domainkit 0.0.1 → 0.1.0-beta.0

package/dist/verify-CeMW6XtK.mjs

@@ -0,0 +1,1109 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { D as parse$1, O as Error$1, T as decode$3, _ as equals, b as Service, h as decode$4, m as data, s as Observed, u as Schema$5, w as Schema$4, y as Error$2 } from "./dns-record-Dzo4flM5.mjs";
+import { a as toAsync$2, m as Service$2, n as Service$4, o as Service$1, t as Error$3, u as Service$3 } from "./resolver-D5nVrR10.mjs";
+import { c as Value } from "./client-DvXfJx_E.mjs";
+import { Cause, Clock, Crypto, Effect, Layer, PlatformError, Schema, SchemaIssue, SchemaTransformation } from "effect";
+import * as oauth from "oauth4webapi";
+import { getDomain } from "tldts";
+import * as DnsPacket from "@leichtgewicht/dns-packet";
+//#region package.json
+var version = "0.1.0-beta.0";
+//#endregion
+//#region src/auth/connection.ts
+var connection_exports = /* @__PURE__ */ __exportAll({
+	AuthorizationError: () => AuthorizationError$1,
+	Capability: () => Capability,
+	Grant: () => Grant,
+	Schema: () => Schema$3,
+	assertGrant: () => assertGrant,
+	decode: () => decode$2,
+	encode: () => encode$1,
+	validate: () => validate
+});
+const Capability = Schema.Literals(["dns:read", "dns:write"]);
+const Grant = Schema.TaggedUnion({
+	account: {},
+	domains: { domains: Schema.Array(Schema$4) }
+});
+const Schema$3 = Schema.Struct({
+	accountId: Schema.String,
+	capabilities: Schema.Array(Capability),
+	createdAt: Schema.DateFromString,
+	expiresAt: Schema.NullOr(Schema.DateFromString),
+	grant: Grant,
+	id: Schema.String,
+	kind: Schema.Literals(["oauth2", "token"]),
+	providerId: Schema.String,
+	scopes: Schema.Array(Schema.String),
+	subjectId: Schema.String
+});
+const decode$2 = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$3)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const validate = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$3))(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const encode$1 = Schema.encodeSync(Schema$3);
+var AuthorizationError$1 = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
+function assertGrant(connection, request) {
+	if (connection.providerId !== request.providerId || connection.accountId !== request.accountId) throw new AuthorizationError$1({ message: "Connection does not grant this provider account" });
+	if (connection.expiresAt !== null) {
+		if (Number.isNaN(connection.expiresAt.getTime())) throw new AuthorizationError$1({ message: "Connection expiration is invalid" });
+		if (connection.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw new AuthorizationError$1({ message: "Connection has expired" });
+	}
+	if (!connection.capabilities.includes(request.capability)) throw new AuthorizationError$1({ message: `Connection lacks the ${request.capability} capability` });
+	let domain;
+	try {
+		domain = parse$1(request.domain);
+	} catch (cause) {
+		if (cause instanceof Error$1) throw cause;
+		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+	if (connection.grant._tag === "domains" && !connection.grant.domains.includes(domain)) throw new AuthorizationError$1({ message: "Connection does not grant this domain" });
+	return domain;
+}
+//#endregion
+//#region src/plan/canonical-json.ts
+var canonical_json_exports = /* @__PURE__ */ __exportAll({
+	CryptoError: () => CryptoError,
+	sha256Encoded: () => sha256Encoded,
+	sha256Json: () => sha256Json,
+	sha256Text: () => sha256Text,
+	stringify: () => stringify,
+	webCryptoLayer: () => webCryptoLayer
+});
+var CryptoError = class extends Schema.TaggedError()("CryptoError", { message: Schema.String }) {};
+/** Deterministic JSON serialization for already schema-encoded protocol values. */
+function stringify(value) {
+	if (value === null || typeof value !== "object") {
+		const encoded = JSON.stringify(value);
+		if (encoded === void 0) throw new TypeError("Value is not representable as JSON");
+		return encoded;
+	}
+	if (isJsonArray(value)) return `[${value.map(stringify).join(",")}]`;
+	return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`).join(",")}}`;
+}
+function isJsonArray(value) {
+	return Array.isArray(value);
+}
+const sha256Text = Effect.fn("Digest.sha256Text")(function* (value) {
+	return [...yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+});
+const sha256Json = Effect.fn("Digest.sha256Json")((value) => Effect.try({
+	try: () => stringify(value),
+	catch: (cause) => new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) })
+}).pipe(Effect.flatMap(sha256Text)));
+function sha256EncodedProgram(schema, value) {
+	return Schema.encodeEffect(schema)(value).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)), Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(sha256Json));
+}
+const sha256Encoded = Effect.fn("Digest.sha256Encoded")(sha256EncodedProgram);
+/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
+const webCryptoLayer = Layer.succeed(Crypto.Crypto, Crypto.make({
+	randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),
+	digest: (algorithm, data) => Effect.tryPromise({
+		try: async () => {
+			const bytes = new Uint8Array(data.byteLength);
+			bytes.set(data);
+			return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));
+		},
+		catch: (cause) => PlatformError.systemError({
+			_tag: "Unknown",
+			module: "WebCrypto",
+			method: "digest",
+			cause
+		})
+	})
+}));
+//#endregion
+//#region src/auth/oauth.ts
+var oauth_exports = /* @__PURE__ */ __exportAll({
+	begin: () => begin,
+	complete: () => complete,
+	refresh: () => refresh,
+	revoke: () => revoke
+});
