domainkit 0.8.0 → 0.9.0

package/dist/Server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Server.mjs","names":["Storage.AuthMethod","DnsRecord.Model","Plan.OperationId","Plan.Model","Storage.AttemptStatus","Approval.Model","Receipt.Model","Storage.Rejection","Storage.Overall","Storage.RequirementStatus","Verify.Evidence","Verify.HostEvidence","Plan.PlanId","Approval.ApprovalId","Receipt.ReceiptId","Errors.fail","Reason.InvalidInput","Errors.DomainKitError","Connect.Service","Provision.Service","Cleanup.Service","Verify.Service","Storage.Service","Principal.Service","Reason.NotFound"],"sources":["../src/Server.ts"],"sourcesContent":["/**\n * domainkit/server — the whole lifecycle as one HttpApi group the host mounts.\n *\n *   const Api = HttpApi.make(\"app\").add(Server.group)\n *   const ApiLive = HttpApiBuilder.layer(Api).pipe(\n *     Layer.provide([Server.layer(Api), DomainKitLive, IdentityLive]),\n *   )\n *\n * The host provides `Identity` (request -> `Principal.Interface`). Everything else comes from\n * `DomainKit.layer`. Non-HttpApi hosts use `toWebHandler`. The group carries no prefix of its\n * own, so `group.prefix(\"/internal/dns\")` or a host router mount is all a different base path\n * takes; callback URLs follow the mount.\n */\nimport { Context, Effect, Layer, Option, Schema } from \"effect\";\nimport * as HttpRouter from \"effect/unstable/http/HttpRouter\";\nimport * as HttpServer from \"effect/unstable/http/HttpServer\";\nimport * as HttpServerRequest from \"effect/unstable/http/HttpServerRequest\";\nimport * as HttpApi from \"effect/unstable/httpapi/HttpApi\";\nimport * as HttpApiBuilder from \"effect/unstable/httpapi/HttpApiBuilder\";\nimport * as HttpApiEndpoint from \"effect/unstable/httpapi/HttpApiEndpoint\";\nimport * as HttpApiGroup from \"effect/unstable/httpapi/HttpApiGroup\";\nimport * as HttpApiSchema from \"effect/unstable/httpapi/HttpApiSchema\";\n\nimport * as Approval from \"./Approval.ts\";\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Receipt from \"./Receipt.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\n/** The only service a host must implement for the server. */\nexport interface IdentityService {\n  readonly principal: (\n    request: HttpServerRequest.HttpServerRequest,\n  ) => Effect.Effect<Principal.Interface, Errors.DomainKitError>;\n  /**\n   * Which routes this principal may reach, checked after `principal` on every request. Fail with\n   * reason `Forbidden` for the 403 a UI expects. Without it every authenticated principal reaches\n   * every route, which is the right default for a host whose own middleware already gates the\n   * mount.\n   */\n  readonly authorize?: (\n    principal: Principal.Interface,\n    endpoint: EndpointName,\n  ) => Effect.Effect<void, Errors.DomainKitError>;\n}\n\nexport class Identity extends Context.Service<Identity, IdentityService>()(\n  \"@domainkit/server/Identity\",\n) {}\n\n// ---------------------------------------------------------------------------------------------\n// Wire schemas (the transport contract `domainkit/client` and `@domainkit/react` consume)\n// ---------------------------------------------------------------------------------------------\n\nexport const ConnectionStatus = Schema.Literals([\"disconnected\", \"connected\", \"reconnect\"]);\nexport type ConnectionStatus = typeof ConnectionStatus.Type;\n\n/** One value a token method needs, so a form renders without knowing the provider. */\nexport const Field = Schema.Struct({\n  name: Schema.String,\n  required: Schema.Boolean,\n  secret: Schema.Boolean,\n});\nexport type Field = typeof Field.Type;\n\n/** How a provider can be connected; `fields` is `null` for the interactive methods. */\nexport const MethodDescriptor = Schema.Struct({\n  kind: Storage.AuthMethod,\n  label: Schema.String,\n  docsUrl: Schema.NullOr(Schema.String),\n  fields: Schema.NullOr(Schema.Array(Field)),\n});\nexport type MethodDescriptor = typeof MethodDescriptor.Type;\n\n/** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */\nexport const Snapshot = Schema.Struct({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  connectionId: Schema.NullOr(Schema.String),\n  provider: Schema.NullOr(Schema.String),\n  method: Schema.NullOr(Storage.AuthMethod),\n  status: ConnectionStatus,\n  lastReceiptId: Schema.NullOr(Schema.String),\n  reusable: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      method: Storage.AuthMethod,\n    }),\n  ),\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Snapshot = typeof Snapshot.Type;\n\n/**\n * How the client asks to connect. `values` is keyed by the provider's declared token fields, as\n * `Snapshot.providers[].methods[].fields` names them. Secrets are plaintext in transit and never\n * come back out.\n */\nexport class Token extends Schema.TaggedClass<Token>(\"@domainkit/server/Method/Token\")(\"Token\", {\n  values: Schema.Record(Schema.String, Schema.String),\n}) {}\nexport class OAuth extends Schema.TaggedClass<OAuth>(\"@domainkit/server/Method/OAuth\")(\"OAuth\", {\n  returnTo: Schema.optionalKey(Schema.String),\n}) {}\nexport class Integration extends Schema.TaggedClass<Integration>(\n  \"@domainkit/server/Method/Integration\",\n)(\"Integration\", { returnTo: Schema.optionalKey(Schema.String) }) {}\nexport const Method = Schema.Union([Token, OAuth, Integration]);\nexport type Method = typeof Method.Type;\n\nexport const StartPayload = Schema.Struct({\n  domain: Schema.String,\n  provider: Schema.String,\n  method: Method,\n});\nexport type StartPayload = typeof StartPayload.Type;\n\n/** A zone the connection can serve, named for a customer to pick from. */\nexport class Candidate extends Schema.Class<Candidate>(\"@domainkit/server/Candidate\")({\n  zone: Schema.String,\n  label: Schema.String,\n}) {}\n\nexport class Connected extends Schema.TaggedClass<Connected>(\"@domainkit/server/Started/Connected\")(\n  \"Connected\",\n  { snapshot: Snapshot },\n) {}\nexport class Redirect extends Schema.TaggedClass<Redirect>(\"@domainkit/server/Started/Redirect\")(\n  \"Redirect\",\n  { authorizationUrl: Schema.String },\n) {}\nexport class SelectionRequired extends Schema.TaggedClass<SelectionRequired>(\n  \"@domainkit/server/Started/SelectionRequired\",\n)(\"SelectionRequired\", { connectionId: Schema.String, candidates: Schema.Array(Candidate) }) {}\nexport const Started = Schema.Union([Connected, Redirect, SelectionRequired]);\nexport type Started = typeof Started.Type;\n\n/**\n * Which of the principal's connections already reaches a domain. The class names carry a\n * `Discovery` prefix because `Started` owns the unprefixed `SelectionRequired`; the wire tags are\n * the ones `Connect.Discovery` uses.\n */\nexport class DiscoveryResolved extends Schema.TaggedClass<DiscoveryResolved>(\n  \"@domainkit/server/Discovery/Resolved\",\n)(\"Resolved\", { connectionId: Schema.String, zone: Schema.String, label: Schema.String }) {}\nexport class DiscoverySelectionRequired extends Schema.TaggedClass<DiscoverySelectionRequired>(\n  \"@domainkit/server/Discovery/SelectionRequired\",\n)(\"SelectionRequired\", {\n  candidates: Schema.Array(\n    Schema.Struct({ connectionId: Schema.String, zone: Schema.String, label: Schema.String }),\n  ),\n}) {}\nexport class DiscoveryNotFound extends Schema.TaggedClass<DiscoveryNotFound>(\n  \"@domainkit/server/Discovery/NotFound\",\n)(\"NotFound\", { nameservers: Schema.Array(Schema.String) }) {}\nexport const Discovery = Schema.Union([\n  DiscoveryResolved,\n  DiscoverySelectionRequired,\n  DiscoveryNotFound,\n]);\nexport type Discovery = typeof Discovery.Type;\n\nexport const AttachPayload = Schema.Struct({\n  domain: Schema.String,\n  /** Which candidate zone to attach when `SelectionRequired` came back. */\n  zone: Schema.optionalKey(Schema.String),\n});\nexport type AttachPayload = typeof AttachPayload.Type;\n\nexport const PlanPayload = Schema.Struct({\n  requirements: Schema.Array(DnsRecord.Model),\n});\nexport type PlanPayload = typeof PlanPayload.Type;\n\nexport const ObservePayload = Schema.Struct({\n  /** Records to observe instead of the attachment's receipt; required for an unattached domain. */\n  requirements: Schema.optionalKey(Schema.Array(DnsRecord.Model)),\n});\nexport type ObservePayload = typeof ObservePayload.Type;\n\nexport const ApprovePayload = Schema.Struct({\n  /** A subset of the plan's writes; omit to approve every write. */\n  operationIds: Schema.optionalKey(Schema.Array(Plan.OperationId)),\n});\nexport type ApprovePayload = typeof ApprovePayload.Type;\n\nexport const RejectPayload = Schema.Struct({\n  /** Why the customer declined, for the audit trail. */\n  reason: Schema.optionalKey(Schema.String),\n});\nexport type RejectPayload = typeof RejectPayload.Type;\n\n/** One durable plan -> approval -> receipt lifecycle, as `GET /plans/:planId` returns it. */\nexport const Attempt = Schema.Struct({\n  plan: Plan.Model,\n  status: Storage.AttemptStatus,\n  approval: Schema.NullOr(Approval.Model),\n  receipt: Schema.NullOr(Receipt.Model),\n  rejection: Schema.NullOr(Storage.Rejection),\n});\nexport type Attempt = typeof Attempt.Type;\n\n/** `Verify.Readiness` on the wire; timestamps encode as ISO strings. */\nexport const Readiness = Schema.Struct({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  overall: Storage.Overall,\n  requirements: Schema.Array(\n    Schema.Struct({\n      operationId: Schema.NullOr(Plan.OperationId),\n      record: DnsRecord.Model,\n      status: Storage.RequirementStatus,\n      evidence: Schema.Array(Verify.Evidence),\n    }),\n  ),\n  host: Schema.Array(Verify.HostEvidence),\n  checkedAt: Schema.DateTimeUtcFromString,\n  nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n});\nexport type Readiness = typeof Readiness.Type;\n\nconst Redirected = HttpApiSchema.WithHeaders(HttpApiSchema.Empty(302), {\n  location: Schema.String,\n});\n\n// ---------------------------------------------------------------------------------------------\n// Errors: one wire body, the status from `DomainKit.Error.httpStatus`\n// ---------------------------------------------------------------------------------------------\n\n/** `DomainKit.Error` narrowed to the reasons that answer with `status`. */\nconst errorAt = (status: number) =>\n  Errors.DomainKitError.check(\n    Schema.makeFilter((error: Errors.DomainKitError) => error.httpStatus === status),\n  ).pipe(HttpApiSchema.status(status));\n\nconst errors = [400, 401, 403, 404, 409, 500, 501, 502, 503].map(errorAt);\n\n// ---------------------------------------------------------------------------------------------\n// The group\n// ---------------------------------------------------------------------------------------------\n\nexport const group = HttpApiGroup.make(\"domainkit\")\n  .add(\n    HttpApiEndpoint.get(\"inspect\", \"/domains/:domain\", {\n      params: { domain: Schema.String },\n      success: Snapshot,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"discover\", \"/domains/:domain/discovery\", {\n      params: { domain: Schema.String },\n      success: Discovery,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"start\", \"/connections\", {\n      payload: StartPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"callback\", \"/callback/:provider\", {\n      params: { provider: Schema.String },\n      // `Connect.complete` reads every callback parameter off the request URL, because a provider\n      // may return `error`, `teamId`, or `configurationId` too. These two are declared so the\n      // OpenAPI document names what a provider is expected to send back.\n      query: { state: Schema.String, code: Schema.optionalKey(Schema.String) },\n      success: Redirected,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"attach\", \"/connections/:connectionId/attachments\", {\n      params: { connectionId: Schema.String },\n      payload: AttachPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"detach\", \"/attachments/:attachmentId\", {\n      params: { attachmentId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"disconnect\", \"/connections/:connectionId\", {\n      params: { connectionId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"createPlan\", \"/domains/:domain/plans\", {\n      params: { domain: Schema.String },\n      payload: PlanPayload,\n      success: Plan.