domainkit 0.2.1 → 0.3.0

package/dist/{resolver-CxE-VDw4.mjs → resolver-CvK7JoJM.mjs}

@@ -1,21 +1,87 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { E as decode$1, T as Schema$2, _ as equals, b as Service$2, h as decode$2, k as Error$2, m as data, p as Type, s as Observed, u as Schema$3 } from "./dns-record-BLeqo56C.mjs";
-import { t as candidates } from "./zones-DKHTpX9C.mjs";
-import { n as sha256Encoded, r as stringify } from "./canonical-json-CpvqGMcr.mjs";
-import { Cause, Clock, Context, Data, Effect, Layer, Schema } from "effect";
+import { Cause, Clock, Context, Crypto, Data, Effect, Layer, PlatformError, Schema, SchemaIssue, SchemaTransformation } from "effect";
+import { getDomain } from "tldts";
+//#region src/invalid-input.ts
+var invalid_input_exports = /* @__PURE__ */ __exportAll({ Error: () => Error$5 });
+var Error$5 = class extends Schema.TaggedError()("InvalidInputError", { message: Schema.String }) {};
+//#endregion
+//#region src/domain/domain-name.ts
+var domain_name_exports = /* @__PURE__ */ __exportAll({
+	Schema: () => Schema$3,
+	decode: () => decode$2,
+	parse: () => parse$1
+});
+const labelPattern = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;
+const Type$1 = Schema.String.check(Schema.makeFilter((value) => value.length <= 253 && value.includes(".") && value.split(".").every((label) => labelPattern.test(label)) ? void 0 : "Expected a fully qualified DNS name", { identifier: "DomainName" })).pipe(Schema.brand("DomainName"));
+/** Decodes user and wire strings into canonical domain names. */
+const Schema$3 = Schema.String.pipe(Schema.decodeTo(Type$1, SchemaTransformation.transformOrFail({
+	decode: (input, options) => Effect.try({
+		try: () => normalize(input),
+		catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, input, options)
+	}),
+	encode: (domain) => Effect.succeed(domain)
+})));
+const decode$2 = Effect.fn("DomainName.decode")((input) => Schema.decodeUnknownEffect(Schema$3)(input).pipe(Effect.mapError((cause) => new Error$5({ message: cause.message }))));
+function parse$1(input) {
+	try {
+		return Schema.decodeUnknownSync(Schema$3)(input);
+	} catch (cause) {
+		throw new Error$5({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+}
+function normalize(input) {
+	return input.trim().replace(/\.+$/, "").split(".").map((label) => {
+		if (label.includes("_") || [...label].every((character) => character.charCodeAt(0) <= 127)) return label.toLowerCase();
+		const normalized = new URL(`http://${label}.example`).hostname.split(".")[0];
+		if (normalized === void 0) throw new Error("Domain label could not be normalized");
+		return normalized.toLowerCase();
+	}).join(".");
+}
+//#endregion
+//#region src/auth/lifecycle-repository.ts
+var lifecycle_repository_exports = /* @__PURE__ */ __exportAll({
+	Error: () => Error$4,
+	Service: () => Service$3
+});
+var Error$4 = class extends Schema.TaggedError()("LifecycleRepositoryError", {
+	category: Schema.Literal("storage"),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+var Service$3 = class extends Context.Service()("@domainkit/AuthorizationLifecycleRepository") {};
+//#endregion
+//#region src/discovery/zones.ts
+var zones_exports = /* @__PURE__ */ __exportAll({ candidates: () => candidates });
+function candidates(input) {
+	const domain = parse$1(input);
+	const registrable = getDomain(domain, { allowPrivateDomains: true });
+	if (registrable === null) throw new Error$5({ message: "Domain does not have a registrable DNS zone" });
+	const labels = domain.split(".");
+	const registrableLabels = registrable.split(".").length;
+	const values = [];
+	for (let index = 0; index <= labels.length - registrableLabels; index += 1) values.push(parse$1(labels.slice(index).join(".")));
+	return values;
+}
+//#endregion
 //#region src/discovery/zone-discovery.ts
 var zone_discovery_exports = /* @__PURE__ */ __exportAll({
 	Candidate: () => Candidate,
 	Outcome: () => Outcome,
-	Service: () => Service$1,