+function beginProgram(input) {
+	return Effect.gen(function* () {
+		const stateStore = yield* Service$1;
+		const cryptoService = yield* Crypto.Crypto;
+		const now = yield* Clock.currentTimeMillis;
+		const state = base64Url(yield* cryptoBytes(cryptoService, 32));
+		const codeVerifier = base64Url(yield* cryptoBytes(cryptoService, 32));
+		const challenge = base64Url(yield* cryptoService.digest("SHA-256", new TextEncoder().encode(codeVerifier)).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message }))));
+		const stateHash = yield* sha256Text(state);
+		const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);
+		authorizationUrl.search = new URLSearchParams({
+			client_id: input.client.clientId,
+			code_challenge: challenge,
+			code_challenge_method: "S256",
+			redirect_uri: input.redirectUri,
+			response_type: "code",
+			scope: input.method.scopes.join(" "),
+			state
+		}).toString();
+		yield* stateStore.put({
+			clientId: input.client.clientId,
+			codeVerifier: Value.from(codeVerifier),
+			expiresAt: new Date(now + (input.ttlMs ?? 6e5)),
+			grant: input.grant,
+			method: input.method,
+			redirectUri: input.redirectUri,
+			stateHash,
+			subjectId: input.subjectId
+		});
+		return { authorizationUrl };
+	});
+}
+function completeProgram(input) {
+	return Effect.gen(function* () {
+		const stateStore = yield* Service$1;
+		const connectionStore = yield* Service$2;
+		const credentialStore = yield* Service$3;
+		const cryptoService = yield* Crypto.Crypto;
+		const state = input.callbackUrl.searchParams.get("state");
+		if (state === null) return yield* new AuthorizationError$1({ message: "OAuth callback is missing state" });
+		const now = yield* Clock.currentTimeMillis;
+		const continuation = yield* stateStore.consume(yield* sha256Text(state), new Date(now));
+		if (continuation === null) return yield* new AuthorizationError$1({ message: "OAuth continuation is expired, unknown, or already used" });
+		if (continuation.clientId !== input.client.clientId) return yield* new AuthorizationError$1({ message: "OAuth client does not match the continuation" });
+		const as = continuation.method.authorizationServer;
+		const client = { client_id: continuation.clientId };
+		const authentication = yield* effectClientAuthentication(continuation.method, input.client);
+		const tokens = yield* providerRequest(input.providerId, async (signal) => {
+			const callbackParameters = oauth.validateAuthResponse(as, client, input.callbackUrl, state);
+			const response = await oauth.authorizationCodeGrantRequest(as, client, authentication, callbackParameters, continuation.redirectUri, continuation.codeVerifier.expose(), requestOptions(input.fetch, signal));
+			return oauth.processAuthorizationCodeResponse(as, client, response);
+		});
+		const accessToken = Value.from(tokens.access_token);
+		const subject = yield* input.resolveSubject(tokens, accessToken);
+		const id = yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));
+		const connection = yield* validate({
+			accountId: subject.accountId,
+			capabilities: [...continuation.method.capabilities],
+			createdAt: new Date(now),
+			expiresAt: subject.expiresAt,
+			grant: continuation.grant,
+			id,
+			kind: "oauth2",
+			providerId: input.providerId,
+			scopes: (tokens.scope ?? continuation.method.scopes.join(" ")).split(" ").filter(Boolean),
+			subjectId: continuation.subjectId
+		});
+		yield* credentialStore.put(connection.id, {
+			accessToken,
+			refreshToken: tokens.refresh_token === void 0 ? null : Value.from(tokens.refresh_token),
+			tokenType: tokens.token_type
+		});
+		yield* connectionStore.put(connection);
+		return connection;
+	});
+}
+function refreshProgram(input) {
+	return Effect.gen(function* () {
+		const credentialStore = yield* Service$3;
+		const credential = yield* requireCredential(input.connection.id, credentialStore);
+		const refreshToken = credential.refreshToken;
+		if (refreshToken === null) return yield* new AuthorizationError$1({ message: "Connection has no refresh token" });
+		const as = input.method.authorizationServer;
+		const client = { client_id: input.client.clientId };
+		const authentication = yield* effectClientAuthentication(input.method, input.client);
+		const tokens = yield* providerRequest(input.connection.providerId, async (signal) => {
+			const response = await oauth.refreshTokenGrantRequest(as, client, authentication, refreshToken.expose(), requestOptions(input.fetch, signal));
+			return oauth.processRefreshTokenResponse(as, client, response);
+		});
+		yield* credentialStore.put(input.connection.id, {
+			accessToken: Value.from(tokens.access_token),
+			refreshToken: tokens.refresh_token === void 0 ? credential.refreshToken : Value.from(tokens.refresh_token),
+			tokenType: tokens.token_type
+		});
+	});
+}
+function revokeProgram(input) {
+	return Effect.gen(function* () {
+		if (input.method.authorizationServer.revocation_endpoint === void 0) return yield* new AuthorizationError$1({ message: "Provider does not advertise token revocation" });
+		const credentialStore = yield* Service$3;
+		const credential = yield* requireCredential(input.connection.id, credentialStore);
+		const as = input.method.authorizationServer;
+		const authentication = yield* effectClientAuthentication(input.method, input.client);
+		yield* providerRequest(input.connection.providerId, async (signal) => {
+			const response = await oauth.revocationRequest(as, { client_id: input.client.clientId }, authentication, credential.accessToken.expose(), requestOptions(input.fetch, signal));