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"approve\", \"/plans/:planId/approvals\", {\n      params: { planId: Plan.PlanId },\n      payload: ApprovePayload,\n      success: Approval.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reject\", \"/plans/:planId/rejections\", {\n      params: { planId: Plan.PlanId },\n      payload: RejectPayload,\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"apply\", \"/approvals/:approvalId/apply\", {\n      params: { approvalId: Approval.ApprovalId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"plan\", \"/plans/:planId\", {\n      params: { planId: Plan.PlanId },\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"receipt\", \"/receipts/:receiptId\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"observe\", \"/domains/:domain/observations\", {\n      params: { domain: Schema.String },\n      payload: ObservePayload,\n      success: Readiness,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"cleanupPlan\", \"/receipts/:receiptId/cleanup-plans\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Plan.Model,\n      error: errors,\n    }),\n  );\n// Cleanup approve, reject, and apply reuse those routes: the attempt knows its kind.\n\nexport type Group = typeof group;\n\n/** Every route in the group, by name; what `Identity.authorize` is asked about. */\nexport type EndpointName = HttpApiGroup.Endpoints<Group>[\"identifier\"];\n\nexport interface Options {\n  /**\n   * Where the callback route is reachable from the provider, without the `/callback/:provider`\n   * suffix. Defaults to the incoming request's origin and mount path.\n   */\n  readonly callbackBaseUrl?: string;\n  /** Where interactive flows return when the callback carries no `returnTo`. */\n  readonly defaultReturnTo?: string;\n}\n\n/** Everything the handlers need: the lifecycle services, Storage, and the host's `Identity`. */\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Storage.Service\n  | Identity;\n\n// ---------------------------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------------------------\n\nconst START_ROUTE = \"/connections\";\nconst callbackRoute = (provider: string) => `/callback/${encodeURIComponent(provider)}`;\n\nconst invalid = (message: string, field?: string) =>\n  Errors.fail(new Reason.InvalidInput({ message, ...(field === undefined ? {} : { field }) }));\n\n/** The request as an absolute URL: the web original when there is one, else scheme plus `Host`. */\nconst absoluteUrl = (\n  request: HttpServerRequest.HttpServerRequest,\n): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    try {\n      return Effect.succeed(new URL(request.originalUrl));\n    } catch {\n      const url = HttpServerRequest.toURL(request);\n      return Option.isNone(url)\n        ? invalid(\"The request has no usable origin; set callbackBaseUrl\", \"callbackBaseUrl\")\n        : Effect.succeed(url.value);\n    }\n  });\n\n/**\n * The absolute URL the provider redirects back to. `callbackBaseUrl` wins when the host set it,\n * because a proxy that rewrites `Host` leaves the request pointing at an origin the browser never\n * sees; otherwise it follows the prefix the group is mounted at, derived by stripping the handling\n * route's own path off the request.\n */\nconst callbackUrlFor = (input: {\n  readonly request: HttpServerRequest.HttpServerRequest;\n  readonly provider: string;\n  readonly options: Options;\n  /** The path of the route serving this request, stripped to find the mount. */\n  readonly route: string;\n}): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    const suffix = `/callback/${encodeURIComponent(input.provider)}`;\n    const configured = input.options.callbackBaseUrl;\n    if (configured !== undefined) {\n      return Effect.try({\n        try: () => new URL(`${configured.replace(/\\/+$/, \"\")}${suffix}`),\n        catch: () => callbackConfigurationError(`${configured} is not a URL`),\n      });\n    }\n    return Effect.flatMap(absoluteUrl(input.request), (url) => {\n      const path = url.pathname;\n      if (!path.endsWith(input.route)) {\n        return invalid(\n          `The ${input.route} route is not mounted where it says; set callbackBaseUrl`,\n          \"callbackBaseUrl\",\n        );\n      }\n      return Effect.succeed(\n        new URL(`${url.origin}${path.slice(0, path.length - input.route.length)}${suffix}`),\n      );\n    });\n  });\n\nconst callbackConfigurationError = (message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({ message, field: \"callbackBaseUrl\" }),\n  });\n\n/**\n * Where the callback may send the customer: a path under the callback's own base, or an absolute\n * URL on its origin. A destination that leaves the application is an open redirect, whoever\n * supplied it.\n */\nconst sameOrigin = (destination: string, callback: URL): string | null => {\n  try {\n    // Resolving against the callback is what makes this safe: the URL parser normalizes the forms\n    // a browser would follow off-origin (`//host`, `/\\host`, `\\/host`, encoded hosts) into a real\n    // origin, so comparing origins catches every one of them.\n    const url = new URL(destination, callback);\n    return url.origin === callback.origin ? url.toString() : null;\n  } catch {\n    return null;\n  }\n};\n\nconst snapshotOf = (snapshot: Connect.Snapshot): Snapshot => ({\n  domain: snapshot.domain,\n  attachmentId: snapshot.attachment?.id ?? null,\n  connectionId: snapshot.connection?.id ?? null,\n  provider: snapshot.authorization?.provider ?? null,\n  method: snapshot.authorization?.method ?? null,\n  status:\n    snapshot.connection === null\n      ? \"disconnected\"\n      : snapshot.authorization?.revocation === \"active\"\n        ? \"connected\"\n        : \"reconnect\",\n  lastReceiptId: snapshot.lastReceiptId,\n  reusable: snapshot.reusable.map(({ connection, provider, method }) => ({\n    connectionId: connection.id,\n    provider,\n    method,\n  })),\n  providers: snapshot.providers.map(({ id, name, methods }) => ({ id, name, methods })),\n});\n\n/** The wire method as `Connect` takes it; interactive cases carry the caller's return destination. */\nconst methodOf = (method: Method): Connect.Method => {\n  switch (method._tag) {\n    case \"Token\":\n      return Connect.Method.token(method.values);\n    case \"OAuth\":\n      return Connect.Method.oauth(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n    case \"Integration\":\n      return Connect.Method.integration(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n  }\n};\n\nconst candidatesOf = (\n  candidates: ReadonlyArray<{ readonly zone: string; readonly label: string }>,\n): ReadonlyArray<Candidate> => candidates.map(({ zone, label }) => new Candidate({ zone, label }));\n\n/**\n * Handlers for `group` inside the host's API. Every handler derives `Principal` from `Identity`\n * for the request it is serving and provides it to the lifecycle services.\n */\nexport const layer = <ApiId extends string, Groups extends HttpApiGroup.Constraint>(\n  api: HttpApi.HttpApi<ApiId, Groups>,\n  options: Options = {},\n): Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services> =>\n  // The host's API carries its own groups beside this one; only `\"domainkit\"` is implemented here,\n  // and `HttpApiBuilder.group` needs the group's own endpoint types to check the handlers.\n  HttpApiBuilder.group(api as unknown as HttpApi.HttpApi<ApiId, Group>, \"domainkit\", (handlers) =>\n    Effect.gen(function* () {\n      const identity = yield* Identity;\n      const connect = yield* Connect.Service;\n      const provision = yield* Provision.Service;\n      const cleanup = yield* Cleanup.Service;\n      const verify = yield* Verify.Service;\n      const storage = yield* Storage.Service;\n\n      /**\n       * Run a lifecycle effect as the principal the host derives from this request, once the host\n       * has allowed that principal onto this route.\n       */\n      const as = <A>(\n        endpoint: EndpointName,\n        request: HttpServerRequest.HttpServerRequest,\n        effect: Effect.Effect<A, Errors.DomainKitError, Principal.Service>,\n      ): Effect.Effect<A, Errors.DomainKitError> =>\n        Effect.flatMap(identity.principal(request), (principal) =>\n          Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () =>\n            Effect.provideService(effect, Principal.Service, principal),\n          ),\n        );\n\n      const snapshot = (domain: string) => Effect.map(connect.inspect(domain), snapshotOf);\n\n      const discovered = (discovery: Connect.Discovery): Discovery => {\n        switch (discovery._tag) {\n          case \"Resolved\":\n            return new DiscoveryResolved({\n              connectionId: discovery.connectionId,\n              zone: discovery.target.zone,\n              label: discovery.target.label,\n            });\n          case \"SelectionRequired\":\n            return new DiscoverySelectionRequired({\n              candidates: discovery.candidates.map(({ connectionId, target }) => ({\n                connectionId,\n                zone: target.zone,\n                label: target.label,\n              })),\n            });\n          case \"NotFound\":\n            return new DiscoveryNotFound({ nameservers: discovery.nameservers });\n        }\n      };\n\n      const connected = (domain: string) =>\n        Effect.map(snapshot(domain), (value) => new Connected({ snapshot: value }));\n\n      const startedOf = (\n        started: Connect.Started,\n        domain: string,\n      ): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> => {\n        switch (started._tag) {\n          case \"Connected\":\n            return connected(domain);\n          case \"Redirect\":\n            return Effect.succeed(new Redirect({ authorizationUrl: started.authorizationUrl }));\n          case \"SelectionRequired\":\n            return Effect.succeed(\n              new SelectionRequired({\n                connectionId: started.connection.id,\n                candidates: candidatesOf(started.candidates),\n              }),\n            );\n        }\n      };\n\n      /**\n       * Attach with a zone the client picked out of a `SelectionRequired`. The provider target\n       * behind a zone never crosses the wire, so resolve the candidates again and match by zone.\n       */\n      const attachAt = (input: {\n        readonly connectionId: string;\n        readonly domain: string;\n        readonly zone: string | undefined;\n      }): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const first = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n          });\n          if (!(\"_tag\" in first)) return yield* connected(input.domain);\n          if (input.zone === undefined) {\n            return new SelectionRequired({\n              connectionId: input.connectionId,\n              candidates: candidatesOf(first.candidates),\n            });\n          }\n          const target = first.candidates.find(({ zone }) => zone === input.zone);\n          if (target === undefined) {\n            return yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }));\n          }\n          yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n            target,\n          });\n          return yield* connected(input.domain);\n        });\n\n      /** Provisioning and cleanup share the approve and apply routes; the attempt knows its kind. */\n      const kindOf = (attempt: Storage.Attempt) =>\n        attempt.kind === \"cleanup\" ? cleanup : provision;\n\n      return handlers\n        .handle(\"inspect\", ({ params, request }) => as(\"inspect\", request, snapshot(params.domain)))\n        .handle(\"discover\", ({ params, request }) =>\n          as(\"discover\", request, Effect.map(connect.discover(params.domain), discovered)),\n        )\n        .handle(\"start\", ({ payload, request }) =>\n          as(\n            \"start\",\n            request,\n            Effect.gen(function* () {\n              // Token methods connect in one call; the interactive ones need somewhere to land.