domainkit 0.7.0 → 0.9.0

package/dist/testing.mjs

@@ -1,507 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { i as webCryptoLayer, k as parse, l as Revocation, o as Error$1, s as Service, w as project } from "./canonical-json-CQYKsZw7.mjs";
-import { C as authorize, I as Error$2, L as Service$1, R as fromAsync$1, S as apply, V as toAsync$2, _ as ConflictError, at as parse$1, b as StaleError, h as create$1, i as Service$2, it as equals, m as authorize$1, o as toAsync$3, p as apply$1, w as create, x as Target, y as PartialApplyError } from "./resolver-DPJs8h0a.mjs";
-import { DateTime, Effect, Layer, Ref, Schema, Semaphore } from "effect";
-//#region src/stores/in-memory-lifecycle-repository.ts
-var in_memory_lifecycle_repository_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$2,
-	make: () => make$3
-});
-function missing(operation, message) {
-	return new Error$1({
-		category: "storage",
-		message,
-		operation,
-		retry: "never"
-	});
-}
-function conflict$1(operation, message) {
-	return new Error$1({
-		category: "storage",
-		message,
-		operation,
-		retry: "after-user-action"
-	});
-}
-function ownerConnection(aggregate, connectionId, ownerId) {
-	return aggregate.connections.find((connection) => connection.id === connectionId && connection.ownerId === ownerId);
-}
-function publicConnection(connection, authorization, credential) {
-	return project(connection, authorization, credential);
-}
-function make$3(options = {}) {
-	const state = Effect.runSync(Ref.make(/* @__PURE__ */ new Map()));
-	const mutations = Semaphore.makeUnsafe(1);
-	const serialize = (effect) => mutations.withPermit(effect);
-	const commit = Effect.fn("InMemoryManagedDnsConnections.commit")(function* (operation, aggregate) {
-		if (options.beforeCommit !== void 0) yield* options.beforeCommit(operation, aggregate);
-		yield* Ref.update(state, (entries) => {
-			const next = new Map(entries);
-			next.set(aggregate.authorization.id, aggregate);
-			return next;
-		});
-	});
-	const remove = Effect.fn("InMemoryManagedDnsConnections.remove")(function* (operation, authorizationId) {
-		if (options.beforeCommit !== void 0) yield* options.beforeCommit(operation, null);
-		yield* Ref.update(state, (entries) => {
-			const next = new Map(entries);
-			next.delete(authorizationId);
-			return next;
-		});
-	});
-	const get = Effect.fn("ManagedDnsConnections.get")((authorizationId) => Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)));
-	const getByConnectionId = Effect.fn("ManagedDnsConnections.getByConnectionId")((connectionId) => Ref.get(state).pipe(Effect.map((entries) => [...entries.values()].find((aggregate) => aggregate.connections.some((connection) => connection.id === connectionId)) ?? null)));
-	const finishRevocation = Effect.fn("InMemoryManagedDnsConnections.finishRevocation")(function* (aggregate, connection, revoke) {
-		const requestedAt = yield* DateTime.nowAsDate;
-		const pending = {
-			...aggregate,
-			authorization: {
-				...aggregate.authorization,
-				revocation: aggregate.authorization.revocation._tag === "Pending" ? aggregate.authorization.revocation : Revocation.Pending({ requestedAt })
-			}
-		};
-		yield* commit("prepareRevocation", pending);
-		yield* revoke(pending.authorization);
-		yield* remove("completeRevocation", pending.authorization.id);
-		return {
-			connection: publicConnection(connection, pending.authorization, pending.credential),
-			remainingConnections: 0,
-			revokedAuthorization: true
-		};
-	});
-	return Service.of({
-		attach: ({ attachment, connectionId, ownerId }) => serialize(Effect.gen(function* () {
-			const aggregate = yield* getByConnectionId(connectionId);
-			if (aggregate === null) return yield* missing("attach", "Provider connection does not exist");
-			const connection = ownerConnection(aggregate, connectionId, ownerId);
-			if (connection === void 0) return yield* missing("attach", "Provider connection does not belong to this owner");
-			if (attachment.connectionId !== connectionId) return yield* conflict$1("attach", "Domain attachment targets another connection");
-			const existing = aggregate.attachments.find(({ id }) => id === attachment.id);
-			if (existing !== void 0) {
-				if (existing.connectionId !== attachment.connectionId || existing.domain !== attachment.domain || existing.target.accountId !== attachment.target.accountId || existing.target.accountKind !== attachment.target.accountKind || existing.target.zoneId !== attachment.target.zoneId || existing.target.zoneName !== attachment.target.zoneName) return yield* conflict$1("attach", "Domain attachment id is already in use");
-				return {
-					attachment: existing,
-					connection: publicConnection(connection, aggregate.authorization, aggregate.credential)
-				};
-			}
-			if ([...(yield* Ref.get(state)).values()].some((candidate) => candidate.attachments.some(({ id }) => id === attachment.id))) return yield* conflict$1("attach", "Domain attachment id is already in use");
-			if ([...(yield* Ref.get(state)).values()].some((candidate) => {
-				return candidate.attachments.some(({ connectionId: attachmentConnectionId, domain }) => domain === attachment.domain && candidate.connections.some((candidateConnection) => candidateConnection.id === attachmentConnectionId && candidateConnection.ownerId === ownerId));
-			})) return yield* conflict$1("attach", "An organization domain already has a provider attachment");
-			const next = {
-				...aggregate,
-				attachments: [...aggregate.attachments, attachment]
-			};
-			yield* commit("attach", next);
-			return {
-				attachment,
-				connection: publicConnection(connection, aggregate.authorization, aggregate.credential)
-			};
-		})),
-		connect: (input) => serialize(Effect.gen(function* () {
-			const current = (yield* Ref.get(state)).get(input.authorization.id);
-			if (current?.authorization.revocation._tag === "Pending" || input.expectedAuthorizationId !== void 0 && current === void 0) return yield* conflict$1("connect", current === void 0 ? "Provider authorization no longer exists" : "Provider authorization is awaiting revocation recovery");
-			if (input.expectedAuthorizationId !== void 0 && current?.authorization.id !== input.expectedAuthorizationId) return yield* conflict$1("connect", "Provider authorization changed during reconnect");
-			if (input.authorization.id !== input.connection.authorizationId || input.authorization.providerId !== input.connection.providerId || input.authorization.method !== input.connection.method) return yield* conflict$1("connect", "Connection does not match its authorization");
-			const existingConnection = current?.connections.find((connection) => connection.ownerId === input.connection.ownerId);
-			if (input.expectedConnectionId !== void 0 && existingConnection?.id !== input.expectedConnectionId) return yield* conflict$1("connect", "Organization connection changed during reconnect");
-			const connection = existingConnection ?? input.connection;
-			const next = {
-				authorization: input.authorization,
-				connections: current ? [...current.connections.filter(({ id }) => id !== connection.id), connection] : [connection],
-				attachments: current?.attachments ?? [],
-				credential: input.credential
-			};
-			yield* commit("connect", next);
-			return next;
-		})),
-		detach: ({ attachmentId, ownerId }) => serialize(Effect.gen(function* () {
-			const entries = yield* Ref.get(state);
-			for (const aggregate of entries.values()) {
-				const attachment = aggregate.attachments.find(({ id }) => id === attachmentId);
-				if (attachment === void 0) continue;
-				const connection = ownerConnection(aggregate, attachment.connectionId, ownerId);
-				if (connection === void 0) return yield* missing("detach", "Domain attachment does not belong to this owner");
-				const next = {
-					...aggregate,
-					attachments: aggregate.attachments.filter(({ id }) => id !== attachmentId)
-				};
-				yield* commit("detach", next);
-				return {
-					attachment,
-					connection: publicConnection(connection, aggregate.authorization, aggregate.credential),
-					remainingAttachments: next.attachments.filter(({ connectionId }) => connectionId === connection.id).length
-				};
-			}
-			return yield* missing("detach", "Domain attachment does not exist");
-		})),
-		disconnect: ({ connectionId, ownerId, revoke }) => serialize(Effect.gen(function* () {
-			const aggregate = yield* getByConnectionId(connectionId);
-			if (aggregate === null) return yield* missing("disconnect", "Provider connection does not exist");
-			const connection = ownerConnection(aggregate, connectionId, ownerId);
-			if (connection === void 0) return yield* missing("disconnect", "Provider connection does not belong to this owner");
-			if (aggregate.attachments.some(({ connectionId: id }) => id === connectionId)) return yield* conflict$1("disconnect", "Detach all organization domains before disconnecting the provider");
