domainkit 0.2.2 → 0.3.0

package/dist/verify-B00c81-n.mjs

@@ -0,0 +1,2420 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { I as Error$3, L as Service$3, Y as Opaque, gt as decode$8, ht as Schema$4, i as toAsync$3, it as equals, n as Service$2, nt as decode$9, pt as Service$1, t as Error$4, tt as data, ut as candidates, vt as parse$1, x as authorize$1, yt as Error$2 } from "./resolver-CvK7JoJM.mjs";
+import { Clock, Context, Crypto, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
+import * as oauth from "oauth4webapi";
+import * as DnsPacket from "@leichtgewicht/dns-packet";
+//#region package.json
+var version = "0.3.0";
+//#endregion
+//#region src/auth/provider-context.ts
+var provider_context_exports = /* @__PURE__ */ __exportAll({
+	Envelope: () => Envelope,
+	codec: () => codec,
+	decode: () => decode$7,
+	encode: () => encode$4
+});
+/** A provider-owned, versioned, non-secret context value persisted by the host. */
+const Envelope = Schema.Struct({
+	value: Schema.Json,
+	version: Schema.String
+});
+/** Build an adapter-owned context codec from a schema and stable version identifier. */
+function codec(version, schema) {
+	return {
+		decode: Effect.fn("ProviderContext.decode")((envelope) => envelope.version !== version ? Effect.fail(new Error$2({ message: `Unsupported provider context version: ${envelope.version}` })) : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })))),
+		encode: Effect.fn("ProviderContext.encode")((value) => Schema.encodeEffect(schema)(value).pipe(Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)), Effect.map((encoded) => ({
+			value: encoded,
+			version
+		})), Effect.mapError((cause) => new Error$2({ message: cause.message })))),
+		version
+	};
+}
+const decode$7 = Effect.fn("ProviderContext.Envelope.decode")((input) => Schema.decodeUnknownEffect(Envelope)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encode$4 = Schema.encodeSync(Envelope);
+//#endregion
+//#region src/auth/authorization.ts
+var authorization_exports = /* @__PURE__ */ __exportAll({
+	Capability: () => Capability,
+	CapabilityEvidence: () => CapabilityEvidence,
+	Evidence: () => Evidence$1,
+	EvidenceSchema: () => EvidenceSchema,
+	Revocation: () => Revocation,
+	Schema: () => Schema$3,
+	decode: () => decode$6,
+	encode: () => encode$3,
+	evidenceFor: () => evidenceFor$1,
+	validate: () => validate$1
+});
+const Capability = Schema.Literals(["dns:read", "dns:write"]);
+const Evidence$1 = Data.taggedEnum();
+const EvidenceSchema = Schema.TaggedUnion({
+	Declared: {},
+	Exercised: { observedAt: Schema.DateFromString },
+	Introspected: { observedAt: Schema.DateFromString }
+});
+const CapabilityEvidence = Schema.Struct({
+	capability: Capability,
+	evidence: EvidenceSchema
+});
+const Revocation = Schema.TaggedUnion({
+	Active: {},
+	Pending: { requestedAt: Schema.DateFromString }
+});
+/** A provider credential authorization shared by one or more owner connections. */
+const Schema$3 = Schema.Struct({
+	authorizedById: Schema.String,
+	capabilityEvidence: Schema.Array(CapabilityEvidence),
+	createdAt: Schema.DateFromString,
+	expiresAt: Schema.NullOr(Schema.DateFromString),
+	id: Schema.String,
+	method: Schema.Literals([
+		"integration",
+		"oauth2",
+		"token"
+	]),
+	providerAccountId: Schema.String,
+	providerContext: Envelope,
+	providerId: Schema.String,
+	requiredCapabilities: Schema.Array(Capability),
+	revocation: Revocation,
+	scopes: Schema.Array(Schema.String)
+});
+const decode$6 = Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$3)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const validate$1 = Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$3))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encode$3 = Schema.encodeSync(Schema$3);
+function evidenceFor$1(authorization, capability) {
+	return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;
+}
+//#endregion
+//#region src/auth/connection.ts
+const Grant = Schema.TaggedUnion({
+	account: { excludedDomains: Schema.Array(Schema$4) },
+	domains: { domains: Schema.Array(Schema$4) }
+});
+/** Returns whether a grant includes one parsed domain. */
+const coversDomain = (grant, domain) => grant._tag === "account" ? !grant.excludedDomains.includes(domain) : grant.domains.includes(domain);
