@alchemy.run/acme 0.0.0 → 2.0.0-beta.85

package/lib/Client.js

@@ -0,0 +1,237 @@
+/**
+ * The ACME issuance flow shared by the `Certificate` resource (deploy time)
+ * and the `IssueCertificate` binding (runtime):
+ *
+ *   order → DNS-01 per authorization (present → propagated → respond →
+ *   poll) → finalize with a fresh key's CSR → download → parse.
+ *
+ * The wire is `@distilled.cloud/acme`; this file only sequences it.
+ */
+import * as Acme from "@distilled.cloud/acme";
+import * as acme from "@distilled.cloud/acme/acme";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { waitForTxt } from "./Dns.js";
+import { ChallengeFailed, ChallengeUnsupported, OrderInvalid, OrderTimeout, PkiError, } from "./Errors.js";
+import { createCsr, csrToBase64Url, fromPem, generateKey, parseCertificate, privateKeyToJwk, splitPemChain, } from "./Pki.js";
+/**
+ * The SDK's `Credentials` (+ a CA-trusting `HttpClient` for private CAs)
+ * for one account. Provide around any `@distilled.cloud/acme` call.
+ */
+export const accountLayer = (credentials) => {
+    const creds = Acme.layer({
+        directoryUrl: credentials.ca.directoryUrl,
+        accountKey: credentials.accountKey,
+        accountUrl: credentials.accountUrl,
+        externalAccountBinding: credentials.externalAccountBinding,
+    });
+    const http = credentials.ca.trustedRoot === undefined
+        ? FetchHttpClient.layer
+        : FetchHttpClient.layer.pipe(Layer.provideMerge(Layer.succeed(FetchHttpClient.RequestInit, {
+            // Bun's fetch honours `tls`; the option is ignored elsewhere.
+            tls: { ca: credentials.ca.trustedRoot },
+        })));
+    return Layer.merge(creds, http);
+};
+const PENDING = new Set(["pending", "processing", "ready"]);
+const challengeFqdn = (identifier) => `_acme-challenge.${identifier.replace(/^\*\./, "")}`;
+const problemsOf = (order, authorizations) => {
+    const problems = [];
+    if (order.error) {
+        problems.push({ type: order.error.type, detail: order.error.detail });
+    }
+    for (const authorization of authorizations) {
+        for (const challenge of authorization.challenges) {
+            if (challenge.error) {
+                problems.push({
+                    identifier: authorization.identifier.value,
+                    type: challenge.error.type,
+                    detail: challenge.error.detail,
+                });
+            }
+        }
+    }
+    return problems;
+};
+/**
+ * Complete one DNS-01 authorization and remove its TXT record on every exit.
+ */
+const solveAuthorization = (authorizationUrl, jwk, solver, propagation) => Effect.gen(function* () {
+    const authorization = yield* acme.getAuthorization({
+        url: authorizationUrl,
+    });
+    if (authorization.status === "valid")
+        return authorization;
+    const identifier = authorization.identifier.value;
+    const challenge = authorization.challenges.find((c) => c.type === "dns-01");
+    if (challenge === undefined || challenge.token === undefined) {
+        return yield* new ChallengeUnsupported({
+            identifier,
+            offered: authorization.challenges.map((c) => c.type),
+        });
+    }
+    const record = {
+        fqdn: challengeFqdn(identifier),
+        value: yield* Acme.Jose.dnsChallengeValue(challenge.token, jwk),
+    };
+    return yield* Effect.acquireUseRelease(solver.present(record), () => Effect.gen(function* () {
+        yield* solver.propagated === undefined
+            ? waitForTxt(record.fqdn, record.value, propagation)
+            : solver.propagated(record, propagation);
+        yield* acme.respondChallenge({ url: challenge.url });
+        const settled = yield* acme.getAuthorization({ url: authorizationUrl }).pipe(Effect.repeat({
+            schedule: Schedule.spaced("2 seconds"),
+            until: (a) => !PENDING.has(a.status),
+            times: 8,
+        }));
+        if (settled.status !== "valid") {
+            const failed = settled.challenges.find((c) => c.type === "dns-01");
+            return yield* new ChallengeFailed({
+                identifier,
+                type: failed?.error?.type,
+                detail: failed?.error?.detail ?? `authorization is ${settled.status}`,
+            });
+        }
+        return settled;
+    }), () => solver.cleanup(record));
+});
+const chooseChain = (downloaded, preferredChain) => Effect.gen(function* () {
+    const matches = (chain) => Effect.gen(function* () {
+        const blocks = splitPemChain(chain);
+        const top = blocks[blocks.length - 1];
+        if (top === undefined)
+            return false;
+        const parsed = yield* parseCertificate(top).pipe(Effect.orElseSucceed(() => undefined));
+        return parsed?.issuer.includes(preferredChain) === true;
+    });
+    if (preferredChain === undefined)
+        return downloaded.chain;
+    if (yield* matches(downloaded.chain))
+        return downloaded.chain;
+    for (const url of downloaded.alternates ?? []) {
+        const alternate = yield* acme.downloadCertificate({ url });
+        if (yield* matches(alternate.chain))
+            return alternate.chain;
+    }
+    return downloaded.chain;
+});
+/**
+ * Issue a certificate for `identifiers` as the current `Credentials`
+ * account. Requires the SDK's `Credentials` and an `HttpClient` (see
+ * {@link accountLayer}) plus whatever the solver needs.