-			const remainingConnections = aggregate.connections.filter(({ id }) => id !== connectionId);
-			if (remainingConnections.length > 0) {
-				const next = {
-					...aggregate,
-					connections: remainingConnections
-				};
-				yield* commit("disconnectConnection", next);
-				return {
-					connection: publicConnection(connection, aggregate.authorization, aggregate.credential),
-					remainingConnections: remainingConnections.length,
-					revokedAuthorization: false
-				};
-			}
-			return yield* finishRevocation(aggregate, connection, revoke);
-		}).pipe(Effect.withSpan("ManagedDnsConnections.disconnect"))),
-		findConnection: (ownerId, authorizationId) => Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId)?.connections.find(({ ownerId: id }) => id === ownerId) ?? null)),
-		get,
-		getAttachment: (attachmentId) => Ref.get(state).pipe(Effect.map((entries) => [...entries.values()].flatMap(({ attachments }) => attachments).find(({ id }) => id === attachmentId) ?? null)),
-		getByConnectionId,
-		listAttachments: (connectionId, ownerId) => Effect.gen(function* () {
-			const aggregate = yield* getByConnectionId(connectionId);
-			if (aggregate === null) return yield* missing("listAttachments", "Provider connection does not exist");
-			if (ownerConnection(aggregate, connectionId, ownerId) === void 0) return yield* missing("listAttachments", "Provider connection does not belong to this owner");
-			return aggregate.attachments.filter(({ connectionId: id }) => id === connectionId);
-		}),
-		promoteEvidence: (authorizationId, evidence) => serialize(Effect.gen(function* () {
-			const aggregate = yield* get(authorizationId);
-			if (aggregate === null) return yield* missing("promoteEvidence", "Provider authorization does not exist");
-			const byCapability = new Map(aggregate.authorization.capabilityEvidence.map((item) => [item.capability, item]));
-			for (const item of evidence) byCapability.set(item.capability, item);
-			const next = {
-				...aggregate,
-				authorization: {
-					...aggregate.authorization,
-					capabilityEvidence: [...byCapability.values()]
-				}
-			};
-			yield* commit("promoteEvidence", next);
-			return next;
-		})),
-		recover: ({ authorizationId, revoke }) => serialize(Effect.gen(function* () {
-			const aggregate = yield* get(authorizationId);
-			if (aggregate === null) return yield* missing("recover", "Provider authorization does not exist");
-			if (aggregate.authorization.revocation._tag !== "Pending") return yield* missing("recover", "Provider authorization is not awaiting revocation");
-			const connection = aggregate.connections[0];
-			if (connection === void 0) return yield* missing("recover", "Pending authorization has no connection");
-			return yield* finishRevocation(aggregate, connection, revoke);
-		}).pipe(Effect.withSpan("ManagedDnsConnections.recover"))),
-		rotate: (authorizationId, credential) => serialize(Effect.gen(function* () {
-			const aggregate = yield* get(authorizationId);
-			if (aggregate === null) return yield* missing("rotate", "Provider authorization does not exist");
-			const next = {
-				...aggregate,
-				credential
-			};
-			yield* commit("rotate", next);
-			return next;
-		}))
-	});
-}
-const layer$2 = (options = {}) => Layer.sync(Service, () => make$3(options));
-//#endregion
-//#region src/stores/in-memory-continuation.ts
-var in_memory_continuation_exports = /* @__PURE__ */ __exportAll({ make: () => make$2 });
-function make$2() {
-	const state = Effect.runSync(Ref.make(/* @__PURE__ */ new Map()));
-	return {
-		consume: Effect.fn("ConnectionContinuations.consume")(function* (id, now) {
-			return yield* Ref.modify(state, (entries) => {
-				const continuation = entries.get(id);
-				const next = new Map(entries);
-				next.delete(id);
-				return [continuation !== void 0 && continuation.expiresAt > now ? continuation : null, next];
-			});
-		}),
-		put: Effect.fn("ConnectionContinuations.put")((continuation) => Ref.update(state, (entries) => {
-			const next = new Map(entries);
-			next.set(continuation.id, continuation);
-			return next;
-		}))
-	};
-}
-//#endregion
-//#region src/provider/in-memory.ts
-var in_memory_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$1,
-	make: () => make$1,
-	toAsync: () => toAsync$1
-});
-function make$1(options = {}) {
-	const id = options.id ?? "memory";
-	const records = /* @__PURE__ */ new Map();
-	const recordIds = /* @__PURE__ */ new Map();
-	for (const [zone, initial] of Object.entries(options.records ?? {})) {
-		records.set(parse(zone), [...initial]);
-		for (const [index, record] of initial.entries()) recordIds.set(`${id}:${index + 1}`, record);
-	}
-	return {
-		id,
-		listRecords: Effect.fn("InMemoryDnsProvider.listRecords")((zone) => Effect.sync(() => [...records.get(zone) ?? []])),
-		createRecord: Effect.fn("InMemoryDnsProvider.createRecord")((zone, record) => Effect.sync(() => {
-			const current = records.get(zone) ?? [];
-			current.push(record);
-			records.set(zone, current);
-			const providerRecordId = `${id}:${current.length}`;
-			recordIds.set(providerRecordId, record);
-			return { providerRecordId };
-		})),
-		deleteRecord: Effect.fn("InMemoryDnsProvider.deleteRecord")((zone, providerRecordId) => Effect.sync(() => {
-			const record = recordIds.get(providerRecordId);
-			if (record === void 0) return;
-			records.set(zone, (records.get(zone) ?? []).filter((candidate) => candidate !== record));
-			recordIds.delete(providerRecordId);
-		})),
-		getRecord: Effect.fn("InMemoryDnsProvider.getRecord")((_zone, providerRecordId) => Effect.sync(() => recordIds.get(providerRecordId) ?? null))
-	};
-}
-const layer$1 = (options = {}) => Layer.succeed(Service$1, make$1(options));
-const toAsync$1 = (options = {}) => toAsync$2(make$1(options));
-//#endregion
-//#region src/verification/in-memory.ts
-var in_memory_exports$1 = /* @__PURE__ */ __exportAll({
-	layer: () => layer,
-	make: () => make,
-	toAsync: () => toAsync
-});
-function make(resolve) {
-	return { resolve: Effect.fn("InMemoryDnsResolver.resolve")((query) => Effect.suspend(() => {
-		const resolution = resolve(query);
-		return Effect.isEffect(resolution) ? resolution : Effect.succeed(resolution);
-	})) };
-}
-const layer = (resolve) => Layer.succeed(Service$2, make(resolve));
-const toAsync = (resolve) => toAsync$3(make(resolve));
-//#endregion
-//#region src/testing/provider-conformance.ts
-var provider_conformance_exports = /* @__PURE__ */ __exportAll({
-	Error: () => Error,
-	fromAsync: () => fromAsync,
-	run: () => run
-});
-var Error = class extends Schema.TaggedError()("ProviderConformanceError", {
-	case: Schema.String,
-	message: Schema.String,
-	providerId: Schema.String
-}) {};
-/** Adapt a fresh Promise-shaped provider factory for the Effect-native conformance runner. */
-function fromAsync(makeProvider) {
-	return () => Effect.sync(() => fromAsync$1(makeProvider()));
-}
-const cases = [
-	"create-readback-cleanup",
-	"exact-noop",
-	"conflict",
-	"stale-plan",
-	"partial-apply-cleanup"
-];
-/** Run the deterministic offline contract every DomainKit DNS adapter must satisfy. */
-const run = Effect.fn("ProviderConformance.run")(function* (input) {
-	const makeProvider = () => Effect.suspend(input.makeProvider).pipe(Effect.catchDefect((cause) => Effect.fail(new Error({
-		case: "factory",
-		message: cause instanceof globalThis.Error ? cause.message : "Provider factory failed",
-		providerId: "unknown"
-	}))));
-	const first = yield* makeProvider();
-	const providerId = first.id;
-	const prefix = input.prefix ?? "domainkit-conformance";
-	yield* createReadbackCleanup(first, input.zone, prefix);
-	yield* exactNoop(yield* makeProvider(), input.zone, prefix);
-	yield* conflict(yield* makeProvider(), input.zone, prefix);
-	yield* stalePlan(yield* makeProvider(), input.zone, prefix);
-	yield* partialApplyCleanup(yield* makeProvider(), input.zone, prefix);
-	return {
-		cases,
-		providerId,
-		zone: input.zone
-	};
-});
-function createReadbackCleanup(provider, zone, prefix) {
-	const requirements = createRequirements(zone, prefix);
-	let cleanupRecordIds = [];
-	return Effect.gen(function* () {
-		const { plan } = yield* create({
-			requirements,
-			target: Target.ExactZone({ zone })
-		});
-		yield* requireTags(provider, "create-readback-cleanup", plan.operations, ["create", "create"]);
-		const receipt = yield* apply({
-			authorization: yield* authorize(plan),
-			plan
-		}).pipe(Effect.tapError((failure) => failure instanceof PartialApplyError ? Effect.sync(() => {
-			cleanupRecordIds = providerRecordIds(failure.receipt.operations);
-		}) : Effect.void));
-		cleanupRecordIds = providerRecordIds(receipt.operations);