+			await oauth.processRevocationResponse(response);
+		});
+		yield* credentialStore.delete(input.connection.id);
+	});
+}
+function effectClientAuthentication(method, client) {
+	return Effect.try({
+		try: () => clientAuthentication(method, client),
+		catch: (cause) => cause instanceof Error$1 ? cause : new Error$1({ message: "OAuth client authentication is invalid" })
+	});
+}
+function clientAuthentication(method, client) {
+	switch (method.clientAuth) {
+		case "none": return oauth.None();
+		case "client_secret_basic":
+			if (client.clientSecret === void 0) throw new Error$1({ message: "Client secret is required" });
+			return oauth.ClientSecretBasic(client.clientSecret.expose());
+		case "client_secret_post":
+			if (client.clientSecret === void 0) throw new Error$1({ message: "Client secret is required" });
+			return oauth.ClientSecretPost(client.clientSecret.expose());
+	}
+}
+function requestOptions(fetchImplementation, signal) {
+	return fetchImplementation === void 0 ? { signal } : {
+		signal,
+		[oauth.customFetch]: (url, options) => fetchImplementation(url, {
+			...options,
+			body: options.body
+		})
+	};
+}
+function requireCredential(connectionId, store) {
+	return store.get(connectionId).pipe(Effect.flatMap((credential) => credential === null ? Effect.fail(new AuthorizationError$1({ message: "Connection credentials are unavailable" })) : Effect.succeed(credential)));
+}
+function providerRequest(providerId, request) {
+	return Effect.tryPromise({
+		try: request,
+		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$1 ? cause : new Error$2({
+			cause,
+			message: safeOAuthMessage(cause),
+			operation: "oauthRequest",
+			providerId
+		})
+	});
+}
+function cryptoBytes(cryptoService, size) {
+	return cryptoService.randomBytes(size).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));
+}
+function base64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function safeOAuthMessage(cause) {
+	return cause instanceof Error ? cause.name : "OAuth provider request failed";
+}
+const begin = Effect.fn("OAuth.begin")(beginProgram);
+const complete = Effect.fn("OAuth.complete")(completeProgram);
+const refresh = Effect.fn("OAuth.refresh")(refreshProgram);
+const revoke = Effect.fn("OAuth.revoke")(revokeProgram);
+//#endregion
+//#region src/auth/manifest.ts
+var manifest_exports = /* @__PURE__ */ __exportAll({
+	Method: () => Method,
+	Schema: () => Schema$2,
+	decode: () => decode$1
+});
+const Method = Schema.TaggedUnion({
+	integration: {
+		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
+		installUrl: Schema.String,
+		tokenEndpoint: Schema.String
+	},
+	oauth2: {
+		authorizationServer: Schema.Struct({
+			authorization_endpoint: Schema.String,
+			issuer: Schema.String,
+			revocation_endpoint: Schema.optionalKey(Schema.String),
+			token_endpoint: Schema.String
+		}),
+		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
+		clientAuth: Schema.Literals([
+			"none",
+			"client_secret_basic",
+			"client_secret_post"
+		]),
+		scopes: Schema.Array(Schema.String)
+	},
+	token: {
+		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
+		instructionsUrl: Schema.String
+	}
+});
+const Schema$2 = Schema.Struct({
+	methods: Schema.Array(Method),
+	providerId: Schema.String
+});
+const decode$1 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+//#endregion
+//#region src/auth/token.ts
+var token_exports = /* @__PURE__ */ __exportAll({ connect: () => connect });
+const connect = Effect.fn("TokenConnection.connect")(function* (input) {
+	const connectionStore = yield* Service$2;
+	const credentialStore = yield* Service$3;
+	const cryptoService = yield* Crypto.Crypto;
+	const validation = yield* input.validate(input.token);
+	const createdAt = new Date(yield* Clock.currentTimeMillis);
+	const id = yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));
+	const connection = yield* validate({
+		accountId: validation.accountId,
+		capabilities: [...validation.capabilities],
+		createdAt,
+		expiresAt: validation.expiresAt,
+		grant: input.grant,
+		id,
+		kind: "token",
+		providerId: input.providerId,
+		scopes: [...validation.scopes],
+		subjectId: input.subjectId
+	});
+	yield* credentialStore.put(connection.id, {
+		accessToken: input.token,
+		refreshToken: null,
+		tokenType: "bearer"
+	});
+	yield* connectionStore.put(connection);
+	return connection;
+});
+//#endregion
+//#region src/discovery/zones.ts
+var zones_exports = /* @__PURE__ */ __exportAll({ candidates: () => candidates });
+function candidates(input) {
+	const domain = parse$1(input);
+	const registrable = getDomain(domain, { allowPrivateDomains: true });
+	if (registrable === null) throw new Error$1({ message: "Domain does not have a registrable DNS zone" });
+	const labels = domain.split(".");
+	const registrableLabels = registrable.split(".").length;
+	const values = [];
+	for (let index = 0; index <= labels.length - registrableLabels; index += 1) values.push(parse$1(labels.slice(index).join(".")));
+	return values;
+}
+//#endregion
+//#region src/discovery/selection.ts
+var selection_exports = /* @__PURE__ */ __exportAll({
+	Evidence: () => Evidence,
+	Selection: () => Selection,
+	select: () => select
+});
+const Evidence = Schema.Struct({
+	accountId: Schema.String,
+	connectionId: Schema.String,
+	decisiveNameserverMatch: Schema.Boolean,
+	matchedNameservers: Schema.Array(Schema$4),
+	providerId: Schema.String,
+	zone: Schema$4
+});
+const Selection = Schema.TaggedUnion({
+	selected: {
+		candidate: Evidence,
+		evidence: Schema.Array(Evidence),