\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: payload.provider,\n                      options,\n                      route: START_ROUTE,\n                    })).toString();\n              const started = yield* connect.start({\n                provider: payload.provider,\n                domain: payload.domain,\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, payload.domain);\n            }),\n          ),\n        )\n        .handle(\"callback\", ({ params, query, request }) =>\n          as(\n            \"callback\",\n            request,\n            Effect.gen(function* () {\n              const url = yield* absoluteUrl(request);\n              // Resolve the destination against the callback's public base, not the request: a\n              // proxy that rewrites `Host` leaves the request on an origin the browser never sees.\n              const base = yield* callbackUrlFor({\n                request,\n                provider: params.provider,\n                options,\n                route: callbackRoute(params.provider),\n              });\n              // Where the customer lands comes from the continuation this owner started, never\n              // from the provider's query string, and it is resolved before the callback is spent:\n              // a server with nowhere to send them must not connect the provider and then fail.\n              const continuation = yield* storage.continuations.get(query.state);\n              const requested = continuation.returnTo ?? options.defaultReturnTo;\n              if (requested === undefined) {\n                return yield* invalid(\n                  \"The flow carried no returnTo and the server has no defaultReturnTo\",\n                  \"returnTo\",\n                );\n              }\n              const destination = sameOrigin(requested, base);\n              if (destination === null) {\n                return yield* invalid(`${requested} leaves this application`, \"returnTo\");\n              }\n              yield* connect.complete({\n                continuationId: query.state,\n                callbackUrl: url.toString(),\n              });\n              return HttpApiSchema.withHeaders({\n                body: undefined as void,\n                headers: { location: destination },\n              });\n            }),\n          ),\n        )\n        .handle(\"attach\", ({ params, payload, request }) =>\n          as(\n            \"attach\",\n            request,\n            attachAt({\n              connectionId: params.connectionId,\n              domain: payload.domain,\n              zone: payload.zone,\n            }),\n          ),\n        )\n        .handle(\"detach\", ({ params, request }) =>\n          as(\"detach\", request, connect.detach(params.attachmentId)),\n        )\n        .handle(\"disconnect\", ({ params, request }) =>\n          as(\"disconnect\", request, connect.disconnect(params.connectionId)),\n        )\n        .handle(\"createPlan\", ({ params, payload, request }) =>\n          as(\n            \"createPlan\",\n            request,\n            provision.plan({ domain: params.domain, requirements: payload.requirements }),\n          ),\n        )\n        .handle(\"approve\", ({ params, payload, request }) =>\n          as(\n            \"approve\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).approve(params.planId, {\n                ...(payload.operationIds === undefined\n                  ? {}\n                  : { operationIds: payload.operationIds, allowPartial: true }),\n              });\n            }),\n          ),\n        )\n        .handle(\"reject\", ({ params, payload, request }) =>\n          as(\n            \"reject\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).reject(params.planId, {\n                ...(payload.reason === undefined ? {} : { reason: payload.reason }),\n              });\n            }),\n          ),\n        )\n        .handle(\"apply\", ({ params, request }) =>\n          as(\n            \"apply\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.byApproval(params.approvalId);\n              return yield* kindOf(attempt).apply(params.approvalId);\n            }),\n          ),\n        )\n        .handle(\"plan\", ({ params, request }) =>\n          as(\n            \"plan\",\n            request,\n            Effect.map(storage.attempts.get(params.planId), (attempt) => ({\n              plan: attempt.plan,\n              status: attempt.status,\n              approval: attempt.approval,\n              receipt: attempt.receipt,\n              rejection: attempt.rejection,\n            })),\n          ),\n        )\n        .handle(\"receipt\", ({ params, request }) =>\n          as(\n            \"receipt\",\n            request,\n            Effect.flatMap(storage.attempts.byReceipt(params.receiptId), (attempt) =>\n              attempt.receipt === null\n                ? Errors.fail(new Reason.NotFound({ entity: \"receipt\", id: params.receiptId }))\n                : Effect.succeed(attempt.receipt),\n            ),\n          ),\n        )\n        .handle(\"observe\", ({ params, payload, request }) =>\n          as(\n            \"observe\",\n            request,\n            verify.observe({\n              domain: params.domain,\n              ...(payload.requirements === undefined ? {} : { requirements: payload.requirements }),\n            }),\n          ),\n        )\n        .handle(\"cleanupPlan\", ({ params, request }) =>\n          as(\"cleanupPlan\", request, cleanup.plan({ receiptId: params.receiptId })),\n        );\n    }),\n  ) as Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services>;\n\n/** A standalone API for hosts not on HttpApi. Mount at any prefix. */\nexport const api: HttpApi.HttpApi<\"domainkit\", Group> = HttpApi.make(\"domainkit\").add(group);\n\nexport interface WebHandlerOptions extends Options {\n  /** Mount every route under this path, e.g. `/api/domainkit`. */\n  readonly prefix?: `/${string}`;\n}\n\n/** The Promise edge: a `fetch`-shaped handler over the group for hosts that are not Effect-native. */\nexport const toWebHandler = (\n  services: Layer.Layer<Services, Errors.DomainKitError>,\n  options: WebHandlerOptions = {},\n): {\n  readonly handler: (request: Request) => Promise<Response>;\n  readonly dispose: () => Promise<void>;\n} => {\n  // `group.prefix` widens the endpoint paths in the type, which `Group` states unprefixed; the\n  // handlers are keyed by endpoint identifier, so the routes still line up.\n  const prefixed =\n    options.prefix === undefined\n      ? api\n      : (HttpApi.make(\"domainkit\").add(group.prefix(options.prefix)) as unknown as HttpApi.HttpApi<\n          \"domainkit\",\n          Group\n        >);\n  const app = HttpApiBuilder.layer(prefixed).pipe(\n    Layer.provide(layer(prefixed, options)),\n    Layer.provide(services),\n    Layer.provide(HttpServer.layerServices),\n  );\n  return HttpRouter.toWebHandler(app, { disableLogger: true });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAa,WAAb,cAA8B,QAAQ,QAAmC,CAAC,CACxE,4BACF,CAAC,CAAC,CAAC;AAMH,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAgB;CAAa;AAAW,CAAC;;AAI1F,MAAa,QAAQ,OAAO,OAAO;CACjC,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ,OAAO;AACjB,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO;CAC5C,MAAMA;CACN,OAAO,OAAO;CACd,SAAS,OAAO,OAAO,OAAO,MAAM;CACpC,QAAQ,OAAO,OAAO,OAAO,MAAM,KAAK,CAAC;AAC3C,CAAC;;AAID,MAAa,WAAW,OAAO,OAAO;CACpC,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,UAAU,OAAO,OAAO,OAAO,MAAM;CACrC,QAAQ,OAAO,OAAOA,UAAkB;CACxC,QAAQ;CACR,eAAe,OAAO,OAAO,OAAO,MAAM;CAC1C,UAAU,OAAO,MACf,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQA;CACV,CAAC,CACH;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;;;;;;AAQD,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,EACpD,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,UAAU,OAAO,YAAY,OAAO,MAAM,EAC5C,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,cAAb,cAAiC,OAAO,YACtC,sCACF,CAAC,CAAC,eAAe,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACnE,MAAa,SAAS,OAAO,MAAM;CAAC;CAAO;CAAO;AAAW,CAAC;AAG9D,MAAa,eAAe,OAAO,OAAO;CACxC,QAAQ,OAAO;CACf,UAAU,OAAO;CACjB,QAAQ;AACV,CAAC;;AAID,IAAa,YAAb,cAA+B,OAAO,MAAiB,6BAA6B,CAAC,CAAC;CACpF,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,YAAb,cAA+B,OAAO,YAAuB,qCAAqC,CAAC,CACjG,aACA,EAAE,UAAU,SAAS,CACvB,CAAC,CAAC,CAAC;AACH,IAAa,WAAb,cAA8B,OAAO,YAAsB,oCAAoC,CAAC,CAC9F,YACA,EAAE,kBAAkB,OAAO,OAAO,CACpC,CAAC,CAAC,CAAC;AACH,IAAa,oBAAb,cAAuC,OAAO,YAC5C,6CACF,CAAC,CAAC,qBAAqB;CAAE,cAAc,OAAO;CAAQ,YAAY,OAAO,MAAM,SAAS;AAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAa,UAAU,OAAO,MAAM;CAAC;CAAW;CAAU;AAAiB,CAAC;;;;;;AAQ5E,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAAC,CAAC,CAAC;AAC3F,IAAa,6BAAb,cAAgD,OAAO,YACrD,+CACF,CAAC,CAAC,qBAAqB,EACrB,YAAY,OAAO,MACjB,OAAO,OAAO;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAC1F,EACF,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY,EAAE,aAAa,OAAO,MAAM,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7D,MAAa,YAAY,OAAO,MAAM;CACpC;CACA;CACA;AACF,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;CACzC,QAAQ,OAAO;;CAEf,MAAM,OAAO,YAAY,OAAO,MAAM;AACxC,CAAC;AAGD,MAAa,cAAc,OAAO,OAAO,EACvC,cAAc,OAAO,MAAMC,KAAe,EAC5C,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMA,KAAe,CAAC,EAChE,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMC,WAAgB,CAAC,EACjE,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;;AAEzC,QAAQ,OAAO,YAAY,OAAO,MAAM,EAC1C,CAAC;;AAID,MAAa,UAAU,OAAO,OAAO;CACnC,MAAMC;CACN,QAAQC;CACR,UAAU,OAAO,OAAOC,OAAc;CACtC,SAAS,OAAO,OAAOC,OAAa;CACpC,WAAW,OAAO,OAAOC,SAAiB;AAC5C,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,SAASC;CACT,cAAc,OAAO,MACnB,OAAO,OAAO;EACZ,aAAa,OAAO,OAAON,WAAgB;EAC3C,QAAQD;EACR,QAAQQ;EACR,UAAU,OAAO,MAAMC,QAAe;CACxC,CAAC,CACH;CACA,MAAM,OAAO,MAAMC,YAAmB;CACtC,WAAW,OAAO;CAClB,aAAa,OAAO,OAAO,OAAO,qBAAqB;AACzD,CAAC;AAGD,MAAM,aAAa,cAAc,YAAY,cAAc,MAAM,GAAG,GAAG,EACrE,UAAU,OAAO,OACnB,CAAC;;AAOD,MAAM,WAAW,WAAA,eACO,MACpB,OAAO,YAAY,UAAiC,MAAM,eAAe,MAAM,CACjF,CAAC,CAAC,KAAK,cAAc,OAAO,MAAM,CAAC;AAErC,MAAM,SAAS;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC,CAAC,IAAI,OAAO;AAMxE,MAAa,QAAQ,aAAa,KAAK,WAAW,CAAC,CAChD,IACC,gBAAgB,IAAI,WAAW,oBAAoB;CACjD,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,8BAA8B;CAC5D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gBAAgB;CAC5C,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,uBAAuB;CACrD,QAAQ,EAAE,UAAU,OAAO,OAAO;CAIlC,OAAO;EAAE,OAAO,OAAO;EAAQ,MAAM,OAAO,YAAY,OAAO,MAAM;CAAE;CACvE,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,0CAA0C;CACvE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,UAAU,8BAA8B;CAC7D,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,cAAc,8BAA8B;CACjE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,cAAc,0BAA0B;CAC3D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,4BAA4B;CAC1D,QAAQ,EAAE,QAAQS,OAAY;CAC9B,SAAS;CACT,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,6BAA6B;CAC1D,QAAQ,EAAE,QAAQO,OAAY;CAC9B,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gCAAgC;CAC5D,QAAQ,EAAE,YAAYC,WAAoB;CAC1C,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,QAAQ,kBAAkB;CAC5C,QAAQ,EAAE,QAAQM,OAAY;CAC9B,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,WAAW,wBAAwB;CACrD,QAAQ,EAAE,WAAWE,UAAkB;CACvC,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,iCAAiC;CAC/D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,eAAe,sCAAsC;CACxE,QAAQ,EAAE,WAAWQ,UAAkB;CACvC,SAASX;CACT,OAAO;AACT,CAAC,CACH;AAgCF,MAAM,cAAc;AACpB,MAAM,iBAAiB,aAAqB,aAAa,mBAAmB,QAAQ;AAEpF,MAAM,WAAW,SAAiB,UAChCY,KAAY,IAAIC,aAAoB;CAAE;CAAS,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AAAG,CAAC,CAAC;;AAG7F,MAAM,eACJ,YAEA,OAAO,cAAc;CACnB,IAAI;EACF,OAAO,OAAO,QAAQ,IAAI,IAAI,QAAQ,WAAW,CAAC;CACpD,QAAQ;EACN,MAAM,MAAM,kBAAkB,MAAM,OAAO;EAC3C,OAAO,OAAO,OAAO,GAAG,IACpB,QAAQ,yDAAyD,iBAAiB,IAClF,OAAO,QAAQ,IAAI,KAAK;CAC9B;AACF,CAAC;;;;;;;AAQH,MAAM,kBAAkB,UAOtB,OAAO,cAAc;CACnB,MAAM,SAAS,aAAa,mBAAmB,MAAM,QAAQ;CAC7D,MAAM,aAAa,MAAM,QAAQ;CACjC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,IAAI;EAChB,WAAW,IAAI,IAAI,GAAG,WAAW,QAAQ,QAAQ,EAAE,IAAI,QAAQ;EAC/D,aAAa,2BAA2B,GAAG,WAAW,cAAc;CACtE,CAAC;CAEH,OAAO,OAAO,QAAQ,YAAY,MAAM,OAAO,IAAI,QAAQ;EACzD,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,KAAK,SAAS,MAAM,KAAK,GAC5B,OAAO,QACL,OAAO,MAAM,MAAM,2DACnB,iBACF;EAEF,OAAO,OAAO,QACZ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,MAAM,GAAG,KAAK,SAAS,MAAM,MAAM,MAAM,IAAI,QAAQ,CACpF;CACF,CAAC;AACH,CAAC;AAEH,MAAM,8BAA8B,YAClC,IAAIC,eAAsB,EACxB,QAAQ,IAAID,aAAoB;CAAE;CAAS,OAAO;AAAkB,CAAC,EACvE,CAAC;;;;;;AAOH,MAAM,cAAc,aAAqB,aAAiC;CACxE,IAAI;EAIF,MAAM,MAAM,IAAI,IAAI,aAAa,QAAQ;EACzC,OAAO,IAAI,WAAW,SAAS,SAAS,IAAI,SAAS,IAAI;CAC3D,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,cAAc,cAA0C;CAC5D,QAAQ,SAAS;CACjB,cAAc,SAAS,YAAY,MAAM;CACzC,cAAc,SAAS,YAAY,MAAM;CACzC,UAAU,SAAS,eAAe,YAAY;CAC9C,QAAQ,SAAS,eAAe,UAAU;CAC1C,QACE,SAAS,eAAe,OACpB,iBACA,SAAS,eAAe,eAAe,WACrC,cACA;CACR,eAAe,SAAS;CACxB,UAAU,SAAS,SAAS,KAAK,EAAE,YAAY,UAAU,cAAc;EACrE,cAAc,WAAW;EACzB;EACA;CACF,EAAE;CACF,WAAW,SAAS,UAAU,KAAK,EAAE,IAAI,MAAM,eAAe;EAAE;EAAI;EAAM;CAAQ,EAAE;AACtF;;AAGA,MAAM,YAAY,WAAmC;CACnD,QAAQ,OAAO,MAAf;EACE,KAAK,SACH,OAAA,SAAsB,MAAM,OAAO,MAAM;EAC3C,KAAK,SACH,OAAA,SAAsB,MACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;EACF,KAAK,eACH,OAAA,SAAsB,YACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;CACJ;AACF;AAEA,MAAM,gBACJ,eAC6B,WAAW,KAAK,EAAE,MAAM,YAAY,IAAI,UAAU;CAAE;CAAM;AAAM,CAAC,CAAC;;;;;AAMjG,MAAa,SACX,KACA,UAAmB,CAAC,MAIpB,eAAe,MAAM,KAAiD,cAAc,aAClF,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAOE;CACvB,MAAM,YAAY,OAAOC;CACzB,MAAM,UAAU,OAAOC;CACvB,MAAM,SAAS,OAAOC;CACtB,MAAM,UAAU,OAAOC;;;;;CAMvB,MAAM,MACJ,UACA,SACA,WAEA,OAAO,QAAQ,SAAS,UAAU,OAAO,IAAI,cAC3C,OAAO,QAAQ,SAAS,YAAY,WAAW,QAAQ,KAAK,OAAO,YACjE,OAAO,eAAe,QAAQC,SAAmB,SAAS,CAC5D,CACF;CAEF,MAAM,YAAY,WAAmB,OAAO,IAAI,QAAQ,QAAQ,MAAM,GAAG,UAAU;CAEnF,MAAM,cAAc,cAA4C;EAC9D,QAAQ,UAAU,MAAlB;GACE,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,cAAc,UAAU;IACxB,MAAM,UAAU,OAAO;IACvB,OAAO,UAAU,OAAO;GAC1B,CAAC;GACH,KAAK,qBACH,OAAO,IAAI,2BAA2B,EACpC,YAAY,UAAU,WAAW,KAAK,EAAE,cAAc,cAAc;IAClE;IACA,MAAM,OAAO;IACb,OAAO,OAAO;GAChB,EAAE,EACJ,CAAC;GACH,KAAK,YACH,OAAO,IAAI,kBAAkB,EAAE,aAAa,UAAU,YAAY,CAAC;EACvE;CACF;CAEA,MAAM,aAAa,WACjB,OAAO,IAAI,SAAS,MAAM,IAAI,UAAU,IAAI,UAAU,EAAE,UAAU,MAAM,CAAC,CAAC;CAE5E,MAAM,aACJ,SACA,WACqE;EACrE,QAAQ,QAAQ,MAAhB;GACE,KAAK,aACH,OAAO,UAAU,MAAM;GACzB,KAAK,YACH,OAAO,OAAO,QAAQ,IAAI,SAAS,EAAE,kBAAkB,QAAQ,iBAAiB,CAAC,CAAC;GACpF,KAAK,qBACH,OAAO,OAAO,QACZ,IAAI,kBAAkB;IACpB,cAAc,QAAQ,WAAW;IACjC,YAAY,aAAa,QAAQ,UAAU;GAC7C,CAAC,CACH;EACJ;CACF;;;;;CAMA,MAAM,YAAY,UAKhB,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,QAAQ,OAAO;GAClC,cAAc,MAAM;GACpB,QAAQ,MAAM;EAChB,CAAC;EACD,IAAI,EAAE,UAAU,QAAQ,OAAO,OAAO,UAAU,MAAM,MAAM;EAC5D,IAAI,MAAM,SAAS,KAAA,GACjB,OAAO,IAAI,kBAAkB;GAC3B,cAAc,MAAM;GACpB,YAAY,aAAa,MAAM,UAAU;EAC3C,CAAC;EAEH,MAAM,SAAS,MAAM,WAAW,MAAM,EAAE,WAAW,SAAS,MAAM,IAAI;EACtE,IAAI,WAAW,KAAA,GACb,OAAO,OAAOR,KAAY,IAAIS,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC;EAEnF,OAAO,QAAQ,OAAO;GACpB,cAAc,MAAM;GACpB,QAAQ,MAAM;GACd;EACF,CAAC;EACD,OAAO,OAAO,UAAU,MAAM,MAAM;CACtC,CAAC;;CAGH,MAAM,UAAU,YACd,QAAQ,SAAS,YAAY,UAAU;CAEzC,OAAO,SACJ,OAAO,YAAY,EAAE,QAAQ,cAAc,GAAG,WAAW,SAAS,SAAS,OAAO,MAAM,CAAC,CAAC,CAAC,CAC3F,OAAO,aAAa,EAAE,QAAQ,cAC7B,GAAG,YAAY,SAAS,OAAO,IAAI,QAAQ,SAAS,OAAO,MAAM,GAAG,UAAU,CAAC,CACjF,CAAC,CACA,OAAO,UAAU,EAAE,SAAS,cAC3B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EAEtB,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,QAAQ;GAClB;GACA,OAAO;EACT,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,MAAM;GACnC,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,QAAQ,MAAM;CACjD,CAAC,CACH,CACF,CAAC,CACA,OAAO,aAAa,EAAE,QAAQ,OAAO,cACpC,GACE,YACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,YAAY,OAAO;EAGtC,MAAM,OAAO,OAAO,eAAe;GACjC;GACA,UAAU,OAAO;GACjB;GACA,OAAO,cAAc,OAAO,QAAQ;EACtC,CAAC;EAKD,MAAM,aAAY,OADU,QAAQ,cAAc,IAAI,MAAM,KAAK,EAAA,CAClC,YAAY,QAAQ;EACnD,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,QACZ,sEACA,UACF;EAEF,MAAM,cAAc,WAAW,WAAW,IAAI;EAC9C,IAAI,gBAAgB,MAClB,OAAO,OAAO,QAAQ,GAAG,UAAU,2BAA2B,UAAU;EAE1E,OAAO,QAAQ,SAAS;GACtB,gBAAgB,MAAM;GACtB,aAAa,IAAI,SAAS;EAC5B,CAAC;EACD,OAAO,cAAc,YAAY;GAC/B,MAAM,KAAA;GACN,SAAS,EAAE,UAAU,YAAY;EACnC,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,SAAS;EACP,cAAc,OAAO;EACrB,QAAQ,QAAQ;EAChB,MAAM,QAAQ;CAChB,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,cAC3B,GAAG,UAAU,SAAS,QAAQ,OAAO,OAAO,YAAY,CAAC,CAC3D,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,cAC/B,GAAG,cAAc,SAAS,QAAQ,WAAW,OAAO,YAAY,CAAC,CACnE,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,SAAS,cACxC,GACE,cACA,SACA,UAAU,KAAK;EAAE,QAAQ,OAAO;EAAQ,cAAc,QAAQ;CAAa,CAAC,CAC9E,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,QAAQ,OAAO,QAAQ,EACnD,GAAI,QAAQ,iBAAiB,KAAA,IACzB,CAAC,IACD;GAAE,cAAc,QAAQ;GAAc,cAAc;EAAK,EAC/D,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,EAClD,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO,EACnE,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,UAAU,EAAE,QAAQ,cAC1B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,WAAW,OAAO,UAAU;EACpE,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,MAAM,OAAO,UAAU;CACvD,CAAC,CACH,CACF,CAAC,CACA,OAAO,SAAS,EAAE,QAAQ,cACzB,GACE,QACA,SACA,OAAO,IAAI,QAAQ,SAAS,IAAI,OAAO,MAAM,IAAI,aAAa;EAC5D,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,UAAU,QAAQ;EAClB,SAAS,QAAQ;EACjB,WAAW,QAAQ;CACrB,EAAE,CACJ,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,cAC5B,GACE,WACA,SACA,OAAO,QAAQ,QAAQ,SAAS,UAAU,OAAO,SAAS,IAAI,YAC5D,QAAQ,YAAY,OAChBT,KAAY,IAAIS,SAAgB;EAAE,QAAQ;EAAW,IAAI,OAAO;CAAU,CAAC,CAAC,IAC5E,OAAO,QAAQ,QAAQ,OAAO,CACpC,CACF,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,QAAQ;EACb,QAAQ,OAAO;EACf,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;CACrF,CAAC,CACH,CACF,CAAC,CACA,OAAO,gBAAgB,EAAE,QAAQ,cAChC,GAAG,eAAe,SAAS,QAAQ,KAAK,EAAE,WAAW,OAAO,UAAU,CAAC,CAAC,CAC1E;AACJ,CAAC,CACH;;AAGF,MAAa,MAA2C,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,KAAK;;AAQ3F,MAAa,gBACX,UACA,UAA6B,CAAC,MAI3B;CAGH,MAAM,WACJ,QAAQ,WAAW,KAAA,IACf,MACC,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,MAAM,OAAO,QAAQ,MAAM,CAAC;CAIjE,MAAM,MAAM,eAAe,MAAM,QAAQ,CAAC,CAAC,KACzC,MAAM,QAAQ,MAAM,UAAU,OAAO,CAAC,GACtC,MAAM,QAAQ,QAAQ,GACtB,MAAM,QAAQ,WAAW,aAAa,CACxC;CACA,OAAO,WAAW,aAAa,KAAK,EAAE,eAAe,KAAK,CAAC;AAC7D"}

package/dist/Storage.mjs

@@ -0,0 +1,236 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Model } from "./DnsRecord.mjs";
+import { Kind, Model as Model$1, OperationId, PlanId } from "./Plan.mjs";
+import { Busy, StorageFailed } from "./Reason.mjs";
+import { DomainKitError, fail, isDomainKitError } from "./internal/error.mjs";
+import { Model as Model$2 } from "./Approval.mjs";
+import { Service as Service$1 } from "./Principal.mjs";
+import { makeMemory } from "./internal/storage-memory.mjs";
+import { Model as Model$3, ReceiptId } from "./Receipt.mjs";
+import { Context, Effect, Layer, Option, Schema } from "effect";
+//#region src/Storage.ts
+/**
+* Everything DomainKit persists, behind one service the host installs once. Every method requires
+* `Principal` and is scoped by it. `@domainkit/capsuledb` ships the Postgres implementation;
+* `domainkit/testing` ships the memory one; both pass `Testing.conformance.storage`.
+*
+* Storage never sees plaintext credentials: `Connect` seals secrets through `Custody` before
+* writing a `Credential` row and opens them after reading one.
+*
+* Grouped by noun so the 25-odd methods stay navigable. Implementations must satisfy the
+* invariants documented per group; the conformance suite checks them.
+*/
+var Storage_exports = /* @__PURE__ */ __exportAll({
+	Attachment: () => Attachment,
+	Attempt: () => Attempt,
+	AttemptStatus: () => AttemptStatus,
+	AuthMethod: () => AuthMethod,
+	Authorization: () => Authorization,
+	Capability: () => Capability,
+	Connection: () => Connection,
+	Continuation: () => Continuation,
+	Credential: () => Credential,
+	Overall: () => Overall,
+	Readiness: () => Readiness,
+	Rejection: () => Rejection,
+	RequirementStatus: () => RequirementStatus,
+	Service: () => Service,
+	fromAsync: () => fromAsync,
+	layerFromAsync: () => layerFromAsync,
+	layerMemory: () => layerMemory,
+	layerMemoryWith: () => layerMemoryWith,
+	makeMemory: () => makeMemory
+});
+const Capability = Schema.Literals(["dns:read", "dns:write"]);
+const AuthMethod = Schema.Literals([
+	"token",
+	"oauth",
+	"integration"
+]);
+/** Sealed provider credential plus the metadata needed without unsealing it. */
+var Credential = class extends Schema.Class("@domainkit/Storage/Credential")({
+	ciphertext: Schema.String,
+	expiresAt: Schema.NullOr(Schema.DateTimeUtcFromString),
+	rotatedAt: Schema.DateTimeUtcFromString
+}) {};
+/** One provider authorization (an OAuth grant or a token) owned by a principal. */
+var Authorization = class extends Schema.Class("@domainkit/Storage/Authorization")({
+	id: Schema.String,
+	ownerId: Schema.String,
+	provider: Schema.String,
+	method: AuthMethod,
+	capabilities: Schema.Array(Capability),
+	/** Provider-specific account context (account id, team id, ...) decoded by the provider's `context` schema. */
+	context: Schema.Unknown,
+	revocation: Schema.Literals([
+		"active",
+		"pending",
+		"revoked"
+	]),
+	createdBy: Schema.String,
+	createdAt: Schema.DateTimeUtcFromString
+}) {};
+/** A connection is the principal-facing handle over an authorization; one authorization, many domains. */
+var Connection = class extends Schema.Class("@domainkit/Storage/Connection")({
+	id: Schema.String,
+	ownerId: Schema.String,
+	authorizationId: Schema.String,
+	createdAt: Schema.DateTimeUtcFromString
+}) {};
+var Attachment = class extends Schema.Class("@domainkit/Storage/Attachment")({
+	id: Schema.String,
+	ownerId: Schema.String,
+	connectionId: Schema.String,
+	domain: Schema.String,
+	zone: Schema.String,
+	/** Provider zone identity (zone id, account id) decoded by the provider's `context` schema. */
+	target: Schema.Unknown,
+	createdAt: Schema.DateTimeUtcFromString
+}) {};
+/** Interactive-flow state between `Connect.start` and `Connect.complete`. */
+var Continuation = class extends Schema.Class("@domainkit/Storage/Continuation")({
+	id: Schema.String,
+	ownerId: Schema.String,
+	actorId: Schema.String,
+	provider: Schema.String,
+	payload: Schema.Unknown,
+	returnTo: Schema.NullOr(Schema.String),
+	expiresAt: Schema.DateTimeUtcFromString
+}) {};
+const AttemptStatus = Schema.Literals([
+	"planned",
+	"approved",
+	"applying",
+	"complete",
+	"partial",
+	"failed",
+	"expired",
+	"rejected"
+]);
+/** Who declined the plan, why, and when. Terminal: the domain needs a new plan. */
+const Rejection = Schema.Struct({
+	actorId: Schema.String,
+	reason: Schema.NullOr(Schema.String),
+	at: Schema.DateTimeUtcFromString
+});
+/** One durable plan -> approval -> receipt lifecycle. */
+var Attempt = class extends Schema.Class("@domainkit/Storage/Attempt")({
+	id: PlanId,
+	ownerId: Schema.String,
+	attachmentId: Schema.String,
+	kind: Kind,
+	status: AttemptStatus,
+	plan: Model$1,
+	approval: Schema.NullOr(Model$2),
+	receipt: Schema.NullOr(Model$3),
+	rejection: Schema.NullOr(Rejection),
+	/** Cleanup attempts point at the provisioning receipt they undo. */
+	sourceReceiptId: Schema.NullOr(ReceiptId),
+	leaseExpiresAt: Schema.NullOr(Schema.DateTimeUtcFromString),
+	/** Why the last apply stopped before any write; cleared on the next claim. */
+	failure: Schema.NullOr(Schema.String),
+	updatedAt: Schema.DateTimeUtcFromString
+}) {};
+const RequirementStatus = Schema.Literals([
+	"satisfied",
+	"missing",
+	"mismatch",
+	"unknown"
+]);
+const Overall = Schema.Literals([
+	"ready",
+	"pending",
+	"failed"
+]);
+/**
+* Latest observed readiness for one domain, written by `Verify.observe`. Keyed by domain so
+* observe-only hosts (no attachment, public DNS alone) get the same row; `attachmentId` links the
+* attachment when one exists.
