domainkit 0.1.0-beta.0 → 0.1.0

package/dist/{verify-CeMW6XtK.mjs → verify-BjrR_4NF.mjs}

@@ -1,64 +1,143 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { D as parse$1, O as Error$1, T as decode$3, _ as equals, b as Service, h as decode$4, m as data, s as Observed, u as Schema$5, w as Schema$4, y as Error$2 } from "./dns-record-Dzo4flM5.mjs";
-import { a as toAsync$2, m as Service$2, n as Service$4, o as Service$1, t as Error$3, u as Service$3 } from "./resolver-D5nVrR10.mjs";
-import { c as Value } from "./client-DvXfJx_E.mjs";
+import { D as parse$1, O as Error$3, T as decode$4, _ as equals, b as Service, h as decode$5, m as data, s as Observed, u as Schema$6, w as Schema$5, y as Error$4 } from "./dns-record-C_KwGPLf.mjs";
+import { a as toAsync$2, m as Service$3, n as Service$5, o as Service$4, t as Error$5, u as Service$2, v as Service$1 } from "./resolver-tEXpKxmH.mjs";
+import { c as Value } from "./client-BnD7QLRF.mjs";
 import { Cause, Clock, Crypto, Effect, Layer, PlatformError, Schema, SchemaIssue, SchemaTransformation } from "effect";
 import * as oauth from "oauth4webapi";
 import { getDomain } from "tldts";
 import * as DnsPacket from "@leichtgewicht/dns-packet";
 //#region package.json
-var version = "0.1.0-beta.0";
+var version = "0.1.0";
 //#endregion
 //#region src/auth/connection.ts
 var connection_exports = /* @__PURE__ */ __exportAll({
 	AuthorizationError: () => AuthorizationError$1,
-	Capability: () => Capability,
 	Grant: () => Grant,
-	Schema: () => Schema$3,
+	Schema: () => Schema$4,
 	assertGrant: () => assertGrant,
-	decode: () => decode$2,
-	encode: () => encode$1,
-	validate: () => validate
+	decode: () => decode$3,
+	encode: () => encode$2,
+	validate: () => validate$3
 });
-const Capability = Schema.Literals(["dns:read", "dns:write"]);
 const Grant = Schema.TaggedUnion({
 	account: {},
-	domains: { domains: Schema.Array(Schema$4) }
+	domains: { domains: Schema.Array(Schema$5) }
 });
-const Schema$3 = Schema.Struct({
-	accountId: Schema.String,
-	capabilities: Schema.Array(Capability),
+/** An owner-scoped grant bound to one provider authorization. */
+const Schema$4 = Schema.Struct({
+	authorizationId: Schema.String,
 	createdAt: Schema.DateFromString,
-	expiresAt: Schema.NullOr(Schema.DateFromString),
 	grant: Grant,
 	id: Schema.String,
-	kind: Schema.Literals(["oauth2", "token"]),
-	providerId: Schema.String,
-	scopes: Schema.Array(Schema.String),
-	subjectId: Schema.String
+	ownerId: Schema.String
 });
-const decode$2 = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$3)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
-const validate = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$3))(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
-const encode$1 = Schema.encodeSync(Schema$3);
+const decode$3 = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$4)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
+const validate$3 = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$4))(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
+const encode$2 = Schema.encodeSync(Schema$4);
 var AuthorizationError$1 = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
-function assertGrant(connection, request) {
-	if (connection.providerId !== request.providerId || connection.accountId !== request.accountId) throw new AuthorizationError$1({ message: "Connection does not grant this provider account" });
-	if (connection.expiresAt !== null) {
-		if (Number.isNaN(connection.expiresAt.getTime())) throw new AuthorizationError$1({ message: "Connection expiration is invalid" });
-		if (connection.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw new AuthorizationError$1({ message: "Connection has expired" });
+function assertGrant(connection, authorization, request) {
+	if (connection.authorizationId !== authorization.id || authorization.providerId !== request.providerId) throw new AuthorizationError$1({ message: "Connection does not grant this provider account" });
+	if (authorization.expiresAt !== null) {
+		if (Number.isNaN(authorization.expiresAt.getTime())) throw new AuthorizationError$1({ message: "Connection expiration is invalid" });
+		if (authorization.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw new AuthorizationError$1({ message: "Connection has expired" });
 	}
-	if (!connection.capabilities.includes(request.capability)) throw new AuthorizationError$1({ message: `Connection lacks the ${request.capability} capability` });
+	if (!authorization.capabilities.includes(request.capability)) throw new AuthorizationError$1({ message: `Connection lacks the ${request.capability} capability` });
 	let domain;
 	try {
 		domain = parse$1(request.domain);
 	} catch (cause) {
-		if (cause instanceof Error$1) throw cause;
-		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
+		if (cause instanceof Error$3) throw cause;
+		throw new Error$3({ message: cause instanceof Error ? cause.message : String(cause) });
 	}
 	if (connection.grant._tag === "domains" && !connection.grant.domains.includes(domain)) throw new AuthorizationError$1({ message: "Connection does not grant this domain" });
 	return domain;
 }
 //#endregion
+//#region src/auth/connection-lifecycle.ts
+var connection_lifecycle_exports = /* @__PURE__ */ __exportAll({
+	Error: () => Error$2,
+	detach: () => detach,
+	updateGrant: () => updateGrant
+});
+var Error$2 = class extends Schema.TaggedError()("ConnectionLifecycleError", { message: Schema.String }) {};
+/** Replace the grant on an owner binding after the host has obtained explicit consent. */
+const updateGrant = Effect.fn("ConnectionLifecycle.updateGrant")(function* (input) {
+	const connectionStore = yield* Service$1;
+	const connection = yield* validate$3({
+		...input.connection,
+		grant: input.grant
+	});
+	yield* connectionStore.put(connection);
+	return connection;
+});
+/**
+* Detach one owner binding. The final binding invokes provider revocation before deleting local
+* credential and authorization state. The callback keeps provider-specific revocation outside the
+* portable authorization model.