+	Service: () => Service$2,
 	make: () => make
 });
 /** Display-safe identity and nameserver evidence for one provider-owned zone. */
 const Candidate = Schema.Struct({
 	accountId: Schema.String,
 	id: Schema.String,
-	name: Schema$2,
-	nameservers: Schema.Array(Schema$2),
+	name: Schema$3,
+	nameservers: Schema.Array(Schema$3),
 	providerId: Schema.String,
 	status: Schema.Literals([
 		"active",
@@ -24,10 +90,10 @@ const Candidate = Schema.Struct({
 	])
 });
 const Outcome = Data.taggedEnum();
-var Service$1 = class extends Context.Service()("@domainkit/ZoneDiscovery") {};
+var Service$2 = class extends Context.Service()("@domainkit/ZoneDiscovery") {};
 /** Compose provider-account discovery sources without expanding the record-provider contract. */
 function make(sources) {
-	return Service$1.of({ discover: Effect.fn("ZoneDiscovery.discover")(function* (domain) {
+	return Service$2.of({ discover: Effect.fn("ZoneDiscovery.discover")(function* (domain) {
 		for (const name of candidates(domain)) {
 			const matches = deduplicate((yield* Effect.forEach(sources, (source) => source.listZones(name).pipe(Effect.map((zones) => zones.filter((zone) => zone.name === name).map((zone) => ({
 				candidate: {
@@ -65,6 +131,287 @@ function candidateKey(candidate) {
 	].join(":");
 }
 //#endregion
+//#region src/domain/dns-record.ts
+var dns_record_exports = /* @__PURE__ */ __exportAll({
+	A: () => A,
+	Aaaa: () => Aaaa,
+	Caa: () => Caa,
+	Cname: () => Cname,
+	Mx: () => Mx,
+	Ns: () => Ns,
+	Observed: () => Observed,
+	Opaque: () => Opaque,
+	RequirementMetadata: () => RequirementMetadata,
+	Schema: () => Schema$2,
+	Srv: () => Srv,
+	Txt: () => Txt,
+	Type: () => Type,
+	data: () => data,
+	decode: () => decode$1,
+	equals: () => equals,
+	parse: () => parse
+});
+const Type = Schema.Literals([
+	"A",
+	"AAAA",
+	"CNAME",
+	"TXT",
+	"MX",
+	"CAA",
+	"NS",
+	"SRV"
+]);
+const RequirementMetadata = Schema.Struct({
+	ownership: Schema.String.check(Schema.isMinLength(1)),
+	provenance: Schema.String.check(Schema.isMinLength(1)),
+	purpose: Schema.String.check(Schema.isMinLength(1))
+});
+const CommonFields = {
+	metadata: RequirementMetadata,
+	name: Schema$3,
+	policy: Schema.Literals(["exclusive", "append"]),
+	ttl: Schema.NullOr(Schema.Int.check(Schema.isBetween({
+		minimum: 60,
+		maximum: 2147483647
+	})))
+};
+const ExclusiveCommonFields = {
+	...CommonFields,
+	policy: Schema.Literal("exclusive")
+};
+const Address = Schema.String.check(Schema.makeFilter((value) => isIpv4(value) ? void 0 : "Expected an IPv4 address"));
+const Ipv6Address = Schema.String.check(Schema.makeFilter((value) => isIpv6(value) ? void 0 : "Expected an IPv6 address"));
+const Port = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 65535
+}));
+const Priority = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 65535
+}));
+const Schema$2 = Schema.TaggedUnion({
+	A: {
+		...CommonFields,
+		address: Address
+	},
+	AAAA: {
+		...CommonFields,
+		address: Ipv6Address
+	},
+	CNAME: {
+		...ExclusiveCommonFields,
+		target: Schema$3
+	},
+	TXT: {
+		...CommonFields,
+		value: Schema.String.check(Schema.isMinLength(1))
+	},
+	MX: {
+		...CommonFields,
+		exchange: Schema$3,
+		priority: Priority
+	},
+	CAA: {
+		...CommonFields,
+		flags: Schema.Int.check(Schema.isBetween({
+			minimum: 0,
+			maximum: 255
+		})),
+		tag: Schema.Literals([
+			"issue",
+			"issuewild",
+			"iodef"
+		]),
+		value: Schema.String.check(Schema.isMinLength(1))
+	},
+	NS: {
+		...CommonFields,
+		target: Schema$3
+	},
+	SRV: {
+		...CommonFields,
+		port: Port,
+		priority: Priority,
+		target: Schema$3,
+		weight: Priority
+	}
+});
+const { A, AAAA: Aaaa, CAA: Caa, CNAME: Cname, MX: Mx, NS: Ns, SRV: Srv, TXT: Txt } = Schema$2.cases;
+/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
+const Opaque = Schema.Struct({
+	_tag: Schema.Literal("Opaque"),
+	name: Schema.String.check(Schema.isMinLength(1)),
+	providerRecordId: Schema.NullOr(Schema.String),
