domainkit 0.8.0 → 0.9.1

package/dist/Testing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Testing.mjs","names":["Storage.layerMemory","Principal.make","Context","DomainName.fromStringUnsafe","Errors.fail","Reason.NotFound","Provider.make","Provider.tokenAuth","Reason.Unauthenticated","DomainName.decode","Provider.resolveAmong","Reason.ProviderUnavailable","DomainName.isWithin","Reason.ProviderRejected","DnsRecord.ns","Resolver.Service","DomainName.fromString","Server.toWebHandler","DomainKit.layerMemory","Server.Identity","Transport.fromFetch","Transport.capabilities","storageCases","providerCases"],"sources":["../src/Testing.ts"],"sourcesContent":["/**\n * domainkit/testing — fakes and conformance runners so hosts test against the seam instead of\n * stubbing global fetch.\n */\nimport { DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as DomainKit from \"./DomainKit.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport { provider as providerCases } from \"./internal/conformance/provider.ts\";\nimport { storage as storageCases } from \"./internal/conformance/storage.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Provider from \"./Provider.ts\";\nimport * as Resolver from \"./Resolver.ts\";\nimport * as Server from \"./Server.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Transport from \"./Transport.ts\";\n\n/** In-memory Storage. Same as `Storage.layerMemory`; re-exported for discoverability. */\nexport const storage: Layer.Layer<Storage.Service> = Storage.layerMemory;\n\nexport const principal: Principal.Interface = Principal.make({\n  ownerId: \"org_test\",\n  actorId: \"user_test\",\n});\n\nexport interface FakeProviderOptions {\n  readonly id?: string;\n  /** Zones the fake credential can reach. Default: `example.com`. */\n  readonly zones?: ReadonlyArray<string>;\n  /** Pre-existing records, to produce `Noop` and `Conflict` operations. */\n  readonly records?: ReadonlyArray<{ readonly zone: string; readonly record: DnsRecord.Observed }>;\n  /** Offer OAuth in addition to tokens; the fake redirects to `callbackUrl` immediately. */\n  readonly oauth?: boolean;\n  /** Fail the write at this zero-based index, to exercise partial receipts. */\n  readonly failWrite?: (index: number) => boolean;\n  /** Nameservers per zone; default `ns1.<zone>`, `ns2.<zone>`. `resolver()` answers NS queries from them. */\n  readonly nameservers?: Readonly<Record<string, ReadonlyArray<string>>>;\n}\n\nexport interface FakeProvider extends Provider.Definition<FakeContext> {\n  readonly records: (zone: string) => ReadonlyArray<DnsRecord.Observed>;\n  /** Every credential the fake issued, oldest first. */\n  readonly issued: () => ReadonlyArray<string>;\n  /** How many credentials were revoked at the fake. */\n  readonly revoked: () => number;\n}\n\ninterface Zone {\n  readonly name: string;\n  readonly nameservers: ReadonlyArray<string>;\n  readonly rows: Array<{ readonly id: string; readonly record: DnsRecord.Observed }>;\n}\n\n/** Every fake zone created in this process, so `resolver()` can answer from them. */\nconst registry = new Set<Zone>();\n\n/** Account context carries `account`; target context carries `zone`. One schema covers both. */\nconst Context = Schema.Struct({\n  account: Schema.optionalKey(Schema.String),\n  zone: Schema.optionalKey(Schema.String),\n});\ntype FakeContext = typeof Context.Type;\nconst TargetContext = Schema.Struct({ zone: Schema.String });\n\n/** A provider definition with a token method (and optional OAuth) over in-memory zones. */\nexport const provider = (options: FakeProviderOptions = {}): FakeProvider => {\n  const id = options.id ?? \"fake\";\n  const zones = new Map<string, Zone>();\n  let nextId = 1;\n  let writes = 0;\n  let revokedCount = 0;\n  const issued: Array<string> = [];\n  for (const name of options.zones ?? [\"example.com\"]) {\n    const normalized = DomainName.fromStringUnsafe(name);\n    const zone: Zone = {\n      name: normalized,\n      nameservers: options.nameservers?.[name] ??\n        options.nameservers?.[normalized] ?? [`ns1.${normalized}`, `ns2.${normalized}`],\n      rows: [],\n    };\n    zones.set(zone.name, zone);\n    registry.add(zone);\n  }\n  for (const { zone: name, record } of options.records ?? []) {\n    const zone = zones.get(DomainName.fromStringUnsafe(name));\n    if (zone === undefined) throw new Error(`Fake provider ${id} has no zone ${name}`);\n    zone.rows.push({ id: `${id}-${nextId++}`, record });\n  }\n\n  const issue = (prefix: string): Provider.IssuedCredential => {\n    const secret = `${prefix}-${issued.length + 1}`;\n    issued.push(secret);\n    return { secret: Redacted.make(secret), context: { account: id }, expiresAt: null };\n  };\n\n  const zoneOf = (target: Provider.Target) =>\n    Effect.suspend(() => {\n      const decoded = Schema.decodeUnknownOption(TargetContext)(target.context);\n      const zone = decoded._tag === \"Some\" ? zones.get(decoded.value.zone) : undefined;\n      return zone === undefined\n        ? Errors.fail(new Reason.NotFound({ entity: \"zone\", id: target.zone }))\n        : Effect.succeed(zone);\n    });\n\n  const targets = () =>\n    [...zones.values()].map((zone): Provider.Target => ({\n      zone: zone.name,\n      context: { zone: zone.name },\n      label: zone.name,\n      nameservers: zone.nameservers,\n    }));\n\n  const oauth: Provider.OAuthAuth = {\n    label: \"Sign in (fake)\",\n    scopes: [\"dns\"],\n    start: (input) =>\n      Effect.succeed({\n        authorizationUrl: `${input.callbackUrl}?${new URLSearchParams({\n          state: input.state,\n          code: \"fake-code\",\n        })}`,\n      }),\n    complete: (input) =>\n      input.code === \"fake-code\"\n        ? Effect.map(DateTime.now, (now) => ({\n            ...issue(\"oauth\"),\n            expiresAt: DateTime.add(now, { hours: 1 }),\n          }))\n        : Errors.fail(new Reason.Unauthenticated({ message: \"fake provider rejected the code\" })),\n    refresh: (credential) =>\n      Redacted.value(credential.secret).startsWith(\"revoked\")\n        ? Errors.fail(new Reason.Unauthenticated({ message: \"fake refresh token was revoked\" }))\n        : Effect.map(DateTime.now, (now) => ({\n            ...issue(\"oauth\"),\n            expiresAt: DateTime.add(now, { hours: 1 }),\n          })),\n    revoke: () => Effect.sync(() => void (revokedCount += 1)),\n  };\n\n  const definition = Provider.make<FakeContext>({\n    id,\n    name: `Fake ${id}`,\n    context: Context,\n    contextVersion: \"fake.v1\",\n    auth: {\n      token: Provider.tokenAuth({\n        label: \"Token (fake)\",\n        requiredCapabilities: [\"dns:read\", \"dns:write\"],\n        fields: Schema.Struct({ token: Schema.RedactedFromValue(Schema.String) }),\n        authenticate: ({ token }) =>\n          Redacted.value(token).length === 0\n            ? Errors.fail(\n                new Reason.Unauthenticated({\n                  message: \"fake provider rejected an empty token\",\n                }),\n              )\n            : Effect.succeed({ secret: token, context: { account: id }, expiresAt: null }),\n      }),\n      ...