domainkit 0.1.0 → 0.2.0

package/dist/resolver-CxE-VDw4.mjs

@@ -0,0 +1,598 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { E as decode$1, T as Schema$2, _ as equals, b as Service$2, h as decode$2, k as Error$2, m as data, p as Type, s as Observed, u as Schema$3 } from "./dns-record-BLeqo56C.mjs";
+import { t as candidates } from "./zones-DKHTpX9C.mjs";
+import { n as sha256Encoded, r as stringify } from "./canonical-json-CpvqGMcr.mjs";
+import { Cause, Clock, Context, Data, Effect, Layer, Schema } from "effect";
+//#region src/discovery/zone-discovery.ts
+var zone_discovery_exports = /* @__PURE__ */ __exportAll({
+	Candidate: () => Candidate,
+	Outcome: () => Outcome,
+	Service: () => Service$1,
+	make: () => make
+});
+/** Display-safe identity and nameserver evidence for one provider-owned zone. */
+const Candidate = Schema.Struct({
+	accountId: Schema.String,
+	id: Schema.String,
+	name: Schema$2,
+	nameservers: Schema.Array(Schema$2),
+	providerId: Schema.String,
+	status: Schema.Literals([
+		"active",
+		"pending",
+		"unknown"
+	])
+});
+const Outcome = Data.taggedEnum();
+var Service$1 = class extends Context.Service()("@domainkit/ZoneDiscovery") {};
+/** Compose provider-account discovery sources without expanding the record-provider contract. */
+function make(sources) {
+	return Service$1.of({ discover: Effect.fn("ZoneDiscovery.discover")(function* (domain) {
+		for (const name of candidates(domain)) {
+			const matches = deduplicate((yield* Effect.forEach(sources, (source) => source.listZones(name).pipe(Effect.map((zones) => zones.filter((zone) => zone.name === name).map((zone) => ({
+				candidate: {
+					...zone,
+					providerId: source.provider.id
+				},
+				provider: source.provider
+			})))), { concurrency: "unbounded" })).flat());
+			const match = matches[0];
+			if (matches.length === 1 && match !== void 0) return Outcome.Resolved(match);
+			if (matches.length > 1) return Outcome.SelectionRequired({ candidates: matches.map(({ candidate }) => candidate) });
+		}
+		return Outcome.NotFound({ domain });
+	}) });
+}
+function deduplicate(matches) {
+	const unique = /* @__PURE__ */ new Map();
+	for (const match of matches) {
+		const key = [
+			match.candidate.providerId,
+			match.candidate.accountId,
+			match.candidate.id,
+			match.candidate.name
+		].join(":");
+		if (unique.get(key) === void 0) unique.set(key, match);
+	}
+	return [...unique.values()].sort((left, right) => candidateKey(left.candidate).localeCompare(candidateKey(right.candidate)));
+}
+function candidateKey(candidate) {
+	return [
+		candidate.name,
+		candidate.providerId,
+		candidate.accountId,
+		candidate.id
+	].join(":");
+}
+//#endregion
+//#region src/plan/types.ts
+var types_exports = /* @__PURE__ */ __exportAll({
+	Authorization: () => Authorization$1,
+	Operation: () => Operation$1,
+	Receipt: () => Receipt$1,
+	Schema: () => Schema$1,
+	decode: () => decode,
+	decodeReceipt: () => decodeReceipt,
+	encode: () => encode,
+	encodeReceipt: () => encodeReceipt
+});
+const Operation$1 = Schema.TaggedUnion({
+	create: {
+		id: Schema.String,
+		requirement: Schema$3
+	},
+	noop: {
+		id: Schema.String,
+		requirement: Schema$3,
+		ttlDrift: Schema.Boolean
+	},
+	conflict: {
+		existing: Schema.Array(Observed),
+		id: Schema.String,
+		reason: Schema.String,
+		requirement: Schema$3
+	}
+});
+const Schema$1 = Schema.Struct({
+	digest: Schema.String,
+	operations: Schema.Array(Operation$1),
+	providerId: Schema.String,
+	version: Schema.Literal("domainkit.dns-plan.v1"),
+	zone: Schema$2
+});
+const Authorization$1 = Schema.Struct({
+	allowPartial: Schema.Boolean,
