domainkit 0.2.0 → 0.2.1

package/dist/effect-cloudflare.mjs

@@ -1,2 +1,2 @@
-import { d as make, l as client_exports, t as auth_exports, u as discovery } from "./auth-CZ1pZHMZ.mjs";
+import { d as make, l as client_exports, t as auth_exports, u as discovery } from "./auth-B4jq3yk3.mjs";
 export { auth_exports as Auth, client_exports as Client, discovery, make };

package/dist/effect-vercel.mjs

@@ -1,2 +1,2 @@
-import { c as client_exports, l as discovery, t as auth_exports, u as make } from "./auth-CzhZ3Cuc.mjs";
+import { c as client_exports, l as discovery, t as auth_exports, u as make } from "./auth-6-KRy1gN.mjs";
 export { auth_exports as Auth, client_exports as Client, discovery, make };

package/dist/effect.d.mts

@@ -2,8 +2,8 @@ import { A as Connection, At as dns_record_d_exports, Ft as domain_name_d_export
 import { t as index_d_exports } from "./index-B1opsgls.mjs";
 import { t as connection_api_d_exports } from "./connection-api-DftK7eHo.mjs";
 import { t as index_d_exports$1 } from "./index-Ewc__bQu.mjs";
-import { _ as selection_d_exports, a as verify_d_exports, d as google_doh_d_exports, g as zones_d_exports, h as doh_d_exports, l as resolver_pool_d_exports, p as cloudflare_doh_d_exports, v as diagnostic_d_exports } from "./verify-DZWLM91T.mjs";
-import { B as types_d_exports, N as DnsPlan, b as AuthorizeError, k as plan_d_exports, l as resolver_d_exports, v as deletion_d_exports } from "./resolver-CJOR9mQ8.mjs";
+import { _ as selection_d_exports, a as verify_d_exports, d as google_doh_d_exports, g as zones_d_exports, h as doh_d_exports, l as resolver_pool_d_exports, p as cloudflare_doh_d_exports, v as diagnostic_d_exports } from "./verify-7_EbKbFM.mjs";
+import { B as types_d_exports, N as DnsPlan, b as AuthorizeError, k as plan_d_exports, l as resolver_d_exports, v as deletion_d_exports } from "./resolver-BbVzTbCX.mjs";
 import { Crypto, Effect } from "effect";
 declare namespace connection_authorization_d_exports {
   export { Error, Requirements, authorize };

package/dist/effect.mjs

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { A as invalid_input_exports, C as provider_exports, D as domain_name_exports, N as lifecycle_repository_exports, g as dns_record_exports } from "./dns-record-BLeqo56C.mjs";
-import { _ as StartResult, d as provider_context_exports, g as Method, h as Error, m as secret_exports, o as authorization_exports, v as complete, y as start } from "./authorization-DOg2Re1D.mjs";
-import { d as make, l as client_exports, t as auth_exports, u as discovery } from "./auth-CZ1pZHMZ.mjs";
+import { _ as StartResult, d as provider_context_exports, g as Method, h as Error, m as secret_exports, o as authorization_exports, v as complete, y as start } from "./authorization-CQSKKMrW.mjs";
+import { d as make, l as client_exports, t as auth_exports, u as discovery } from "./auth-B4jq3yk3.mjs";
 import { n as zones_exports } from "./zones-DKHTpX9C.mjs";
-import { a as authorizationError, c as validate, i as assertGrant, n as Grant, o as decode, r as Schema, s as encode, t as AuthorizationError } from "./connection-BWrBwqjk.mjs";
+import { a as authorizationError, c as validate, i as assertGrant, n as Grant, o as decode, r as Schema, s as encode, t as AuthorizationError } from "./connection-BXoSrhZs.mjs";
 import { t as canonical_json_exports } from "./canonical-json-CpvqGMcr.mjs";
-import { C as selection_exports, D as manifest_exports, O as diagnostic_exports, S as connection_authorization_exports, b as dns_data_exports, g as cloudflare_doh_exports, k as version, m as google_doh_exports, p as resolver_pool_exports, s as verify_exports, v as doh_exports } from "./verify-BzpiA0Es.mjs";
+import { C as selection_exports, D as manifest_exports, O as diagnostic_exports, S as connection_authorization_exports, b as dns_data_exports, g as cloudflare_doh_exports, k as version, m as google_doh_exports, p as resolver_pool_exports, s as verify_exports, v as doh_exports } from "./verify-Q5RYpnuw.mjs";
 import { C as plan_exports, L as zone_discovery_exports, N as types_exports, m as deletion_exports, r as resolver_exports } from "./resolver-CxE-VDw4.mjs";
-import { c as client_exports$1, l as discovery$1, t as auth_exports$1, u as make$1 } from "./auth-CzhZ3Cuc.mjs";
+import { c as client_exports$1, l as discovery$1, t as auth_exports$1, u as make$1 } from "./auth-6-KRy1gN.mjs";
 //#region src/providers/cloudflare/index.ts
 var cloudflare_exports = /* @__PURE__ */ __exportAll({
 	Auth: () => auth_exports,

package/dist/index.d.mts

@@ -1,8 +1,8 @@
 import { $ as Method, A as Connection, B as Capability, Ct as Opaque, Dt as Txt, Et as Srv, G as Schema$2, H as Evidence, It as parse$1, Mt as parse, Nt as DomainName, Ot as Type, Pt as Schema$4, Q as Manifest, Rt as invalid_input_d_exports, S as provider_context_d_exports, St as Observed, Tt as Schema$3, U as EvidenceSchema, V as CapabilityEvidence, W as ProviderAuthorization, X as AsyncOAuthSubjectResolver, _t as Cname, bt as Mx, ct as AsyncInterface, et as OAuthClientConfiguration, gt as Caa, ht as Aaaa, it as TokenValidation, jt as equals, kt as data, lt as CreateResult, mt as A, q as encode, rt as Schema$1, st as secret_d_exports, tt as OAuthMethod, vt as DnsRecord, wt as RequirementMetadata, xt as Ns, yt as Encoded } from "./zone-discovery-BA5I24vu.mjs";
 import { a as Source, i as authorization_lifecycle_d_exports, o as zone_discovery_d_exports, r as connection_d_exports } from "./connection-CEqadXSm.mjs";
 import { n as cloudflare_d_exports } from "./cloudflare-FDl5q7Dm.mjs";
-import { _ as selection_d_exports, c as Policy, f as Options$3, g as zones_d_exports, i as Result, m as Options$4, n as PublicDns$1, o as DefaultOptions, r as PublicDnsObservation, s as Observation, t as ProviderObservation, u as Options$5, v as diagnostic_d_exports } from "./verify-DZWLM91T.mjs";
-import { A as renderManualInstructions$1, C as DiscoverCreateInput$1, E as ResolvedCreateResult, F as PlanAuthorization, I as Receipt, L as Schema$5, M as Authorization, N as DnsPlan, O as Target, P as Operation, R as encode$1, S as CreateResult$1, _ as Receipt$1, d as Authorization$1, f as CreateError, g as Plan, h as PartialError, j as ApplyReceipt, m as Operation$1, n as AsyncInterface$1, o as Query, p as Error, r as AsyncResolution, t as Answer, u as ApplyError, w as ExactCreateInput$1, z as encodeReceipt } from "./resolver-CJOR9mQ8.mjs";
+import { _ as selection_d_exports, c as Policy, f as Options$3, g as zones_d_exports, i as Result, m as Options$4, n as PublicDns$1, o as DefaultOptions, r as PublicDnsObservation, s as Observation, t as ProviderObservation, u as Options$5, v as diagnostic_d_exports } from "./verify-7_EbKbFM.mjs";
+import { A as renderManualInstructions$1, C as DiscoverCreateInput$1, E as ResolvedCreateResult, F as PlanAuthorization, I as Receipt, L as Schema$5, M as Authorization, N as DnsPlan, O as Target, P as Operation, R as encode$1, S as CreateResult$1, _ as Receipt$1, d as Authorization$1, f as CreateError, g as Plan, h as PartialError, j as ApplyReceipt, m as Operation$1, n as AsyncInterface$1, o as Query, p as Error, r as AsyncResolution, t as Answer, u as ApplyError, w as ExactCreateInput$1, z as encodeReceipt } from "./resolver-BbVzTbCX.mjs";
 import { i as vercel_d_exports } from "./vercel-DgJaUX9D.mjs";
 import { Data } from "effect";
 declare namespace dns_provider_d_exports {

package/dist/index.mjs

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { A as invalid_input_exports, O as parse$1, S as layerFromAsync, T as Schema$2, _ as equals, a as Mx, b as Service, c as Opaque, d as Srv, f as Txt, i as Cname, l as RequirementMetadata, m as data, n as Aaaa, o as Ns, p as Type, r as Caa, s as Observed, t as A, u as Schema$1, v as parse, y as Error } from "./dns-record-BLeqo56C.mjs";
-import { a as Schema$3, c as encode, d as provider_context_exports, i as EvidenceSchema, m as secret_exports, n as CapabilityEvidence, r as Evidence, s as decode$3, t as Capability } from "./authorization-DOg2Re1D.mjs";
+import { a as Schema$3, c as encode, d as provider_context_exports, i as EvidenceSchema, m as secret_exports, n as CapabilityEvidence, r as Evidence, s as decode$3, t as Capability } from "./authorization-CQSKKMrW.mjs";
 import { n as zones_exports } from "./zones-DKHTpX9C.mjs";
 import { i as webCryptoLayer } from "./canonical-json-CpvqGMcr.mjs";
-import { i as authorization_lifecycle_exports, t as connection_exports } from "./connection-CcQokgrd.mjs";
-import { t as cloudflare_exports } from "./cloudflare-BedFw4cX.mjs";
-import { C as selection_exports, E as decode$4, O as diagnostic_exports, T as Schema$4, _ as toAsync$1, a as Result, c as Observation, d as defaultMake$1, f as make$4, h as toAsync$3, i as PublicDnsObservation, k as version, l as Policy, n as ProviderObservation, o as observe$1, r as PublicDns$1, t as Provider$1, u as Service$1, w as Method, x as authorize$2, y as toAsync$2 } from "./verify-BzpiA0Es.mjs";
+import { i as authorization_lifecycle_exports, t as connection_exports } from "./connection-X3rZhrBZ.mjs";
+import { t as cloudflare_exports } from "./cloudflare-Bg_p-M2c.mjs";
+import { C as selection_exports, E as decode$4, O as diagnostic_exports, T as Schema$4, _ as toAsync$1, a as Result, c as Observation, d as defaultMake$1, f as make$4, h as toAsync$3, i as PublicDnsObservation, k as version, l as Policy, n as ProviderObservation, o as observe$1, r as PublicDns$1, t as Provider$1, u as Service$1, w as Method, x as authorize$2, y as toAsync$2 } from "./verify-Q5RYpnuw.mjs";
 import { A as decodeReceipt$1, D as Receipt, E as Operation, F as Service$2, I as make$5, M as encodeReceipt, O as Schema$5, P as Candidate, S as create$3, T as Authorization, a as Authorization$1, b as apply$3, c as PartialError, d as apply$2, f as authorize$3, g as CreateResult, j as encode$1, k as decode$5, l as Plan, o as Error$1, p as create$2, s as Operation$1, t as Error$2, u as Receipt$1, w as renderManualInstructions$1, x as authorize$4, y as Target } from "./resolver-CxE-VDw4.mjs";
-import { r as vercel_exports } from "./vercel-CWZ33NUS.mjs";
+import { r as vercel_exports } from "./vercel-BIFpZRPu.mjs";
 import { Data, Effect, Layer } from "effect";
 //#region src/promise/provider-auth.ts
 var provider_auth_exports = /* @__PURE__ */ __exportAll({

package/dist/{resolver-CJOR9mQ8.d.mts → resolver-BbVzTbCX.d.mts}

@@ -840,6 +840,11 @@ declare const decode: (input: unknown) => Effect.Effect<{
   readonly operations: readonly ({
     readonly _tag: "conflict";
     readonly existing: readonly ({
+      readonly _tag: "Opaque";
+      readonly name: string;
+      readonly providerRecordId: string | null;
+      readonly providerType: string;
+    } | {
       readonly _tag: "A";
       readonly metadata: {
         readonly ownership: string;
@@ -933,11 +938,6 @@ declare const decode: (input: unknown) => Effect.Effect<{
       readonly policy: "append" | "exclusive";
       readonly ttl: number | null;
       readonly value: string;
-    } | {
-      readonly _tag: "Opaque";
-      readonly name: string;
-      readonly providerRecordId: string | null;
-      readonly providerType: string;
     })[];
     readonly id: string;
     readonly reason: string;
@@ -1243,6 +1243,11 @@ declare const encode: (input: {
   readonly operations: readonly ({
     readonly _tag: "conflict";
     readonly existing: readonly ({
+      readonly _tag: "Opaque";
+      readonly name: string;
+      readonly providerRecordId: string | null;
+      readonly providerType: string;
+    } | {
       readonly _tag: "A";
       readonly metadata: {
         readonly ownership: string;
@@ -1336,11 +1341,6 @@ declare const encode: (input: {
       readonly policy: "append" | "exclusive";
       readonly ttl: number | null;
       readonly value: string;
-    } | {
-      readonly _tag: "Opaque";
-      readonly name: string;
-      readonly providerRecordId: string | null;
-      readonly providerType: string;
     })[];
     readonly id: string;
     readonly reason: string;
@@ -2741,4 +2741,4 @@ declare const layerFromAsync: (resolver: AsyncInterface) => Layer.Layer<Service>
 declare const toAsync: (resolver: Interface) => AsyncInterface;
 //#endregion
 export { renderManualInstructions as A, types_d_exports as B, DiscoverCreateInput as C, StaleError as D, ResolvedCreateResult as E, PlanAuthorization as F, Receipt$1 as I, Schema$1 as L, Authorization$1 as M, DnsPlan as N, Target as O, Operation$1 as P, encode as R, CreateResult as S, PartialApplyError as T, Receipt as _, Interface as a, AuthorizeError as b, Service as c, Authorization as d, CreateError as f, Plan as g, PartialError as h, Error as i, ApplyReceipt as j, plan_d_exports as k, resolver_d_exports as l, Operation as m, AsyncInterface as n, Query as o, Error$1 as p, AsyncResolution as r, Resolution as s, Answer as t, ApplyError as u, deletion_d_exports as v, ExactCreateInput as w, ConflictError as x, AuthorizationError as y, encodeReceipt as z };
-//# sourceMappingURL=resolver-CJOR9mQ8.d.mts.map
+//# sourceMappingURL=resolver-BbVzTbCX.d.mts.map

package/dist/testing.d.mts

@@ -1,5 +1,5 @@
 import { C as Aggregate, D as Service, E as Interface, J as CryptoError, Lt as Error$3, Nt as DomainName, St as Observed, T as Error$1, ct as AsyncInterface, dt as Interface$1, ft as Service$1, u as ContinuationStore, ut as Error$2 } from "./zone-discovery-BA5I24vu.mjs";
-import { D as StaleError, T as PartialApplyError, a as Interface$2, c as Service$2, h as PartialError, i as Error$4, j as ApplyReceipt, n as AsyncInterface$1, o as Query, p as Error$5, s as Resolution, x as ConflictError, y as AuthorizationError } from "./resolver-CJOR9mQ8.mjs";
+import { D as StaleError, T as PartialApplyError, a as Interface$2, c as Service$2, h as PartialError, i as Error$4, j as ApplyReceipt, n as AsyncInterface$1, o as Query, p as Error$5, s as Resolution, x as ConflictError, y as AuthorizationError } from "./resolver-BbVzTbCX.mjs";
 import { Effect, Layer, Schema } from "effect";
 declare namespace in_memory_lifecycle_repository_d_exports {
   export { Options$1 as Options, layer$2 as layer, make$3 as make };

package/dist/{vercel-CWZ33NUS.mjs → vercel-BIFpZRPu.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { n as fromEffectFlow, r as fromEffectTokenMethod } from "./connection-CcQokgrd.mjs";
-import { a as manifest$1, i as integrationMethod$1, n as exchangeCode$1, o as tokenConnectionMethod$1, r as integrationFlow$1, s as tokenMethod$1, u as make$1 } from "./auth-CzhZ3Cuc.mjs";
+import { n as fromEffectFlow, r as fromEffectTokenMethod } from "./connection-X3rZhrBZ.mjs";
+import { a as manifest$1, i as integrationMethod$1, n as exchangeCode$1, o as tokenConnectionMethod$1, r as integrationFlow$1, s as tokenMethod$1, u as make$1 } from "./auth-6-KRy1gN.mjs";
 import { Effect } from "effect";
 //#region src/promise/vercel-auth.ts
 var vercel_auth_exports = /* @__PURE__ */ __exportAll({
@@ -57,4 +57,4 @@ function discovery(options) {
 //#endregion
 export { vercel_auth_exports as i, make as n, vercel_exports as r, discovery as t };
 
-//# sourceMappingURL=vercel-CWZ33NUS.mjs.map
+//# sourceMappingURL=vercel-BIFpZRPu.mjs.map