(options.oauth === true ? { oauth } : {}),\n    },\n    session: () => ({\n      capabilities: () => Effect.succeed([\"dns:read\", \"dns:write\"]),\n      listTargets: () => Effect.succeed(targets()),\n      resolveTarget: (domain) =>\n        Effect.map(DomainName.decode(domain), (name) => Provider.resolveAmong(name, targets())),\n      dns: (target) => ({\n        list: () =>\n          Effect.map(zoneOf(target), (zone) =>\n            zone.rows.map(({ id: providerRecordId, record }) => ({ record, providerRecordId })),\n          ),\n        create: (_zone, record) =>\n          Effect.gen(function* () {\n            const zone = yield* zoneOf(target);\n            const index = writes;\n            writes += 1;\n            if (options.failWrite?.(index) === true) {\n              return yield* Errors.fail(\n                new Reason.ProviderUnavailable({\n                  provider: id,\n                  message: `fake provider failed write ${index}`,\n                }),\n              );\n            }\n            if (!DomainName.isWithin(record.name, zone.name)) {\n              return yield* Errors.fail(\n                new Reason.ProviderRejected({\n                  provider: id,\n                  message: `${record.name} is outside ${zone.name}`,\n                }),\n              );\n            }\n            const providerRecordId = `${id}-${nextId++}`;\n            zone.rows.push({ id: providerRecordId, record });\n            return { providerRecordId };\n          }),\n        get: (_zone, providerRecordId) =>\n          Effect.map(\n            zoneOf(target),\n            (zone) => zone.rows.find((row) => row.id === providerRecordId)?.record ?? null,\n          ),\n        delete: (_zone, providerRecordId) =>\n          Effect.map(zoneOf(target), (zone) => {\n            const index = zone.rows.findIndex((row) => row.id === providerRecordId);\n            if (index >= 0) zone.rows.splice(index, 1);\n          }),\n      }),\n    }),\n  });\n\n  return {\n    ...definition,\n    records: (zone) =>\n      zones.get(DomainName.fromStringUnsafe(zone))?.rows.map(({ record }) => record) ?? [],\n    issued: () => issued,\n    revoked: () => revokedCount,\n  };\n};\n\n/** NS records for every fake zone named `name`, so `resolver()` can answer authority queries. */\nconst fakeNameservers = (name: string): ReadonlyArray<DnsRecord.Observed> =>\n  [...registry]\n    .filter((zone) => zone.name === name)\n    .flatMap((zone) =>\n      zone.nameservers.map((nameserver) => DnsRecord.ns({ name: zone.name, nameserver })),\n    );\n\n/** Records every fake provider currently holds for `name`, across all fake zones. */\nexport const fakeRecords = (name: string): ReadonlyArray<DnsRecord.Observed> =>\n  [...registry]\n    .flatMap((zone) => zone.rows.map(({ record }) => record))\n    .filter((record) => record.name === name);\n\n/**\n * A resolver answering from the fake providers' zones, or from an explicit table. Every answer\n * is attributed to the resolver named `fake`.\n */\nexport const resolver = (\n  answers?: ReadonlyArray<{\n    readonly name: string;\n    readonly records: ReadonlyArray<DnsRecord.Observed>;\n  }>,\n): Layer.Layer<Resolver.Service> =>\n  Layer.succeed(Resolver.Service)({\n    resolve: (name, type) =>\n      Effect.sync(() => {\n        const normalized = DomainName.fromString(name);\n        const lookup = normalized._tag === \"Some\" ? normalized.value : name;\n        const table =\n          answers === undefined\n            ? [...fakeRecords(lookup), ...fakeNameservers(lookup)]\n            : answers.filter((entry) => entry.name === lookup).flatMap((entry) => entry.records);\n        const records = table.filter(\n          (record) => (record._tag === \"Opaque\" ? record.type : record._tag) === type,\n        );\n        return [\n          Resolver.Outcome.Answered({\n            answer: { resolver: \"fake\", records, negative: records.length === 0, ttl: 60 },\n          }),\n        ];\n      }),\n  });\n\nexport interface TransportOptions {\n  /** Which groups the fake server exposes, so a UI can be tested against a partial host. */\n  readonly capabilities?: ReadonlyArray<Transport.Capability>;\n  readonly provider?: FakeProviderOptions;\n}\n\nexport interface RecordedCall {\n  /** `connection.inspect`, `provisioning.approve`, ... */\n  readonly method: string;\n  /** The call's only argument, or the argument list when the method takes more than one. */\n  readonly input: unknown;\n}\n\ntype TransportMethod = (\n  ...args: ReadonlyArray<never>\n) => Effect.Effect<unknown, Errors.DomainKitError>;\n\nexport interface RecordingTransport extends Transport.Interface {\n  readonly calls: ReadonlyArray<RecordedCall>;\n}\n\n/**\n * A transport over an in-memory `domainkit/server` and memory Storage, recording every call. What\n * `@domainkit/react` tests render against, instead of stubbing global `fetch`.\n */\nexport const transport = (options: TransportOptions = {}): RecordingTransport => {\n  const fake = provider(options.provider);\n  // The handler's layer holds memory Storage and a throwaway custody key, so there is nothing to\n  // release; a test that wants the server disposed builds `Server.toWebHandler` itself.\n  const { handler } = Server.toWebHandler(\n    DomainKit.layerMemory({ providers: [fake], resolver: resolver() }).pipe(\n      Layer.merge(Layer.succeed(Server.Identity)({ principal: () => Effect.succeed(principal) })),\n    ),\n  );\n  const live = Transport.fromFetch(\"http://domainkit.test\", {\n    fetch: (input, init) => handler(new Request(input, init)),\n    ...(options.capabilities === undefined ? {} : { capabilities: options.capabilities }),\n  });\n  const calls: Array<RecordedCall> = [];\n  const recorded = Object.fromEntries(\n    Transport.capabilities(live).map((capability) => [\n      capability,\n      Object.fromEntries(\n        Object.entries(live[capability] as unknown as Record<string, TransportMethod>).map(\n          ([name, method]) => [\n            name,\n            (...args: ReadonlyArray<never>) =>\n              Effect.suspend(() => {\n                calls.push({\n                  method: `${capability}.${name}`,\n                  input: args.length > 1 ? args : args[0],\n                });\n                return method(...args);\n              }),\n          ],\n        ),\n      ),\n    ]),\n  ) as Transport.Interface;\n  return { ...recorded, calls };\n};\n\nexport type { Case as ProviderCase } from \"./internal/conformance/provider.ts\";\nexport type { Case as StorageCase } from \"./internal/conformance/storage.ts\";\n\nexport const conformance = {\n  /** Runs every Storage invariant (tenant isolation, leases, exactly-once continuations, revocation recovery). */\n  storage: storageCases,\n  /** Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply against a real provider definition. */\n  provider: providerCases,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,UAAwCA;AAErD,MAAa,YAAiCC,KAAe;CAC3D,SAAS;CACT,SAAS;AACX,CAAC;;AA+BD,MAAM,2BAAW,IAAI,IAAU;;AAG/B,MAAMC,YAAU,OAAO,OAAO;CAC5B,SAAS,OAAO,YAAY,OAAO,MAAM;CACzC,MAAM,OAAO,YAAY,OAAO,MAAM;AACxC,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,CAAC;;AAG3D,MAAa,YAAY,UAA+B,CAAC,MAAoB;CAC3E,MAAM,KAAK,QAAQ,MAAM;CACzB,MAAM,wBAAQ,IAAI,IAAkB;CACpC,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI,eAAe;CACnB,MAAM,SAAwB,CAAC;CAC/B,KAAK,MAAM,QAAQ,QAAQ,SAAS,CAAC,aAAa,GAAG;EACnD,MAAM,aAAaC,iBAA4B,IAAI;EACnD,MAAM,OAAa;GACjB,MAAM;GACN,aAAa,QAAQ,cAAc,SACjC,QAAQ,cAAc,eAAe,CAAC,OAAO,cAAc,OAAO,YAAY;GAChF,MAAM,CAAC;EACT;EACA,MAAM,IAAI,KAAK,MAAM,IAAI;EACzB,SAAS,IAAI,IAAI;CACnB;CACA,KAAK,MAAM,EAAE,MAAM,MAAM,YAAY,QAAQ,WAAW,CAAC,GAAG;EAC1D,MAAM,OAAO,MAAM,IAAIA,iBAA4B,IAAI,CAAC;EACxD,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,MAAM,iBAAiB,GAAG,eAAe,MAAM;EACjF,KAAK,KAAK,KAAK;GAAE,IAAI,GAAG,GAAG,GAAG;GAAY;EAAO,CAAC;CACpD;CAEA,MAAM,SAAS,WAA8C;EAC3D,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,SAAS;EAC5C,OAAO,KAAK,MAAM;EAClB,OAAO;GAAE,QAAQ,SAAS,KAAK,MAAM;GAAG,SAAS,EAAE,SAAS,GAAG;GAAG,WAAW;EAAK;CACpF;CAEA,MAAM,UAAU,WACd,OAAO,cAAc;EACnB,MAAM,UAAU,OAAO,oBAAoB,aAAa,CAAC,CAAC,OAAO,OAAO;EACxE,MAAM,OAAO,QAAQ,SAAS,SAAS,MAAM,IAAI,QAAQ,MAAM,IAAI,IAAI,KAAA;EACvE,OAAO,SAAS,KAAA,IACZC,KAAY,IAAIC,SAAgB;GAAE,QAAQ;GAAQ,IAAI,OAAO;EAAK,CAAC,CAAC,IACpE,OAAO,QAAQ,IAAI;CACzB,CAAC;CAEH,MAAM,gBACJ,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,UAA2B;EAClD,MAAM,KAAK;EACX,SAAS,EAAE,MAAM,KAAK,KAAK;EAC3B,OAAO,KAAK;EACZ,aAAa,KAAK;CACpB,EAAE;CAmGJ,OAAO;EACL,GAvEiBC,OAA2B;GAC5C;GACA,MAAM,QAAQ;GACd,SAASJ;GACT,gBAAgB;GAChB,MAAM;IACJ,OAAOK,UAAmB;KACxB,OAAO;KACP,sBAAsB,CAAC,YAAY,WAAW;KAC9C,QAAQ,OAAO,OAAO,EAAE,OAAO,OAAO,kBAAkB,OAAO,MAAM,EAAE,CAAC;KACxE,eAAe,EAAE,YACf,SAAS,MAAM,KAAK,CAAC,CAAC,WAAW,IAC7BH,KACE,IAAII,gBAAuB,EACzB,SAAS,wCACX,CAAC,CACH,IACA,OAAO,QAAQ;MAAE,QAAQ;MAAO,SAAS,EAAE,SAAS,GAAG;MAAG,WAAW;KAAK,CAAC;IACnF,CAAC;IACD,GAAI,QAAQ,UAAU,OAAO,EAAE,OAAA;KA7CjC,OAAO;KACP,QAAQ,CAAC,KAAK;KACd,QAAQ,UACN,OAAO,QAAQ,EACb,kBAAkB,GAAG,MAAM,YAAY,GAAG,IAAI,gBAAgB;MAC5D,OAAO,MAAM;MACb,MAAM;KACR,CAAC,IACH,CAAC;KACH,WAAW,UACT,MAAM,SAAS,cACX,OAAO,IAAI,SAAS,MAAM,SAAS;MACjC,GAAG,MAAM,OAAO;MAChB,WAAW,SAAS,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;KAC3C,EAAE,IACFJ,KAAY,IAAII,gBAAuB,EAAE,SAAS,kCAAkC,CAAC,CAAC;KAC5F,UAAU,eACR,SAAS,MAAM,WAAW,MAAM,CAAC,CAAC,WAAW,SAAS,IAClDJ,KAAY,IAAII,gBAAuB,EAAE,SAAS,iCAAiC,CAAC,CAAC,IACrF,OAAO,IAAI,SAAS,MAAM,SAAS;MACjC,GAAG,MAAM,OAAO;MAChB,WAAW,SAAS,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;KAC3C,EAAE;KACR,cAAc,OAAO,WAAW,MAAM,gBAAgB,EAAE;IAsBnB,EAAE,IAAI,CAAC;GAC5C;GACA,gBAAgB;IACd,oBAAoB,OAAO,QAAQ,CAAC,YAAY,WAAW,CAAC;IAC5D,mBAAmB,OAAO,QAAQ,QAAQ,CAAC;IAC3C,gBAAgB,WACd,OAAO,IAAIC,OAAkB,MAAM,IAAI,SAASC,aAAsB,MAAM,QAAQ,CAAC,CAAC;IACxF,MAAM,YAAY;KAChB,YACE,OAAO,IAAI,OAAO,MAAM,IAAI,SAC1B,KAAK,KAAK,KAAK,EAAE,IAAI,kBAAkB,cAAc;MAAE;MAAQ;KAAiB,EAAE,CACpF;KACF,SAAS,OAAO,WACd,OAAO,IAAI,aAAa;MACtB,MAAM,OAAO,OAAO,OAAO,MAAM;MACjC,MAAM,QAAQ;MACd,UAAU;MACV,IAAI,QAAQ,YAAY,KAAK,MAAM,MACjC,OAAO,OAAON,KACZ,IAAIO,oBAA2B;OAC7B,UAAU;OACV,SAAS,8BAA8B;MACzC,CAAC,CACH;MAEF,IAAI,CAACC,SAAoB,OAAO,MAAM,KAAK,IAAI,GAC7C,OAAO,OAAOR,KACZ,IAAIS,iBAAwB;OAC1B,UAAU;OACV,SAAS,GAAG,OAAO,KAAK,cAAc,KAAK;MAC7C,CAAC,CACH;MAEF,MAAM,mBAAmB,GAAG,GAAG,GAAG;MAClC,KAAK,KAAK,KAAK;OAAE,IAAI;OAAkB;MAAO,CAAC;MAC/C,OAAO,EAAE,iBAAiB;KAC5B,CAAC;KACH,MAAM,OAAO,qBACX,OAAO,IACL,OAAO,MAAM,IACZ,SAAS,KAAK,KAAK,MAAM,QAAQ,IAAI,OAAO,gBAAgB,CAAC,EAAE,UAAU,IAC5E;KACF,SAAS,OAAO,qBACd,OAAO,IAAI,OAAO,MAAM,IAAI,SAAS;MACnC,MAAM,QAAQ,KAAK,KAAK,WAAW,QAAQ,IAAI,OAAO,gBAAgB;MACtE,IAAI,SAAS,GAAG,KAAK,KAAK,OAAO,OAAO,CAAC;KAC3C,CAAC;IACL;GACF;EACF,CAGc;EACZ,UAAU,SACR,MAAM,IAAIV,iBAA4B,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE,aAAa,MAAM,KAAK,CAAC;EACrF,cAAc;EACd,eAAe;CACjB;AACF;;AAGA,MAAM,mBAAmB,SACvB,CAAC,GAAG,QAAQ,CAAC,CACV,QAAQ,SAAS,KAAK,SAAS,IAAI,CAAC,CACpC,SAAS,SACR,KAAK,YAAY,KAAK,eAAeW,GAAa;CAAE,MAAM,KAAK;CAAM;AAAW,CAAC,CAAC,CACpF;;AAGJ,MAAa,eAAe,SAC1B,CAAC,GAAG,QAAQ,CAAC,CACV,SAAS,SAAS,KAAK,KAAK,KAAK,EAAE,aAAa,MAAM,CAAC,CAAC,CACxD,QAAQ,WAAW,OAAO,SAAS,IAAI;;;;;AAM5C,MAAa,YACX,YAKA,MAAM,QAAQC,OAAgB,CAAC,CAAC,EAC9B,UAAU,MAAM,SACd,OAAO,WAAW;CAChB,MAAM,aAAaC,WAAsB,IAAI;CAC7C,MAAM,SAAS,WAAW,SAAS,SAAS,WAAW,QAAQ;CAK/D,MAAM,WAHJ,YAAY,KAAA,IACR,CAAC,GAAG,YAAY,MAAM,GAAG,GAAG,gBAAgB,MAAM,CAAC,IACnD,QAAQ,QAAQ,UAAU,MAAM,SAAS,MAAM,CAAC,CAAC,SAAS,UAAU,MAAM,OAAO,EAAA,CACjE,QACnB,YAAY,OAAO,SAAS,WAAW,OAAO,OAAO,OAAO,UAAU,IACzE;CACA,OAAO,CAAA,QACY,SAAS,EACxB,QAAQ;EAAE,UAAU;EAAQ;EAAS,UAAU,QAAQ,WAAW;EAAG,KAAK;CAAG,EAC/E,CAAC,CACH;AACF,CAAC,EACL,CAAC;;;;;AA2BH,MAAa,aAAa,UAA4B,CAAC,MAA0B;CAC/E,MAAM,OAAO,SAAS,QAAQ,QAAQ;CAGtC,MAAM,EAAE,YAAYC,aAClBC,cAAsB;EAAE,WAAW,CAAC,IAAI;EAAG,UAAU,SAAS;CAAE,CAAC,CAAC,CAAC,KACjE,MAAM,MAAM,MAAM,QAAQC,QAAe,CAAC,CAAC,EAAE,iBAAiB,OAAO,QAAQ,SAAS,EAAE,CAAC,CAAC,CAC5F,CACF;CACA,MAAM,OAAOC,UAAoB,yBAAyB;EACxD,QAAQ,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,IAAI,CAAC;EACxD,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;CACrF,CAAC;CACD,MAAM,QAA6B,CAAC;CAqBpC,OAAO;EAAE,GApBQ,OAAO,YACtBC,aAAuB,IAAI,CAAC,CAAC,KAAK,eAAe,CAC/C,YACA,OAAO,YACL,OAAO,QAAQ,KAAK,WAAyD,CAAC,CAAC,KAC5E,CAAC,MAAM,YAAY,CAClB,OACC,GAAG,SACF,OAAO,cAAc;GACnB,MAAM,KAAK;IACT,QAAQ,GAAG,WAAW,GAAG;IACzB,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK;GACvC,CAAC;GACD,OAAO,OAAO,GAAG,IAAI;EACvB,CAAC,CACL,CACF,CACF,CACF,CAAC,CAEgB;EAAG;CAAM;AAC9B;AAKA,MAAa,cAAc;;CAEzB,SAASC;;CAET,UAAUC;AACZ"}

package/dist/Transport.mjs

@@ -0,0 +1,187 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Model } from "./Plan.mjs";
+import { ProviderUnavailable } from "./Reason.mjs";
+import { DomainKitError, decode, isDomainKitError } from "./internal/error.mjs";
+import { Model as Model$1 } from "./Approval.mjs";
+import { Model as Model$2 } from "./Receipt.mjs";
+import { classify, headersFrom, requestJson } from "./internal/http.mjs";
+import { ApprovePayload, AttachPayload, Attempt, Discovery, Integration, OAuth, ObservePayload, PlanPayload, Readiness, RejectPayload, Snapshot, StartPayload, Started, Token } from "./Server.mjs";
+import { Effect, Schema } from "effect";
+//#region src/Transport.ts
+/**
+* domainkit/client — the browser-side transport `@domainkit/react` consumes. Capability groups are
+* optional: a host that only exposes connection routes declares just `connection`, and the parts
+* of the UI that plan or clean up do not render.
+*
+*   const transport = Transport.fromFetch("/api/domainkit")
+*
+* Every method decodes the same wire schemas `domainkit/server` encodes, so a failure arrives as
+* the `DomainKit.Error` the lifecycle raised, reason intact.