-		yield* requireCondition(provider, "create-readback-cleanup", receipt.status === "complete" && receipt.operations.every(({ providerRecordId }) => providerRecordId !== null), "apply must return a complete receipt with provider record IDs");
-		const observed = yield* provider.listRecords(zone);
-		yield* requireCondition(provider, "create-readback-cleanup", requirements.every((requirement) => observed.some((record) => record._tag !== "Opaque" && equals(record, requirement))), "listRecords must return every created record, including across provider pages");
-		const deletion = yield* create$1({
-			plan,
-			receipt
-		});
-		yield* requireCondition(provider, "create-readback-cleanup", (yield* apply$1({
-			authorization: yield* authorize$1(deletion),
-			plan: deletion
-		})).status === "complete" && (yield* recordIdsAbsent(provider, zone, cleanupRecordIds)), "receipt-bound cleanup must remove every created record");
-	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
-}
-function exactNoop(provider, zone, prefix) {
-	const requirement = cname(zone, `${prefix}-exact`);
-	let cleanupRecordIds = [];
-	return Effect.gen(function* () {
-		const created = yield* provider.createRecord(zone, requirement);
-		cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];
-		const { plan } = yield* create({
-			requirements: [requirement],
-			target: Target.ExactZone({ zone })
-		});
-		yield* requireTags(provider, "exact-noop", plan.operations, ["noop"]);
-		yield* requireCondition(provider, "exact-noop", (yield* apply({
-			authorization: yield* authorize(plan),
-			plan
-		})).operations.length === 0, "an exact plan must not create another record");
-		yield* deleteCreated(provider, zone, created.providerRecordId, "exact-noop");
-	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
-}
-function conflict(provider, zone, prefix) {
-	const requirement = cname(zone, `${prefix}-conflict`);
-	const occupied = txt(zone, `${prefix}-conflict`, "occupied");
-	let cleanupRecordIds = [];
-	return Effect.gen(function* () {
-		const created = yield* provider.createRecord(zone, occupied);
-		cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];
-		const { plan } = yield* create({
-			requirements: [requirement],
-			target: Target.ExactZone({ zone })
-		});
-		yield* requireTags(provider, "conflict", plan.operations, ["conflict"]);
-		yield* requireCondition(provider, "conflict", (yield* apply({
-			authorization: yield* authorize(plan),
-			plan
-		}).pipe(Effect.flip)) instanceof ConflictError, "apply must fail closed on incompatible state");
-		yield* deleteCreated(provider, zone, created.providerRecordId, "conflict");
-	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
-}
-function stalePlan(provider, zone, prefix) {
-	const requirement = cname(zone, `${prefix}-stale`);
-	let cleanupRecordIds = [];
-	return Effect.gen(function* () {
-		const { plan } = yield* create({
-			requirements: [requirement],
-			target: Target.ExactZone({ zone })
-		});
-		const authorization = yield* authorize(plan);
-		const created = yield* provider.createRecord(zone, requirement);
-		cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];
-		yield* requireCondition(provider, "stale-plan", (yield* apply({
-			authorization,
-			plan
-		}).pipe(Effect.flip)) instanceof StaleError, "apply must reject provider state that changed after authorization");
-		yield* deleteCreated(provider, zone, created.providerRecordId, "stale-plan");
-	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(provider)));
-}
-function partialApplyCleanup(provider, zone, prefix) {
-	let creates = 0;
-	const flaky = Service$1.of({
-		...provider,
-		createRecord: Effect.fn("ProviderConformance.createRecord")((target, record) => {
-			creates += 1;
-			return creates === 1 ? provider.createRecord(target, record) : Effect.fail(new Error$2({
-				message: "injected conformance failure",
-				operation: "createRecord",
-				providerId: provider.id
-			}));
-		})
-	});
-	const requirements = [cname(zone, `${prefix}-partial-one`), txt(zone, `${prefix}-partial-two`, "domainkit")];
-	let cleanupRecordIds = [];
-	return Effect.gen(function* () {
-		const { plan } = yield* create({
-			requirements,
-			target: Target.ExactZone({ zone })
-		});
-		const failure = yield* apply({
-			authorization: yield* authorize(plan),
-			plan
-		}).pipe(Effect.flip);
-		cleanupRecordIds = failure instanceof PartialApplyError ? providerRecordIds(failure.receipt.operations) : [];
-		yield* requireCondition(provider, "partial-apply-cleanup", failure instanceof PartialApplyError && failure.receipt.operations.length === 1, "a later write failure must preserve the first confirmed write in a partial receipt");
-		if (!(failure instanceof PartialApplyError)) return;
-		const deletion = yield* create$1({
-			plan,
-			receipt: failure.receipt
-		}).pipe(Effect.provide(providerLayer(provider)));
-		yield* apply$1({
-			authorization: yield* authorize$1(deletion),
-			plan: deletion
-		}).pipe(Effect.provide(providerLayer(provider)));
-		yield* requireCondition(provider, "partial-apply-cleanup", yield* recordIdsAbsent(provider, zone, cleanupRecordIds), "partial receipt cleanup must remove the confirmed write");
-	}).pipe(Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)), Effect.provide(providerLayer(flaky)));
-}
-function providerRecordIds(operations) {
-	return operations.flatMap(({ providerRecordId }) => providerRecordId === null ? [] : [providerRecordId]);
-}
-function recordIdsAbsent(provider, zone, recordIds) {
-	return Effect.forEach(recordIds, (providerRecordId) => provider.getRecord(zone, providerRecordId)).pipe(Effect.map((records) => records.every((record) => record === null)));
-}
-function bestEffortDelete(provider, zone, recordIds) {
-	return Effect.suspend(() => Effect.forEach(recordIds(), (providerRecordId) => provider.deleteRecord(zone, providerRecordId).pipe(Effect.ignore), { discard: true }));
-}
-function providerLayer(provider) {
-	return Layer.merge(Layer.succeed(Service$1, provider), webCryptoLayer);
-}
-function createRequirements(zone, prefix) {
-	return [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, "domainkit")];
-}
-function cname(zone, label) {
-	return parse$1({
-		_tag: "CNAME",
-		metadata: {
-			ownership: "tester",
-			provenance: "domainkit",
-			purpose: "conformance"
-		},
-		name: `${label}.${zone}`,
-		policy: "exclusive",
-		target: "target.example.net",
-		ttl: 300
-	});
-}
-function txt(zone, label, value) {
-	return parse$1({
-		_tag: "TXT",
-		metadata: {
-			ownership: "tester",
-			provenance: "domainkit",
-			purpose: "conformance"
-		},
-		name: `${label}.${zone}`,
-		policy: "append",
-		ttl: 300,
-		value
-	});
-}
-function requireTags(provider, testCase, operations, expected) {
-	return requireCondition(provider, testCase, JSON.stringify(operations.map(({ _tag }) => _tag)) === JSON.stringify(expected), `expected operations ${expected.join(", ")}`);
-}
-function requireCondition(provider, testCase, condition, message) {
-	return condition ? Effect.void : Effect.fail(new Error({
-		case: testCase,
-		message,
-		providerId: provider.id
-	}));
-}
-function deleteCreated(provider, zone, providerRecordId, testCase) {
-	return providerRecordId === null ? Effect.fail(new Error({
-		case: testCase,
-		message: "provider must return record IDs for safe cleanup",
-		providerId: provider.id
-	})) : provider.deleteRecord(zone, providerRecordId);
-}
-//#endregion
-export { in_memory_continuation_exports as InMemoryConnectionContinuations, in_memory_exports as InMemoryDnsProvider, in_memory_exports$1 as InMemoryDnsResolver, in_memory_lifecycle_repository_exports as InMemoryManagedDnsConnections, provider_conformance_exports as ProviderConformance };
-
-//# sourceMappingURL=testing.mjs.map