package/dist/{vercel-CWZ33NUS.mjs.map → vercel-BIFpZRPu.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"vercel-CWZ33NUS.mjs","names":["EffectAuth.integrationMethod","EffectAuth.manifest","EffectAuth.tokenMethod","EffectAuth.exchangeCode","Connection.fromEffectFlow","EffectAuth.integrationFlow","Connection.fromEffectTokenMethod","EffectAuth.tokenConnectionMethod","Vercel.make"],"sources":["../src/promise/vercel-auth.ts","../src/promise/vercel.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as EffectAuth from \"../providers/vercel/auth.ts\";\nimport * as Connection from \"./connection.ts\";\n\nexport const integrationMethod = EffectAuth.integrationMethod;\nexport const manifest = EffectAuth.manifest;\nexport const tokenMethod = EffectAuth.tokenMethod;\nexport type {\n  ExchangeCodeOptions,\n  IntegrationCredential,\n  IntegrationFlowOptions,\n  IntegrationMethodOptions,\n} from \"../providers/vercel/auth.ts\";\n\nexport function exchangeCode(\n  options: EffectAuth.ExchangeCodeOptions,\n): Promise<EffectAuth.IntegrationCredential> {\n  return Effect.runPromise(EffectAuth.exchangeCode(options));\n}\n\n/** Creates Vercel Integration's implementation for the Promise connection facade. */\nexport function integrationFlow(\n  options: EffectAuth.IntegrationFlowOptions,\n): Connection.InteractiveFlow {\n  return Connection.fromEffectFlow(EffectAuth.integrationFlow(options));\n}\n\n/** Creates a Vercel token method for the Promise connection facade. */\nexport function tokenConnectionMethod(\n  options: EffectAuth.TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  return Connection.fromEffectTokenMethod(EffectAuth.tokenConnectionMethod(options));\n}\n","import { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as Vercel from \"../providers/vercel/index.ts\";\nimport type * as ZoneDiscovery from \"./zone-discovery.ts\";\n\nexport * as Auth from \"./vercel-auth.ts\";\nexport type {\n  Account,\n  AccountContext,\n  Fetch,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"../providers/vercel/client.ts\";\n\nexport interface Interface extends DnsProvider.AsyncInterface {\n  readonly listAccounts: () => Promise<ReadonlyArray<Vercel.Account>>;\n  readonly listZones: (input?: Vercel.Client.ListZonesInput) => Promise<ReadonlyArray<Vercel.Zone>>;\n  readonly validateToken: () => Promise<ProviderAuth.TokenValidation>;\n}\n\n/** Creates a Promise-compatible facade over the Effect-native Vercel client. */\nexport function make(options: Vercel.Client.Options): Interface {\n  const client = Vercel.make(options);\n  return {\n    id: client.id,\n    createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),\n    deleteRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.deleteRecord(zone, providerRecordId)),\n    getRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.getRecord(zone, providerRecordId)),\n    listAccounts: () => Effect.runPromise(client.listAccounts()),\n    listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),\n    listZones: (input) => Effect.runPromise(client.listZones(input)),\n    validateToken: () => Effect.runPromise(client.validateToken()),\n  };\n}\n\n/** Creates the optional Vercel discovery source for Promise consumers. */\nexport function discovery(options: Vercel.Client.Options): ZoneDiscovery.Source {\n  const client = make(options);\n  return {\n    listZones: (name) => client.listZones({ name }),\n    provider: client,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAKA,MAAa,oBAAoBA;AACjC,MAAa,WAAWC;AACxB,MAAa,cAAcC;AAQ3B,SAAgB,aACd,SAC2C;CAC3C,OAAO,OAAO,WAAWC,eAAwB,OAAO,CAAC;AAC3D;;AAGA,SAAgB,gBACd,SAC4B;CAC5B,OAAOC,eAA0BC,kBAA2B,OAAO,CAAC;AACtE;;AAGA,SAAgB,sBACd,SACwD;CACxD,OAAOC,sBAAiCC,wBAAiC,OAAO,CAAC;AACnF;;;;;;;;;ACTA,SAAgB,KAAK,SAA2C;CAC9D,MAAM,SAASC,OAAY,OAAO;CAClC,OAAO;EACL,IAAI,OAAO;EACX,eAAe,MAAM,WAAW,OAAO,WAAW,OAAO,aAAa,MAAM,MAAM,CAAC;EACnF,eAAe,MAAM,qBACnB,OAAO,WAAW,OAAO,aAAa,MAAM,gBAAgB,CAAC;EAC/D,YAAY,MAAM,qBAChB,OAAO,WAAW,OAAO,UAAU,MAAM,gBAAgB,CAAC;EAC5D,oBAAoB,OAAO,WAAW,OAAO,aAAa,CAAC;EAC3D,cAAc,SAAS,OAAO,WAAW,OAAO,YAAY,IAAI,CAAC;EACjE,YAAY,UAAU,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC;EAC/D,qBAAqB,OAAO,WAAW,OAAO,cAAc,CAAC;CAC/D;AACF;;AAGA,SAAgB,UAAU,SAAsD;CAC9E,MAAM,SAAS,KAAK,OAAO;CAC3B,OAAO;EACL,YAAY,SAAS,OAAO,UAAU,EAAE,KAAK,CAAC;EAC9C,UAAU;CACZ;AACF"}
+{"version":3,"file":"vercel-BIFpZRPu.mjs","names":["EffectAuth.integrationMethod","EffectAuth.manifest","EffectAuth.tokenMethod","EffectAuth.exchangeCode","Connection.fromEffectFlow","EffectAuth.integrationFlow","Connection.fromEffectTokenMethod","EffectAuth.tokenConnectionMethod","Vercel.make"],"sources":["../src/promise/vercel-auth.ts","../src/promise/vercel.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as EffectAuth from \"../providers/vercel/auth.ts\";\nimport * as Connection from \"./connection.ts\";\n\nexport const integrationMethod = EffectAuth.integrationMethod;\nexport const manifest = EffectAuth.manifest;\nexport const tokenMethod = EffectAuth.tokenMethod;\nexport type {\n  ExchangeCodeOptions,\n  IntegrationCredential,\n  IntegrationFlowOptions,\n  IntegrationMethodOptions,\n} from \"../providers/vercel/auth.ts\";\n\nexport function exchangeCode(\n  options: EffectAuth.ExchangeCodeOptions,\n): Promise<EffectAuth.IntegrationCredential> {\n  return Effect.runPromise(EffectAuth.exchangeCode(options));\n}\n\n/** Creates Vercel Integration's implementation for the Promise connection facade. */\nexport function integrationFlow(\n  options: EffectAuth.IntegrationFlowOptions,\n): Connection.InteractiveFlow {\n  return Connection.fromEffectFlow(EffectAuth.integrationFlow(options));\n}\n\n/** Creates a Vercel token method for the Promise connection facade. */\nexport function tokenConnectionMethod(\n  options: EffectAuth.TokenConnectionOptions,\n): Extract<Connection.Method, { readonly _tag: \"Token\" }> {\n  return Connection.fromEffectTokenMethod(EffectAuth.tokenConnectionMethod(options));\n}\n","import { Effect } from \"effect\";\n\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as Vercel from \"../providers/vercel/index.ts\";\nimport type * as ZoneDiscovery from \"./zone-discovery.ts\";\n\nexport * as Auth from \"./vercel-auth.ts\";\nexport type {\n  Account,\n  AccountContext,\n  Fetch,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"../providers/vercel/client.ts\";\n\nexport interface Interface extends DnsProvider.AsyncInterface {\n  readonly listAccounts: () => Promise<ReadonlyArray<Vercel.Account>>;\n  readonly listZones: (input?: Vercel.Client.ListZonesInput) => Promise<ReadonlyArray<Vercel.Zone>>;\n  readonly validateToken: () => Promise<ProviderAuth.TokenValidation>;\n}\n\n/** Creates a Promise-compatible facade over the Effect-native Vercel client. */\nexport function make(options: Vercel.Client.Options): Interface {\n  const client = Vercel.make(options);\n  return {\n    id: client.id,\n    createRecord: (zone, record) => Effect.runPromise(client.createRecord(zone, record)),\n    deleteRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.deleteRecord(zone, providerRecordId)),\n    getRecord: (zone, providerRecordId) =>\n      Effect.runPromise(client.getRecord(zone, providerRecordId)),\n    listAccounts: () => Effect.runPromise(client.listAccounts()),\n    listRecords: (zone) => Effect.runPromise(client.listRecords(zone)),\n    listZones: (input) => Effect.runPromise(client.listZones(input)),\n    validateToken: () => Effect.runPromise(client.validateToken()),\n  };\n}\n\n/** Creates the optional Vercel discovery source for Promise consumers. */\nexport function discovery(options: Vercel.Client.Options): ZoneDiscovery.Source {\n  const client = make(options);\n  return {\n    listZones: (name) => client.listZones({ name }),\n    provider: client,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAKA,MAAa,oBAAoBA;AACjC,MAAa,WAAWC;AACxB,MAAa,cAAcC;AAQ3B,SAAgB,aACd,SAC2C;CAC3C,OAAO,OAAO,WAAWC,eAAwB,OAAO,CAAC;AAC3D;;AAGA,SAAgB,gBACd,SAC4B;CAC5B,OAAOC,eAA0BC,kBAA2B,OAAO,CAAC;AACtE;;AAGA,SAAgB,sBACd,SACwD;CACxD,OAAOC,sBAAiCC,wBAAiC,OAAO,CAAC;AACnF;;;;;;;;;ACTA,SAAgB,KAAK,SAA2C;CAC9D,MAAM,SAASC,OAAY,OAAO;CAClC,OAAO;EACL,IAAI,OAAO;EACX,eAAe,MAAM,WAAW,OAAO,WAAW,OAAO,aAAa,MAAM,MAAM,CAAC;EACnF,eAAe,MAAM,qBACnB,OAAO,WAAW,OAAO,aAAa,MAAM,gBAAgB,CAAC;EAC/D,YAAY,MAAM,qBAChB,OAAO,WAAW,OAAO,UAAU,MAAM,gBAAgB,CAAC;EAC5D,oBAAoB,OAAO,WAAW,OAAO,aAAa,CAAC;EAC3D,cAAc,SAAS,OAAO,WAAW,OAAO,YAAY,IAAI,CAAC;EACjE,YAAY,UAAU,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC;EAC/D,qBAAqB,OAAO,WAAW,OAAO,cAAc,CAAC;CAC/D;AACF;;AAGA,SAAgB,UAAU,SAAsD;CAC9E,MAAM,SAAS,KAAK,OAAO;CAC3B,OAAO;EACL,YAAY,SAAS,OAAO,UAAU,EAAE,KAAK,CAAC;EAC9C,UAAU;CACZ;AACF"}

package/dist/vercel.mjs

@@ -1,2 +1,2 @@
-import { i as vercel_auth_exports, n as make, t as discovery } from "./vercel-CWZ33NUS.mjs";
+import { i as vercel_auth_exports, n as make, t as discovery } from "./vercel-BIFpZRPu.mjs";
 export { vercel_auth_exports as Auth, discovery, make };

package/dist/{verify-DZWLM91T.d.mts → verify-7_EbKbFM.d.mts}

@@ -1,5 +1,5 @@
 import { A as Connection, Lt as Error, Nt as DomainName, W as ProviderAuthorization, ft as Service$1, vt as DnsRecord } from "./zone-discovery-BA5I24vu.mjs";
-import { a as Interface$1, c as Service$2, i as Error$1, n as AsyncInterface, o as Query, t as Answer } from "./resolver-CJOR9mQ8.mjs";
+import { a as Interface$1, c as Service$2, i as Error$1, n as AsyncInterface, o as Query, t as Answer } from "./resolver-BbVzTbCX.mjs";
 import { Context, Data, Effect, Layer, Schema } from "effect";
 declare namespace diagnostic_d_exports {
   export { Category, Diagnostic, Fields, RetryAdvice, from };
@@ -802,4 +802,4 @@ declare function observe(input: ProviderConfig): Effect.Effect<Result, Error, Se
 declare function observe(input: Config): Effect.Effect<Result, Error, Service$1>;
 //#endregion
 export { selection_d_exports as _, verify_d_exports as a, Policy as c, google_doh_d_exports as d, Options$1 as f, zones_d_exports as g, doh_d_exports as h, Result as i, resolver_pool_d_exports as l, Options$2 as m, PublicDns as n, DefaultOptions as o, cloudflare_doh_d_exports as p, PublicDnsObservation as r, Observation as s, ProviderObservation as t, Options as u, diagnostic_d_exports as v };
-//# sourceMappingURL=verify-DZWLM91T.d.mts.map
+//# sourceMappingURL=verify-7_EbKbFM.d.mts.map

package/dist/{verify-BzpiA0Es.mjs → verify-Q5RYpnuw.mjs}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { E as decode$1, O as parse$1, T as Schema$2, _ as equals, b as Service$1, k as Error$1, m as data } from "./dns-record-BLeqo56C.mjs";
 import { t as candidates } from "./zones-DKHTpX9C.mjs";
-import { a as authorizationError, i as assertGrant, t as AuthorizationError } from "./connection-BWrBwqjk.mjs";
+import { a as authorizationError, i as assertGrant, t as AuthorizationError } from "./connection-BXoSrhZs.mjs";
 import { i as toAsync$3, n as Service$2, t as Error$2, x as authorize$1 } from "./resolver-CxE-VDw4.mjs";
 import { Context, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
 import * as DnsPacket from "@leichtgewicht/dns-packet";
 //#region package.json
-var version = "0.2.0";
+var version = "0.2.1";
 //#endregion
 //#region src/auth/diagnostic.ts
 var diagnostic_exports = /* @__PURE__ */ __exportAll({
@@ -639,4 +639,4 @@ function recordValue(requirement) {
 //#endregion
 export { selection_exports as C, manifest_exports as D, decode as E, diagnostic_exports as O, connection_authorization_exports as S, Schema$1 as T, toAsync$1 as _, Result as a, dns_data_exports as b, Observation as c, defaultMake as d, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, version as k, Policy as l, google_doh_exports as m, ProviderObservation as n, observe as o, resolver_pool_exports as p, PublicDns as r, verify_exports as s, Provider as t, Service as u, doh_exports as v, Method as w, authorize as x, toAsync$2 as y };
 
-//# sourceMappingURL=verify-BzpiA0Es.mjs.map
+//# sourceMappingURL=verify-Q5RYpnuw.mjs.map