+		reason: Schema.Literals(["explicit", "unique-nameserver-match"])
+	},
+	manual: {
+		evidence: Schema.Array(Evidence),
+		reason: Schema.Literals(["ambiguous", "unsupported"])
+	}
+});
+function select(input) {
+	const domain = parse$1(input.domain);
+	const zoneCandidates = new Set(candidates(domain));
+	const authoritative = nameserverSet(input.authoritativeNameservers);
+	const eligible = input.connectedZones.filter((connected) => {
+		if (!zoneCandidates.has(parse$1(connected.zone))) return false;
+		try {
+			assertGrant(connected.connection, {
+				accountId: connected.accountId,
+				capability: "dns:read",
+				domain,
+				...input.now === void 0 ? {} : { now: input.now },
+				providerId: connected.providerId
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	});
+	const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));
+	if (input.explicit !== void 0) {
+		const explicitZone = parse$1(input.explicit.zone);
+		const index = eligible.findIndex((connected) => connected.providerId === input.explicit?.providerId && connected.accountId === input.explicit.accountId && parse$1(connected.zone) === explicitZone);
+		if (index < 0) throw new AuthorizationError$1({ message: "Explicit provider zone is not connected or granted" });
+		const candidate = evidence[index];
+		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
+		return {
+			_tag: "selected",
+			candidate,
+			evidence,
+			reason: "explicit"
+		};
+	}
+	const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);
+	const candidate = decisive[0];
+	return decisive.length === 1 && candidate !== void 0 ? {
+		_tag: "selected",
+		candidate,
+		evidence,
+		reason: "unique-nameserver-match"
+	} : {
+		_tag: "manual",
+		evidence,
+		reason: decisive.length > 1 ? "ambiguous" : "unsupported"
+	};
+}
+function evidenceFor(connected, authoritative) {
+	const configured = new Set(nameserverSet(connected.nameservers));
+	const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));
+	return {
+		accountId: connected.accountId,
+		connectionId: connected.connection.id,
+		decisiveNameserverMatch: authoritative.length > 0 && matchedNameservers.length === authoritative.length,
+		matchedNameservers,
+		providerId: connected.providerId,
+		zone: parse$1(connected.zone)
+	};
+}
+function nameserverSet(nameservers) {
+	return [...new Set(nameservers.map(parse$1))].sort();
+}
+//#endregion
+//#region src/plan/types.ts
+var types_exports = /* @__PURE__ */ __exportAll({
+	Authorization: () => Authorization,
+	Operation: () => Operation,
+	Receipt: () => Receipt,
+	Schema: () => Schema$1,
+	decode: () => decode,
+	decodeReceipt: () => decodeReceipt,
+	encode: () => encode,
+	encodeReceipt: () => encodeReceipt
+});
+const Operation = Schema.TaggedUnion({
+	create: {
+		id: Schema.String,
+		requirement: Schema$5
+	},
+	noop: {
+		id: Schema.String,
+		requirement: Schema$5,
+		ttlDrift: Schema.Boolean
+	},
+	conflict: {
+		existing: Schema.Array(Observed),
+		id: Schema.String,
+		reason: Schema.String,
+		requirement: Schema$5
+	}
+});
+const Schema$1 = Schema.Struct({
+	digest: Schema.String,
+	operations: Schema.Array(Operation),
+	providerId: Schema.String,
+	version: Schema.Literal("domainkit.dns-plan.v1"),
+	zone: Schema$4
+});
+const Authorization = Schema.Struct({
+	allowPartial: Schema.Boolean,
+	operationIds: Schema.Array(Schema.String),
+	planDigest: Schema.String,
+	version: Schema.Literal("domainkit.plan-authorization.v1")
+});
+const Receipt = Schema.Struct({
+	appliedAt: Schema.DateFromString,
+	operations: Schema.Array(Schema.Struct({
+		operationId: Schema.String,
+		providerRecordId: Schema.NullOr(Schema.String)
+	})),
+	planDigest: Schema.String,
+	providerId: Schema.String,
+	status: Schema.Literals(["complete", "partial"]),
+	version: Schema.Literal("domainkit.apply-receipt.v1"),
+	zone: Schema$4
+});
+const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const encode = Schema.encodeSync(Schema$1);
+const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const encodeReceipt = Schema.encodeSync(Receipt);
+//#endregion
+//#region src/plan/plan.ts
+var plan_exports = /* @__PURE__ */ __exportAll({
+	AuthorizationError: () => AuthorizationError,
+	ConflictError: () => ConflictError,
+	PartialApplyError: () => PartialApplyError,
+	StaleError: () => StaleError,
+	apply: () => apply,
+	authorize: () => authorize$1,
+	create: () => create,
+	renderManualInstructions: () => renderManualInstructions
+});
+const UnsignedPlan = Schema.Struct({
+	operations: Schema.Array(Operation),
+	providerId: Schema.String,
+	version: Schema.Literal("domainkit.dns-plan.v1"),
+	zone: Schema$4
+});
+const RequirementDigest = Schema.Struct({ requirement: Schema$5 });
+var ConflictError = class extends Schema.TaggedError()("PlanConflictError", { operationIds: Schema.Array(Schema.String) }) {};
+var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
+var StaleError = class extends Schema.TaggedError()("StalePlanError", {
+	approvedPlanDigest: Schema.String,
+	currentPlanDigest: Schema.String
+}) {};
+var PartialApplyError = class extends Schema.TaggedError()("PartialApplyError", {
+	causeTag: Schema.Literals([
+		"CryptoError",
+		"InvalidInputError",
+		"Interrupted",
+		"ProviderError",
+		"StalePlanError"
+	]),
+	failedOperationId: Schema.String,
+	message: Schema.String,
+	receipt: Receipt
+}) {};
+/** Builds a deterministic DNS plan through the provider in the Effect environment. */
+const create = Effect.fn("Provisioning.create")(function* (input) {
+	const provider = yield* Service;