+*/
+function detach(input) {
+	return Effect.gen(function* () {
+		const authorizationStore = yield* Service$2;
+		const connectionStore = yield* Service$1;
+		const credentialStore = yield* Service$3;
+		const connection = yield* connectionStore.get(input.connectionId);
+		if (connection === null) return yield* new Error$2({ message: "Connection binding does not exist" });
+		const remainingBindings = (yield* connectionStore.listByAuthorizationId(connection.authorizationId)).filter(({ id }) => id !== connection.id);
+		if (remainingBindings.length > 0) {
+			yield* connectionStore.delete(connection.id);
+			return {
+				connection,
+				remainingBindings: remainingBindings.length,
+				revokedAuthorization: false
+			};
+		}
+		const authorization = yield* authorizationStore.get(connection.authorizationId);
+		if (authorization === null) {
+			yield* credentialStore.delete(connection.authorizationId);
+			yield* connectionStore.delete(connection.id);
+			return {
+				connection,
+				remainingBindings: 0,
+				revokedAuthorization: true
+			};
+		}
+		yield* input.revokeAuthorization(authorization);
+		yield* credentialStore.delete(authorization.id);
+		yield* authorizationStore.delete(authorization.id);
+		yield* connectionStore.delete(connection.id);
+		return {
+			connection,
+			remainingBindings: 0,
+			revokedAuthorization: true
+		};
+	});
+}
+//#endregion
+//#region src/auth/authorization.ts
+var authorization_exports = /* @__PURE__ */ __exportAll({
+	Capability: () => Capability,
+	Schema: () => Schema$3,
+	decode: () => decode$2,
+	encode: () => encode$1,
+	validate: () => validate$2
+});
+const Capability = Schema.Literals(["dns:read", "dns:write"]);
+/** A provider credential authorization shared by one or more owner connections. */
+const Schema$3 = Schema.Struct({
+	accountId: Schema.String,
+	capabilities: Schema.Array(Capability),
+	createdAt: Schema.DateFromString,
+	expiresAt: Schema.NullOr(Schema.DateFromString),
+	id: Schema.String,
+	kind: Schema.Literals(["oauth2", "token"]),
+	providerId: Schema.String,
+	scopes: Schema.Array(Schema.String),
+	subjectId: Schema.String
+});
+const decode$2 = Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$3)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
+const validate$2 = Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$3))(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
+const encode$1 = Schema.encodeSync(Schema$3);
+//#endregion
 //#region src/plan/canonical-json.ts
 var canonical_json_exports = /* @__PURE__ */ __exportAll({
 	CryptoError: () => CryptoError,
@@ -120,7 +199,7 @@ var oauth_exports = /* @__PURE__ */ __exportAll({
 });
 function beginProgram(input) {
 	return Effect.gen(function* () {
-		const stateStore = yield* Service$1;
+		const stateStore = yield* Service$4;
 		const cryptoService = yield* Crypto.Crypto;
 		const now = yield* Clock.currentTimeMillis;
 		const state = base64Url(yield* cryptoBytes(cryptoService, 32));
@@ -143,6 +222,7 @@ function beginProgram(input) {
 			expiresAt: new Date(now + (input.ttlMs ?? 6e5)),
 			grant: input.grant,
 			method: input.method,
+			ownerId: input.ownerId,
 			redirectUri: input.redirectUri,
 			stateHash,
 			subjectId: input.subjectId
@@ -152,8 +232,9 @@ function beginProgram(input) {
 }
 function completeProgram(input) {
 	return Effect.gen(function* () {
-		const stateStore = yield* Service$1;
-		const connectionStore = yield* Service$2;
+		const stateStore = yield* Service$4;
+		const authorizationStore = yield* Service$2;
+		const connectionStore = yield* Service$1;
 		const credentialStore = yield* Service$3;
 		const cryptoService = yield* Crypto.Crypto;
 		const state = input.callbackUrl.searchParams.get("state");
@@ -172,42 +253,54 @@ function completeProgram(input) {
 		});
 		const accessToken = Value.from(tokens.access_token);
 		const subject = yield* input.resolveSubject(tokens, accessToken);
-		const id = yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));
-		const connection = yield* validate({
+		const existingAuthorization = yield* authorizationStore.findByProviderAccount(input.providerId, subject.accountId);
+		const authorizationId = existingAuthorization?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message }))));
+		const authorization = yield* validate$2({
 			accountId: subject.accountId,
 			capabilities: [...continuation.method.capabilities],
-			createdAt: new Date(now),
+			createdAt: existingAuthorization?.createdAt ?? new Date(now),
 			expiresAt: subject.expiresAt,
-			grant: continuation.grant,
-			id,
+			id: authorizationId,
 			kind: "oauth2",
 			providerId: input.providerId,
 			scopes: (tokens.scope ?? continuation.method.scopes.join(" ")).split(" ").filter(Boolean),
 			subjectId: continuation.subjectId
 		});
-		yield* credentialStore.put(connection.id, {
+		const existingConnection = yield* connectionStore.find(continuation.ownerId, authorization.id);
+		const connection = yield* validate$3({
+			authorizationId: authorization.id,
+			createdAt: existingConnection?.createdAt ?? new Date(now),
+			grant: continuation.grant,
+			id: existingConnection?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))),
+			ownerId: continuation.ownerId
+		});
+		yield* credentialStore.put(authorization.id, {
 			accessToken,
 			refreshToken: tokens.refresh_token === void 0 ? null : Value.from(tokens.refresh_token),
 			tokenType: tokens.token_type
 		});
+		yield* authorizationStore.put(authorization);
 		yield* connectionStore.put(connection);
-		return connection;
+		return {
+			authorization,
+			connection
+		};
 	});
 }
 function refreshProgram(input) {
 	return Effect.gen(function* () {
 		const credentialStore = yield* Service$3;
-		const credential = yield* requireCredential(input.connection.id, credentialStore);
+		const credential = yield* requireCredential(input.authorization.id, credentialStore);
 		const refreshToken = credential.refreshToken;