package/dist/{verify-BzpiA0Es.mjs.map → verify-Q5RYpnuw.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"verify-BzpiA0Es.mjs","names":["S","Schema","InvalidInputError","DomainName.Schema","DomainName.parse","Zones.candidates","Connection.authorizationError","Connection.assertGrant","Connection.AuthorizationError","InvalidInputError","Connection.authorizationError","Provisioning.authorize","DomainName.parse","InvalidInputError","make","DnsResolver.Error","layer","DnsResolver.Service","toAsync","DnsResolver.toAsync","DomainName.parse","DomainName.decode","DnsData.parse","endpoint","make","DnsOverHttps.make","layer","DnsResolver.Service","toAsync","DnsResolver.toAsync","make","DnsOverHttps.make","DnsResolver.Service","DnsResolver.toAsync","observe","CloudflareDnsOverHttps.make","GoogleDnsOverHttps.make","DnsProvider.Service","DnsRecord.equals","InvalidInputError","DnsResolverPool.Service","DnsResolverPool.defaultMake","DnsData.parse","data","DnsRecord.data"],"sources":["../package.json","../src/auth/diagnostic.ts","../src/auth/manifest.ts","../src/discovery/selection.ts","../src/plan/connection-authorization.ts","../src/verification/dns-data.ts","../src/verification/doh.ts","../src/verification/cloudflare-doh.ts","../src/verification/google-doh.ts","../src/verification/resolver-pool.ts","../src/verification/verify.ts"],"sourcesContent":["","import { Schema } from \"effect\";\n\nexport const Category = Schema.Literals([\n  \"authorization\",\n  \"configuration\",\n  \"provider\",\n  \"storage\",\n  \"validation\",\n]);\nexport type Category = typeof Category.Type;\n\nexport const RetryAdvice = Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]);\nexport type RetryAdvice = typeof RetryAdvice.Type;\n\nexport const Fields = {\n  category: Category,\n  message: Schema.String,\n  operation: Schema.String,\n  retry: RetryAdvice,\n} as const;\n\nexport interface Diagnostic {\n  readonly category: Category;\n  readonly message: string;\n  readonly operation: string;\n  readonly retry: RetryAdvice;\n  readonly tag: string;\n}\n\nexport function from(error: {\n  readonly _tag: string;\n  readonly category: Category;\n  readonly message: string;\n  readonly operation: string;\n  readonly retry: RetryAdvice;\n}): Diagnostic {\n  return {\n    category: error.category,\n    message: error.message,\n    operation: error.operation,\n    retry: error.retry,\n    tag: error._tag,\n  };\n}\n","import { Effect, Schema as S } from \"effect\";\nimport type * as oauth from \"oauth4webapi\";\n\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\n\nexport const Method = S.TaggedUnion({\n  integration: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    installUrl: S.String,\n    tokenEndpoint: S.String,\n  },\n  oauth2: {\n    authorizationServer: S.Struct({\n      authorization_endpoint: S.String,\n      issuer: S.String,\n      revocation_endpoint: S.optionalKey(S.String),\n      token_endpoint: S.String,\n    }),\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    clientAuth: S.Literals([\"none\", \"client_secret_basic\", \"client_secret_post\"]),\n    scopes: S.Array(S.String),\n  },\n  token: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    instructionsUrl: S.String,\n  },\n});\n\nexport const Schema = S.Struct({\n  methods: S.Array(Method),\n  providerId: S.String,\n});\nexport interface Manifest extends S.Schema.Type<typeof Schema> {}\nexport type OAuthMethod = Extract<Manifest[\"methods\"][number], { readonly _tag: \"oauth2\" }>;\n/** A provider-owned installation flow that returns a credential from a one-time code. */\nexport type IntegrationMethod = Extract<\n  Manifest[\"methods\"][number],\n  { readonly _tag: \"integration\" }\n>;\n\nexport const decode = Effect.fn(\"ProviderAuth.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport interface OAuthClientConfiguration {\n  readonly clientId: string;\n  readonly clientSecret?: Secret;\n}\n\nexport interface TokenValidation {\n  readonly accountId: string;\n  readonly capabilities: ReadonlyArray<\"dns:read\" | \"dns:write\">;\n  readonly expiresAt: Date | null;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport interface OAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Effect.Effect<\n    { readonly accountId: string; readonly expiresAt: Date | null },\n    DnsProvider.Error\n  >;\n}\n\nexport interface AsyncOAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Promise<{ readonly accountId: string; readonly expiresAt: Date | null }>;\n}\n","import { Schema } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as Zones from \"./zones.ts\";\n\nexport interface ConnectedZone {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n  readonly nameservers: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: string;\n}\n\nexport const Evidence = Schema.Struct({\n  accountId: Schema.String,\n  connectionId: Schema.String,\n  decisiveNameserverMatch: Schema.Boolean,\n  matchedNameservers: Schema.Array(DomainName.Schema),\n  providerId: Schema.String,\n  zone: DomainName.Schema,\n});\nexport interface Evidence extends Schema.Schema.Type<typeof Evidence> {}\n\nexport const Selection = Schema.TaggedUnion({\n  selected: {\n    candidate: Evidence,\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"explicit\", \"unique-nameserver-match\"]),\n  },\n  manual: {\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"ambiguous\", \"unsupported\"]),\n  },\n});\nexport type Selection = typeof Selection.Type;\n\nexport function select(input: {\n  readonly authoritativeNameservers: ReadonlyArray<string>;\n  readonly connectedZones: ReadonlyArray<ConnectedZone>;\n  readonly domain: string;\n  readonly explicit?: {\n    readonly accountId: string;\n    readonly providerId: string;\n    readonly zone: string;\n  };\n  readonly now?: Date;\n}): Selection {\n  const domain = DomainName.parse(input.domain);\n  const zoneCandidates = new Set(Zones.candidates(domain));\n  const authoritative = nameserverSet(input.authoritativeNameservers);\n  const eligible = input.connectedZones.filter((connected) => {\n    if (!zoneCandidates.has(DomainName.parse(connected.zone))) return false;\n    try {\n      Connection.assertGrant(connected.connection, connected.authorization, {\n        capability: \"dns:read\",\n        domain,\n        ...(input.now === undefined ? {} : { now: input.now }),\n        providerId: connected.providerId,\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  });\n  const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));\n\n  if (input.explicit !== undefined) {\n    const explicitZone = DomainName.parse(input.explicit.zone);\n    const index = eligible.findIndex(\n      (connected) =>\n        connected.providerId === input.explicit?.providerId &&\n        connected.authorization.providerAccountId === input.explicit.accountId &&\n        DomainName.parse(connected.zone) === explicitZone,\n    );\n    if (index < 0) {\n      throw Connection.authorizationError(\n        \"Explicit provider zone is not connected or granted\",\n        \"ProviderDiscovery.select\",\n      );\n    }\n    const candidate = evidence[index];\n    if (candidate === undefined) throw new Error(\"Eligible provider evidence is missing\");\n    return { _tag: \"selected\", candidate, evidence, reason: \"explicit\" };\n  }\n\n  const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);\n  const candidate = decisive[0];\n  return decisive.length === 1 && candidate !== undefined\n    ? { _tag: \"selected\", candidate, evidence, reason: \"unique-nameserver-match\" }\n    : {\n        _tag: \"manual\",\n        evidence,\n        reason: decisive.length > 1 ? \"ambiguous\" : \"unsupported\",\n      };\n}\n\nfunction evidenceFor(\n  connected: ConnectedZone,\n  authoritative: ReadonlyArray<DomainName.DomainName>,\n): Evidence {\n  const configured = new Set(nameserverSet(connected.nameservers));\n  const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));\n  return {\n    accountId: connected.authorization.providerAccountId,\n    connectionId: connected.connection.id,\n    decisiveNameserverMatch:\n      authoritative.length > 0 && matchedNameservers.length === authoritative.length,\n    matchedNameservers,\n    providerId: connected.providerId,\n    zone: DomainName.parse(connected.zone),\n  };\n}\n\nfunction nameserverSet(nameservers: ReadonlyArray<string>): ReadonlyArray<DomainName.DomainName> {\n  return [...new Set(nameservers.map(DomainName.parse))].sort();\n}\n","import { Crypto, Effect } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport { CryptoError } from \"./canonical-json.ts\";\nimport * as Provisioning from \"./plan.ts\";\nimport type * as DnsPlan from \"./types.ts\";\n\nexport const authorize = Effect.fn(\"ConnectionAuthorization.authorize\")(function* (input: {\n  readonly allowPartial?: boolean;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n  readonly domain: string;\n  readonly operationIds?: ReadonlyArray<string>;\n  readonly plan: DnsPlan.DnsPlan;\n}) {\n  const domain = yield* Effect.try({\n    try: () =>\n      Connection.assertGrant(input.connection, input.authorization, {\n        capability: \"dns:write\",\n        domain: input.domain,\n        providerId: input.plan.providerId,\n      }),\n    catch: (cause) =>\n      cause instanceof Connection.AuthorizationError || cause instanceof InvalidInputError\n        ? cause\n        : Connection.authorizationError(\n            \"Connection grant is invalid\",\n            \"ConnectionAuthorization.authorize\",\n          ),\n  });\n  const authorization = yield* Provisioning.authorize(\n    input.plan,\n    input.operationIds,\n    input.allowPartial === undefined ? {} : { allowPartial: input.allowPartial },\n  );\n  const selected = new Set(authorization.operationIds);\n  const outsideGrant = input.plan.operations.filter(\n    (operation) =>\n      operation._tag === \"create\" &&\n      selected.has(operation.id) &&\n      operation.requirement.name !== domain &&\n      !operation.requirement.name.endsWith(`.${domain}`),\n  );\n  if (outsideGrant.length > 0) {\n    return yield* Connection.authorizationError(\n      `Plan operations are outside the granted domain ${domain}`,\n      \"ConnectionAuthorization.authorize\",\n    );\n  }\n  return authorization;\n});\n\nexport type Error = Connection.AuthorizationError | InvalidInputError | CryptoError;\nexport type Requirements = Crypto.Crypto;\n","import { Effect, Schema, SchemaIssue, SchemaTransformation } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nconst CanonicalAddress = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().toLowerCase(),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalDomain = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transformOrFail({\n      decode: (value, options) =>\n        Effect.try({\n          try: () => DomainName.parse(value).toString(),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue(\n              { message: cause instanceof Error ? cause.message : String(cause) },\n              value,\n              options,\n            ),\n        }),\n      encode: (value) => Effect.succeed(value),\n    }),\n  ),\n);\n\nconst CanonicalMx = tokenizedDomain(2, 1);\nconst CanonicalSrv = tokenizedDomain(4, 3);\n\nconst CanonicalTxt = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => {\n        const trimmed = value.trim();\n        const chunks = [...trimmed.matchAll(/\"((?:\\\\.|[^\"])*)\"/g)];\n        return chunks.length === 0\n          ? trimmed\n          : chunks\n              .map((match) => (match[1] ?? \"\").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\"))\n              .join(\"\");\n      },\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalCaa = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().replace(/\\s+\"([\\s\\S]*)\"$/, \" $1\"),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nexport function parse(type: DnsRecord.Type, input: unknown): string {\n  const schema = (() => {\n    switch (type) {\n      case \"A\":\n      case \"AAAA\":\n        return CanonicalAddress;\n      case \"CNAME\":\n      case \"NS\":\n        return CanonicalDomain;\n      case \"MX\":\n        return CanonicalMx;\n      case \"SRV\":\n        return CanonicalSrv;\n      case \"TXT\":\n        return CanonicalTxt;\n      case \"CAA\":\n        return CanonicalCaa;\n    }\n  })();\n  try {\n    return Schema.decodeUnknownSync(schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nfunction tokenizedDomain(length: number, domainIndex: number) {\n  return Schema.String.pipe(\n    Schema.decodeTo(\n      Schema.String,\n      SchemaTransformation.transformOrFail({\n        decode: (value, options) =>\n          Effect.try({\n            try: () => {\n              const parts = value.trim().split(/\\s+/);\n              if (parts.length !== length)\n                throw new Error(\"DNS record data has an invalid field count\");\n              const domain = parts[domainIndex];\n              if (domain === undefined) throw new Error(\"DNS record target is missing\");\n              parts[domainIndex] = DomainName.parse(domain);\n              return parts.join(\" \");\n            },\n            catch: (cause) =>\n              new SchemaIssue.InvalidValue(\n                { message: cause instanceof Error ? cause.message : String(cause) },\n                value,\n                options,\n              ),\n          }),\n        encode: (value) => Effect.succeed(value),\n      }),\n    ),\n  );\n}\n","import * as DnsPacket from \"@leichtgewicht/dns-packet\";\nimport { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Options {\n  readonly endpoint: string;\n  readonly fetch?: Fetch;\n  readonly timeoutMs?: number;\n}\n\nexport function make(options: Options): DnsResolver.Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const timeoutMs = options.timeoutMs ?? 5_000;\n  return {\n    resolve: Effect.fn(\"DnsOverHttps.resolve\")((query) =>\n      Effect.tryPromise({\n        try: (effectSignal) =>\n          request({ effectSignal, fetch, query, timeoutMs, endpoint: options.endpoint }),\n        catch: (cause) =>\n          cause instanceof DnsResolver.Error\n            ? cause\n            : new DnsResolver.Error({\n                cause,\n                message: cause instanceof Error ? cause.message : \"DNS resolution failed\",\n                reason: \"transport\",\n              }),\n      }).pipe(Effect.flatMap((message) => decodeResolution(query, message))),\n    ),\n  };\n}\n\nexport const layer = (options: Options): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n\nfunction decodeResolution(\n  query: DnsResolver.Query,\n  message: Uint8Array,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  return Effect.try({\n    try: () => DnsPacket.decode(message),\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: \"DoH returned an invalid DNS message\",\n        reason: \"response\",\n      }),\n  }).pipe(\n    Effect.flatMap((packet) => validatePacket(query, packet)),\n    Effect.flatMap(decodePacket),\n  );\n}\n\nfunction decodePacket(\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  if (packet.rcode === \"NXDOMAIN\") {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  if (packet.rcode !== \"NOERROR\") {\n    return Effect.fail(\n      new DnsResolver.Error({\n        message: `DNS resolver returned ${packet.rcode ?? \"an unknown response code\"}`,\n        reason: \"response\",\n      }),\n    );\n  }\n  if (packet.answers === undefined || packet.answers.length === 0) {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  return Effect.forEach(packet.answers, decodeAnswer, { concurrency: \"unbounded\" }).pipe(\n    Effect.map((answers): DnsResolver.Resolution => {\n      const supportedAnswers = answers.filter((answer) => answer !== null);\n      return supportedAnswers.length === 0\n        ? { _tag: \"nodata\" }\n        : { _tag: \"answer\", answers: supportedAnswers };\n    }),\n  );\n}\n\nfunction validatePacket(\n  query: DnsResolver.Query,\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsPacket.Packet, DnsResolver.Error> {\n  return Effect.try({\n    try: () => {\n      if (packet.type !== \"response\") throw new Error(\"DoH returned a DNS query\");\n      if (packet.id !== 0) throw new Error(\"DoH response used an unexpected message ID\");\n      if (packet.flag_tc) throw new Error(\"DoH returned a truncated DNS response\");\n      const questions = packet.questions ?? [];\n      if (questions.length !== 1) throw new Error(\"DoH returned an unexpected question count\");\n      const question = questions[0];\n      if (question === undefined) throw new Error(\"DoH response omitted the DNS question\");\n      if (\n        question.class !== \"IN\" ||\n        question.type !== query.type ||\n        DomainName.parse(question.name) !== query.name\n      ) {\n        throw new Error(\"DoH response did not match the DNS question\");\n      }\n      return packet;\n    },\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: cause instanceof Error ? cause.message : \"DoH returned an invalid DNS response\",\n        reason: \"response\",\n      }),\n  });\n}\n\nfunction decodeAnswer(\n  answer: DnsPacket.Answer,\n): Effect.Effect<DnsResolver.Answer | null, DnsResolver.Error> {\n  return Effect.gen(function* () {\n    if (answer.class !== \"IN\") return null;\n    const decoded = yield* Effect.try({\n      try: () => answerData(answer),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (decoded === undefined) return null;\n    const name = yield* DomainName.decode(answer.name);\n    const data = yield* Effect.try({\n      try: () => DnsData.parse(decoded.type, decoded.data),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (answer.ttl === undefined) {\n      return yield* new DnsResolver.Error({\n        message: \"DoH response omitted the DNS record TTL\",\n        reason: \"response\",\n      });\n    }\n    return { data, name, ttl: answer.ttl, type: decoded.type };\n  }).pipe(\n    Effect.mapError((cause) =>\n      cause instanceof DnsResolver.Error\n        ? cause\n        : new DnsResolver.Error({ cause, message: cause.message, reason: \"response\" }),\n    ),\n  );\n}\n\nfunction answerData(\n  answer: DnsPacket.Answer,\n): { readonly data: string; readonly type: DnsRecord.Type } | undefined {\n  switch (answer.type) {\n    case \"A\":\n    case \"AAAA\":\n    case \"CNAME\":\n    case \"NS\":\n      return { data: answer.data, type: answer.type };\n    case \"CAA\":\n      return {\n        data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,\n        type: answer.type,\n      };\n    case \"MX\":\n      return {\n        data: `${requiredNumber(answer.data.preference, \"MX preference\")} ${answer.data.exchange}`,\n        type: answer.type,\n      };\n    case \"SRV\":\n      return {\n        data: [\n          requiredNumber(answer.data.priority, \"SRV priority\"),\n          requiredNumber(answer.data.weight, \"SRV weight\"),\n          requiredNumber(answer.data.port, \"SRV port\"),\n          answer.data.target,\n        ].join(\" \"),\n        type: answer.type,\n      };\n    case \"TXT\":\n      return { data: decodeTxt(answer.data), type: answer.type };\n    default:\n      return undefined;\n  }\n}\n\nfunction decodeTxt(data: DnsPacket.TxtData): string {\n  const chunks = Array.isArray(data) ? data : [data];\n  const encoded = chunks.map((chunk) =>\n    typeof chunk === \"string\" ? new TextEncoder().encode(chunk) : chunk,\n  );\n  const length = encoded.reduce((total, chunk) => total + chunk.length, 0);\n  const joined = new Uint8Array(length);\n  let offset = 0;\n  for (const chunk of encoded) {\n    joined.set(chunk, offset);\n    offset += chunk.length;\n  }\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(joined);\n}\n\nfunction requiredNumber(value: number | undefined, field: string): number {\n  if (value === undefined) throw new Error(`DoH response omitted ${field}`);\n  return value;\n}\n\nasync function request(input: {\n  readonly effectSignal: AbortSignal;\n  readonly endpoint: string;\n  readonly fetch: Fetch;\n  readonly query: DnsResolver.Query;\n  readonly timeoutMs: number;\n}): Promise<Uint8Array> {\n  const controller = new AbortController();\n  let timedOut = false;\n  const abortFromEffect = () => controller.abort(input.effectSignal.reason);\n  const abortFromHost = () => controller.abort(input.query.signal?.reason);\n  input.effectSignal.addEventListener(\"abort\", abortFromEffect, { once: true });\n  input.query.signal?.addEventListener(\"abort\", abortFromHost, { once: true });\n  const timer = setTimeout(() => {\n    timedOut = true;\n    controller.abort(new Error(\"DNS resolution timed out\"));\n  }, input.timeoutMs);\n  try {\n    const query = Uint8Array.from(\n      DnsPacket.encode({\n        flags: DnsPacket.RECURSION_DESIRED,\n        id: 0,\n        questions: [{ name: input.query.name, type: input.query.type }],\n        type: \"query\",\n      }),\n    );\n    const response = await input.fetch(new URL(input.endpoint), {\n      body: query,\n      headers: {\n        accept: \"application/dns-message\",\n        \"content-type\": \"application/dns-message\",\n      },\n      method: \"POST\",\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      throw new DnsResolver.Error({\n        message: `DoH returned HTTP ${response.status}`,\n        reason: \"transport\",\n      });\n    }\n    const contentType = response.headers\n      .get(\"content-type\")\n      ?.split(\";\", 1)[0]\n      ?.trim()\n      .toLowerCase();\n    if (contentType !