+ */
+export const issueCertificate = (request) => Effect.gen(function* () {
+    const resolve = yield* Acme.Credentials;
+    const config = yield* resolve;
+    const jwk = yield* Acme.Jose.parseJwk(config.accountKey);
+    const propagation = request.propagation ?? {};
+    const order = yield* acme.newOrder({
+        identifiers: request.identifiers.map((value) => ({ type: "dns", value })),
+    });
+    if (order.location === undefined) {
+        return yield* new OrderInvalid({
+            orderUrl: order.finalize,
+            problems: [{ detail: "The CA omitted the order Location header." }],
+        });
+    }
+    const orderUrl = order.location;
+    // Each authorization removes its own TXT record on success or failure.
+    const authorizations = yield* Effect.forEach(order.authorizations, (url) => solveAuthorization(url, jwk, request.solver, propagation), { concurrency: 4 });
+    const ready = yield* acme.getOrder({ url: orderUrl }).pipe(Effect.repeat({
+        schedule: Schedule.spaced("2 seconds"),
+        until: (value) => value.status !== "pending",
+        times: 8,
+    }));
+    if (ready.status === "invalid") {
+        return yield* new OrderInvalid({
+            orderUrl,
+            problems: problemsOf(ready, authorizations),
+        });
+    }
+    if (ready.status !== "ready") {
+        return yield* new OrderTimeout({ orderUrl, status: ready.status });
+    }
+    const key = yield* generateKey(request.keyAlgorithm ?? "ES256");
+    const csr = yield* createCsr({ key, identifiers: request.identifiers });
+    yield* acme.finalizeOrder({ url: order.finalize, csr: csrToBase64Url(csr) }).pipe(Effect.retry({
+        while: (error) => error._tag === "AcmeOrderNotReady",
+        schedule: Schedule.spaced("1 second"),
+        times: 8,
+    }));
+    const settled = yield* acme.getOrder({ url: orderUrl }).pipe(Effect.repeat({
+        schedule: Schedule.spaced("2 seconds"),
+        until: (o) => o.status === "valid" || o.status === "invalid",
+        times: 8,
+    }));
+    if (settled.status === "invalid") {
+        return yield* new OrderInvalid({
+            orderUrl,
+            problems: problemsOf(settled, authorizations),
+        });
+    }
+    if (settled.status !== "valid" || settled.certificate === undefined) {
+        return yield* new OrderTimeout({ orderUrl, status: settled.status });
+    }
+    const downloaded = yield* acme.downloadCertificate({
+        url: settled.certificate,
+    });
+    const chain = yield* chooseChain(downloaded, request.preferredChain);
+    const certificate = splitPemChain(chain)[0] ?? chain;
+    const parsed = yield* parseCertificate(certificate);
+    return toIssued({
+        certificate,
+        chain,
+        privateKey: key.privateKeyPem,
+        identifiers: request.identifiers,
+        certificateUrl: settled.certificate,
+        orderUrl,
+        parsed,
+    });
+});
+const toIssued = (input) => ({
+    certificate: input.certificate,
+    chain: input.chain,
+    privateKey: input.privateKey,
+    identifiers: input.identifiers,
+    serial: input.parsed.serial,
+    notBefore: input.parsed.notBefore.toISOString(),
+    notAfter: input.parsed.notAfter.toISOString(),
+    issuer: input.parsed.issuer,
+    certificateUrl: input.certificateUrl,
+    orderUrl: input.orderUrl,
+});
+const REASON_CODES = {
+    unspecified: 0,
+    keyCompromise: 1,
+    affiliationChanged: 3,
+    superseded: 4,
+    cessationOfOperation: 5,
+};
+/** Revoke a certificate. `AcmeAlreadyRevoked` is folded into success. */
+export const revokeCertificate = (request) => Effect.gen(function* () {
+    const leaf = splitPemChain(request.certificate)[0] ?? request.certificate;
+    const der = yield* Effect.try({
+        try: () => fromPem(leaf),
+        catch: (cause) => new PkiError({ message: "The certificate is not PEM.", cause }),
+    });
+    const revoke = acme
+        .revokeCertificate({
+        certificate: Acme.Jose.base64url(der),
+        reason: request.reason === undefined ? undefined : REASON_CODES[request.reason],
+    })
+        .pipe(Effect.catchTag("AcmeAlreadyRevoked", () => Effect.void));
+    if (request.privateKey === undefined) {
+        return yield* revoke;
+    }
+    // Sign with the certificate key (RFC 8555 §7.6): swap the account key
+    // and drop the account URL so the protocol embeds the JWK.
