domainkit 0.8.0 → 0.9.1

package/dist/internal/doh.mjs

@@ -0,0 +1,153 @@
+import { Opaque, a, aaaa, caa, cname, mx, ns, srv, txt } from "../DnsRecord.mjs";
+import { ResolverFailed } from "../Reason.mjs";
+import { DomainKitError, isDomainKitError } from "./error.mjs";
+import { Effect } from "effect";
+import * as DnsPacket from "@leichtgewicht/dns-packet";
+//#region src/internal/doh.ts
+const failed = (resolver, message) => new DomainKitError({ reason: new ResolverFailed({
+	resolver,
+	message
+}) });
+/** One RFC 8484 wire-format query; the caller applies the timeout. */
+const query = (input) => Effect.tryPromise({
+	try: async (fiberSignal) => {
+		const controller = new AbortController();
+		const abort = (reason) => controller.abort(reason);
+		fiberSignal.addEventListener("abort", () => abort(fiberSignal.reason), { once: true });
+		input.signal?.addEventListener("abort", () => abort(input.signal?.reason), { once: true });
+		if (input.signal?.aborted === true) abort(input.signal.reason);
+		const signal = controller.signal;
+		const body = Uint8Array.from(DnsPacket.encode({
+			flags: DnsPacket.RECURSION_DESIRED,
+			id: 0,
+			questions: [{
+				name: input.name,
+				type: input.type
+			}],
+			type: "query"
+		}));
+		const { fetch: send } = input;
+		const response = await send(input.url, {
+			body,
+			headers: {
+				accept: "application/dns-message",
+				"content-type": "application/dns-message"
+			},
+			method: "POST",
+			signal
+		});
+		if (!response.ok) throw failed(input.resolver, `DoH returned HTTP ${response.status}`);
+		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+		if (contentType !== "application/dns-message") throw failed(input.resolver, `DoH returned unsupported content type ${contentType ?? "<missing>"}`);
+		return decode(input.resolver, input.name, input.type, new Uint8Array(await response.arrayBuffer()));
+	},
+	catch: (cause) => isDomainKitError(cause) ? cause : failed(input.resolver, cause instanceof Error ? cause.message : "DNS resolution failed")
+});
+function decode(resolver, name, type, message) {
+	let packet;
+	try {
+		packet = DnsPacket.decode(message);
+	} catch {
+		throw failed(resolver, "DoH returned an invalid DNS message");
+	}
+	if (packet.type !== "response") throw failed(resolver, "DoH returned a DNS query");
+	if (packet.id !== 0) throw failed(resolver, "DoH response used an unexpected message ID");
+	if (packet.flag_tc) throw failed(resolver, "DoH returned a truncated DNS response");
+	const question = packet.questions?.[0];
+	if (packet.questions?.length !== 1 || question === void 0 || question.class !== "IN" || question.type !== type || question.name.toLowerCase().replace(/\.$/, "") !== name) throw failed(resolver, "DoH response did not match the DNS question");
+	if (packet.rcode === "NXDOMAIN") return {
+		records: [],
+		negative: true,
+		ttl: null
+	};
+	if (packet.rcode !== "NOERROR") throw failed(resolver, `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`);
+	const answers = (packet.answers ?? []).filter((answer) => answer.class === "IN");
+	if (answers.some((answer) => answer.ttl === void 0)) throw failed(resolver, "DoH response omitted the DNS record TTL");
+	const records = answers.map(toRecord);
+	const ttls = answers.flatMap((answer) => answer.ttl === void 0 ? [] : [answer.ttl]);
+	return {
+		records,
+		negative: records.length === 0,
+		ttl: ttls.length === 0 ? null : Math.min(...ttls)
+	};
+}
+function toRecord(answer) {
+	const name = answer.name;
+	const opaque = () => new Opaque({
+		name,
+		type: answer.type,
+		raw: answer
+	});
+	const ttl = answer.ttl === void 0 || answer.ttl <= 0 ? {} : { ttl: answer.ttl };
+	try {
+		switch (answer.type) {
+			case "A": return a({
+				name,
+				address: answer.data,
+				...ttl
+			});
+			case "AAAA": return aaaa({
+				name,
+				address: answer.data,
+				...ttl
+			});
+			case "CNAME": return cname({
+				name,
+				target: answer.data,
+				...ttl
+			});
+			case "NS": return ns({
+				name,
+				nameserver: answer.data,
+				...ttl
+			});
+			case "TXT": return txt({
+				name,
+				value: decodeTxt(answer.data),
+				...ttl
+			});
+			case "MX": return mx({
+				name,
+				exchange: answer.data.exchange,
+				priority: answer.data.preference ?? 0,
+				...ttl
+			});
+			case "CAA": return caa({
+				name,
+				flags: answer.data.flags ?? 0,
+				tag: answer.data.tag,
+				value: answer.data.value,
+				...ttl
+			});
+			case "SRV": return srv({
+				name,
+				target: answer.data.target,
+				port: required(answer.data.port),
+				priority: answer.data.priority ?? 0,
+				weight: answer.data.weight ?? 0,
+				...ttl
+			});
+			default: return opaque();
+		}
+	} catch {
+		return opaque();
+	}
+}
+function required(value) {
+	if (value === void 0) throw new Error("DoH answer omitted a required field");
+	return value;
+}
+function decodeTxt(data) {
+	const encoded = (Array.isArray(data) ? data : [data]).map((chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
+	const joined = new Uint8Array(encoded.reduce((total, chunk) => total + chunk.length, 0));
+	let offset = 0;
+	for (const chunk of encoded) {
+		joined.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return new TextDecoder("utf-8", { fatal: true }).decode(joined);
+}
+//#endregion
+export { query };
+
+//# sourceMappingURL=doh.mjs.map