+*/
+var Readiness = class extends Schema.Class("@domainkit/Storage/Readiness")({
+	domain: Schema.String,
+	attachmentId: Schema.NullOr(Schema.String),
+	ownerId: Schema.String,
+	overall: Overall,
+	requirements: Schema.Array(Schema.Struct({
+		operationId: Schema.NullOr(OperationId),
+		record: Model,
+		status: RequirementStatus,
+		/** Encoded `Verify.Evidence` values. */
+		evidence: Schema.Array(Schema.Unknown)
+	})),
+	/** Encoded `Verify.HostEvidence` values, keyed by `source` on merge. */
+	host: Schema.Array(Schema.Unknown),
+	/** When the current pending streak began; drives the backoff ladder. */
+	pendingSince: Schema.NullOr(Schema.DateTimeUtcFromString),
+	checkedAt: Schema.DateTimeUtcFromString,
+	nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString)
+}) {};
+var Service = class extends Context.Service()("@domainkit/Storage") {};
+/** In-memory implementation for tests and local development. Not for production. */
+const layerMemory = Layer.sync(Service)(() => makeMemory());
+/** `layerMemory` with fault injection for storage-failure tests. */
+const layerMemoryWith = (options) => Layer.sync(Service)(() => makeMemory(options));
+const storageFailed = (operation) => (cause) => isDomainKitError(cause) ? cause : new DomainKitError({ reason: new StorageFailed({
+	operation,
+	message: cause instanceof Error ? cause.message : String(cause)
+}) });
+/** Wraps a Promise-shaped implementation. Rejections become `StorageFailed`. */
+const fromAsync = (service) => {
+	const call = (operation, run) => Effect.flatMap(Service$1, (principal) => Effect.tryPromise({
+		try: () => run(principal),
+		catch: storageFailed(operation)
+	}));
+	const option = (operation, run) => call(operation, run).pipe(Effect.map(Option.fromNullishOr));
+	return {
+		authorizations: {
+			upsert: (input) => call("authorizations.upsert", (p) => service.authorizations.upsert(p, input)),
+			get: (id) => call("authorizations.get", (p) => service.authorizations.get(p, id)),
+			credential: (id) => call("authorizations.credential", (p) => service.authorizations.credential(p, id)),
+			rotate: (id, credential) => call("authorizations.rotate", (p) => service.authorizations.rotate(p, id, credential)),
+			promoteCapabilities: (id, capabilities) => call("authorizations.promoteCapabilities", (p) => service.authorizations.promoteCapabilities(p, id, capabilities)),
+			revoke: (id, revoke) => call("authorizations.prepareRevocation", (p) => service.authorizations.prepareRevocation(p, id)).pipe(Effect.flatMap(() => revoke), Effect.flatMap(() => call("authorizations.completeRevocation", (p) => service.authorizations.completeRevocation(p, id)))),
+			recoverRevocations: (revoke) => call("authorizations.pendingRevocations", (p) => service.authorizations.pendingRevocations(p)).pipe(Effect.flatMap((pending) => Effect.forEach(pending, (authorization) => revoke(authorization).pipe(Effect.flatMap(() => call("authorizations.completeRevocation", (p) => service.authorizations.completeRevocation(p, authorization.id)))))), Effect.map((completed) => completed.length))
+		},
+		connections: {
+			create: (authorizationId) => call("connections.create", (p) => service.connections.create(p, authorizationId)),
+			get: (id) => call("connections.get", (p) => service.connections.get(p, id)),
+			list: (filter) => call("connections.list", (p) => service.connections.list(p, filter)),
+			remove: (id) => call("connections.remove", (p) => service.connections.remove(p, id))
+		},
+		attachments: {
+			create: (input) => call("attachments.create", (p) => service.attachments.create(p, input)),
+			get: (id) => call("attachments.get", (p) => service.attachments.get(p, id)),
+			byDomain: (domain) => option("attachments.byDomain", (p) => service.attachments.byDomain(p, domain)),
+			list: (connectionId) => call("attachments.list", (p) => service.attachments.list(p, connectionId)),
+			remove: (id) => call("attachments.remove", (p) => service.attachments.remove(p, id))
+		},
+		continuations: {
+			put: (continuation) => call("continuations.put", (p) => service.continuations.put(p, continuation)),
+			get: (id) => call("continuations.get", (p) => service.continuations.get(p, id)),
+			consume: (id) => call("continuations.consume", (p) => service.continuations.consume(p, id))
+		},
+		attempts: {
+			create: (attempt) => call("attempts.create", (p) => service.attempts.create(p, attempt)),
+			get: (id) => call("attempts.get", (p) => service.attempts.get(p, id)),
+			byApproval: (id) => call("attempts.byApproval", (p) => service.attempts.byApproval(p, id)),
+			byReceipt: (id) => call("attempts.byReceipt", (p) => service.attempts.byReceipt(p, id)),
+			latest: (attachmentId, kind) => option("attempts.latest", (p) => service.attempts.latest(p, attachmentId, kind)),
+			approve: (id, approval) => call("attempts.approve", (p) => service.attempts.approve(p, id, approval)),
+			reject: (id, input) => call("attempts.reject", (p) => service.attempts.reject(p, id, input)),
+			claim: (id, lease) => call("attempts.claim", (p) => service.attempts.claim(p, id, lease)),
+			complete: (id, receipt) => call("attempts.complete", (p) => service.attempts.complete(p, id, receipt)),
+			fail: (id, message) => call("attempts.fail", (p) => service.attempts.fail(p, id, message))
+		},
+		readiness: {
+			put: (readiness) => call("readiness.put", (p) => service.readiness.put(p, readiness)),
+			get: (domain) => option("readiness.get", (p) => service.readiness.get(p, domain))
+		},
+		withLock: (key, effect) => Effect.acquireRelease(call("acquireLock", (p) => service.acquireLock(p, key)).pipe(Effect.flatMap((acquired) => acquired ? Effect.void : fail(new Busy({ key })))), () => call("releaseLock", (p) => service.releaseLock(p, key)).pipe(Effect.ignore)).pipe(Effect.flatMap(() => effect), Effect.scoped)
+	};
+};
+const layerFromAsync = (service) => Layer.succeed(Service)(fromAsync(service));
+//#endregion
+export { Attachment, Attempt, AttemptStatus, AuthMethod, Authorization, Capability, Connection, Continuation, Credential, Overall, Readiness, Rejection, RequirementStatus, Service, Storage_exports, fromAsync, layerFromAsync, layerMemory, layerMemoryWith, makeMemory };
+
+//# sourceMappingURL=Storage.mjs.map

package/dist/Storage.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Storage.mjs","names":["Plan.PlanId","Plan.Kind","Plan.Model","Approval.Model","Receipt.Model","Receipt.ReceiptId","Plan.OperationId","DnsRecord.Model","Errors.isDomainKitError","Errors.DomainKitError","Reason.StorageFailed","Principal.Service","Errors.fail","Reason.Busy"],"sources":["../src/Storage.ts"],"sourcesContent":["/**\n * Everything DomainKit persists, behind one service the host installs once. Every method requires\n * `Principal` and is scoped by it. `@domainkit/capsuledb` ships the Postgres implementation;\n * `domainkit/testing` ships the memory one; both pass `Testing.conformance.storage`.\n *\n * Storage never sees plaintext credentials: `Connect` seals secrets through `Custody` before\n * writing a `Credential` row and opens them after reading one.\n *\n * Grouped by noun so the 25-odd methods stay navigable. Implementations must satisfy the\n * invariants documented per group; the conformance suite checks them.\n */\nimport { Context, DateTime, Effect, Layer, Option, Schema } from \"effect\";\n\nimport * as Approval from \"./Approval.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport { makeMemory } from \"./internal/storage-memory.ts\";\nimport * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Receipt from \"./Receipt.ts\";\n\nexport type Fx<A> = Effect.Effect<A, Errors.DomainKitError, Principal.Service>;\n\n// ---------------------------------------------------------------------------------------------\n// Rows\n// ---------------------------------------------------------------------------------------------\n\nexport const Capability = Schema.Literals([\"dns:read\", \"dns:write\"]);\nexport type Capability = typeof Capability.Type;\n\nexport const AuthMethod = Schema.Literals([\"token\", \"oauth\", \"integration\"]);\nexport type AuthMethod = typeof AuthMethod.Type;\n\n/** Sealed provider credential plus the metadata needed without unsealing it. */\nexport class Credential extends Schema.Class<Credential>(\"@domainkit/Storage/Credential\")({\n  ciphertext: Schema.String,\n  expiresAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n  rotatedAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/** One provider authorization (an OAuth grant or a token) owned by a principal. */\nexport class Authorization extends Schema.Class<Authorization>(\"@domainkit/Storage/Authorization\")({\n  id: Schema.String,\n  ownerId: Schema.String,\n  provider: Schema.String,\n  method: AuthMethod,\n  capabilities: Schema.Array(Capability),\n  /** Provider-specific account context (account id, team id, ...) decoded by the provider's `context` schema. */\n  context: Schema.Unknown,\n  revocation: Schema.Literals([\"active\", \"pending\", \"revoked\"]),\n  createdBy: Schema.String,\n  createdAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/** A connection is the principal-facing handle over an authorization; one authorization, many domains. */\nexport class Connection extends Schema.Class<Connection>(\"@domainkit/Storage/Connection\")({\n  id: Schema.String,\n  ownerId: Schema.String,\n  authorizationId: Schema.String,\n  createdAt: Schema.DateTimeUtcFromString,\n}) {}\n\nexport class Attachment extends Schema.Class<Attachment>(\"@domainkit/Storage/Attachment\")({\n  id: Schema.String,\n  ownerId: Schema.String,\n  connectionId: Schema.String,\n  domain: Schema.String,\n  zone: Schema.String,\n  /** Provider zone identity (zone id, account id) decoded by the provider's `context` schema. */\n  target: Schema.Unknown,\n  createdAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/** Interactive-flow state between `Connect.start` and `Connect.complete`. */\nexport class Continuation extends Schema.Class<Continuation>(\"@domainkit/Storage/Continuation\")({\n  id: Schema.String,\n  ownerId: Schema.String,\n  actorId: Schema.String,\n  provider: Schema.String,\n  payload: Schema.Unknown,\n  returnTo: Schema.NullOr(Schema.String),\n  expiresAt: Schema.DateTimeUtcFromString,\n}) {}\n\nexport const AttemptStatus = Schema.Literals([\n  \"planned\",\n  \"approved\",\n  \"applying\",\n  \"complete\",\n  \"partial\",\n  \"failed\",\n  \"expired\",\n  \"rejected\",\n]);\nexport type AttemptStatus = typeof AttemptStatus.Type;\n\n/** Who declined the plan, why, and when. Terminal: the domain needs a new plan. */\nexport const Rejection = Schema.Struct({\n  actorId: Schema.String,\n  reason: Schema.NullOr(Schema.String),\n  at: Schema.DateTimeUtcFromString,\n});\nexport type Rejection = typeof Rejection.Type;\n\n/** One durable plan -> approval -> receipt lifecycle. */\nexport class Attempt extends Schema.Class<Attempt>(\"@domainkit/Storage/Attempt\")({\n  id: Plan.PlanId,\n  ownerId: Schema.String,\n  attachmentId: Schema.String,\n  kind: Plan.Kind,\n  status: AttemptStatus,\n  plan: Plan.Model,\n  approval: Schema.NullOr(Approval.Model),\n  receipt: Schema.NullOr(Receipt.Model),\n  rejection: Schema.NullOr(Rejection),\n  /** Cleanup attempts point at the provisioning receipt they undo. */\n  sourceReceiptId: Schema.NullOr(Receipt.ReceiptId),\n  leaseExpiresAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n  /** Why the last apply stopped before any write; cleared on the next claim. */\n  failure: Schema.NullOr(Schema.String),\n  updatedAt: Schema.DateTimeUtcFromString,\n}) {}\n\nexport const RequirementStatus = Schema.Literals([\"satisfied\", \"missing\", \"mismatch\", \"unknown\"]);\nexport type RequirementStatus = typeof RequirementStatus.Type;\n\nexport const Overall = Schema.Literals([\"ready\", \"pending\", \"failed\"]);\nexport type Overall = typeof Overall.Type;\n\n/**\n * Latest observed readiness for one domain, written by `Verify.observe`. Keyed by domain so\n * observe-only hosts (no attachment, public DNS alone) get the same row; `attachmentId` links the\n * attachment when one exists.