+	const zone = yield* decode$3(input.zone);
+	const requirements = (yield* Effect.forEach(input.requirements, decode$4, { concurrency: "unbounded" })).sort(compareRecords);
+	const existing = [...yield* provider.listRecords(zone)].sort(compareRecords);
+	const { operations } = yield* Effect.reduce(requirements, () => ({
+		operations: [],
+		projected: existing
+	}), (state, requirement) => reconcileRequirement(requirement, state.projected).pipe(Effect.map((operation) => ({
+		operations: [...state.operations, operation],
+		projected: operation._tag === "create" ? [...state.projected, operation.requirement].sort(compareRecords) : state.projected
+	}))));
+	const unsigned = {
+		operations,
+		providerId: provider.id,
+		version: "domainkit.dns-plan.v1",
+		zone
+	};
+	return {
+		...unsigned,
+		digest: yield* sha256Encoded(UnsignedPlan, unsigned)
+	};
+});
+/** Authorizes all or a selected subset of create operations in a digest-bound plan. */
+const authorize$1 = Effect.fn("Provisioning.authorize")(function* (plan, operationIds, options = {}) {
+	yield* validateDigest(plan);
+	const createIds = plan.operations.filter((operation) => operation._tag === "create").map(({ id }) => id);
+	const selected = [...new Set(operationIds ?? createIds)].sort();
+	const unknown = selected.filter((id) => !createIds.includes(id));
+	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Unknown operation IDs: ${unknown.join(", ")}` });
+	if (!options.allowPartial && selected.length !== createIds.length) return yield* new AuthorizationError({ message: "Partial authorization requires allowPartial" });
+	return {
+		allowPartial: options.allowPartial ?? false,
+		operationIds: selected,
+		planDigest: plan.digest,
+		version: "domainkit.plan-authorization.v1"
+	};
+});
+/** Applies approved creates sequentially after full and per-operation revalidation. */
+const apply = Effect.fn("Provisioning.apply")(function* (input) {
+	const { authorization, plan } = input;
+	const provider = yield* Service;
+	yield* validateDigest(plan);
+	if (authorization.planDigest !== plan.digest) return yield* new AuthorizationError({ message: "Authorization belongs to a different plan" });
+	if (provider.id !== plan.providerId) return yield* new AuthorizationError({ message: "Provider does not match the approved plan" });
+	const conflicts = plan.operations.filter((operation) => operation._tag === "conflict");
+	if (conflicts.length > 0) return yield* new ConflictError({ operationIds: conflicts.map(({ id }) => id) });
+	const creates = plan.operations.filter(Operation.guards.create);
+	const approved = new Set(authorization.operationIds);
+	const unknown = authorization.operationIds.filter((id) => !creates.some((operation) => operation.id === id));
+	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Authorization contains unknown operations: ${unknown.join(", ")}` });
+	if (!authorization.allowPartial && creates.some(({ id }) => !approved.has(id))) return yield* new AuthorizationError({ message: "Authorization does not cover every create operation" });
+	const currentPlan = yield* create({
+		requirements: plan.operations.map(({ requirement }) => requirement),
+		zone: plan.zone
+	});
+	if (currentPlan.digest !== plan.digest) return yield* new StaleError({
+		approvedPlanDigest: plan.digest,
+		currentPlanDigest: currentPlan.digest
+	});
+	const operations = [];
+	for (const operation of creates) {
+		if (!approved.has(operation.id)) continue;
+		yield* Effect.gen(function* () {
+			yield* assertStillCreatable(plan, operation);
+			const result = yield* provider.createRecord(plan.zone, operation.requirement);
+			operations.push({
+				operationId: operation.id,
+				providerRecordId: result.providerRecordId
+			});
+		}).pipe(Effect.catch((failure) => operations.length === 0 ? Effect.fail(failure) : makeReceipt(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
+			causeTag: failure._tag,
+			failedOperationId: operation.id,
+			message: failureMessage(failure),
+			receipt
+		}))))), Effect.catchCause((cause) => {
+			if (!Cause.hasInterruptsOnly(cause) || operations.length === 0) return Effect.failCause(cause);
+			return makeReceipt(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
+				causeTag: "Interrupted",
+				failedOperationId: operation.id,
+				message: "DNS apply was interrupted after confirmed writes",
+				receipt
+			}))));
+		}));
+	}
+	return yield* makeReceipt(input, operations, "complete");
+});
+function renderManualInstructions(plan) {
+	return plan.operations.map((operation) => {
+		const record = operation.requirement;
+		const data$2 = Object.entries(data(record)).map(([key, value]) => `${key}=${value}`).join(" ");
+		return `${operation._tag.toUpperCase()} ${record._tag} ${record.name} ${data$2}`.trim();
+	});
+}
+function makeReceipt(input, operations, status) {
+	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
+		appliedAt: new Date(now),
+		operations,
+		planDigest: input.plan.digest,
+		providerId: input.plan.providerId,
+		status,
+		version: "domainkit.apply-receipt.v1",
+		zone: input.plan.zone
+	})));
+}
+function assertStillCreatable(plan, operation) {
+	return create({
+		requirements: [operation.requirement],
+		zone: plan.zone
+	}).pipe(Effect.flatMap((currentPlan) => {
+		const currentOperation = currentPlan.operations[0];
+		return currentOperation?._tag === "create" && currentOperation.id === operation.id ? Effect.void : Effect.fail(new StaleError({
+			approvedPlanDigest: plan.digest,
+			currentPlanDigest: currentPlan.digest
+		}));
+	}));
+}