package/dist/internal/doh.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"doh.mjs","names":["Errors.DomainKitError","Reason.ResolverFailed","Errors.isDomainKitError","DnsRecord.Opaque","DnsRecord.a","DnsRecord.aaaa","DnsRecord.cname","DnsRecord.ns","DnsRecord.txt","DnsRecord.mx","DnsRecord.caa","DnsRecord.srv"],"sources":["../../src/internal/doh.ts"],"sourcesContent":["import * as DnsPacket from \"@leichtgewicht/dns-packet\";\nimport { Effect } from \"effect\";\n\nimport * as DnsRecord from \"../DnsRecord.ts\";\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\nimport type { Fetch } from \"./http.ts\";\n\nexport interface Answer {\n  readonly records: ReadonlyArray<DnsRecord.Observed>;\n  readonly negative: boolean;\n  readonly ttl: number | null;\n}\n\nconst failed = (resolver: string, message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.ResolverFailed({ resolver, message }),\n  });\n\n/** One RFC 8484 wire-format query; the caller applies the timeout. */\nexport const query = (input: {\n  readonly resolver: string;\n  readonly url: string;\n  readonly fetch: Fetch;\n  readonly name: string;\n  readonly type: DnsRecord.Type;\n  /** Host-supplied abort, combined with the fiber's own interruption signal. */\n  readonly signal?: AbortSignal | undefined;\n}): Effect.Effect<Answer, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async (fiberSignal) => {\n      const controller = new AbortController();\n      const abort = (reason: unknown) => controller.abort(reason);\n      fiberSignal.addEventListener(\"abort\", () => abort(fiberSignal.reason), { once: true });\n      input.signal?.addEventListener(\"abort\", () => abort(input.signal?.reason), { once: true });\n      if (input.signal?.aborted === true) abort(input.signal.reason);\n      const signal = controller.signal;\n      const body = Uint8Array.from(\n        DnsPacket.encode({\n          flags: DnsPacket.RECURSION_DESIRED,\n          id: 0,\n          questions: [{ name: input.name, type: input.type }],\n          type: \"query\",\n        }),\n      );\n      const { fetch: send } = input; // a free call keeps `this` undefined for a native fetch\n      const response = await send(input.url, {\n        body,\n        headers: { accept: \"application/dns-message\", \"content-type\": \"application/dns-message\" },\n        method: \"POST\",\n        signal,\n      });\n      if (!response.ok) throw failed(input.resolver, `DoH returned HTTP ${response.status}`);\n      const contentType = response.headers\n        .get(\"content-type\")\n        ?.split(\";\", 1)[0]\n        ?.trim()\n        .toLowerCase();\n      if (contentType !== \"application/dns-message\") {\n        throw failed(\n          input.resolver,\n          `DoH returned unsupported content type ${contentType ?? \"<missing>\"}`,\n        );\n      }\n      return decode(\n        input.resolver,\n        input.name,\n        input.type,\n        new Uint8Array(await response.arrayBuffer()),\n      );\n    },\n    catch: (cause) =>\n      Errors.isDomainKitError(cause)\n        ? cause\n        : failed(input.resolver, cause instanceof Error ? cause.message : \"DNS resolution failed\"),\n  });\n\nfunction decode(resolver: string, name: string, type: DnsRecord.Type, message: Uint8Array): Answer {\n  let packet: DnsPacket.Packet;\n  try {\n    packet = DnsPacket.decode(message);\n  } catch {\n    throw failed(resolver, \"DoH returned an invalid DNS message\");\n  }\n  if (packet.type !== \"response\") throw failed(resolver, \"DoH returned a DNS query\");\n  if (packet.id !== 0) throw failed(resolver, \"DoH response used an unexpected message ID\");\n  if (packet.flag_tc) throw failed(resolver, \"DoH returned a truncated DNS response\");\n  const question = packet.questions?.[0];\n  if (\n    packet.questions?.length !== 1 ||\n    question === undefined ||\n    question.class !== \"IN\" ||\n    question.type !== type ||\n    question.name.toLowerCase().replace(/\\.$/, \"\") !== name\n  ) {\n    throw failed(resolver, \"DoH response did not match the DNS question\");\n  }\n  if (packet.rcode === \"NXDOMAIN\") return { records: [], negative: true, ttl: null };\n  if (packet.rcode !== \"NOERROR\") {\n    throw failed(resolver, `DNS resolver returned ${packet.rcode ?? \"an unknown response code\"}`);\n  }\n  const answers = (packet.answers ?? []).filter((answer) => answer.class === \"IN\");\n  if (answers.some((answer) => answer.ttl === undefined)) {\n    throw failed(resolver, \"DoH response omitted the DNS record TTL\");\n  }\n  const records = answers.map(toRecord);\n  const ttls = answers.flatMap((answer) => (answer.ttl === undefined ? [] : [answer.ttl]));\n  return {\n    records,\n    negative: records.length === 0,\n    ttl: ttls.length === 0 ? null : Math.min(...ttls),\n  };\n}\n\nfunction toRecord(answer: DnsPacket.Answer): DnsRecord.Observed {\n  const name = answer.name;\n  const opaque = () => new DnsRecord.Opaque({ name, type: answer.type, raw: answer });\n  const ttl = answer.ttl === undefined || answer.ttl <= 0 ? {} : { ttl: answer.ttl };\n  try {\n    switch (answer.type) {\n      case \"A\":\n        return DnsRecord.a({ name, address: answer.data, ...ttl });\n      case \"AAAA\":\n        return DnsRecord.aaaa({ name, address: answer.data, ...ttl });\n      case \"CNAME\":\n        return DnsRecord.cname({ name, target: answer.data, ...ttl });\n      case \"NS\":\n        return DnsRecord.ns({ name, nameserver: answer.data, ...ttl });\n      case \"TXT\":\n        return DnsRecord.txt({ name, value: decodeTxt(answer.data), ...ttl });\n      case \"MX\":\n        return DnsRecord.mx({\n          name,\n          exchange: answer.data.exchange,\n          priority: answer.data.preference ?? 0,\n          ...ttl,\n        });\n      case \"CAA\":\n        return DnsRecord.caa({\n          name,\n          flags: answer.data.flags ?? 0,\n          tag: answer.data.tag,\n          value: answer.data.value,\n          ...ttl,\n        });\n      case \"SRV\":\n        return DnsRecord.srv({\n          name,\n          target: answer.data.target,\n          port: required(answer.data.port),\n          priority: answer.data.priority ?? 0,\n          weight: answer.data.weight ?? 0,\n          ...ttl,\n        });\n      default:\n        return opaque();\n    }\n  } catch {\n    return opaque();\n  }\n}\n\nfunction required<A>(value: A | undefined): A {\n  if (value === undefined) throw new Error(\"DoH answer omitted a required field\");\n  return value;\n}\n\nfunction decodeTxt(data: DnsPacket.TxtData): string {\n  const chunks = Array.isArray(data) ? data : [data];\n  const encoded = chunks.map((chunk) =>\n    typeof chunk === \"string\" ? new TextEncoder().encode(chunk) : chunk,\n  );\n  const joined = new Uint8Array(encoded.reduce((total, chunk) => total + chunk.length, 0));\n  let offset = 0;\n  for (const chunk of encoded) {\n    joined.set(chunk, offset);\n    offset += chunk.length;\n  }\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(joined);\n}\n"],"mappings":";;;;;;AAcA,MAAM,UAAU,UAAkB,YAChC,IAAIA,eAAsB,EACxB,QAAQ,IAAIC,eAAsB;CAAE;CAAU;AAAQ,CAAC,EACzD,CAAC;;AAGH,MAAa,SAAS,UASpB,OAAO,WAAW;CAChB,KAAK,OAAO,gBAAgB;EAC1B,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,SAAS,WAAoB,WAAW,MAAM,MAAM;EAC1D,YAAY,iBAAiB,eAAe,MAAM,YAAY,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;EACrF,MAAM,QAAQ,iBAAiB,eAAe,MAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;EACzF,IAAI,MAAM,QAAQ,YAAY,MAAM,MAAM,MAAM,OAAO,MAAM;EAC7D,MAAM,SAAS,WAAW;EAC1B,MAAM,OAAO,WAAW,KACtB,UAAU,OAAO;GACf,OAAO,UAAU;GACjB,IAAI;GACJ,WAAW,CAAC;IAAE,MAAM,MAAM;IAAM,MAAM,MAAM;GAAK,CAAC;GAClD,MAAM;EACR,CAAC,CACH;EACA,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK;GACrC;GACA,SAAS;IAAE,QAAQ;IAA2B,gBAAgB;GAA0B;GACxF,QAAQ;GACR;EACF,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,OAAO,MAAM,UAAU,qBAAqB,SAAS,QAAQ;EACrF,MAAM,cAAc,SAAS,QAC1B,IAAI,cAAc,CAAC,EAClB,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAChB,KAAK,CAAC,CACP,YAAY;EACf,IAAI,gBAAgB,2BAClB,MAAM,OACJ,MAAM,UACN,yCAAyC,eAAe,aAC1D;EAEF,OAAO,OACL,MAAM,UACN,MAAM,MACN,MAAM,MACN,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC,CAC7C;CACF;CACA,QAAQ,UACNC,iBAAwB,KAAK,IACzB,QACA,OAAO,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,uBAAuB;AAC/F,CAAC;AAEH,SAAS,OAAO,UAAkB,MAAc,MAAsB,SAA6B;CACjG,IAAI;CACJ,IAAI;EACF,SAAS,UAAU,OAAO,OAAO;CACnC,QAAQ;EACN,MAAM,OAAO,UAAU,qCAAqC;CAC9D;CACA,IAAI,OAAO,SAAS,YAAY,MAAM,OAAO,UAAU,0BAA0B;CACjF,IAAI,OAAO,OAAO,GAAG,MAAM,OAAO,UAAU,4CAA4C;CACxF,IAAI,OAAO,SAAS,MAAM,OAAO,UAAU,uCAAuC;CAClF,MAAM,WAAW,OAAO,YAAY;CACpC,IACE,OAAO,WAAW,WAAW,KAC7B,aAAa,KAAA,KACb,SAAS,UAAU,QACnB,SAAS,SAAS,QAClB,SAAS,KAAK,YAAY,CAAC,CAAC,QAAQ,OAAO,EAAE,MAAM,MAEnD,MAAM,OAAO,UAAU,6CAA6C;CAEtE,IAAI,OAAO,UAAU,YAAY,OAAO;EAAE,SAAS,CAAC;EAAG,UAAU;EAAM,KAAK;CAAK;CACjF,IAAI,OAAO,UAAU,WACnB,MAAM,OAAO,UAAU,yBAAyB,OAAO,SAAS,4BAA4B;CAE9F,MAAM,WAAW,OAAO,WAAW,CAAC,EAAA,CAAG,QAAQ,WAAW,OAAO,UAAU,IAAI;CAC/E,IAAI,QAAQ,MAAM,WAAW,OAAO,QAAQ,KAAA,CAAS,GACnD,MAAM,OAAO,UAAU,yCAAyC;CAElE,MAAM,UAAU,QAAQ,IAAI,QAAQ;CACpC,MAAM,OAAO,QAAQ,SAAS,WAAY,OAAO,QAAQ,KAAA,IAAY,CAAC,IAAI,CAAC,OAAO,GAAG,CAAE;CACvF,OAAO;EACL;EACA,UAAU,QAAQ,WAAW;EAC7B,KAAK,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,GAAG,IAAI;CAClD;AACF;AAEA,SAAS,SAAS,QAA8C;CAC9D,MAAM,OAAO,OAAO;CACpB,MAAM,eAAe,IAAIC,OAAiB;EAAE;EAAM,MAAM,OAAO;EAAM,KAAK;CAAO,CAAC;CAClF,MAAM,MAAM,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;CACjF,IAAI;EACF,QAAQ,OAAO,MAAf;GACE,KAAK,KACH,OAAOC,EAAY;IAAE;IAAM,SAAS,OAAO;IAAM,GAAG;GAAI,CAAC;GAC3D,KAAK,QACH,OAAOC,KAAe;IAAE;IAAM,SAAS,OAAO;IAAM,GAAG;GAAI,CAAC;GAC9D,KAAK,SACH,OAAOC,MAAgB;IAAE;IAAM,QAAQ,OAAO;IAAM,GAAG;GAAI,CAAC;GAC9D,KAAK,MACH,OAAOC,GAAa;IAAE;IAAM,YAAY,OAAO;IAAM,GAAG;GAAI,CAAC;GAC/D,KAAK,OACH,OAAOC,IAAc;IAAE;IAAM,OAAO,UAAU,OAAO,IAAI;IAAG,GAAG;GAAI,CAAC;GACtE,KAAK,MACH,OAAOC,GAAa;IAClB;IACA,UAAU,OAAO,KAAK;IACtB,UAAU,OAAO,KAAK,cAAc;IACpC,GAAG;GACL,CAAC;GACH,KAAK,OACH,OAAOC,IAAc;IACnB;IACA,OAAO,OAAO,KAAK,SAAS;IAC5B,KAAK,OAAO,KAAK;IACjB,OAAO,OAAO,KAAK;IACnB,GAAG;GACL,CAAC;GACH,KAAK,OACH,OAAOC,IAAc;IACnB;IACA,QAAQ,OAAO,KAAK;IACpB,MAAM,SAAS,OAAO,KAAK,IAAI;IAC/B,UAAU,OAAO,KAAK,YAAY;IAClC,QAAQ,OAAO,KAAK,UAAU;IAC9B,GAAG;GACL,CAAC;GACH,SACE,OAAO,OAAO;EAClB;CACF,QAAQ;EACN,OAAO,OAAO;CAChB;AACF;AAEA,SAAS,SAAY,OAAyB;CAC5C,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,qCAAqC;CAC9E,OAAO;AACT;AAEA,SAAS,UAAU,MAAiC;CAElD,MAAM,WADS,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,EAAA,CAC1B,KAAK,UAC1B,OAAO,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,KAChE;CACA,MAAM,SAAS,IAAI,WAAW,QAAQ,QAAQ,OAAO,UAAU,QAAQ,MAAM,QAAQ,CAAC,CAAC;CACvF,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,SAAS;EAC3B,OAAO,IAAI,OAAO,MAAM;EACxB,UAAU,MAAM;CAClB;CACA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM;AAChE"}