+	operationIds: Schema.Array(Schema.String),
+	planDigest: Schema.String,
+	version: Schema.Literal("domainkit.plan-authorization.v1")
+});
+const Receipt$1 = Schema.Struct({
+	appliedAt: Schema.DateFromString,
+	operations: Schema.Array(Schema.Struct({
+		operationId: Schema.String,
+		providerRecordId: Schema.NullOr(Schema.String)
+	})),
+	planDigest: Schema.String,
+	providerId: Schema.String,
+	status: Schema.Literals(["complete", "partial"]),
+	version: Schema.Literal("domainkit.apply-receipt.v1"),
+	zone: Schema$2
+});
+const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encode = Schema.encodeSync(Schema$1);
+const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encodeReceipt = Schema.encodeSync(Receipt$1);
+//#endregion
+//#region src/plan/plan.ts
+var plan_exports = /* @__PURE__ */ __exportAll({
+	AuthorizationError: () => AuthorizationError,
+	ConflictError: () => ConflictError,
+	CreateResult: () => CreateResult,
+	PartialApplyError: () => PartialApplyError,
+	StaleError: () => StaleError,
+	Target: () => Target,
+	apply: () => apply$1,
+	authorize: () => authorize$1,
+	create: () => create$1,
+	renderManualInstructions: () => renderManualInstructions,
+	validate: () => validate$1
+});
+const UnsignedPlan$1 = Schema.Struct({
+	operations: Schema.Array(Operation$1),
+	providerId: Schema.String,
+	version: Schema.Literal("domainkit.dns-plan.v1"),
+	zone: Schema$2
+});
+const RequirementDigest = Schema.Struct({ requirement: Schema$3 });
+var ConflictError = class extends Schema.TaggedError()("PlanConflictError", { operationIds: Schema.Array(Schema.String) }) {};
+var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
+var StaleError = class extends Schema.TaggedError()("StalePlanError", {
+	approvedPlanDigest: Schema.String,
+	currentPlanDigest: Schema.String
+}) {};
+var PartialApplyError = class extends Schema.TaggedError()("PartialApplyError", {
+	causeTag: Schema.Literals([
+		"CryptoError",
+		"InvalidInputError",
+		"Interrupted",
+		"ProviderError",
+		"StalePlanError"
+	]),
+	failedOperationId: Schema.String,
+	message: Schema.String,
+	receipt: Receipt$1
+}) {};
+const Target = Data.taggedEnum();
+const CreateResult = Data.taggedEnum();
+function create$1(input) {
+	const target = input.target;
+	if (target._tag === "ExactZone") return Effect.gen(function* () {
+		const provider = yield* Service$2;
+		const zone = yield* decode$1(target.zone);
+		return CreateResult.Resolved({
+			candidate: null,
+			plan: yield* planAgainst(provider, zone, input.requirements)
+		});
+	}).pipe(Effect.withSpan("Provisioning.create"));
+	return Effect.gen(function* () {
+		const discovery = yield* Service$1;
+		const domain = yield* decode$1(target.domain);
+		const outcome = yield* discovery.discover(domain);
+		switch (outcome._tag) {
+			case "NotFound": return CreateResult.NotFound({ domain: outcome.domain });
+			case "SelectionRequired": return CreateResult.SelectionRequired({ candidates: outcome.candidates });
+			case "Resolved": return CreateResult.Resolved({
+				candidate: outcome.candidate,
+				plan: yield* planAgainst(outcome.provider, outcome.candidate.name, input.requirements)
+			});
+		}
+	}).pipe(Effect.withSpan("Provisioning.create"));
+}
+const planAgainst = Effect.fn("Provisioning.planAgainst")(function* (provider, zone, inputs) {
+	const requirements = (yield* Effect.forEach(inputs, decode$2, { concurrency: "unbounded" })).sort(compareRecords);
+	const existing = [...yield* provider.listRecords(zone)].sort(compareRecords);
+	const { operations } = yield* Effect.reduce(requirements, () => ({
+		operations: [],