package/dist/testing.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"testing.mjs","names":["Lifecycle.Error","conflict","Connection.project","make","layer","Lifecycle.Service","make","make","DomainName.parse","layer","DnsProvider.Service","toAsync","DnsProvider.toAsync","DnsResolver.Service","DnsResolver.toAsync","DnsProvider.fromAsync","Provisioning.create","Provisioning.apply","Provisioning.authorize","Provisioning.PartialApplyError","DnsRecord.equals","Deletion.create","Deletion.apply","Deletion.authorize","Provisioning.ConflictError","Provisioning.StaleError","DnsProvider.Error","DnsProvider.Service","Digest.webCryptoLayer","DnsRecord.parse"],"sources":["../src/stores/in-memory-lifecycle-repository.ts","../src/stores/in-memory-continuation.ts","../src/provider/in-memory.ts","../src/verification/in-memory.ts","../src/testing/provider-conformance.ts"],"sourcesContent":["import { DateTime, Effect, Layer, Ref, Semaphore } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface Options {\n  readonly beforeCommit?: (\n    operation: string,\n    aggregate: Lifecycle.Aggregate | null,\n  ) => Effect.Effect<void, Lifecycle.Error>;\n}\n\nfunction missing(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"never\",\n  });\n}\n\nfunction conflict(operation: string, message: string): Lifecycle.Error {\n  return new Lifecycle.Error({\n    category: \"storage\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n}\n\nfunction ownerConnection(\n  aggregate: Lifecycle.Aggregate,\n  connectionId: string,\n  ownerId: string,\n): Connection.StoredConnection | undefined {\n  return aggregate.connections.find(\n    (connection) => connection.id === connectionId && connection.ownerId === ownerId,\n  );\n}\n\nfunction publicConnection(\n  connection: Connection.StoredConnection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  credential: Connection.StoredCredential,\n): Connection.ProviderConnection {\n  return Connection.project(connection, authorization, credential);\n}\n\nexport function make(options: Options = {}): Lifecycle.Interface {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Lifecycle.Aggregate>>(new Map()));\n  const mutations = Semaphore.makeUnsafe(1);\n  const serialize = <A, E, R>(effect: Effect.Effect<A, E, R>) => mutations.withPermit(effect);\n\n  const commit = Effect.fn(\"InMemoryManagedDnsConnections.commit\")(function* (\n    operation: string,\n    aggregate: Lifecycle.Aggregate,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, aggregate);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.set(aggregate.authorization.id, aggregate);\n      return next;\n    });\n  });\n\n  const remove = Effect.fn(\"InMemoryManagedDnsConnections.remove\")(function* (\n    operation: string,\n    authorizationId: string,\n  ) {\n    if (options.beforeCommit !== undefined) yield* options.beforeCommit(operation, null);\n    yield* Ref.update(state, (entries) => {\n      const next = new Map(entries);\n      next.delete(authorizationId);\n      return next;\n    });\n  });\n\n  const get = Effect.fn(\"ManagedDnsConnections.get\")((authorizationId: string) =>\n    Ref.get(state).pipe(Effect.map((entries) => entries.get(authorizationId) ?? null)),\n  );\n\n  const getByConnectionId = Effect.fn(\"ManagedDnsConnections.getByConnectionId\")(\n    (connectionId: string) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()].find((aggregate) =>\n              aggregate.connections.some((connection) => connection.id === connectionId),\n            ) ?? null,\n        ),\n      ),\n  );\n\n  const finishRevocation = Effect.fn(\"InMemoryManagedDnsConnections.finishRevocation\")(function* <\n    E,\n  >(\n    aggregate: Lifecycle.Aggregate,\n    connection: Connection.StoredConnection,\n    revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Effect.Effect<void, E>,\n  ) {\n    const requestedAt = yield* DateTime.nowAsDate;\n    const pending: Lifecycle.Aggregate = {\n      ...aggregate,\n      authorization: {\n        ...aggregate.authorization,\n        revocation:\n          aggregate.authorization.revocation._tag === \"Pending\"\n            ? aggregate.authorization.revocation\n            : ProviderAuthorization.Revocation.Pending({ requestedAt }),\n      },\n    };\n    yield* commit(\"prepareRevocation\", pending);\n    yield* revoke(pending.authorization);\n    yield* remove(\"completeRevocation\", pending.authorization.id);\n    return {\n      connection: publicConnection(connection, pending.authorization, pending.credential),\n      remainingConnections: 0,\n      revokedAuthorization: true,\n    } satisfies Lifecycle.DisconnectResult;\n  });\n\n  return Lifecycle.Service.of({\n    attach: ({ attachment, connectionId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"attach\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\"attach\", \"Provider connection does not belong to this owner\");\n          }\n          if (attachment.connectionId !== connectionId) {\n            return yield* conflict(\"attach\", \"Domain attachment targets another connection\");\n          }\n          const existing = aggregate.attachments.find(({ id }) => id === attachment.id);\n          if (existing !== undefined) {\n            if (\n              existing.connectionId !== attachment.connectionId ||\n              existing.domain !== attachment.domain ||\n              existing.target.accountId !== attachment.target.accountId ||\n              existing.target.accountKind !== attachment.target.accountKind ||\n              existing.target.zoneId !== attachment.target.zoneId ||\n              existing.target.zoneName !== attachment.target.zoneName\n            ) {\n              return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n            }\n            return {\n              attachment: existing,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n            };\n          }\n          const duplicateId = [...(yield* Ref.get(state)).values()].some((candidate) =>\n            candidate.attachments.some(({ id }) => id === attachment.id),\n          );\n          if (duplicateId) {\n            return yield* conflict(\"attach\", \"Domain attachment id is already in use\");\n          }\n          const duplicate = [...(yield* Ref.get(state)).values()].some((candidate) => {\n            return candidate.attachments.some(\n              ({ connectionId: attachmentConnectionId, domain }) =>\n                domain === attachment.domain &&\n                candidate.connections.some(\n                  (candidateConnection) =>\n                    candidateConnection.id === attachmentConnectionId &&\n                    candidateConnection.ownerId === ownerId,\n                ),\n            );\n          });\n          if (duplicate) {\n            return yield* conflict(\n              \"attach\",\n              \"An organization domain already has a provider attachment\",\n            );\n          }\n          const next: Lifecycle.Aggregate = {\n            ...aggregate,\n            attachments: [...aggregate.attachments, attachment],\n          };\n          yield* commit(\"attach\", next);\n          return {\n            attachment,\n            connection: publicConnection(connection, aggregate.authorization, aggregate.credential),\n          };\n        }),\n      ),\n    connect: (input) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          const current = entries.get(input.authorization.id);\n          if (\n            current?.authorization.revocation._tag === \"Pending\" ||\n            (input.expectedAuthorizationId !== undefined && current === undefined)\n          ) {\n            return yield* conflict(\n              \"connect\",\n              current === undefined\n                ? \"Provider authorization no longer exists\"\n                : \"Provider authorization is awaiting revocation recovery\",\n            );\n          }\n          if (\n            input.expectedAuthorizationId !== undefined &&\n            current?.authorization.id !== input.expectedAuthorizationId\n          ) {\n            return yield* conflict(\"connect\", \"Provider authorization changed during reconnect\");\n          }\n          if (\n            input.authorization.id !== input.connection.authorizationId ||\n            input.authorization.providerId !== input.connection.providerId ||\n            input.authorization.method !== input.connection.method\n          ) {\n            return yield* conflict(\"connect\", \"Connection does not match its authorization\");\n          }\n          const existingConnection = current?.connections.find(\n            (connection) => connection.ownerId === input.connection.ownerId,\n          );\n          if (\n            input.expectedConnectionId !== undefined &&\n            existingConnection?.id !== input.expectedConnectionId\n          ) {\n            return yield* conflict(\"connect\", \"Organization connection changed during reconnect\");\n          }\n          const connection = existingConnection ?? input.connection;\n          const next: Lifecycle.Aggregate = {\n            authorization: input.authorization,\n            connections: current\n              ? [...current.connections.filter(({ id }) => id !== connection.id), connection]\n              : [connection],\n            attachments: current?.attachments ?? [],\n            credential: input.credential,\n          };\n          yield* commit(\"connect\", next);\n          return next;\n        }),\n      ),\n    detach: ({ attachmentId, ownerId }) =>\n      serialize(\n        Effect.gen(function* () {\n          const entries = yield* Ref.get(state);\n          for (const aggregate of entries.values()) {\n            const attachment = aggregate.attachments.find(({ id }) => id === attachmentId);\n            if (attachment === undefined) continue;\n            const connection = ownerConnection(aggregate, attachment.connectionId, ownerId);\n            if (connection === undefined) {\n              return yield* missing(\"detach\", \"Domain attachment does not belong to this owner\");\n            }\n            const next: Lifecycle.Aggregate = {\n              ...aggregate,\n              attachments: aggregate.attachments.filter(({ id }) => id !