== \"application/dns-message\") {\n      throw new DnsResolver.Error({\n        message: `DoH returned unsupported content type ${contentType ?? \"<missing>\"}`,\n        reason: \"response\",\n      });\n    }\n    return new Uint8Array(await response.arrayBuffer());\n  } catch (cause) {\n    if (timedOut) {\n      throw new DnsResolver.Error({ message: \"DNS query timed out\", reason: \"timeout\" });\n    }\n    throw cause;\n  } finally {\n    clearTimeout(timer);\n    input.effectSignal.removeEventListener(\"abort\", abortFromEffect);\n    input.query.signal?.removeEventListener(\"abort\", abortFromHost);\n  }\n}\n","import { Layer } from \"effect\";\n\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nconst endpoint = \"https://cloudflare-dns.com/dns-query\";\n\nexport interface Options extends Omit<DnsOverHttps.Options, \"endpoint\"> {\n  readonly endpoint?: string;\n}\n\nexport function make(options: Options = {}): DnsResolver.Interface {\n  return DnsOverHttps.make({ ...options, endpoint: options.endpoint ?? endpoint });\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n","import { Layer } from \"effect\";\n\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nconst endpoint = \"https://dns.google/dns-query\";\n\nexport interface Options extends Omit<DnsOverHttps.Options, \"endpoint\"> {\n  readonly endpoint?: string;\n}\n\nexport function make(options: Options = {}): DnsResolver.Interface {\n  return DnsOverHttps.make({ ...options, endpoint: options.endpoint ?? endpoint });\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n","import { Context, Data, Effect, Layer, Schema } from \"effect\";\n\nimport * as CloudflareDnsOverHttps from \"./cloudflare-doh.ts\";\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\nimport * as GoogleDnsOverHttps from \"./google-doh.ts\";\n\nexport interface Entry {\n  readonly id: string;\n  readonly resolver: DnsResolver.Interface;\n  readonly timeoutMs?: number;\n}\n\nexport type Observation = Data.TaggedEnum<{\n  Answer: { readonly answers: ReadonlyArray<DnsResolver.Answer>; readonly resolverId: string };\n  Failed: {\n    readonly message: string;\n    readonly reason: Exclude<DnsResolver.Error[\"reason\"], \"timeout\">;\n    readonly resolverId: string;\n  };\n  NoData: { readonly resolverId: string };\n  TimedOut: { readonly resolverId: string; readonly timeoutMs: number };\n}>;\nexport const Observation = Data.taggedEnum<Observation>();\n\nexport type Policy = Data.TaggedEnum<{\n  AllMatch: {};\n  AnyMatch: {};\n  Quorum: { readonly minimum: number };\n}>;\nconst PolicyVariants = Data.taggedEnum<Policy>();\nconst QuorumMinimum = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));\nconst PolicySchema = Schema.TaggedUnion({\n  AllMatch: {},\n  AnyMatch: {},\n  Quorum: { minimum: QuorumMinimum },\n});\nexport const Policy = {\n  AllMatch: PolicyVariants.AllMatch,\n  AnyMatch: PolicyVariants.AnyMatch,\n  Quorum: ({ minimum }: { readonly minimum: number }): Policy =>\n    PolicyVariants.Quorum({ minimum: Schema.decodeUnknownSync(QuorumMinimum)(minimum) }),\n  Schema: PolicySchema,\n};\n\nexport interface Interface {\n  readonly observe: (query: DnsResolver.Query) => Effect.Effect<ReadonlyArray<Observation>>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/DnsResolverPool\") {}\n\nexport function make(entries: ReadonlyArray<Entry>): Interface {\n  return Service.of({\n    observe: Effect.fn(\"DnsResolverPool.observe\")((query) =>\n      Effect.forEach(entries, (entry) => observe(entry, query), { concurrency: \"unbounded\" }),\n    ),\n  });\n}\n\nexport interface DefaultOptions extends Omit<DnsOverHttps.Options, \"endpoint\"> {}\n\n/** Cloudflare and Google RFC wire-format DoH resolvers. */\nexport function defaultMake(options: DefaultOptions = {}): Interface {\n  const timeoutMs = options.timeoutMs ?? 5_000;\n  return make([\n    {\n      id: \"cloudflare\",\n      resolver: CloudflareDnsOverHttps.make(options),\n      timeoutMs,\n    },\n    { id: \"google\", resolver: GoogleDnsOverHttps.make(options), timeoutMs },\n  ]);\n}\n\nexport const defaultLayer = (options: DefaultOptions = {}): Layer.Layer<Service> =>\n  Layer.succeed(Service, defaultMake(options));\n\nfunction observe(entry: Entry, query: DnsResolver.Query): Effect.Effect<Observation> {\n  const timeoutMs = entry.timeoutMs ?? 5_000;\n  return entry.resolver.resolve(query).pipe(\n    Effect.timeout(timeoutMs),\n    Effect.match({\n      onFailure: (failure): Observation => {\n        if (\n          failure._tag === \"TimeoutError\" ||\n          (failure._tag === \"ResolverError\" && failure.reason === \"timeout\")\n        ) {\n          return Observation.TimedOut({ resolverId: entry.id, timeoutMs });\n        }\n        return Observation.Failed({\n          message: failure.message,\n          reason: failure.reason === \"response\" ? \"response\" : \"transport\",\n          resolverId: entry.id,\n        });\n      },\n      onSuccess: (resolution): Observation =>\n        resolution._tag === \"nodata\"\n          ? Observation.NoData({ resolverId: entry.id })\n          : Observation.Answer({ answers: resolution.answers, resolverId: entry.id }),\n    }),\n  );\n}\n","import { Data, Effect, Option, Schema } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolverPool from \"./resolver-pool.ts\";\n\nexport type PublicDns = Data.TaggedEnum<{\n  Disabled: {};\n  Enabled: { readonly policy?: DnsResolverPool.Policy };\n}>;\nexport const PublicDns = Data.taggedEnum<PublicDns>();\n\nexport type Provider = Data.TaggedEnum<{\n  Disabled: {};\n  Enabled: { readonly zone: DomainName.DomainName };\n}>;\nexport const Provider = Data.taggedEnum<Provider>();\n\ntype ProviderEnabled = Extract<Provider, { readonly _tag: \"Enabled\" }>;\ntype ProviderDisabled = Extract<Provider, { readonly _tag: \"Disabled\" }>;\n\nexport interface PublicOnlyConfig {\n  readonly provider?: ProviderDisabled;\n  readonly publicDns?: PublicDns;\n  readonly record: DnsRecord.DnsRecord;\n}\n\nexport interface ProviderConfig {\n  readonly provider: ProviderEnabled;\n  readonly publicDns?: PublicDns;\n  readonly record: DnsRecord.DnsRecord;\n}\n\nexport type Config = ProviderConfig | PublicOnlyConfig;\n\nexport type ProviderObservation = Data.TaggedEnum<{\n  Matched: {};\n  Mismatch: { readonly records: ReadonlyArray<DnsRecord.DnsRecord> };\n  Pending: {};\n  Unavailable: { readonly message: string };\n}>;\nexport const ProviderObservation = Data.taggedEnum<ProviderObservation>();\n\nexport type PublicDnsObservation = Data.TaggedEnum<{\n  Verified: {\n    readonly evidence: ReadonlyArray<DnsResolverPool.Observation>;\n    readonly matchedResolverIds: ReadonlyArray<string>;\n  };\n  Mismatch: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n  Pending: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n  Unavailable: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n}>;\nexport const PublicDnsObservation = Data.taggedEnum<PublicDnsObservation>();\n\ninterface Evidence {\n  readonly provider: ProviderObservation | null;\n  readonly publicDns: PublicDnsObservation | null;\n}\n\nexport type Result = Data.TaggedEnum<{\n  Mismatch: Evidence;\n  NotObserved: Evidence;\n  Pending: Evidence;\n  Unavailable: Evidence;\n  Verified: Evidence;\n}>;\nexport const Result = Data.taggedEnum<Result>();\n\nexport function observe(input: PublicOnlyConfig): Effect.Effect<Result, InvalidInputError>;\nexport function observe(\n  input: ProviderConfig,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service>;\nexport function observe(\n  input: Config,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service>;\nexport function observe(\n  input: Config,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service> {\n  return observeEffect(input);\n}\n\nconst observeEffect = Effect.fn(\"Verification.observe\")(function* (input: Config) {\n  const publicDns = input.publicDns ?? PublicDns.Enabled({});\n  const provider = input.provider ?? Provider.Disabled();\n  const publicEffect =\n    publicDns._tag === \"Disabled\"\n      ? Effect.succeed<PublicDnsObservation | null>(null)\n      : observePublicDns(input.record, publicDns.policy ?? DnsResolverPool.Policy.AnyMatch());\n  const providerEffect =\n    provider._tag === \"Disabled\"\n      ? Effect.succeed<ProviderObservation | null>(null)\n      : Effect.flatMap(DnsProvider.Service, (service) =>\n          observeProvider(service, provider.zone, input.record).pipe(\n            Effect.catch((failure) =>\n              Effect.succeed<ProviderObservation>(\n                ProviderObservation.Unavailable({ message: failure.message }),\n              ),\n            ),\n          ),\n        );\n  const [providerObservation, publicDnsObservation] = yield* Effect.all(\n    [providerEffect, publicEffect] as const,\n    { concurrency: \"unbounded\" },\n  );\n  return aggregate({ provider: providerObservation, publicDns: publicDnsObservation });\n});\n\nfunction observeProvider(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  requirement: DnsRecord.DnsRecord,\n): Effect.Effect<ProviderObservation, DnsProvider.Error> {\n  return provider.listRecords(zone).pipe(\n    Effect.map((records): ProviderObservation => {\n      if (\n        records.some(\n          (existing) => existing._tag !== \"Opaque\" && DnsRecord.equals(existing, requirement),\n        )\n      ) {\n        return ProviderObservation.Matched();\n      }\n      const sameSet = records.filter(\n        (existing): existing is DnsRecord.DnsRecord =>\n          existing._tag !== \"Opaque\" &&\n          existing.name === requirement.name &&\n          existing._tag === requirement._tag,\n      );\n      return sameSet.length === 0\n        ? ProviderObservation.Pending()\n        : ProviderObservation.Mismatch({ records: sameSet });\n    }),\n  );\n}\n\nfunction observePublicDns(\n  requirement: DnsRecord.DnsRecord,\n  policy: DnsResolverPool.Policy,\n): Effect.Effect<PublicDnsObservation, InvalidInputError> {\n  return Effect.gen(function* () {\n    const validatedPolicy = yield* Schema.decodeUnknownEffect(DnsResolverPool.Policy.Schema)(\n      policy,\n    ).pipe(Effect.mapError((cause) => new InvalidInputError({ message: cause.message })));\n    const configuredPool = yield* Effect.serviceOption(DnsResolverPool.Service);\n    const pool = Option.getOrElse(configuredPool, () => DnsResolverPool.defaultMake());\n    const evidence = yield* pool.observe({ name: requirement.name, type: requirement._tag });\n    if (validatedPolicy._tag === \"Quorum\" && validatedPolicy.minimum > evidence.length) {\n      return yield* new InvalidInputError({\n        message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers`,\n      });\n    }\n    return evaluatePublicDns(requirement, validatedPolicy, evidence);\n  });\n}\n\nfunction evaluatePublicDns(\n  requirement: DnsRecord.DnsRecord,\n  policy: DnsResolverPool.Policy,\n  evidence: ReadonlyArray<DnsResolverPool.Observation>,\n): PublicDnsObservation {\n  const matchedResolverIds = evidence.flatMap((observation) =>\n    observation._tag === \"Answer\" && answersMatch(requirement, observation.answers)\n      ? [observation.resolverId]\n      : [],\n  );\n  const required =\n    policy._tag === \"AnyMatch\" ? 1 : policy._tag === \"AllMatch\" ? evidence.length : policy.minimum;\n  if (required > 0 && matchedResolverIds.length >= required) {\n    return PublicDnsObservation.Verified({ evidence, matchedResolverIds });\n  }\n  const unavailable = evidence.filter(\n    (observation) => observation._tag === \"TimedOut\" || observation._tag === \"Failed\",\n  ).length;\n  if (unavailable > 0 && matchedResolverIds.length + unavailable >= required) {\n    return PublicDnsObservation.Unavailable({ evidence });\n  }\n  if (\n    evidence.some(\n      (observation) =>\n        observation._tag === \"Answer\" && !answersMatch(requirement, observation.answers),\n    )\n  ) {\n    return PublicDnsObservation.Mismatch({ evidence });\n  }\n  if (evidence.some((observation) => observation._tag === \"NoData\")) {\n    return PublicDnsObservation.Pending({ evidence });\n  }\n  return PublicDnsObservation.Unavailable({ evidence });\n}\n\nfunction answersMatch(\n  requirement: DnsRecord.DnsRecord,\n  answers: ReadonlyArray<{ readonly data: string; readonly name: string; readonly type: string }>,\n): boolean {\n  const expected = DnsData.parse(requirement._tag, recordValue(requirement));\n  return answers.some(\n    (answer) =>\n      answer.name === requirement.name &&\n      answer.type === requirement._tag &&\n      DnsData.parse(requirement._tag, answer.data) === expected,\n  );\n}\n\nfunction aggregate(evidence: Evidence): Result {\n  const requested = [evidence.provider, evidence.publicDns].filter(\n    (observation): observation is ProviderObservation | PublicDnsObservation =>\n      observation !== null,\n  );\n  if (requested.length === 0) return Result.NotObserved(evidence);\n  if (\n    requested.every(\n      (observation) => observation._tag === \"Matched\" || observation._tag === \"Verified\",\n    )\n  ) {\n    return Result.Verified(evidence);\n  }\n  if (requested.some((observation) => observation._tag === \"Unavailable\")) {\n    return Result.Unavailable(evidence);\n  }\n  if (requested.some((observation) => observation._tag === \"Mismatch\")) {\n    return Result.Mismatch(evidence);\n  }\n  return Result.Pending(evidence);\n}\n\nfunction recordValue(requirement: DnsRecord.DnsRecord): string {\n  const data = DnsRecord.data(requirement);\n  switch (requirement._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return String(data.address);\n    case \"CNAME\":\n    case \"NS\":\n      return String(data.target);\n    case \"TXT\":\n      return String(data.value);\n    case \"MX\":\n      return `${data.priority} ${data.exchange}`;\n    case \"CAA\":\n      return `${data.flags} ${data.tag} ${data.value}`;\n    case \"SRV\":\n      return `${data.priority} ${data.weight} ${data.port} ${data.target}`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;ACEA,MAAa,WAAW,OAAO,SAAS;CACtC;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAa,cAAc,OAAO,SAAS;CAAC;CAAS;CAAqB;CAAQ;AAAS,CAAC;AAG5F,MAAa,SAAS;CACpB,UAAU;CACV,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO;AACT;AAUA,SAAgB,KAAK,OAMN;CACb,OAAO;EACL,UAAU,MAAM;EAChB,SAAS,MAAM;EACf,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,KAAK,MAAM;CACb;AACF;;;;;;;;ACpCA,MAAa,SAASA,OAAE,YAAY;CAClC,aAAa;EACX,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE;EACd,eAAeA,OAAE;CACnB;CACA,QAAQ;EACN,qBAAqBA,OAAE,OAAO;GAC5B,wBAAwBA,OAAE;GAC1B,QAAQA,OAAE;GACV,qBAAqBA,OAAE,YAAYA,OAAE,MAAM;GAC3C,gBAAgBA,OAAE;EACpB,CAAC;EACD,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE,SAAS;GAAC;GAAQ;GAAuB;EAAoB,CAAC;EAC5E,QAAQA,OAAE,MAAMA,OAAE,MAAM;CAC1B;CACA,OAAO;EACL,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,iBAAiBA,OAAE;CACrB;AACF,CAAC;AAED,MAAaC,WAASD,OAAE,OAAO;CAC7B,SAASA,OAAE,MAAM,MAAM;CACvB,YAAYA,OAAE;AAChB,CAAC;AASD,MAAa,SAAS,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACtDA,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;;;;;;;;AC/BA,MAAa,WAAW,OAAO,OAAO;CACpC,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,yBAAyB,OAAO;CAChC,oBAAoB,OAAO,MAAMC,QAAiB;CAClD,YAAY,OAAO;CACnB,MAAMA;AACR,CAAC;AAGD,MAAa,YAAY,OAAO,YAAY;CAC1C,UAAU;EACR,WAAW;EACX,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,YAAY,yBAAyB,CAAC;CACjE;CACA,QAAQ;EACN,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,aAAa,aAAa,CAAC;CACtD;AACF,CAAC;AAGD,SAAgB,OAAO,OAUT;CACZ,MAAM,SAASC,QAAiB,MAAM,MAAM;CAC5C,MAAM,iBAAiB,IAAI,IAAIC,WAAiB,MAAM,CAAC;CACvD,MAAM,gBAAgB,cAAc,MAAM,wBAAwB;CAClE,MAAM,WAAW,MAAM,eAAe,QAAQ,cAAc;EAC1D,IAAI,CAAC,eAAe,IAAID,QAAiB,UAAU,IAAI,CAAC,GAAG,OAAO;EAClE,IAAI;GACF,YAAuB,UAAU,YAAY,UAAU,eAAe;IACpE,YAAY;IACZ;IACA,GAAI,MAAM,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;IACpD,YAAY,UAAU;GACxB,CAAC;GACD,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CACD,MAAM,WAAW,SAAS,KAAK,cAAc,YAAY,WAAW,aAAa,CAAC;CAElF,IAAI,MAAM,aAAa,KAAA,GAAW;EAChC,MAAM,eAAeA,QAAiB,MAAM,SAAS,IAAI;EACzD,MAAM,QAAQ,SAAS,WACpB,cACC,UAAU,eAAe,MAAM,UAAU,cACzC,UAAU,cAAc,sBAAsB,MAAM,SAAS,aAC7DA,QAAiB,UAAU,IAAI,MAAM,YACzC;EACA,IAAI,QAAQ,GACV,MAAME,mBACJ,sDACA,0BACF;EAEF,MAAM,YAAY,SAAS;EAC3B,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;EACpF,OAAO;GAAE,MAAM;GAAY;GAAW;GAAU,QAAQ;EAAW;CACrE;CAEA,MAAM,WAAW,SAAS,QAAQ,EAAE,8BAA8B,uBAAuB;CACzF,MAAM,YAAY,SAAS;CAC3B,OAAO,SAAS,WAAW,KAAK,cAAc,KAAA,IAC1C;EAAE,MAAM;EAAY;EAAW;EAAU,QAAQ;CAA0B,IAC3E;EACE,MAAM;EACN;EACA,QAAQ,SAAS,SAAS,IAAI,cAAc;CAC9C;AACN;AAEA,SAAS,YACP,WACA,eACU;CACV,MAAM,aAAa,IAAI,IAAI,cAAc,UAAU,WAAW,CAAC;CAC/D,MAAM,qBAAqB,cAAc,QAAQ,eAAe,WAAW,IAAI,UAAU,CAAC;CAC1F,OAAO;EACL,WAAW,UAAU,cAAc;EACnC,cAAc,UAAU,WAAW;EACnC,yBACE,cAAc,SAAS,KAAK,mBAAmB,WAAW,cAAc;EAC1E;EACA,YAAY,UAAU;EACtB,MAAMF,QAAiB,UAAU,IAAI;CACvC;AACF;AAEA,SAAS,cAAc,aAA0E;CAC/F,OAAO,CAAC,GAAG,IAAI,IAAI,YAAY,IAAIA,OAAgB,CAAC,CAAC,CAAC,CAAC,KAAK;AAC9D;;;;AC5GA,MAAa,YAAY,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAOhF;CACD,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WACEG,YAAuB,MAAM,YAAY,MAAM,eAAe;GAC5D,YAAY;GACZ,QAAQ,MAAM;GACd,YAAY,MAAM,KAAK;EACzB,CAAC;EACH,QAAQ,UACN,iBAAiBC,sBAAiC,iBAAiBC,UAC/D,QACAC,mBACE,+BACA,mCACF;CACR,CAAC;CACD,MAAM,gBAAgB,OAAOC,YAC3B,MAAM,MACN,MAAM,cACN,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa,CAC7E;CACA,MAAM,WAAW,IAAI,IAAI,cAAc,YAAY;CAQnD,IAPqB,MAAM,KAAK,WAAW,QACxC,cACC,UAAU,SAAS,YACnB,SAAS,IAAI,UAAU,EAAE,KACzB,UAAU,YAAY,SAAS,UAC/B,CAAC,UAAU,YAAY,KAAK,SAAS,IAAI,QAAQ,CAEtC,CAAC,CAAC,SAAS,GACxB,OAAO,OAAOD,mBACZ,kDAAkD,UAClD,mCACF;CAEF,OAAO;AACT,CAAC;;;;AC9CD,MAAM,mBAAmB,OAAO,OAAO,KACrC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CAC5C,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,kBAAkB,OAAO,OAAO,KACpC,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAWE,QAAiB,KAAK,CAAC,CAAC,SAAS;EAC5C,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;CACJ,CAAC;CACH,SAAS,UAAU,OAAO,QAAQ,KAAK;AACzC,CAAC,CACH,CACF;AAEA,MAAM,cAAc,gBAAgB,GAAG,CAAC;AACxC,MAAM,eAAe,gBAAgB,GAAG,CAAC;AAEzC,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU;EACjB,MAAM,UAAU,MAAM,KAAK;EAC3B,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,oBAAoB,CAAC;EACzD,OAAO,OAAO,WAAW,IACrB,UACA,OACG,KAAK,WAAW,MAAM,MAAM,GAAA,CAAI,QAAQ,QAAQ,IAAG,CAAC,CAAC,QAAQ,SAAS,IAAI,CAAC,CAAC,CAC5E,KAAK,EAAE;CAChB;CACA,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,QAAQ,mBAAmB,KAAK;CAChE,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,SAAgB,MAAM,MAAsB,OAAwB;CAClE,MAAM,gBAAgB;EACpB,QAAQ,MAAR;GACE,KAAK;GACL,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,MACH,OAAO;GACT,KAAK,MACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;EACX;CACF,EAAA,CAAG;CACH,IAAI;EACF,OAAO,OAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK;CAC/C,SAAS,OAAO;EACd,MAAM,IAAIC,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAS,gBAAgB,QAAgB,aAAqB;CAC5D,OAAO,OAAO,OAAO,KACnB,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;EACnC,SAAS,OAAO,YACd,OAAO,IAAI;GACT,WAAW;IACT,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;IACtC,IAAI,MAAM,WAAW,QACnB,MAAM,IAAI,MAAM,4CAA4C;IAC9D,MAAM,SAAS,MAAM;IACrB,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,8BAA8B;IACxE,MAAM,eAAeD,QAAiB,MAAM;IAC5C,OAAO,MAAM,KAAK,GAAG;GACvB;GACA,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;EACJ,CAAC;EACH,SAAS,UAAU,OAAO,QAAQ,KAAK;CACzC,CAAC,CACH,CACF;AACF;;;;;;;;ACzGA,SAAgBE,OAAK,SAAyC;CAC5D,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,YAAY,QAAQ,aAAa;CACvC,OAAO,EACL,SAAS,OAAO,GAAG,sBAAsB,CAAC,EAAE,UAC1C,OAAO,WAAW;EAChB,MAAM,iBACJ,QAAQ;GAAE;GAAc;GAAO;GAAO;GAAW,UAAU,QAAQ;EAAS,CAAC;EAC/E,QAAQ,UACN,iBAAiBC,UACb,QACA,IAAIA,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,iBAAiB,OAAO,OAAO,CAAC,CAAC,CACvE,EACF;AACF;AAEA,MAAaC,WAAS,YACpB,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,YACtBC,UAAoBL,OAAK,OAAO,CAAC;AAEnC,SAAS,iBACP,OACA,SAC0D;CAC1D,OAAO,OAAO,IAAI;EAChB,WAAW,UAAU,OAAO,OAAO;EACnC,QAAQ,UACN,IAAIC,QAAkB;GACpB;GACA,SAAS;GACT,QAAQ;EACV,CAAC;CACL,