+*/
+var Transport_exports = /* @__PURE__ */ __exportAll({
+	Method: () => Method,
+	allCapabilities: () => allCapabilities,
+	capabilities: () => capabilities,
+	fromAsync: () => fromAsync,
+	fromFetch: () => fromFetch,
+	toAsync: () => toAsync
+});
+/** How a client asks to connect. Mirrors `Connect.Method`, over the wire. */
+const Method = {
+	/** A lone string for the common one-field provider, or the values its descriptor names. */
+	token: (values) => new Token({ values: typeof values === "string" ? { token: values } : values }),
+	oauth: (options = {}) => new OAuth(options),
+	integration: (options = {}) => new Integration(options)
+};
+const allCapabilities = [
+	"connection",
+	"provisioning",
+	"verification",
+	"cleanup"
+];
+/** Which groups this transport actually carries, in declaration order. */
+const capabilities = (transport) => allCapabilities.filter((capability) => transport[capability] !== void 0);
+/** A transport over `domainkit/server` routes mounted at `baseUrl`. */
+const fromFetch = (baseUrl, options = {}) => {
+	const base = baseUrl.replace(/\/+$/, "");
+	const source = safeOrigin(base);
+	const call = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	const declared = options.capabilities ?? allCapabilities;
+	const request = (input) => Effect.gen(function* () {
+		const headers = yield* headersFrom(options.headers);
+		if (input.body !== void 0) headers.set("content-type", "application/json");
+		const reply = yield* requestJson({
+			fetch: call,
+			provider: source,
+			url: `${base}${input.path}`,
+			init: {
+				method: input.method,
+				headers,
+				...input.body === void 0 ? {} : { body: JSON.stringify(input.body) }
+			}
+		});
+		if (!reply.ok) {
+			const decoded = yield* Effect.result(decode(DomainKitError, reply.body, "response"));
+			return yield* decoded._tag === "Success" ? Effect.fail(decoded.success) : Effect.fail(new DomainKitError({ reason: classify(source, reply.status, reply.headers, `${input.method} ${input.path} answered ${reply.status}`) }));
+		}
+		if (input.success === null) return void 0;
+		return yield* decode(input.success, reply.body, "response");
+	});
+	/** Provisioning and cleanup share these routes; the attempt knows its kind. */
+	const approve = (input) => request({
+		method: "POST",
+		path: `/plans/${encodeURIComponent(input.planId)}/approvals`,
+		body: Schema.encodeSync(ApprovePayload)(input.operationIds === void 0 ? {} : { operationIds: input.operationIds }),
+		success: Model$1
+	});
+	const reject = (input) => request({
+		method: "POST",
+		path: `/plans/${encodeURIComponent(input.planId)}/rejections`,
+		body: Schema.encodeSync(RejectPayload)(input.reason === void 0 ? {} : { reason: input.reason }),
+		success: Attempt
+	});
+	const apply = (approvalId) => request({
+		method: "POST",
+		path: `/approvals/${encodeURIComponent(approvalId)}/apply`,
+		success: Model$2
+	});
+	const groups = {
+		connection: {
+			inspect: (domain) => request({
+				method: "GET",
+				path: `/domains/${encodeURIComponent(domain)}`,
+				success: Snapshot
+			}),
+			discover: (domain) => request({
+				method: "GET",
+				path: `/domains/${encodeURIComponent(domain)}/discovery`,
+				success: Discovery
+			}),
+			start: (input) => request({
+				method: "POST",
+				path: "/connections",
+				body: Schema.encodeSync(StartPayload)(input),
+				success: Started
+			}),
+			attach: (input) => request({
+				method: "POST",
+				path: `/connections/${encodeURIComponent(input.connectionId)}/attachments`,
+				body: Schema.encodeSync(AttachPayload)(input.zone === void 0 ? { domain: input.domain } : {
+					domain: input.domain,
+					zone: input.zone
+				}),
+				success: Started
+			}),
+			detach: (attachmentId) => request({
+				method: "DELETE",
+				path: `/attachments/${encodeURIComponent(attachmentId)}`,
+				success: null
+			}),
+			disconnect: (connectionId) => request({
+				method: "DELETE",
+				path: `/connections/${encodeURIComponent(connectionId)}`,
+				success: null
+			})
+		},
+		provisioning: {
+			plan: (input) => request({
+				method: "POST",
+				path: `/domains/${encodeURIComponent(input.domain)}/plans`,
+				body: Schema.encodeSync(PlanPayload)({ requirements: input.requirements }),
+				success: Model
+			}),
+			approve,
+			reject,
+			apply,
+			attempt: (planId) => request({
+				method: "GET",
+				path: `/plans/${encodeURIComponent(planId)}`,
+				success: Attempt
+			})
+		},
+		verification: { observe: (domain, input) => request({
+			method: "POST",
+			path: `/domains/${encodeURIComponent(domain)}/observations`,
+			body: Schema.encodeSync(ObservePayload)(input?.requirements === void 0 ? {} : { requirements: input.requirements }),
+			success: Readiness
+		}) },
+		cleanup: {
+			plan: (receiptId) => request({
+				method: "POST",
+				path: `/receipts/${encodeURIComponent(receiptId)}/cleanup-plans`,
+				success: Model
+			}),
+			approve,
+			reject,
+			apply
+		}
+	};
+	return Object.fromEntries(allCapabilities.filter((capability) => declared.includes(capability)).map((capability) => [capability, groups[capability]]));
+};
+/** Adapt a Promise-shaped transport; a rejection that is not a `DomainKit.Error` becomes one. */
+const fromAsync = (transport) => mapGroups(transport, (method) => (...args) => Effect.tryPromise({
+	try: () => method(...args),
+	catch: (cause) => isDomainKitError(cause) ? cause : new DomainKitError({ reason: new ProviderUnavailable({
+		provider: "domainkit",
+		message: `The transport rejected: ${String(cause)}`
+	}) })
+}));
+/** Adapt to Promises; every rejection is the `DomainKit.Error` the lifecycle raised. */
+const toAsync = (transport) => mapGroups(transport, (method) => (...args) => Effect.runPromise(method(...args)));
+/** Rebuild every declared group with each method wrapped; the two adapters differ only in `wrap`. */
+const mapGroups = (source, wrap) => Object.fromEntries(allCapabilities.flatMap((capability) => {
+	const group = source[capability];
+	if (group === void 0) return [];
+	return [[capability, Object.fromEntries(Object.entries(group).map(([name, method]) => [name, wrap(method)]))]];
+}));
+const safeOrigin = (base) => {
+	try {
+		return new URL(base).origin;
+	} catch {
+		return base === "" ? "domainkit" : base;
+	}
+};
+//#endregion
+export { Method, Transport_exports, allCapabilities, capabilities, fromAsync, fromFetch, toAsync };
+
+//# sourceMappingURL=Transport.mjs.map

package/dist/Transport.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Transport.mjs","names":["Server.Token","Server.OAuth","Server.Integration","Http.headersFrom","Http.requestJson","Errors.decode","Errors.DomainKitError","Http.classify","Server.ApprovePayload","Approval.Model","Server.RejectPayload","Server.Attempt","Receipt.Model","Server.Snapshot","Server.Discovery","Server.StartPayload","Server.Started","Server.AttachPayload","Server.PlanPayload","Plan.Model","Server.ObservePayload","Server.Readiness","Errors.isDomainKitError","Reason.ProviderUnavailable"],"sources":["../src/Transport.ts"],"sourcesContent":["/**\n * domainkit/client — the browser-side transport `@domainkit/react` consumes. Capability groups are\n * optional: a host that only exposes connection routes declares just `connection`, and the parts\n * of the UI that plan or clean up do not render.\n *\n *   const transport = Transport.fromFetch(\"/api/domainkit\")\n *\n * Every method decodes the same wire schemas `domainkit/server` encodes, so a failure arrives as\n * the `DomainKit.Error` the lifecycle raised, reason intact.\n */\nimport { Effect, Schema } from \"effect\";\n\nimport * as Approval from \"./Approval.ts\";\nimport type * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Http from \"./internal/http.ts\";\nimport * as Plan from \"./Plan.