+/** Expands a grant to include the requested domains. */
+const includeDomains = (current, requested) => {
+	if (current === void 0) return requested;
+	if (current._tag === "account" && requested._tag === "account") return {
+		_tag: "account",
+		excludedDomains: current.excludedDomains.filter((domain) => requested.excludedDomains.includes(domain))
+	};
+	if (current._tag === "account" && requested._tag === "domains") return {
+		_tag: "account",
+		excludedDomains: current.excludedDomains.filter((domain) => !requested.domains.includes(domain))
+	};
+	if (requested._tag === "account") {
+		const includedDomains = current._tag === "domains" ? current.domains : [];
+		return {
+			_tag: "account",
+			excludedDomains: requested.excludedDomains.filter((domain) => !includedDomains.includes(domain))
+		};
+	}
+	if (current._tag === "account") return current;
+	return {
+		_tag: "domains",
+		domains: [.../* @__PURE__ */ new Set([...current.domains, ...requested.domains])]
+	};
+};
+/** Contracts a grant so it no longer includes one parsed domain. */
+const removeDomain$1 = (grant, domain) => grant._tag === "account" ? {
+	_tag: "account",
+	excludedDomains: [.../* @__PURE__ */ new Set([...grant.excludedDomains, domain])]
+} : {
+	_tag: "domains",
+	domains: grant.domains.filter((candidate) => candidate !== domain)
+};
+/** An owner-scoped grant bound to one provider authorization. */
+const Schema$2 = Schema.Struct({
+	authorizationId: Schema.String,
+	createdAt: Schema.DateFromString,
+	grant: Grant,
+	id: Schema.String,
+	ownerId: Schema.String
+});
+const decode$5 = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const validate = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$2))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encode$2 = Schema.encodeSync(Schema$2);
+var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", {
+	category: Schema.Literal("authorization"),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+const authorizationError = (message, operation) => new AuthorizationError({
+	category: "authorization",
+	message,
+	operation,
+	retry: "after-user-action"
+});
+function assertGrant(connection, authorization, request) {
+	if (connection.authorizationId !== authorization.id || authorization.providerId !== request.providerId || authorization.revocation._tag !== "Active") throw authorizationError("Connection does not grant this provider account", "Connection.assertGrant");
+	if (authorization.expiresAt !== null) {
+		if (Number.isNaN(authorization.expiresAt.getTime())) throw authorizationError("Connection expiration is invalid", "Connection.assertGrant");
+		if (authorization.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw authorizationError("Connection has expired", "Connection.assertGrant");
+	}
+	if (!authorization.requiredCapabilities.includes(request.capability)) throw authorizationError(`Connection lacks the ${request.capability} capability`, "Connection.assertGrant");
+	if (evidenceFor$1(authorization, request.capability) === void 0) throw authorizationError(`Connection has no evidence for the ${request.capability} capability`, "Connection.assertGrant");
+	let domain;
+	try {
+		domain = parse$1(request.domain);
+	} catch (cause) {
+		if (cause instanceof Error$2) throw cause;
+		throw new Error$2({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+	if (!coversDomain(connection.grant, domain)) throw authorizationError("Connection does not grant this domain", "Connection.assertGrant");
+	return domain;
+}
+//#endregion
+//#region src/auth/connect.ts
+const Method$1 = Data.taggedEnum();
+const StartResult = Data.taggedEnum();
+var Error$1 = class extends Schema.TaggedError()("ConnectionError", {
+	category: Schema.Literals([
+		"authorization",
+		"provider",
+		"validation"
+	]),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+const RemoveDomainResult = Data.taggedEnum();
+const persist = Effect.fn("Connection.persist")(function* (input) {
+	const repository = yield* Service$1;
+	const crypto = yield* Crypto.Crypto;
+	const now = new Date(yield* Clock.currentTimeMillis);
+	const missingCapability = input.requiredCapabilities.find((capability) => !input.authentication.capabilityEvidence.some((item) => item.capability === capability));
+	if (missingCapability !== void 0) return yield* new Error$1({