+		projected: existing
+	}), (state, requirement) => reconcileRequirement(requirement, state.projected).pipe(Effect.map((operation) => ({
+		operations: [...state.operations, operation],
+		projected: operation._tag === "create" ? [...state.projected, operation.requirement].sort(compareRecords) : state.projected
+	}))));
+	const unsigned = {
+		operations,
+		providerId: provider.id,
+		version: "domainkit.dns-plan.v1",
+		zone
+	};
+	return {
+		...unsigned,
+		digest: yield* sha256Encoded(UnsignedPlan$1, unsigned)
+	};
+});
+/** Authorizes all or a selected subset of create operations in a digest-bound plan. */
+const authorize$1 = Effect.fn("Provisioning.authorize")(function* (plan, operationIds, options = {}) {
+	yield* validate$1(plan);
+	const createIds = plan.operations.filter((operation) => operation._tag === "create").map(({ id }) => id);
+	const selected = [...new Set(operationIds ?? createIds)].sort();
+	const unknown = selected.filter((id) => !createIds.includes(id));
+	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Unknown operation IDs: ${unknown.join(", ")}` });
+	if (!options.allowPartial && selected.length !== createIds.length) return yield* new AuthorizationError({ message: "Partial authorization requires allowPartial" });
+	return {
+		allowPartial: options.allowPartial ?? false,
+		operationIds: selected,
+		planDigest: plan.digest,
+		version: "domainkit.plan-authorization.v1"
+	};
+});
+/** Applies approved creates sequentially after full and per-operation revalidation. */
+const apply$1 = Effect.fn("Provisioning.apply")(function* (input) {
+	const { authorization, plan } = input;
+	const provider = yield* Service$2;
+	yield* validate$1(plan);
+	if (authorization.planDigest !== plan.digest) return yield* new AuthorizationError({ message: "Authorization belongs to a different plan" });
+	if (provider.id !== plan.providerId) return yield* new AuthorizationError({ message: "Provider does not match the approved plan" });
+	const conflicts = plan.operations.filter((operation) => operation._tag === "conflict");
+	if (conflicts.length > 0) return yield* new ConflictError({ operationIds: conflicts.map(({ id }) => id) });
+	const creates = plan.operations.filter(Operation$1.guards.create);
+	const approved = new Set(authorization.operationIds);
+	const unknown = authorization.operationIds.filter((id) => !creates.some((operation) => operation.id === id));
+	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Authorization contains unknown operations: ${unknown.join(", ")}` });
+	if (!authorization.allowPartial && creates.some(({ id }) => !approved.has(id))) return yield* new AuthorizationError({ message: "Authorization does not cover every create operation" });
+	const currentPlan = yield* planAgainst(provider, plan.zone, plan.operations.map(({ requirement }) => requirement));
+	if (currentPlan.digest !== plan.digest) return yield* new StaleError({
+		approvedPlanDigest: plan.digest,
+		currentPlanDigest: currentPlan.digest
+	});
+	const operations = [];
+	for (const operation of creates) {
+		if (!approved.has(operation.id)) continue;
+		yield* Effect.gen(function* () {
+			yield* assertStillCreatable(plan, operation);
+			const result = yield* provider.createRecord(plan.zone, operation.requirement);
+			operations.push({
+				operationId: operation.id,
+				providerRecordId: result.providerRecordId
+			});
+		}).pipe(Effect.catch((failure) => operations.length === 0 ? Effect.fail(failure) : makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
+			causeTag: failure._tag,
+			failedOperationId: operation.id,
+			message: failureMessage(failure),