 		if (refreshToken === null) return yield* new AuthorizationError$1({ message: "Connection has no refresh token" });
 		const as = input.method.authorizationServer;
 		const client = { client_id: input.client.clientId };
 		const authentication = yield* effectClientAuthentication(input.method, input.client);
-		const tokens = yield* providerRequest(input.connection.providerId, async (signal) => {
+		const tokens = yield* providerRequest(input.authorization.providerId, async (signal) => {
 			const response = await oauth.refreshTokenGrantRequest(as, client, authentication, refreshToken.expose(), requestOptions(input.fetch, signal));
 			return oauth.processRefreshTokenResponse(as, client, response);
 		});
-		yield* credentialStore.put(input.connection.id, {
+		yield* credentialStore.put(input.authorization.id, {
 			accessToken: Value.from(tokens.access_token),
 			refreshToken: tokens.refresh_token === void 0 ? credential.refreshToken : Value.from(tokens.refresh_token),
 			tokenType: tokens.token_type
@@ -218,30 +311,30 @@ function revokeProgram(input) {
 	return Effect.gen(function* () {
 		if (input.method.authorizationServer.revocation_endpoint === void 0) return yield* new AuthorizationError$1({ message: "Provider does not advertise token revocation" });
 		const credentialStore = yield* Service$3;
-		const credential = yield* requireCredential(input.connection.id, credentialStore);
+		const credential = yield* requireCredential(input.authorization.id, credentialStore);
 		const as = input.method.authorizationServer;
 		const authentication = yield* effectClientAuthentication(input.method, input.client);
-		yield* providerRequest(input.connection.providerId, async (signal) => {
+		yield* providerRequest(input.authorization.providerId, async (signal) => {
 			const response = await oauth.revocationRequest(as, { client_id: input.client.clientId }, authentication, credential.accessToken.expose(), requestOptions(input.fetch, signal));
 			await oauth.processRevocationResponse(response);
 		});
-		yield* credentialStore.delete(input.connection.id);
+		yield* credentialStore.delete(input.authorization.id);
 	});
 }
 function effectClientAuthentication(method, client) {
 	return Effect.try({
 		try: () => clientAuthentication(method, client),
-		catch: (cause) => cause instanceof Error$1 ? cause : new Error$1({ message: "OAuth client authentication is invalid" })
+		catch: (cause) => cause instanceof Error$3 ? cause : new Error$3({ message: "OAuth client authentication is invalid" })
 	});
 }
 function clientAuthentication(method, client) {
 	switch (method.clientAuth) {
 		case "none": return oauth.None();
 		case "client_secret_basic":
-			if (client.clientSecret === void 0) throw new Error$1({ message: "Client secret is required" });
+			if (client.clientSecret === void 0) throw new Error$3({ message: "Client secret is required" });
 			return oauth.ClientSecretBasic(client.clientSecret.expose());
 		case "client_secret_post":
-			if (client.clientSecret === void 0) throw new Error$1({ message: "Client secret is required" });
+			if (client.clientSecret === void 0) throw new Error$3({ message: "Client secret is required" });
 			return oauth.ClientSecretPost(client.clientSecret.expose());
 	}
 }
@@ -260,7 +353,7 @@ function requireCredential(connectionId, store) {
 function providerRequest(providerId, request) {
 	return Effect.tryPromise({
 		try: request,
-		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$1 ? cause : new Error$2({
+		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$3 ? cause : new Error$4({
 			cause,
 			message: safeOAuthMessage(cause),
 			operation: "oauthRequest",
@@ -320,36 +413,48 @@ const Schema$2 = Schema.Struct({
 	methods: Schema.Array(Method),
 	providerId: Schema.String
 });
-const decode$1 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const decode$1 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
 //#endregion
 //#region src/auth/token.ts
 var token_exports = /* @__PURE__ */ __exportAll({ connect: () => connect });
 const connect = Effect.fn("TokenConnection.connect")(function* (input) {
-	const connectionStore = yield* Service$2;
+	const authorizationStore = yield* Service$2;
+	const connectionStore = yield* Service$1;
 	const credentialStore = yield* Service$3;
 	const cryptoService = yield* Crypto.Crypto;
 	const validation = yield* input.validate(input.token);
 	const createdAt = new Date(yield* Clock.currentTimeMillis);
-	const id = yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));
-	const connection = yield* validate({
+	const existingAuthorization = yield* authorizationStore.findByProviderAccount(input.providerId, validation.accountId);
+	const authorization = yield* validate$2({
 		accountId: validation.accountId,
 		capabilities: [...validation.capabilities],
-		createdAt,
+		createdAt: existingAuthorization?.createdAt ?? createdAt,
 		expiresAt: validation.expiresAt,
-		grant: input.grant,
-		id,
+		id: existingAuthorization?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))),
 		kind: "token",
 		providerId: input.providerId,
 		scopes: [...validation.scopes],
 		subjectId: input.subjectId
 	});
-	yield* credentialStore.put(connection.id, {
+	const existingConnection = yield* connectionStore.find(input.ownerId, authorization.id);
+	const connection = yield* validate$3({
+		authorizationId: authorization.id,
+		createdAt: existingConnection?.createdAt ?? createdAt,
+		grant: input.grant,
+		id: existingConnection?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))),
+		ownerId: input.ownerId
+	});
+	yield* credentialStore.put(authorization.id, {
 		accessToken: input.token,
 		refreshToken: null,
 		tokenType: "bearer"
 	});
+	yield* authorizationStore.put(authorization);
 	yield* connectionStore.put(connection);
-	return connection;
+	return {
+		authorization,
+		connection
+	};
 });
 //#endregion
 //#region src/discovery/zones.ts
@@ -357,7 +462,7 @@ var zones_exports = /* @__PURE__ */ __exportAll({ candidates: () => candidates }
 function candidates(input) {