+	providerType: Schema.String.check(Schema.isMinLength(1))
+});
+/** Any DNS record observed through a provider, including non-portable record types. */
+const Observed = Schema.Union([Schema$2, Opaque]);
+const decode$1 = Effect.fn("DnsRecord.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$5({ message: cause.message }))));
+function parse(input) {
+	try {
+		return Schema.decodeUnknownSync(Schema$2)(input);
+	} catch (cause) {
+		throw new Error$5({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+}
+function data(record) {
+	switch (record._tag) {
+		case "A":
+		case "AAAA": return { address: record.address };
+		case "CNAME":
+		case "NS": return { target: record.target };
+		case "TXT": return { value: record.value };
+		case "MX": return {
+			exchange: record.exchange,
+			priority: record.priority
+		};
+		case "CAA": return {
+			flags: record.flags,
+			tag: record.tag,
+			value: record.value
+		};
+		case "SRV": return {
+			port: record.port,
+			priority: record.priority,
+			target: record.target,
+			weight: record.weight
+		};
+	}
+}
+function equals(left, right) {
+	return left._tag === right._tag && left.name === right.name && JSON.stringify(data(left)) === JSON.stringify(data(right));
+}
+function isIpv4(value) {
+	const parts = value.split(".");
+	return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part);
+}
+function isIpv6(value) {
+	try {
+		return new URL(`http://[${value}]/`).hostname.startsWith("[");
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/provider/provider.ts
+var provider_exports = /* @__PURE__ */ __exportAll({
+	Error: () => Error$3,
+	ErrorReason: () => ErrorReason,
+	Service: () => Service$1,
+	fromAsync: () => fromAsync,
+	layerFromAsync: () => layerFromAsync$1,
+	toAsync: () => toAsync$1
+});
+const ErrorReason = Schema.Literals([
+	"authentication",
+	"authorization",
+	"conflict",
+	"not_found",
+	"rate_limit",
+	"request",
+	"response",
+	"transport",
+	"unsupported"
+]);
+var Error$3 = class extends Schema.TaggedError()("ProviderError", {
+	cause: Schema.optionalKey(Schema.Unknown),
+	code: Schema.optionalKey(Schema.Union([Schema.Number, Schema.String])),
+	message: Schema.String,
+	operation: Schema.String,
+	providerId: Schema.String,
+	reason: Schema.optionalKey(ErrorReason),
+	retryAfterMs: Schema.optionalKey(Schema.Number),
+	status: Schema.optionalKey(Schema.Number)
+}) {};
+var Service$1 = class extends Context.Service()("@domainkit/DnsProvider") {};
+const fromAsync = (provider) => Service$1.of({
+	id: provider.id,
+	createRecord: Effect.fn("DnsProvider.createRecord")((zone, record) => Effect.tryPromise({
+		try: () => provider.createRecord(zone, record),
+		catch: (cause) => failure(provider, "createRecord", cause)
+	})),
+	deleteRecord: Effect.fn("DnsProvider.deleteRecord")((zone, providerRecordId) => Effect.tryPromise({
+		try: () => provider.deleteRecord(zone, providerRecordId),
+		catch: (cause) => failure(provider, "deleteRecord", cause)
+	})),
+	getRecord: Effect.fn("DnsProvider.getRecord")((zone, providerRecordId) => Effect.tryPromise({
+		try: () => provider.getRecord(zone, providerRecordId),
+		catch: (cause) => failure(provider, "getRecord", cause)
+	})),
+	listRecords: Effect.fn("DnsProvider.listRecords")((zone) => Effect.tryPromise({
+		try: () => provider.listRecords(zone),
+		catch: (cause) => failure(provider, "listRecords", cause)
+	}))
+});
+const layerFromAsync$1 = (provider) => Layer.succeed(Service$1, fromAsync(provider));
+const toAsync$1 = (provider) => ({
+	id: provider.id,
+	createRecord: (zone, record) => Effect.runPromise(provider.createRecord(zone, record)),
+	deleteRecord: (zone, providerRecordId) => Effect.runPromise(provider.deleteRecord(zone, providerRecordId)),
+	getRecord: (zone, providerRecordId) => Effect.runPromise(provider.getRecord(zone, providerRecordId)),
+	listRecords: (zone) => Effect.runPromise(provider.listRecords(zone))
+});
+function failure(provider, operation, cause) {