\n */\nexport class Readiness extends Schema.Class<Readiness>(\"@domainkit/Storage/Readiness\")({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  ownerId: Schema.String,\n  overall: Overall,\n  requirements: Schema.Array(\n    Schema.Struct({\n      operationId: Schema.NullOr(Plan.OperationId),\n      record: DnsRecord.Model,\n      status: RequirementStatus,\n      /** Encoded `Verify.Evidence` values. */\n      evidence: Schema.Array(Schema.Unknown),\n    }),\n  ),\n  /** Encoded `Verify.HostEvidence` values, keyed by `source` on merge. */\n  host: Schema.Array(Schema.Unknown),\n  /** When the current pending streak began; drives the backoff ladder. */\n  pendingSince: Schema.NullOr(Schema.DateTimeUtcFromString),\n  checkedAt: Schema.DateTimeUtcFromString,\n  nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n}) {}\n\n// ---------------------------------------------------------------------------------------------\n// Service\n// ---------------------------------------------------------------------------------------------\n\nexport interface Interface {\n  readonly authorizations: {\n    /**\n     * Insert, or CAS-replace when `expectedId` is set: the row must exist under this owner with an\n     * active revocation state, else `NotFound` / `Busy`.\n     */\n    readonly upsert: (input: {\n      readonly authorization: Authorization;\n      readonly credential: Credential;\n      readonly expectedId?: string;\n    }) => Fx<Authorization>;\n    readonly get: (id: string) => Fx<Authorization>;\n    readonly credential: (id: string) => Fx<Credential>;\n    readonly rotate: (id: string, credential: Credential) => Fx<void>;\n    readonly promoteCapabilities: (id: string, capabilities: ReadonlyArray<Capability>) => Fx<void>;\n    /**\n     * Two-phase: mark `pending`, run `revoke` outside any transaction, then delete. A failed\n     * `revoke` leaves the row pending; `recoverRevocations` finishes it later.\n     */\n    readonly revoke: <E, R>(\n      id: string,\n      revoke: Effect.Effect<void, E, R>,\n    ) => Effect.Effect<void, Errors.DomainKitError | E, Principal.Service | R>;\n    readonly recoverRevocations: <E, R>(\n      revoke: (authorization: Authorization) => Effect.Effect<void, E, R>,\n    ) => Effect.Effect<number, Errors.DomainKitError | E, Principal.Service | R>;\n  };\n  readonly connections: {\n    readonly create: (authorizationId: string) => Fx<Connection>;\n    readonly get: (id: string) => Fx<Connection>;\n    readonly list: (filter?: { readonly provider?: string }) => Fx<ReadonlyArray<Connection>>;\n    /** Fails `InvalidInput` while attachments still reference the connection. */\n    readonly remove: (id: string) => Fx<void>;\n  };\n  readonly attachments: {\n    /** One attachment per (owner, domain); a duplicate fails `InvalidInput`. */\n    readonly create: (input: {\n      readonly connectionId: string;\n      readonly domain: string;\n      readonly zone: string;\n      readonly target: unknown;\n    }) => Fx<Attachment>;\n    readonly get: (id: string) => Fx<Attachment>;\n    readonly byDomain: (domain: string) => Fx<Option.Option<Attachment>>;\n    readonly list: (connectionId: string) => Fx<ReadonlyArray<Attachment>>;\n    readonly remove: (id: string) => Fx<void>;\n  };\n  readonly continuations: {\n    readonly put: (continuation: Continuation) => Fx<void>;\n    /** Read without spending; a late read fails `Expired`. */\n    readonly get: (id: string) => Fx<Continuation>;\n    /** Exactly-once: the second consume of the same id fails `NotFound`; a late one fails `Expired`. */\n    readonly consume: (id: string) => Fx<Continuation>;\n  };\n  readonly attempts: {\n    readonly create: (attempt: Attempt) => Fx<Attempt>;\n    readonly get: (id: Plan.PlanId) => Fx<Attempt>;\n    readonly byApproval: (id: Approval.ApprovalId) => Fx<Attempt>;\n    readonly byReceipt: (id: Receipt.ReceiptId) => Fx<Attempt>;\n    readonly latest: (attachmentId: string, kind: Plan.Kind) => Fx<Option.Option<Attempt>>;\n    /** `planned` -> `approved`; approving again with the same approval id is a no-op, anything else fails `Stale`. */\n    readonly approve: (id: Plan.PlanId, approval: Approval.Model) => Fx<Attempt>;\n    /**\n     * `planned` -> `rejected` (terminal). Rejecting again returns the row unchanged; any other\n     * status fails `Stale`, `expired` fails `Expired`, and a digest mismatch fails `Stale`.\n     */\n    readonly reject: (\n      id: Plan.PlanId,\n      input: {\n        readonly digest: Plan.Digest;\n        readonly actorId: string;\n        readonly reason: string | null;\n      },\n    ) => Fx<Attempt>;\n    /**\n     * Atomic transition to `applying` with a lease from `approved`, `failed`, or an expired\n     * `applying`; fails `Busy` while a lease is live and `Stale` from any other status.\n     */\n    readonly claim: (id: Plan.PlanId, lease: DateTime.Utc) => Fx<Attempt>;\n    readonly complete: (id: Plan.PlanId, receipt: Receipt.Model) => Fx<Attempt>;\n    readonly fail: (id: Plan.PlanId, message: string) => Fx<Attempt>;\n  };\n  readonly readiness: {\n    /** One row per (owner, domain); `attachmentId`, when set, must exist for the owner. */\n    readonly put: (readiness: Readiness) => Fx<void>;\n    readonly get: (domain: string) => Fx<Option.Option<Readiness>>;\n  };\n  /** Single-flight guard keyed by string (credential refresh, apply). Fails `Busy` rather than waiting. */\n  readonly withLock: <A, E, R>(\n    key: string,\n    effect: Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | Errors.DomainKitError, R | Principal.Service>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Storage\") {}\n\nexport interface MemoryOptions {\n  /** Fault injection: runs before every mutation commits; failing here leaves state untouched. */\n  readonly beforeCommit?: (operation: string) => Effect.Effect<void, Errors.DomainKitError>;\n}\n\n/** In-memory implementation for tests and local development. Not for production. */\nexport const layerMemory: Layer.Layer<Service> = Layer.sync(Service)(() => makeMemory());\n\n/** `layerMemory` with fault injection for storage-failure tests. */\nexport const layerMemoryWith = (options: MemoryOptions): Layer.Layer<Service> =>\n  Layer.sync(Service)(() => makeMemory(options));\n\nexport { makeMemory };\n\n// ---------------------------------------------------------------------------------------------\n// Async adapter\n// ---------------------------------------------------------------------------------------------\n\n/**\n * A Promise-shaped implementation for hosts that persist without Effect. Every method takes the\n * principal explicitly. Rejections become `StorageFailed`; reject with a `DomainKit.Error` to keep\n * a typed reason. Two-phase revocation and locking are split into plain steps so no callback has\n * to run an Effect.\n */\nexport interface AsyncInterface {\n  readonly authorizations: {\n    readonly upsert: (\n      principal: Principal.Interface,\n      input: {\n        readonly authorization: Authorization;\n        readonly credential: Credential;\n        readonly expectedId?: string;\n      },\n    ) => Promise<Authorization>;\n    readonly get: (principal: Principal.Interface, id: string) => Promise<Authorization>;\n    readonly credential: (principal: Principal.Interface, id: string) => Promise<Credential>;\n    readonly rotate: (\n      principal: Principal.Interface,\n      id: string,\n      credential: Credential,\n    ) => Promise<void>;\n    readonly promoteCapabilities: (\n      principal: Principal.Interface,\n      id: string,\n      capabilities: ReadonlyArray<Capability>,\n    ) => Promise<void>;\n    /** Mark `pending` durably; must be idempotent. */\n    readonly prepareRevocation: (\n      principal: Principal.Interface,\n      id: string,\n    ) => Promise<Authorization>;\n    /** Delete the authorization after the provider confirmed revocation. */\n    readonly completeRevocation: (principal: Principal.Interface, id: string) => Promise<void>;\n    readonly pendingRevocations: (\n      principal: Principal.Interface,\n    ) => Promise<ReadonlyArray<Authorization>>;\n  };\n  readonly connections: {\n    readonly create: (\n      principal: Principal.Interface,\n      authorizationId: string,\n    ) => Promise<Connection>;\n    readonly get: (principal: Principal.Interface, id: string) => Promise<Connection>;\n    readonly list: (\n      principal: Principal.Interface,\n      filter?: { readonly provider?: string },\n    ) => Promise<ReadonlyArray<Connection>>;\n    readonly remove: (principal: Principal.Interface, id: string) => Promise<void>;\n  };\n  readonly attachments: {\n    readonly create: (\n      principal: Principal.Interface,\n      input: {\n        readonly connectionId: string;\n        readonly domain: string;\n        readonly zone: string;\n        readonly target: unknown;\n      },\n    ) => Promise<Attachment>;\n    readonly get: (principal: Principal.Interface, id: string) => Promise<Attachment>;\n    readonly byDomain: (\n      principal: Principal.Interface,\n      domain: string,\n    ) => Promise<Attachment | null>;\n    readonly list: (\n      principal: Principal.Interface,\n      connectionId: string,\n    ) => Promise<ReadonlyArray<Attachment>>;\n    readonly remove: (principal: Principal.Interface, id: string) => Promise<void>;\n  };\n  readonly continuations: {\n    readonly put: (principal: Principal.Interface, continuation: Continuation) => Promise<void>;\n    readonly get: (principal: Principal.Interface, id: string) => Promise<Continuation>;\n    readonly consume: (principal: Principal.Interface, id: string) => Promise<Continuation>;\n  };\n  readonly attempts: {\n    readonly create: (principal: Principal.Interface, attempt: Attempt) => Promise<Attempt>;\n    readonly get: (principal: Principal.Interface, id: Plan.PlanId) => Promise<Attempt>;\n    readonly byApproval: (\n      principal: Principal.Interface,\n      id: Approval.ApprovalId,\n    ) => Promise<Attempt>;\n    readonly byReceipt: (principal: Principal.Interface, id: Receipt.ReceiptId) => Promise<Attempt>;\n    readonly latest: (\n      principal: Principal.Interface,\n      attachmentId: string,\n      kind: Plan.Kind,\n    ) => Promise<Attempt | null>;\n    readonly approve: (\n      principal: Principal.Interface,\n      id: Plan.PlanId,\n      approval: Approval.Model,\n    ) => Promise<Attempt>;\n    readonly reject: (\n      principal: Principal.Interface,\n      id: Plan.PlanId,\n      input: {\n        readonly digest: Plan.Digest;\n        readonly actorId: string;\n        readonly reason: string | null;\n      },\n    ) => Promise<Attempt>;\n    readonly claim: (\n      principal: Principal.Interface,\n      id: Plan.PlanId,\n      lease: DateTime.Utc,\n    ) => Promise<Attempt>;\n    readonly complete: (\n      principal: Principal.Interface,\n      id: Plan.PlanId,\n      receipt: Receipt.Model,\n    ) => Promise<Attempt>;\n    readonly fail: (\n      principal: Principal.Interface,\n      id: Plan.PlanId,\n      message: string,\n    ) => Promise<Attempt>;\n  };\n  readonly readiness: {\n    readonly put: (principal: Principal.Interface, readiness: Readiness) => Promise<void>;\n    readonly get: (principal: Principal.Interface, domain: string) => Promise<Readiness | null>;\n  };\n  /** Return `false` when another holder has the key. */\n  readonly acquireLock: (principal: Principal.Interface, key: string) => Promise<boolean>;\n  readonly releaseLock: (principal: Principal.Interface, key: string) => Promise<void>;\n}\n\nconst storageFailed = (operation: string) => (cause: unknown) =>\n  Errors.isDomainKitError(cause)\n    ? cause\n    : new Errors.DomainKitError({\n        reason: new Reason.StorageFailed({\n          operation,\n          message: cause instanceof Error ? cause.message : String(cause),\n        }),\n      });\n\n/** Wraps a Promise-shaped implementation. Rejections become `StorageFailed`. */\nexport const fromAsync = (service: AsyncInterface): Interface => {\n  const call = <A>(operation: string, run: (principal: Principal.Interface) => Promise<A>): Fx<A> =>\n    Effect.flatMap(Principal.Service, (principal) =>\n      Effect.tryPromise({ try: () => run(principal), catch: storageFailed(operation) }),\n    );\n  const option = <A>(\n    operation: string,\n    run: (principal: Principal.Interface) => Promise<A | null>,\n  ) => call(operation, run).pipe(Effect.map(Option.fromNullishOr));\n  return {\n    authorizations: {\n      upsert: (input) =>\n        call(\"authorizations.upsert\", (p) => service.authorizations.upsert(p, input)),\n      get: (id) => call(\"authorizations.get\", (p) => service.authorizations.get(p, id)),\n      credential: (id) =>\n        call(\"authorizations.credential\", (p) => service.authorizations.credential(p, id)),\n      rotate: (id, credential) =>\n        call(\"authorizations.rotate\", (p) => service.authorizations.rotate(p, id, credential)),\n      promoteCapabilities: (id, capabilities) =>\n        call(\"authorizations.promoteCapabilities\", (p) =>\n          service.authorizations.promoteCapabilities(p, id, capabilities),\n        ),\n      revoke: (id, revoke) =>\n        call(\"authorizations.prepareRevocation\", (p) =>\n          service.authorizations.prepareRevocation(p, id),\n        ).pipe(\n          Effect.flatMap(() => revoke),\n          Effect.flatMap(() =>\n            call(\"authorizations.completeRevocation\", (p) =>\n              service.authorizations.completeRevocation(p, id),\n            ),\n          ),\n        ),\n      recoverRevocations: (revoke) =>\n        call(\"authorizations.pendingRevocations\", (p) =>\n          service.authorizations.pendingRevocations(p),\n        ).pipe(\n          Effect.flatMap((pending) =>\n            Effect.forEach(pending, (authorization) =>\n              revoke(authorization).pipe(\n                Effect.flatMap(() =>\n                  call(\"authorizations.completeRevocation\", (p) =>\n                    service.authorizations.completeRevocation(p, authorization.id),\n                  ),\n                ),\n              ),\n            ),\n          ),\n          Effect.map((completed) => completed.length),\n        ),\n    },\n    connections: {\n      create: (authorizationId) =>\n        call(\"connections.create\", (p) => service.connections.create(p, authorizationId)),\n      get: (id) => call(\"connections.get\", (p) => service.connections.get(p, id)),\n      list: (filter) => call(\"connections.list\", (p) => service.connections.list(p, filter)),\n      remove: (id) => call(\"connections.remove\", (p) => service.connections.remove(p, id)),\n    },\n    attachments: {\n      create: (input) => call(\"attachments.create\", (p) => service.attachments.create(p, input)),\n      get: (id) => call(\"attachments.get\", (p) => service.attachments.get(p, id)),\n      byDomain: (domain) =>\n        option(\"attachments.byDomain\", (p) => service.attachments.byDomain(p, domain)),\n      list: (connectionId) =>\n        call(\"attachments.list\", (p) => service.attachments.list(p, connectionId)),\n      remove: (id) => call(\"attachments.remove\", (p) => service.attachments.remove(p, id)),\n    },\n    continuations: {\n      put: (continuation) =>\n        call(\"continuations.put\", (p) => service.continuations.put(p, continuation)),\n      get: (id) => call(\"continuations.get\", (p) => service.continuations.get(p, id)),\n      consume: (id) => call(\"continuations.consume\", (p) => service.continuations.consume(p, id)),\n    },\n    attempts: {\n      create: (attempt) => call(\"attempts.create\", (p) => service.attempts.create(p, attempt)),\n      get: (id) => call(\"attempts.get\", (p) => service.attempts.get(p, id)),\n      byApproval: (id) => call(\"attempts.byApproval\", (p) => service.attempts.byApproval(p, id)),\n      byReceipt: (id) => call(\"attempts.byReceipt\", (p) => service.attempts.byReceipt(p, id)),\n      latest: (attachmentId, kind) =>\n        option(\"attempts.latest\", (p) => service.attempts.latest(p, attachmentId, kind)),\n      approve: (id, approval) =>\n        call(\"attempts.approve\", (p) => service.attempts.approve(p, id, approval)),\n      reject: (id, input) => call(\"attempts.reject\", (p) => service.attempts.reject(p, id, input)),\n      claim: (id, lease) => call(\"attempts.claim\", (p) => service.attempts.claim(p, id, lease)),\n      complete: (id, receipt) =>\n        call(\"attempts.complete\", (p) => service.attempts.complete(p, id, receipt)),\n      fail: (id, message) => call(\"attempts.fail\", (p) => service.attempts.fail(p, id, message)),\n    },\n    readiness: {\n      put: (readiness) => call(\"readiness.put\", (p) => service.readiness.put(p, readiness)),\n      get: (domain) => option(\"readiness.get\", (p) => service.readiness.get(p, domain)),\n    },\n    withLock: (key, effect) =>\n      Effect.acquireRelease(\n        call(\"acquireLock\", (p) => service.acquireLock(p, key)).pipe(\n          Effect.flatMap((acquired) =>\n            acquired ? Effect.void : Errors.fail(new Reason.Busy({ key })),\n          ),\n        ),\n        () => call(\"releaseLock\", (p) => service.releaseLock(p, key)).pipe(Effect.ignore),\n      ).pipe(\n        Effect.flatMap(() => effect),\n        Effect.scoped,\n      ),\n  };\n};\n\nexport const layerFromAsync = (service: AsyncInterface): Layer.Layer<Service> =>\n  Layer.succeed(Service)(fromAsync(service));\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,aAAa,OAAO,SAAS,CAAC,YAAY,WAAW,CAAC;AAGnE,MAAa,aAAa,OAAO,SAAS;CAAC;CAAS;CAAS;AAAa,CAAC;;AAI3E,IAAa,aAAb,cAAgC,OAAO,MAAkB,+BAA+B,CAAC,CAAC;CACxF,YAAY,OAAO;CACnB,WAAW,OAAO,OAAO,OAAO,qBAAqB;CACrD,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gBAAb,cAAmC,OAAO,MAAqB,kCAAkC,CAAC,CAAC;CACjG,IAAI,OAAO;CACX,SAAS,OAAO;CAChB,UAAU,OAAO;CACjB,QAAQ;CACR,cAAc,OAAO,MAAM,UAAU;;CAErC,SAAS,OAAO;CAChB,YAAY,OAAO,SAAS;EAAC;EAAU;EAAW;CAAS,CAAC;CAC5D,WAAW,OAAO;CAClB,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,aAAb,cAAgC,OAAO,MAAkB,+BAA+B,CAAC,CAAC;CACxF,IAAI,OAAO;CACX,SAAS,OAAO;CAChB,iBAAiB,OAAO;CACxB,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,aAAb,cAAgC,OAAO,MAAkB,+BAA+B,CAAC,CAAC;CACxF,IAAI,OAAO;CACX,SAAS,OAAO;CAChB,cAAc,OAAO;CACrB,QAAQ,OAAO;CACf,MAAM,OAAO;;CAEb,QAAQ,OAAO;CACf,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,iCAAiC,CAAC,CAAC;CAC9F,IAAI,OAAO;CACX,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,UAAU,OAAO;CACjB,SAAS,OAAO;CAChB,UAAU,OAAO,OAAO,OAAO,MAAM;CACrC,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,gBAAgB,OAAO,SAAS;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,SAAS,OAAO;CAChB,QAAQ,OAAO,OAAO,OAAO,MAAM;CACnC,IAAI,OAAO;AACb,CAAC;;AAID,IAAa,UAAb,cAA6B,OAAO,MAAe,4BAA4B,CAAC,CAAC;CAC/E,IAAIA;CACJ,SAAS,OAAO;CAChB,cAAc,OAAO;CACrB,MAAMC;CACN,QAAQ;CACR,MAAMC;CACN,UAAU,OAAO,OAAOC,OAAc;CACtC,SAAS,OAAO,OAAOC,OAAa;CACpC,WAAW,OAAO,OAAO,SAAS;;CAElC,iBAAiB,OAAO,OAAOC,SAAiB;CAChD,gBAAgB,OAAO,OAAO,OAAO,qBAAqB;;CAE1D,SAAS,OAAO,OAAO,OAAO,MAAM;CACpC,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,oBAAoB,OAAO,SAAS;CAAC;CAAa;CAAW;CAAY;AAAS,CAAC;AAGhG,MAAa,UAAU,OAAO,SAAS;CAAC;CAAS;CAAW;AAAQ,CAAC;;;;;;AAQrE,IAAa,YAAb,cAA+B,OAAO,MAAiB,8BAA8B,CAAC,CAAC;CACrF,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,SAAS,OAAO;CAChB,SAAS;CACT,cAAc,OAAO,MACnB,OAAO,OAAO;EACZ,aAAa,OAAO,OAAOC,WAAgB;EAC3C,QAAQC;EACR,QAAQ;;EAER,UAAU,OAAO,MAAM,OAAO,OAAO;CACvC,CAAC,CACH;;CAEA,MAAM,OAAO,MAAM,OAAO,OAAO;;CAEjC,cAAc,OAAO,OAAO,OAAO,qBAAqB;CACxD,WAAW,OAAO;CAClB,aAAa,OAAO,OAAO,OAAO,qBAAqB;AACzD,CAAC,CAAC,CAAC,CAAC;AAoGJ,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;;AAQ1F,MAAa,cAAoC,MAAM,KAAK,OAAO,CAAC,OAAO,WAAW,CAAC;;AAGvF,MAAa,mBAAmB,YAC9B,MAAM,KAAK,OAAO,CAAC,OAAO,WAAW,OAAO,CAAC;AAyI/C,MAAM,iBAAiB,eAAuB,UAC5CC,iBAAwB,KAAK,IACzB,QACA,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,cAAqB;CAC/B;CACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAChE,CAAC,EACH,CAAC;;AAGP,MAAa,aAAa,YAAuC;CAC/D,MAAM,QAAW,WAAmB,QAClC,OAAO,QAAQC,YAAoB,cACjC,OAAO,WAAW;EAAE,WAAW,IAAI,SAAS;EAAG,OAAO,cAAc,SAAS;CAAE,CAAC,CAClF;CACF,MAAM,UACJ,WACA,QACG,KAAK,WAAW,GAAG,CAAC,CAAC,KAAK,OAAO,IAAI,OAAO,aAAa,CAAC;CAC/D,OAAO;EACL,gBAAgB;GACd,SAAS,UACP,KAAK,0BAA0B,MAAM,QAAQ,eAAe,OAAO,GAAG,KAAK,CAAC;GAC9E,MAAM,OAAO,KAAK,uBAAuB,MAAM,QAAQ,eAAe,IAAI,GAAG,EAAE,CAAC;GAChF,aAAa,OACX,KAAK,8BAA8B,MAAM,QAAQ,eAAe,WAAW,GAAG,EAAE,CAAC;GACnF,SAAS,IAAI,eACX,KAAK,0BAA0B,MAAM,QAAQ,eAAe,OAAO,GAAG,IAAI,UAAU,CAAC;GACvF,sBAAsB,IAAI,iBACxB,KAAK,uCAAuC,MAC1C,QAAQ,eAAe,oBAAoB,GAAG,IAAI,YAAY,CAChE;GACF,SAAS,IAAI,WACX,KAAK,qCAAqC,MACxC,QAAQ,eAAe,kBAAkB,GAAG,EAAE,CAChD,CAAC,CAAC,KACA,OAAO,cAAc,MAAM,GAC3B,OAAO,cACL,KAAK,sCAAsC,MACzC,QAAQ,eAAe,mBAAmB,GAAG,EAAE,CACjD,CACF,CACF;GACF,qBAAqB,WACnB,KAAK,sCAAsC,MACzC,QAAQ,eAAe,mBAAmB,CAAC,CAC7C,CAAC,CAAC,KACA,OAAO,SAAS,YACd,OAAO,QAAQ,UAAU,kBACvB,OAAO,aAAa,CAAC,CAAC,KACpB,OAAO,cACL,KAAK,sCAAsC,MACzC,QAAQ,eAAe,mBAAmB,GAAG,cAAc,EAAE,CAC/D,CACF,CACF,CACF,CACF,GACA,OAAO,KAAK,cAAc,UAAU,MAAM,CAC5C;EACJ;EACA,aAAa;GACX,SAAS,oBACP,KAAK,uBAAuB,MAAM,QAAQ,YAAY,OAAO,GAAG,eAAe,CAAC;GAClF,MAAM,OAAO,KAAK,oBAAoB,MAAM,QAAQ,YAAY,IAAI,GAAG,EAAE,CAAC;GAC1E,OAAO,WAAW,KAAK,qBAAqB,MAAM,QAAQ,YAAY,KAAK,GAAG,MAAM,CAAC;GACrF,SAAS,OAAO,KAAK,uBAAuB,MAAM,QAAQ,YAAY,OAAO,GAAG,EAAE,CAAC;EACrF;EACA,aAAa;GACX,SAAS,UAAU,KAAK,uBAAuB,MAAM,QAAQ,YAAY,OAAO,GAAG,KAAK,CAAC;GACzF,MAAM,OAAO,KAAK,oBAAoB,MAAM,QAAQ,YAAY,IAAI,GAAG,EAAE,CAAC;GAC1E,WAAW,WACT,OAAO,yBAAyB,MAAM,QAAQ,YAAY,SAAS,GAAG,MAAM,CAAC;GAC/E,OAAO,iBACL,KAAK,qBAAqB,MAAM,QAAQ,YAAY,KAAK,GAAG,YAAY,CAAC;GAC3E,SAAS,OAAO,KAAK,uBAAuB,MAAM,QAAQ,YAAY,OAAO,GAAG,EAAE,CAAC;EACrF;EACA,eAAe;GACb,MAAM,iBACJ,KAAK,sBAAsB,MAAM,QAAQ,cAAc,IAAI,GAAG,YAAY,CAAC;GAC7E,MAAM,OAAO,KAAK,sBAAsB,MAAM,QAAQ,cAAc,IAAI,GAAG,EAAE,CAAC;GAC9E,UAAU,OAAO,KAAK,0BAA0B,MAAM,QAAQ,cAAc,QAAQ,GAAG,EAAE,CAAC;EAC5F;EACA,UAAU;GACR,SAAS,YAAY,KAAK,oBAAoB,MAAM,QAAQ,SAAS,OAAO,GAAG,OAAO,CAAC;GACvF,MAAM,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,IAAI,GAAG,EAAE,CAAC;GACpE,aAAa,OAAO,KAAK,wBAAwB,MAAM,QAAQ,SAAS,WAAW,GAAG,EAAE,CAAC;GACzF,YAAY,OAAO,KAAK,uBAAuB,MAAM,QAAQ,SAAS,UAAU,GAAG,EAAE,CAAC;GACtF,SAAS,cAAc,SACrB,OAAO,oBAAoB,MAAM,QAAQ,SAAS,OAAO,GAAG,cAAc,IAAI,CAAC;GACjF,UAAU,IAAI,aACZ,KAAK,qBAAqB,MAAM,QAAQ,SAAS,QAAQ,GAAG,IAAI,QAAQ,CAAC;GAC3E,SAAS,IAAI,UAAU,KAAK,oBAAoB,MAAM,QAAQ,SAAS,OAAO,GAAG,IAAI,KAAK,CAAC;GAC3F,QAAQ,IAAI,UAAU,KAAK,mBAAmB,MAAM,QAAQ,SAAS,MAAM,GAAG,IAAI,KAAK,CAAC;GACxF,WAAW,IAAI,YACb,KAAK,sBAAsB,MAAM,QAAQ,SAAS,SAAS,GAAG,IAAI,OAAO,CAAC;GAC5E,OAAO,IAAI,YAAY,KAAK,kBAAkB,MAAM,QAAQ,SAAS,KAAK,GAAG,IAAI,OAAO,CAAC;EAC3F;EACA,WAAW;GACT,MAAM,cAAc,KAAK,kBAAkB,MAAM,QAAQ,UAAU,IAAI,GAAG,SAAS,CAAC;GACpF,MAAM,WAAW,OAAO,kBAAkB,MAAM,QAAQ,UAAU,IAAI,GAAG,MAAM,CAAC;EAClF;EACA,WAAW,KAAK,WACd,OAAO,eACL,KAAK,gBAAgB,MAAM,QAAQ,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,KACtD,OAAO,SAAS,aACd,WAAW,OAAO,OAAOC,KAAY,IAAIC,KAAY,EAAE,IAAI,CAAC,CAAC,CAC/D,CACF,SACM,KAAK,gBAAgB,MAAM,QAAQ,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,CAClF,CAAC,CAAC,KACA,OAAO,cAAc,MAAM,GAC3B,OAAO,MACT;CACJ;AACF;AAEA,MAAa,kBAAkB,YAC7B,MAAM,QAAQ,OAAO,CAAC,CAAC,UAAU,OAAO,CAAC"}