 	const domain = parse$1(input);
 	const registrable = getDomain(domain, { allowPrivateDomains: true });
-	if (registrable === null) throw new Error$1({ message: "Domain does not have a registrable DNS zone" });
+	if (registrable === null) throw new Error$3({ message: "Domain does not have a registrable DNS zone" });
 	const labels = domain.split(".");
 	const registrableLabels = registrable.split(".").length;
 	const values = [];
@@ -375,9 +480,9 @@ const Evidence = Schema.Struct({
 	accountId: Schema.String,
 	connectionId: Schema.String,
 	decisiveNameserverMatch: Schema.Boolean,
-	matchedNameservers: Schema.Array(Schema$4),
+	matchedNameservers: Schema.Array(Schema$5),
 	providerId: Schema.String,
-	zone: Schema$4
+	zone: Schema$5
 });
 const Selection = Schema.TaggedUnion({
 	selected: {
@@ -397,8 +502,7 @@ function select(input) {
 	const eligible = input.connectedZones.filter((connected) => {
 		if (!zoneCandidates.has(parse$1(connected.zone))) return false;
 		try {
-			assertGrant(connected.connection, {
-				accountId: connected.accountId,
+			assertGrant(connected.connection, connected.authorization, {
 				capability: "dns:read",
 				domain,
 				...input.now === void 0 ? {} : { now: input.now },
@@ -412,7 +516,7 @@ function select(input) {
 	const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));
 	if (input.explicit !== void 0) {
 		const explicitZone = parse$1(input.explicit.zone);
-		const index = eligible.findIndex((connected) => connected.providerId === input.explicit?.providerId && connected.accountId === input.explicit.accountId && parse$1(connected.zone) === explicitZone);
+		const index = eligible.findIndex((connected) => connected.providerId === input.explicit?.providerId && connected.authorization.accountId === input.explicit.accountId && parse$1(connected.zone) === explicitZone);
 		if (index < 0) throw new AuthorizationError$1({ message: "Explicit provider zone is not connected or granted" });
 		const candidate = evidence[index];
 		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
@@ -440,7 +544,7 @@ function evidenceFor(connected, authoritative) {
 	const configured = new Set(nameserverSet(connected.nameservers));
 	const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));
 	return {
-		accountId: connected.accountId,
+		accountId: connected.authorization.accountId,
 		connectionId: connected.connection.id,
 		decisiveNameserverMatch: authoritative.length > 0 && matchedNameservers.length === authoritative.length,
 		matchedNameservers,
@@ -454,46 +558,46 @@ function nameserverSet(nameservers) {
 //#endregion
 //#region src/plan/types.ts
 var types_exports = /* @__PURE__ */ __exportAll({
-	Authorization: () => Authorization,
-	Operation: () => Operation,
-	Receipt: () => Receipt,
+	Authorization: () => Authorization$1,
+	Operation: () => Operation$1,
+	Receipt: () => Receipt$1,
 	Schema: () => Schema$1,
 	decode: () => decode,
 	decodeReceipt: () => decodeReceipt,
 	encode: () => encode,
 	encodeReceipt: () => encodeReceipt
 });
-const Operation = Schema.TaggedUnion({
+const Operation$1 = Schema.TaggedUnion({
 	create: {
 		id: Schema.String,
-		requirement: Schema$5
+		requirement: Schema$6
 	},
 	noop: {
 		id: Schema.String,
-		requirement: Schema$5,
+		requirement: Schema$6,
 		ttlDrift: Schema.Boolean
 	},
 	conflict: {
 		existing: Schema.Array(Observed),
 		id: Schema.String,
 		reason: Schema.String,
-		requirement: Schema$5
+		requirement: Schema$6
 	}
 });
 const Schema$1 = Schema.Struct({
 	digest: Schema.String,
-	operations: Schema.Array(Operation),
+	operations: Schema.Array(Operation$1),
 	providerId: Schema.String,
 	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$4
+	zone: Schema$5
 });
-const Authorization = Schema.Struct({
+const Authorization$1 = Schema.Struct({
 	allowPartial: Schema.Boolean,
 	operationIds: Schema.Array(Schema.String),
 	planDigest: Schema.String,
 	version: Schema.Literal("domainkit.plan-authorization.v1")
 });
-const Receipt = Schema.Struct({
+const Receipt$1 = Schema.Struct({
 	appliedAt: Schema.DateFromString,
 	operations: Schema.Array(Schema.Struct({
 		operationId: Schema.String,
@@ -503,12 +607,12 @@ const Receipt = Schema.Struct({
 	providerId: Schema.String,
 	status: Schema.Literals(["complete", "partial"]),
 	version: Schema.Literal("domainkit.apply-receipt.v1"),
-	zone: Schema$4
+	zone: Schema$5
 });
-const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
 const encode = Schema.encodeSync(Schema$1);
-const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
-const encodeReceipt = Schema.encodeSync(Receipt);
+const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt$1)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
+const encodeReceipt = Schema.encodeSync(Receipt$1);
 //#endregion
 //#region src/plan/plan.ts
 var plan_exports = /* @__PURE__ */ __exportAll({
@@ -516,18 +620,19 @@ var plan_exports = /* @__PURE__ */ __exportAll({
 	ConflictError: () => ConflictError,
 	PartialApplyError: () => PartialApplyError,
 	StaleError: () => StaleError,
-	apply: () => apply,
-	authorize: () => authorize$1,
-	create: () => create,
-	renderManualInstructions: () => renderManualInstructions
+	apply: () => apply$1,
+	authorize: () => authorize$2,
+	create: () => create$1,
+	renderManualInstructions: () => renderManualInstructions,
+	validate: () => validate$1
 });
-const UnsignedPlan = Schema.Struct({
-	operations: Schema.Array(Operation),
+const UnsignedPlan$1 = Schema.Struct({
+	operations: Schema.Array(Operation$1),
 	providerId: Schema.String,
 	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$4
+	zone: Schema$5
 });
-const RequirementDigest = Schema.Struct({ requirement: Schema$5 });
+const RequirementDigest = Schema.Struct({ requirement: Schema$6 });
 var ConflictError = class extends Schema.TaggedError()("PlanConflictError", { operationIds: Schema.Array(Schema.String) }) {};
 var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
 var StaleError = class extends Schema.TaggedError()("StalePlanError", {