+	return cause instanceof Error$3 ? cause : new Error$3({
+		cause,
+		message: cause instanceof globalThis.Error ? cause.message : String(cause),
+		operation,
+		providerId: provider.id
+	});
+}
+//#endregion
+//#region src/plan/canonical-json.ts
+var canonical_json_exports = /* @__PURE__ */ __exportAll({
+	CryptoError: () => CryptoError,
+	sha256Encoded: () => sha256Encoded,
+	sha256Json: () => sha256Json,
+	sha256Text: () => sha256Text,
+	stringify: () => stringify,
+	webCryptoLayer: () => webCryptoLayer
+});
+var CryptoError = class extends Schema.TaggedError()("CryptoError", { message: Schema.String }) {};
+/** Deterministic JSON serialization for already schema-encoded protocol values. */
+function stringify(value) {
+	if (value === null || typeof value !== "object") {
+		const encoded = JSON.stringify(value);
+		if (encoded === void 0) throw new TypeError("Value is not representable as JSON");
+		return encoded;
+	}
+	if (isJsonArray(value)) return `[${value.map(stringify).join(",")}]`;
+	return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`).join(",")}}`;
+}
+function isJsonArray(value) {
+	return Array.isArray(value);
+}
+const sha256Text = Effect.fn("Digest.sha256Text")(function* (value) {
+	return [...yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+});
+const sha256Json = Effect.fn("Digest.sha256Json")((value) => Effect.try({
+	try: () => stringify(value),
+	catch: (cause) => new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) })
+}).pipe(Effect.flatMap(sha256Text)));
+function sha256EncodedProgram(schema, value) {
+	return Schema.encodeEffect(schema)(value).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)), Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(sha256Json));
+}
+const sha256Encoded = Effect.fn("Digest.sha256Encoded")(sha256EncodedProgram);
+/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
+const webCryptoLayer = Layer.succeed(Crypto.Crypto, Crypto.make({
+	randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),
+	digest: (algorithm, data) => Effect.tryPromise({
+		try: async () => {
+			const bytes = new Uint8Array(data.byteLength);
+			bytes.set(data);
+			return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));
+		},
+		catch: (cause) => PlatformError.systemError({
+			_tag: "Unknown",
+			module: "WebCrypto",
+			method: "digest",
+			cause
+		})
+	})
+}));
+//#endregion
 //#region src/plan/types.ts
 var types_exports = /* @__PURE__ */ __exportAll({
 	Authorization: () => Authorization$1,
@@ -79,18 +426,18 @@ var types_exports = /* @__PURE__ */ __exportAll({
 const Operation$1 = Schema.TaggedUnion({
 	create: {
 		id: Schema.String,
-		requirement: Schema$3
+		requirement: Schema$2
 	},
 	noop: {
 		id: Schema.String,
-		requirement: Schema$3,
+		requirement: Schema$2,
 		ttlDrift: Schema.Boolean
 	},
 	conflict: {
 		existing: Schema.Array(Observed),
 		id: Schema.String,
 		reason: Schema.String,
-		requirement: Schema$3
+		requirement: Schema$2
 	}
 });
 const Schema$1 = Schema.Struct({
@@ -98,7 +445,7 @@ const Schema$1 = Schema.Struct({
 	operations: Schema.Array(Operation$1),
 	providerId: Schema.String,
 	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$2
+	zone: Schema$3
 });
 const Authorization$1 = Schema.Struct({
 	allowPartial: Schema.Boolean,
@@ -116,11 +463,11 @@ const Receipt$1 = Schema.Struct({
 	providerId: Schema.String,
 	status: Schema.Literals(["complete", "partial"]),
 	version: Schema.Literal("domainkit.apply-receipt.v1"),
-	zone: Schema$2
+	zone: Schema$3
 });
-const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$5({ message: cause.message }))));
 const encode = Schema.encodeSync(Schema$1);
-const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt$1)(input).pipe(Effect.mapError((cause) => new Error$5({ message: cause.message }))));
 const encodeReceipt = Schema.encodeSync(Receipt$1);
 //#endregion
 //#region src/plan/plan.ts
@@ -141,9 +488,9 @@ const UnsignedPlan$1 = Schema.Struct({
 	operations: Schema.Array(Operation$1),