package/dist/internal/error.mjs

@@ -0,0 +1,69 @@
+import { InvalidInput, Model } from "../Reason.mjs";
+import { Effect, Schema } from "effect";
+//#region src/internal/error.ts
+/**
+* The one error every DomainKit operation fails with, published as `DomainKit.Error`. Hosts match
+* on `reason`; `category`, `isRetryable`, and `httpStatus` derive from it. Modelled on `SqlError`
+* and `HttpClientError` in Effect.
+*/
+var DomainKitError = class extends Schema.TaggedError("@domainkit/DomainKitError")("DomainKitError", { reason: Schema.suspend(() => Model) }) {
+	get category() {
+		switch (this.reason._tag) {
+			case "InvalidInput":
+			case "NotFound": return "request";
+			case "Unauthenticated":
+			case "Forbidden":
+			case "Reconnect": return "auth";
+			case "Conflict":
+			case "Stale":
+			case "Expired":
+			case "Busy": return "plan";
+			case "ProviderRejected":
+			case "ProviderUnavailable":
+			case "ProviderConflict":
+			case "Unsupported": return "provider";
+			case "StorageFailed": return "storage";
+			case "CryptoFailed":
+			case "ResolverFailed": return "internal";
+		}
+	}
+	get isRetryable() {
+		return this.reason._tag === "Busy" || this.reason._tag === "ProviderUnavailable" || this.reason._tag === "StorageFailed";
+	}
+	/** The HTTP status `domainkit/server` answers with; hosts mapping their own routes use the same table. */
+	get httpStatus() {
+		switch (this.reason._tag) {
+			case "InvalidInput": return 400;
+			case "Unauthenticated": return 401;
+			case "Forbidden":
+			case "Reconnect": return 403;
+			case "NotFound": return 404;
+			case "Conflict":
+			case "Stale":
+			case "Expired":
+			case "Busy": return 409;
+			case "ProviderRejected": return 502;
+			case "ProviderConflict": return 409;
+			case "Unsupported": return 501;
+			case "ProviderUnavailable": return 503;
+			case "StorageFailed":
+			case "CryptoFailed":
+			case "ResolverFailed": return 500;
+		}
+	}
+	get message() {
+		return this.reason.message;
+	}
+};
+const isDomainKitError = (input) => input instanceof DomainKitError;
+/** `Effect.fail(new DomainKitError({ reason }))` shorthand used across the package. */
+const fail = (reason) => Effect.fail(new DomainKitError({ reason }));
+/** Decode with any schema, failing with reason `InvalidInput` and the schema's message. */
+const decode = (schema, input, field) => Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => new DomainKitError({ reason: new InvalidInput({
+	message: cause.message,
+	...field === void 0 ? {} : { field }
+}) })));
+//#endregion
+export { DomainKitError, decode, fail, isDomainKitError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/internal/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["Reason.Model","Reason.InvalidInput"],"sources":["../../src/internal/error.ts"],"sourcesContent":["/**\n * The one error every DomainKit operation fails with, published as `DomainKit.Error`. Hosts match\n * on `reason`; `category`, `isRetryable`, and `httpStatus` derive from it. Modelled on `SqlError`\n * and `HttpClientError` in Effect.\n */\nimport { Effect, Schema } from \"effect\";\n\nimport * as Reason from \"../Reason.ts\";\n\nexport type Category = \"request\" | \"auth\" | \"plan\" | \"provider\" | \"storage\" | \"internal\";\n\nexport class DomainKitError extends Schema.TaggedError<DomainKitError>(\"@domainkit/DomainKitError\")(\n  \"DomainKitError\",\n  { reason: Schema.suspend(() => Reason.Model) },\n) {\n  get category(): Category {\n    switch (this.reason._tag) {\n      case \"InvalidInput\":\n      case \"NotFound\":\n        return \"request\";\n      case \"Unauthenticated\":\n      case \"Forbidden\":\n      case \"Reconnect\":\n        return \"auth\";\n      case \"Conflict\":\n      case \"Stale\":\n      case \"Expired\":\n      case \"Busy\":\n        return \"plan\";\n      case \"ProviderRejected\":\n      case \"ProviderUnavailable\":\n      case \"ProviderConflict\":\n      case \"Unsupported\":\n        return \"provider\";\n      case \"StorageFailed\":\n        return \"storage\";\n      case \"CryptoFailed\":\n      case \"ResolverFailed\":\n        return \"internal\";\n    }\n  }\n\n  get isRetryable(): boolean {\n    return (\n      this.reason._tag === \"Busy\" ||\n      this.reason._tag === \"ProviderUnavailable\" ||\n      this.reason._tag === \"StorageFailed\"\n    );\n  }\n\n  /** The HTTP status `domainkit/server` answers with; hosts mapping their own routes use the same table. */\n  get httpStatus(): number {\n    switch (this.reason._tag) {\n      case \"InvalidInput\":\n        return 400;\n      case \"Unauthenticated\":\n        return 401;\n      case \"Forbidden\":\n      case \"Reconnect\":\n        return 403;\n      case \"NotFound\":\n        return 404;\n      case \"Conflict\":\n      case \"Stale\":\n      case \"Expired\":\n      case \"Busy\":\n        return 409;\n      case \"ProviderRejected\":\n        return 502;\n      case \"ProviderConflict\":\n        return 409;\n      case \"Unsupported\":\n        return 501;\n      case \"ProviderUnavailable\":\n        return 503;\n      case \"StorageFailed\":\n      case \"CryptoFailed\":\n      case \"ResolverFailed\":\n        return 500;\n    }\n  }\n\n  override get message(): string {\n    return this.reason.message;\n  }\n}\n\nexport const isDomainKitError = (input: unknown): input is DomainKitError =>\n  input instanceof DomainKitError;\n\n/** `Effect.fail(new DomainKitError({ reason }))` shorthand used across the package. */\nexport const fail = <R extends Reason.Model>(reason: R): Effect.Effect<never, DomainKitError> =>\n  Effect.fail(new DomainKitError({ reason }));\n\n/** Decode with any schema, failing with reason `InvalidInput` and the schema's message. */\nexport const decode = <S extends Schema.ConstraintDecoder<unknown>>(\n  schema: S,\n  input: unknown,\n  field?: string,\n): Effect.Effect<S[\"Type\"], DomainKitError> =>\n  Schema.decodeUnknownEffect(schema)(input).pipe(\n    Effect.mapError(\n      (cause) =>\n        new DomainKitError({\n          reason: new Reason.InvalidInput({\n            message: cause.message,\n            ...(field === undefined ? {} : { field }),\n          }),\n        }),\n    ),\n  );\n"],"mappings":";;;;;;;;AAWA,IAAa,iBAAb,cAAoC,OAAO,YAA4B,2BAA2B,CAAC,CACjG,kBACA,EAAE,QAAQ,OAAO,cAAcA,KAAY,EAAE,CAC/C,CAAC,CAAC;CACA,IAAI,WAAqB;EACvB,QAAQ,KAAK,OAAO,MAApB;GACE,KAAK;GACL,KAAK,YACH,OAAO;GACT,KAAK;GACL,KAAK;GACL,KAAK,aACH,OAAO;GACT,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,eACH,OAAO;GACT,KAAK,iBACH,OAAO;GACT,KAAK;GACL,KAAK,kBACH,OAAO;EACX;CACF;CAEA,IAAI,cAAuB;EACzB,OACE,KAAK,OAAO,SAAS,UACrB,KAAK,OAAO,SAAS,yBACrB,KAAK,OAAO,SAAS;CAEzB;;CAGA,IAAI,aAAqB;EACvB,QAAQ,KAAK,OAAO,MAApB;GACE,KAAK,gBACH,OAAO;GACT,KAAK,mBACH,OAAO;GACT,KAAK;GACL,KAAK,aACH,OAAO;GACT,KAAK,YACH,OAAO;GACT,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,QACH,OAAO;GACT,KAAK,oBACH,OAAO;GACT,KAAK,oBACH,OAAO;GACT,KAAK,eACH,OAAO;GACT,KAAK,uBACH,OAAO;GACT,KAAK;GACL,KAAK;GACL,KAAK,kBACH,OAAO;EACX;CACF;CAEA,IAAa,UAAkB;EAC7B,OAAO,KAAK,OAAO;CACrB;AACF;AAEA,MAAa,oBAAoB,UAC/B,iBAAiB;;AAGnB,MAAa,QAAgC,WAC3C,OAAO,KAAK,IAAI,eAAe,EAAE,OAAO,CAAC,CAAC;;AAG5C,MAAa,UACX,QACA,OACA,UAEA,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,UACJ,UACC,IAAI,eAAe,EACjB,QAAQ,IAAIC,aAAoB;CAC9B,SAAS,MAAM;CACf,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AACzC,CAAC,EACH,CAAC,CACL,CACF"}