+function reconcileRequirement(requirement, allExisting) {
+	return Effect.gen(function* () {
+		const sameName = allExisting.filter((record) => record.name === requirement.name);
+		const sameSet = sameName.filter((record) => record._tag !== "Opaque" && record._tag === requirement._tag);
+		const exact = sameSet.find((record) => equals(record, requirement));
+		const id = yield* sha256Encoded(RequirementDigest, { requirement });
+		if (exact !== void 0) return {
+			_tag: "noop",
+			id,
+			requirement,
+			ttlDrift: exact.ttl !== requirement.ttl
+		};
+		if (sameName.length > 0 && (requirement._tag === "CNAME" || sameName.some((record) => record._tag === "CNAME"))) return {
+			_tag: "conflict",
+			existing: sameName,
+			id,
+			reason: "CNAME records cannot coexist with other records at the same name",
+			requirement
+		};
+		if (sameSet.length > 0 && (requirement.policy === "exclusive" || sameSet.some(({ policy }) => policy === "exclusive"))) return {
+			_tag: "conflict",
+			existing: sameSet,
+			id,
+			reason: "The exclusive record set already contains incompatible data",
+			requirement
+		};
+		return {
+			_tag: "create",
+			id,
+			requirement
+		};
+	});
+}
+function validateDigest(plan) {
+	const unsigned = {
+		operations: plan.operations,
+		providerId: plan.providerId,
+		version: plan.version,
+		zone: plan.zone
+	};
+	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new AuthorizationError({ message: "Plan digest does not match its contents" }))));
+}
+function failureMessage(failure) {
+	return failure._tag === "StalePlanError" ? "DNS state changed while applying the approved plan" : failure.message;
+}
+function compareRecords(left, right) {
+	const encode = Schema.encodeSync(Observed);
+	const toJson = Schema.decodeUnknownSync(Schema.Json);
+	const leftJson = stringify(toJson(encode(left)));
+	const rightJson = stringify(toJson(encode(right)));
+	return leftJson < rightJson ? -1 : leftJson > rightJson ? 1 : 0;
+}
+//#endregion
+//#region src/plan/connection-authorization.ts
+var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize });
+const authorize = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
+	yield* Effect.try({
+		try: () => assertGrant(input.connection, {
+			accountId: input.accountId,
+			capability: "dns:write",
+			domain: input.plan.zone,
+			providerId: input.plan.providerId
+		}),
+		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$1 ? cause : new AuthorizationError$1({ message: "Connection grant is invalid" })
+	});
+	return yield* authorize$1(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
+});
+//#endregion
+//#region src/verification/dns-data.ts
+var dns_data_exports = /* @__PURE__ */ __exportAll({ parse: () => parse });
+const CanonicalAddress = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode: (value) => value.trim().toLowerCase(),
+	encode: (value) => value
+})));
+const CanonicalDomain = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
+	decode: (value, options) => Effect.try({
+		try: () => parse$1(value).toString(),
+		catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
+	}),
+	encode: (value) => Effect.succeed(value)
+})));
+const CanonicalMx = tokenizedDomain(2, 1);
+const CanonicalSrv = tokenizedDomain(4, 3);
+const CanonicalTxt = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode: (value) => {
+		const trimmed = value.trim();
+		const chunks = [...trimmed.matchAll(/"((?:\\.|[^"])*)"/g)];
+		return chunks.length === 0 ? trimmed : chunks.map((match) => (match[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")).join("");
+	},
+	encode: (value) => value
+})));
+const CanonicalCaa = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode: (value) => value.trim().replace(/\s+"([\s\S]*)"$/, " $1"),
+	encode: (value) => value
+})));
+function parse(type, input) {
+	const schema = (() => {
+		switch (type) {
+			case "A":
+			case "AAAA": return CanonicalAddress;
+			case "CNAME":
+			case "NS": return CanonicalDomain;
+			case "MX": return CanonicalMx;
+			case "SRV": return CanonicalSrv;
+			case "TXT": return CanonicalTxt;
+			case "CAA": return CanonicalCaa;
+		}
+	})();
+	try {
+		return Schema.decodeUnknownSync(schema)(input);
+	} catch (cause) {
+		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+}
+function tokenizedDomain(length, domainIndex) {
+	return Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
+		decode: (value, options) => Effect.try({
+			try: () => {
+				const parts = value.trim().split(/\s+/);
+				if (parts.length !== length) throw new Error("DNS record data has an invalid field count");
+				const domain = parts[domainIndex];
+				if (domain === void 0) throw new Error("DNS record target is missing");
+				parts[domainIndex] = parse$1(domain);
+				return parts.join(" ");
+			},
+			catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
+		}),
+		encode: (value) => Effect.succeed(value)
+	})));
+}
+//#endregion
+//#region src/verification/doh.ts
+var doh_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer$1,
+	make: () => make$1,
+	toAsync: () => toAsync$1
+});
+function make$1(options) {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	return { resolve: Effect.fn("DnsOverHttps.resolve")((query) => Effect.tryPromise({
+		try: (effectSignal) => request({
+			effectSignal,
+			fetch,
+			query,
+			timeoutMs,
+			endpoint: options.endpoint
+		}),
+		catch: (cause) => cause instanceof Error$3 ? cause : new Error$3({
+			cause,
+			message: cause instanceof Error ? cause.message : "DNS resolution failed",
+			reason: "transport"
+		})