 	providerId: Schema.String,
 	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$2
+	zone: Schema$3
 });
-const RequirementDigest = Schema.Struct({ requirement: Schema$3 });
+const RequirementDigest = Schema.Struct({ requirement: Schema$2 });
 var ConflictError = class extends Schema.TaggedError()("PlanConflictError", { operationIds: Schema.Array(Schema.String) }) {};
 var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
 var StaleError = class extends Schema.TaggedError()("StalePlanError", {
@@ -167,16 +514,16 @@ const CreateResult = Data.taggedEnum();
 function create$1(input) {
 	const target = input.target;
 	if (target._tag === "ExactZone") return Effect.gen(function* () {
-		const provider = yield* Service$2;
-		const zone = yield* decode$1(target.zone);
+		const provider = yield* Service$1;
+		const zone = yield* decode$2(target.zone);
 		return CreateResult.Resolved({
 			candidate: null,
 			plan: yield* planAgainst(provider, zone, input.requirements)
 		});
 	}).pipe(Effect.withSpan("Provisioning.create"));
 	return Effect.gen(function* () {
-		const discovery = yield* Service$1;
-		const domain = yield* decode$1(target.domain);
+		const discovery = yield* Service$2;
+		const domain = yield* decode$2(target.domain);
 		const outcome = yield* discovery.discover(domain);
 		switch (outcome._tag) {
 			case "NotFound": return CreateResult.NotFound({ domain: outcome.domain });
@@ -189,7 +536,7 @@ function create$1(input) {
 	}).pipe(Effect.withSpan("Provisioning.create"));
 }
 const planAgainst = Effect.fn("Provisioning.planAgainst")(function* (provider, zone, inputs) {
-	const requirements = (yield* Effect.forEach(inputs, decode$2, { concurrency: "unbounded" })).sort(compareRecords);
+	const requirements = (yield* Effect.forEach(inputs, decode$1, { concurrency: "unbounded" })).sort(compareRecords);
 	const existing = [...yield* provider.listRecords(zone)].sort(compareRecords);
 	const { operations } = yield* Effect.reduce(requirements, () => ({
 		operations: [],
@@ -227,7 +574,7 @@ const authorize$1 = Effect.fn("Provisioning.authorize")(function* (plan, operati
 /** Applies approved creates sequentially after full and per-operation revalidation. */
 const apply$1 = Effect.fn("Provisioning.apply")(function* (input) {
 	const { authorization, plan } = input;
-	const provider = yield* Service$2;
+	const provider = yield* Service$1;
 	yield* validate$1(plan);
 	if (authorization.planDigest !== plan.digest) return yield* new AuthorizationError({ message: "Authorization belongs to a different plan" });
 	if (provider.id !== plan.providerId) return yield* new AuthorizationError({ message: "Provider does not match the approved plan" });
@@ -289,7 +636,7 @@ function makeReceipt$1(input, operations, status) {
 	})));
 }
 function assertStillCreatable(plan, operation) {
-	return Service$2.pipe(Effect.flatMap((provider) => planAgainst(provider, plan.zone, [operation.requirement])), Effect.flatMap((currentPlan) => {
+	return Service$1.pipe(Effect.flatMap((provider) => planAgainst(provider, plan.zone, [operation.requirement])), Effect.flatMap((currentPlan) => {
 		const currentOperation = currentPlan.operations[0];
 		return currentOperation?._tag === "create" && currentOperation.id === operation.id ? Effect.void : Effect.fail(new StaleError({
 			approvedPlanDigest: plan.digest,
@@ -353,7 +700,7 @@ function compareRecords(left, right) {
 //#region src/plan/deletion.ts
 var deletion_exports = /* @__PURE__ */ __exportAll({
 	Authorization: () => Authorization,
-	Error: () => Error$1,
+	Error: () => Error$2,
 	Operation: () => Operation,
 	PartialError: () => PartialError,
 	Plan: () => Plan,
@@ -366,7 +713,7 @@ var deletion_exports = /* @__PURE__ */ __exportAll({
 const Operation = Schema.Struct({
 	id: Schema.String,
 	providerRecordId: Schema.String,
-	record: Schema$3
+	record: Schema$2
 });
 const UnsignedPlan = Schema.Struct({
 	createdAt: Schema.DateFromString,
@@ -375,7 +722,7 @@ const UnsignedPlan = Schema.Struct({