package/dist/internal/http.mjs

@@ -0,0 +1,90 @@
+import { Forbidden, ProviderConflict, ProviderRejected, ProviderUnavailable, Unauthenticated } from "../Reason.mjs";
+import { DomainKitError, isDomainKitError } from "./error.mjs";
+import { Effect } from "effect";
+//#region src/internal/http.ts
+/** One provider HTTP round trip: transport failures and non-JSON replies are already classified. */
+const requestJson = (input) => Effect.tryPromise({
+	try: async (signal) => {
+		const { fetch: send } = input;
+		const response = await send(input.url, {
+			...input.init,
+			signal
+		});
+		const text = await response.text();
+		let body = null;
+		if (text.length > 0) try {
+			body = JSON.parse(text);
+		} catch {
+			throw new DomainKitError({ reason: response.ok ? new ProviderRejected({
+				provider: input.provider,
+				message: `${input.provider} returned a non-JSON response`
+			}) : classify(input.provider, response.status, response.headers, `HTTP ${response.status}`) });
+		}
+		return {
+			status: response.status,
+			ok: response.ok,
+			headers: response.headers,
+			body
+		};
+	},
+	catch: (cause) => isDomainKitError(cause) ? cause : new DomainKitError({ reason: new ProviderUnavailable({
+		provider: input.provider,
+		message: cause instanceof Error ? cause.message : `${input.provider} request failed`
+	}) })
+});
+/** Host-supplied request headers, given as a value or as a thunk that may await a fresh token. */
+const headersFrom = (source) => source === void 0 ? Effect.sync(() => new Headers()) : typeof source !== "function" ? Effect.sync(() => new Headers(source)) : Effect.tryPromise({
+	try: async () => new Headers(await source()),
+	catch: (cause) => isDomainKitError(cause) ? cause : new DomainKitError({ reason: new Unauthenticated({ message: cause instanceof Error ? cause.message : "Request headers were unavailable" }) })
+});
+/**
+* Map an HTTP failure to a reason: 401 -> Unauthenticated, 403 -> Forbidden, 409 or a provider
+* conflict code -> ProviderConflict, 429/5xx -> ProviderUnavailable, else ProviderRejected.
+*/
+const classify = (provider, status, headers, message, code) => {
+	if (status === 401) return new Unauthenticated({ message });
+	if (status === 403) return new Forbidden({ message });
+	if (status === 409 || code === "conflict") return new ProviderConflict({
+		provider,
+		message,
+		code: code ?? String(status)
+	});
+	if (status === 429 || status >= 500) {
+		const retryAfterMs = retryAfter(headers.get("retry-after"));
+		return new ProviderUnavailable({
+			provider,
+			message,
+			...retryAfterMs === void 0 ? {} : { retryAfterMs }
+		});
+	}
+	return new ProviderRejected({
+		provider,
+		message,
+		code: code ?? String(status)
+	});
+};
+const rejected = (provider, message, code) => new DomainKitError({ reason: new ProviderRejected({
+	provider,
+	message,
+	...code === void 0 ? {} : { code }
+}) });
+function retryAfter(value) {
+	if (value === null) return void 0;
+	const seconds = Number(value);
+	if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+	const date = Date.parse(value);
+	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
+}
+const bearer = (token, init) => ({
+	...init,
+	headers: {
+		Accept: "application/json",
+		Authorization: `Bearer ${token}`,
+		...init?.body === void 0 ? {} : { "Content-Type": "application/json" },
+		...init?.headers
+	}
+});
+//#endregion
+export { bearer, classify, headersFrom, rejected, requestJson };
+
+//# sourceMappingURL=http.mjs.map

package/dist/internal/http.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.mjs","names":["Errors.DomainKitError","Reason.ProviderRejected","Errors.isDomainKitError","Reason.ProviderUnavailable","Reason.Unauthenticated","Reason.Forbidden","Reason.ProviderConflict"],"sources":["../../src/internal/http.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Reply {\n  readonly status: number;\n  readonly ok: boolean;\n  readonly headers: Headers;\n  /** Parsed JSON, or `null` for an empty body. */\n  readonly body: unknown;\n}\n\n/** One provider HTTP round trip: transport failures and non-JSON replies are already classified. */\nexport const requestJson = (input: {\n  readonly fetch: Fetch;\n  readonly provider: string;\n  readonly url: URL | string;\n  readonly init?: RequestInit;\n}): Effect.Effect<Reply, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async (signal): Promise<Reply> => {\n      const { fetch: send } = input; // a free call keeps `this` undefined for a native fetch\n      const response = await send(input.url, { ...input.init, signal });\n      const text = await response.text();\n      let body: unknown = null;\n      if (text.length > 0) {\n        try {\n          body = JSON.parse(text);\n        } catch {\n          throw new Errors.DomainKitError({\n            reason: response.ok\n              ? new Reason.ProviderRejected({\n                  provider: input.provider,\n                  message: `${input.provider} returned a non-JSON response`,\n                })\n              : classify(\n                  input.provider,\n                  response.status,\n                  response.headers,\n                  `HTTP ${response.status}`,\n                ),\n          });\n        }\n      }\n      return { status: response.status, ok: response.ok, headers: response.headers, body };\n    },\n    catch: (cause) =>\n      Errors.isDomainKitError(cause)\n        ? cause\n        : new Errors.DomainKitError({\n            reason: new Reason.ProviderUnavailable({\n              provider: input.provider,\n              message: cause instanceof Error ? cause.message : `${input.provider} request failed`,\n            }),\n          }),\n  });\n\n/** Host-supplied request headers, given as a value or as a thunk that may await a fresh token. */\nexport const headersFrom = (\n  source: HeadersInit | (() => HeadersInit | Promise<HeadersInit>) | undefined,\n): Effect.Effect<Headers, Errors.DomainKitError> =>\n  source === undefined\n    ? Effect.sync(() => new Headers())\n    : typeof source !== \"function\"\n      ? Effect.sync(() => new Headers(source))\n      : Effect.tryPromise({\n          try: async () => new Headers(await source()),\n          catch: (cause) =>\n            Errors.isDomainKitError(cause)\n              ? cause\n              : new Errors.DomainKitError({\n                  reason: new Reason.Unauthenticated({\n                    message:\n                      cause instanceof Error ? cause.message : \"Request headers were unavailable\",\n                  }),\n                }),\n        });\n\n/**\n * Map an HTTP failure to a reason: 401 -> Unauthenticated, 403 -> Forbidden, 409 or a provider\n * conflict code -> ProviderConflict, 429/5xx -> ProviderUnavailable, else ProviderRejected.\n */\nexport const classify = (\n  provider: string,\n  status: number,\n  headers: Headers,\n  message: string,\n  code?: string,\n): Reason.Model => {\n  if (status === 401) return new Reason.Unauthenticated({ message });\n  if (status === 403) return new Reason.Forbidden({ message });\n  if (status === 409 || code === \"conflict\") {\n    return new Reason.ProviderConflict({\n      provider,\n      message,\n      code: code ?? String(status),\n    });\n  }\n  if (status === 429 || status >= 500) {\n    const retryAfterMs = retryAfter(headers.get(\"retry-after\"));\n    return new Reason.ProviderUnavailable({\n      provider,\n      message,\n      ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n    });\n  }\n  return new Reason.ProviderRejected({\n    provider,\n    message,\n    code: code ?? String(status),\n  });\n};\n\nexport const rejected = (provider: string, message: string, code?: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.ProviderRejected({\n      provider,\n      message,\n      ...(code === undefined ? {} : { code }),\n    }),\n  });\n\nfunction retryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);\n  const date = Date.parse(value);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\nexport const bearer = (token: string, init?: RequestInit): RequestInit => ({\n  ...init,\n  headers: {\n    Accept: \"application/json\",\n    Authorization: `Bearer ${token}`,\n    ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n    ...init?.headers,\n  },\n});\n"],"mappings":";;;;;AAgBA,MAAa,eAAe,UAM1B,OAAO,WAAW;CAChB,KAAK,OAAO,WAA2B;EACrC,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK;GAAE,GAAG,MAAM;GAAM;EAAO,CAAC;EAChE,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,OAAgB;EACpB,IAAI,KAAK,SAAS,GAChB,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,MAAM,IAAIA,eAAsB,EAC9B,QAAQ,SAAS,KACb,IAAIC,iBAAwB;IAC1B,UAAU,MAAM;IAChB,SAAS,GAAG,MAAM,SAAS;GAC7B,CAAC,IACD,SACE,MAAM,UACN,SAAS,QACT,SAAS,SACT,QAAQ,SAAS,QACnB,EACN,CAAC;EACH;EAEF,OAAO;GAAE,QAAQ,SAAS;GAAQ,IAAI,SAAS;GAAI,SAAS,SAAS;GAAS;EAAK;CACrF;CACA,QAAQ,UACNC,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EACxB,QAAQ,IAAIG,oBAA2B;EACrC,UAAU,MAAM;EAChB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,GAAG,MAAM,SAAS;CACtE,CAAC,EACH,CAAC;AACT,CAAC;;AAGH,MAAa,eACX,WAEA,WAAW,KAAA,IACP,OAAO,WAAW,IAAI,QAAQ,CAAC,IAC/B,OAAO,WAAW,aAChB,OAAO,WAAW,IAAI,QAAQ,MAAM,CAAC,IACrC,OAAO,WAAW;CAChB,KAAK,YAAY,IAAI,QAAQ,MAAM,OAAO,CAAC;CAC3C,QAAQ,UACND,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EACxB,QAAQ,IAAII,gBAAuB,EACjC,SACE,iBAAiB,QAAQ,MAAM,UAAU,mCAC7C,CAAC,EACH,CAAC;AACT,CAAC;;;;;AAMT,MAAa,YACX,UACA,QACA,SACA,SACA,SACiB;CACjB,IAAI,WAAW,KAAK,OAAO,IAAIA,gBAAuB,EAAE,QAAQ,CAAC;CACjE,IAAI,WAAW,KAAK,OAAO,IAAIC,UAAiB,EAAE,QAAQ,CAAC;CAC3D,IAAI,WAAW,OAAO,SAAS,YAC7B,OAAO,IAAIC,iBAAwB;EACjC;EACA;EACA,MAAM,QAAQ,OAAO,MAAM;CAC7B,CAAC;CAEH,IAAI,WAAW,OAAO,UAAU,KAAK;EACnC,MAAM,eAAe,WAAW,QAAQ,IAAI,aAAa,CAAC;EAC1D,OAAO,IAAIH,oBAA2B;GACpC;GACA;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;CACH;CACA,OAAO,IAAIF,iBAAwB;EACjC;EACA;EACA,MAAM,QAAQ,OAAO,MAAM;CAC7B,CAAC;AACH;AAEA,MAAa,YAAY,UAAkB,SAAiB,SAC1D,IAAID,eAAsB,EACxB,QAAQ,IAAIC,iBAAwB;CAClC;CACA;CACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;AACvC,CAAC,EACH,CAAC;AAEH,SAAS,WAAW,OAA0C;CAC5D,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,UAAU,GAAK;CAChE,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,OAAO,OAAO,MAAM,IAAI,IAAI,KAAA,IAAY,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AACvE;AAEA,MAAa,UAAU,OAAe,UAAqC;CACzE,GAAG;CACH,SAAS;EACP,QAAQ;EACR,eAAe,UAAU;EACzB,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;EACzE,GAAG,MAAM;CACX;AACF"}