+    const resolve = yield* Acme.Credentials;
+    const config = yield* resolve;
+    const jwk = yield* privateKeyToJwk(request.privateKey);
+    return yield* revoke.pipe(Effect.provide(Acme.layer({ directoryUrl: config.directoryUrl, accountKey: jwk })));
+});
+//# sourceMappingURL=Client.js.map

package/lib/Client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Client.js","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,IAAI,MAAM,uBAAuB,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,4BAA4B,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAA2B,MAAM,UAAU,CAAC;AAE/D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,QAAQ,GAGT,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,cAAc,EACd,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,aAAa,GAGd,MAAM,UAAU,CAAC;AAclB;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,WAA+B,EACwB,EAAE;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,YAAY;QACzC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;KAC3D,CAAC,CAAC;IACH,MAAM,IAAI,GACR,WAAW,CAAC,EAAE,CAAC,WAAW,KAAK,SAAS;QACtC,CAAC,CAAC,eAAe,CAAC,KAAK;QACvB,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CACxB,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE;YACzC,8DAA8D;YAC9D,GAAG,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE;SACzB,CAAC,CAClB,CACF,CAAC;IACR,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC,CAAC;AAgDF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5D,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAU,EAAE,CACnD,mBAAmB,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AAEvD,MAAM,UAAU,GAAG,CACjB,KAAyB,EACzB,cAAiD,EACjD,EAAE;IACF,MAAM,QAAQ,GAIT,EAAE,CAAC;IACR,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YACjD,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK;oBAC1C,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI;oBAC1B,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG,CACzB,gBAAwB,EACxB,GAAkB,EAClB,MAAoB,EACpB,WAA+B,EAC/B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACjD,GAAG,EAAE,gBAAgB;KACtB,CAAC,CAAC;IACH,IAAI,aAAa,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;YACrC,UAAU;YACV,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAuB;QACjC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC;QAC/B,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC;KAChE,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,GAAG,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACpC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3C,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAC1E,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;YACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;gBAChC,UAAU;gBACV,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI;gBACzB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,oBAAoB,OAAO,CAAC,MAAM,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,EACJ,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAC7B,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAClB,UAAiE,EACjE,cAAkC,EAClC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,OAAO,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAe,CAAC,KAAK,IAAI,CAAC;IAC3D,CAAC,CAAC,CAAC;IACL,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC1D,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAwB,EACoE,EAAE,CAC9F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAEhC,uEAAuE;IACvE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAC1C,KAAK,CAAC,cAAc,EACpB,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAClE,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,MAAM,CAAC;QACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;QAC5C,KAAK,EAAE,CAAC;KACT,CAAC,CACH,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC;YAC7B,QAAQ;YACR,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;QACpD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QACrC,KAAK,EAAE,CAAC;KACT,CAAC,CACH,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,MAAM,CAAC;QACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAC5D,KAAK,EAAE,CAAC;KACT,CAAC,CACH,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC;YAC7B,QAAQ;YACR,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;QACjD,GAAG,EAAE,OAAO,CAAC,WAAW;KACzB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;QACd,WAAW;QACX,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,WAAW;QACnC,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,QAAQ,GAAG,CAAC,KAQjB,EAAqB,EAAE,CAAC,CAAC;IACxB,WAAW,EAAE,KAAK,CAAC,WAAW;IAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;IAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;IAC3B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;IAC/C,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;IAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;IAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;IACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;CACzB,CAAC,CAAC;AAUH,MAAM,YAAY,GAAqC;IACrD,WAAW,EAAE,CAAC;IACd,aAAa,EAAE,CAAC;IAChB,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,CAAC;IACb,oBAAoB,EAAE,CAAC;CACxB,CAAC;AAgBF,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAAsB,EACsD,EAAE,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC;KAClF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI;SAChB,iBAAiB,CAAC;QACjB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;KAChF,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,sEAAsE;IACtE,2DAA2D;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CACnF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/lib/Der.d.ts

@@ -0,0 +1,43 @@
+/**
+ * A minimal DER encoder/decoder — just enough ASN.1 for a PKCS#10
+ * certificate request (encode) and reading a certificate's serial,
+ * validity, issuer and subject alternative names (decode). Pure
+ * TypeScript; no native code, no dependency, works on workerd.