+		category: "authorization",
+		message: `Provider authorization lacks evidence for ${missingCapability}`,
+		operation: "Connection.persist",
+		retry: "after-user-action"
+	});
+	const existing = yield* repository.findByProviderAccount(input.providerId, input.authentication.providerAccountId);
+	const authorizationId = existing?.authorization.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
+		category: "validation",
+		message: cause.message,
+		operation: "Connection.persist",
+		retry: "safe"
+	}))));
+	const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);
+	const binding = {
+		authorizationId,
+		createdAt: existingBinding?.createdAt ?? now,
+		grant: includeDomains(existingBinding?.grant, input.grant),
+		id: existingBinding?.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
+			category: "validation",
+			message: cause.message,
+			operation: "Connection.persist",
+			retry: "safe"
+		})))),
+		ownerId: input.ownerId
+	};
+	const aggregate = {
+		authorization: {
+			authorizedById: input.authorizedById,
+			capabilityEvidence: [...input.authentication.capabilityEvidence],
+			createdAt: existing?.authorization.createdAt ?? now,
+			expiresAt: input.authentication.expiresAt,
+			id: authorizationId,
+			method: input.method,
+			providerAccountId: input.authentication.providerAccountId,
+			providerContext: input.authentication.providerContext,
+			providerId: input.providerId,
+			requiredCapabilities: [...input.requiredCapabilities],
+			revocation: { _tag: "Active" },
+			scopes: [...input.authentication.scopes]
+		},
+		bindings: [...existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? [], binding],
+		credential: input.authentication.credential
+	};
+	return yield* repository.connect(aggregate);
+});
+const start$1 = Effect.fn("Connection.start")(function* (input) {
+	if (input.method._tag === "Interactive") {
+		const crypto = yield* Crypto.Crypto;
+		const now = yield* Clock.currentTimeMillis;
+		const continuationId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
+			category: "validation",
+			message: cause.message,
+			operation: "Connection.start",
+			retry: "safe"
+		})));
+		const started = yield* input.method.flow.start(continuationId);
+		yield* input.method.continuations.put({
+			authorizedById: input.authorizedById,
+			expiresAt: new Date(now + (input.method.ttlMs ?? 6e5)),
+			grant: input.grant,
+			id: continuationId,
+			method: input.method.flow.method,
+			ownerId: input.ownerId,
+			payload: started.payload,
+			providerId: input.method.flow.providerId,
+			requiredCapabilities: [...input.method.flow.requiredCapabilities]
+		});
+		return StartResult.Redirect({
+			authorizationUrl: started.authorizationUrl,
+			continuationId
+		});
+	}
+	const authentication = yield* input.method.authenticate(input.method.token);
+	const aggregate = yield* persist({
+		authentication,
+		authorizedById: input.authorizedById,
+		grant: input.grant,
+		method: "token",
+		ownerId: input.ownerId,
+		providerId: input.method.providerId,
+		requiredCapabilities: input.method.requiredCapabilities
+	});
+	return StartResult.Connected({ aggregate });
+});
+const complete$1 = Effect.fn("Connection.complete")(function* (input) {
+	const continuation = yield* input.continuations.consume(input.continuationId, new Date(yield* Clock.currentTimeMillis));
+	if (continuation === null) return yield* new Error$1({
+		category: "authorization",
+		message: "Connection continuation is expired, unknown, or already consumed",
+		operation: "Connection.complete",
+		retry: "after-user-action"
+	});
+	if (continuation.providerId !== input.flow.providerId || continuation.method !== input.flow.method) return yield* new Error$1({
+		category: "authorization",
+		message: "Connection continuation does not match the provider flow",
+		operation: "Connection.complete",
+		retry: "never"
+	});
+	const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);
+	return yield* persist({
+		authentication,
+		authorizedById: continuation.authorizedById,
+		grant: continuation.grant,
+		method: continuation.method,
+		ownerId: continuation.ownerId,
+		providerId: continuation.providerId,
+		requiredCapabilities: continuation.requiredCapabilities
+	});
+});
+/** Extends one owner binding without repeating provider authentication. */