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Receipt from \"./Receipt.ts\";\nimport * as Server from \"./Server.ts\";\n\ntype Fx<A> = Effect.Effect<A, Errors.DomainKitError>;\n\nexport type Snapshot = Server.Snapshot;\nexport type Started = Server.Started;\nexport type Readiness = Server.Readiness;\nexport type Attempt = Server.Attempt;\nexport type Candidate = Server.Candidate;\nexport type Discovery = Server.Discovery;\nexport type Field = Server.Field;\nexport type MethodDescriptor = Server.MethodDescriptor;\nexport type Method = Server.Method;\n\n/** How a client asks to connect. Mirrors `Connect.Method`, over the wire. */\nexport const Method = {\n  /** A lone string for the common one-field provider, or the values its descriptor names. */\n  token: (values: string | Readonly<Record<string, string>>): Method =>\n    new Server.Token({ values: typeof values === \"string\" ? { token: values } : values }),\n  oauth: (options: { readonly returnTo?: string } = {}): Method => new Server.OAuth(options),\n  integration: (options: { readonly returnTo?: string } = {}): Method =>\n    new Server.Integration(options),\n} as const;\n\nexport interface ConnectionGroup {\n  readonly inspect: (domain: string) => Fx<Snapshot>;\n  /** Which of this owner's existing connections already reaches the domain. */\n  readonly discover: (domain: string) => Fx<Discovery>;\n  readonly start: (input: {\n    readonly domain: string;\n    readonly provider: string;\n    readonly method: Method;\n  }) => Fx<Started>;\n  readonly attach: (input: {\n    readonly connectionId: string;\n    readonly domain: string;\n    readonly zone?: string;\n  }) => Fx<Started>;\n  readonly detach: (attachmentId: string) => Fx<void>;\n  readonly disconnect: (connectionId: string) => Fx<void>;\n}\n\nexport interface ProvisioningGroup {\n  readonly plan: (input: {\n    readonly domain: string;\n    readonly requirements: ReadonlyArray<DnsRecord.Model>;\n  }) => Fx<Plan.Model>;\n  readonly approve: (input: {\n    readonly planId: Plan.PlanId;\n    readonly operationIds?: ReadonlyArray<Plan.OperationId>;\n  }) => Fx<Approval.Model>;\n  /** Decline the plan; terminal, and approving it afterwards fails `Stale`. */\n  readonly reject: (input: {\n    readonly planId: Plan.PlanId;\n    readonly reason?: string;\n  }) => Fx<Attempt>;\n  readonly apply: (approvalId: Approval.ApprovalId) => Fx<Receipt.Model>;\n  /** The stored plan with its status, approval, receipt, and rejection. */\n  readonly attempt: (planId: Plan.PlanId) => Fx<Attempt>;\n}\n\nexport interface VerificationGroup {\n  /**\n   * Observe the domain's provisioning receipt, or `options.requirements` when supplied (required\n   * for a domain with no attachment).\n   */\n  readonly observe: (\n    domain: string,\n    options?: { readonly requirements?: ReadonlyArray<DnsRecord.Model> },\n  ) => Fx<Readiness>;\n}\n\nexport interface CleanupGroup {\n  readonly plan: (receiptId: Receipt.ReceiptId) => Fx<Plan.Model>;\n  readonly approve: (input: {\n    readonly planId: Plan.PlanId;\n    readonly operationIds?: ReadonlyArray<Plan.OperationId>;\n  }) => Fx<Approval.Model>;\n  readonly reject: (input: {\n    readonly planId: Plan.PlanId;\n    readonly reason?: string;\n  }) => Fx<Attempt>;\n  readonly apply: (approvalId: Approval.ApprovalId) => Fx<Receipt.Model>;\n}\n\nexport interface Interface {\n  readonly connection?: ConnectionGroup;\n  readonly provisioning?: ProvisioningGroup;\n  readonly verification?: VerificationGroup;\n  readonly cleanup?: CleanupGroup;\n}\n\nexport type Capability = keyof Interface;\n\nexport const allCapabilities: ReadonlyArray<Capability> = [\n  \"connection\",\n  \"provisioning\",\n  \"verification\",\n  \"cleanup\",\n];\n\n/** Which groups this transport actually carries, in declaration order. */\nexport const capabilities = (transport: Interface): ReadonlyArray<Capability> =>\n  allCapabilities.filter((capability) => transport[capability] !== undefined);\n\nexport interface FetchOptions {\n  readonly fetch?: Http.Fetch;\n  readonly headers?: HeadersInit | (() => HeadersInit | Promise<HeadersInit>);\n  /** Which groups the server exposes. Default: all. */\n  readonly capabilities?: ReadonlyArray<Capability>;\n}\n\n// ---------------------------------------------------------------------------------------------\n// fetch\n// ---------------------------------------------------------------------------------------------\n\n/** A transport over `domainkit/server` routes mounted at `baseUrl`. */\nexport const fromFetch = (baseUrl: string, options: FetchOptions = {}): Interface => {\n  const base = baseUrl.replace(/\\/+$/, \"\");\n  const source = safeOrigin(base);\n  // Resolved at call time and invoked as a free function: a browser `fetch` throws \"Illegal\n  // invocation\" when called as a method of anything but `window`, and a host may polyfill later.\n  const call: Http.Fetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));\n  const declared = options.capabilities ?? allCapabilities;\n\n  const request = <A>(input: {\n    readonly method: \"GET\" | \"POST\" | \"DELETE\";\n    readonly path: string;\n    readonly body?: unknown;\n    readonly success: Schema.Codec<A, unknown> | null;\n  }): Fx<A> =>\n    Effect.gen(function* () {\n      const headers = yield* Http.headersFrom(options.headers);\n      if (input.body !== undefined) headers.set(\"content-type\", \"application/json\");\n      const reply = yield* Http.requestJson({\n        fetch: call,\n        provider: source,\n        url: `${base}${input.path}`,\n        init: {\n          method: input.method,\n          headers,\n          ...(input.body === undefined ? {} : { body: JSON.stringify(input.body) }),\n        },\n      });\n      if (!reply.ok) {\n        // The server answers failures with the `DomainKit.Error` value itself. Anything else came\n        // from in front of it: a proxy, a login page, a maintenance window.\n        const decoded = yield* Effect.result(\n          Errors.decode(Errors.DomainKitError, reply.body, \"response\"),\n        );\n        return yield* decoded._tag === \"Success\"\n          ? Effect.fail(decoded.success)\n          : Effect.fail(\n              new Errors.DomainKitError({\n                reason: Http.classify(\n                  source,\n                  reply.status,\n                  reply.headers,\n                  `${input.method} ${input.path} answered ${reply.status}`,\n                ),\n              }),\n            );\n      }\n      if (input.success === null) return undefined as A;\n      return yield* Errors.decode(input.success, reply.body, \"response\");\n    });\n\n  /** Provisioning and cleanup share these routes; the attempt knows its kind. */\n  const approve = (input: {\n    readonly planId: Plan.PlanId;\n    readonly operationIds?: ReadonlyArray<Plan.OperationId>;\n  }) =>\n    request({\n      method: \"POST\",\n      path: `/plans/${encodeURIComponent(input.planId)}/approvals`,\n      body: Schema.encodeSync(Server.ApprovePayload)(\n        input.operationIds === undefined ? {} : { operationIds: input.operationIds },\n      ),\n      success: Approval.Model,\n    });\n\n  const reject = (input: { readonly planId: Plan.PlanId; readonly reason?: string }) =>\n    request({\n      method: \"POST\",\n      path: `/plans/${encodeURIComponent(input.planId)}/rejections`,\n      body: Schema.encodeSync(Server.RejectPayload)(\n        input.reason === undefined ? {} : { reason: input.reason },\n      ),\n      success: Server.Attempt,\n    });\n\n  const apply = (approvalId: Approval.ApprovalId) =>\n    request({\n      method: \"POST\",\n      path: `/approvals/${encodeURIComponent(approvalId)}/apply`,\n      success: Receipt.Model,\n    });\n\n  const connection: ConnectionGroup = {\n    inspect: (domain) =>\n      request({\n        method: \"GET\",\n        path: `/domains/${encodeURIComponent(domain)}`,\n        success: Server.Snapshot,\n      }),\n    discover: (domain) =>\n      request({\n        method: \"GET\",\n        path: `/domains/${encodeURIComponent(domain)}/discovery`,\n        success: Server.Discovery,\n      }),\n    start: (input) =>\n      request({\n        method: \"POST\",\n        path: \"/connections\",\n        body: Schema.encodeSync(Server.StartPayload)(input),\n        success: Server.Started,\n      }),\n    attach: (input) =>\n      request({\n        method: \"POST\",\n        path: `/connections/${encodeURIComponent(input.connectionId)}/attachments`,\n        body: Schema.encodeSync(Server.AttachPayload)(\n          input.zone === undefined\n            ? { domain: input.domain }\n            : { domain: input.domain, zone: input.zone },\n        ),\n        success: Server.Started,\n      }),\n    detach: (attachmentId) =>\n      request({\n        method: \"DELETE\",\n        path: `/attachments/${encodeURIComponent(attachmentId)}`,\n        success: null,\n      }),\n    disconnect: (connectionId) =>\n      request({\n        method: \"DELETE\",\n        path: `/connections/${encodeURIComponent(connectionId)}`,\n        success: null,\n      }),\n  };\n\n  const provisioning: ProvisioningGroup = {\n    plan: (input) =>\n      request({\n        method: \"POST\",\n        path: `/domains/${encodeURIComponent(input.domain)}/plans`,\n        body: Schema.encodeSync(Server.PlanPayload)({ requirements: input.requirements }),\n        success: Plan.Model,\n      }),\n    approve,\n    reject,\n    apply,\n    attempt: (planId) =>\n      request({\n        method: \"GET\",\n        path: `/plans/${encodeURIComponent(planId)}`,\n        success: Server.Attempt,\n      }),\n  };\n\n  const verification: VerificationGroup = {\n    observe: (domain, input) =>\n      request({\n        method: \"POST\",\n        path: `/domains/${encodeURIComponent(domain)}/observations`,\n        body: Schema.encodeSync(Server.ObservePayload)(\n          input?.requirements === undefined ? {} : { requirements: input.requirements },\n        ),\n        success: Server.Readiness,\n      }),\n  };\n\n  const cleanup: CleanupGroup = {\n    plan: (receiptId) =>\n      request({\n        method: \"POST\",\n        path: `/receipts/${encodeURIComponent(receiptId)}/cleanup-plans`,\n        success: Plan.Model,\n      }),\n    approve,\n    reject,\n    apply,\n  };\n\n  const groups = { connection, provisioning, verification, cleanup };\n  return Object.fromEntries(\n    allCapabilities\n      .filter((capability) => declared.includes(capability))\n      .map((capability) => [capability, groups[capability]]),\n  );\n};\n\n// ---------------------------------------------------------------------------------------------\n// Promise adapters\n// ---------------------------------------------------------------------------------------------\n\n/** The same transport in Promises, for hosts and tests that do not run Effect. */\nexport type AsyncTransport = {\n  readonly [K in keyof Interface]?: {\n    readonly [M in keyof NonNullable<Interface[K]>]: NonNullable<Interface[K]>[M] extends (\n      ...args: infer A\n    ) => Effect.Effect<infer R, Errors.DomainKitError>\n      ? (...args: A) => Promise<R>\n      : never;\n  };\n};\n\n/** Adapt a Promise-shaped transport; a rejection that is not a `DomainKit.Error` becomes one. */\nexport const fromAsync = (transport: AsyncTransport): Interface =>\n  mapGroups(\n    transport,\n    (method) =>\n      (...args: ReadonlyArray<never>) =>\n        Effect.tryPromise({\n          try: () => method(...args) as Promise<unknown>,\n          catch: (cause) =>\n            Errors.isDomainKitError(cause)\n              ? cause\n              : new Errors.DomainKitError({\n                  reason: new Reason.ProviderUnavailable({\n                    provider: \"domainkit\",\n                    message: `The transport rejected: ${String(cause)}`,\n                  }),\n                }),\n        }),\n  ) as Interface;\n\n/** Adapt to Promises; every rejection is the `DomainKit.Error` the lifecycle raised. */\nexport const toAsync = (transport: Interface): AsyncTransport =>\n  mapGroups(\n    transport,\n    (method) =>\n      (...args: ReadonlyArray<never>) =>\n        Effect.runPromise(method(...args) as Effect.Effect<unknown, Errors.DomainKitError>),\n  ) as AsyncTransport;\n\ntype AnyMethod = (...args: ReadonlyArray<never>) => unknown;\ntype AnyGroups = { readonly [key: string]: Record<string, AnyMethod> | undefined };\n\n/** Rebuild every declared group with each method wrapped; the two adapters differ only in `wrap`. */\nconst mapGroups = (source: object, wrap: (method: AnyMethod) => AnyMethod): unknown =>\n  Object.fromEntries(\n    allCapabilities.flatMap((capability) => {\n      const group = (source as AnyGroups)[capability];\n      if (group === undefined) return [];\n      return [\n        [\n          capability,\n          Object.fromEntries(Object.entries(group).map(([name, method]) => [name, wrap(method)])),\n        ],\n      ];\n    }),\n  );\n\n// ---------------------------------------------------------------------------------------------\n// Internals\n// ---------------------------------------------------------------------------------------------\n\nconst safeOrigin = (base: string): string => {\n  try {\n    return new URL(base).origin;\n  } catch {\n    return base === \"\" ? \"domainkit\" : base;\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,SAAS;;CAEpB,QAAQ,WACN,IAAIA,MAAa,EAAE,QAAQ,OAAO,WAAW,WAAW,EAAE,OAAO,OAAO,IAAI,OAAO,CAAC;CACtF,QAAQ,UAA0C,CAAC,MAAc,IAAIC,MAAa,OAAO;CACzF,cAAc,UAA0C,CAAC,MACvD,IAAIC,YAAmB,OAAO;AAClC;AAwEA,MAAa,kBAA6C;CACxD;CACA;CACA;CACA;AACF;;AAGA,MAAa,gBAAgB,cAC3B,gBAAgB,QAAQ,eAAe,UAAU,gBAAgB,KAAA,CAAS;;AAc5E,MAAa,aAAa,SAAiB,UAAwB,CAAC,MAAiB;CACnF,MAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;CACvC,MAAM,SAAS,WAAW,IAAI;CAG9B,MAAM,OAAmB,QAAQ,WAAW,OAAO,SAAS,WAAW,MAAM,OAAO,IAAI;CACxF,MAAM,WAAW,QAAQ,gBAAgB;CAEzC,MAAM,WAAc,UAMlB,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAOC,YAAiB,QAAQ,OAAO;EACvD,IAAI,MAAM,SAAS,KAAA,GAAW,QAAQ,IAAI,gBAAgB,kBAAkB;EAC5E,MAAM,QAAQ,OAAOC,YAAiB;GACpC,OAAO;GACP,UAAU;GACV,KAAK,GAAG,OAAO,MAAM;GACrB,MAAM;IACJ,QAAQ,MAAM;IACd;IACA,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE;GACzE;EACF,CAAC;EACD,IAAI,CAAC,MAAM,IAAI;GAGb,MAAM,UAAU,OAAO,OAAO,OAC5BC,OAAcC,gBAAuB,MAAM,MAAM,UAAU,CAC7D;GACA,OAAO,OAAO,QAAQ,SAAS,YAC3B,OAAO,KAAK,QAAQ,OAAO,IAC3B,OAAO,KACL,IAAIA,eAAsB,EACxB,QAAQC,SACN,QACA,MAAM,QACN,MAAM,SACN,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,YAAY,MAAM,QAClD,EACF,CAAC,CACH;EACN;EACA,IAAI,MAAM,YAAY,MAAM,OAAO,KAAA;EACnC,OAAO,OAAOF,OAAc,MAAM,SAAS,MAAM,MAAM,UAAU;CACnE,CAAC;;CAGH,MAAM,WAAW,UAIf,QAAQ;EACN,QAAQ;EACR,MAAM,UAAU,mBAAmB,MAAM,MAAM,EAAE;EACjD,MAAM,OAAO,WAAWG,cAAqB,CAAC,CAC5C,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa,CAC7E;EACA,SAASC;CACX,CAAC;CAEH,MAAM,UAAU,UACd,QAAQ;EACN,QAAQ;EACR,MAAM,UAAU,mBAAmB,MAAM,MAAM,EAAE;EACjD,MAAM,OAAO,WAAWC,aAAoB,CAAC,CAC3C,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO,CAC3D;EACA,SAASC;CACX,CAAC;CAEH,MAAM,SAAS,eACb,QAAQ;EACN,QAAQ;EACR,MAAM,cAAc,mBAAmB,UAAU,EAAE;EACnD,SAASC;CACX,CAAC;CA0FH,MAAM,SAAS;EAAE,YAAA;GAvFf,UAAU,WACR,QAAQ;IACN,QAAQ;IACR,MAAM,YAAY,mBAAmB,MAAM;IAC3C,SAASC;GACX,CAAC;GACH,WAAW,WACT,QAAQ;IACN,QAAQ;IACR,MAAM,YAAY,mBAAmB,MAAM,EAAE;IAC7C,SAASC;GACX,CAAC;GACH,QAAQ,UACN,QAAQ;IACN,QAAQ;IACR,MAAM;IACN,MAAM,OAAO,WAAWC,YAAmB,CAAC,CAAC,KAAK;IAClD,SAASC;GACX,CAAC;GACH,SAAS,UACP,QAAQ;IACN,QAAQ;IACR,MAAM,gBAAgB,mBAAmB,MAAM,YAAY,EAAE;IAC7D,MAAM,OAAO,WAAWC,aAAoB,CAAC,CAC3C,MAAM,SAAS,KAAA,IACX,EAAE,QAAQ,MAAM,OAAO,IACvB;KAAE,QAAQ,MAAM;KAAQ,MAAM,MAAM;IAAK,CAC/C;IACA,SAASD;GACX,CAAC;GACH,SAAS,iBACP,QAAQ;IACN,QAAQ;IACR,MAAM,gBAAgB,mBAAmB,YAAY;IACrD,SAAS;GACX,CAAC;GACH,aAAa,iBACX,QAAQ;IACN,QAAQ;IACR,MAAM,gBAAgB,mBAAmB,YAAY;IACrD,SAAS;GACX,CAAC;EA8CqB;EAAG,cAAA;GA1C3B,OAAO,UACL,QAAQ;IACN,QAAQ;IACR,MAAM,YAAY,mBAAmB,MAAM,MAAM,EAAE;IACnD,MAAM,OAAO,WAAWE,WAAkB,CAAC,CAAC,EAAE,cAAc,MAAM,aAAa,CAAC;IAChF,SAASC;GACX,CAAC;GACH;GACA;GACA;GACA