+			receipt
+		}))))), Effect.catchCause((cause) => {
+			if (!Cause.hasInterruptsOnly(cause) || operations.length === 0) return Effect.failCause(cause);
+			return makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
+				causeTag: "Interrupted",
+				failedOperationId: operation.id,
+				message: "DNS apply was interrupted after confirmed writes",
+				receipt
+			}))));
+		}));
+	}
+	return yield* makeReceipt$1(input, operations, "complete");
+});
+function renderManualInstructions(plan) {
+	return plan.operations.map((operation) => {
+		const record = operation.requirement;
+		const data$1 = Object.entries(data(record)).map(([key, value]) => `${key}=${value}`).join(" ");
+		return `${operation._tag.toUpperCase()} ${record._tag} ${record.name} ${data$1}`.trim();
+	});
+}
+function makeReceipt$1(input, operations, status) {
+	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
+		appliedAt: new Date(now),
+		operations,
+		planDigest: input.plan.digest,
+		providerId: input.plan.providerId,
+		status,
+		version: "domainkit.apply-receipt.v1",
+		zone: input.plan.zone
+	})));
+}
+function assertStillCreatable(plan, operation) {
+	return Service$2.pipe(Effect.flatMap((provider) => planAgainst(provider, plan.zone, [operation.requirement])), Effect.flatMap((currentPlan) => {
+		const currentOperation = currentPlan.operations[0];
+		return currentOperation?._tag === "create" && currentOperation.id === operation.id ? Effect.void : Effect.fail(new StaleError({
+			approvedPlanDigest: plan.digest,
+			currentPlanDigest: currentPlan.digest
+		}));
+	}));
+}
+function reconcileRequirement(requirement, allExisting) {
+	return Effect.gen(function* () {
+		const sameName = allExisting.filter((record) => record.name === requirement.name);
+		const sameSet = sameName.filter((record) => record._tag !== "Opaque" && record._tag === requirement._tag);
+		const exact = sameSet.find((record) => equals(record, requirement));
+		const id = yield* sha256Encoded(RequirementDigest, { requirement });
+		if (exact !== void 0) return {
+			_tag: "noop",
+			id,
+			requirement,
+			ttlDrift: exact.ttl !== requirement.ttl
+		};
+		if (sameName.length > 0 && (requirement._tag === "CNAME" || sameName.some((record) => record._tag === "CNAME"))) return {
+			_tag: "conflict",
+			existing: sameName,
+			id,
+			reason: "CNAME records cannot coexist with other records at the same name",
+			requirement
+		};
+		if (sameSet.length > 0 && (requirement.policy === "exclusive" || sameSet.some(({ policy }) => policy === "exclusive"))) return {
+			_tag: "conflict",
+			existing: sameSet,
+			id,
+			reason: "The exclusive record set already contains incompatible data",
+			requirement
+		};
+		return {
+			_tag: "create",
+			id,
+			requirement
+		};
+	});
+}
+function validate$1(plan) {
+	const unsigned = {
+		operations: plan.operations,
+		providerId: plan.providerId,
+		version: plan.version,
+		zone: plan.zone
+	};
+	return sha256Encoded(UnsignedPlan$1, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new AuthorizationError({ message: "Plan digest does not match its contents" }))));
+}
+function failureMessage(failure) {
+	return failure._tag === "StalePlanError" ? "DNS state changed while applying the approved plan" : failure.message;
+}
+function compareRecords(left, right) {
+	const encode = Schema.encodeSync(Observed);
+	const toJson = Schema.decodeUnknownSync(Schema.Json);
+	const leftJson = stringify(toJson(encode(left)));
+	const rightJson = stringify(toJson(encode(right)));
+	return leftJson < rightJson ? -1 : leftJson > rightJson ? 1 : 0;
+}
+//#endregion