+const extend = Effect.fn("Connection.extend")(function* (input) {
+	const repository = yield* Service$1;
+	const aggregate = yield* repository.getByConnectionId(input.connectionId);
+	const binding = aggregate?.bindings.find(({ id }) => id === input.connectionId);
+	if (aggregate === null || binding === void 0 || binding.ownerId !== input.ownerId) return yield* new Error$1({
+		category: "authorization",
+		message: "Connection does not belong to this owner",
+		operation: "Connection.extend",
+		retry: "never"
+	});
+	if (aggregate.authorization.revocation._tag !== "Active") return yield* new Error$1({
+		category: "authorization",
+		message: "Provider authorization is awaiting revocation",
+		operation: "Connection.extend",
+		retry: "after-user-action"
+	});
+	const now = new Date(yield* Clock.currentTimeMillis);
+	if (aggregate.authorization.expiresAt !== null && (Number.isNaN(aggregate.authorization.expiresAt.getTime()) || aggregate.authorization.expiresAt <= now)) return yield* new Error$1({
+		category: "authorization",
+		message: "Provider authorization has expired",
+		operation: "Connection.extend",
+		retry: "after-user-action"
+	});
+	return yield* repository.bind(aggregate.authorization.id, {
+		...binding,
+		grant: includeDomains(binding.grant, input.grant)
+	});
+});
+/** Removes one domain from an owner binding without revoking provider authorization. */
+const removeDomain = Effect.fn("Connection.removeDomain")(function* (input) {
+	const repository = yield* Service$1;
+	const aggregate = yield* repository.getByConnectionId(input.connectionId);
+	const binding = aggregate?.bindings.find(({ id }) => id === input.connectionId);
+	if (aggregate === null || binding === void 0 || binding.ownerId !== input.ownerId) return yield* new Error$1({
+		category: "authorization",
+		message: "Connection does not belong to this owner",
+		operation: "Connection.removeDomain",
+		retry: "never"
+	});
+	const domain = yield* decode$8(input.domain).pipe(Effect.mapError((cause) => new Error$1({
+		category: "validation",
+		message: cause.message,
+		operation: "Connection.removeDomain",
+		retry: "never"
+	})));
+	const updated = yield* repository.modifyBinding(input.connectionId, (current) => {
+		if (!coversDomain(current.grant, domain)) return {
+			binding: current,
+			value: false
+		};
+		return {
+			binding: {
+				...current,
+				grant: removeDomain$1(current.grant, domain)
+			},
+			value: true
+		};
+	});
+	return updated.value ? RemoveDomainResult.Removed({ aggregate: updated.aggregate }) : RemoveDomainResult.AlreadyRemoved({ aggregate: updated.aggregate });
+});
+//#endregion
+//#region src/auth/diagnostic.ts
+var diagnostic_exports = /* @__PURE__ */ __exportAll({
+	Category: () => Category,
+	Fields: () => Fields,
+	RetryAdvice: () => RetryAdvice,
+	from: () => from
+});
+const Category = Schema.Literals([
+	"authorization",
+	"configuration",
+	"provider",
+	"storage",
+	"validation"
+]);
+const RetryAdvice = Schema.Literals([
+	"never",
+	"after-user-action",
+	"safe",
+	"unknown"
+]);
+const Fields = {
+	category: Category,
+	message: Schema.String,
+	operation: Schema.String,
+	retry: RetryAdvice
+};
+function from(error) {
+	return {
+		category: error.category,
+		message: error.message,
+		operation: error.operation,
+		retry: error.retry,
+		tag: error._tag
+	};
+}
+//#endregion
+//#region src/auth/manifest.ts
+var manifest_exports = /* @__PURE__ */ __exportAll({
+	Method: () => Method,
+	Schema: () => Schema$1,
+	decode: () => decode$4
+});
+const Method = Schema.TaggedUnion({
+	integration: {
+		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
+		installUrl: Schema.String,
+		tokenEndpoint: Schema.String
+	},
+	oauth2: {
+		authorizationServer: Schema.Struct({
+			authorization_endpoint: Schema.String,
+			issuer: Schema.String,
+			revocation_endpoint: Schema.optionalKey(Schema.String),
+			token_endpoint: Schema.String
+		}),
+		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
+		clientAuth: Schema.Literals([
+			"none",
+			"client_secret_basic",
+			"client_secret_post"
+		]),
+		scopes: Schema.Array(Schema.String)
+	},
+	token: {
+		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
+		instructionsUrl: Schema.String
+	}
+});
+const Schema$1 = Schema.Struct({