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,eAAe,OAAO,MAAM,CAAC,GACxD,OAAO,QAAQ,YAAY,CAC7B;AACF;AAEA,SAAS,aACP,QAC0D;CAC1D,IAAI,OAAO,UAAU,YACnB,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,IAAI,OAAO,UAAU,WACnB,OAAO,OAAO,KACZ,IAAIA,QAAkB;EACpB,SAAS,yBAAyB,OAAO,SAAS;EAClD,QAAQ;CACV,CAAC,CACH;CAEF,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,QAAQ,WAAW,GAC5D,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,OAAO,OAAO,QAAQ,OAAO,SAAS,cAAc,EAAE,aAAa,YAAY,CAAC,CAAC,CAAC,KAChF,OAAO,KAAK,YAAoC;EAC9C,MAAM,mBAAmB,QAAQ,QAAQ,WAAW,WAAW,IAAI;EACnE,OAAO,iBAAiB,WAAW,IAC/B,EAAE,MAAM,SAAS,IACjB;GAAE,MAAM;GAAU,SAAS;EAAiB;CAClD,CAAC,CACH;AACF;AAEA,SAAS,eACP,OACA,QACoD;CACpD,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,IAAI,OAAO,SAAS,YAAY,MAAM,IAAI,MAAM,0BAA0B;GAC1E,IAAI,OAAO,OAAO,GAAG,MAAM,IAAI,MAAM,4CAA4C;GACjF,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,uCAAuC;GAC3E,MAAM,YAAY,OAAO,aAAa,CAAC;GACvC,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,2CAA2C;GACvF,MAAM,WAAW,UAAU;GAC3B,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;GACnF,IACE,SAAS,UAAU,QACnB,SAAS,SAAS,MAAM,QACxBK,QAAiB,SAAS,IAAI,MAAM,MAAM,MAE1C,MAAM,IAAI,MAAM,6CAA6C;GAE/D,OAAO;EACT;EACA,QAAQ,UACN,IAAIL,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACL,CAAC;AACH;AAEA,SAAS,aACP,QAC6D;CAC7D,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,OAAO,UAAU,MAAM,OAAO;EAClC,MAAM,UAAU,OAAO,OAAO,IAAI;GAChC,WAAW,WAAW,MAAM;GAC5B,QAAQ,UACN,IAAIA,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,YAAY,KAAA,GAAW,OAAO;EAClC,MAAM,OAAO,OAAOM,SAAkB,OAAO,IAAI;EACjD,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,MAAc,QAAQ,MAAM,QAAQ,IAAI;GACnD,QAAQ,UACN,IAAIP,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,OAAO,QAAQ,KAAA,GACjB,OAAO,OAAO,IAAIA,QAAkB;GAClC,SAAS;GACT,QAAQ;EACV,CAAC;EAEH,OAAO;GAAE;GAAM;GAAM,KAAK,OAAO;GAAK,MAAM,QAAQ;EAAK;CAC3D,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,iBAAiBA,UACb,QACA,IAAIA,QAAkB;EAAE;EAAO,SAAS,MAAM;EAAS,QAAQ;CAAW,CAAC,CACjF,CACF;AACF;AAEA,SAAS,WACP,QACsE;CACtE,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,MACH,OAAO;GAAE,MAAM,OAAO;GAAM,MAAM,OAAO;EAAK;EAChD,KAAK,OACH,OAAO;GACL,MAAM,GAAG,OAAO,KAAK,SAAS,EAAE,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK;GAClE,MAAM,OAAO;EACf;EACF,KAAK,MACH,OAAO;GACL,MAAM,GAAG,eAAe,OAAO,KAAK,YAAY,eAAe,EAAE,GAAG,OAAO,KAAK;GAChF,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GACL,MAAM;IACJ,eAAe,OAAO,KAAK,UAAU,cAAc;IACnD,eAAe,OAAO,KAAK,QAAQ,YAAY;IAC/C,eAAe,OAAO,KAAK,MAAM,UAAU;IAC3C,OAAO,KAAK;GACd,CAAC,CAAC,KAAK,GAAG;GACV,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GAAE,MAAM,UAAU,OAAO,IAAI;GAAG,MAAM,OAAO;EAAK;EAC3D,SACE;CACJ;AACF;AAEA,SAAS,UAAU,MAAiC;CAElD,MAAM,WADS,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,EAAA,CAC1B,KAAK,UAC1B,OAAO,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,KAChE;CACA,MAAM,SAAS,QAAQ,QAAQ,OAAO,UAAU,QAAQ,MAAM,QAAQ,CAAC;CACvE,MAAM,SAAS,IAAI,WAAW,MAAM;CACpC,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,SAAS;EAC3B,OAAO,IAAI,OAAO,MAAM;EACxB,UAAU,MAAM;CAClB;CACA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM;AAChE;AAEA,SAAS,eAAe,OAA2B,OAAuB;CACxE,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,wBAAwB,OAAO;CACxE,OAAO;AACT;AAEA,eAAe,QAAQ,OAMC;CACtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,WAAW;CACf,MAAM,wBAAwB,WAAW,MAAM,MAAM,aAAa,MAAM;CACxE,MAAM,sBAAsB,WAAW,MAAM,MAAM,MAAM,QAAQ,MAAM;CACvE,MAAM,aAAa,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAC5E,MAAM,MAAM,QAAQ,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;CAC3E,MAAM,QAAQ,iBAAiB;EAC7B,WAAW;EACX,WAAW,sBAAM,IAAI,MAAM,0BAA0B,CAAC;CACxD,GAAG,MAAM,SAAS;CAClB,IAAI;EACF,MAAM,QAAQ,WAAW,KACvB,UAAU,OAAO;GACf,OAAO,UAAU;GACjB,IAAI;GACJ,WAAW,CAAC;IAAE,MAAM,MAAM,MAAM;IAAM,MAAM,MAAM,MAAM;GAAK,CAAC;GAC9D,MAAM;EACR,CAAC,CACH;EACA,MAAM,WAAW,MAAM,MAAM,MAAM,IAAI,IAAI,MAAM,QAAQ,GAAG;GAC1D,MAAM;GACN,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;GACR,QAAQ,WAAW;EACrB,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,QAAkB;GAC1B,SAAS,qBAAqB,SAAS;GACvC,QAAQ;EACV,CAAC;EAEH,MAAM,cAAc,SAAS,QAC1B,IAAI,cAAc,CAAC,EAClB,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAChB,KAAK,CAAC,CACP,YAAY;EACf,IAAI,gBAAgB,2BAClB,MAAM,IAAIA,QAAkB;GAC1B,SAAS,yCAAyC,eAAe;GACjE,QAAQ;EACV,CAAC;EAEH,OAAO,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACpD,SAAS,OAAO;EACd,IAAI,UACF,MAAM,IAAIA,QAAkB;GAAE,SAAS;GAAuB,QAAQ;EAAU,CAAC;EAEnF,MAAM;CACR,UAAU;EACR,aAAa,KAAK;EAClB,MAAM,aAAa,oBAAoB,SAAS,eAAe;EAC/D,MAAM,MAAM,QAAQ,oBAAoB,SAAS,aAAa;CAChE;AACF;;;;;;;;AClRA,MAAMQ,aAAW;AAMjB,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,OAAOC,OAAkB;EAAE,GAAG;EAAS,UAAU,QAAQ,YAAYF;CAAS,CAAC;AACjF;AAEA,MAAaG,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;ACdnC,MAAM,WAAW;AAMjB,SAAgBM,OAAK,UAAmB,CAAC,GAA0B;CACjE,OAAOC,OAAkB;EAAE,GAAG;EAAS,UAAU,QAAQ,YAAY;CAAS,CAAC;AACjF;AAEA,MAAa,SAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBF,OAAK,OAAO,CAAC;AAElD,MAAa,WAAW,UAAmB,CAAC,MAC1CG,UAAoBH,OAAK,OAAO,CAAC;;;;;;;;;;;ACInC,MAAa,cAAc,KAAK,WAAwB;AAOxD,MAAM,iBAAiB,KAAK,WAAmB;AAC/C,MAAM,gBAAgB,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AACvE,MAAM,eAAe,OAAO,YAAY;CACtC,UAAU,CAAC;CACX,UAAU,CAAC;CACX,QAAQ,EAAE,SAAS,cAAc;AACnC,CAAC;AACD,MAAa,SAAS;CACpB,UAAU,eAAe;CACzB,UAAU,eAAe;CACzB,SAAS,EAAE,cACT,eAAe,OAAO,EAAE,SAAS,OAAO,kBAAkB,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;CACrF,QAAQ;AACV;AAMA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;AAElG,SAAgB,KAAK,SAA0C;CAC7D,OAAO,QAAQ,GAAG,EAChB,SAAS,OAAO,GAAG,yBAAyB,CAAC,EAAE,UAC7C,OAAO,QAAQ,UAAU,UAAUI,UAAQ,OAAO,KAAK,GAAG,EAAE,aAAa,YAAY,CAAC,CACxF,EACF,CAAC;AACH;;AAKA,SAAgB,YAAY,UAA0B,CAAC,GAAc;CACnE,MAAM,YAAY,QAAQ,aAAa;CACvC,OAAO,KAAK,CACV;EACE,IAAI;EACJ,UAAUC,OAA4B,OAAO;EAC7C;CACF,GACA;EAAE,IAAI;EAAU,UAAUC,OAAwB,OAAO;EAAG;CAAU,CACxE,CAAC;AACH;AAEA,MAAa,gBAAgB,UAA0B,CAAC,MACtD,MAAM,QAAQ,SAAS,YAAY,OAAO,CAAC;AAE7C,SAASF,UAAQ,OAAc,OAAsD;CACnF,MAAM,YAAY,MAAM,aAAa;CACrC,OAAO,MAAM,SAAS,QAAQ,KAAK,CAAC,CAAC,KACnC,OAAO,QAAQ,SAAS,GACxB,OAAO,MAAM;EACX,YAAY,YAAyB;GACnC,IACE,QAAQ,SAAS,kBAChB,QAAQ,SAAS,mBAAmB,QAAQ,WAAW,WAExD,OAAO,YAAY,SAAS;IAAE,YAAY,MAAM;IAAI;GAAU,CAAC;GAEjE,OAAO,YAAY,OAAO;IACxB,SAAS,QAAQ;IACjB,QAAQ,QAAQ,WAAW,aAAa,aAAa;IACrD,YAAY,MAAM;GACpB,CAAC;EACH;EACA,YAAY,eACV,WAAW,SAAS,WAChB,YAAY,OAAO,EAAE,YAAY,MAAM,GAAG,CAAC,IAC3C,YAAY,OAAO;GAAE,SAAS,WAAW;GAAS,YAAY,MAAM;EAAG,CAAC;CAChF,CAAC,CACH;AACF;;;;;;;;;;;ACxFA,MAAa,YAAY,KAAK,WAAsB;AAMpD,MAAa,WAAW,KAAK,WAAqB;AAyBlD,MAAa,sBAAsB,KAAK,WAAgC;AAWxE,MAAa,uBAAuB,KAAK,WAAiC;AAc1E,MAAa,SAAS,KAAK,WAAmB;AAS9C,SAAgB,QACd,OAC+D;CAC/D,OAAO,cAAc,KAAK;AAC5B;AAEA,MAAM,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAe;CAChF,MAAM,YAAY,MAAM,aAAa,UAAU,QAAQ,CAAC,CAAC;CACzD,MAAM,WAAW,MAAM,YAAY,SAAS,SAAS;CACrD,MAAM,eACJ,UAAU,SAAS,aACf,OAAO,QAAqC,IAAI,IAChD,iBAAiB,MAAM,QAAQ,UAAU,UAAA,OAAiC,SAAS,CAAC;CAC1F,MAAM,iBACJ,SAAS,SAAS,aACd,OAAO,QAAoC,IAAI,IAC/C,OAAO,QAAQG,YAAsB,YACnC,gBAAgB,SAAS,SAAS,MAAM,MAAM,MAAM,CAAC,CAAC,KACpD,OAAO,OAAO,YACZ,OAAO,QACL,oBAAoB,YAAY,EAAE,SAAS,QAAQ,QAAQ,CAAC,CAC9D,CACF,CACF,CACF;CACN,MAAM,CAAC,qBAAqB,wBAAwB,OAAO,OAAO,IAChE,CAAC,gBAAgB,YAAY,GAC7B,EAAE,aAAa,YAAY,CAC7B;CACA,OAAO,UAAU;EAAE,UAAU;EAAqB,WAAW;CAAqB,CAAC;AACrF,CAAC;AAED,SAAS,gBACP,UACA,MACA,aACuD;CACvD,OAAO,SAAS,YAAY,IAAI,CAAC,CAAC,KAChC,OAAO,KAAK,YAAiC;EAC3C,IACE,QAAQ,MACL,aAAa,SAAS,SAAS,YAAYC,OAAiB,UAAU,WAAW,CACpF,GAEA,OAAO,oBAAoB,QAAQ;EAErC,MAAM,UAAU,QAAQ,QACrB,aACC,SAAS,SAAS,YAClB,SAAS,SAAS,YAAY,QAC9B,SAAS,SAAS,YAAY,IAClC;EACA,OAAO,QAAQ,WAAW,IACtB,oBAAoB,QAAQ,IAC5B,oBAAoB,SAAS,EAAE,SAAS,QAAQ,CAAC;CACvD,CAAC,CACH;AACF;AAEA,SAAS,iBACP,aACA,QACwD;CACxD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,kBAAkB,OAAO,OAAO,oBAAA,OAA2C,MAAM,CAAC,CACtF,MACF,CAAC,CAAC,KAAK,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC;EACpF,MAAM,iBAAiB,OAAO,OAAO,cAAcC,OAAuB;EAE1E,MAAM,WAAW,OADJ,OAAO,UAAU,sBAAsBC,YAA4B,CACrD,CAAC,CAAC,QAAQ;GAAE,MAAM,YAAY;GAAM,MAAM,YAAY;EAAK,CAAC;EACvF,IAAI,gBAAgB,SAAS,YAAY,gBAAgB,UAAU,SAAS,QAC1E,OAAO,OAAO,IAAIF,QAAkB,EAClC,SAAS,kBAAkB,gBAAgB,QAAQ,eAAe,SAAS,OAAO,uBACpF,CAAC;EAEH,OAAO,kBAAkB,aAAa,iBAAiB,QAAQ;CACjE,CAAC;AACH;AAEA,SAAS,kBACP,aACA,QACA,UACsB;CACtB,MAAM,qBAAqB,SAAS,SAAS,gBAC3C,YAAY,SAAS,YAAY,aAAa,aAAa,YAAY,OAAO,IAC1E,CAAC,YAAY,UAAU,IACvB,CAAC,CACP;CACA,MAAM,WACJ,OAAO,SAAS,aAAa,IAAI,OAAO,SAAS,aAAa,SAAS,SAAS,OAAO;CACzF,IAAI,WAAW,KAAK,mBAAmB,UAAU,UAC/C,OAAO,qBAAqB,SAAS;EAAE;EAAU;CAAmB,CAAC;CAEvE,MAAM,cAAc,SAAS,QAC1B,gBAAgB,YAAY,SAAS,cAAc,YAAY,SAAS,QAC3E,CAAC,CAAC;CACF,IAAI,cAAc,KAAK,mBAAmB,SAAS,eAAe,UAChE,OAAO,qBAAqB,YAAY,EAAE,SAAS,CAAC;CAEtD,IACE,SAAS,MACN,gBACC,YAAY,SAAS,YAAY,CAAC,aAAa,aAAa,YAAY,OAAO,CACnF,GAEA,OAAO,qBAAqB,SAAS,EAAE,SAAS,CAAC;CAEnD,IAAI,SAAS,MAAM,gBAAgB,YAAY,SAAS,QAAQ,GAC9D,OAAO,qBAAqB,QAAQ,EAAE,SAAS,CAAC;CAElD,OAAO,qBAAqB,YAAY,EAAE,SAAS,CAAC;AACtD;AAEA,SAAS,aACP,aACA,SACS;CACT,MAAM,WAAWG,MAAc,YAAY,MAAM,YAAY,WAAW,CAAC;CACzE,OAAO,QAAQ,MACZ,WACC,OAAO,SAAS,YAAY,QAC5B,OAAO,SAAS,YAAY,QAC5BA,MAAc,YAAY,MAAM,OAAO,IAAI,MAAM,QACrD;AACF;AAEA,SAAS,UAAU,UAA4B;CAC7C,MAAM,YAAY,CAAC,SAAS,UAAU,SAAS,SAAS,CAAC,CAAC,QACvD,gBACC,gBAAgB,IACpB;CACA,IAAI,UAAU,WAAW,GAAG,OAAO,OAAO,YAAY,QAAQ;CAC9D,IACE,UAAU,OACP,gBAAgB,YAAY,SAAS,aAAa,YAAY,SAAS,UAC1E,GAEA,OAAO,OAAO,SAAS,QAAQ;CAEjC,IAAI,UAAU,MAAM,gBAAgB,YAAY,SAAS,aAAa,GACpE,OAAO,OAAO,YAAY,QAAQ;CAEpC,IAAI,UAAU,MAAM,gBAAgB,YAAY,SAAS,UAAU,GACjE,OAAO,OAAO,SAAS,QAAQ;CAEjC,OAAO,OAAO,QAAQ,QAAQ;AAChC;AAEA,SAAS,YAAY,aAA0C;CAC7D,MAAMC,SAAOC,KAAe,WAAW;CACvC,QAAQ,YAAY,MAApB;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAOD,OAAK,OAAO;EAC5B,KAAK;EACL,KAAK,MACH,OAAO,OAAOA,OAAK,MAAM;EAC3B,KAAK,OACH,OAAO,OAAOA,OAAK,KAAK;EAC1B,KAAK,MACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK;EAClC,KAAK,OACH,OAAO,GAAGA,OAAK,MAAM,GAAGA,OAAK,IAAI,GAAGA,OAAK;EAC3C,KAAK,OACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK,OAAO,GAAGA,OAAK,KAAK,GAAGA,OAAK;CAChE;AACF"}
+{"version":3,"file":"verify-Q5RYpnuw.mjs","names":["S","Schema","InvalidInputError","DomainName.Schema","DomainName.parse","Zones.candidates","Connection.authorizationError","Connection.assertGrant","Connection.AuthorizationError","InvalidInputError","Connection.authorizationError","Provisioning.authorize","DomainName.parse","InvalidInputError","make","DnsResolver.Error","layer","DnsResolver.Service","toAsync","DnsResolver.toAsync","DomainName.parse","DomainName.decode","DnsData.parse","endpoint","make","DnsOverHttps.make","layer","DnsResolver.Service","toAsync","DnsResolver.toAsync","make","DnsOverHttps.make","DnsResolver.Service","DnsResolver.toAsync","observe","CloudflareDnsOverHttps.make","GoogleDnsOverHttps.make","DnsProvider.Service","DnsRecord.equals","InvalidInputError","DnsResolverPool.Service","DnsResolverPool.defaultMake","DnsData.parse","data","DnsRecord.data"],"sources":["../package.json","../src/auth/diagnostic.ts","../src/auth/manifest.ts","../src/discovery/selection.ts","../src/plan/connection-authorization.ts","../src/verification/dns-data.ts","../src/verification/doh.ts","../src/verification/cloudflare-doh.ts","../src/verification/google-doh.ts","../src/verification/resolver-pool.ts","../src/verification/verify.ts"],"sourcesContent":["","import { Schema } from \"effect\";\n\nexport const Category = Schema.Literals([\n  \"authorization\",\n  \"configuration\",\n  \"provider\",\n  \"storage\",\n  \"validation\",\n]);\nexport type Category = typeof Category.Type;\n\nexport const RetryAdvice = Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]);\nexport type RetryAdvice = typeof RetryAdvice.Type;\n\nexport const Fields = {\n  category: Category,\n  message: Schema.String,\n  operation: Schema.String,\n  retry: RetryAdvice,\n} as const;\n\nexport interface Diagnostic {\n  readonly category: Category;\n  readonly message: string;\n  readonly operation: string;\n  readonly retry: RetryAdvice;\n  readonly tag: string;\n}\n\nexport function from(error: {\n  readonly _tag: string;\n  readonly category: Category;\n  readonly message: string;\n  readonly operation: string;\n  readonly retry: RetryAdvice;\n}): Diagnostic {\n  return {\n    category: error.category,\n    message: error.message,\n    operation: error.operation,\n    retry: error.retry,\n    tag: error._tag,\n  };\n}\n","import { Effect, Schema as S } from \"effect\";\nimport type * as oauth from \"oauth4webapi\";\n\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\n\nexport const Method = S.TaggedUnion({\n  integration: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    installUrl: S.String,\n    tokenEndpoint: S.String,\n  },\n  oauth2: {\n    authorizationServer: S.Struct({\n      authorization_endpoint: S.String,\n      issuer: S.String,\n      revocation_endpoint: S.optionalKey(S.String),\n      token_endpoint: S.String,\n    }),\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    clientAuth: S.Literals([\"none\", \"client_secret_basic\", \"client_secret_post\"]),\n    scopes: S.Array(S.String),\n  },\n  token: {\n    capabilities: S.Array(S.Literals([\"dns:read\", \"dns:write\"])),\n    instructionsUrl: S.String,\n  },\n});\n\nexport const Schema = S.Struct({\n  methods: S.Array(Method),\n  providerId: S.String,\n});\nexport interface Manifest extends S.Schema.Type<typeof Schema> {}\nexport type OAuthMethod = Extract<Manifest[\"methods\"][number], { readonly _tag: \"oauth2\" }>;\n/** A provider-owned installation flow that returns a credential from a one-time code. */\nexport type IntegrationMethod = Extract<\n  Manifest[\"methods\"][number],\n  { readonly _tag: \"integration\" }\n>;\n\nexport const decode = Effect.fn(\"ProviderAuth.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport interface OAuthClientConfiguration {\n  readonly clientId: string;\n  readonly clientSecret?: Secret;\n}\n\nexport interface TokenValidation {\n  readonly accountId: string;\n  readonly capabilities: ReadonlyArray<\"dns:read\" | \"dns:write\">;\n  readonly expiresAt: Date | null;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport interface OAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Effect.Effect<\n    { readonly accountId: string; readonly expiresAt: Date | null },\n    DnsProvider.Error\n  >;\n}\n\nexport interface AsyncOAuthSubjectResolver {\n  (\n    tokens: oauth.TokenEndpointResponse,\n    accessToken: Secret,\n  ): Promise<{ readonly accountId: string; readonly expiresAt: Date | null }>;\n}\n","import { Schema } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Connection from \"../auth/connection.ts\";\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as Zones from \"./zones.ts\";\n\nexport interface ConnectedZone {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n  readonly nameservers: ReadonlyArray<string>;\n  readonly providerId: string;\n  readonly zone: string;\n}\n\nexport const Evidence = Schema.Struct({\n  accountId: Schema.String,\n  connectionId: Schema.String,\n  decisiveNameserverMatch: Schema.Boolean,\n  matchedNameservers: Schema.Array(DomainName.Schema),\n  providerId: Schema.String,\n  zone: DomainName.Schema,\n});\nexport interface Evidence extends Schema.Schema.Type<typeof Evidence> {}\n\nexport const Selection = Schema.TaggedUnion({\n  selected: {\n    candidate: Evidence,\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"explicit\", \"unique-nameserver-match\"]),\n  },\n  manual: {\n    evidence: Schema.Array(Evidence),\n    reason: Schema.Literals([\"ambiguous\", \"unsupported\"]),\n  },\n});\nexport type Selection = typeof Selection.Type;\n\nexport function select(input: {\n  readonly authoritativeNameservers: ReadonlyArray<string>;\n  readonly connectedZones: ReadonlyArray<ConnectedZone>;\n  readonly domain: string;\n  readonly explicit?: {\n    readonly accountId: string;\n    readonly providerId: string;\n    readonly zone: string;\n  };\n  readonly now?: Date;\n}): Selection {\n  const domain = DomainName.parse(input.domain);\n  const zoneCandidates = new Set(Zones.candidates(domain));\n  const authoritative = nameserverSet(input.authoritativeNameservers);\n  const eligible = input.connectedZones.filter((connected) => {\n    if (!zoneCandidates.has(DomainName.parse(connected.zone))) return false;\n    try {\n      Connection.assertGrant(connected.connection, connected.authorization, {\n        capability: \"dns:read\",\n        domain,\n        ...(input.now === undefined ? {} : { now: input.now }),\n        providerId: connected.providerId,\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  });\n  const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));\n\n  if (input.explicit !== undefined) {\n    const explicitZone = DomainName.parse(input.explicit.zone);\n    const index = eligible.findIndex(\n      (connected) =>\n        connected.providerId === input.explicit?.providerId &&\n        connected.authorization.providerAccountId === input.explicit.accountId &&\n        DomainName.parse(connected.zone) === explicitZone,\n    );\n    if (index < 0) {\n      throw Connection.authorizationError(\n        \"Explicit provider zone is not connected or granted\",\n        \"ProviderDiscovery.select\",\n      );\n    }\n    const candidate = evidence[index];\n    if (candidate === undefined) throw new Error(\"Eligible provider evidence is missing\");\n    return { _tag: \"selected\", candidate, evidence, reason: \"explicit\" };\n  }\n\n  const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);\n  const candidate = decisive[0];\n  return decisive.length === 1 && candidate !== undefined\n    ? { _tag: \"selected\", candidate, evidence, reason: \"unique-nameserver-match\" }\n    : {\n        _tag: \"manual\",\n        evidence,\n        reason: decisive.length > 1 ? \"ambiguous\" : \"unsupported\",\n      };\n}\n\nfunction evidenceFor(\n  connected: ConnectedZone,\n  authoritative: ReadonlyArray<DomainName.DomainName>,\n): Evidence {\n  const configured = new Set(nameserverSet(connected.nameservers));\n  const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));\n  return {\n    accountId: connected.authorization.providerAccountId,\n    connectionId: connected.connection.id,\n    decisiveNameserverMatch:\n      authoritative.length > 0 && matchedNameservers.length === authoritative.length,\n    matchedNameservers,\n    providerId: connected.providerId,\n    zone: DomainName.parse(connected.zone),\n  };\n}\n\nfunction nameserverSet(nameservers: ReadonlyArray<string>): ReadonlyArray<DomainName.DomainName> {\n  return [...new Set(nameservers.map(DomainName.parse))].sort();\n}\n","import { Crypto, Effect } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport { CryptoError } from \"./canonical-json.ts\";\nimport * as Provisioning from \"./plan.ts\";\nimport type * as DnsPlan from \"./types.ts\";\n\nexport const authorize = Effect.fn(\"ConnectionAuthorization.authorize\")(function* (input: {\n  readonly allowPartial?: boolean;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n  readonly domain: string;\n  readonly operationIds?: ReadonlyArray<string>;\n  readonly plan: DnsPlan.DnsPlan;\n}) {\n  const domain = yield* Effect.try({\n    try: () =>\n      Connection.assertGrant(input.connection, input.authorization, {\n        capability: \"dns:write\",\n        domain: input.domain,\n        providerId: input.plan.providerId,\n      }),\n    catch: (cause) =>\n      cause instanceof Connection.AuthorizationError || cause instanceof InvalidInputError\n        ? cause\n        : Connection.authorizationError(\n            \"Connection grant is invalid\",\n            \"ConnectionAuthorization.authorize\",\n          ),\n  });\n  const authorization = yield* Provisioning.authorize(\n    input.plan,\n    input.operationIds,\n    input.allowPartial === undefined ? {} : { allowPartial: input.allowPartial },\n  );\n  const selected = new Set(authorization.operationIds);\n  const outsideGrant = input.plan.operations.filter(\n    (operation) =>\n      operation._tag === \"create\" &&\n      selected.has(operation.id) &&\n      operation.requirement.name !== domain &&\n      !operation.requirement.name.endsWith(`.${domain}`),\n  );\n  if (outsideGrant.length > 0) {\n    return yield* Connection.authorizationError(\n      `Plan operations are outside the granted domain ${domain}`,\n      \"ConnectionAuthorization.authorize\",\n    );\n  }\n  return authorization;\n});\n\nexport type Error = Connection.AuthorizationError | InvalidInputError | CryptoError;\nexport type Requirements = Crypto.Crypto;\n","import { Effect, Schema, SchemaIssue, SchemaTransformation } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nconst CanonicalAddress = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().toLowerCase(),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalDomain = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transformOrFail({\n      decode: (value, options) =>\n        Effect.try({\n          try: () => DomainName.parse(value).toString(),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue(\n              { message: cause instanceof Error ? cause.message : String(cause) },\n              value,\n              options,\n            ),\n        }),\n      encode: (value) => Effect.succeed(value),\n    }),\n  ),\n);\n\nconst CanonicalMx = tokenizedDomain(2, 1);\nconst CanonicalSrv = tokenizedDomain(4, 3);\n\nconst CanonicalTxt = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => {\n        const trimmed = value.trim();\n        const chunks = [...trimmed.matchAll(/\"((?:\\\\.