+	}).pipe(Effect.flatMap((message) => decodeResolution(query, message)))) };
+}
+const layer$1 = (options) => Layer.succeed(Service$4, make$1(options));
+const toAsync$1 = (options) => toAsync$2(make$1(options));
+function decodeResolution(query, message) {
+	return Effect.try({
+		try: () => DnsPacket.decode(message),
+		catch: (cause) => new Error$3({
+			cause,
+			message: "DoH returned an invalid DNS message",
+			reason: "response"
+		})
+	}).pipe(Effect.flatMap((packet) => validatePacket(query, packet)), Effect.flatMap(decodePacket));
+}
+function decodePacket(packet) {
+	if (packet.rcode === "NXDOMAIN") return Effect.succeed({ _tag: "nodata" });
+	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$3({
+		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
+		reason: "response"
+	}));
+	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed({ _tag: "nodata" });
+	return Effect.forEach(packet.answers, decodeAnswer, { concurrency: "unbounded" }).pipe(Effect.map((answers) => {
+		const supportedAnswers = answers.filter((answer) => answer !== null);
+		return supportedAnswers.length === 0 ? { _tag: "nodata" } : {
+			_tag: "answer",
+			answers: supportedAnswers
+		};
+	}));
+}
+function validatePacket(query, packet) {
+	return Effect.try({
+		try: () => {
+			if (packet.type !== "response") throw new Error("DoH returned a DNS query");
+			if (packet.id !== 0) throw new Error("DoH response used an unexpected message ID");
+			if (packet.flag_tc) throw new Error("DoH returned a truncated DNS response");
+			const questions = packet.questions ?? [];
+			if (questions.length !== 1) throw new Error("DoH returned an unexpected question count");
+			const question = questions[0];
+			if (question === void 0) throw new Error("DoH response omitted the DNS question");
+			if (question.class !== "IN" || question.type !== query.type || parse$1(question.name) !== query.name) throw new Error("DoH response did not match the DNS question");
+			return packet;
+		},
+		catch: (cause) => new Error$3({
+			cause,
+			message: cause instanceof Error ? cause.message : "DoH returned an invalid DNS response",
+			reason: "response"
+		})
+	});
+}
+function decodeAnswer(answer) {
+	return Effect.gen(function* () {
+		if (answer.class !== "IN") return null;
+		const decoded = yield* Effect.try({
+			try: () => answerData(answer),
+			catch: (cause) => new Error$3({
+				cause,
+				message: "DoH returned invalid DNS record data",
+				reason: "response"
+			})
+		});
+		if (decoded === void 0) return null;
+		const name = yield* decode$3(answer.name);
+		const data = yield* Effect.try({
+			try: () => parse(decoded.type, decoded.data),
+			catch: (cause) => new Error$3({
+				cause,
+				message: "DoH returned invalid DNS record data",
+				reason: "response"
+			})
+		});
+		if (answer.ttl === void 0) return yield* new Error$3({
+			message: "DoH response omitted the DNS record TTL",
+			reason: "response"
+		});
+		return {
+			data,
+			name,
+			ttl: answer.ttl,
+			type: decoded.type
+		};
+	}).pipe(Effect.mapError((cause) => cause instanceof Error$3 ? cause : new Error$3({
+		cause,
+		message: cause.message,
+		reason: "response"
+	})));
+}
+function answerData(answer) {
+	switch (answer.type) {
+		case "A":
+		case "AAAA":
+		case "CNAME":
+		case "NS": return {
+			data: answer.data,
+			type: answer.type
+		};
+		case "CAA": return {
+			data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,
+			type: answer.type
+		};
+		case "MX": return {
+			data: `${requiredNumber(answer.data.preference, "MX preference")} ${answer.data.exchange}`,
+			type: answer.type
+		};
+		case "SRV": return {
+			data: [
+				requiredNumber(answer.data.priority, "SRV priority"),
+				requiredNumber(answer.data.weight, "SRV weight"),
+				requiredNumber(answer.data.port, "SRV port"),
+				answer.data.target
+			].join(" "),
+			type: answer.type
+		};
+		case "TXT": return {
+			data: decodeTxt(answer.data),
+			type: answer.type
+		};
+		default: return;
+	}
+}
+function decodeTxt(data) {
+	const encoded = (Array.isArray(data) ? data : [data]).map((chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
+	const length = encoded.reduce((total, chunk) => total + chunk.length, 0);
+	const joined = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of encoded) {
+		joined.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return new TextDecoder("utf-8", { fatal: true }).decode(joined);
+}
+function requiredNumber(value, field) {
+	if (value === void 0) throw new Error(`DoH response omitted ${field}`);
+	return value;
+}
+async function request(input) {
+	const controller = new AbortController();
+	let timedOut = false;
+	const abortFromEffect = () => controller.abort(input.effectSignal.reason);
+	const abortFromHost = () => controller.abort(input.query.signal?.reason);
+	input.effectSignal.addEventListener("abort", abortFromEffect, { once: true });
+	input.query.signal?.addEventListener("abort", abortFromHost, { once: true });
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort(/* @__PURE__ */ new Error("DNS resolution timed out"));
+	}, input.timeoutMs);
+	try {
+		const query = Uint8Array.from(DnsPacket.encode({
+			flags: DnsPacket.RECURSION_DESIRED,
+			id: 0,
+			questions: [{
+				name: input.query.name,
+				type: input.query.type
+			}],
+			type: "query"
+		}));
+		const response = await input.fetch(new URL(input.endpoint), {
+			body: query,
+			headers: {
+				accept: "application/dns-message",
+				"content-type": "application/dns-message"
+			},
+			method: "POST",
+			signal: controller.signal