+ *
+ * @internal
+ */
+export declare const concat: (...parts: ReadonlyArray<Uint8Array>) => Uint8Array;
+/** Tag-length-value. */
+export declare const tlv: (tag: number, body: Uint8Array) => Uint8Array;
+export declare const sequence: (...items: ReadonlyArray<Uint8Array>) => Uint8Array<ArrayBufferLike>;
+export declare const set: (...items: ReadonlyArray<Uint8Array>) => Uint8Array<ArrayBufferLike>;
+export declare const octetString: (body: Uint8Array) => Uint8Array<ArrayBufferLike>;
+export declare const bitString: (body: Uint8Array) => Uint8Array<ArrayBufferLike>;
+export declare const nullValue: () => Uint8Array<ArrayBuffer>;
+export declare const ia5String: (text: string) => Uint8Array<ArrayBufferLike>;
+export declare const utf8String: (text: string) => Uint8Array<ArrayBufferLike>;
+/** Context-specific constructed tag `[n]` (implicit or explicit, caller's choice of body). */
+export declare const contextTag: (n: number, body: Uint8Array) => Uint8Array<ArrayBufferLike>;
+/** Context-specific primitive tag `[n]` (e.g. GeneralName dNSName is `[2]`). */
+export declare const contextPrimitive: (n: number, body: Uint8Array) => Uint8Array<ArrayBufferLike>;
+/** INTEGER from a non-negative number or big-endian magnitude bytes. */
+export declare const integer: (value: number | Uint8Array) => Uint8Array;
+/** OBJECT IDENTIFIER from dotted notation. */
+export declare const oid: (dotted: string) => Uint8Array;
+export interface Node {
+    readonly tag: number;
+    /** Offset of the first content byte. */
+    readonly start: number;
+    /** Offset one past the last content byte. */
+    readonly end: number;
+    readonly bytes: Uint8Array;
+}
+export declare const read: (bytes: Uint8Array, offset: number) => Node;
+/** The children of a constructed node, in order. */
+export declare const children: (node: Node) => Node[];
+export declare const content: (node: Node) => Uint8Array;
+export declare const decodeOid: (node: Node) => string;
+/** Parse UTCTime (`YYMMDDHHMMSSZ`) or GeneralizedTime (`YYYYMMDDHHMMSSZ`). */
+export declare const decodeTime: (node: Node) => Date;
+export declare const toHex: (bytes: Uint8Array) => string;
+//# sourceMappingURL=Der.d.ts.map

package/lib/Der.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Der.d.ts","sourceRoot":"","sources":["../src/Der.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,MAAM,aAAc,aAAa,CAAC,UAAU,CAAC,KAAG,UAQ5D,CAAC;AASF,wBAAwB;AACxB,eAAO,MAAM,GAAG,QAAS,MAAM,QAAQ,UAAU,KAAG,UACS,CAAC;AAE9D,eAAO,MAAM,QAAQ,aAAc,aAAa,CAAC,UAAU,CAAC,gCAAgC,CAAC;AAC7F,eAAO,MAAM,GAAG,aAAc,aAAa,CAAC,UAAU,CAAC,gCAAgC,CAAC;AACxF,eAAO,MAAM,WAAW,SAAU,UAAU,gCAAoB,CAAC;AACjE,eAAO,MAAM,SAAS,SAAU,UAAU,gCAA8C,CAAC;AACzF,eAAO,MAAM,SAAS,+BAAkC,CAAC;AACzD,eAAO,MAAM,SAAS,SAAU,MAAM,gCAA8C,CAAC;AACrF,eAAO,MAAM,UAAU,SAAU,MAAM,gCAA8C,CAAC;AACtF,8FAA8F;AAC9F,eAAO,MAAM,UAAU,MAAO,MAAM,QAAQ,UAAU,gCAAwB,CAAC;AAC/E,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,MAAO,MAAM,QAAQ,UAAU,gCAAwB,CAAC;AAErF,wEAAwE;AACxE,eAAO,MAAM,OAAO,UAAW,MAAM,GAAG,UAAU,KAAG,UAgBpD,CAAC;AAEF,8CAA8C;AAC9C,eAAO,MAAM,GAAG,WAAY,MAAM,KAAG,UAapC,CAAC;AAMF,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,eAAO,MAAM,IAAI,UAAW,UAAU,UAAU,MAAM,KAAG,IAUxD,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,QAAQ,SAAU,IAAI,KAAG,IAAI,EASzC,CAAC;AAEF,eAAO,MAAM,OAAO,SAAU,IAAI,KAAG,UAAuD,CAAC;AAE7F,eAAO,MAAM,SAAS,SAAU,IAAI,KAAG,MAkBtC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,UAAU,SAAU,IAAI,KAAG,IAgBvC,CAAC;AAEF,eAAO,MAAM,KAAK,UAAW,UAAU,KAAG,MAC0B,CAAC"}

package/lib/Der.js

@@ -0,0 +1,138 @@
+/**
+ * A minimal DER encoder/decoder — just enough ASN.1 for a PKCS#10
+ * certificate request (encode) and reading a certificate's serial,
+ * validity, issuer and subject alternative names (decode). Pure
+ * TypeScript; no native code, no dependency, works on workerd.