|[^\"])*)\"/g)];\n        return chunks.length === 0\n          ? trimmed\n          : chunks\n              .map((match) => (match[1] ?? \"\").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\"))\n              .join(\"\");\n      },\n      encode: (value) => value,\n    }),\n  ),\n);\n\nconst CanonicalCaa = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String,\n    SchemaTransformation.transform({\n      decode: (value) => value.trim().replace(/\\s+\"([\\s\\S]*)\"$/, \" $1\"),\n      encode: (value) => value,\n    }),\n  ),\n);\n\nexport function parse(type: DnsRecord.Type, input: unknown): string {\n  const schema = (() => {\n    switch (type) {\n      case \"A\":\n      case \"AAAA\":\n        return CanonicalAddress;\n      case \"CNAME\":\n      case \"NS\":\n        return CanonicalDomain;\n      case \"MX\":\n        return CanonicalMx;\n      case \"SRV\":\n        return CanonicalSrv;\n      case \"TXT\":\n        return CanonicalTxt;\n      case \"CAA\":\n        return CanonicalCaa;\n    }\n  })();\n  try {\n    return Schema.decodeUnknownSync(schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nfunction tokenizedDomain(length: number, domainIndex: number) {\n  return Schema.String.pipe(\n    Schema.decodeTo(\n      Schema.String,\n      SchemaTransformation.transformOrFail({\n        decode: (value, options) =>\n          Effect.try({\n            try: () => {\n              const parts = value.trim().split(/\\s+/);\n              if (parts.length !== length)\n                throw new Error(\"DNS record data has an invalid field count\");\n              const domain = parts[domainIndex];\n              if (domain === undefined) throw new Error(\"DNS record target is missing\");\n              parts[domainIndex] = DomainName.parse(domain);\n              return parts.join(\" \");\n            },\n            catch: (cause) =>\n              new SchemaIssue.InvalidValue(\n                { message: cause instanceof Error ? cause.message : String(cause) },\n                value,\n                options,\n              ),\n          }),\n        encode: (value) => Effect.succeed(value),\n      }),\n    ),\n  );\n}\n","import * as DnsPacket from \"@leichtgewicht/dns-packet\";\nimport { Effect, Layer } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Options {\n  readonly endpoint: string;\n  readonly fetch?: Fetch;\n  readonly timeoutMs?: number;\n}\n\nexport function make(options: Options): DnsResolver.Interface {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const timeoutMs = options.timeoutMs ?? 5_000;\n  return {\n    resolve: Effect.fn(\"DnsOverHttps.resolve\")((query) =>\n      Effect.tryPromise({\n        try: (effectSignal) =>\n          request({ effectSignal, fetch, query, timeoutMs, endpoint: options.endpoint }),\n        catch: (cause) =>\n          cause instanceof DnsResolver.Error\n            ? cause\n            : new DnsResolver.Error({\n                cause,\n                message: cause instanceof Error ? cause.message : \"DNS resolution failed\",\n                reason: \"transport\",\n              }),\n      }).pipe(Effect.flatMap((message) => decodeResolution(query, message))),\n    ),\n  };\n}\n\nexport const layer = (options: Options): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n\nfunction decodeResolution(\n  query: DnsResolver.Query,\n  message: Uint8Array,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  return Effect.try({\n    try: () => DnsPacket.decode(message),\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: \"DoH returned an invalid DNS message\",\n        reason: \"response\",\n      }),\n  }).pipe(\n    Effect.flatMap((packet) => validatePacket(query, packet)),\n    Effect.flatMap(decodePacket),\n  );\n}\n\nfunction decodePacket(\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsResolver.Resolution, DnsResolver.Error> {\n  if (packet.rcode === \"NXDOMAIN\") {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  if (packet.rcode !== \"NOERROR\") {\n    return Effect.fail(\n      new DnsResolver.Error({\n        message: `DNS resolver returned ${packet.rcode ?? \"an unknown response code\"}`,\n        reason: \"response\",\n      }),\n    );\n  }\n  if (packet.answers === undefined || packet.answers.length === 0) {\n    return Effect.succeed({ _tag: \"nodata\" });\n  }\n  return Effect.forEach(packet.answers, decodeAnswer, { concurrency: \"unbounded\" }).pipe(\n    Effect.map((answers): DnsResolver.Resolution => {\n      const supportedAnswers = answers.filter((answer) => answer !== null);\n      return supportedAnswers.length === 0\n        ? { _tag: \"nodata\" }\n        : { _tag: \"answer\", answers: supportedAnswers };\n    }),\n  );\n}\n\nfunction validatePacket(\n  query: DnsResolver.Query,\n  packet: DnsPacket.Packet,\n): Effect.Effect<DnsPacket.Packet, DnsResolver.Error> {\n  return Effect.try({\n    try: () => {\n      if (packet.type !== \"response\") throw new Error(\"DoH returned a DNS query\");\n      if (packet.id !== 0) throw new Error(\"DoH response used an unexpected message ID\");\n      if (packet.flag_tc) throw new Error(\"DoH returned a truncated DNS response\");\n      const questions = packet.questions ?? [];\n      if (questions.length !== 1) throw new Error(\"DoH returned an unexpected question count\");\n      const question = questions[0];\n      if (question === undefined) throw new Error(\"DoH response omitted the DNS question\");\n      if (\n        question.class !== \"IN\" ||\n        question.type !== query.type ||\n        DomainName.parse(question.name) !== query.name\n      ) {\n        throw new Error(\"DoH response did not match the DNS question\");\n      }\n      return packet;\n    },\n    catch: (cause) =>\n      new DnsResolver.Error({\n        cause,\n        message: cause instanceof Error ? cause.message : \"DoH returned an invalid DNS response\",\n        reason: \"response\",\n      }),\n  });\n}\n\nfunction decodeAnswer(\n  answer: DnsPacket.Answer,\n): Effect.Effect<DnsResolver.Answer | null, DnsResolver.Error> {\n  return Effect.gen(function* () {\n    if (answer.class !== \"IN\") return null;\n    const decoded = yield* Effect.try({\n      try: () => answerData(answer),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (decoded === undefined) return null;\n    const name = yield* DomainName.decode(answer.name);\n    const data = yield* Effect.try({\n      try: () => DnsData.parse(decoded.type, decoded.data),\n      catch: (cause) =>\n        new DnsResolver.Error({\n          cause,\n          message: \"DoH returned invalid DNS record data\",\n          reason: \"response\",\n        }),\n    });\n    if (answer.ttl === undefined) {\n      return yield* new DnsResolver.Error({\n        message: \"DoH response omitted the DNS record TTL\",\n        reason: \"response\",\n      });\n    }\n    return { data, name, ttl: answer.ttl, type: decoded.type };\n  }).pipe(\n    Effect.mapError((cause) =>\n      cause instanceof DnsResolver.Error\n        ? cause\n        : new DnsResolver.Error({ cause, message: cause.message, reason: \"response\" }),\n    ),\n  );\n}\n\nfunction answerData(\n  answer: DnsPacket.Answer,\n): { readonly data: string; readonly type: DnsRecord.Type } | undefined {\n  switch (answer.type) {\n    case \"A\":\n    case \"AAAA\":\n    case \"CNAME\":\n    case \"NS\":\n      return { data: answer.data, type: answer.type };\n    case \"CAA\":\n      return {\n        data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,\n        type: answer.type,\n      };\n    case \"MX\":\n      return {\n        data: `${requiredNumber(answer.data.preference, \"MX preference\")} ${answer.data.exchange}`,\n        type: answer.type,\n      };\n    case \"SRV\":\n      return {\n        data: [\n          requiredNumber(answer.data.priority, \"SRV priority\"),\n          requiredNumber(answer.data.weight, \"SRV weight\"),\n          requiredNumber(answer.data.port, \"SRV port\"),\n          answer.data.target,\n        ].join(\" \"),\n        type: answer.type,\n      };\n    case \"TXT\":\n      return { data: decodeTxt(answer.data), type: answer.type };\n    default:\n      return undefined;\n  }\n}\n\nfunction decodeTxt(data: DnsPacket.TxtData): string {\n  const chunks = Array.isArray(data) ? data : [data];\n  const encoded = chunks.map((chunk) =>\n    typeof chunk === \"string\" ? new TextEncoder().encode(chunk) : chunk,\n  );\n  const length = encoded.reduce((total, chunk) => total + chunk.length, 0);\n  const joined = new Uint8Array(length);\n  let offset = 0;\n  for (const chunk of encoded) {\n    joined.set(chunk, offset);\n    offset += chunk.length;\n  }\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(joined);\n}\n\nfunction requiredNumber(value: number | undefined, field: string): number {\n  if (value === undefined) throw new Error(`DoH response omitted ${field}`);\n  return value;\n}\n\nasync function request(input: {\n  readonly effectSignal: AbortSignal;\n  readonly endpoint: string;\n  readonly fetch: Fetch;\n  readonly query: DnsResolver.Query;\n  readonly timeoutMs: number;\n}): Promise<Uint8Array> {\n  const controller = new AbortController();\n  let timedOut = false;\n  const abortFromEffect = () => controller.abort(input.effectSignal.reason);\n  const abortFromHost = () => controller.abort(input.query.signal?.reason);\n  input.effectSignal.addEventListener(\"abort\", abortFromEffect, { once: true });\n  input.query.signal?.addEventListener(\"abort\", abortFromHost, { once: true });\n  const timer = setTimeout(() => {\n    timedOut = true;\n    controller.abort(new Error(\"DNS resolution timed out\"));\n  }, input.timeoutMs);\n  try {\n    const query = Uint8Array.from(\n      DnsPacket.encode({\n        flags: DnsPacket.RECURSION_DESIRED,\n        id: 0,\n        questions: [{ name: input.query.name, type: input.query.type }],\n        type: \"query\",\n      }),\n    );\n    const response = await input.fetch(new URL(input.endpoint), {\n      body: query,\n      headers: {\n        accept: \"application/dns-message\",\n        \"content-type\": \"application/dns-message\",\n      },\n      method: \"POST\",\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      throw new DnsResolver.Error({\n        message: `DoH returned HTTP ${response.status}`,\n        reason: \"transport\",\n      });\n    }\n    const contentType = response.headers\n      .get(\"content-type\")\n      ?.split(\";\", 1)[0]\n      ?.trim()\n      .toLowerCase();\n    if (contentType !== \"application/dns-message\") {\n      throw new DnsResolver.Error({\n        message: `DoH returned unsupported content type ${contentType ?? \"<missing>\"}`,\n        reason: \"response\",\n      });\n    }\n    return new Uint8Array(await response.arrayBuffer());\n  } catch (cause) {\n    if (timedOut) {\n      throw new DnsResolver.Error({ message: \"DNS query timed out\", reason: \"timeout\" });\n    }\n    throw cause;\n  } finally {\n    clearTimeout(timer);\n    input.effectSignal.removeEventListener(\"abort\", abortFromEffect);\n    input.query.signal?.removeEventListener(\"abort\", abortFromHost);\n  }\n}\n","import { Layer } from \"effect\";\n\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nconst endpoint = \"https://cloudflare-dns.com/dns-query\";\n\nexport interface Options extends Omit<DnsOverHttps.Options, \"endpoint\"> {\n  readonly endpoint?: string;\n}\n\nexport function make(options: Options = {}): DnsResolver.Interface {\n  return DnsOverHttps.make({ ...options, endpoint: options.endpoint ?? endpoint });\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n","import { Layer } from \"effect\";\n\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\n\nconst endpoint = \"https://dns.google/dns-query\";\n\nexport interface Options extends Omit<DnsOverHttps.Options, \"endpoint\"> {\n  readonly endpoint?: string;\n}\n\nexport function make(options: Options = {}): DnsResolver.Interface {\n  return DnsOverHttps.make({ ...options, endpoint: options.endpoint ?? endpoint });\n}\n\nexport const layer = (options: Options = {}): Layer.Layer<DnsResolver.Service> =>\n  Layer.succeed(DnsResolver.Service, make(options));\n\nexport const toAsync = (options: Options = {}): DnsResolver.AsyncInterface =>\n  DnsResolver.toAsync(make(options));\n","import { Context, Data, Effect, Layer, Schema } from \"effect\";\n\nimport * as CloudflareDnsOverHttps from \"./cloudflare-doh.ts\";\nimport * as DnsOverHttps from \"./doh.ts\";\nimport * as DnsResolver from \"./resolver.ts\";\nimport * as GoogleDnsOverHttps from \"./google-doh.ts\";\n\nexport interface Entry {\n  readonly id: string;\n  readonly resolver: DnsResolver.Interface;\n  readonly timeoutMs?: number;\n}\n\nexport type Observation = Data.TaggedEnum<{\n  Answer: { readonly answers: ReadonlyArray<DnsResolver.Answer>; readonly resolverId: string };\n  Failed: {\n    readonly message: string;\n    readonly reason: Exclude<DnsResolver.Error[\"reason\"], \"timeout\">;\n    readonly resolverId: string;\n  };\n  NoData: { readonly resolverId: string };\n  TimedOut: { readonly resolverId: string; readonly timeoutMs: number };\n}>;\nexport const Observation = Data.taggedEnum<Observation>();\n\nexport type Policy = Data.TaggedEnum<{\n  AllMatch: {};\n  AnyMatch: {};\n  Quorum: { readonly minimum: number };\n}>;\nconst PolicyVariants = Data.taggedEnum<Policy>();\nconst QuorumMinimum = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));\nconst PolicySchema = Schema.TaggedUnion({\n  AllMatch: {},\n  AnyMatch: {},\n  Quorum: { minimum: QuorumMinimum },\n});\nexport const Policy = {\n  AllMatch: PolicyVariants.AllMatch,\n  AnyMatch: PolicyVariants.AnyMatch,\n  Quorum: ({ minimum }: { readonly minimum: number }): Policy =>\n    PolicyVariants.Quorum({ minimum: Schema.decodeUnknownSync(QuorumMinimum)(minimum) }),\n  Schema: PolicySchema,\n};\n\nexport interface Interface {\n  readonly observe: (query: DnsResolver.Query) => Effect.Effect<ReadonlyArray<Observation>>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/DnsResolverPool\") {}\n\nexport function make(entries: ReadonlyArray<Entry>): Interface {\n  return Service.of({\n    observe: Effect.fn(\"DnsResolverPool.observe\")((query) =>\n      Effect.forEach(entries, (entry) => observe(entry, query), { concurrency: \"unbounded\" }),\n    ),\n  });\n}\n\nexport interface DefaultOptions extends Omit<DnsOverHttps.Options, \"endpoint\"> {}\n\n/** Cloudflare and Google RFC wire-format DoH resolvers. */\nexport function defaultMake(options: DefaultOptions = {}): Interface {\n  const timeoutMs = options.timeoutMs ?? 5_000;\n  return make([\n    {\n      id: \"cloudflare\",\n      resolver: CloudflareDnsOverHttps.make(options),\n      timeoutMs,\n    },\n    { id: \"google\", resolver: GoogleDnsOverHttps.make(options), timeoutMs },\n  ]);\n}\n\nexport const defaultLayer = (options: DefaultOptions = {}): Layer.Layer<Service> =>\n  Layer.succeed(Service, defaultMake(options));\n\nfunction observe(entry: Entry, query: DnsResolver.Query): Effect.Effect<Observation> {\n  const timeoutMs = entry.timeoutMs ?? 5_000;\n  return entry.resolver.resolve(query).pipe(\n    Effect.timeout(timeoutMs),\n    Effect.match({\n      onFailure: (failure): Observation => {\n        if (\n          failure._tag === \"TimeoutError\" ||\n          (failure._tag === \"ResolverError\" && failure.reason === \"timeout\")\n        ) {\n          return Observation.TimedOut({ resolverId: entry.id, timeoutMs });\n        }\n        return Observation.Failed({\n          message: failure.message,\n          reason: failure.reason === \"response\" ? \"response\" : \"transport\",\n          resolverId: entry.id,\n        });\n      },\n      onSuccess: (resolution): Observation =>\n        resolution._tag === \"nodata\"\n          ? Observation.NoData({ resolverId: entry.id })\n          : Observation.Answer({ answers: resolution.answers, resolverId: entry.id }),\n    }),\n  );\n}\n","import { Data, Effect, Option, Schema } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport * as DnsRecord from \"../domain/dns-record.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as DnsData from \"./dns-data.ts\";\nimport * as DnsResolverPool from \"./resolver-pool.ts\";\n\nexport type PublicDns = Data.TaggedEnum<{\n  Disabled: {};\n  Enabled: { readonly policy?: DnsResolverPool.Policy };\n}>;\nexport const PublicDns = Data.taggedEnum<PublicDns>();\n\nexport type Provider = Data.TaggedEnum<{\n  Disabled: {};\n  Enabled: { readonly zone: DomainName.DomainName };\n}>;\nexport const Provider = Data.taggedEnum<Provider>();\n\ntype ProviderEnabled = Extract<Provider, { readonly _tag: \"Enabled\" }>;\ntype ProviderDisabled = Extract<Provider, { readonly _tag: \"Disabled\" }>;\n\nexport interface PublicOnlyConfig {\n  readonly provider?: ProviderDisabled;\n  readonly publicDns?: PublicDns;\n  readonly record: DnsRecord.DnsRecord;\n}\n\nexport interface ProviderConfig {\n  readonly provider: ProviderEnabled;\n  readonly publicDns?: PublicDns;\n  readonly record: DnsRecord.DnsRecord;\n}\n\nexport type Config = ProviderConfig | PublicOnlyConfig;\n\nexport type ProviderObservation = Data.TaggedEnum<{\n  Matched: {};\n  Mismatch: { readonly records: ReadonlyArray<DnsRecord.DnsRecord> };\n  Pending: {};\n  Unavailable: { readonly message: string };\n}>;\nexport const ProviderObservation = Data.taggedEnum<ProviderObservation>();\n\nexport type PublicDnsObservation = Data.TaggedEnum<{\n  Verified: {\n    readonly evidence: ReadonlyArray<DnsResolverPool.Observation>;\n    readonly matchedResolverIds: ReadonlyArray<string>;\n  };\n  Mismatch: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n  Pending: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n  Unavailable: { readonly evidence: ReadonlyArray<DnsResolverPool.Observation> };\n}>;\nexport const PublicDnsObservation = Data.taggedEnum<PublicDnsObservation>();\n\ninterface Evidence {\n  readonly provider: ProviderObservation | null;\n  readonly publicDns: PublicDnsObservation | null;\n}\n\nexport type Result = Data.TaggedEnum<{\n  Mismatch: Evidence;\n  NotObserved: Evidence;\n  Pending: Evidence;\n  Unavailable: Evidence;\n  Verified: Evidence;\n}>;\nexport const Result = Data.taggedEnum<Result>();\n\nexport function observe(input: PublicOnlyConfig): Effect.Effect<Result, InvalidInputError>;\nexport function observe(\n  input: ProviderConfig,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service>;\nexport function observe(\n  input: Config,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service>;\nexport function observe(\n  input: Config,\n): Effect.Effect<Result, InvalidInputError, DnsProvider.Service> {\n  return observeEffect(input);\n}\n\nconst observeEffect = Effect.fn(\"Verification.observe\")(function* (input: Config) {\n  const publicDns = input.publicDns ?? PublicDns.Enabled({});\n  const provider = input.provider ?? Provider.Disabled();\n  const publicEffect =\n    publicDns._tag === \"Disabled\"\n      ? Effect.succeed<PublicDnsObservation | null>(null)\n      : observePublicDns(input.record, publicDns.policy ?? DnsResolverPool.Policy.AnyMatch());\n  const providerEffect =\n    provider._tag === \"Disabled\"\n      ? Effect.succeed<ProviderObservation | null>(null)\n      : Effect.flatMap(DnsProvider.Service, (service) =>\n          observeProvider(service, provider.zone, input.record).pipe(\n            Effect.catch((failure) =>\n              Effect.succeed<ProviderObservation>(\n                ProviderObservation.Unavailable({ message: failure.message }),\n              ),\n            ),\n          ),\n        );\n  const [providerObservation, publicDnsObservation] = yield* Effect.all(\n    [providerEffect, publicEffect] as const,\n    { concurrency: \"unbounded\" },\n  );\n  return aggregate({ provider: providerObservation, publicDns: publicDnsObservation });\n});\n\nfunction observeProvider(\n  provider: DnsProvider.Interface,\n  zone: DomainName.DomainName,\n  requirement: DnsRecord.DnsRecord,\n): Effect.Effect<ProviderObservation, DnsProvider.Error> {\n  return provider.listRecords(zone).pipe(\n    Effect.map((records): ProviderObservation => {\n      if (\n        records.some(\n          (existing) => existing._tag !