,UAAU,WACR,QAAQ;IACN,QAAQ;IACR,MAAM,UAAU,mBAAmB,MAAM;IACzC,SAASR;GACX,CAAC;EA2BmC;EAAG,cAAA,EAvBzC,UAAU,QAAQ,UAChB,QAAQ;GACN,QAAQ;GACR,MAAM,YAAY,mBAAmB,MAAM,EAAE;GAC7C,MAAM,OAAO,WAAWS,cAAqB,CAAC,CAC5C,OAAO,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa,CAC9E;GACA,SAASC;EACX,CAAC,EAeiD;EAAG,SAAA;GAXvD,OAAO,cACL,QAAQ;IACN,QAAQ;IACR,MAAM,aAAa,mBAAmB,SAAS,EAAE;IACjD,SAASF;GACX,CAAC;GACH;GACA;GACA;EAG6D;CAAE;CACjE,OAAO,OAAO,YACZ,gBACG,QAAQ,eAAe,SAAS,SAAS,UAAU,CAAC,CAAC,CACrD,KAAK,eAAe,CAAC,YAAY,OAAO,WAAW,CAAC,CACzD;AACF;;AAkBA,MAAa,aAAa,cACxB,UACE,YACC,YACE,GAAG,SACF,OAAO,WAAW;CAChB,WAAW,OAAO,GAAG,IAAI;CACzB,QAAQ,UACNG,iBAAwB,KAAK,IACzB,QACA,IAAIhB,eAAsB,EACxB,QAAQ,IAAIiB,oBAA2B;EACrC,UAAU;EACV,SAAS,2BAA2B,OAAO,KAAK;CAClD,CAAC,EACH,CAAC;AACT,CAAC,CACP;;AAGF,MAAa,WAAW,cACtB,UACE,YACC,YACE,GAAG,SACF,OAAO,WAAW,OAAO,GAAG,IAAI,CAAkD,CACxF;;AAMF,MAAM,aAAa,QAAgB,SACjC,OAAO,YACL,gBAAgB,SAAS,eAAe;CACtC,MAAM,QAAS,OAAqB;CACpC,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,OAAO,CACL,CACE,YACA,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CACxF,CACF;AACF,CAAC,CACH;AAMF,MAAM,cAAc,SAAyB;CAC3C,IAAI;EACF,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC;CACvB,QAAQ;EACN,OAAO,SAAS,KAAK,cAAc;CACrC;AACF"}

package/dist/Vercel.mjs

@@ -0,0 +1,116 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { decode } from "./DomainName.mjs";
+import { Unauthenticated } from "./Reason.mjs";
+import { fail } from "./internal/error.mjs";
+import { make, resolveAmong, tokenAuth } from "./Provider.mjs";
+import { resolve } from "./internal/config.mjs";
+import { dns, exchangeCode, teams, user, zones } from "./internal/vercel/client.mjs";
+import { Effect, Redacted, Schema } from "effect";
+//#region src/Vercel.ts
+/** Vercel: personal tokens and marketplace integrations. */
+var Vercel_exports = /* @__PURE__ */ __exportAll({
+	TeamContext: () => TeamContext,
+	TokenFields: () => TokenFields,
+	provider: () => provider
+});
+/** `teamId` is `null` for a personal account; targets carry the team that owns the zone. */
+const TeamContext = Schema.Struct({ teamId: Schema.NullOr(Schema.String) });
+/** Token-method input: the access token, and a team id to scope the connection to one team. */
+const TokenFields = Schema.Struct({
+	token: Schema.RedactedFromValue(Schema.String),
+	teamId: Schema.optionalKey(Schema.String)
+});
+const capabilities = ["dns:read", "dns:write"];
+const provider = (options = {}) => {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
+	const client = (token) => ({
+		token,
+		fetch,
+		baseUrl
+	});
+	const targetOf = (domain, label) => ({
+		zone: domain.name,
+		context: { teamId: domain.teamId },
+		label: `${domain.name} (${label})`,
+		nameservers: domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers
+	});
+	const integration = options.integration === void 0 ? void 0 : integrationAuth(options.integration);
+	function integrationAuth(settings) {
+		return {
+			label: "Install the Vercel integration",
+			start: (input) => {
+				const authorizationUrl = new URL(`https://vercel.com/integrations/${encodeURIComponent(settings.slug)}/new`);
+				authorizationUrl.searchParams.set("source", "external");
+				authorizationUrl.searchParams.set("state", input.state);
+				return Effect.succeed({ authorizationUrl: authorizationUrl.toString() });
+			},
+			complete: (input) => Effect.gen(function* () {
+				const clientId = yield* resolve(settings.clientId, "integration.clientId");
+				const clientSecret = yield* resolve(settings.clientSecret, "integration.clientSecret");
+				const token = yield* exchangeCode({
+					options: client(""),
+					clientId,
+					clientSecret: Redacted.value(clientSecret),
+					code: input.code,
+					callbackUrl: input.callbackUrl
+				});
+				const callbackTeam = input.params.teamId;
+				if (callbackTeam !== void 0 && callbackTeam !== token.team_id) return yield* fail(new Unauthenticated({ message: "Vercel integration callback team does not match the installed team" }));
+				return {
+					secret: Redacted.make(token.access_token),
+					context: { teamId: token.team_id },
+					expiresAt: null
+				};
+			})
+		};
+	}
+	return make({
+		id: "vercel",
+		name: "Vercel",
+		context: TeamContext,
+		contextVersion: "vercel.v1",
+		auth: {
+			token: tokenAuth({
+				label: "Access token",
+				docsUrl: "https://vercel.com/account/settings/tokens",
+				requiredCapabilities: capabilities,
+				fields: TokenFields,
+				authenticate: ({ token, teamId }) => user(client(Redacted.value(token))).pipe(Effect.map(() => ({
+					secret: token,
+					context: { teamId: teamId ?? null },
+					expiresAt: null
+				})))
+			}),
+			...integration === void 0 ? {} : { integration }
+		},
+		session: (credential) => {
+			const clientOptions = client(Redacted.value(credential.secret));
+			const context = Schema.decodeUnknownOption(TeamContext)(credential.context);
+			const teamId = context._tag === "Some" ? context.value.teamId : null;
+			const listTargets = () => teamId !== null ? zones(clientOptions, teamId).pipe(Effect.map((domains) => domains.map((domain) => targetOf(domain, teamId)))) : Effect.gen(function* () {
+				const personal = yield* zones(clientOptions, null);
+				const teams$1 = yield* teams(clientOptions).pipe(Effect.catchIf((error) => error.reason._tag !== "ProviderUnavailable", () => Effect.succeed([])));
+				const perTeam = yield* Effect.forEach(teams$1, (team) => zones(clientOptions, team.id).pipe(Effect.map((domains) => domains.map((domain) => targetOf(domain, team.name ?? team.slug)))));
+				return [...personal.map((domain) => targetOf(domain, "personal")), ...perTeam.flat()];
+			});
+			return {
+				capabilities: () => Effect.succeed(capabilities),
+				listTargets,
+				resolveTarget: (domain) => Effect.gen(function* () {
+					const name = yield* decode(domain);
+					const targets = yield* listTargets();
+					return resolveAmong(name, targets);
+				}),
+				dns: (target) => {
+					const scope = Schema.decodeUnknownOption(TeamContext)(target.context);
+					return dns(clientOptions, scope._tag === "Some" ? scope.value.teamId : teamId);
+				}
+			};
+		}
+	});
+};
+//#endregion
+export { TeamContext, TokenFields, Vercel_exports, provider };
+
+//# sourceMappingURL=Vercel.mjs.map

package/dist/Vercel.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Vercel.mjs","names":["Client.exchangeCode","Errors.fail","Reason.Unauthenticated","Provider.make","Provider.tokenAuth","Client.user","Client.zones","teams","Client.teams","DomainName.decode","Provider.resolveAmong","Client.dns"],"sources":["../src/Vercel.ts"],"sourcesContent":["/** Vercel: personal tokens and marketplace integrations. */\nimport { type Config, Effect, Redacted, Schema } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport { resolve } from \"./internal/config.ts\";\nimport type { Fetch } from \"./internal/http.ts\";\nimport * as Client from \"./internal/vercel/client.ts\";\nimport type * as Protocol from \"./internal/vercel/protocol.ts\";\nimport * as Provider from \"./Provider.ts\";\n\n/** `teamId` is `null` for a personal account; targets carry the team that owns the zone. */\nexport const TeamContext = Schema.Struct({ teamId: Schema.NullOr(Schema.String) });\nexport type TeamContext = typeof TeamContext.Type;\n\n/** Token-method input: the access token, and a team id to scope the connection to one team. */\nexport const TokenFields = Schema.Struct({\n  token: Schema.RedactedFromValue(Schema.String),\n  teamId: Schema.optionalKey(Schema.String),\n});\n\nexport interface Options {\n  /** Omit to offer tokens only. */\n  readonly integration?: {\n    readonly clientId: string | Config.Config<string>;\n    readonly clientSecret: Redacted.Redacted<string> | Config.Config<Redacted.Redacted<string>>;\n    readonly slug: string;\n  };\n  readonly fetch?: Fetch;\n  readonly baseUrl?: string;\n}\n\nconst capabilities = [\"dns:read\", \"dns:write\"] as