+//#region src/plan/deletion.ts
+var deletion_exports = /* @__PURE__ */ __exportAll({
+	Authorization: () => Authorization,
+	Error: () => Error$1,
+	Operation: () => Operation,
+	PartialError: () => PartialError,
+	Plan: () => Plan,
+	Receipt: () => Receipt,
+	apply: () => apply,
+	authorize: () => authorize,
+	create: () => create,
+	validate: () => validate
+});
+const Operation = Schema.Struct({
+	id: Schema.String,
+	providerRecordId: Schema.String,
+	record: Schema$3
+});
+const UnsignedPlan = Schema.Struct({
+	createdAt: Schema.DateFromString,
+	expiresAt: Schema.DateFromString,
+	operations: Schema.Array(Operation),
+	providerId: Schema.String,
+	sourcePlanDigest: Schema.String,
+	version: Schema.Literal("domainkit.deletion-plan.v1"),
+	zone: Schema$2
+});
+const Plan = Schema.Struct({
+	...UnsignedPlan.fields,
+	digest: Schema.String
+});
+const Authorization = Schema.Struct({
+	operationIds: Schema.Array(Schema.String),
+	planDigest: Schema.String,
+	version: Schema.Literal("domainkit.deletion-authorization.v1")
+});
+const Receipt = Schema.Struct({
+	deletedAt: Schema.DateFromString,
+	operations: Schema.Array(Schema.Struct({
+		operationId: Schema.String,
+		providerRecordId: Schema.String
+	})),
+	planDigest: Schema.String,
+	providerId: Schema.String,
+	status: Schema.Literals(["complete", "partial"]),
+	version: Schema.Literal("domainkit.deletion-receipt.v1"),
+	zone: Schema$2
+});
+var Error$1 = class extends Schema.TaggedError()("UnsafeDeletionError", {
+	message: Schema.String,
+	operationId: Schema.optionalKey(Schema.String)
+}) {};
+var PartialError = class extends Schema.TaggedError()("PartialDeletionError", {
+	failedOperationId: Schema.String,
+	message: Schema.String,
+	receipt: Receipt
+}) {};
+/** Build a fresh deletion plan only from records proven by a prior create receipt. */
+const create = Effect.fn("Deletion.create")(function* (input) {
+	const provider = yield* Service$2;
+	yield* validate$1(input.plan);
+	if (input.receipt.planDigest !== input.plan.digest || input.receipt.providerId !== input.plan.providerId || input.receipt.zone !== input.plan.zone) return yield* new Error$1({ message: "Create receipt does not belong to the source plan" });
+	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the source receipt" });
+	const operations = yield* Effect.forEach(input.receipt.operations, (applied) => Effect.gen(function* () {
+		const source = input.plan.operations.find((operation) => operation._tag === "create" && operation.id === applied.operationId);
+		if (source === void 0 || source._tag !== "create") return yield* new Error$1({
+			message: "Receipt operation is not a created source record",
+			operationId: applied.operationId
+		});
+		if (applied.providerRecordId === null) return yield* new Error$1({
+			message: "Provider record ID is required for safe deletion",
+			operationId: applied.operationId
+		});
+		yield* assertExact(provider, input.plan.zone, applied.providerRecordId, source.requirement, source.id);
+		return {
+			id: source.id,
+			providerRecordId: applied.providerRecordId,
+			record: source.requirement
+		};
+	}));
+	const now = yield* Clock.currentTimeMillis;
+	const unsigned = {
+		createdAt: new Date(now),
+		expiresAt: new Date(now + (input.ttlMs ?? 9e5)),
+		operations,
+		providerId: input.plan.providerId,
+		sourcePlanDigest: input.plan.digest,
+		version: "domainkit.deletion-plan.v1",
+		zone: input.plan.zone
+	};
+	return {
+		...unsigned,
+		digest: yield* sha256Encoded(UnsignedPlan, unsigned)
+	};
+});
+/** Produce a separate digest-bound consent artifact for destructive operations. */