== \"Opaque\" && DnsRecord.equals(existing, requirement),\n        )\n      ) {\n        return ProviderObservation.Matched();\n      }\n      const sameSet = records.filter(\n        (existing): existing is DnsRecord.DnsRecord =>\n          existing._tag !== \"Opaque\" &&\n          existing.name === requirement.name &&\n          existing._tag === requirement._tag,\n      );\n      return sameSet.length === 0\n        ? ProviderObservation.Pending()\n        : ProviderObservation.Mismatch({ records: sameSet });\n    }),\n  );\n}\n\nfunction observePublicDns(\n  requirement: DnsRecord.DnsRecord,\n  policy: DnsResolverPool.Policy,\n): Effect.Effect<PublicDnsObservation, InvalidInputError> {\n  return Effect.gen(function* () {\n    const validatedPolicy = yield* Schema.decodeUnknownEffect(DnsResolverPool.Policy.Schema)(\n      policy,\n    ).pipe(Effect.mapError((cause) => new InvalidInputError({ message: cause.message })));\n    const configuredPool = yield* Effect.serviceOption(DnsResolverPool.Service);\n    const pool = Option.getOrElse(configuredPool, () => DnsResolverPool.defaultMake());\n    const evidence = yield* pool.observe({ name: requirement.name, type: requirement._tag });\n    if (validatedPolicy._tag === \"Quorum\" && validatedPolicy.minimum > evidence.length) {\n      return yield* new InvalidInputError({\n        message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers`,\n      });\n    }\n    return evaluatePublicDns(requirement, validatedPolicy, evidence);\n  });\n}\n\nfunction evaluatePublicDns(\n  requirement: DnsRecord.DnsRecord,\n  policy: DnsResolverPool.Policy,\n  evidence: ReadonlyArray<DnsResolverPool.Observation>,\n): PublicDnsObservation {\n  const matchedResolverIds = evidence.flatMap((observation) =>\n    observation._tag === \"Answer\" && answersMatch(requirement, observation.answers)\n      ? [observation.resolverId]\n      : [],\n  );\n  const required =\n    policy._tag === \"AnyMatch\" ? 1 : policy._tag === \"AllMatch\" ? evidence.length : policy.minimum;\n  if (required > 0 && matchedResolverIds.length >= required) {\n    return PublicDnsObservation.Verified({ evidence, matchedResolverIds });\n  }\n  const unavailable = evidence.filter(\n    (observation) => observation._tag === \"TimedOut\" || observation._tag === \"Failed\",\n  ).length;\n  if (unavailable > 0 && matchedResolverIds.length + unavailable >= required) {\n    return PublicDnsObservation.Unavailable({ evidence });\n  }\n  if (\n    evidence.some(\n      (observation) =>\n        observation._tag === \"Answer\" && !answersMatch(requirement, observation.answers),\n    )\n  ) {\n    return PublicDnsObservation.Mismatch({ evidence });\n  }\n  if (evidence.some((observation) => observation._tag === \"NoData\")) {\n    return PublicDnsObservation.Pending({ evidence });\n  }\n  return PublicDnsObservation.Unavailable({ evidence });\n}\n\nfunction answersMatch(\n  requirement: DnsRecord.DnsRecord,\n  answers: ReadonlyArray<{ readonly data: string; readonly name: string; readonly type: string }>,\n): boolean {\n  const expected = DnsData.parse(requirement._tag, recordValue(requirement));\n  return answers.some(\n    (answer) =>\n      answer.name === requirement.name &&\n      answer.type === requirement._tag &&\n      DnsData.parse(requirement._tag, answer.data) === expected,\n  );\n}\n\nfunction aggregate(evidence: Evidence): Result {\n  const requested = [evidence.provider, evidence.publicDns].filter(\n    (observation): observation is ProviderObservation | PublicDnsObservation =>\n      observation !== null,\n  );\n  if (requested.length === 0) return Result.NotObserved(evidence);\n  if (\n    requested.every(\n      (observation) => observation._tag === \"Matched\" || observation._tag === \"Verified\",\n    )\n  ) {\n    return Result.Verified(evidence);\n  }\n  if (requested.some((observation) => observation._tag === \"Unavailable\")) {\n    return Result.Unavailable(evidence);\n  }\n  if (requested.some((observation) => observation._tag === \"Mismatch\")) {\n    return Result.Mismatch(evidence);\n  }\n  return Result.Pending(evidence);\n}\n\nfunction recordValue(requirement: DnsRecord.DnsRecord): string {\n  const data = DnsRecord.data(requirement);\n  switch (requirement._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return String(data.address);\n    case \"CNAME\":\n    case \"NS\":\n      return String(data.target);\n    case \"TXT\":\n      return String(data.value);\n    case \"MX\":\n      return `${data.priority} ${data.exchange}`;\n    case \"CAA\":\n      return `${data.flags} ${data.tag} ${data.value}`;\n    case \"SRV\":\n      return `${data.priority} ${data.weight} ${data.port} ${data.target}`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;ACEA,MAAa,WAAW,OAAO,SAAS;CACtC;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAa,cAAc,OAAO,SAAS;CAAC;CAAS;CAAqB;CAAQ;AAAS,CAAC;AAG5F,MAAa,SAAS;CACpB,UAAU;CACV,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO;AACT;AAUA,SAAgB,KAAK,OAMN;CACb,OAAO;EACL,UAAU,MAAM;EAChB,SAAS,MAAM;EACf,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,KAAK,MAAM;CACb;AACF;;;;;;;;ACpCA,MAAa,SAASA,OAAE,YAAY;CAClC,aAAa;EACX,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE;EACd,eAAeA,OAAE;CACnB;CACA,QAAQ;EACN,qBAAqBA,OAAE,OAAO;GAC5B,wBAAwBA,OAAE;GAC1B,QAAQA,OAAE;GACV,qBAAqBA,OAAE,YAAYA,OAAE,MAAM;GAC3C,gBAAgBA,OAAE;EACpB,CAAC;EACD,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,YAAYA,OAAE,SAAS;GAAC;GAAQ;GAAuB;EAAoB,CAAC;EAC5E,QAAQA,OAAE,MAAMA,OAAE,MAAM;CAC1B;CACA,OAAO;EACL,cAAcA,OAAE,MAAMA,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC,CAAC;EAC3D,iBAAiBA,OAAE;CACrB;AACF,CAAC;AAED,MAAaC,WAASD,OAAE,OAAO;CAC7B,SAASA,OAAE,MAAM,MAAM;CACvB,YAAYA,OAAE;AAChB,CAAC;AASD,MAAa,SAAS,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACtDA,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;;;;;;;;AC/BA,MAAa,WAAW,OAAO,OAAO;CACpC,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,yBAAyB,OAAO;CAChC,oBAAoB,OAAO,MAAMC,QAAiB;CAClD,YAAY,OAAO;CACnB,MAAMA;AACR,CAAC;AAGD,MAAa,YAAY,OAAO,YAAY;CAC1C,UAAU;EACR,WAAW;EACX,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,YAAY,yBAAyB,CAAC;CACjE;CACA,QAAQ;EACN,UAAU,OAAO,MAAM,QAAQ;EAC/B,QAAQ,OAAO,SAAS,CAAC,aAAa,aAAa,CAAC;CACtD;AACF,CAAC;AAGD,SAAgB,OAAO,OAUT;CACZ,MAAM,SAASC,QAAiB,MAAM,MAAM;CAC5C,MAAM,iBAAiB,IAAI,IAAIC,WAAiB,MAAM,CAAC;CACvD,MAAM,gBAAgB,cAAc,MAAM,wBAAwB;CAClE,MAAM,WAAW,MAAM,eAAe,QAAQ,cAAc;EAC1D,IAAI,CAAC,eAAe,IAAID,QAAiB,UAAU,IAAI,CAAC,GAAG,OAAO;EAClE,IAAI;GACF,YAAuB,UAAU,YAAY,UAAU,eAAe;IACpE,YAAY;IACZ;IACA,GAAI,MAAM,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI;IACpD,YAAY,UAAU;GACxB,CAAC;GACD,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CACD,MAAM,WAAW,SAAS,KAAK,cAAc,YAAY,WAAW,aAAa,CAAC;CAElF,IAAI,MAAM,aAAa,KAAA,GAAW;EAChC,MAAM,eAAeA,QAAiB,MAAM,SAAS,IAAI;EACzD,MAAM,QAAQ,SAAS,WACpB,cACC,UAAU,eAAe,MAAM,UAAU,cACzC,UAAU,cAAc,sBAAsB,MAAM,SAAS,aAC7DA,QAAiB,UAAU,IAAI,MAAM,YACzC;EACA,IAAI,QAAQ,GACV,MAAME,mBACJ,sDACA,0BACF;EAEF,MAAM,YAAY,SAAS;EAC3B,IAAI,cAAc,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;EACpF,OAAO;GAAE,MAAM;GAAY;GAAW;GAAU,QAAQ;EAAW;CACrE;CAEA,MAAM,WAAW,SAAS,QAAQ,EAAE,8BAA8B,uBAAuB;CACzF,MAAM,YAAY,SAAS;CAC3B,OAAO,SAAS,WAAW,KAAK,cAAc,KAAA,IAC1C;EAAE,MAAM;EAAY;EAAW;EAAU,QAAQ;CAA0B,IAC3E;EACE,MAAM;EACN;EACA,QAAQ,SAAS,SAAS,IAAI,cAAc;CAC9C;AACN;AAEA,SAAS,YACP,WACA,eACU;CACV,MAAM,aAAa,IAAI,IAAI,cAAc,UAAU,WAAW,CAAC;CAC/D,MAAM,qBAAqB,cAAc,QAAQ,eAAe,WAAW,IAAI,UAAU,CAAC;CAC1F,OAAO;EACL,WAAW,UAAU,cAAc;EACnC,cAAc,UAAU,WAAW;EACnC,yBACE,cAAc,SAAS,KAAK,mBAAmB,WAAW,cAAc;EAC1E;EACA,YAAY,UAAU;EACtB,MAAMF,QAAiB,UAAU,IAAI;CACvC;AACF;AAEA,SAAS,cAAc,aAA0E;CAC/F,OAAO,CAAC,GAAG,IAAI,IAAI,YAAY,IAAIA,OAAgB,CAAC,CAAC,CAAC,CAAC,KAAK;AAC9D;;;;AC5GA,MAAa,YAAY,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAOhF;CACD,MAAM,SAAS,OAAO,OAAO,IAAI;EAC/B,WACEG,YAAuB,MAAM,YAAY,MAAM,eAAe;GAC5D,YAAY;GACZ,QAAQ,MAAM;GACd,YAAY,MAAM,KAAK;EACzB,CAAC;EACH,QAAQ,UACN,iBAAiBC,sBAAiC,iBAAiBC,UAC/D,QACAC,mBACE,+BACA,mCACF;CACR,CAAC;CACD,MAAM,gBAAgB,OAAOC,YAC3B,MAAM,MACN,MAAM,cACN,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa,CAC7E;CACA,MAAM,WAAW,IAAI,IAAI,cAAc,YAAY;CAQnD,IAPqB,MAAM,KAAK,WAAW,QACxC,cACC,UAAU,SAAS,YACnB,SAAS,IAAI,UAAU,EAAE,KACzB,UAAU,YAAY,SAAS,UAC/B,CAAC,UAAU,YAAY,KAAK,SAAS,IAAI,QAAQ,CAEtC,CAAC,CAAC,SAAS,GACxB,OAAO,OAAOD,mBACZ,kDAAkD,UAClD,mCACF;CAEF,OAAO;AACT,CAAC;;;;AC9CD,MAAM,mBAAmB,OAAO,OAAO,KACrC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,YAAY;CAC5C,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,kBAAkB,OAAO,OAAO,KACpC,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAWE,QAAiB,KAAK,CAAC,CAAC,SAAS;EAC5C,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;CACJ,CAAC;CACH,SAAS,UAAU,OAAO,QAAQ,KAAK;AACzC,CAAC,CACH,CACF;AAEA,MAAM,cAAc,gBAAgB,GAAG,CAAC;AACxC,MAAM,eAAe,gBAAgB,GAAG,CAAC;AAEzC,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU;EACjB,MAAM,UAAU,MAAM,KAAK;EAC3B,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,oBAAoB,CAAC;EACzD,OAAO,OAAO,WAAW,IACrB,UACA,OACG,KAAK,WAAW,MAAM,MAAM,GAAA,CAAI,QAAQ,QAAQ,IAAG,CAAC,CAAC,QAAQ,SAAS,IAAI,CAAC,CAAC,CAC5E,KAAK,EAAE;CAChB;CACA,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,MAAM,eAAe,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,QACP,qBAAqB,UAAU;CAC7B,SAAS,UAAU,MAAM,KAAK,CAAC,CAAC,QAAQ,mBAAmB,KAAK;CAChE,SAAS,UAAU;AACrB,CAAC,CACH,CACF;AAEA,SAAgB,MAAM,MAAsB,OAAwB;CAClE,MAAM,gBAAgB;EACpB,QAAQ,MAAR;GACE,KAAK;GACL,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,MACH,OAAO;GACT,KAAK,MACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;GACT,KAAK,OACH,OAAO;EACX;CACF,EAAA,CAAG;CACH,IAAI;EACF,OAAO,OAAO,kBAAkB,MAAM,CAAC,CAAC,KAAK;CAC/C,SAAS,OAAO;EACd,MAAM,IAAIC,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAS,gBAAgB,QAAgB,aAAqB;CAC5D,OAAO,OAAO,OAAO,KACnB,OAAO,SACL,OAAO,QACP,qBAAqB,gBAAgB;EACnC,SAAS,OAAO,YACd,OAAO,IAAI;GACT,WAAW;IACT,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;IACtC,IAAI,MAAM,WAAW,QACnB,MAAM,IAAI,MAAM,4CAA4C;IAC9D,MAAM,SAAS,MAAM;IACrB,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,8BAA8B;IACxE,MAAM,eAAeD,QAAiB,MAAM;IAC5C,OAAO,MAAM,KAAK,GAAG;GACvB;GACA,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;EACJ,CAAC;EACH,SAAS,UAAU,OAAO,QAAQ,KAAK;CACzC,CAAC,CACH,CACF;AACF;;;;;;;;ACzGA,SAAgBE,OAAK,SAAyC;CAC5D,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,YAAY,QAAQ,aAAa;CACvC,OAAO,EACL,SAAS,OAAO,GAAG,sBAAsB,CAAC,EAAE,UAC1C,OAAO,WAAW;EAChB,MAAM,iBACJ,QAAQ;GAAE;GAAc;GAAO;GAAO;GAAW,UAAU,QAAQ;EAAS,CAAC;EAC/E,QAAQ,UACN,iBAAiBC,UACb,QACA,IAAIA,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,iBAAiB,OAAO,OAAO,CAAC,CAAC,CACvE,EACF;AACF;AAEA,MAAaC,WAAS,YACpB,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,YACtBC,UAAoBL,OAAK,OAAO,CAAC;AAEnC,SAAS,iBACP,OACA,SAC0D;CAC1D,OAAO,OAAO,IAAI;EAChB,WAAW,UAAU,OAAO,OAAO;EACnC,QAAQ,UACN,IAAIC,QAAkB;GACpB;GACA,SAAS;GACT,QAAQ;EACV,CAAC;CACL,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,WAAW,eAAe,OAAO,MAAM,CAAC,GACxD,OAAO,QAAQ,YAAY,CAC7B;AACF;AAEA,SAAS,aACP,QAC0D;CAC1D,IAAI,OAAO,UAAU,YACnB,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,IAAI,OAAO,UAAU,WACnB,OAAO,OAAO,KACZ,IAAIA,QAAkB;EACpB,SAAS,yBAAyB,OAAO,SAAS;EAClD,QAAQ;CACV,CAAC,CACH;CAEF,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,QAAQ,WAAW,GAC5D,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CAE1C,OAAO,OAAO,QAAQ,OAAO,SAAS,cAAc,EAAE,aAAa,YAAY,CAAC,CAAC,CAAC,KAChF,OAAO,KAAK,YAAoC;EAC9C,MAAM,mBAAmB,QAAQ,QAAQ,WAAW,WAAW,IAAI;EACnE,OAAO,iBAAiB,WAAW,IAC/B,EAAE,MAAM,SAAS,IACjB;GAAE,MAAM;GAAU,SAAS;EAAiB;CAClD,CAAC,CACH;AACF;AAEA,SAAS,eACP,OACA,QACoD;CACpD,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,IAAI,OAAO,SAAS,YAAY,MAAM,IAAI,MAAM,0BAA0B;GAC1E,IAAI,OAAO,OAAO,GAAG,MAAM,IAAI,MAAM,4CAA4C;GACjF,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,uCAAuC;GAC3E,MAAM,YAAY,OAAO,aAAa,CAAC;GACvC,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,2CAA2C;GACvF,MAAM,WAAW,UAAU;GAC3B,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;GACnF,IACE,SAAS,UAAU,QACnB,SAAS,SAAS,MAAM,QACxBK,QAAiB,SAAS,IAAI,MAAM,MAAM,MAE1C,MAAM,IAAI,MAAM,6CAA6C;GAE/D,OAAO;EACT;EACA,QAAQ,UACN,IAAIL,QAAkB;GACpB;GACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GAClD,QAAQ;EACV,CAAC;CACL,CAAC;AACH;AAEA,SAAS,aACP,QAC6D;CAC7D,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,OAAO,UAAU,MAAM,OAAO;EAClC,MAAM,UAAU,OAAO,OAAO,IAAI;GAChC,WAAW,WAAW,MAAM;GAC5B,QAAQ,UACN,IAAIA,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,YAAY,KAAA,GAAW,OAAO;EAClC,MAAM,OAAO,OAAOM,SAAkB,OAAO,IAAI;EACjD,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAWC,MAAc,QAAQ,MAAM,QAAQ,IAAI;GACnD,QAAQ,UACN,IAAIP,QAAkB;IACpB;IACA,SAAS;IACT,QAAQ;GACV,CAAC;EACL,CAAC;EACD,IAAI,OAAO,QAAQ,KAAA,GACjB,OAAO,OAAO,IAAIA,QAAkB;GAClC,SAAS;GACT,QAAQ;EACV,CAAC;EAEH,OAAO;GAAE;GAAM;GAAM,KAAK,OAAO;GAAK,MAAM,QAAQ;EAAK;CAC3D,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,iBAAiBA,UACb,QACA,IAAIA,QAAkB;EAAE;EAAO,SAAS,MAAM;EAAS,QAAQ;CAAW,CAAC,CACjF,CACF;AACF;AAEA,SAAS,WACP,QACsE;CACtE,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,MACH,OAAO;GAAE,MAAM,OAAO;GAAM,MAAM,OAAO;EAAK;EAChD,KAAK,OACH,OAAO;GACL,MAAM,GAAG,OAAO,KAAK,SAAS,EAAE,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK;GAClE,MAAM,OAAO;EACf;EACF,KAAK,MACH,OAAO;GACL,MAAM,GAAG,eAAe,OAAO,KAAK,YAAY,eAAe,EAAE,GAAG,OAAO,KAAK;GAChF,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GACL,MAAM;IACJ,eAAe,OAAO,KAAK,UAAU,cAAc;IACnD,eAAe,OAAO,KAAK,QAAQ,YAAY;IAC/C,eAAe,OAAO,KAAK,MAAM,UAAU;IAC3C,OAAO,KAAK;GACd,CAAC,CAAC,KAAK,GAAG;GACV,MAAM,OAAO;EACf;EACF,KAAK,OACH,OAAO;GAAE,MAAM,UAAU,OAAO,IAAI;GAAG,MAAM,OAAO;EAAK;EAC3D,SACE;CACJ;AACF;AAEA,SAAS,UAAU,MAAiC;CAElD,MAAM,WADS,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,EAAA,CAC1B,KAAK,UAC1B,OAAO,UAAU,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,KAChE;CACA,MAAM,SAAS,QAAQ,QAAQ,OAAO,UAAU,QAAQ,MAAM,QAAQ,CAAC;CACvE,MAAM,SAAS,IAAI,WAAW,MAAM;CACpC,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,SAAS;EAC3B,OAAO,IAAI,OAAO,MAAM;EACxB,UAAU,MAAM;CAClB;CACA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM;AAChE;AAEA,SAAS,eAAe,OAA2B,OAAuB;CACxE,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,wBAAwB,OAAO;CACxE,OAAO;AACT;AAEA,eAAe,QAAQ,OAMC;CACtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,WAAW;CACf,MAAM,wBAAwB,WAAW,MAAM,MAAM,aAAa,MAAM;CACxE,MAAM,sBAAsB,WAAW,MAAM,MAAM,MAAM,QAAQ,MAAM;CACvE,MAAM,aAAa,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAC5E,MAAM,MAAM,QAAQ,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;CAC3E,MAAM,QAAQ,iBAAiB;EAC7B,WAAW;EACX,WAAW,sBAAM,IAAI,MAAM,0BAA0B,CAAC;CACxD,GAAG,MAAM,SAAS;CAClB,IAAI;EACF,MAAM,QAAQ,WAAW,KACvB,UAAU,OAAO;GACf,OAAO,UAAU;GACjB,IAAI;GACJ,WAAW,CAAC;IAAE,MAAM,MAAM,MAAM;IAAM,MAAM,MAAM,MAAM;GAAK,CAAC;GAC9D,MAAM;EACR,CAAC,CACH;EACA,MAAM,WAAW,MAAM,MAAM,MAAM,IAAI,IAAI,MAAM,QAAQ,GAAG;GAC1D,MAAM;GACN,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,QAAQ;GACR,QAAQ,WAAW;EACrB,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,QAAkB;GAC1B,SAAS,qBAAqB,SAAS;GACvC,QAAQ;EACV,CAAC;EAEH,MAAM,cAAc,SAAS,QAC1B,IAAI,cAAc,CAAC,EAClB,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAChB,KAAK,CAAC,CACP,YAAY;EACf,IAAI,gBAAgB,2BAClB,MAAM,IAAIA,QAAkB;GAC1B,SAAS,yCAAyC,eAAe;GACjE,QAAQ;EACV,CAAC;EAEH,OAAO,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;CACpD,SAAS,OAAO;EACd,IAAI,UACF,MAAM,IAAIA,QAAkB;GAAE,SAAS;GAAuB,QAAQ;EAAU,CAAC;EAEnF,MAAM;CACR,UAAU;EACR,aAAa,KAAK;EAClB,MAAM,aAAa,oBAAoB,SAAS,eAAe;EAC/D,MAAM,MAAM,QAAQ,oBAAoB,SAAS,aAAa;CAChE;AACF;;;;;;;;AClRA,MAAMQ,aAAW;AAMjB,SAAgBC,OAAK,UAAmB,CAAC,GAA0B;CACjE,OAAOC,OAAkB;EAAE,GAAG;EAAS,UAAU,QAAQ,YAAYF;CAAS,CAAC;AACjF;AAEA,MAAaG,WAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBH,OAAK,OAAO,CAAC;AAElD,MAAaI,aAAW,UAAmB,CAAC,MAC1CC,UAAoBL,OAAK,OAAO,CAAC;;;;;;;;ACdnC,MAAM,WAAW;AAMjB,SAAgBM,OAAK,UAAmB,CAAC,GAA0B;CACjE,OAAOC,OAAkB;EAAE,GAAG;EAAS,UAAU,QAAQ,YAAY;CAAS,CAAC;AACjF;AAEA,MAAa,SAAS,UAAmB,CAAC,MACxC,MAAM,QAAQC,WAAqBF,OAAK,OAAO,CAAC;AAElD,MAAa,WAAW,UAAmB,CAAC,MAC1CG,UAAoBH,OAAK,OAAO,CAAC;;;;;;;;;;;ACInC,MAAa,cAAc,KAAK,WAAwB;AAOxD,MAAM,iBAAiB,KAAK,WAAmB;AAC/C,MAAM,gBAAgB,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AACvE,MAAM,eAAe,OAAO,YAAY;CACtC,UAAU,CAAC;CACX,UAAU,CAAC;CACX,QAAQ,EAAE,SAAS,cAAc;AACnC,CAAC;AACD,MAAa,SAAS;CACpB,UAAU,eAAe;CACzB,UAAU,eAAe;CACzB,SAAS,EAAE,cACT,eAAe,OAAO,EAAE,SAAS,OAAO,kBAAkB,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;CACrF,QAAQ;AACV;AAMA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;AAElG,SAAgB,KAAK,SAA0C;CAC7D,OAAO,QAAQ,GAAG,EAChB,SAAS,OAAO,GAAG,yBAAyB,CAAC,EAAE,UAC7C,OAAO,QAAQ,UAAU,UAAUI,UAAQ,OAAO,KAAK,GAAG,EAAE,aAAa,YAAY,CAAC,CACxF,EACF,CAAC;AACH;;AAKA,SAAgB,YAAY,UAA0B,CAAC,GAAc;CACnE,MAAM,YAAY,QAAQ,aAAa;CACvC,OAAO,KAAK,CACV;EACE,IAAI;EACJ,UAAUC,OAA4B,OAAO;EAC7C;CACF,GACA;EAAE,IAAI;EAAU,UAAUC,OAAwB,OAAO;EAAG;CAAU,CACxE,CAAC;AACH;AAEA,MAAa,gBAAgB,UAA0B,CAAC,MACtD,MAAM,QAAQ,SAAS,YAAY,OAAO,CAAC;AAE7C,SAASF,UAAQ,OAAc,OAAsD;CACnF,MAAM,YAAY,MAAM,aAAa;CACrC,OAAO,MAAM,SAAS,QAAQ,KAAK,CAAC,CAAC,KACnC,OAAO,QAAQ,SAAS,GACxB,OAAO,MAAM;EACX,YAAY,YAAyB;GACnC,IACE,QAAQ,SAAS,kBAChB,QAAQ,SAAS,mBAAmB,QAAQ,WAAW,WAExD,OAAO,YAAY,SAAS;IAAE,YAAY,MAAM;IAAI;GAAU,CAAC;GAEjE,OAAO,YAAY,OAAO;IACxB,SAAS,QAAQ;IACjB,QAAQ,QAAQ,WAAW,aAAa,aAAa;IACrD,YAAY,MAAM;GACpB,CAAC;EACH;EACA,YAAY,eACV,WAAW,SAAS,WAChB,YAAY,OAAO,EAAE,YAAY,MAAM,GAAG,CAAC,IAC3C,YAAY,OAAO;GAAE,SAAS,WAAW;GAAS,YAAY,MAAM;EAAG,CAAC;CAChF,CAAC,CACH;AACF;;;;;;;;;;;ACxFA,MAAa,YAAY,KAAK,WAAsB;AAMpD,MAAa,WAAW,KAAK,WAAqB;AAyBlD,MAAa,sBAAsB,KAAK,WAAgC;AAWxE,MAAa,uBAAuB,KAAK,WAAiC;AAc1E,MAAa,SAAS,KAAK,WAAmB;AAS9C,SAAgB,QACd,OAC+D;CAC/D,OAAO,cAAc,KAAK;AAC5B;AAEA,MAAM,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAe;CAChF,MAAM,YAAY,MAAM,aAAa,UAAU,QAAQ,CAAC,CAAC;CACzD,MAAM,WAAW,MAAM,YAAY,SAAS,SAAS;CACrD,MAAM,eACJ,UAAU,SAAS,aACf,OAAO,QAAqC,IAAI,IAChD,iBAAiB,MAAM,QAAQ,UAAU,UAAA,OAAiC,SAAS,CAAC;CAC1F,MAAM,iBACJ,SAAS,SAAS,aACd,OAAO,QAAoC,IAAI,IAC/C,OAAO,QAAQG,YAAsB,YACnC,gBAAgB,SAAS,SAAS,MAAM,MAAM,MAAM,CAAC,CAAC,KACpD,OAAO,OAAO,YACZ,OAAO,QACL,oBAAoB,YAAY,EAAE,SAAS,QAAQ,QAAQ,CAAC,CAC9D,CACF,CACF,CACF;CACN,MAAM,CAAC,qBAAqB,wBAAwB,OAAO,OAAO,IAChE,CAAC,gBAAgB,YAAY,GAC7B,EAAE,aAAa,YAAY,CAC7B;CACA,OAAO,UAAU;EAAE,UAAU;EAAqB,WAAW;CAAqB,CAAC;AACrF,CAAC;AAED,SAAS,gBACP,UACA,MACA,aACuD;CACvD,OAAO,SAAS,YAAY,IAAI,CAAC,CAAC,KAChC,OAAO,KAAK,YAAiC;EAC3C,IACE,QAAQ,MACL,aAAa,SAAS,SAAS,YAAYC,OAAiB,UAAU,WAAW,CACpF,GAEA,OAAO,oBAAoB,QAAQ;EAErC,MAAM,UAAU,QAAQ,QACrB,aACC,SAAS,SAAS,YAClB,SAAS,SAAS,YAAY,QAC9B,SAAS,SAAS,YAAY,IAClC;EACA,OAAO,QAAQ,WAAW,IACtB,oBAAoB,QAAQ,IAC5B,oBAAoB,SAAS,EAAE,SAAS,QAAQ,CAAC;CACvD,CAAC,CACH;AACF;AAEA,SAAS,iBACP,aACA,QACwD;CACxD,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,kBAAkB,OAAO,OAAO,oBAAA,OAA2C,MAAM,CAAC,CACtF,MACF,CAAC,CAAC,KAAK,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC;EACpF,MAAM,iBAAiB,OAAO,OAAO,cAAcC,OAAuB;EAE1E,MAAM,WAAW,OADJ,OAAO,UAAU,sBAAsBC,YAA4B,CACrD,CAAC,CAAC,QAAQ;GAAE,MAAM,YAAY;GAAM,MAAM,YAAY;EAAK,CAAC;EACvF,IAAI,gBAAgB,SAAS,YAAY,gBAAgB,UAAU,SAAS,QAC1E,OAAO,OAAO,IAAIF,QAAkB,EAClC,SAAS,kBAAkB,gBAAgB,QAAQ,eAAe,SAAS,OAAO,uBACpF,CAAC;EAEH,OAAO,kBAAkB,aAAa,iBAAiB,QAAQ;CACjE,CAAC;AACH;AAEA,SAAS,kBACP,aACA,QACA,UACsB;CACtB,MAAM,qBAAqB,SAAS,SAAS,gBAC3C,YAAY,SAAS,YAAY,aAAa,aAAa,YAAY,OAAO,IAC1E,CAAC,YAAY,UAAU,IACvB,CAAC,CACP;CACA,MAAM,WACJ,OAAO,SAAS,aAAa,IAAI,OAAO,SAAS,aAAa,SAAS,SAAS,OAAO;CACzF,IAAI,WAAW,KAAK,mBAAmB,UAAU,UAC/C,OAAO,qBAAqB,SAAS;EAAE;EAAU;CAAmB,CAAC;CAEvE,MAAM,cAAc,SAAS,QAC1B,gBAAgB,YAAY,SAAS,cAAc,YAAY,SAAS,QAC3E,CAAC,CAAC;CACF,IAAI,cAAc,KAAK,mBAAmB,SAAS,eAAe,UAChE,OAAO,qBAAqB,YAAY,EAAE,SAAS,CAAC;CAEtD,IACE,SAAS,MACN,gBACC,YAAY,SAAS,YAAY,CAAC,aAAa,aAAa,YAAY,OAAO,CACnF,GAEA,OAAO,qBAAqB,SAAS,EAAE,SAAS,CAAC;CAEnD,IAAI,SAAS,MAAM,gBAAgB,YAAY,SAAS,QAAQ,GAC9D,OAAO,qBAAqB,QAAQ,EAAE,SAAS,CAAC;CAElD,OAAO,qBAAqB,YAAY,EAAE,SAAS,CAAC;AACtD;AAEA,SAAS,aACP,aACA,SACS;CACT,MAAM,WAAWG,MAAc,YAAY,MAAM,YAAY,WAAW,CAAC;CACzE,OAAO,QAAQ,MACZ,WACC,OAAO,SAAS,YAAY,QAC5B,OAAO,SAAS,YAAY,QAC5BA,MAAc,YAAY,MAAM,OAAO,IAAI,MAAM,QACrD;AACF;AAEA,SAAS,UAAU,UAA4B;CAC7C,MAAM,YAAY,CAAC,SAAS,UAAU,SAAS,SAAS,CAAC,CAAC,QACvD,gBACC,gBAAgB,IACpB;CACA,IAAI,UAAU,WAAW,GAAG,OAAO,OAAO,YAAY,QAAQ;CAC9D,IACE,UAAU,OACP,gBAAgB,YAAY,SAAS,aAAa,YAAY,SAAS,UAC1E,GAEA,OAAO,OAAO,SAAS,QAAQ;CAEjC,IAAI,UAAU,MAAM,gBAAgB,YAAY,SAAS,aAAa,GACpE,OAAO,OAAO,YAAY,QAAQ;CAEpC,IAAI,UAAU,MAAM,gBAAgB,YAAY,SAAS,UAAU,GACjE,OAAO,OAAO,SAAS,QAAQ;CAEjC,OAAO,OAAO,QAAQ,QAAQ;AAChC;AAEA,SAAS,YAAY,aAA0C;CAC7D,MAAMC,SAAOC,KAAe,WAAW;CACvC,QAAQ,YAAY,MAApB;EACE,KAAK;EACL,KAAK,QACH,OAAO,OAAOD,OAAK,OAAO;EAC5B,KAAK;EACL,KAAK,MACH,OAAO,OAAOA,OAAK,MAAM;EAC3B,KAAK,OACH,OAAO,OAAOA,OAAK,KAAK;EAC1B,KAAK,MACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK;EAClC,KAAK,OACH,OAAO,GAAGA,OAAK,MAAM,GAAGA,OAAK,IAAI,GAAGA,OAAK;EAC3C,KAAK,OACH,OAAO,GAAGA,OAAK,SAAS,GAAGA,OAAK,OAAO,GAAGA,OAAK,KAAK,GAAGA,OAAK;CAChE;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domainkit",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Provider-independent DNS provisioning plans and authorization for TypeScript",
   "keywords": [
     "dns",