 	providerId: Schema.String,
 	sourcePlanDigest: Schema.String,
 	version: Schema.Literal("domainkit.deletion-plan.v1"),
-	zone: Schema$2
+	zone: Schema$3
 });
 const Plan = Schema.Struct({
 	...UnsignedPlan.fields,
@@ -396,9 +743,9 @@ const Receipt = Schema.Struct({
 	providerId: Schema.String,
 	status: Schema.Literals(["complete", "partial"]),
 	version: Schema.Literal("domainkit.deletion-receipt.v1"),
-	zone: Schema$2
+	zone: Schema$3
 });
-var Error$1 = class extends Schema.TaggedError()("UnsafeDeletionError", {
+var Error$2 = class extends Schema.TaggedError()("UnsafeDeletionError", {
 	message: Schema.String,
 	operationId: Schema.optionalKey(Schema.String)
 }) {};
@@ -409,17 +756,17 @@ var PartialError = class extends Schema.TaggedError()("PartialDeletionError", {
 }) {};
 /** Build a fresh deletion plan only from records proven by a prior create receipt. */
 const create = Effect.fn("Deletion.create")(function* (input) {
-	const provider = yield* Service$2;
+	const provider = yield* Service$1;
 	yield* validate$1(input.plan);
-	if (input.receipt.planDigest !== input.plan.digest || input.receipt.providerId !== input.plan.providerId || input.receipt.zone !== input.plan.zone) return yield* new Error$1({ message: "Create receipt does not belong to the source plan" });
-	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the source receipt" });
+	if (input.receipt.planDigest !== input.plan.digest || input.receipt.providerId !== input.plan.providerId || input.receipt.zone !== input.plan.zone) return yield* new Error$2({ message: "Create receipt does not belong to the source plan" });
+	if (provider.id !== input.plan.providerId) return yield* new Error$2({ message: "Provider does not match the source receipt" });
 	const operations = yield* Effect.forEach(input.receipt.operations, (applied) => Effect.gen(function* () {
 		const source = input.plan.operations.find((operation) => operation._tag === "create" && operation.id === applied.operationId);
-		if (source === void 0 || source._tag !== "create") return yield* new Error$1({
+		if (source === void 0 || source._tag !== "create") return yield* new Error$2({
 			message: "Receipt operation is not a created source record",
 			operationId: applied.operationId
 		});
-		if (applied.providerRecordId === null) return yield* new Error$1({
+		if (applied.providerRecordId === null) return yield* new Error$2({
 			message: "Provider record ID is required for safe deletion",
 			operationId: applied.operationId
 		});
@@ -450,7 +797,7 @@ const authorize = Effect.fn("Deletion.authorize")(function* (plan, operationIds)
 	yield* validate(plan);
 	const selected = [...new Set(operationIds ?? plan.operations.map(({ id }) => id))].sort();
 	const unknown = selected.filter((id) => !plan.operations.some((operation) => operation.id === id));
-	if (unknown.length > 0) return yield* new Error$1({ message: `Unknown deletion operation IDs: ${unknown.join(", ")}` });
+	if (unknown.length > 0) return yield* new Error$2({ message: `Unknown deletion operation IDs: ${unknown.join(", ")}` });
 	return {
 		operationIds: selected,
 		planDigest: plan.digest,
@@ -459,17 +806,17 @@ const authorize = Effect.fn("Deletion.authorize")(function* (plan, operationIds)
 });
 /** Re-read every approved record before the first delete, then delete by provider record ID. */
 const apply = Effect.fn("Deletion.apply")(function* (input) {
-	const provider = yield* Service$2;
+	const provider = yield* Service$1;
 	yield* validate(input.plan);
-	if (input.authorization.planDigest !== input.plan.digest) return yield* new Error$1({ message: "Deletion authorization belongs to a different plan" });
-	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the deletion plan" });
+	if (input.authorization.planDigest !== input.plan.digest) return yield* new Error$2({ message: "Deletion authorization belongs to a different plan" });