+	methods: Schema.Array(Method),
+	providerId: Schema.String
+});
+const decode$4 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+//#endregion
+//#region src/auth/secret.ts
+var secret_exports = /* @__PURE__ */ __exportAll({
+	Value: () => Value,
+	make: () => make$6
+});
+/** A deliberately non-serializable credential value. */
+var Value = class Value {
+	#value;
+	constructor(value) {
+		this.#value = value;
+	}
+	static from(value) {
+		if (value.length === 0) throw new Error("Secret values cannot be empty");
+		return new Value(value);
+	}
+	expose() {
+		return this.#value;
+	}
+	toJSON() {
+		return "[REDACTED]";
+	}
+	toString() {
+		return "[REDACTED]";
+	}
+};
+const make$6 = Value.from;
+//#endregion
+//#region src/discovery/selection.ts
+var selection_exports = /* @__PURE__ */ __exportAll({
+	Evidence: () => Evidence,
+	Selection: () => Selection,
+	select: () => select
+});
+const Evidence = Schema.Struct({
+	accountId: Schema.String,
+	connectionId: Schema.String,
+	decisiveNameserverMatch: Schema.Boolean,
+	matchedNameservers: Schema.Array(Schema$4),
+	providerId: Schema.String,
+	zone: Schema$4
+});
+const Selection = Schema.TaggedUnion({
+	selected: {
+		candidate: Evidence,
+		evidence: Schema.Array(Evidence),
+		reason: Schema.Literals(["explicit", "unique-nameserver-match"])
+	},
+	manual: {
+		evidence: Schema.Array(Evidence),
+		reason: Schema.Literals(["ambiguous", "unsupported"])
+	}
+});
+function select(input) {
+	const domain = parse$1(input.domain);
+	const zoneCandidates = new Set(candidates(domain));
+	const authoritative = nameserverSet(input.authoritativeNameservers);
+	const eligible = input.connectedZones.filter((connected) => {
+		if (!zoneCandidates.has(parse$1(connected.zone))) return false;
+		try {
+			assertGrant(connected.connection, connected.authorization, {
+				capability: "dns:read",
+				domain,
+				...input.now === void 0 ? {} : { now: input.now },
+				providerId: connected.providerId
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	});
+	const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));
+	if (input.explicit !== void 0) {
+		const explicitZone = parse$1(input.explicit.zone);
+		const index = eligible.findIndex((connected) => connected.providerId === input.explicit?.providerId && connected.authorization.providerAccountId === input.explicit.accountId && parse$1(connected.zone) === explicitZone);
+		if (index < 0) throw authorizationError("Explicit provider zone is not connected or granted", "ProviderDiscovery.select");
+		const candidate = evidence[index];
+		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
+		return {
+			_tag: "selected",
+			candidate,
+			evidence,
+			reason: "explicit"
+		};
+	}
+	const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);
+	const candidate = decisive[0];
+	return decisive.length === 1 && candidate !== void 0 ? {
+		_tag: "selected",
+		candidate,
+		evidence,
+		reason: "unique-nameserver-match"
+	} : {
+		_tag: "manual",
+		evidence,
+		reason: decisive.length > 1 ? "ambiguous" : "unsupported"
+	};
+}
+function evidenceFor(connected, authoritative) {
+	const configured = new Set(nameserverSet(connected.nameservers));
+	const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));
+	return {
+		accountId: connected.authorization.providerAccountId,
+		connectionId: connected.connection.id,
+		decisiveNameserverMatch: authoritative.length > 0 && matchedNameservers.length === authoritative.length,
+		matchedNameservers,
+		providerId: connected.providerId,
+		zone: parse$1(connected.zone)
+	};
+}
+function nameserverSet(nameservers) {
+	return [...new Set(nameservers.map(parse$1))].sort();
+}
+//#endregion
+//#region src/plan/connection-authorization.ts
+var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize });
+const authorize = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
+	const domain = yield* Effect.try({
+		try: () => assertGrant(input.connection, input.authorization, {
+			capability: "dns:write",
+			domain: input.domain,
+			providerId: input.plan.providerId
+		}),
+		catch: (cause) => cause instanceof AuthorizationError || cause instanceof Error$2 ? cause : authorizationError("Connection grant is invalid", "ConnectionAuthorization.authorize")
+	});