+		});
+		if (!response.ok) throw new Error$3({
+			message: `DoH returned HTTP ${response.status}`,
+			reason: "transport"
+		});
+		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+		if (contentType !== "application/dns-message") throw new Error$3({
+			message: `DoH returned unsupported content type ${contentType ?? "<missing>"}`,
+			reason: "response"
+		});
+		return new Uint8Array(await response.arrayBuffer());
+	} catch (cause) {
+		if (timedOut) throw new Error$3({
+			message: "DNS query timed out",
+			reason: "timeout"
+		});
+		throw cause;
+	} finally {
+		clearTimeout(timer);
+		input.effectSignal.removeEventListener("abort", abortFromEffect);
+		input.query.signal?.removeEventListener("abort", abortFromHost);
+	}
+}
+//#endregion
+//#region src/verification/cloudflare-doh.ts
+var cloudflare_doh_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer,
+	make: () => make,
+	toAsync: () => toAsync
+});
+const endpoint = "https://cloudflare-dns.com/dns-query";
+function make(options = {}) {
+	return make$1({
+		...options,
+		endpoint: options.endpoint ?? endpoint
+	});
+}
+const layer = (options = {}) => Layer.succeed(Service$4, make(options));
+const toAsync = (options = {}) => toAsync$2(make(options));
+//#endregion
+//#region src/verification/verify.ts
+var verify_exports = /* @__PURE__ */ __exportAll({
+	ProviderObservation: () => ProviderObservation,
+	PublicDnsObservation: () => PublicDnsObservation,
+	Result: () => Result,
+	record: () => record
+});
+const ProviderObservation = Schema.TaggedUnion({
+	match: {},
+	missing: {},
+	mismatch: { records: Schema.Array(Schema$5) },
+	failure: { message: Schema.String }
+});
+const PublicDnsObservation = Schema.TaggedUnion({
+	propagated: {},
+	missing: {},
+	mismatch: { answers: Schema.Array(Schema.String) },
+	timeout: {},
+	failure: { message: Schema.String }
+});
+const Result = Schema.Struct({
+	provider: ProviderObservation,
+	publicDns: PublicDnsObservation,
+	status: Schema.Literals([
+		"verified",
+		"pending",
+		"mismatch",
+		"unavailable"
+	])
+});
+const record = Effect.fn("Verification.record")(function* (input) {
+	const provider = yield* Service;
+	const resolver = yield* Service$4;
+	const [providerObservation, publicDns] = yield* Effect.all([observeProvider(provider, input.zone, input.record).pipe(Effect.catch((failure) => Effect.succeed({
+		_tag: "failure",
+		message: failure.message
+	}))), resolver.resolve({
+		name: input.record.name,
+		type: input.record._tag
+	}).pipe(Effect.match({
+		onFailure: (failure) => failure.reason === "timeout" ? { _tag: "timeout" } : {
+			_tag: "failure",
+			message: failure.message
+		},
+		onSuccess: (resolution) => observePublicDns(input.record, resolution)
+	}))], { concurrency: "unbounded" });
+	return {
+		provider: providerObservation,
+		publicDns,
+		status: providerObservation._tag === "match" && publicDns._tag === "propagated" ? "verified" : providerObservation._tag === "failure" || publicDns._tag === "failure" || publicDns._tag === "timeout" ? "unavailable" : providerObservation._tag === "mismatch" || publicDns._tag === "mismatch" ? "mismatch" : "pending"
+	};
+});
+function observeProvider(provider, zone, requirement) {
+	return provider.listRecords(zone).pipe(Effect.map((records) => {
+		if (records.some((existing) => existing._tag !== "Opaque" && equals(existing, requirement))) return { _tag: "match" };
+		const sameSet = records.filter((existing) => existing._tag !== "Opaque" && existing.name === requirement.name && existing._tag === requirement._tag);
+		return sameSet.length === 0 ? { _tag: "missing" } : {
+			_tag: "mismatch",
+			records: sameSet
+		};
+	}));
+}
+function observePublicDns(requirement, resolution) {
+	if (resolution._tag === "nodata") return { _tag: "missing" };
+	const expected = parse(requirement._tag, recordValue(requirement));
+	return resolution.answers.some((answer) => answer.name === requirement.name && answer.type === requirement._tag && parse(answer.type, answer.data) === expected) ? { _tag: "propagated" } : {
+		_tag: "mismatch",
+		answers: resolution.answers.map(({ data }) => data)
+	};
+}
+function recordValue(requirement) {
+	const data$1 = data(requirement);
+	switch (requirement._tag) {
+		case "A":
+		case "AAAA": return String(data$1.address);
+		case "CNAME":
+		case "NS": return String(data$1.target);
+		case "TXT": return String(data$1.value);
+		case "MX": return `${data$1.priority} ${data$1.exchange}`;
+		case "CAA": return `${data$1.flags} ${data$1.tag} ${data$1.value}`;
+		case "SRV": return `${data$1.priority} ${data$1.weight} ${data$1.port} ${data$1.target}`;
+	}
+}
+//#endregion
+export { decode$1 as A, Capability as B, types_exports as C, token_exports as D, connect as E, refresh as F, decode$2 as G, Schema$3 as H, revoke as I, encode$1 as K, canonical_json_exports as L, begin as M, complete as N, Method as O, oauth_exports as P, webCryptoLayer as R, encodeReceipt as S, zones_exports as T, assertGrant as U, Grant as V, connection_exports as W, Receipt as _, doh_exports as a, decodeReceipt as b, authorize as c, authorize$1 as d, create as f, Operation as g, Authorization as h, toAsync as i, manifest_exports as j, Schema$2 as k, connection_authorization_exports as l, renderManualInstructions as m, verify_exports as n, toAsync$1 as o, plan_exports as p, version as q, cloudflare_doh_exports as r, dns_data_exports as s, record as t, apply as u, Schema$1 as v, selection_exports as w, encode as x, decode as y, AuthorizationError$1 as z };
+
+//# sourceMappingURL=verify-CeMW6XtK.mjs.map