@@ -544,13 +649,13 @@ var PartialApplyError = class extends Schema.TaggedError()("PartialApplyError",
 	]),
 	failedOperationId: Schema.String,
 	message: Schema.String,
-	receipt: Receipt
+	receipt: Receipt$1
 }) {};
 /** Builds a deterministic DNS plan through the provider in the Effect environment. */
-const create = Effect.fn("Provisioning.create")(function* (input) {
+const create$1 = Effect.fn("Provisioning.create")(function* (input) {
 	const provider = yield* Service;
-	const zone = yield* decode$3(input.zone);
-	const requirements = (yield* Effect.forEach(input.requirements, decode$4, { concurrency: "unbounded" })).sort(compareRecords);
+	const zone = yield* decode$4(input.zone);
+	const requirements = (yield* Effect.forEach(input.requirements, decode$5, { concurrency: "unbounded" })).sort(compareRecords);
 	const existing = [...yield* provider.listRecords(zone)].sort(compareRecords);
 	const { operations } = yield* Effect.reduce(requirements, () => ({
 		operations: [],
@@ -567,12 +672,12 @@ const create = Effect.fn("Provisioning.create")(function* (input) {
 	};
 	return {
 		...unsigned,
-		digest: yield* sha256Encoded(UnsignedPlan, unsigned)
+		digest: yield* sha256Encoded(UnsignedPlan$1, unsigned)
 	};
 });
 /** Authorizes all or a selected subset of create operations in a digest-bound plan. */
-const authorize$1 = Effect.fn("Provisioning.authorize")(function* (plan, operationIds, options = {}) {
-	yield* validateDigest(plan);
+const authorize$2 = Effect.fn("Provisioning.authorize")(function* (plan, operationIds, options = {}) {
+	yield* validate$1(plan);
 	const createIds = plan.operations.filter((operation) => operation._tag === "create").map(({ id }) => id);
 	const selected = [...new Set(operationIds ?? createIds)].sort();
 	const unknown = selected.filter((id) => !createIds.includes(id));
@@ -586,20 +691,20 @@ const authorize$1 = Effect.fn("Provisioning.authorize")(function* (plan, operati
 	};
 });
 /** Applies approved creates sequentially after full and per-operation revalidation. */
-const apply = Effect.fn("Provisioning.apply")(function* (input) {
+const apply$1 = Effect.fn("Provisioning.apply")(function* (input) {
 	const { authorization, plan } = input;
 	const provider = yield* Service;
-	yield* validateDigest(plan);
+	yield* validate$1(plan);
 	if (authorization.planDigest !== plan.digest) return yield* new AuthorizationError({ message: "Authorization belongs to a different plan" });
 	if (provider.id !== plan.providerId) return yield* new AuthorizationError({ message: "Provider does not match the approved plan" });
 	const conflicts = plan.operations.filter((operation) => operation._tag === "conflict");
 	if (conflicts.length > 0) return yield* new ConflictError({ operationIds: conflicts.map(({ id }) => id) });
-	const creates = plan.operations.filter(Operation.guards.create);
+	const creates = plan.operations.filter(Operation$1.guards.create);
 	const approved = new Set(authorization.operationIds);
 	const unknown = authorization.operationIds.filter((id) => !creates.some((operation) => operation.id === id));
 	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Authorization contains unknown operations: ${unknown.join(", ")}` });
 	if (!authorization.allowPartial && creates.some(({ id }) => !approved.has(id))) return yield* new AuthorizationError({ message: "Authorization does not cover every create operation" });
-	const currentPlan = yield* create({
+	const currentPlan = yield* create$1({
 		requirements: plan.operations.map(({ requirement }) => requirement),
 		zone: plan.zone
 	});
@@ -617,14 +722,14 @@ const apply = Effect.fn("Provisioning.apply")(function* (input) {
 				operationId: operation.id,
 				providerRecordId: result.providerRecordId
 			});
-		}).pipe(Effect.catch((failure) => operations.length === 0 ? Effect.fail(failure) : makeReceipt(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
+		}).pipe(Effect.catch((failure) => operations.length === 0 ? Effect.fail(failure) : makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
 			causeTag: failure._tag,
 			failedOperationId: operation.id,
 			message: failureMessage(failure),
 			receipt
 		}))))), Effect.catchCause((cause) => {
 			if (!Cause.hasInterruptsOnly(cause) || operations.length === 0) return Effect.failCause(cause);
-			return makeReceipt(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
+			return makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
 				causeTag: "Interrupted",
 				failedOperationId: operation.id,
 				message: "DNS apply was interrupted after confirmed writes",
@@ -632,7 +737,7 @@ const apply = Effect.fn("Provisioning.apply")(function* (input) {
 			}))));
 		}));
 	}
-	return yield* makeReceipt(input, operations, "complete");
+	return yield* makeReceipt$1(input, operations, "complete");
 });
 function renderManualInstructions(plan) {
 	return plan.operations.map((operation) => {
@@ -641,7 +746,7 @@ function renderManualInstructions(plan) {
 		return `${operation._tag.toUpperCase()} ${record._tag} ${record.name} ${data$2}`.trim();
 	});
 }
-function makeReceipt(input, operations, status) {
+function makeReceipt$1(input, operations, status) {
 	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
 		appliedAt: new Date(now),
 		operations,
@@ -653,7 +758,7 @@ function makeReceipt(input, operations, status) {
 	})));
 }
 function assertStillCreatable(plan, operation) {
-	return create({
+	return create$1({
 		requirements: [operation.requirement],
 		zone: plan.zone
 	}).pipe(Effect.flatMap((currentPlan) => {
@@ -697,14 +802,14 @@ function reconcileRequirement(requirement, allExisting) {
 		};
 	});
 }
-function validateDigest(plan) {
+function validate$1(plan) {
 	const unsigned = {
 		operations: plan.operations,
 		providerId: plan.providerId,
 		version: plan.version,
 		zone: plan.zone
 	};
-	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new AuthorizationError({ message: "Plan digest does not match its contents" }))));