package/dist/internal/ids.mjs

@@ -0,0 +1,8 @@
+import { Effect } from "effect";
+//#region src/internal/ids.ts
+/** A fresh, prefixed, URL-safe identifier (`prefix_<uuid>`). */
+const fresh = (prefix) => Effect.sync(() => `${prefix}_${crypto.randomUUID()}`);
+//#endregion
+export { fresh };
+
+//# sourceMappingURL=ids.mjs.map

package/dist/internal/ids.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.mjs","names":[],"sources":["../../src/internal/ids.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\n/** A fresh, prefixed, URL-safe identifier (`prefix_<uuid>`). */\nexport const fresh = (prefix: string): Effect.Effect<string> =>\n  Effect.sync(() => `${prefix}_${crypto.randomUUID()}`);\n"],"mappings":";;;AAGA,MAAa,SAAS,WACpB,OAAO,WAAW,GAAG,OAAO,GAAG,OAAO,WAAW,GAAG"}

package/dist/internal/oauth.mjs

@@ -0,0 +1,113 @@
+import { CryptoFailed, ProviderRejected, ProviderUnavailable, Unauthenticated } from "../Reason.mjs";
+import { DomainKitError } from "./error.mjs";
+import { DateTime, Effect, Redacted } from "effect";
+import * as oauth from "oauth4webapi";
+//#region src/internal/oauth.ts
+/** A PKCE pair: the verifier stays in the continuation, the challenge goes to the provider. */
+const pkce = () => Effect.tryPromise({
+	try: async () => {
+		const codeVerifier = oauth.generateRandomCodeVerifier();
+		return {
+			codeVerifier,
+			codeChallenge: await oauth.calculatePKCECodeChallenge(codeVerifier)
+		};
+	},
+	catch: () => new DomainKitError({ reason: new CryptoFailed({ operation: "digest" }) })
+});
+const authorizationUrl = (input) => {
+	const url = new URL(input.server.authorization_endpoint);
+	url.search = new URLSearchParams({
+		client_id: input.clientId,
+		code_challenge: input.codeChallenge,
+		code_challenge_method: "S256",
+		redirect_uri: input.callbackUrl,
+		response_type: "code",
+		scope: input.scopes.join(" "),
+		state: input.state
+	}).toString();
+	return url.toString();
+};
+const clientAuth = (client) => {
+	if (client.clientAuth === "none") return oauth.None();
+	const secret = client.clientSecret === null ? "" : Redacted.value(client.clientSecret);
+	return client.clientAuth === "client_secret_basic" ? oauth.ClientSecretBasic(secret) : oauth.ClientSecretPost(secret);
+};
+const requestOptions = (fetch, signal) => fetch === void 0 ? { signal } : {
+	signal,
+	[oauth.customFetch]: (url, init) => fetch(url, {
+		...init,
+		body: init.body
+	})
+};
+const tokens = (response, now) => ({
+	accessToken: response.access_token,
+	refreshToken: response.refresh_token ?? null,
+	expiresAt: typeof response.expires_in === "number" ? DateTime.add(now, { seconds: response.expires_in }) : null,
+	scope: response.scope ?? null
+});
+const failure = (provider, cause) => {
+	if (cause instanceof oauth.ResponseBodyError) {
+		const terminal = [
+			"invalid_grant",
+			"invalid_client",
+			"unauthorized_client"
+		].includes(cause.error);
+		return new DomainKitError({ reason: terminal ? new Unauthenticated({ message: `${provider} rejected the grant: ${cause.error}` }) : new ProviderRejected({
+			provider,
+			code: cause.error,
+			message: cause.error_description ?? cause.error
+		}) });
+	}
+	if (cause instanceof oauth.AuthorizationResponseError) return new DomainKitError({ reason: new Unauthenticated({ message: `${provider} authorization failed: ${cause.error}` }) });
+	return new DomainKitError({ reason: new ProviderUnavailable({
+		provider,
+		message: cause instanceof Error ? cause.message : `${provider} OAuth request failed`
+	}) });
+};
+const exchangeCode = (input) => Effect.gen(function* () {
+	const now = yield* DateTime.now;
+	const server = input.server;
+	const client = { client_id: input.client.clientId };
+	const response = yield* Effect.tryPromise({
+		try: async (signal) => {
+			const params = oauth.validateAuthResponse(server, client, new URLSearchParams({
+				code: input.code,
+				state: input.state
+			}), input.state);
+			const reply = await oauth.authorizationCodeGrantRequest(server, client, clientAuth(input.client), params, input.callbackUrl, input.codeVerifier, requestOptions(input.fetch, signal));
+			return oauth.processAuthorizationCodeResponse(server, client, reply);
+		},
+		catch: (cause) => failure(input.provider, cause)
+	});
+	return tokens(response, now);
+});
+const refresh = (input) => Effect.gen(function* () {
+	const now = yield* DateTime.now;
+	const server = input.server;
+	const client = { client_id: input.client.clientId };
+	const response = yield* Effect.tryPromise({
+		try: async (signal) => {
+			const reply = await oauth.refreshTokenGrantRequest(server, client, clientAuth(input.client), input.refreshToken, requestOptions(input.fetch, signal));
+			return oauth.processRefreshTokenResponse(server, client, reply);
+		},
+		catch: (cause) => failure(input.provider, cause)
+	});
+	const next = tokens(response, now);
+	return {
+		...next,
+		refreshToken: next.refreshToken ?? input.refreshToken
+	};
+});
+const revoke = (input) => Effect.tryPromise({
+	try: async (signal) => {
+		const server = input.server;
+		const client = { client_id: input.client.clientId };
+		const reply = await oauth.revocationRequest(server, client, clientAuth(input.client), input.token, requestOptions(input.fetch, signal));
+		await oauth.processRevocationResponse(reply);
+	},
+	catch: (cause) => failure(input.provider, cause)
+});
+//#endregion
+export { authorizationUrl, exchangeCode, pkce, refresh, revoke };
+
+//# sourceMappingURL=oauth.mjs.map