const;\n\nexport const provider = (options: Options = {}): Provider.Definition<TeamContext> => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n  const client = (token: string): Client.Options => ({ token, fetch, baseUrl });\n\n  const targetOf = (domain: Protocol.Domain, label: string): Provider.Target => ({\n    zone: domain.name,\n    context: { teamId: domain.teamId } satisfies TeamContext,\n    label: `${domain.name} (${label})`,\n    nameservers: domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers,\n  });\n\n  const integration =\n    options.integration === undefined ? undefined : integrationAuth(options.integration);\n\n  function integrationAuth(\n    settings: NonNullable<Options[\"integration\"]>,\n  ): Provider.IntegrationAuth {\n    return {\n      label: \"Install the Vercel integration\",\n      start: (input) => {\n        const authorizationUrl = new URL(\n          `https://vercel.com/integrations/${encodeURIComponent(settings.slug)}/new`,\n        );\n        authorizationUrl.searchParams.set(\"source\", \"external\");\n        authorizationUrl.searchParams.set(\"state\", input.state);\n        return Effect.succeed({ authorizationUrl: authorizationUrl.toString() });\n      },\n      complete: (input) =>\n        Effect.gen(function* () {\n          const clientId = yield* resolve(settings.clientId, \"integration.clientId\");\n          const clientSecret = yield* resolve(settings.clientSecret, \"integration.clientSecret\");\n          const token = yield* Client.exchangeCode({\n            options: client(\"\"),\n            clientId,\n            clientSecret: Redacted.value(clientSecret),\n            code: input.code,\n            callbackUrl: input.callbackUrl,\n          });\n          const callbackTeam = input.params.teamId;\n          if (callbackTeam !== undefined && callbackTeam !== token.team_id) {\n            return yield* Errors.fail(\n              new Reason.Unauthenticated({\n                message: \"Vercel integration callback team does not match the installed team\",\n              }),\n            );\n          }\n          return {\n            secret: Redacted.make(token.access_token),\n            context: { teamId: token.team_id } satisfies TeamContext,\n            expiresAt: null,\n          };\n        }),\n    };\n  }\n\n  return Provider.make<TeamContext>({\n    id: \"vercel\",\n    name: \"Vercel\",\n    context: TeamContext,\n    contextVersion: \"vercel.v1\",\n    auth: {\n      token: Provider.tokenAuth({\n        label: \"Access token\",\n        docsUrl: \"https://vercel.com/account/settings/tokens\",\n        requiredCapabilities: capabilities,\n        fields: TokenFields,\n        authenticate: ({ token, teamId }) =>\n          Client.user(client(Redacted.value(token))).pipe(\n            Effect.map(() => ({\n              secret: token,\n              context: { teamId: teamId ?? null } satisfies TeamContext,\n              expiresAt: null,\n            })),\n          ),\n      }),\n      ...(integration === undefined ? {} : { integration }),\n    },\n    session: (credential) => {\n      const clientOptions = client(Redacted.value(credential.secret));\n      const context = Schema.decodeUnknownOption(TeamContext)(credential.context);\n      const teamId = context._tag === \"Some\" ? context.value.teamId : null;\n      const listTargets = (): Effect.Effect<\n        ReadonlyArray<Provider.Target>,\n        Errors.DomainKitError\n      > =>\n        teamId !== null\n          ? Client.zones(clientOptions, teamId).pipe(\n              Effect.map((domains) => domains.map((domain) => targetOf(domain, teamId))),\n            )\n          : Effect.gen(function* () {\n              const personal = yield* Client.zones(clientOptions, null);\n              const teams = yield* Client.teams(clientOptions).pipe(\n                Effect.catchIf(\n                  (error) => error.reason._tag !== \"ProviderUnavailable\",\n                  () => Effect.succeed([]),\n                ),\n              );\n              const perTeam = yield* Effect.forEach(teams, (team) =>\n                Client.zones(clientOptions, team.id).pipe(\n                  Effect.map((domains) =>\n                    domains.map((domain) => targetOf(domain, team.name ?? team.slug)),\n                  ),\n                ),\n              );\n              return [...personal.map((domain) => targetOf(domain, \"personal\")), ...perTeam.flat()];\n            });\n      return {\n        capabilities: () => Effect.succeed(capabilities),\n        listTargets,\n        resolveTarget: (domain) =>\n          Effect.gen(function* () {\n            const name = yield* DomainName.decode(domain);\n            const targets = yield* listTargets();\n            return Provider.resolveAmong(name, targets);\n          }),\n        dns: (target) => {\n          const scope = Schema.decodeUnknownOption(TeamContext)(target.context);\n          return Client.dns(clientOptions, scope._tag === \"Some\" ? scope.value.teamId : teamId);\n        },\n      };\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAaA,MAAa,cAAc,OAAO,OAAO,EAAE,QAAQ,OAAO,OAAO,OAAO,MAAM,EAAE,CAAC;;AAIjF,MAAa,cAAc,OAAO,OAAO;CACvC,OAAO,OAAO,kBAAkB,OAAO,MAAM;CAC7C,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC;AAaD,MAAM,eAAe,CAAC,YAAY,WAAW;AAE7C,MAAa,YAAY,UAAmB,CAAC,MAAwC;CACnF,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAC/E,MAAM,UAAU,WAAmC;EAAE;EAAO;EAAO;CAAQ;CAE3E,MAAM,YAAY,QAAyB,WAAoC;EAC7E,MAAM,OAAO;EACb,SAAS,EAAE,QAAQ,OAAO,OAAO;EACjC,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM;EAChC,aAAa,OAAO,YAAY,SAAS,IAAI,OAAO,cAAc,OAAO;CAC3E;CAEA,MAAM,cACJ,QAAQ,gBAAgB,KAAA,IAAY,KAAA,IAAY,gBAAgB,QAAQ,WAAW;CAErF,SAAS,gBACP,UAC0B;EAC1B,OAAO;GACL,OAAO;GACP,QAAQ,UAAU;IAChB,MAAM,mBAAmB,IAAI,IAC3B,mCAAmC,mBAAmB,SAAS,IAAI,EAAE,KACvE;IACA,iBAAiB,aAAa,IAAI,UAAU,UAAU;IACtD,iBAAiB,aAAa,IAAI,SAAS,MAAM,KAAK;IACtD,OAAO,OAAO,QAAQ,EAAE,kBAAkB,iBAAiB,SAAS,EAAE,CAAC;GACzE;GACA,WAAW,UACT,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,QAAQ,SAAS,UAAU,sBAAsB;IACzE,MAAM,eAAe,OAAO,QAAQ,SAAS,cAAc,0BAA0B;IACrF,MAAM,QAAQ,OAAOA,aAAoB;KACvC,SAAS,OAAO,EAAE;KAClB;KACA,cAAc,SAAS,MAAM,YAAY;KACzC,MAAM,MAAM;KACZ,aAAa,MAAM;IACrB,CAAC;IACD,MAAM,eAAe,MAAM,OAAO;IAClC,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,SACvD,OAAO,OAAOC,KACZ,IAAIC,gBAAuB,EACzB,SAAS,qEACX,CAAC,CACH;IAEF,OAAO;KACL,QAAQ,SAAS,KAAK,MAAM,YAAY;KACxC,SAAS,EAAE,QAAQ,MAAM,QAAQ;KACjC,WAAW;IACb;GACF,CAAC;EACL;CACF;CAEA,OAAOC,KAA2B;EAChC,IAAI;EACJ,MAAM;EACN,SAAS;EACT,gBAAgB;EAChB,MAAM;GACJ,OAAOC,UAAmB;IACxB,OAAO;IACP,SAAS;IACT,sBAAsB;IACtB,QAAQ;IACR,eAAe,EAAE,OAAO,aACtBC,KAAY,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KACzC,OAAO,WAAW;KAChB,QAAQ;KACR,SAAS,EAAE,QAAQ,UAAU,KAAK;KAClC,WAAW;IACb,EAAE,CACJ;GACJ,CAAC;GACD,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD;EACA,UAAU,eAAe;GACvB,MAAM,gBAAgB,OAAO,SAAS,MAAM,WAAW,MAAM,CAAC;GAC9D,MAAM,UAAU,OAAO,oBAAoB,WAAW,CAAC,CAAC,WAAW,OAAO;GAC1E,MAAM,SAAS,QAAQ,SAAS,SAAS,QAAQ,MAAM,SAAS;GAChE,MAAM,oBAIJ,WAAW,OACPC,MAAa,eAAe,MAAM,CAAC,CAAC,KAClC,OAAO,KAAK,YAAY,QAAQ,KAAK,WAAW,SAAS,QAAQ,MAAM,CAAC,CAAC,CAC3E,IACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAOA,MAAa,eAAe,IAAI;IACxD,MAAMC,UAAQ,OAAOC,MAAa,aAAa,CAAC,CAAC,KAC/C,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,6BAC3B,OAAO,QAAQ,CAAC,CAAC,CACzB,CACF;IACA,MAAM,UAAU,OAAO,OAAO,QAAQD,UAAQ,SAC5CD,MAAa,eAAe,KAAK,EAAE,CAAC,CAAC,KACnC,OAAO,KAAK,YACV,QAAQ,KAAK,WAAW,SAAS,QAAQ,KAAK,QAAQ,KAAK,IAAI,CAAC,CAClE,CACF,CACF;IACA,OAAO,CAAC,GAAG,SAAS,KAAK,WAAW,SAAS,QAAQ,UAAU,CAAC,GAAG,GAAG,QAAQ,KAAK,CAAC;GACtF,CAAC;GACP,OAAO;IACL,oBAAoB,OAAO,QAAQ,YAAY;IAC/C;IACA,gBAAgB,WACd,OAAO,IAAI,aAAa;KACtB,MAAM,OAAO,OAAOG,OAAkB,MAAM;KAC5C,MAAM,UAAU,OAAO,YAAY;KACnC,OAAOC,aAAsB,MAAM,OAAO;IAC5C,CAAC;IACH,MAAM,WAAW;KACf,MAAM,QAAQ,OAAO,oBAAoB,WAAW,CAAC,CAAC,OAAO,OAAO;KACpE,OAAOC,IAAW,eAAe,MAAM,SAAS,SAAS,MAAM,MAAM,SAAS,MAAM;IACtF;GACF;EACF;CACF,CAAC;AACH"}