== attachmentId),\n            };\n            yield* commit(\"detach\", next);\n            return {\n              attachment,\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingAttachments: next.attachments.filter(\n                ({ connectionId }) => connectionId === connection.id,\n              ).length,\n            };\n          }\n          return yield* missing(\"detach\", \"Domain attachment does not exist\");\n        }),\n      ),\n    disconnect: ({ connectionId, ownerId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* getByConnectionId(connectionId);\n          if (aggregate === null) {\n            return yield* missing(\"disconnect\", \"Provider connection does not exist\");\n          }\n          const connection = ownerConnection(aggregate, connectionId, ownerId);\n          if (connection === undefined) {\n            return yield* missing(\n              \"disconnect\",\n              \"Provider connection does not belong to this owner\",\n            );\n          }\n          if (aggregate.attachments.some(({ connectionId: id }) => id === connectionId)) {\n            return yield* conflict(\n              \"disconnect\",\n              \"Detach all organization domains before disconnecting the provider\",\n            );\n          }\n          const remainingConnections = aggregate.connections.filter(\n            ({ id }) => id !== connectionId,\n          );\n          if (remainingConnections.length > 0) {\n            const next: Lifecycle.Aggregate = { ...aggregate, connections: remainingConnections };\n            yield* commit(\"disconnectConnection\", next);\n            return {\n              connection: publicConnection(\n                connection,\n                aggregate.authorization,\n                aggregate.credential,\n              ),\n              remainingConnections: remainingConnections.length,\n              revokedAuthorization: false,\n            };\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.disconnect\")),\n      ),\n    findConnection: (ownerId, authorizationId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            entries.get(authorizationId)?.connections.find(({ ownerId: id }) => id === ownerId) ??\n            null,\n        ),\n      ),\n    get,\n    getAttachment: (attachmentId) =>\n      Ref.get(state).pipe(\n        Effect.map(\n          (entries) =>\n            [...entries.values()]\n              .flatMap(({ attachments }) => attachments)\n              .find(({ id }) => id === attachmentId) ?? null,\n        ),\n      ),\n    getByConnectionId,\n    listAttachments: (connectionId, ownerId) =>\n      Effect.gen(function* () {\n        const aggregate = yield* getByConnectionId(connectionId);\n        if (aggregate === null) {\n          return yield* missing(\"listAttachments\", \"Provider connection does not exist\");\n        }\n        if (ownerConnection(aggregate, connectionId, ownerId) === undefined) {\n          return yield* missing(\n            \"listAttachments\",\n            \"Provider connection does not belong to this owner\",\n          );\n        }\n        return aggregate.attachments.filter(({ connectionId: id }) => id === connectionId);\n      }),\n    promoteEvidence: (authorizationId, evidence) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"promoteEvidence\", \"Provider authorization does not exist\");\n          }\n          const byCapability = new Map(\n            aggregate.authorization.capabilityEvidence.map((item) => [item.capability, item]),\n          );\n          for (const item of evidence) byCapability.set(item.capability, item);\n          const next = {\n            ...aggregate,\n            authorization: {\n              ...aggregate.authorization,\n              capabilityEvidence: [...byCapability.values()],\n            },\n          };\n          yield* commit(\"promoteEvidence\", next);\n          return next;\n        }),\n      ),\n    recover: ({ authorizationId, revoke }) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"recover\", \"Provider authorization does not exist\");\n          }\n          if (aggregate.authorization.revocation._tag !== \"Pending\") {\n            return yield* missing(\"recover\", \"Provider authorization is not awaiting revocation\");\n          }\n          const connection = aggregate.connections[0];\n          if (connection === undefined) {\n            return yield* missing(\"recover\", \"Pending authorization has no connection\");\n          }\n          return yield* finishRevocation(aggregate, connection, revoke);\n        }).pipe(Effect.withSpan(\"ManagedDnsConnections.recover\")),\n      ),\n    rotate: (authorizationId, credential) =>\n      serialize(\n        Effect.gen(function* () {\n          const aggregate = yield* get(authorizationId);\n          if (aggregate === null) {\n            return yield* missing(\"rotate\", \"Provider authorization does not exist\");\n          }\n          const next = {\n            ...aggregate,\n            credential,\n          };\n          yield* commit(\"rotate\", next);\n          return next;\n        }),\n      ),\n  });\n}\n\nexport const layer = (options: Options = {}) => Layer.sync(Lifecycle.Service, () => make(options));\n","import { Effect, Ref } from \"effect\";\n\nimport type * as Connection from \"../auth/connect.ts\";\n\nexport function make(): Connection.ContinuationStore {\n  const state = Effect.runSync(Ref.make<ReadonlyMap<string, Connection.Continuation>>(new Map()));\n  return {\n    consume: Effect.fn(\"ConnectionContinuations.consume\")(function* (id, now) {\n      return yield* Ref.modify(state, (entries) => {\n        const continuation = entries.get(id);\n        const next = new Map(entries);\n        next.delete(id);\n        return [\n          continuation !== undefined && continuation.expiresAt > now ? continuation : null,\n          next,\n        ] as const;\n      });\n    }),\n    put: Effect.fn(\"ConnectionContinuations.put\")((continuation) =>\n      Ref.update(state, (entries) => {\n        const next = new Map(entries);\n        next.set(continuation.id, continuation);\n        return next;\n      }),\n    ),\n  };\n}\n","import { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsProvider from \"./provider.ts\";\n\nexport interface Options {\n  readonly id?: string;\n  readonly records?: Readonly<Record<string, ReadonlyArray<DnsRecord.Observed>>>;\n}\n\nexport function make(options: Options = {}): DnsProvider.Interface {\n  const id = options.id ?? \"memory\";\n  const records = new Map<DomainName.DomainName, Array<DnsRecord.Observed>>();\n  const recordIds = new Map<string, DnsRecord.Observed>();\n  for (const [zone, initial] of Object.entries(options.records ?? {})) {\n    records.set(DomainName.parse(zone), [...initial]);\n    for (const [index, record] of initial.entries()) recordIds.set(`${id}:${index + 1}`, record);\n  }\n  return {\n    id,\n    listRecords: Effect.fn(\"InMemoryDnsProvider.listRecords\")((zone) =>\n      Effect.sync(() => [...(records.get(zone) ?? [])]),\n    ),\n    createRecord: Effect.fn(\"InMemoryDnsProvider.createRecord\")((zone, record) =>\n      Effect.sync(() => {\n        const current = records.get(zone) ?? [];\n        current.push(record);\n        records.set(zone, current);\n        const providerRecordId = `${id}:${current.length}`;\n        recordIds.set(providerRecordId, record);\n        return { providerRecordId };\n      }),\n    ),\n    deleteRecord: Effect.fn(\"InMemoryDnsProvider.deleteRecord\")((zone, providerRecordId) =>\n      Effect.sync(() => {\n        const record = recordIds.get(providerRecordId);\n        if (record === undefined) return;\n        records.set(\n          zone,\n          (records.get(zone) ?? []).filter((candidate) => candidate !== record),\n        );\n        recordIds.delete(providerRecordId);\n      }),\n    ),\n    getRecord: Effect.fn(\"InMemoryDnsProvider.getRecord\")((_zone, providerRecordId) =>\n      Effect.sync(() => recordIds.get(providerRecordId) ?? null),\n    ),\n  };\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsProvider.Service> =>\n  Layer.succeed(DnsProvider.