+ *
+ * @internal
+ */
+export const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+};
+const encodeLength = (n) => {
+    if (n < 0x80)
+        return Uint8Array.of(n);
+    if (n < 0x100)
+        return Uint8Array.of(0x81, n);
+    if (n < 0x10000)
+        return Uint8Array.of(0x82, n >>> 8, n & 0xff);
+    return Uint8Array.of(0x83, n >>> 16, (n >>> 8) & 0xff, n & 0xff);
+};
+/** Tag-length-value. */
+export const tlv = (tag, body) => concat(Uint8Array.of(tag), encodeLength(body.length), body);
+export const sequence = (...items) => tlv(0x30, concat(...items));
+export const set = (...items) => tlv(0x31, concat(...items));
+export const octetString = (body) => tlv(0x04, body);
+export const bitString = (body) => tlv(0x03, concat(Uint8Array.of(0), body));
+export const nullValue = () => Uint8Array.of(0x05, 0x00);
+export const ia5String = (text) => tlv(0x16, new TextEncoder().encode(text));
+export const utf8String = (text) => tlv(0x0c, new TextEncoder().encode(text));
+/** Context-specific constructed tag `[n]` (implicit or explicit, caller's choice of body). */
+export const contextTag = (n, body) => tlv(0xa0 | n, body);
+/** Context-specific primitive tag `[n]` (e.g. GeneralName dNSName is `[2]`). */
+export const contextPrimitive = (n, body) => tlv(0x80 | n, body);
+/** INTEGER from a non-negative number or big-endian magnitude bytes. */
+export const integer = (value) => {
+    if (typeof value === "number") {
+        if (value === 0)
+            return tlv(0x02, Uint8Array.of(0));
+        const bytes = [];
+        let n = value;
+        while (n > 0) {
+            bytes.unshift(n & 0xff);
+            n = Math.floor(n / 256);
+        }
+        if (bytes[0] & 0x80)
+            bytes.unshift(0);
+        return tlv(0x02, Uint8Array.from(bytes));
+    }
+    let start = 0;
+    while (start < value.length - 1 && value[start] === 0)
+        start++;
+    const magnitude = value.subarray(start);
+    return tlv(0x02, magnitude[0] & 0x80 ? concat(Uint8Array.of(0), magnitude) : magnitude);
+};
+/** OBJECT IDENTIFIER from dotted notation. */
+export const oid = (dotted) => {
+    const parts = dotted.split(".").map(Number);
+    const bytes = [parts[0] * 40 + parts[1]];
+    for (const part of parts.slice(2)) {
+        const stack = [part & 0x7f];
+        let n = Math.floor(part / 128);
+        while (n > 0) {
+            stack.unshift((n & 0x7f) | 0x80);
+            n = Math.floor(n / 128);
+        }
+        bytes.push(...stack);
+    }
+    return tlv(0x06, Uint8Array.from(bytes));
+};
+export const read = (bytes, offset) => {
+    const tag = bytes[offset];
+    let cursor = offset + 1;
+    let length = bytes[cursor++];
+    if (length & 0x80) {
+        const count = length & 0x7f;
+        length = 0;
+        for (let i = 0; i < count; i++)
+            length = length * 256 + bytes[cursor++];
+    }
+    return { tag, start: cursor, end: cursor + length, bytes };
+};
+/** The children of a constructed node, in order. */
+export const children = (node) => {
+    const out = [];
+    let cursor = node.start;
+    while (cursor < node.end) {
+        const child = read(node.bytes, cursor);
+        out.push(child);
+        cursor = child.end;
+    }
+    return out;
+};
+export const content = (node) => node.bytes.subarray(node.start, node.end);
+export const decodeOid = (node) => {
+    const body = content(node);
+    const first = body[0];
+    const parts = [Math.floor(first / 40), first % 40];
+    let n = 0;
+    for (let i = 1; i < body.length; i++) {
+        n = n * 128 + (body[i] & 0x7f);
+        if ((body[i] & 0x80) === 0) {
+            parts.push(n);
+            n = 0;
+        }
+    }
+    // OIDs under joint-iso-itu-t(2) can have a first arc ≥ 2 with large second arcs.