package/dist/authorization-DOg2Re1D.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization-DOg2Re1D.mjs","names":["Error","Repository.Service","InvalidInputError","decode","encode","S","Schema","ProviderContext.Envelope","InvalidInputError"],"sources":["../src/auth/connect.ts","../src/auth/secret.ts","../src/auth/provider-context.ts","../src/auth/authorization.ts"],"sourcesContent":["import { Clock, Crypto, Data, Effect, Schema } from \"effect\";\n\nimport { CryptoError } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as Binding from \"./connection.ts\";\nimport * as Repository from \"./lifecycle-repository.ts\";\nimport type * as ProviderContext from \"./provider-context.ts\";\nimport type * as Secret from \"./secret.ts\";\n\nexport interface Authentication {\n  readonly capabilityEvidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>;\n  readonly credential: Binding.StoredCredential;\n  readonly expiresAt: Date | null;\n  readonly providerAccountId: string;\n  readonly providerContext: ProviderContext.Envelope;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport type AuthenticationFailure = Error | InvalidInputError | DnsProvider.Error;\n\nexport interface InteractiveStart {\n  readonly authorizationUrl: URL;\n  readonly payload: Secret.Value;\n}\n\nexport interface Continuation extends BaseInput {\n  readonly expiresAt: Date;\n  readonly id: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;\n  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (\n    payload: Secret.Value,\n    callbackUrl: URL,\n  ) => Effect.Effect<Authentication, AuthenticationFailure>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (\n    continuationId: string,\n  ) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (\n      token: Secret.Value,\n    ) => Effect.Effect<Authentication, AuthenticationFailure>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport type StartResult = Data.TaggedEnum<{\n  Connected: { readonly aggregate: Repository.Aggregate };\n  Redirect: { readonly authorizationUrl: URL; readonly continuationId: string };\n}>;\nexport const StartResult = Data.taggedEnum<StartResult>();\n\nexport class Error extends Schema.TaggedError<Error>()(\"ConnectionError\", {\n  category: Schema.Literals([\"authorization\", \"provider\", \"validation\"]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport interface BaseInput {\n  readonly authorizedById: string;\n  readonly grant: Binding.Grant;\n  readonly ownerId: string;\n}\n\nexport interface CompleteInput {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n}\n\nconst persist = Effect.fn(\"Connection.persist\")(function* (\n  input: BaseInput & {\n    readonly authentication: Authentication;\n    readonly method: \"integration\" | \"oauth2\" | \"token\";\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  },\n) {\n  const repository = yield* Repository.Service;\n  const crypto = yield* Crypto.Crypto;\n  const now = new Date(yield* Clock.currentTimeMillis);\n  const missingCapability = input.requiredCapabilities.find(\n    (capability) =>\n      !input.authentication.capabilityEvidence.some((item) => item.capability === capability),\n  );\n  if (missingCapability !== undefined) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: `Provider authorization lacks evidence for ${missingCapability}`,\n      operation: \"Connection.persist\",\n      retry: \"after-user-action\",\n    });\n  }\n  const existing = yield* repository.findByProviderAccount(\n    input.providerId,\n    input.authentication.providerAccountId,\n  );\n  const authorizationId =\n    existing?.authorization.id ??\n    (yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.persist\",\n            retry: \"safe\",\n          }),\n      ),\n    ));\n  const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);\n  const binding: Binding.Connection = {\n    authorizationId,\n    createdAt: existingBinding?.createdAt ?? now,\n    grant: input.grant,\n    id:\n      existingBinding?.id ??\n      (yield* crypto.randomUUIDv4.pipe(\n        Effect.mapError(\n          (cause) =>\n            new Error({\n              category: \"validation\",\n              message: cause.message,\n              operation: \"Connection.persist\",\n              retry: \"safe\",\n            }),\n        ),\n      )),\n    ownerId: input.ownerId,\n  };\n  const aggregate: Repository.Aggregate = {\n    authorization: {\n      authorizedById: input.authorizedById,\n      capabilityEvidence: [...input.authentication.capabilityEvidence],\n      createdAt: existing?.authorization.createdAt ?? now,\n      expiresAt: input.authentication.expiresAt,\n      id: authorizationId,\n      method: input.method,\n      providerAccountId: input.authentication.providerAccountId,\n      providerContext: input.authentication.providerContext,\n      providerId: input.providerId,\n      requiredCapabilities: [...input.requiredCapabilities],\n      revocation: { _tag: \"Active\" },\n      scopes: [...input.authentication.scopes],\n    },\n    bindings: [\n      ...(existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? []),\n      binding,\n    ],\n    credential: input.authentication.credential,\n  };\n  return yield* repository.connect(aggregate);\n});\n\nexport const start = Effect.fn(\"Connection.start\")(function* (\n  input: BaseInput & { readonly method: Method },\n) {\n  if (input.method._tag === \"Interactive\") {\n    const crypto = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const continuationId = yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.start\",\n            retry: \"safe\",\n          }),\n      ),\n    );\n    const started = yield* input.method.flow.start(continuationId);\n    yield* input.method.continuations.put({\n      authorizedById: input.authorizedById,\n      expiresAt: new Date(now + (input.method.ttlMs ?? 10 * 60_000)),\n      grant: input.grant,\n      id: continuationId,\n      method: input.method.flow.method,\n      ownerId: input.ownerId,\n      payload: started.payload,\n      providerId: input.method.flow.providerId,\n      requiredCapabilities: [...input.method.flow.requiredCapabilities],\n    });\n    return StartResult.Redirect({\n      authorizationUrl: started.authorizationUrl,\n      continuationId,\n    });\n  }\n  const authentication = yield* input.method.authenticate(input.method.token);\n  const aggregate = yield* persist({\n    authentication,\n    authorizedById: input.authorizedById,\n    grant: input.grant,\n    method: \"token\",\n    ownerId: input.ownerId,\n    providerId: input.method.providerId,\n    requiredCapabilities: input.method.requiredCapabilities,\n  });\n  return StartResult.Connected({ aggregate });\n});\n\nexport const complete = Effect.fn(\"Connection.complete\")(function* (input: CompleteInput) {\n  const continuation = yield* input.continuations.consume(\n    input.continuationId,\n    new Date(yield* Clock.currentTimeMillis),\n  );\n  if (continuation === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation is expired, unknown, or already consumed\",\n      operation: \"Connection.complete\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    continuation.providerId !== input.flow.providerId ||\n    continuation.method !== input.flow.method\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation does not match the provider flow\",\n      operation: \"Connection.complete\",\n      retry: \"never\",\n    });\n  }\n  const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);\n  return yield* persist({\n    authentication,\n    authorizedById: continuation.authorizedById,\n    grant: continuation.grant,\n    method: continuation.method,\n    ownerId: continuation.ownerId,\n    providerId: continuation.providerId,\n    requiredCapabilities: continuation.requiredCapabilities,\n  });\n});\n\nexport type Requirements = Repository.Service | Crypto.Crypto;\nexport type Failure = AuthenticationFailure | Repository.Error | CryptoError;\n","/** A deliberately non-serializable credential value. */\nexport class Value {\n  readonly #value: string;\n\n  private constructor(value: string) {\n    this.#value = value;\n  }\n\n  static from(value: string): Value {\n    if (value.length === 0) throw new Error(\"Secret values cannot be empty\");\n    return new Value(value);\n  }\n\n  expose(): string {\n    return this.#value;\n  }\n\n  toJSON(): string {\n    return \"[REDACTED]\";\n  }\n\n  toString(): string {\n    return \"[REDACTED]\";\n  }\n}\n\nexport const make = Value.from;\n","import { Effect, Schema } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\n/** A provider-owned, versioned, non-secret context value persisted by the host. */\nexport const Envelope = Schema.Struct({\n  value: Schema.Json,\n  version: Schema.String,\n});\nexport interface Envelope extends Schema.Schema.Type<typeof Envelope> {}\n\nexport interface Codec<A> {\n  readonly decode: (envelope: Envelope) => Effect.Effect<A, InvalidInputError>;\n  readonly encode: (value: A) => Effect.Effect<Envelope, InvalidInputError>;\n  readonly version: string;\n}\n\n/** Build an adapter-owned context codec from a schema and stable version identifier. */\nexport function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A> {\n  return {\n    decode: Effect.fn(\"ProviderContext.decode\")((envelope) =>\n      envelope.version !== version\n        ? Effect.fail(\n            new InvalidInputError({\n              message: `Unsupported provider context version: ${envelope.version}`,\n            }),\n          )\n        : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(\n            Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n          ),\n    ),\n    encode: Effect.fn(\"ProviderContext.encode\")((value) =>\n      Schema.encodeEffect(schema)(value).pipe(\n        Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)),\n        Effect.map((encoded) => ({ value: encoded, version })),\n        Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n      ),\n    ),\n    version,\n  };\n}\n\nexport const decode = Effect.fn(\"ProviderContext.Envelope.decode\")((input: unknown) =>\n  Schema.decodeUnknownEffect(Envelope)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = Schema.encodeSync(Envelope);\n","import { Data, Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as ProviderContext from \"./provider-context.ts\";\n\nexport const Capability = S.Literals([\"dns:read\", \"dns:write\"]);\nexport type Capability = typeof Capability.Type;\n\nexport type Evidence = Data.TaggedEnum<{\n  Declared: {};\n  Exercised: { readonly observedAt: Date };\n  Introspected: { readonly observedAt: Date };\n}>;\nexport const Evidence = Data.taggedEnum<Evidence>();\n\nexport const EvidenceSchema = S.TaggedUnion({\n  Declared: {},\n  Exercised: { observedAt: S.DateFromString },\n  Introspected: { observedAt: S.DateFromString },\n});\n\nexport const CapabilityEvidence = S.Struct({\n  capability: Capability,\n  evidence: EvidenceSchema,\n});\nexport interface CapabilityEvidence extends S.Schema.Type<typeof CapabilityEvidence> {}\n\nexport const Revocation = S.TaggedUnion({\n  Active: {},\n  Pending: { requestedAt: S.DateFromString },\n});\nexport type Revocation = typeof Revocation.Type;\n\n/** A provider credential authorization shared by one or more owner connections. */\nexport const Schema = S.Struct({\n  authorizedById: S.String,\n  capabilityEvidence: S.Array(CapabilityEvidence),\n  createdAt: S.DateFromString,\n  expiresAt: S.NullOr(S.DateFromString),\n  id: S.String,\n  method: S.Literals([\"integration\", \"oauth2\", \"token\"]),\n  providerAccountId: S.String,\n  providerContext: ProviderContext.Envelope,\n  providerId: S.String,\n  requiredCapabilities: S.Array(Capability),\n  revocation: Revocation,\n  scopes: S.Array(S.String),\n});\nexport interface ProviderAuthorization extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"ProviderAuthorization.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"ProviderAuthorization.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport function evidenceFor(\n  authorization: ProviderAuthorization,\n  capability: Capability,\n): Evidence | undefined {\n  return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;\n}\n"],"mappings":";;;;AAqEA,MAAa,SAAS,KAAK,WAAmB;AAM9C,MAAa,cAAc,KAAK,WAAwB;AAExD,IAAaA,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,mBAAmB;CACxE,UAAU,OAAO,SAAS;EAAC;EAAiB;EAAY;CAAY,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAeJ,MAAM,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAC9C,OAMA;CACA,MAAM,aAAa,OAAOC;CAC1B,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,MAAM,oBAAoB,MAAM,qBAAqB,MAClD,eACC,CAAC,MAAM,eAAe,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAC1F;CACA,IAAI,sBAAsB,KAAA,GACxB,OAAO,OAAO,IAAID,QAAM;EACtB,UAAU;EACV,SAAS,6CAA6C;EACtD,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,WAAW,OAAO,WAAW,sBACjC,MAAM,YACN,MAAM,eAAe,iBACvB;CACA,MAAM,kBACJ,UAAU,cAAc,OACvB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;EACR,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;CACF,MAAM,kBAAkB,UAAU,SAAS,MAAM,YAAY,QAAQ,YAAY,MAAM,OAAO;CAC9F,MAAM,UAA8B;EAClC;EACA,WAAW,iBAAiB,aAAa;EACzC,OAAO,MAAM;EACb,IACE,iBAAiB,OAChB,OAAO,OAAO,aAAa,KAC1B,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACF,SAAS,MAAM;CACjB;CACA,MAAM,YAAkC;EACtC,eAAe;GACb,gBAAgB,MAAM;GACtB,oBAAoB,CAAC,GAAG,MAAM,eAAe,kBAAkB;GAC/D,WAAW,UAAU,cAAc,aAAa;GAChD,WAAW,MAAM,eAAe;GAChC,IAAI;GACJ,QAAQ,MAAM;GACd,mBAAmB,MAAM,eAAe;GACxC,iBAAiB,MAAM,eAAe;GACtC,YAAY,MAAM;GAClB,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;GACpD,YAAY,EAAE,MAAM,SAAS;GAC7B,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;EACzC;EACA,UAAU,CACR,GAAI,UAAU,SAAS,QAAQ,cAAc,UAAU,OAAO,QAAQ,EAAE,KAAK,CAAC,GAC9E,OACF;EACA,YAAY,MAAM,eAAe;CACnC;CACA,OAAO,OAAO,WAAW,QAAQ,SAAS;AAC5C,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WACjD,OACA;CACA,IAAI,MAAM,OAAO,SAAS,eAAe;EACvC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,iBAAiB,OAAO,OAAO,aAAa,KAChD,OAAO,UACJ,UACC,IAAIA,QAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACA,MAAM,UAAU,OAAO,MAAM,OAAO,KAAK,MAAM,cAAc;EAC7D,OAAO,MAAM,OAAO,cAAc,IAAI;GACpC,gBAAgB,MAAM;GACtB,WAAW,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS,IAAY;GAC7D,OAAO,MAAM;GACb,IAAI;GACJ,QAAQ,MAAM,OAAO,KAAK;GAC1B,SAAS,MAAM;GACf,SAAS,QAAQ;GACjB,YAAY,MAAM,OAAO,KAAK;GAC9B,sBAAsB,CAAC,GAAG,MAAM,OAAO,KAAK,oBAAoB;EAClE,CAAC;EACD,OAAO,YAAY,SAAS;GAC1B,kBAAkB,QAAQ;GAC1B;EACF,CAAC;CACH;CACA,MAAM,iBAAiB,OAAO,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK;CAC1E,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,MAAM;EACtB,OAAO,MAAM;EACb,QAAQ;EACR,SAAS,MAAM;EACf,YAAY,MAAM,OAAO;EACzB,sBAAsB,MAAM,OAAO;CACrC,CAAC;CACD,OAAO,YAAY,UAAU,EAAE,UAAU,CAAC;AAC5C,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAsB;CACxF,MAAM,eAAe,OAAO,MAAM,cAAc,QAC9C,MAAM,gBACN,IAAI,KAAK,OAAO,MAAM,iBAAiB,CACzC;CACA,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,eAAe,MAAM,KAAK,cACvC,aAAa,WAAW,MAAM,KAAK,QAEnC,OAAO,OAAO,IAAIA,QAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,iBAAiB,OAAO,MAAM,KAAK,SAAS,aAAa,SAAS,MAAM,WAAW;CACzF,OAAO,OAAO,QAAQ;EACpB;EACA,gBAAgB,aAAa;EAC7B,OAAO,aAAa;EACpB,QAAQ,aAAa;EACrB,SAAS,aAAa;EACtB,YAAY,aAAa;EACzB,sBAAsB,aAAa;CACrC,CAAC;AACH,CAAC;;;;;;;;ACrQD,IAAa,QAAb,MAAa,MAAM;CACjB;CAEA,YAAoB,OAAe;EACjC,KAAK,SAAS;CAChB;CAEA,OAAO,KAAK,OAAsB;EAChC,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,+BAA+B;EACvE,OAAO,IAAI,MAAM,KAAK;CACxB;CAEA,SAAiB;EACf,OAAO,KAAK;CACd;CAEA,SAAiB;EACf,OAAO;CACT;CAEA,WAAmB;EACjB,OAAO;CACT;AACF;AAEA,MAAa,OAAO,MAAM;;;;;;;;;;ACrB1B,MAAa,WAAW,OAAO,OAAO;CACpC,OAAO,OAAO;CACd,SAAS,OAAO;AAClB,CAAC;;AAUD,SAAgB,MAAY,SAAiB,QAAsC;CACjF,OAAO;EACL,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,aAC3C,SAAS,YAAY,UACjB,OAAO,KACL,IAAIE,QAAkB,EACpB,SAAS,yCAAyC,SAAS,UAC7D,CAAC,CACH,IACA,OAAO,oBAAoB,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KACjD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACN;EACA,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,UAC3C,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACjC,OAAO,SAAS,YAAY,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,GAC5E,OAAO,KAAK,aAAa;GAAE,OAAO;GAAS;EAAQ,EAAE,GACrD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;EACA;CACF;AACF;AAEA,MAAaC,WAAS,OAAO,GAAG,iCAAiC,CAAC,EAAE,UAClE,OAAO,oBAAoB,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UAAU,IAAID,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAAS,OAAO,WAAW,QAAQ;;;;;;;;;;;;;;;AC3ChD,MAAa,aAAaC,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC;AAQ9D,MAAa,WAAW,KAAK,WAAqB;AAElD,MAAa,iBAAiBA,OAAE,YAAY;CAC1C,UAAU,CAAC;CACX,WAAW,EAAE,YAAYA,OAAE,eAAe;CAC1C,cAAc,EAAE,YAAYA,OAAE,eAAe;AAC/C,CAAC;AAED,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAY;CACZ,UAAU;AACZ,CAAC;AAGD,MAAa,aAAaA,OAAE,YAAY;CACtC,QAAQ,CAAC;CACT,SAAS,EAAE,aAAaA,OAAE,eAAe;AAC3C,CAAC;;AAID,MAAaC,WAASD,OAAE,OAAO;CAC7B,gBAAgBA,OAAE;CAClB,oBAAoBA,OAAE,MAAM,kBAAkB;CAC9C,WAAWA,OAAE;CACb,WAAWA,OAAE,OAAOA,OAAE,cAAc;CACpC,IAAIA,OAAE;CACN,QAAQA,OAAE,SAAS;EAAC;EAAe;EAAU;CAAO,CAAC;CACrD,mBAAmBA,OAAE;CACrB,iBAAiBE;CACjB,YAAYF,OAAE;CACd,sBAAsBA,OAAE,MAAM,UAAU;CACxC,YAAY;CACZ,QAAQA,OAAE,MAAMA,OAAE,MAAM;AAC1B,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,EAAE,UAC/DA,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,WAAW,OAAO,GAAG,gCAAgC,CAAC,EAAE,UACnEH,OAAE,oBAAoBA,OAAE,OAAOC,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASH,OAAE,WAAWC,QAAM;AAEzC,SAAgB,YACd,eACA,YACsB;CACtB,OAAO,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAAC,EAAE;AAC1F"}