+	const authorization = yield* authorize$1(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
+	const selected = new Set(authorization.operationIds);
+	if (input.plan.operations.filter((operation) => operation._tag === "create" && selected.has(operation.id) && operation.requirement.name !== domain && !operation.requirement.name.endsWith(`.${domain}`)).length > 0) return yield* authorizationError(`Plan operations are outside the granted domain ${domain}`, "ConnectionAuthorization.authorize");
+	return authorization;
+});
+//#endregion
+//#region src/auth/authorization-code.ts
+const start = Effect.fn("AuthorizationCode.start")(function* (input) {
+	const crypto = yield* Crypto.Crypto;
+	const codeVerifier = base64Url(yield* randomBytes(crypto, 32));
+	const challenge = base64Url(yield* digest(crypto, codeVerifier));
+	const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);
+	authorizationUrl.search = new URLSearchParams({
+		client_id: input.client.clientId,
+		code_challenge: challenge,
+		code_challenge_method: "S256",
+		redirect_uri: input.redirectUri,
+		response_type: "code",
+		scope: input.method.scopes.join(" "),
+		state: input.state
+	}).toString();
+	return {
+		authorizationUrl,
+		payload: make$6(JSON.stringify({
+			codeVerifier,
+			redirectUri: input.redirectUri,
+			state: input.state
+		}))
+	};
+});
+const complete = Effect.fn("AuthorizationCode.complete")(function* (input) {
+	const payload = yield* decodePayload(input.payload);
+	if (input.callbackUrl.searchParams.get("state") !== payload.state) return yield* failure$5("Authorization callback state does not match its continuation");
+	const server = input.method.authorizationServer;
+	const client = { client_id: input.client.clientId };
+	const authentication = yield* clientAuthentication(input.method, input.client);
+	return yield* Effect.tryPromise({
+		try: async (signal) => {
+			const callback = oauth.validateAuthResponse(server, client, input.callbackUrl, payload.state);
+			const response = await oauth.authorizationCodeGrantRequest(server, client, authentication, callback, payload.redirectUri, payload.codeVerifier, requestOptions(input.fetch, signal));
+			return oauth.processAuthorizationCodeResponse(server, client, response);
+		},
+		catch: (cause) => new Error$1({
+			category: "provider",
+			message: cause instanceof globalThis.Error ? cause.name : "OAuth provider request failed",
+			operation: "AuthorizationCode.complete",
+			retry: "unknown"
+		})
+	});
+});
+const PayloadSchema = Schema.Struct({
+	codeVerifier: Schema.String,
+	redirectUri: Schema.String,
+	state: Schema.String
+});
+function decodePayload(payload) {
+	return Schema.decodeUnknownEffect(Schema.fromJsonString(PayloadSchema))(payload.expose()).pipe(Effect.mapError(() => new Error$1({
+		category: "authorization",
+		message: "OAuth continuation payload is invalid",
+		operation: "AuthorizationCode",
+		retry: "after-user-action"
+	})));
+}
+function clientAuthentication(method, client) {
+	switch (method.clientAuth) {
+		case "none": return Effect.succeed(oauth.None());
+		case "client_secret_basic": return client.clientSecret === void 0 ? failure$5("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));
+		case "client_secret_post": return client.clientSecret === void 0 ? failure$5("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretPost(client.clientSecret.expose()));
+	}
+}
+function requestOptions(fetchImplementation, signal) {
+	return fetchImplementation === void 0 ? { signal } : {
+		signal,
+		[oauth.customFetch]: (url, options) => fetchImplementation(url, {
+			...options,
+			body: options.body
+		})
+	};
+}
+const failure$5 = (message) => Effect.fail(new Error$1({
+	category: "authorization",
+	message,
+	operation: "AuthorizationCode",
+	retry: "after-user-action"
+}));
+function randomBytes(crypto, size) {
+	return crypto.randomBytes(size).pipe(Effect.mapError((cause) => new Error$1({
+		category: "validation",
+		message: cause.message,
+		operation: "AuthorizationCode.start",
+		retry: "safe"
+	})));
+}
+function digest(crypto, value) {
+	return crypto.digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new Error$1({
+		category: "validation",
+		message: cause.message,
+		operation: "AuthorizationCode.start",
+		retry: "safe"
+	})));
+}
+function base64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+//#endregion