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsProvider.AsyncInterface =>\n  DnsProvider.toAsync(make(options));\n","import { Effect, Layer } from \"effect\";\n\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Resolve = (\n  query: DnsResolver.Query,\n) => DnsResolver.Resolution | Effect.Effect<DnsResolver.Resolution, DnsResolver.Error>;\n\nexport function make(resolve: Resolve): DnsResolver.Interface {\n  return {\n    resolve: Effect.fn(\"InMemoryDnsResolver.resolve\")((query) =>\n      Effect.suspend(() => {\n        const resolution = resolve(query);\n        return Effect.isEffect(resolution) ? resolution : Effect.succeed(resolution);\n      }),\n    ),\n  };\n}\n\nexport const layer = (resolve: Resolve): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(resolve));\n\nexport const toAsync = (resolve: Resolve): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(resolve));\n","import { Effect, Layer, Schema } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as Deletion from \"../plan/deletion.ts\";\nimport * as Digest from \"../plan/canonical-json.ts\";\nimport * as Provisioning from \"../plan/plan.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"ProviderConformanceError\", {\n  case: Schema.String,\n  message: Schema.String,\n  providerId: Schema.String,\n}) {}\n\nexport interface Input {\n  readonly makeProvider: () => Effect.Effect<DnsProvider.Interface, DnsProvider.Error>;\n  readonly prefix?: string;\n  readonly zone: DomainName.DomainName;\n}\n\nexport interface Report {\n  readonly cases: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: DomainName.DomainName;\n}\n\n/** Adapt a fresh Promise-shaped provider factory for the Effect-native conformance runner. */\nexport function fromAsync(makeProvider: () => DnsProvider.AsyncInterface): Input[\"makeProvider\"] {\n  return () => Effect.sync(() => DnsProvider.fromAsync(makeProvider()));\n}\n\nconst cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n] as const;\n\n/** Run the deterministic offline contract every DomainKit DNS adapter must satisfy. */\nexport const run = Effect.fn(\"ProviderConformance.run\")(function* (input: Input) {\n  const makeProvider = () =>\n    Effect.suspend(input.makeProvider).pipe(\n      Effect.catchDefect((cause) =>\n        Effect.fail(\n          new Error({\n            case: \"factory\",\n            message: cause instanceof globalThis.Error ? cause.message : \"Provider factory failed\",\n            providerId: \"unknown\",\n          }),\n        ),\n      ),\n    );\n  const first = yield* makeProvider();\n  const providerId = first.id;\n  const prefix = input.prefix ?? \"domainkit-conformance\";\n  yield* createReadbackCleanup(first, input.zone, prefix);\n  yield* exactNoop(yield* makeProvider(), input.zone, prefix);\n  yield* conflict(yield* makeProvider(), input.zone, prefix);\n  yield* stalePlan(yield* makeProvider(), input.zone, prefix);\n  yield* partialApplyCleanup(yield* makeProvider(), input.zone, prefix);\n  return { cases, providerId, zone: input.zone } satisfies Report;\n});\n\nfunction createReadbackCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  const requirements = createRequirements(zone, prefix);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"create-readback-cleanup\", plan.operations, [\"create\", \"create\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(\n      Effect.tapError((failure) =>\n        failure instanceof Provisioning.PartialApplyError\n          ? Effect.sync(() => {\n              cleanupRecordIds = providerRecordIds(failure.receipt.operations);\n            })\n          : Effect.void,\n      ),\n    );\n    cleanupRecordIds = providerRecordIds(receipt.operations);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      receipt.status === \"complete\" &&\n        receipt.operations.every(({ providerRecordId }) => providerRecordId !== null),\n      \"apply must return a complete receipt with provider record IDs\",\n    );\n    const observed = yield* provider.listRecords(zone);\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      requirements.every((requirement) =>\n        observed.some(\n          (record) => record._tag !== \"Opaque\" && DnsRecord.equals(record, requirement),\n        ),\n      ),\n      \"listRecords must return every created record, including across provider pages\",\n    );\n    const deletion = yield* Deletion.create({ plan, receipt });\n    const deletionReceipt = yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    });\n    yield* requireCondition(\n      provider,\n      \"create-readback-cleanup\",\n      deletionReceipt.status === \"complete\" &&\n        (yield* recordIdsAbsent(provider, zone, cleanupRecordIds)),\n      \"receipt-bound cleanup must remove every created record\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction exactNoop(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-exact`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"exact-noop\", plan.operations, [\"noop\"]);\n    const receipt = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    });\n    yield* requireCondition(\n      provider,\n      \"exact-noop\",\n      receipt.operations.length === 0,\n      \"an exact plan must not create another record\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"exact-noop\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction conflict(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-conflict`);\n  const occupied = txt(zone, `${prefix}-conflict`, \"occupied\");\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const created = yield* provider.createRecord(zone, occupied);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    yield* requireTags(provider, \"conflict\", plan.operations, [\"conflict\"]);\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"conflict\",\n      failure instanceof Provisioning.ConflictError,\n      \"apply must fail closed on incompatible state\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"conflict\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction stalePlan(provider: DnsProvider.Interface, zone: DomainName.DomainName, prefix: string) {\n  const requirement = cname(zone, `${prefix}-stale`);\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements: [requirement],\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const authorization = yield* Provisioning.authorize(plan);\n    const created = yield* provider.createRecord(zone, requirement);\n    cleanupRecordIds = created.providerRecordId === null ? [] : [created.providerRecordId];\n    const failure = yield* Provisioning.apply({ authorization, plan }).pipe(Effect.flip);\n    yield* requireCondition(\n      provider,\n      \"stale-plan\",\n      failure instanceof Provisioning.StaleError,\n      \"apply must reject provider state that changed after authorization\",\n    );\n    yield* deleteCreated(provider, zone, created.providerRecordId, \"stale-plan\");\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(provider)),\n  );\n}\n\nfunction partialApplyCleanup(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  prefix: string,\n) {\n  let creates = 0;\n  const flaky = DnsProvider.Service.of({\n    ...provider,\n    createRecord: Effect.fn(\"ProviderConformance.createRecord\")((target, record) => {\n      creates += 1;\n      return creates === 1\n        ? provider.createRecord(target, record)\n        : Effect.fail(\n            new DnsProvider.Error({\n              message: \"injected conformance failure\",\n              operation: \"createRecord\",\n              providerId: provider.id,\n            }),\n          );\n    }),\n  });\n  const requirements = [\n    cname(zone, `${prefix}-partial-one`),\n    txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n  ];\n  let cleanupRecordIds: ReadonlyArray<string> = [];\n  return Effect.gen(function* () {\n    const { plan } = yield* Provisioning.create({\n      requirements,\n      target: Provisioning.Target.ExactZone({ zone }),\n    });\n    const failure = yield* Provisioning.apply({\n      authorization: yield* Provisioning.authorize(plan),\n      plan,\n    }).pipe(Effect.flip);\n    cleanupRecordIds =\n      failure instanceof Provisioning.PartialApplyError\n        ? providerRecordIds(failure.receipt.operations)\n        : [];\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      failure instanceof Provisioning.PartialApplyError && failure.receipt.operations.length === 1,\n      \"a later write failure must preserve the first confirmed write in a partial receipt\",\n    );\n    if (!