+    if (first >= 80) {
+        parts[0] = 2;
+        parts[1] = first - 80;
+    }
+    return parts.join(".");
+};
+/** Parse UTCTime (`YYMMDDHHMMSSZ`) or GeneralizedTime (`YYYYMMDDHHMMSSZ`). */
+export const decodeTime = (node) => {
+    const text = new TextDecoder().decode(content(node));
+    const generalized = node.tag === 0x18;
+    const year = generalized
+        ? Number(text.slice(0, 4))
+        : (() => {
+            const yy = Number(text.slice(0, 2));
+            return yy < 50 ? 2000 + yy : 1900 + yy;
+        })();
+    const rest = generalized ? text.slice(4) : text.slice(2);
+    const month = Number(rest.slice(0, 2));
+    const day = Number(rest.slice(2, 4));
+    const hour = Number(rest.slice(4, 6));
+    const minute = Number(rest.slice(6, 8));
+    const second = Number(rest.slice(8, 10)) || 0;
+    return new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+};
+export const toHex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+//# sourceMappingURL=Der.js.map

package/lib/Der.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Der.js","sourceRoot":"","sources":["../src/Der.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAAG,KAAgC,EAAc,EAAE;IACxE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,CAAS,EAAc,EAAE;IAC7C,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,OAAO;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF,wBAAwB;AACxB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAgB,EAAc,EAAE,CAC/D,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAgC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AAC7F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAgC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACtF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,IAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/E,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAE,IAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AAErF,wEAAwE;AACxE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAA0B,EAAc,EAAE;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,KAAK,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI;YAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAc,EAAc,EAAE;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACjC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC;AAeF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAiB,EAAE,MAAc,EAAQ,EAAE;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,GAAG,IAAI,CAAC;QAC5B,MAAM,GAAG,CAAC,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;YAAE,MAAM,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAU,EAAU,EAAE;IAC7C,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IACxB,OAAO,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAU,EAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAU,EAAU,EAAE;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC,GAAG,CAAC,CAAC;QACR,CAAC;IACH,CAAC;IACD,iFAAiF;IACjF,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAU,EAAQ,EAAE;IAC7C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW;QACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAU,EAAE,CACjD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}

package/lib/Dns.d.ts

@@ -0,0 +1,59 @@
+/**
+ * TXT propagation checks.
+ *
+ * Public recursive resolvers are a poor oracle: they cache negative
+ * answers for the zone's SOA minimum (30 minutes is common) and old
+ * record sets past their TTL, so a challenge value published a moment ago
+ * can stay invisible for far longer than the CA takes to validate. Where
+ * `node:dns` is available (deploy time, Fly Machines) the check therefore
+ * asks the zone's **authoritative** nameservers directly — the same
+ * servers the CA asks. Networks can intercept port 53, so DNS over HTTPS
+ * also checks for the exact challenge value. A stale recursive cache must
+ * not veto a positive answer; the CA performs its own validation.
+ */
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import { DnsPropagationTimeout } from "./Errors.ts";
+export interface PropagationOptions {
+    /**
+     * Wait before the first lookup to avoid caching an unpublished record.
+     * Outside the polling budget. Cloudflare defaults to 60 seconds.
+     * @default "0 seconds"
+     */
+    readonly initialDelay?: Duration.Input | undefined;
+    /**
+     * Extra wait after the record is seen (or, for solvers that skip the
+     * check, the whole wait): anycast edges lag the first one that answers.
+     * @default "5 seconds"
+     */
+    readonly delay?: Duration.Input | undefined;
+    /**
+     * DNS-over-HTTPS JSON endpoints to use instead of automatic discovery.
+     * When supplied, every resolver must return the record. Automatic lookup
+     * accepts all discovered nameservers or any default DoH resolver.
+     * @default Cloudflare (1.1.1.1) and Google public DNS
+     */
+    readonly resolvers?: ReadonlyArray<string> | undefined;
+    /** Polling budget. @default "45 seconds" */
+    readonly timeout?: Duration.Input | undefined;
+    /** Polling interval. @default "3 seconds" */
+    readonly interval?: Duration.Input | undefined;
+}
+export declare const DEFAULT_PROPAGATION_DELAY: Duration.Input;
+/** Sleep `options.delay` (default 5 seconds). */
+export declare const propagationDelay: (options?: PropagationOptions) => Effect.Effect<void>;
+export declare const DEFAULT_RESOLVERS: ReadonlyArray<string>;
+/**
+ * TXT values for `fqdn` from one DoH resolver. Any transport or parse
+ * failure reads as "no records yet".
+ */
+export declare const resolveTxt: (resolver: string, fqdn: string) => Effect.Effect<ReadonlyArray<string>, never, HttpClient.HttpClient>;
+/**
+ * Wait `initialDelay`, then poll for the exact challenge value and wait
+ * `delay`. Explicit resolvers must all agree; automatic lookup accepts all
+ * discovered nameservers or a positive default DoH answer. Discovery and
+ * polling share `timeout`; the delays before and after are outside it.