+	return sha256Encoded(UnsignedPlan$1, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new AuthorizationError({ message: "Plan digest does not match its contents" }))));
 }
 function failureMessage(failure) {
 	return failure._tag === "StalePlanError" ? "DNS state changed while applying the approved plan" : failure.message;
@@ -718,20 +823,207 @@ function compareRecords(left, right) {
 }
 //#endregion
 //#region src/plan/connection-authorization.ts
-var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize });
-const authorize = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
-	yield* Effect.try({
-		try: () => assertGrant(input.connection, {
-			accountId: input.accountId,
+var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize$1 });
+const authorize$1 = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
+	const domain = yield* Effect.try({
+		try: () => assertGrant(input.connection, input.authorization, {
 			capability: "dns:write",
-			domain: input.plan.zone,
+			domain: input.domain,
 			providerId: input.plan.providerId
 		}),
-		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$1 ? cause : new AuthorizationError$1({ message: "Connection grant is invalid" })
+		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$3 ? cause : new AuthorizationError$1({ message: "Connection grant is invalid" })
 	});
-	return yield* authorize$1(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
+	const authorization = yield* authorize$2(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
+	const selected = new Set(authorization.operationIds);
+	if (input.plan.operations.filter((operation) => operation._tag === "create" && selected.has(operation.id) && operation.requirement.name !== domain && !operation.requirement.name.endsWith(`.${domain}`)).length > 0) return yield* new AuthorizationError$1({ message: `Plan operations are outside the granted domain ${domain}` });
+	return authorization;
 });
 //#endregion
+//#region src/plan/deletion.ts
+var deletion_exports = /* @__PURE__ */ __exportAll({
+	Authorization: () => Authorization,
+	Error: () => Error$1,
+	Operation: () => Operation,
+	PartialError: () => PartialError,
+	Plan: () => Plan,
+	Receipt: () => Receipt,
+	apply: () => apply,
+	authorize: () => authorize,
+	create: () => create,
+	validate: () => validate
+});
+const Operation = Schema.Struct({
+	id: Schema.String,
+	providerRecordId: Schema.String,
+	record: Schema$6
+});
+const UnsignedPlan = Schema.Struct({
+	createdAt: Schema.DateFromString,
+	expiresAt: Schema.DateFromString,
+	operations: Schema.Array(Operation),
+	providerId: Schema.String,
+	sourcePlanDigest: Schema.String,
+	version: Schema.Literal("domainkit.deletion-plan.v1"),
+	zone: Schema$5
+});
+const Plan = Schema.Struct({
+	...UnsignedPlan.fields,
+	digest: Schema.String
+});
+const Authorization = Schema.Struct({
+	operationIds: Schema.Array(Schema.String),
+	planDigest: Schema.String,
+	version: Schema.Literal("domainkit.deletion-authorization.v1")
+});
+const Receipt = Schema.Struct({
+	deletedAt: Schema.DateFromString,
+	operations: Schema.Array(Schema.Struct({
+		operationId: Schema.String,
+		providerRecordId: Schema.String
+	})),
+	planDigest: Schema.String,
+	providerId: Schema.String,
+	status: Schema.Literals(["complete", "partial"]),
+	version: Schema.Literal("domainkit.deletion-receipt.v1"),
+	zone: Schema$5
+});
+var Error$1 = class extends Schema.TaggedError()("UnsafeDeletionError", {
+	message: Schema.String,
+	operationId: Schema.optionalKey(Schema.String)
+}) {};
+var PartialError = class extends Schema.TaggedError()("PartialDeletionError", {
+	failedOperationId: Schema.String,
+	message: Schema.String,
+	receipt: Receipt
+}) {};
+/** Build a fresh deletion plan only from records proven by a prior create receipt. */
+const create = Effect.fn("Deletion.create")(function* (input) {
+	const provider = yield* Service;
+	yield* validate$1(input.plan);
+	if (input.receipt.planDigest !== input.plan.digest || input.receipt.providerId !== input.plan.providerId || input.receipt.zone !== input.plan.zone) return yield* new Error$1({ message: "Create receipt does not belong to the source plan" });
+	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the source receipt" });
+	const operations = yield* Effect.forEach(input.receipt.operations, (applied) => Effect.gen(function* () {
+		const source = input.plan.operations.find((operation) => operation._tag === "create" && operation.id === applied.operationId);
+		if (source === void 0 || source._tag !== "create") return yield* new Error$1({
+			message: "Receipt operation is not a created source record",
+			operationId: applied.operationId
+		});
+		if (applied.providerRecordId === null) return yield* new Error$1({
+			message: "Provider record ID is required for safe deletion",
+			operationId: applied.operationId
+		});
+		yield* assertExact(provider, input.plan.zone, applied.providerRecordId, source.requirement, source.id);
+		return {
+			id: source.id,
+			providerRecordId: applied.providerRecordId,
+			record: source.requirement
+		};
+	}));
+	const now = yield* Clock.currentTimeMillis;
+	const unsigned = {
+		createdAt: new Date(now),
+		expiresAt: new Date(now + (input.ttlMs ?? 9e5)),
+		operations,
+		providerId: input.plan.providerId,
+		sourcePlanDigest: input.plan.digest,
+		version: "domainkit.deletion-plan.v1",
+		zone: input.plan.zone
+	};
+	return {
+		...unsigned,
+		digest: yield* sha256Encoded(UnsignedPlan, unsigned)
+	};
+});
+/** Produce a separate digest-bound consent artifact for destructive operations. */
+const authorize = Effect.fn("Deletion.authorize")(function* (plan, operationIds) {
+	yield* validate(plan);
+	const selected = [...new Set(operationIds ?? plan.operations.map(({ id }) => id))].sort();
+	const unknown = selected.filter((id) => !plan.operations.some((operation) => operation.id === id));
+	if (unknown.length > 0) return yield* new Error$1({ message: `Unknown deletion operation IDs: ${unknown.join(", ")}` });
+	return {
+		operationIds: selected,