(failure instanceof Provisioning.PartialApplyError)) return;\n    const deletion = yield* Deletion.create({ plan, receipt: failure.receipt }).pipe(\n      Effect.provide(providerLayer(provider)),\n    );\n    yield* Deletion.apply({\n      authorization: yield* Deletion.authorize(deletion),\n      plan: deletion,\n    }).pipe(Effect.provide(providerLayer(provider)));\n    yield* requireCondition(\n      provider,\n      \"partial-apply-cleanup\",\n      yield* recordIdsAbsent(provider, zone, cleanupRecordIds),\n      \"partial receipt cleanup must remove the confirmed write\",\n    );\n  }).pipe(\n    Effect.ensuring(bestEffortDelete(provider, zone, () => cleanupRecordIds)),\n    Effect.provide(providerLayer(flaky)),\n  );\n}\n\nfunction providerRecordIds(\n  operations: ReadonlyArray<{ readonly providerRecordId: string | null }>,\n): ReadonlyArray<string> {\n  return operations.flatMap(({ providerRecordId }) =>\n    providerRecordId === null ? [] : [providerRecordId],\n  );\n}\n\nfunction recordIdsAbsent(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: ReadonlyArray<string>,\n) {\n  return Effect.forEach(recordIds, (providerRecordId) =>\n    provider.getRecord(zone, providerRecordId),\n  ).pipe(Effect.map((records) => records.every((record) => record === null)));\n}\n\nfunction bestEffortDelete(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  recordIds: () => ReadonlyArray<string>,\n) {\n  return Effect.suspend(() =>\n    Effect.forEach(\n      recordIds(),\n      (providerRecordId) => provider.deleteRecord(zone, providerRecordId).pipe(Effect.ignore),\n      { discard: true },\n    ),\n  );\n}\n\nfunction providerLayer(provider: DnsProvider.Interface) {\n  return Layer.merge(Layer.succeed(DnsProvider.Service, provider), Digest.webCryptoLayer);\n}\n\nfunction createRequirements(zone: DomainName.DomainName, prefix: string) {\n  return [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, \"domainkit\")];\n}\n\nfunction cname(zone: DomainName.DomainName, label: string) {\n  return DnsRecord.parse({\n    _tag: \"CNAME\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"exclusive\",\n    target: \"target.example.net\",\n    ttl: 300,\n  });\n}\n\nfunction txt(zone: DomainName.DomainName, label: string, value: string) {\n  return DnsRecord.parse({\n    _tag: \"TXT\",\n    metadata: { ownership: \"tester\", provenance: \"domainkit\", purpose: \"conformance\" },\n    name: `${label}.${zone}`,\n    policy: \"append\",\n    ttl: 300,\n    value,\n  });\n}\n\nfunction requireTags(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  operations: ReadonlyArray<{ readonly _tag: string }>,\n  expected: ReadonlyArray<string>,\n) {\n  return requireCondition(\n    provider,\n    testCase,\n    JSON.stringify(operations.map(({ _tag }) => _tag)) === JSON.stringify(expected),\n    `expected operations ${expected.join(\", \")}`,\n  );\n}\n\nfunction requireCondition(\n  provider: DnsProvider.Interface,\n  testCase: string,\n  condition: boolean,\n  message: string,\n) {\n  return condition\n    ? Effect.void\n    : Effect.fail(new Error({ case: testCase, message, providerId: provider.id }));\n}\n\nfunction deleteCreated(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  providerRecordId: string | null,\n  testCase: string,\n) {\n  return providerRecordId === null\n    ? Effect.fail(\n        new Error({\n          case: testCase,\n          message: \"provider must return record IDs for safe cleanup\",\n          providerId: provider.id,\n        }),\n      )\n    : provider.deleteRecord(zone, providerRecordId);\n}\n"],"mappings":";;;;;;;;;AAaA,SAAS,QAAQ,WAAmB,SAAkC;CACpE,OAAO,IAAIA,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAASC,WAAS,WAAmB,SAAkC;CACrE,OAAO,IAAID,QAAgB;EACzB,UAAU;EACV;EACA;EACA,OAAO;CACT,CAAC;AACH;AAEA,SAAS,gBACP,WACA,cACA,SACyC;CACzC,OAAO,UAAU,YAAY,MAC1B,eAAe,WAAW,OAAO,gBAAgB,WAAW,YAAY,OAC3E;AACF;AAEA,SAAS,iBACP,YACA,eACA,YAC+B;CAC/B,OAAOE,QAAmB,YAAY,eAAe,UAAU;AACjE;AAEA,SAAgBC,OAAK,UAAmB,CAAC,GAAwB;CAC/D,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAA+C,IAAI,IAAI,CAAC,CAAC;CAC1F,MAAM,YAAY,UAAU,WAAW,CAAC;CACxC,MAAM,aAAsB,WAAmC,UAAU,WAAW,MAAM;CAE1F,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,WACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,SAAS;EACxF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,UAAU,cAAc,IAAI,SAAS;GAC9C,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,iBACA;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW,OAAO,QAAQ,aAAa,WAAW,IAAI;EACnF,OAAO,IAAI,OAAO,QAAQ,YAAY;GACpC,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,OAAO,eAAe;GAC3B,OAAO;EACT,CAAC;CACH,CAAC;CAED,MAAM,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,oBAClD,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,IAAI,eAAe,KAAK,IAAI,CAAC,CACnF;CAEA,MAAM,oBAAoB,OAAO,GAAG,yCAAyC,CAAC,EAC3E,iBACC,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,MAAM,cAC1B,UAAU,YAAY,MAAM,eAAe,WAAW,OAAO,YAAY,CAC3E,KAAK,IACT,CACF,CACJ;CAEA,MAAM,mBAAmB,OAAO,GAAG,gDAAgD,CAAC,CAAC,WAGnF,WACA,YACA,QACA;EACA,MAAM,cAAc,OAAO,SAAS;EACpC,MAAM,UAA+B;GACnC,GAAG;GACH,eAAe;IACb,GAAG,UAAU;IACb,YACE,UAAU,cAAc,WAAW,SAAS,YACxC,UAAU,cAAc,aAAA,WACS,QAAQ,EAAE,YAAY,CAAC;GAChE;EACF;EACA,OAAO,OAAO,qBAAqB,OAAO;EAC1C,OAAO,OAAO,QAAQ,aAAa;EACnC,OAAO,OAAO,sBAAsB,QAAQ,cAAc,EAAE;EAC5D,OAAO;GACL,YAAY,iBAAiB,YAAY,QAAQ,eAAe,QAAQ,UAAU;GAClF,sBAAsB;GACtB,sBAAsB;EACxB;CACF,CAAC;CAED,OAAA,QAAyB,GAAG;EAC1B,SAAS,EAAE,YAAY,cAAc,cACnC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,oCAAoC;GAEtE,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,mDAAmD;GAErF,IAAI,WAAW,iBAAiB,cAC9B,OAAO,OAAOF,WAAS,UAAU,8CAA8C;GAEjF,MAAM,WAAW,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE;GAC5E,IAAI,aAAa,KAAA,GAAW;IAC1B,IACE,SAAS,iBAAiB,WAAW,gBACrC,SAAS,WAAW,WAAW,UAC/B,SAAS,OAAO,cAAc,WAAW,OAAO,aAChD,SAAS,OAAO,gBAAgB,WAAW,OAAO,eAClD,SAAS,OAAO,WAAW,WAAW,OAAO,UAC7C,SAAS,OAAO,aAAa,WAAW,OAAO,UAE/C,OAAO,OAAOA,WAAS,UAAU,wCAAwC;IAE3E,OAAO;KACL,YAAY;KACZ,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;IACF;GACF;GAIA,IAHoB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAC9D,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,WAAW,EAAE,CAE/C,GACZ,OAAO,OAAOA,WAAS,UAAU,wCAAwC;GAa3E,IAXkB,CAAC,IAAI,OAAO,IAAI,IAAI,KAAK,EAAA,CAAG,OAAO,CAAC,CAAC,CAAC,MAAM,cAAc;IAC1E,OAAO,UAAU,YAAY,MAC1B,EAAE,cAAc,wBAAwB,aACvC,WAAW,WAAW,UACtB,UAAU,YAAY,MACnB,wBACC,oBAAoB,OAAO,0BAC3B,oBAAoB,YAAY,OACpC,CACJ;GACF,CACY,GACV,OAAO,OAAOA,WACZ,UACA,0DACF;GAEF,MAAM,OAA4B;IAChC,GAAG;IACH,aAAa,CAAC,GAAG,UAAU,aAAa,UAAU;GACpD;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;IACL;IACA,YAAY,iBAAiB,YAAY,UAAU,eAAe,UAAU,UAAU;GACxF;EACF,CAAC,CACH;EACF,UAAU,UACR,UACE,OAAO,IAAI,aAAa;GAEtB,MAAM,WAAU,OADO,IAAI,IAAI,KAAK,EAAA,CACZ,IAAI,MAAM,cAAc,EAAE;GAClD,IACE,SAAS,cAAc,WAAW,SAAS,aAC1C,MAAM,4BAA4B,KAAA,KAAa,YAAY,KAAA,GAE5D,OAAO,OAAOA,WACZ,WACA,YAAY,KAAA,IACR,4CACA,wDACN;GAEF,IACE,MAAM,4BAA4B,KAAA,KAClC,SAAS,cAAc,OAAO,MAAM,yBAEpC,OAAO,OAAOA,WAAS,WAAW,iDAAiD;GAErF,IACE,MAAM,cAAc,OAAO,MAAM,WAAW,mBAC5C,MAAM,cAAc,eAAe,MAAM,WAAW,cACpD,MAAM,cAAc,WAAW,MAAM,WAAW,QAEhD,OAAO,OAAOA,WAAS,WAAW,6CAA6C;GAEjF,MAAM,qBAAqB,SAAS,YAAY,MAC7C,eAAe,WAAW,YAAY,MAAM,WAAW,OAC1D;GACA,IACE,MAAM,yBAAyB,KAAA,KAC/B,oBAAoB,OAAO,MAAM,sBAEjC,OAAO,OAAOA,WAAS,WAAW,kDAAkD;GAEtF,MAAM,aAAa,sBAAsB,MAAM;GAC/C,MAAM,OAA4B;IAChC,eAAe,MAAM;IACrB,aAAa,UACT,CAAC,GAAG,QAAQ,YAAY,QAAQ,EAAE,SAAS,OAAO,WAAW,EAAE,GAAG,UAAU,IAC5E,CAAC,UAAU;IACf,aAAa,SAAS,eAAe,CAAC;IACtC,YAAY,MAAM;GACpB;GACA,OAAO,OAAO,WAAW,IAAI;GAC7B,OAAO;EACT,CAAC,CACH;EACF,SAAS,EAAE,cAAc,cACvB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,IAAI,IAAI,KAAK;GACpC,KAAK,MAAM,aAAa,QAAQ,OAAO,GAAG;IACxC,MAAM,aAAa,UAAU,YAAY,MAAM,EAAE,SAAS,OAAO,YAAY;IAC7E,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,aAAa,gBAAgB,WAAW,WAAW,cAAc,OAAO;IAC9E,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,UAAU,iDAAiD;IAEnF,MAAM,OAA4B;KAChC,GAAG;KACH,aAAa,UAAU,YAAY,QAAQ,EAAE,SAAS,OAAO,YAAY;IAC3E;IACA,OAAO,OAAO,UAAU,IAAI;IAC5B,OAAO;KACL;KACA,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,KAAK,YAAY,QACpC,EAAE,mBAAmB,iBAAiB,WAAW,EACpD,CAAC,CAAC;IACJ;GACF;GACA,OAAO,OAAO,QAAQ,UAAU,kCAAkC;EACpE,CAAC,CACH;EACF,aAAa,EAAE,cAAc,SAAS,aACpC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,cAAc,oCAAoC;GAE1E,MAAM,aAAa,gBAAgB,WAAW,cAAc,OAAO;GACnE,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QACZ,cACA,mDACF;GAEF,IAAI,UAAU,YAAY,MAAM,EAAE,cAAc,SAAS,OAAO,YAAY,GAC1E,OAAO,OAAOA,WACZ,cACA,mEACF;GAEF,MAAM,uBAAuB,UAAU,YAAY,QAChD,EAAE,SAAS,OAAO,YACrB;GACA,IAAI,qBAAqB,SAAS,GAAG;IACnC,MAAM,OAA4B;KAAE,GAAG;KAAW,aAAa;IAAqB;IACpF,OAAO,OAAO,wBAAwB,IAAI;IAC1C,OAAO;KACL,YAAY,iBACV,YACA,UAAU,eACV,UAAU,UACZ;KACA,sBAAsB,qBAAqB;KAC3C,sBAAsB;IACxB;GACF;GACA,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kCAAkC,CAAC,CAC7D;EACF,iBAAiB,SAAS,oBACxB,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,QAAQ,IAAI,eAAe,CAAC,EAAE,YAAY,MAAM,EAAE,SAAS,SAAS,OAAO,OAAO,KAClF,IACJ,CACF;EACF;EACA,gBAAgB,iBACd,IAAI,IAAI,KAAK,CAAC,CAAC,KACb,OAAO,KACJ,YACC,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAClB,SAAS,EAAE,kBAAkB,WAAW,CAAC,CACzC,MAAM,EAAE,SAAS,OAAO,YAAY,KAAK,IAChD,CACF;EACF;EACA,kBAAkB,cAAc,YAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,kBAAkB,YAAY;GACvD,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,oCAAoC;GAE/E,IAAI,gBAAgB,WAAW,cAAc,OAAO,MAAM,KAAA,GACxD,OAAO,OAAO,QACZ,mBACA,mDACF;GAEF,OAAO,UAAU,YAAY,QAAQ,EAAE,cAAc,SAAS,OAAO,YAAY;EACnF,CAAC;EACH,kBAAkB,iBAAiB,aACjC,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,mBAAmB,uCAAuC;GAElF,MAAM,eAAe,IAAI,IACvB,UAAU,cAAc,mBAAmB,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAClF;GACA,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