+ */
+export declare const waitForTxt: (fqdn: string, value: string, options?: PropagationOptions) => Effect.Effect<void, DnsPropagationTimeout, HttpClient.HttpClient>;
+//# sourceMappingURL=Dns.d.ts.map

package/lib/Dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Dns.d.ts","sourceRoot":"","sources":["../src/Dns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAGrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACvD,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IAC9C,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;CAChD;AAED,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,KAAmB,CAAC;AAErE,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,aAAa,kBAAkB,KAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC;AA+D3D,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAGnD,CAAC;AAYF;;;GAGG;AACH,eAAO,MAAM,UAAU,aACX,MAAM,QACV,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CAejE,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,UAAU,SACf,MAAM,SACL,MAAM,YACJ,kBAAkB,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,EAAE,UAAU,CAAC,UAAU,CAgE/D,CAAC"}

package/lib/Dns.js

@@ -0,0 +1,104 @@
+/**
+ * TXT propagation checks.
+ *
+ * Public recursive resolvers are a poor oracle: they cache negative
+ * answers for the zone's SOA minimum (30 minutes is common) and old
+ * record sets past their TTL, so a challenge value published a moment ago
+ * can stay invisible for far longer than the CA takes to validate. Where
+ * `node:dns` is available (deploy time, Fly Machines) the check therefore
+ * asks the zone's **authoritative** nameservers directly — the same
+ * servers the CA asks. Networks can intercept port 53, so DNS over HTTPS
+ * also checks for the exact challenge value. A stale recursive cache must
+ * not veto a positive answer; the CA performs its own validation.
+ */
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import * as Schedule from "effect/Schedule";
+import { DnsPropagationTimeout } from "./Errors.js";
+export const DEFAULT_PROPAGATION_DELAY = "5 seconds";
+/** Sleep `options.delay` (default 5 seconds). */
+export const propagationDelay = (options = {}) => Effect.sleep(options.delay ?? DEFAULT_PROPAGATION_DELAY);
+const nodeDns = Effect.tryPromise(() => import("node:dns/promises")).pipe(Effect.map((mod) => typeof mod?.Resolver === "function" && typeof mod.resolveNs === "function" ? mod : undefined), Effect.orElseSucceed(() => undefined));
+/** The zone apex's nameserver IPv4s for `fqdn`, or `[]` when unknown. */
+const authoritativeServers = (dns, fqdn) => Effect.gen(function* () {
+    const labels = fqdn.replace(/\.$/, "").split(".");
+    for (let i = 0; i < labels.length - 1; i++) {
+        const candidate = labels.slice(i).join(".");
+        const names = yield* Effect.tryPromise(() => dns.resolveNs(candidate)).pipe(Effect.orElseSucceed(() => []));
+        if (names.length === 0)
+            continue;
+        const addresses = yield* Effect.forEach(names, (name) => Effect.tryPromise(() => dns.resolve4(name)).pipe(Effect.orElseSucceed(() => [])), { concurrency: "unbounded" });
+        return addresses.flat();
+    }
+    return [];
+});
+/** TXT values requested from one nameserver (port 53 may be intercepted). */
+const resolveTxtAt = (dns, server, fqdn) => Effect.gen(function* () {
+    const resolver = yield* Effect.sync(() => new dns.Resolver());
+    yield* Effect.sync(() => resolver.setServers([server]));
+    const records = yield* Effect.tryPromise(() => resolver.resolveTxt(fqdn));
+    return records.map((chunks) => chunks.join(""));
+}).pipe(Effect.timeout("3 seconds"), Effect.orElseSucceed(() => []));
+export const DEFAULT_RESOLVERS = [
+    "https://cloudflare-dns.com/dns-query",
+    "https://dns.google/resolve",
+];
+const unquote = (data) => (data.match(/"((?:[^"\\]|\\.)*)"/g) ?? [data])
+    .map((part) => part.replace(/^"|"$/g, "").replace(/\\"/g, '"'))
+    .join("");
+/**
+ * TXT values for `fqdn` from one DoH resolver. Any transport or parse
+ * failure reads as "no records yet".
+ */
+export const resolveTxt = (resolver, fqdn) => Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.get(resolver).pipe(HttpClientRequest.setUrlParams({ name: fqdn, type: "TXT" }), HttpClientRequest.setHeader("Accept", "application/dns-json"));
+    const response = yield* client.execute(request);
+    const body = (yield* response.json);
+    return (body.Answer ?? [])
+        .filter((answer) => answer.type === 16 && typeof answer.data === "string")
+        .map((answer) => unquote(answer.data));
+}).pipe(Effect.timeout("3 seconds"), Effect.orElseSucceed(() => []));
+/**
+ * Wait `initialDelay`, then poll for the exact challenge value and wait
+ * `delay`. Explicit resolvers must all agree; automatic lookup accepts all
+ * discovered nameservers or a positive default DoH answer. Discovery and
+ * polling share `timeout`; the delays before and after are outside it.