+		planDigest: plan.digest,
+		version: "domainkit.deletion-authorization.v1"
+	};
+});
+/** Re-read every approved record before the first delete, then delete by provider record ID. */
+const apply = Effect.fn("Deletion.apply")(function* (input) {
+	const provider = yield* Service;
+	yield* validate(input.plan);
+	if (input.authorization.planDigest !== input.plan.digest) return yield* new Error$1({ message: "Deletion authorization belongs to a different plan" });
+	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the deletion plan" });
+	const now = yield* Clock.currentTimeMillis;
+	if (input.plan.expiresAt <= new Date(now)) return yield* new Error$1({ message: "Deletion plan has expired" });
+	const selected = input.plan.operations.filter(({ id }) => input.authorization.operationIds.includes(id));
+	if (selected.length !== input.authorization.operationIds.length) return yield* new Error$1({ message: "Deletion authorization contains unknown operations" });
+	const previouslyDeleted = yield* validatePriorReceipt(input.plan, input.priorReceipt);
+	const completedIds = new Set(previouslyDeleted.map(({ operationId }) => operationId));
+	if (previouslyDeleted.some(({ operationId }) => !input.authorization.operationIds.includes(operationId))) return yield* new Error$1({ message: "Prior receipt contains an unauthorized operation" });
+	const remaining = selected.filter(({ id }) => !completedIds.has(id));
+	yield* Effect.forEach(remaining, (operation) => assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id));
+	const deleted = [...previouslyDeleted];
+	for (const operation of remaining) {
+		const failure = yield* Effect.gen(function* () {
+			yield* assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id);
+			yield* provider.deleteRecord(input.plan.zone, operation.providerRecordId);
+			deleted.push({
+				operationId: operation.id,
+				providerRecordId: operation.providerRecordId
+			});
+		}).pipe(Effect.match({
+			onFailure: (cause) => cause,
+			onSuccess: () => null
+		}));
+		if (failure !== null) {
+			if (deleted.length === 0) return yield* failure;
+			return yield* new PartialError({
+				failedOperationId: operation.id,
+				message: failure.message,
+				receipt: yield* makeReceipt(input.plan, deleted, "partial")
+			});
+		}
+	}
+	return yield* makeReceipt(input.plan, deleted, "complete");
+});
+function validate(plan) {
+	const unsigned = {
+		createdAt: plan.createdAt,
+		expiresAt: plan.expiresAt,
+		operations: plan.operations,
+		providerId: plan.providerId,
+		sourcePlanDigest: plan.sourcePlanDigest,
+		version: plan.version,
+		zone: plan.zone
+	};
+	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new Error$1({ message: "Deletion plan digest does not match its contents" }))));
+}
+function validatePriorReceipt(plan, receipt) {
+	if (receipt === void 0) return Effect.succeed([]);
+	if (receipt.planDigest !== plan.digest || receipt.providerId !== plan.providerId || receipt.zone !== plan.zone || receipt.status !== "partial") return Effect.fail(new Error$1({ message: "Prior receipt does not belong to this deletion plan" }));
+	for (const completed of receipt.operations) {
+		const operation = plan.operations.find(({ id }) => id === completed.operationId);
+		if (operation === void 0 || operation.providerRecordId !== completed.providerRecordId) return Effect.fail(new Error$1({ message: "Prior receipt operation does not match the deletion plan" }));
+	}
+	return Effect.succeed([...receipt.operations]);
+}
+function assertExact(provider, zone, providerRecordId, expected, operationId) {
+	return provider.getRecord(zone, providerRecordId).pipe(Effect.flatMap((observed) => observed !== null && observed._tag !== "Opaque" && equals(observed, expected) ? Effect.void : Effect.fail(new Error$1({
+		message: observed === null ? "Created record no longer exists" : "Created record content no longer matches its receipt",
+		operationId
+	}))));
+}
+function makeReceipt(plan, operations, status) {
+	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
+		deletedAt: new Date(now),
+		operations,
+		planDigest: plan.digest,
+		providerId: plan.providerId,
+		status,
+		version: "domainkit.deletion-receipt.v1",
+		zone: plan.zone
+	})));
+}
+//#endregion
 //#region src/verification/dns-data.ts
 var dns_data_exports = /* @__PURE__ */ __exportAll({ parse: () => parse });
 const CanonicalAddress = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
@@ -775,7 +1067,7 @@ function parse(type, input) {
 	try {
 		return Schema.decodeUnknownSync(schema)(input);
 	} catch (cause) {
-		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
+		throw new Error$3({ message: cause instanceof Error ? cause.message : String(cause) });
 	}
 }
 function tokenizedDomain(length, domainIndex) {
@@ -812,19 +1104,19 @@ function make$1(options) {
 			timeoutMs,
 			endpoint: options.endpoint
 		}),
-		catch: (cause) => cause instanceof Error$3 ? cause : new Error$3({
+		catch: (cause) => cause instanceof Error$5 ? cause : new Error$5({
 			cause,
 			message: cause instanceof Error ? cause.message : "DNS resolution failed",
 			reason: "transport"
 		})
 	}).pipe(Effect.flatMap((message) => decodeResolution(query, message)))) };
 }
-const layer$1 = (options) => Layer.succeed(Service$4, make$1(options));
+const layer$1 = (options) => Layer.succeed(Service$5, make$1(options));
 const toAsync$1 = (options) => toAsync$2(make$1(options));
 function decodeResolution(query, message) {
 	return Effect.try({
 		try: () => DnsPacket.decode(message),
-		catch: (cause) => new Error$3({
+		catch: (cause) => new Error$5({
 			cause,
 			message: "DoH returned an invalid DNS message",
 			reason: "response"
@@ -833,7 +1125,7 @@ function decodeResolution(query, message) {
 }
 function decodePacket(packet) {
 	if (packet.rcode === "NXDOMAIN") return Effect.succeed({ _tag: "nodata" });
-	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$3({
+	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$5({