package/dist/internal/oauth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.mjs","names":["Errors.DomainKitError","Reason.CryptoFailed","Reason.Unauthenticated","Reason.ProviderRejected","Reason.ProviderUnavailable"],"sources":["../../src/internal/oauth.ts"],"sourcesContent":["import { DateTime, Effect, Redacted } from \"effect\";\nimport * as oauth from \"oauth4webapi\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\nimport type { Fetch } from \"./http.ts\";\n\nexport interface Server {\n  readonly issuer: string;\n  readonly authorization_endpoint: string;\n  readonly token_endpoint: string;\n  readonly revocation_endpoint?: string;\n}\n\nexport type ClientAuth = \"client_secret_basic\" | \"client_secret_post\" | \"none\";\n\nexport interface Client {\n  readonly clientId: string;\n  readonly clientSecret: Redacted.Redacted<string> | null;\n  readonly clientAuth: ClientAuth;\n}\n\n/** A PKCE pair: the verifier stays in the continuation, the challenge goes to the provider. */\nexport const pkce = (): Effect.Effect<\n  { readonly codeVerifier: string; readonly codeChallenge: string },\n  Errors.DomainKitError\n> =>\n  Effect.tryPromise({\n    try: async () => {\n      const codeVerifier = oauth.generateRandomCodeVerifier();\n      return { codeVerifier, codeChallenge: await oauth.calculatePKCECodeChallenge(codeVerifier) };\n    },\n    catch: () =>\n      new Errors.DomainKitError({\n        reason: new Reason.CryptoFailed({ operation: \"digest\" }),\n      }),\n  });\n\nexport const authorizationUrl = (input: {\n  readonly server: Server;\n  readonly clientId: string;\n  readonly scopes: ReadonlyArray<string>;\n  readonly state: string;\n  readonly callbackUrl: string;\n  readonly codeChallenge: string;\n}): string => {\n  const url = new URL(input.server.authorization_endpoint);\n  url.search = new URLSearchParams({\n    client_id: input.clientId,\n    code_challenge: input.codeChallenge,\n    code_challenge_method: \"S256\",\n    redirect_uri: input.callbackUrl,\n    response_type: \"code\",\n    scope: input.scopes.join(\" \"),\n    state: input.state,\n  }).toString();\n  return url.toString();\n};\n\nexport interface Tokens {\n  readonly accessToken: string;\n  readonly refreshToken: string | null;\n  readonly expiresAt: DateTime.Utc | null;\n  readonly scope: string | null;\n}\n\nconst clientAuth = (client: Client): oauth.ClientAuth => {\n  if (client.clientAuth === \"none\") return oauth.None();\n  const secret = client.clientSecret === null ? \"\" : Redacted.value(client.clientSecret);\n  return client.clientAuth === \"client_secret_basic\"\n    ? oauth.ClientSecretBasic(secret)\n    : oauth.ClientSecretPost(secret);\n};\n\nconst requestOptions = (\n  fetch: Fetch | undefined,\n  signal: AbortSignal,\n): oauth.TokenEndpointRequestOptions =>\n  fetch === undefined\n    ? { signal }\n    : { signal, [oauth.customFetch]: (url, init) => fetch(url, { ...init, body: init.body }) };\n\nconst tokens = (response: oauth.TokenEndpointResponse, now: DateTime.Utc): Tokens => ({\n  accessToken: response.access_token,\n  refreshToken: response.refresh_token ?? null,\n  expiresAt:\n    typeof response.expires_in === \"number\"\n      ? DateTime.add(now, { seconds: response.expires_in })\n      : null,\n  scope: response.scope ?? null,\n});\n\nconst failure = (provider: string, cause: unknown): Errors.DomainKitError => {\n  if (cause instanceof oauth.ResponseBodyError) {\n    const terminal = [\"invalid_grant\", \"invalid_client\", \"unauthorized_client\"].includes(\n      cause.error,\n    );\n    return new Errors.DomainKitError({\n      reason: terminal\n        ? new Reason.Unauthenticated({\n            message: `${provider} rejected the grant: ${cause.error}`,\n          })\n        : new Reason.ProviderRejected({\n            provider,\n            code: cause.error,\n            message: cause.error_description ?? cause.error,\n          }),\n    });\n  }\n  if (cause instanceof oauth.AuthorizationResponseError) {\n    return new Errors.DomainKitError({\n      reason: new Reason.Unauthenticated({\n        message: `${provider} authorization failed: ${cause.error}`,\n      }),\n    });\n  }\n  return new Errors.DomainKitError({\n    reason: new Reason.ProviderUnavailable({\n      provider,\n      message: cause instanceof Error ? cause.message : `${provider} OAuth request failed`,\n    }),\n  });\n};\n\nexport const exchangeCode = (input: {\n  readonly provider: string;\n  readonly server: Server;\n  readonly client: Client;\n  readonly code: string;\n  readonly state: string;\n  readonly callbackUrl: string;\n  readonly codeVerifier: string;\n  readonly fetch?: Fetch;\n}): Effect.Effect<Tokens, Errors.DomainKitError> =>\n  Effect.gen(function* () {\n    const now = yield* DateTime.now;\n    const server = input.server as oauth.AuthorizationServer;\n    const client: oauth.Client = { client_id: input.client.clientId };\n    const response = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const params = oauth.validateAuthResponse(\n          server,\n          client,\n          new URLSearchParams({ code: input.code, state: input.state }),\n          input.state,\n        );\n        const reply = await oauth.authorizationCodeGrantRequest(\n          server,\n          client,\n          clientAuth(input.client),\n          params,\n          input.callbackUrl,\n          input.codeVerifier,\n          requestOptions(input.fetch, signal),\n        );\n        return oauth.processAuthorizationCodeResponse(server, client, reply);\n      },\n      catch: (cause) => failure(input.provider, cause),\n    });\n    return tokens(response, now);\n  });\n\nexport const refresh = (input: {\n  readonly provider: string;\n  readonly server: Server;\n  readonly client: Client;\n  readonly refreshToken: string;\n  readonly fetch?: Fetch;\n}): Effect.Effect<Tokens, Errors.DomainKitError> =>\n  Effect.gen(function* () {\n    const now = yield* DateTime.now;\n    const server = input.server as oauth.AuthorizationServer;\n    const client: oauth.Client = { client_id: input.client.clientId };\n    const response = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const reply = await oauth.refreshTokenGrantRequest(\n          server,\n          client,\n          clientAuth(input.client),\n          input.refreshToken,\n          requestOptions(input.fetch, signal),\n        );\n        return oauth.processRefreshTokenResponse(server, client, reply);\n      },\n      catch: (cause) => failure(input.provider, cause),\n    });\n    const next = tokens(response, now);\n    return { ...next, refreshToken: next.refreshToken ?? input.refreshToken };\n  });\n\nexport const revoke = (input: {\n  readonly provider: string;\n  readonly server: Server;\n  readonly client: Client;\n  readonly token: string;\n  readonly fetch?: Fetch;\n}): Effect.Effect<void, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async (signal) => {\n      const server = input.server as oauth.AuthorizationServer;\n      const client: oauth.Client = { client_id: input.client.clientId };\n      const reply = await oauth.revocationRequest(\n        server,\n        client,\n        clientAuth(input.client),\n        input.token,\n        requestOptions(input.fetch, signal),\n      );\n      await oauth.processRevocationResponse(reply);\n    },\n    catch: (cause) => failure(input.provider, cause),\n  });\n"],"mappings":";;;;;;AAuBA,MAAa,aAIX,OAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,eAAe,MAAM,2BAA2B;EACtD,OAAO;GAAE;GAAc,eAAe,MAAM,MAAM,2BAA2B,YAAY;EAAE;CAC7F;CACA,aACE,IAAIA,eAAsB,EACxB,QAAQ,IAAIC,aAAoB,EAAE,WAAW,SAAS,CAAC,EACzD,CAAC;AACL,CAAC;AAEH,MAAa,oBAAoB,UAOnB;CACZ,MAAM,MAAM,IAAI,IAAI,MAAM,OAAO,sBAAsB;CACvD,IAAI,SAAS,IAAI,gBAAgB;EAC/B,WAAW,MAAM;EACjB,gBAAgB,MAAM;EACtB,uBAAuB;EACvB,cAAc,MAAM;EACpB,eAAe;EACf,OAAO,MAAM,OAAO,KAAK,GAAG;EAC5B,OAAO,MAAM;CACf,CAAC,CAAC,CAAC,SAAS;CACZ,OAAO,IAAI,SAAS;AACtB;AASA,MAAM,cAAc,WAAqC;CACvD,IAAI,OAAO,eAAe,QAAQ,OAAO,MAAM,KAAK;CACpD,MAAM,SAAS,OAAO,iBAAiB,OAAO,KAAK,SAAS,MAAM,OAAO,YAAY;CACrF,OAAO,OAAO,eAAe,wBACzB,MAAM,kBAAkB,MAAM,IAC9B,MAAM,iBAAiB,MAAM;AACnC;AAEA,MAAM,kBACJ,OACA,WAEA,UAAU,KAAA,IACN,EAAE,OAAO,IACT;CAAE;EAAS,MAAM,eAAe,KAAK,SAAS,MAAM,KAAK;EAAE,GAAG;EAAM,MAAM,KAAK;CAAK,CAAC;AAAE;AAE7F,MAAM,UAAU,UAAuC,SAA+B;CACpF,aAAa,SAAS;CACtB,cAAc,SAAS,iBAAiB;CACxC,WACE,OAAO,SAAS,eAAe,WAC3B,SAAS,IAAI,KAAK,EAAE,SAAS,SAAS,WAAW,CAAC,IAClD;CACN,OAAO,SAAS,SAAS;AAC3B;AAEA,MAAM,WAAW,UAAkB,UAA0C;CAC3E,IAAI,iBAAiB,MAAM,mBAAmB;EAC5C,MAAM,WAAW;GAAC;GAAiB;GAAkB;EAAqB,CAAC,CAAC,SAC1E,MAAM,KACR;EACA,OAAO,IAAID,eAAsB,EAC/B,QAAQ,WACJ,IAAIE,gBAAuB,EACzB,SAAS,GAAG,SAAS,uBAAuB,MAAM,QACpD,CAAC,IACD,IAAIC,iBAAwB;GAC1B;GACA,MAAM,MAAM;GACZ,SAAS,MAAM,qBAAqB,MAAM;EAC5C,CAAC,EACP,CAAC;CACH;CACA,IAAI,iBAAiB,MAAM,4BACzB,OAAO,IAAIH,eAAsB,EAC/B,QAAQ,IAAIE,gBAAuB,EACjC,SAAS,GAAG,SAAS,yBAAyB,MAAM,QACtD,CAAC,EACH,CAAC;CAEH,OAAO,IAAIF,eAAsB,EAC/B,QAAQ,IAAII,oBAA2B;EACrC;EACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,GAAG,SAAS;CAChE,CAAC,EACH,CAAC;AACH;AAEA,MAAa,gBAAgB,UAU3B,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,SAAS,MAAM;CACrB,MAAM,SAAuB,EAAE,WAAW,MAAM,OAAO,SAAS;CAChE,MAAM,WAAW,OAAO,OAAO,WAAW;EACxC,KAAK,OAAO,WAAW;GACrB,MAAM,SAAS,MAAM,qBACnB,QACA,QACA,IAAI,gBAAgB;IAAE,MAAM,MAAM;IAAM,OAAO,MAAM;GAAM,CAAC,GAC5D,MAAM,KACR;GACA,MAAM,QAAQ,MAAM,MAAM,8BACxB,QACA,QACA,WAAW,MAAM,MAAM,GACvB,QACA,MAAM,aACN,MAAM,cACN,eAAe,MAAM,OAAO,MAAM,CACpC;GACA,OAAO,MAAM,iCAAiC,QAAQ,QAAQ,KAAK;EACrE;EACA,QAAQ,UAAU,QAAQ,MAAM,UAAU,KAAK;CACjD,CAAC;CACD,OAAO,OAAO,UAAU,GAAG;AAC7B,CAAC;AAEH,MAAa,WAAW,UAOtB,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,SAAS,MAAM;CACrB,MAAM,SAAuB,EAAE,WAAW,MAAM,OAAO,SAAS;CAChE,MAAM,WAAW,OAAO,OAAO,WAAW;EACxC,KAAK,OAAO,WAAW;GACrB,MAAM,QAAQ,MAAM,MAAM,yBACxB,QACA,QACA,WAAW,MAAM,MAAM,GACvB,MAAM,cACN,eAAe,MAAM,OAAO,MAAM,CACpC;GACA,OAAO,MAAM,4BAA4B,QAAQ,QAAQ,KAAK;EAChE;EACA,QAAQ,UAAU,QAAQ,MAAM,UAAU,KAAK;CACjD,CAAC;CACD,MAAM,OAAO,OAAO,UAAU,GAAG;CACjC,OAAO;EAAE,GAAG;EAAM,cAAc,KAAK,gBAAgB,MAAM;CAAa;AAC1E,CAAC;AAEH,MAAa,UAAU,UAOrB,OAAO,WAAW;CAChB,KAAK,OAAO,WAAW;EACrB,MAAM,SAAS,MAAM;EACrB,MAAM,SAAuB,EAAE,WAAW,MAAM,OAAO,SAAS;EAChE,MAAM,QAAQ,MAAM,MAAM,kBACxB,QACA,QACA,WAAW,MAAM,MAAM,GACvB,MAAM,OACN,eAAe,MAAM,OAAO,MAAM,CACpC;EACA,MAAM,MAAM,0BAA0B,KAAK;CAC7C;CACA,QAAQ,UAAU,QAAQ,MAAM,UAAU,KAAK;AACjD,CAAC"}