+const authorize = Effect.fn("Deletion.authorize")(function* (plan, operationIds) {
+	yield* validate(plan);
+	const selected = [...new Set(operationIds ?? plan.operations.map(({ id }) => id))].sort();
+	const unknown = selected.filter((id) => !plan.operations.some((operation) => operation.id === id));
+	if (unknown.length > 0) return yield* new Error$1({ message: `Unknown deletion operation IDs: ${unknown.join(", ")}` });
+	return {
+		operationIds: selected,
+		planDigest: plan.digest,
+		version: "domainkit.deletion-authorization.v1"
+	};
+});
+/** Re-read every approved record before the first delete, then delete by provider record ID. */
+const apply = Effect.fn("Deletion.apply")(function* (input) {
+	const provider = yield* Service$2;
+	yield* validate(input.plan);
+	if (input.authorization.planDigest !== input.plan.digest) return yield* new Error$1({ message: "Deletion authorization belongs to a different plan" });
+	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the deletion plan" });
+	const now = yield* Clock.currentTimeMillis;
+	if (input.plan.expiresAt <= new Date(now)) return yield* new Error$1({ message: "Deletion plan has expired" });
+	const selected = input.plan.operations.filter(({ id }) => input.authorization.operationIds.includes(id));
+	if (selected.length !== input.authorization.operationIds.length) return yield* new Error$1({ message: "Deletion authorization contains unknown operations" });
+	const previouslyDeleted = yield* validatePriorReceipt(input.plan, input.priorReceipt);
+	const completedIds = new Set(previouslyDeleted.map(({ operationId }) => operationId));
+	if (previouslyDeleted.some(({ operationId }) => !input.authorization.operationIds.includes(operationId))) return yield* new Error$1({ message: "Prior receipt contains an unauthorized operation" });
+	const remaining = selected.filter(({ id }) => !completedIds.has(id));
+	yield* Effect.forEach(remaining, (operation) => assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id));
+	const deleted = [...previouslyDeleted];
+	for (const operation of remaining) {
+		const failure = yield* Effect.gen(function* () {
+			yield* assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id);
+			yield* provider.deleteRecord(input.plan.zone, operation.providerRecordId);
+			deleted.push({
+				operationId: operation.id,
+				providerRecordId: operation.providerRecordId
+			});
+		}).pipe(Effect.match({
+			onFailure: (cause) => cause,
+			onSuccess: () => null
+		}));
+		if (failure !== null) {
+			if (deleted.length === 0) return yield* failure;
+			return yield* new PartialError({
+				failedOperationId: operation.id,
+				message: failure.message,
+				receipt: yield* makeReceipt(input.plan, deleted, "partial")
+			});
+		}
+	}
+	return yield* makeReceipt(input.plan, deleted, "complete");
+});
+function validate(plan) {
+	const unsigned = {
+		createdAt: plan.createdAt,
+		expiresAt: plan.expiresAt,
+		operations: plan.operations,
+		providerId: plan.providerId,
+		sourcePlanDigest: plan.sourcePlanDigest,
+		version: plan.version,
+		zone: plan.zone
+	};
+	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new Error$1({ message: "Deletion plan digest does not match its contents" }))));
+}
+function validatePriorReceipt(plan, receipt) {
+	if (receipt === void 0) return Effect.succeed([]);
+	if (receipt.planDigest !== plan.digest || receipt.providerId !== plan.providerId || receipt.zone !== plan.zone || receipt.status !== "partial") return Effect.fail(new Error$1({ message: "Prior receipt does not belong to this deletion plan" }));
+	for (const completed of receipt.operations) {