 		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
 		reason: "response"
 	}));
@@ -859,7 +1151,7 @@ function validatePacket(query, packet) {
 			if (question.class !== "IN" || question.type !== query.type || parse$1(question.name) !== query.name) throw new Error("DoH response did not match the DNS question");
 			return packet;
 		},
-		catch: (cause) => new Error$3({
+		catch: (cause) => new Error$5({
 			cause,
 			message: cause instanceof Error ? cause.message : "DoH returned an invalid DNS response",
 			reason: "response"
@@ -871,23 +1163,23 @@ function decodeAnswer(answer) {
 		if (answer.class !== "IN") return null;
 		const decoded = yield* Effect.try({
 			try: () => answerData(answer),
-			catch: (cause) => new Error$3({
+			catch: (cause) => new Error$5({
 				cause,
 				message: "DoH returned invalid DNS record data",
 				reason: "response"
 			})
 		});
 		if (decoded === void 0) return null;
-		const name = yield* decode$3(answer.name);
+		const name = yield* decode$4(answer.name);
 		const data = yield* Effect.try({
 			try: () => parse(decoded.type, decoded.data),
-			catch: (cause) => new Error$3({
+			catch: (cause) => new Error$5({
 				cause,
 				message: "DoH returned invalid DNS record data",
 				reason: "response"
 			})
 		});
-		if (answer.ttl === void 0) return yield* new Error$3({
+		if (answer.ttl === void 0) return yield* new Error$5({
 			message: "DoH response omitted the DNS record TTL",
 			reason: "response"
 		});
@@ -897,7 +1189,7 @@ function decodeAnswer(answer) {
 			ttl: answer.ttl,
 			type: decoded.type
 		};
-	}).pipe(Effect.mapError((cause) => cause instanceof Error$3 ? cause : new Error$3({
+	}).pipe(Effect.mapError((cause) => cause instanceof Error$5 ? cause : new Error$5({
 		cause,
 		message: cause.message,
 		reason: "response"
@@ -981,18 +1273,18 @@ async function request(input) {
 			method: "POST",
 			signal: controller.signal
 		});
-		if (!response.ok) throw new Error$3({
+		if (!response.ok) throw new Error$5({
 			message: `DoH returned HTTP ${response.status}`,
 			reason: "transport"
 		});
 		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-		if (contentType !== "application/dns-message") throw new Error$3({
+		if (contentType !== "application/dns-message") throw new Error$5({
 			message: `DoH returned unsupported content type ${contentType ?? "<missing>"}`,
 			reason: "response"
 		});
 		return new Uint8Array(await response.arrayBuffer());
 	} catch (cause) {
-		if (timedOut) throw new Error$3({
+		if (timedOut) throw new Error$5({
 			message: "DNS query timed out",
 			reason: "timeout"
 		});
@@ -1017,7 +1309,7 @@ function make(options = {}) {
 		endpoint: options.endpoint ?? endpoint
 	});
 }
-const layer = (options = {}) => Layer.succeed(Service$4, make(options));
+const layer = (options = {}) => Layer.succeed(Service$5, make(options));
 const toAsync = (options = {}) => toAsync$2(make(options));
 //#endregion
 //#region src/verification/verify.ts
@@ -1030,7 +1322,7 @@ var verify_exports = /* @__PURE__ */ __exportAll({
 const ProviderObservation = Schema.TaggedUnion({
 	match: {},
 	missing: {},
-	mismatch: { records: Schema.Array(Schema$5) },
+	mismatch: { records: Schema.Array(Schema$6) },
 	failure: { message: Schema.String }
 });
 const PublicDnsObservation = Schema.TaggedUnion({
@@ -1052,7 +1344,7 @@ const Result = Schema.Struct({
 });
 const record = Effect.fn("Verification.record")(function* (input) {
 	const provider = yield* Service;
-	const resolver = yield* Service$4;
+	const resolver = yield* Service$5;
 	const [providerObservation, publicDns] = yield* Effect.all([observeProvider(provider, input.zone, input.record).pipe(Effect.catch((failure) => Effect.succeed({
 		_tag: "failure",
 		message: failure.message
@@ -1104,6 +1396,6 @@ function recordValue(requirement) {
 	}
 }
 //#endregion
-export { decode$1 as A, Capability as B, types_exports as C, token_exports as D, connect as E, refresh as F, decode$2 as G, Schema$3 as H, revoke as I, encode$1 as K, canonical_json_exports as L, begin as M, complete as N, Method as O, oauth_exports as P, webCryptoLayer as R, encodeReceipt as S, zones_exports as T, assertGrant as U, Grant as V, connection_exports as W, Receipt as _, doh_exports as a, decodeReceipt as b, authorize as c, authorize$1 as d, create as f, Operation as g, Authorization as h, toAsync as i, manifest_exports as j, Schema$2 as k, connection_authorization_exports as l, renderManualInstructions as m, verify_exports as n, toAsync$1 as o, plan_exports as p, version as q, cloudflare_doh_exports as r, dns_data_exports as s, record as t, apply as u, Schema$1 as v, selection_exports as w, encode as x, decode as y, AuthorizationError$1 as z };
+export { encode$1 as $, decodeReceipt as A, decode$1 as B, plan_exports as C, Receipt$1 as D, Operation$1 as E, zones_exports as F, refresh as G, begin as H, connect as I, webCryptoLayer as J, revoke as K, token_exports as L, encodeReceipt as M, types_exports as N, Schema$1 as O, selection_exports as P, decode$2 as Q, Method as R, create$1 as S, Authorization$1 as T, complete as U, manifest_exports as V, oauth_exports as W, Schema$3 as X, Capability as Y, authorization_exports as Z, deletion_exports as _, doh_exports as a, Grant as at, apply$1 as b, Authorization as c, connection_exports as ct, PartialError as d, version as dt, Error$2 as et, Plan as f, create as g, authorize as h, toAsync as i, AuthorizationError$1 as it, encode as j, decode as k, Error$1 as l, decode$3 as lt, apply as m, verify_exports as n, detach as nt, toAsync$1 as o, Schema$4 as ot, Receipt as p, canonical_json_exports as q, cloudflare_doh_exports as r, updateGrant as rt, dns_data_exports as s, assertGrant as st, record as t, connection_lifecycle_exports as tt, Operation as u, encode$2 as ut, authorize$1 as v, renderManualInstructions as w, authorize$2 as x, connection_authorization_exports as y, Schema$2 as z };
 
-//# sourceMappingURL=verify-CeMW6XtK.mjs.map
+//# sourceMappingURL=verify-BjrR_4NF.mjs.map