;GACnE,MAAM,OAAO;IACX,GAAG;IACH,eAAe;KACb,GAAG,UAAU;KACb,oBAAoB,CAAC,GAAG,aAAa,OAAO,CAAC;IAC/C;GACF;GACA,OAAO,OAAO,mBAAmB,IAAI;GACrC,OAAO;EACT,CAAC,CACH;EACF,UAAU,EAAE,iBAAiB,aAC3B,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,WAAW,uCAAuC;GAE1E,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,QAAQ,WAAW,mDAAmD;GAEtF,MAAM,aAAa,UAAU,YAAY;GACzC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,QAAQ,WAAW,yCAAyC;GAE5E,OAAO,OAAO,iBAAiB,WAAW,YAAY,MAAM;EAC9D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,+BAA+B,CAAC,CAC1D;EACF,SAAS,iBAAiB,eACxB,UACE,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,IAAI,eAAe;GAC5C,IAAI,cAAc,MAChB,OAAO,OAAO,QAAQ,UAAU,uCAAuC;GAEzE,MAAM,OAAO;IACX,GAAG;IACH;GACF;GACA,OAAO,OAAO,UAAU,IAAI;GAC5B,OAAO;EACT,CAAC,CACH;CACJ,CAAC;AACH;AAEA,MAAaG,WAAS,UAAmB,CAAC,MAAM,MAAM,KAAKC,eAAyBF,OAAK,OAAO,CAAC;;;;AC/YjG,SAAgBG,SAAqC;CACnD,MAAM,QAAQ,OAAO,QAAQ,IAAI,qBAAmD,IAAI,IAAI,CAAC,CAAC;CAC9F,OAAO;EACL,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAAW,IAAI,KAAK;GACxE,OAAO,OAAO,IAAI,OAAO,QAAQ,YAAY;IAC3C,MAAM,eAAe,QAAQ,IAAI,EAAE;IACnC,MAAM,OAAO,IAAI,IAAI,OAAO;IAC5B,KAAK,OAAO,EAAE;IACd,OAAO,CACL,iBAAiB,KAAA,KAAa,aAAa,YAAY,MAAM,eAAe,MAC5E,IACF;GACF,CAAC;EACH,CAAC;EACD,KAAK,OAAO,GAAG,6BAA6B,CAAC,EAAE,iBAC7C,IAAI,OAAO,QAAQ,YAAY;GAC7B,MAAM,OAAO,IAAI,IAAI,OAAO;GAC5B,KAAK,IAAI,aAAa,IAAI,YAAY;GACtC,OAAO;EACT,CAAC,CACH;CACF;AACF;;;;;;;;ACfA,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,MAAM,KAAK,QAAQ,MAAM;CACzB,MAAM,0BAAU,IAAI,IAAsD;CAC1E,MAAM,4BAAY,IAAI,IAAgC;CACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;EACnE,QAAQ,IAAIC,MAAiB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC;EAChD,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG,UAAU,IAAI,GAAG,GAAG,GAAG,QAAQ,KAAK,MAAM;CAC7F;CACA,OAAO;EACL;EACA,aAAa,OAAO,GAAG,iCAAiC,CAAC,EAAE,SACzD,OAAO,WAAW,CAAC,GAAI,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAE,CAAC,CAClD;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,WACjE,OAAO,WAAW;GAChB,MAAM,UAAU,QAAQ,IAAI,IAAI,KAAK,CAAC;GACtC,QAAQ,KAAK,MAAM;GACnB,QAAQ,IAAI,MAAM,OAAO;GACzB,MAAM,mBAAmB,GAAG,GAAG,GAAG,QAAQ;GAC1C,UAAU,IAAI,kBAAkB,MAAM;GACtC,OAAO,EAAE,iBAAiB;EAC5B,CAAC,CACH;EACA,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,MAAM,qBACjE,OAAO,WAAW;GAChB,MAAM,SAAS,UAAU,IAAI,gBAAgB;GAC7C,IAAI,WAAW,KAAA,GAAW;GAC1B,QAAQ,IACN,OACC,QAAQ,IAAI,IAAI,KAAK,CAAC,EAAA,CAAG,QAAQ,cAAc,cAAc,MAAM,CACtE;GACA,UAAU,OAAO,gBAAgB;EACnC,CAAC,CACH;EACA,WAAW,OAAO,GAAG,+BAA+B,CAAC,EAAE,OAAO,qBAC5D,OAAO,WAAW,UAAU,IAAI,gBAAgB,KAAK,IAAI,CAC3D;CACF;AACF;AAEA,MAAaC,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;AC/CnC,SAAgB,KAAK,SAAyC;CAC5D,OAAO,EACL,SAAS,OAAO,GAAG,6BAA6B,CAAC,EAAE,UACjD,OAAO,cAAc;EACnB,MAAM,aAAa,QAAQ,KAAK;EAChC,OAAO,OAAO,SAAS,UAAU,IAAI,aAAa,OAAO,QAAQ,UAAU;CAC7E,CAAC,CACH,EACF;AACF;AAEA,MAAa,SAAS,YACpB,MAAM,QAAQM,WAAqB,KAAK,OAAO,CAAC;AAElD,MAAa,WAAW,YACtBC,UAAoB,KAAK,OAAO,CAAC;;;;;;;;ACdnC,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,MAAM,OAAO;CACb,SAAS,OAAO;CAChB,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;;AAeJ,SAAgB,UAAU,cAAuE;CAC/F,aAAa,OAAO,WAAWC,YAAsB,aAAa,CAAC,CAAC;AACtE;AAEA,MAAM,QAAQ;CACZ;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAc;CAC/E,MAAM,qBACJ,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC,KACjC,OAAO,aAAa,UAClB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU;EAC7D,YAAY;CACd,CAAC,CACH,CACF,CACF;CACF,MAAM,QAAQ,OAAO,aAAa;CAClC,MAAM,aAAa,MAAM;CACzB,MAAM,SAAS,MAAM,UAAU;CAC/B,OAAO,sBAAsB,OAAO,MAAM,MAAM,MAAM;CACtD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,SAAS,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACzD,OAAO,UAAU,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CAC1D,OAAO,oBAAoB,OAAO,aAAa,GAAG,MAAM,MAAM,MAAM;CACpE,OAAO;EAAE;EAAO;EAAY,MAAM,MAAM;CAAK;AAC/C,CAAC;AAED,SAAS,sBACP,UACA,MACA,QACA;CACA,MAAM,eAAe,mBAAmB,MAAM,MAAM;CACpD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOC,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,2BAA2B,KAAK,YAAY,CAAC,UAAU,QAAQ,CAAC;EAC7F,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,YACf,mBAAmBC,oBACf,OAAO,WAAW;GAChB,mBAAmB,kBAAkB,QAAQ,QAAQ,UAAU;EACjE,CAAC,IACD,OAAO,IACb,CACF;EACA,mBAAmB,kBAAkB,QAAQ,UAAU;EACvD,OAAO,iBACL,UACA,2BACA,QAAQ,WAAW,cACjB,QAAQ,WAAW,OAAO,EAAE,uBAAuB,qBAAqB,IAAI,GAC9E,+DACF;EACA,MAAM,WAAW,OAAO,SAAS,YAAY,IAAI;EACjD,OAAO,iBACL,UACA,2BACA,aAAa,OAAO,gBAClB,SAAS,MACN,WAAW,OAAO,SAAS,YAAYC,OAAiB,QAAQ,WAAW,CAC9E,CACF,GACA,+EACF;EACA,MAAM,WAAW,OAAOC,SAAgB;GAAE;GAAM;EAAQ,CAAC;EAKzD,OAAO,iBACL,UACA,4BACA,OAP6BC,QAAe;GAC5C,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,EAAA,CAIiB,WAAW,eACxB,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,IAC1D,wDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOP,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,cAAc,KAAK,YAAY,CAAC,MAAM,CAAC;EAKpE,OAAO,iBACL,UACA,eACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,EAAA,CAIS,WAAW,WAAW,GAC9B,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,SAAS,UAAiC,MAA6B,QAAgB;CAC9F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,UAAU;CACpD,MAAM,WAAW,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU;CAC3D,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,QAAQ;EAC3D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EACrF,MAAM,EAAE,SAAS,OAAOF,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,OAAO,YAAY,UAAU,YAAY,KAAK,YAAY,CAAC,UAAU,CAAC;EAKtE,OAAO,iBACL,UACA,aACA,OAPqBC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAIEM,eACnB,8CACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,UAAU;CAC3E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,UAAU,UAAiC,MAA6B,QAAgB;CAC/F,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;CACjD,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOR,OAAoB;GAC1C,cAAc,CAAC,WAAW;GAC1B,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,gBAAgB,OAAOE,UAAuB,IAAI;EACxD,MAAM,UAAU,OAAO,SAAS,aAAa,MAAM,WAAW;EAC9D,mBAAmB,QAAQ,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,gBAAgB;EAErF,OAAO,iBACL,UACA,eACA,OAJqBD,MAAmB;GAAE;GAAe;EAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,cAI9DQ,YACnB,mEACF;EACA,OAAO,cAAc,UAAU,MAAM,QAAQ,kBAAkB,YAAY;CAC7E,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;AACF;AAEA,SAAS,oBACP,UACA,MACA,QACA;CACA,IAAI,UAAU;CACd,MAAM,QAAA,UAA4B,GAAG;EACnC,GAAG;EACH,cAAc,OAAO,GAAG,kCAAkC,CAAC,EAAE,QAAQ,WAAW;GAC9E,WAAW;GACX,OAAO,YAAY,IACf,SAAS,aAAa,QAAQ,MAAM,IACpC,OAAO,KACL,IAAIC,QAAkB;IACpB,SAAS;IACT,WAAW;IACX,YAAY,SAAS;GACvB,CAAC,CACH;EACN,CAAC;CACH,CAAC;CACD,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;CACA,IAAI,mBAA0C,CAAC;CAC/C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,EAAE,SAAS,OAAOV,OAAoB;GAC1C;GACA,QAAA,OAA4B,UAAU,EAAE,KAAK,CAAC;EAChD,CAAC;EACD,MAAM,UAAU,OAAOC,MAAmB;GACxC,eAAe,OAAOC,UAAuB,IAAI;GACjD;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI;EACnB,mBACE,mBAAmBC,oBACf,kBAAkB,QAAQ,QAAQ,UAAU,IAC5C,CAAC;EACP,OAAO,iBACL,UACA,yBACA,mBAAmBA,qBAAkC,QAAQ,QAAQ,WAAW,WAAW,GAC3F,oFACF;EACA,IAAI,EAAE,mBAAmBA,oBAAiC;EAC1D,MAAM,WAAW,OAAOE,SAAgB;GAAE;GAAM,SAAS,QAAQ;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,QAAQ,cAAc,QAAQ,CAAC,CACxC;EACA,OAAOC,QAAe;GACpB,eAAe,OAAOC,YAAmB,QAAQ;GACjD,MAAM;EACR,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,QAAQ,CAAC,CAAC;EAC/C,OAAO,iBACL,UACA,yBACA,OAAO,gBAAgB,UAAU,MAAM,gBAAgB,GACvD,yDACF;CACF,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,iBAAiB,UAAU,YAAY,gBAAgB,CAAC,GACxE,OAAO,QAAQ,cAAc,KAAK,CAAC,CACrC;AACF;AAEA,SAAS,kBACP,YACuB;CACvB,OAAO,WAAW,SAAS,EAAE,uBAC3B,qBAAqB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CACpD;AACF;AAEA,SAAS,gBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,QAAQ,YAAY,qBAChC,SAAS,UAAU,MAAM,gBAAgB,CAC3C,CAAC,CAAC,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,WAAW,WAAW,IAAI,CAAC,CAAC;AAC5E;AAEA,SAAS,iBACP,UACA,MACA,WACA;CACA,OAAO,OAAO,cACZ,OAAO,QACL,UAAU,IACT,qBAAqB,SAAS,aAAa,MAAM,gBAAgB,CAAC,CAAC,KAAK,OAAO,MAAM,GACtF,EAAE,SAAS,KAAK,CAClB,CACF;AACF;AAEA,SAAS,cAAc,UAAiC;CACtD,OAAO,MAAM,MAAM,MAAM,QAAQI,WAAqB,QAAQ,GAAGC,cAAqB;AACxF;AAEA,SAAS,mBAAmB,MAA6B,QAAgB;CACvE,OAAO,CAAC,MAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CAAC;AACnF;AAEA,SAAS,MAAM,MAA6B,OAAe;CACzD,OAAOC,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,QAAQ;EACR,KAAK;CACP,CAAC;AACH;AAEA,SAAS,IAAI,MAA6B,OAAe,OAAe;CACtE,OAAOA,QAAgB;EACrB,MAAM;EACN,UAAU;GAAE,WAAW;GAAU,YAAY;GAAa,SAAS;EAAc;EACjF,MAAM,GAAG,MAAM,GAAG;EAClB,QAAQ;EACR,KAAK;EACL;CACF,CAAC;AACH;AAEA,SAAS,YACP,UACA,UACA,YACA,UACA;CACA,OAAO,iBACL,UACA,UACA,KAAK,UAAU,WAAW,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,GAC9E,uBAAuB,SAAS,KAAK,IAAI,GAC3C;AACF;AAEA,SAAS,iBACP,UACA,UACA,WACA,SACA;CACA,OAAO,YACH,OAAO,OACP,OAAO,KAAK,IAAI,MAAM;EAAE,MAAM;EAAU;EAAS,YAAY,SAAS;CAAG,CAAC,CAAC;AACjF;AAEA,SAAS,cACP,UACA,MACA,kBACA,UACA;CACA,OAAO,qBAAqB,OACxB,OAAO,KACL,IAAI,MAAM;EACR,MAAM;EACN,SAAS;EACT,YAAY,SAAS;CACvB,CAAC,CACH,IACA,SAAS,aAAa,MAAM,gBAAgB;AAClD"}