+ */
+export const waitForTxt = (fqdn, value, options = {}) => Effect.gen(function* () {
+    const interval = options.interval ?? "3 seconds";
+    const timeout = options.timeout ?? "45 seconds";
+    // Bounded by `timeout` below, so poll for the caller's whole budget.
+    const attempts = Math.max(1, Math.ceil(Duration.toMillis(timeout) / Duration.toMillis(interval)));
+    yield* Effect.sleep(options.initialDelay ?? "0 seconds");
+    const propagated = yield* Effect.gen(function* () {
+        // Explicit resolvers must work even when node:dns is available.
+        const dns = options.resolvers === undefined ? yield* nodeDns : undefined;
+        const servers = dns === undefined
+            ? []
+            : yield* authoritativeServers(dns, fqdn).pipe(Effect.timeout("5 seconds"), Effect.orElseSucceed(() => []));
+        const check = Effect.all({
+            direct: Effect.all(dns === undefined
+                ? []
+                : servers.map((server) => resolveTxtAt(dns, server, fqdn).pipe(Effect.map((values) => values.includes(value)))), { concurrency: "unbounded" }),
+            doh: Effect.forEach(options.resolvers ?? DEFAULT_RESOLVERS, (resolver) => resolveTxt(resolver, fqdn).pipe(Effect.map((values) => values.includes(value))), { concurrency: "unbounded" }),
+        }, { concurrency: "unbounded" }).pipe(Effect.map(({ direct, doh }) => options.resolvers !== undefined
+            ? doh.length > 0 && doh.every(Boolean)
+            : (direct.length > 0 && direct.every(Boolean)) || doh.some(Boolean)));
+        return yield* check.pipe(Effect.repeat({
+            schedule: Schedule.spaced(interval),
+            until: (seen) => seen,
+            times: attempts,
+        }));
+    }).pipe(Effect.timeoutOrElse({
+        duration: timeout,
+        orElse: () => Effect.fail(new DnsPropagationTimeout({ fqdn, value })),
+    }));
+    if (!propagated) {
+        return yield* new DnsPropagationTimeout({ fqdn, value });
+    }
+    yield* propagationDelay(options);
+});
+//# sourceMappingURL=Dns.js.map

package/lib/Dns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Dns.js","sourceRoot":"","sources":["../src/Dns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA4BpD,MAAM,CAAC,MAAM,yBAAyB,GAAmB,WAAW,CAAC;AAErE,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,GAAuB,EAAE,EAAuB,EAAE,CACxF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;AAe3D,MAAM,OAAO,GAAuC,MAAM,CAAC,UAAU,CACnE,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAgC,CACjE,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjB,OAAO,GAAG,EAAE,QAAQ,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAC7F,EACD,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CACtC,CAAC;AAEF,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,CAAC,GAAY,EAAE,IAAY,EAAwC,EAAE,CAChG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACzE,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAC3C,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACrC,KAAK,EACL,CAAC,IAAI,EAAE,EAAE,CACP,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAC3C,EACH,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;QACF,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC,CAAC;AAEL,6EAA6E;AAC7E,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,MAAc,EACd,IAAY,EAC0B,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAA2B,CAAC,CACxD,CAAC;AAEJ,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,sCAAsC;IACtC,4BAA4B;CAC7B,CAAC;AAOF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CACvC,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC3C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC9D,IAAI,CAAC,EAAE,CAAC,CAAC;AAEd;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,QAAgB,EAChB,IAAY,EACwD,EAAE,CACtE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClD,iBAAiB,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAC3D,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAA6B,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SACvB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;SACzE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAA2B,CAAC,CACxD,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,IAAY,EACZ,KAAa,EACb,OAAO,GAAuB,EAAE,EACmC,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;IAChD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CACpE,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5C,gEAAgE;QAChE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;YACf,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAA2B,CAAC,CACxD,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CACtB;YACE,MAAM,EAAE,MAAM,CAAC,GAAG,CAChB,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC/C,CACF,EACL,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B;YACD,GAAG,EAAE,MAAM,CAAC,OAAO,CACjB,OAAO,CAAC,SAAS,IAAI,iBAAiB,EACtC,CAAC,QAAQ,EAAE,EAAE,CACX,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EACjF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B;SACF,EACD,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAC7B,OAAO,CAAC,SAAS,KAAK,SAAS;YAC7B,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CACtE,CACF,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CACtB,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YACnC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;YACrB,KAAK,EAAE,QAAQ;SAChB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,aAAa,CAAC;QACnB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;KACtE,CAAC,CACH,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC"}