package/dist/Testing.mjs

@@ -0,0 +1,226 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { decode, fromString, fromStringUnsafe, isWithin } from "./DomainName.mjs";
+import { ns } from "./DnsRecord.mjs";
+import { NotFound, ProviderRejected, ProviderUnavailable, Unauthenticated } from "./Reason.mjs";
+import { fail } from "./internal/error.mjs";
+import { make } from "./Principal.mjs";
+import { make as make$1, resolveAmong, tokenAuth } from "./Provider.mjs";
+import { Outcome, Service } from "./Resolver.mjs";
+import { layerMemory } from "./Storage.mjs";
+import { layerMemory as layerMemory$1 } from "./DomainKit.mjs";
+import { Identity, toWebHandler } from "./Server.mjs";
+import { capabilities, fromFetch } from "./Transport.mjs";
+import { provider as provider$1 } from "./internal/conformance/provider.mjs";
+import { storage as storage$1 } from "./internal/conformance/storage.mjs";
+import { DateTime, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/Testing.ts
+/**
+* domainkit/testing — fakes and conformance runners so hosts test against the seam instead of
+* stubbing global fetch.
+*/
+var Testing_exports = /* @__PURE__ */ __exportAll({
+	conformance: () => conformance,
+	fakeRecords: () => fakeRecords,
+	principal: () => principal,
+	provider: () => provider,
+	resolver: () => resolver,
+	storage: () => storage,
+	transport: () => transport
+});
+/** In-memory Storage. Same as `Storage.layerMemory`; re-exported for discoverability. */
+const storage = layerMemory;
+const principal = make({
+	ownerId: "org_test",
+	actorId: "user_test"
+});
+/** Every fake zone created in this process, so `resolver()` can answer from them. */
+const registry = /* @__PURE__ */ new Set();
+/** Account context carries `account`; target context carries `zone`. One schema covers both. */
+const Context$1 = Schema.Struct({
+	account: Schema.optionalKey(Schema.String),
+	zone: Schema.optionalKey(Schema.String)
+});
+const TargetContext = Schema.Struct({ zone: Schema.String });
+/** A provider definition with a token method (and optional OAuth) over in-memory zones. */
+const provider = (options = {}) => {
+	const id = options.id ?? "fake";
+	const zones = /* @__PURE__ */ new Map();
+	let nextId = 1;
+	let writes = 0;
+	let revokedCount = 0;
+	const issued = [];
+	for (const name of options.zones ?? ["example.com"]) {
+		const normalized = fromStringUnsafe(name);
+		const zone = {
+			name: normalized,
+			nameservers: options.nameservers?.[name] ?? options.nameservers?.[normalized] ?? [`ns1.${normalized}`, `ns2.${normalized}`],
+			rows: []
+		};
+		zones.set(zone.name, zone);
+		registry.add(zone);
+	}
+	for (const { zone: name, record } of options.records ?? []) {
+		const zone = zones.get(fromStringUnsafe(name));
+		if (zone === void 0) throw new Error(`Fake provider ${id} has no zone ${name}`);
+		zone.rows.push({
+			id: `${id}-${nextId++}`,
+			record
+		});
+	}
+	const issue = (prefix) => {
+		const secret = `${prefix}-${issued.length + 1}`;
+		issued.push(secret);
+		return {
+			secret: Redacted.make(secret),
+			context: { account: id },
+			expiresAt: null
+		};
+	};
+	const zoneOf = (target) => Effect.suspend(() => {
+		const decoded = Schema.decodeUnknownOption(TargetContext)(target.context);
+		const zone = decoded._tag === "Some" ? zones.get(decoded.value.zone) : void 0;
+		return zone === void 0 ? fail(new NotFound({
+			entity: "zone",
+			id: target.zone
+		})) : Effect.succeed(zone);
+	});
+	const targets = () => [...zones.values()].map((zone) => ({
+		zone: zone.name,
+		context: { zone: zone.name },
+		label: zone.name,
+		nameservers: zone.nameservers
+	}));
+	return {
+		...make$1({
+			id,
+			name: `Fake ${id}`,
+			context: Context$1,
+			contextVersion: "fake.v1",
+			auth: {
+				token: tokenAuth({
+					label: "Token (fake)",
+					requiredCapabilities: ["dns:read", "dns:write"],
+					fields: Schema.Struct({ token: Schema.RedactedFromValue(Schema.String) }),
+					authenticate: ({ token }) => Redacted.value(token).length === 0 ? fail(new Unauthenticated({ message: "fake provider rejected an empty token" })) : Effect.succeed({
+						secret: token,
+						context: { account: id },
+						expiresAt: null
+					})
+				}),
+				...options.oauth === true ? { oauth: {
+					label: "Sign in (fake)",
+					scopes: ["dns"],
+					start: (input) => Effect.succeed({ authorizationUrl: `${input.callbackUrl}?${new URLSearchParams({
+						state: input.state,
+						code: "fake-code"
+					})}` }),
+					complete: (input) => input.code === "fake-code" ? Effect.map(DateTime.now, (now) => ({
+						...issue("oauth"),
+						expiresAt: DateTime.add(now, { hours: 1 })
+					})) : fail(new Unauthenticated({ message: "fake provider rejected the code" })),
+					refresh: (credential) => Redacted.value(credential.secret).startsWith("revoked") ? fail(new Unauthenticated({ message: "fake refresh token was revoked" })) : Effect.map(DateTime.now, (now) => ({
+						...issue("oauth"),
+						expiresAt: DateTime.add(now, { hours: 1 })
+					})),
+					revoke: () => Effect.sync(() => void (revokedCount += 1))
+				} } : {}
+			},
+			session: () => ({
+				capabilities: () => Effect.succeed(["dns:read", "dns:write"]),
+				listTargets: () => Effect.succeed(targets()),
+				resolveTarget: (domain) => Effect.map(decode(domain), (name) => resolveAmong(name, targets())),
+				dns: (target) => ({
+					list: () => Effect.map(zoneOf(target), (zone) => zone.rows.map(({ id: providerRecordId, record }) => ({
+						record,
+						providerRecordId
+					}))),
+					create: (_zone, record) => Effect.gen(function* () {
+						const zone = yield* zoneOf(target);
+						const index = writes;
+						writes += 1;
+						if (options.failWrite?.(index) === true) return yield* fail(new ProviderUnavailable({
+							provider: id,
+							message: `fake provider failed write ${index}`
+						}));
+						if (!isWithin(record.name, zone.name)) return yield* fail(new ProviderRejected({
+							provider: id,
+							message: `${record.name} is outside ${zone.name}`
+						}));
+						const providerRecordId = `${id}-${nextId++}`;
+						zone.rows.push({
+							id: providerRecordId,
+							record
+						});
+						return { providerRecordId };
+					}),
+					get: (_zone, providerRecordId) => Effect.map(zoneOf(target), (zone) => zone.rows.find((row) => row.id === providerRecordId)?.record ?? null),
+					delete: (_zone, providerRecordId) => Effect.map(zoneOf(target), (zone) => {
+						const index = zone.rows.findIndex((row) => row.id === providerRecordId);
+						if (index >= 0) zone.rows.splice(index, 1);
+					})
+				})
+			})
+		}),
+		records: (zone) => zones.get(fromStringUnsafe(zone))?.rows.map(({ record }) => record) ?? [],
+		issued: () => issued,
+		revoked: () => revokedCount
+	};
+};
+/** NS records for every fake zone named `name`, so `resolver()` can answer authority queries. */
+const fakeNameservers = (name) => [...registry].filter((zone) => zone.name === name).flatMap((zone) => zone.nameservers.map((nameserver) => ns({
+	name: zone.name,
+	nameserver
+})));
+/** Records every fake provider currently holds for `name`, across all fake zones. */
+const fakeRecords = (name) => [...registry].flatMap((zone) => zone.rows.map(({ record }) => record)).filter((record) => record.name === name);
+/**
+* A resolver answering from the fake providers' zones, or from an explicit table. Every answer
+* is attributed to the resolver named `fake`.
+*/
+const resolver = (answers) => Layer.succeed(Service)({ resolve: (name, type) => Effect.sync(() => {
+	const normalized = fromString(name);
+	const lookup = normalized._tag === "Some" ? normalized.value : name;
+	const records = (answers === void 0 ? [...fakeRecords(lookup), ...fakeNameservers(lookup)] : answers.filter((entry) => entry.name === lookup).flatMap((entry) => entry.records)).filter((record) => (record._tag === "Opaque" ? record.type : record._tag) === type);
+	return [Outcome.Answered({ answer: {
+		resolver: "fake",
+		records,
+		negative: records.length === 0,
+		ttl: 60
+	} })];
+}) });
+/**
+* A transport over an in-memory `domainkit/server` and memory Storage, recording every call. What
+* `@domainkit/react` tests render against, instead of stubbing global `fetch`.
+*/
+const transport = (options = {}) => {
+	const fake = provider(options.provider);
+	const { handler } = toWebHandler(layerMemory$1({
+		providers: [fake],
+		resolver: resolver()
+	}).pipe(Layer.merge(Layer.succeed(Identity)({ principal: () => Effect.succeed(principal) }))));
+	const live = fromFetch("http://domainkit.test", {
+		fetch: (input, init) => handler(new Request(input, init)),
+		...options.capabilities === void 0 ? {} : { capabilities: options.capabilities }
+	});
+	const calls = [];
+	return {
+		...Object.fromEntries(capabilities(live).map((capability) => [capability, Object.fromEntries(Object.entries(live[capability]).map(([name, method]) => [name, (...args) => Effect.suspend(() => {
+			calls.push({
+				method: `${capability}.${name}`,
+				input: args.length > 1 ? args : args[0]
+			});
+			return method(...args);
+		})]))])),
+		calls
+	};
+};
+const conformance = {
+	/** Runs every Storage invariant (tenant isolation, leases, exactly-once continuations, revocation recovery). */
+	storage: storage$1,
+	/** Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply against a real provider definition. */
+	provider: provider$1
+};
+//#endregion
+export { Testing_exports, conformance, fakeRecords, principal, provider, resolver, storage, transport };
+
+//# sourceMappingURL=Testing.mjs.map