package/dist/internal/planner.mjs

@@ -0,0 +1,88 @@
+import { Model, Observed, equals, sameSet } from "../DnsRecord.mjs";
+import { Conflict, Create, Digest, Kind, Noop, Operation, OperationId, Version } from "../Plan.mjs";
+import { CryptoFailed } from "../Reason.mjs";
+import { DomainKitError } from "./error.mjs";
+import { sha256Hex, stringify } from "./digest.mjs";
+import { Effect, Schema } from "effect";
+//#region src/internal/planner.ts
+const Unsigned = Schema.Struct({
+	version: Version,
+	kind: Kind,
+	domain: Schema.String,
+	zone: Schema.String,
+	provider: Schema.String,
+	attachmentId: Schema.String,
+	operations: Schema.Array(Operation)
+});
+const operationId = (record) => sha256Hex(stringify({ record: strip(record) })).pipe(Effect.map(OperationId.make));
+/** The digest covers every operation but not requirement labels, which are display metadata. */
+const digest = (unsigned) => Effect.try({
+	try: () => {
+		const encoded = Schema.encodeSync(Unsigned)(unsigned);
+		return stringify({
+			...encoded,
+			operations: encoded.operations.map((operation) => ({
+				...operation,
+				record: withoutPurpose(operation.record)
+			}))
+		});
+	},
+	catch: () => new DomainKitError({ reason: new CryptoFailed({ operation: "digest" }) })
+}).pipe(Effect.flatMap(sha256Hex), Effect.map(Digest.make));
+const withoutPurpose = (record) => {
+	const { purpose: _purpose, ...rest } = record;
+	return rest;
+};
+/** Additive, fail-closed reconciliation of requirements against what the provider holds. */
+const reconcile = (requirements, existing) => Effect.gen(function* () {
+	const sorted = [...requirements].sort(compare);
+	const projected = [...existing].sort(compare);
+	const operations = [];
+	for (const record of sorted) {
+		const id = yield* operationId(record);
+		const operation = reconcileOne(id, record, projected);
+		operations.push(operation);
+		if (operation._tag === "Create") projected.push(record);
+	}
+	return operations;
+});
+const reconcileOne = (id, record, existing) => {
+	const sameName = existing.filter((candidate) => candidate.name === record.name);
+	const exact = sameName.find((candidate) => equals(candidate, record));
+	if (exact !== void 0) return new Noop({
+		id,
+		record,
+		existing: exact,
+		ttlDrift: exact._tag !== "Opaque" && exact.ttl !== record.ttl
+	});
+	const conflict = (reason, culprits) => new Conflict({
+		id,
+		record,
+		existing: culprits,
+		reason
+	});
+	if (sameName.length > 0 && (record._tag === "CNAME" || sameName.some((candidate) => candidate._tag === "CNAME"))) return conflict("cname-collision", sameName);
+	const sameSet$1 = sameName.filter((candidate) => sameSet(candidate, record));
+	if (sameSet$1.some((candidate) => candidate._tag === "Opaque")) return conflict("opaque", sameSet$1);
+	if (record.policy === "exclusive" && sameSet$1.length > 0) return conflict("exclusive-name", sameSet$1);
+	return new Create({
+		id,
+		record
+	});
+};
+/** Requirements a plan was built from, for re-planning at apply time. */
+const requirements = (plan) => plan.operations.map((operation) => operation.record);
+/** Operation ids hash the encoded requirement without its label, so relabeling never invalidates a plan. */
+function strip(record) {
+	return withoutPurpose(Schema.encodeSync(Model)(record));
+}
+function compare(left, right) {
+	const encode = Schema.encodeSync(Observed);
+	const leftKey = stringify(encode(left));
+	const rightKey = stringify(encode(right));
+	return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+}
+//#endregion
+export { digest, operationId, reconcile, requirements };
+
+//# sourceMappingURL=planner.mjs.map