+		const operation = plan.operations.find(({ id }) => id === completed.operationId);
+		if (operation === void 0 || operation.providerRecordId !== completed.providerRecordId) return Effect.fail(new Error$1({ message: "Prior receipt operation does not match the deletion plan" }));
+	}
+	return Effect.succeed([...receipt.operations]);
+}
+function assertExact(provider, zone, providerRecordId, expected, operationId) {
+	return provider.getRecord(zone, providerRecordId).pipe(Effect.flatMap((observed) => observed !== null && observed._tag !== "Opaque" && equals(observed, expected) ? Effect.void : Effect.fail(new Error$1({
+		message: observed === null ? "Created record no longer exists" : "Created record content no longer matches its receipt",
+		operationId
+	}))));
+}
+function makeReceipt(plan, operations, status) {
+	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
+		deletedAt: new Date(now),
+		operations,
+		planDigest: plan.digest,
+		providerId: plan.providerId,
+		status,
+		version: "domainkit.deletion-receipt.v1",
+		zone: plan.zone
+	})));
+}
+//#endregion
+//#region src/verification/resolver.ts
+var resolver_exports = /* @__PURE__ */ __exportAll({
+	Answer: () => Answer,
+	Error: () => Error,
+	Resolution: () => Resolution,
+	Service: () => Service,
+	layerFromAsync: () => layerFromAsync,
+	toAsync: () => toAsync
+});
+const Answer = Schema.Struct({
+	data: Schema.String,
+	name: Schema$2,
+	ttl: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	type: Type
+});
+const Resolution = Schema.TaggedUnion({
+	answer: { answers: Schema.Array(Answer) },
+	nodata: {}
+});
+var Error = class extends Schema.TaggedError()("ResolverError", {
+	cause: Schema.optionalKey(Schema.Unknown),
+	message: Schema.String,
+	reason: Schema.Literals([
+		"response",
+		"timeout",
+		"transport"
+	])
+}) {};
+var Service = class extends Context.Service()("@domainkit/DnsResolver") {};
+const layerFromAsync = (resolver) => Layer.succeed(Service, { resolve: Effect.fn("DnsResolver.resolve")((query) => Effect.tryPromise({
+	try: () => resolver.resolve(query),
+	catch: (cause) => new Error({
+		cause,
+		message: cause instanceof globalThis.Error ? cause.message : String(cause),
+		reason: "transport"
+	})
+}).pipe(Effect.flatMap((resolution) => {
+	switch (resolution._tag) {
+		case "answer":
+		case "nodata": return Effect.succeed(resolution);
+		case "timeout": return Effect.fail(new Error({
+			message: "DNS query timed out",
+			reason: "timeout"
+		}));
+		case "failure": return Effect.fail(new Error({
+			message: resolution.message,
+			reason: "transport"
+		}));
+	}
+}))) });
+const toAsync = (resolver) => ({ resolve: (query) => Effect.runPromise(resolver.resolve(query).pipe(Effect.match({
+	onFailure: (failure) => failure.reason === "timeout" ? { _tag: "timeout" } : {
+		_tag: "failure",
+		message: failure.message
+	},
+	onSuccess: (resolution) => resolution
+}))) });
+//#endregion
+export { decodeReceipt as A, plan_exports as C, Receipt$1 as D, Operation$1 as E, Service$1 as F, make as I, zone_discovery_exports as L, encodeReceipt as M, types_exports as N, Schema$1 as O, Candidate as P, create$1 as S, Authorization$1 as T, PartialApplyError as _, Authorization as a, apply$1 as b, PartialError as c, apply as d, authorize as f, CreateResult as g, ConflictError as h, toAsync as i, encode as j, decode as k, Plan as l, deletion_exports as m, Service as n, Error$1 as o, create as p, resolver_exports as r, Operation as s, Error as t, Receipt as u, StaleError as v, renderManualInstructions as w, authorize$1 as x, Target as y };
+
+//# sourceMappingURL=resolver-CxE-VDw4.mjs.map