+	if (provider.id !== input.plan.providerId) return yield* new Error$2({ message: "Provider does not match the deletion plan" });
 	const now = yield* Clock.currentTimeMillis;
-	if (input.plan.expiresAt <= new Date(now)) return yield* new Error$1({ message: "Deletion plan has expired" });
+	if (input.plan.expiresAt <= new Date(now)) return yield* new Error$2({ message: "Deletion plan has expired" });
 	const selected = input.plan.operations.filter(({ id }) => input.authorization.operationIds.includes(id));
-	if (selected.length !== input.authorization.operationIds.length) return yield* new Error$1({ message: "Deletion authorization contains unknown operations" });
+	if (selected.length !== input.authorization.operationIds.length) return yield* new Error$2({ message: "Deletion authorization contains unknown operations" });
 	const previouslyDeleted = yield* validatePriorReceipt(input.plan, input.priorReceipt);
 	const completedIds = new Set(previouslyDeleted.map(({ operationId }) => operationId));
-	if (previouslyDeleted.some(({ operationId }) => !input.authorization.operationIds.includes(operationId))) return yield* new Error$1({ message: "Prior receipt contains an unauthorized operation" });
+	if (previouslyDeleted.some(({ operationId }) => !input.authorization.operationIds.includes(operationId))) return yield* new Error$2({ message: "Prior receipt contains an unauthorized operation" });
 	const remaining = selected.filter(({ id }) => !completedIds.has(id));
 	yield* Effect.forEach(remaining, (operation) => assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id));
 	const deleted = [...previouslyDeleted];
@@ -506,19 +853,19 @@ function validate(plan) {
 		version: plan.version,
 		zone: plan.zone
 	};
-	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new Error$1({ message: "Deletion plan digest does not match its contents" }))));
+	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new Error$2({ message: "Deletion plan digest does not match its contents" }))));
 }
 function validatePriorReceipt(plan, receipt) {
 	if (receipt === void 0) return Effect.succeed([]);
-	if (receipt.planDigest !== plan.digest || receipt.providerId !== plan.providerId || receipt.zone !== plan.zone || receipt.status !== "partial") return Effect.fail(new Error$1({ message: "Prior receipt does not belong to this deletion plan" }));
+	if (receipt.planDigest !== plan.digest || receipt.providerId !== plan.providerId || receipt.zone !== plan.zone || receipt.status !== "partial") return Effect.fail(new Error$2({ message: "Prior receipt does not belong to this deletion plan" }));
 	for (const completed of receipt.operations) {
 		const operation = plan.operations.find(({ id }) => id === completed.operationId);
-		if (operation === void 0 || operation.providerRecordId !== completed.providerRecordId) return Effect.fail(new Error$1({ message: "Prior receipt operation does not match the deletion plan" }));
+		if (operation === void 0 || operation.providerRecordId !== completed.providerRecordId) return Effect.fail(new Error$2({ message: "Prior receipt operation does not match the deletion plan" }));
 	}
 	return Effect.succeed([...receipt.operations]);
 }
 function assertExact(provider, zone, providerRecordId, expected, operationId) {
-	return provider.getRecord(zone, providerRecordId).pipe(Effect.flatMap((observed) => observed !== null && observed._tag !== "Opaque" && equals(observed, expected) ? Effect.void : Effect.fail(new Error$1({
+	return provider.getRecord(zone, providerRecordId).pipe(Effect.flatMap((observed) => observed !== null && observed._tag !== "Opaque" && equals(observed, expected) ? Effect.void : Effect.fail(new Error$2({
 		message: observed === null ? "Created record no longer exists" : "Created record content no longer matches its receipt",
 		operationId
 	}))));
@@ -538,7 +885,7 @@ function makeReceipt(plan, operations, status) {
 //#region src/verification/resolver.ts
 var resolver_exports = /* @__PURE__ */ __exportAll({
 	Answer: () => Answer,
-	Error: () => Error,