package/dist/internal/planner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.mjs","names":["Plan.Version","Plan.Kind","Plan.Operation","Errors.DomainKitError","Reason.CryptoFailed","DnsRecord.equals","Plan.Noop","Plan.Conflict","sameSet","DnsRecord.sameSet","Plan.Create","DnsRecord.Model","DnsRecord.Observed"],"sources":["../../src/internal/planner.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport * as DnsRecord from \"../DnsRecord.ts\";\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\nimport * as Plan from \"../Plan.ts\";\nimport { sha256Hex, stringify } from \"./digest.ts\";\n\nconst Unsigned = Schema.Struct({\n  version: Plan.Version,\n  kind: Plan.Kind,\n  domain: Schema.String,\n  zone: Schema.String,\n  provider: Schema.String,\n  attachmentId: Schema.String,\n  operations: Schema.Array(Plan.Operation),\n});\nexport type Unsigned = typeof Unsigned.Type;\n\nexport const operationId = (\n  record: DnsRecord.Model,\n): Effect.Effect<Plan.OperationId, Errors.DomainKitError> =>\n  sha256Hex(stringify({ record: strip(record) })).pipe(Effect.map(Plan.OperationId.make));\n\n/** The digest covers every operation but not requirement labels, which are display metadata. */\nexport const digest = (unsigned: Unsigned): Effect.Effect<Plan.Digest, Errors.DomainKitError> =>\n  Effect.try({\n    try: () => {\n      const encoded = Schema.encodeSync(Unsigned)(unsigned);\n      return stringify({\n        ...encoded,\n        operations: encoded.operations.map((operation) => ({\n          ...operation,\n          record: withoutPurpose(operation.record),\n        })),\n      });\n    },\n    catch: () =>\n      new Errors.DomainKitError({\n        reason: new Reason.CryptoFailed({ operation: \"digest\" }),\n      }),\n  }).pipe(Effect.flatMap(sha256Hex), Effect.map(Plan.Digest.make));\n\nconst withoutPurpose = (record: DnsRecord.Encoded): DnsRecord.Encoded => {\n  const { purpose: _purpose, ...rest } = record;\n  return rest;\n};\n\n/** Additive, fail-closed reconciliation of requirements against what the provider holds. */\nexport const reconcile = (\n  requirements: ReadonlyArray<DnsRecord.Model>,\n  existing: ReadonlyArray<DnsRecord.Observed>,\n): Effect.Effect<ReadonlyArray<Plan.Create | Plan.Noop | Plan.Conflict>, Errors.DomainKitError> =>\n  Effect.gen(function* () {\n    const sorted = [...requirements].sort(compare);\n    const projected: Array<DnsRecord.Observed> = [...existing].sort(compare);\n    const operations: Array<Plan.Create | Plan.Noop | Plan.Conflict> = [];\n    for (const record of sorted) {\n      const id = yield* operationId(record);\n      const operation = reconcileOne(id, record, projected);\n      operations.push(operation);\n      if (operation._tag === \"Create\") projected.push(record);\n    }\n    return operations;\n  });\n\nconst reconcileOne = (\n  id: Plan.OperationId,\n  record: DnsRecord.Model,\n  existing: ReadonlyArray<DnsRecord.Observed>,\n): Plan.Create | Plan.Noop | Plan.Conflict => {\n  const sameName = existing.filter((candidate) => candidate.name === record.name);\n  const exact = sameName.find((candidate) => DnsRecord.equals(candidate, record));\n  if (exact !== undefined) {\n    return new Plan.Noop({\n      id,\n      record,\n      existing: exact,\n      ttlDrift: exact._tag !== \"Opaque\" && exact.ttl !== record.ttl,\n    });\n  }\n  const conflict = (reason: Plan.Conflict[\"reason\"], culprits: ReadonlyArray<DnsRecord.Observed>) =>\n    new Plan.Conflict({ id, record, existing: culprits, reason });\n  if (\n    sameName.length > 0 &&\n    (record._tag === \"CNAME\" || sameName.some((candidate) => candidate._tag === \"CNAME\"))\n  ) {\n    return conflict(\"cname-collision\", sameName);\n  }\n  const sameSet = sameName.filter((candidate) => DnsRecord.sameSet(candidate, record));\n  if (sameSet.some((candidate) => candidate._tag === \"Opaque\")) return conflict(\"opaque\", sameSet);\n  if (record.policy === \"exclusive\" && sameSet.length > 0)\n    return conflict(\"exclusive-name\", sameSet);\n  return new Plan.Create({ id, record });\n};\n\n/** Requirements a plan was built from, for re-planning at apply time. */\nexport const requirements = (plan: Plan.Model): ReadonlyArray<DnsRecord.Model> =>\n  plan.operations.map((operation) => operation.record);\n\n/** Operation ids hash the encoded requirement without its label, so relabeling never invalidates a plan. */\nfunction strip(record: DnsRecord.Model): DnsRecord.Encoded {\n  return withoutPurpose(Schema.encodeSync(DnsRecord.Model)(record));\n}\n\nfunction compare(left: DnsRecord.Observed, right: DnsRecord.Observed): number {\n  const encode = Schema.encodeSync(DnsRecord.Observed);\n  const leftKey = stringify(encode(left));\n  const rightKey = stringify(encode(right));\n  return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;\n}\n"],"mappings":";;;;;;;AAQA,MAAM,WAAW,OAAO,OAAO;CAC7B,SAASA;CACT,MAAMC;CACN,QAAQ,OAAO;CACf,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,cAAc,OAAO;CACrB,YAAY,OAAO,MAAMC,SAAc;AACzC,CAAC;AAGD,MAAa,eACX,WAEA,UAAU,UAAU,EAAE,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAA,YAAqB,IAAI,CAAC;;AAGxF,MAAa,UAAU,aACrB,OAAO,IAAI;CACT,WAAW;EACT,MAAM,UAAU,OAAO,WAAW,QAAQ,CAAC,CAAC,QAAQ;EACpD,OAAO,UAAU;GACf,GAAG;GACH,YAAY,QAAQ,WAAW,KAAK,eAAe;IACjD,GAAG;IACH,QAAQ,eAAe,UAAU,MAAM;GACzC,EAAE;EACJ,CAAC;CACH;CACA,aACE,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,aAAoB,EAAE,WAAW,SAAS,CAAC,EACzD,CAAC;AACL,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,SAAS,GAAG,OAAO,IAAA,OAAgB,IAAI,CAAC;AAEjE,MAAM,kBAAkB,WAAiD;CACvE,MAAM,EAAE,SAAS,UAAU,GAAG,SAAS;CACvC,OAAO;AACT;;AAGA,MAAa,aACX,cACA,aAEA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,OAAO;CAC7C,MAAM,YAAuC,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,OAAO;CACvE,MAAM,aAA6D,CAAC;CACpE,KAAK,MAAM,UAAU,QAAQ;EAC3B,MAAM,KAAK,OAAO,YAAY,MAAM;EACpC,MAAM,YAAY,aAAa,IAAI,QAAQ,SAAS;EACpD,WAAW,KAAK,SAAS;EACzB,IAAI,UAAU,SAAS,UAAU,UAAU,KAAK,MAAM;CACxD;CACA,OAAO;AACT,CAAC;AAEH,MAAM,gBACJ,IACA,QACA,aAC4C;CAC5C,MAAM,WAAW,SAAS,QAAQ,cAAc,UAAU,SAAS,OAAO,IAAI;CAC9E,MAAM,QAAQ,SAAS,MAAM,cAAcC,OAAiB,WAAW,MAAM,CAAC;CAC9E,IAAI,UAAU,KAAA,GACZ,OAAO,IAAIC,KAAU;EACnB;EACA;EACA,UAAU;EACV,UAAU,MAAM,SAAS,YAAY,MAAM,QAAQ,OAAO;CAC5D,CAAC;CAEH,MAAM,YAAY,QAAiC,aACjD,IAAIC,SAAc;EAAE;EAAI;EAAQ,UAAU;EAAU;CAAO,CAAC;CAC9D,IACE,SAAS,SAAS,MACjB,OAAO,SAAS,WAAW,SAAS,MAAM,cAAc,UAAU,SAAS,OAAO,IAEnF,OAAO,SAAS,mBAAmB,QAAQ;CAE7C,MAAMC,YAAU,SAAS,QAAQ,cAAcC,QAAkB,WAAW,MAAM,CAAC;CACnF,IAAID,UAAQ,MAAM,cAAc,UAAU,SAAS,QAAQ,GAAG,OAAO,SAAS,UAAUA,SAAO;CAC/F,IAAI,OAAO,WAAW,eAAeA,UAAQ,SAAS,GACpD,OAAO,SAAS,kBAAkBA,SAAO;CAC3C,OAAO,IAAIE,OAAY;EAAE;EAAI;CAAO,CAAC;AACvC;;AAGA,MAAa,gBAAgB,SAC3B,KAAK,WAAW,KAAK,cAAc,UAAU,MAAM;;AAGrD,SAAS,MAAM,QAA4C;CACzD,OAAO,eAAe,OAAO,WAAWC,KAAe,CAAC,CAAC,MAAM,CAAC;AAClE;AAEA,SAAS,QAAQ,MAA0B,OAAmC;CAC5E,MAAM,SAAS,OAAO,WAAWC,QAAkB;CACnD,MAAM,UAAU,UAAU,OAAO,IAAI,CAAC;CACtC,MAAM,WAAW,UAAU,OAAO,KAAK,CAAC;CACxC,OAAO,UAAU,WAAW,KAAK,UAAU,WAAW,IAAI;AAC5D"}