+	Error: () => Error$1,
 	Resolution: () => Resolution,
 	Service: () => Service,
 	layerFromAsync: () => layerFromAsync,
@@ -546,7 +893,7 @@ var resolver_exports = /* @__PURE__ */ __exportAll({
 });
 const Answer = Schema.Struct({
 	data: Schema.String,
-	name: Schema$2,
+	name: Schema$3,
 	ttl: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
 	type: Type
 });
@@ -554,7 +901,7 @@ const Resolution = Schema.TaggedUnion({
 	answer: { answers: Schema.Array(Answer) },
 	nodata: {}
 });
-var Error = class extends Schema.TaggedError()("ResolverError", {
+var Error$1 = class extends Schema.TaggedError()("ResolverError", {
 	cause: Schema.optionalKey(Schema.Unknown),
 	message: Schema.String,
 	reason: Schema.Literals([
@@ -566,7 +913,7 @@ var Error = class extends Schema.TaggedError()("ResolverError", {
 var Service = class extends Context.Service()("@domainkit/DnsResolver") {};
 const layerFromAsync = (resolver) => Layer.succeed(Service, { resolve: Effect.fn("DnsResolver.resolve")((query) => Effect.tryPromise({
 	try: () => resolver.resolve(query),
-	catch: (cause) => new Error({
+	catch: (cause) => new Error$1({
 		cause,
 		message: cause instanceof globalThis.Error ? cause.message : String(cause),
 		reason: "transport"
@@ -575,11 +922,11 @@ const layerFromAsync = (resolver) => Layer.succeed(Service, { resolve: Effect.fn
 	switch (resolution._tag) {
 		case "answer":
 		case "nodata": return Effect.succeed(resolution);
-		case "timeout": return Effect.fail(new Error({
+		case "timeout": return Effect.fail(new Error$1({
 			message: "DNS query timed out",
 			reason: "timeout"
 		}));
-		case "failure": return Effect.fail(new Error({
+		case "failure": return Effect.fail(new Error$1({
 			message: resolution.message,
 			reason: "transport"
 		}));
@@ -593,6 +940,6 @@ const toAsync = (resolver) => ({ resolve: (query) => Effect.runPromise(resolver.
 	onSuccess: (resolution) => resolution
 }))) });
 //#endregion
-export { decodeReceipt as A, plan_exports as C, Receipt$1 as D, Operation$1 as E, Service$1 as F, make as I, zone_discovery_exports as L, encodeReceipt as M, types_exports as N, Schema$1 as O, Candidate as P, create$1 as S, Authorization$1 as T, PartialApplyError as _, Authorization as a, apply$1 as b, PartialError as c, apply as d, authorize as f, CreateResult as g, ConflictError as h, toAsync as i, encode as j, decode as k, Plan as l, deletion_exports as m, Service as n, Error$1 as o, create as p, resolver_exports as r, Operation as s, Error as t, Receipt as u, StaleError as v, renderManualInstructions as w, authorize$1 as x, Target as y };
+export { Txt as $, decodeReceipt as A, provider_exports as B, plan_exports as C, Receipt$1 as D, Operation$1 as E, webCryptoLayer as F, Cname as G, A as H, Error$3 as I, Observed as J, Mx as K, Service$1 as L, encodeReceipt as M, types_exports as N, Schema$1 as O, canonical_json_exports as P, Srv as Q, fromAsync as R, create$1 as S, Authorization$1 as T, Aaaa as U, toAsync$1 as V, Caa as W, RequirementMetadata as X, Opaque as Y, Schema$2 as Z, PartialApplyError as _, domain_name_exports as _t, Authorization as a, parse as at, apply$1 as b, invalid_input_exports as bt, PartialError as c, make as ct, apply as d, zones_exports as dt, Type as et, authorize as f, Error$4 as ft, CreateResult as g, decode$2 as gt, ConflictError as h, Schema$3 as ht, toAsync as i, equals as it, encode as j, decode as k, Plan as l, zone_discovery_exports as lt, deletion_exports as m, lifecycle_repository_exports as mt, Service as n, decode$1 as nt, Error$2 as o, Candidate as ot, create as p, Service$3 as pt, Ns as q, resolver_exports as r, dns_record_exports as rt, Operation as s, Service$2 as st, Error$1 as t, data as tt, Receipt as u, candidates as ut, StaleError as v, parse$1 as vt, renderManualInstructions as w, authorize$1 as x, Target as y, Error$5 as yt, layerFromAsync$1 as z };
 
-//# sourceMappingURL=resolver-CxE-VDw4.mjs.map
+//# sourceMappingURL=resolver-CvK7JoJM.mjs.map