+//#region src/providers/cloudflare/protocol.ts
+const ErrorDetail$1 = Schema.Struct({
+	code: Schema.Number,
+	message: Schema.String
+});
+const ResultInfo = Schema.Struct({
+	count: Schema.optionalKey(Schema.Number),
+	page: Schema.optionalKey(Schema.Number),
+	per_page: Schema.optionalKey(Schema.Number),
+	total_count: Schema.optionalKey(Schema.Number),
+	total_pages: Schema.optionalKey(Schema.Number)
+});
+const Message = Schema.Struct({
+	code: Schema.optionalKey(Schema.Number),
+	message: Schema.String
+});
+const BaseEnvelope = Schema.Struct({
+	errors: Schema.Array(ErrorDetail$1),
+	messages: Schema.Array(Message),
+	success: Schema.Boolean
+});
+const Account = Schema.Struct({
+	id: Schema.String,
+	name: Schema.String
+});
+const Zone = Schema.Struct({
+	account: Account,
+	id: Schema.String,
+	name: Schema.String,
+	name_servers: Schema.Array(Schema.String),
+	status: Schema.optionalKey(Schema.String)
+});
+const Record$1 = Schema.Struct({
+	content: Schema.optionalKey(Schema.String),
+	data: Schema.optionalKey(Schema.Unknown),
+	id: Schema.String,
+	name: Schema.String,
+	priority: Schema.optionalKey(Schema.Number),
+	proxied: Schema.optionalKey(Schema.Boolean),
+	ttl: Schema.Number,
+	type: Schema.String
+});
+const Token = Schema.Struct({
+	expires_on: Schema.optionalKey(Schema.String),
+	id: Schema.String,
+	not_before: Schema.optionalKey(Schema.String),
+	status: Schema.Literals([
+		"active",
+		"disabled",
+		"expired"
+	])
+});
+const ZoneListEnvelope = Schema.Struct({
+	errors: Schema.Array(ErrorDetail$1),
+	messages: Schema.Array(Message),
+	result: Schema.Array(Zone),
+	result_info: Schema.optionalKey(ResultInfo),
+	success: Schema.Boolean
+});
+const RecordListEnvelope$1 = Schema.Struct({
+	errors: Schema.Array(ErrorDetail$1),
+	messages: Schema.Array(Message),
+	result: Schema.Array(Record$1),
+	result_info: Schema.optionalKey(ResultInfo),
+	success: Schema.Boolean
+});
+const RecordEnvelope = Schema.Struct({
+	errors: Schema.Array(ErrorDetail$1),
+	messages: Schema.Array(Message),
+	result: Record$1,
+	success: Schema.Boolean
+});
+const TokenEnvelope = Schema.Struct({
+	errors: Schema.Array(ErrorDetail$1),
+	messages: Schema.Array(Message),
+	result: Token,
+	success: Schema.Boolean
+});
+//#endregion
+//#region src/providers/cloudflare/records.ts
+const Data$1 = Schema.Struct({
+	flags: Schema.optionalKey(Schema.Number),
+	port: Schema.optionalKey(Schema.Number),
+	priority: Schema.optionalKey(Schema.Number),
+	tag: Schema.optionalKey(Schema.String),
+	target: Schema.optionalKey(Schema.String),
+	value: Schema.optionalKey(Schema.String),
+	weight: Schema.optionalKey(Schema.Number)
+});
+const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(function* () {
+	const name = yield* decode$8(record.name).pipe(Effect.match({
+		onFailure: () => null,
+		onSuccess: (value) => value
+	}));
+	if (name === null) return yield* decodeOpaque$1(record);
+	const common = {
+		metadata: {
+			ownership: "provider",
+			provenance: record.proxied === true ? "cloudflare:proxied" : "cloudflare",
+			purpose: "existing DNS record"
+		},
+		name,
+		policy: record.type === "CNAME" ? "exclusive" : "append",
+		ttl: record.ttl === 1 ? null : record.ttl
+	};
+	const content = () => record.content === void 0 ? Effect.fail(failure$4("decodeRecord", `Cloudflare ${record.type} record has no content`)) : Effect.succeed(record.content);
+	switch (record.type) {
+		case "A":
+		case "AAAA": return yield* decode$9({
+			...common,
+			_tag: record.type,
+			address: yield* content()
+		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		case "CNAME":
+		case "NS": return yield* decode$9({
+			...common,
+			_tag: record.type,
+			target: yield* content()
+		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		case "TXT": return yield* decode$9({
+			...common,
+			_tag: "TXT",
+			value: yield* content()
+		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		case "MX": return yield* decode$9({
+			...common,
+			_tag: "MX",
+			exchange: yield* content(),
+			priority: record.priority
+		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		case "CAA": {
+			const data = yield* decodeData(record);
+			return yield* decode$9({
+				...common,
+				_tag: "CAA",
+				...data
+			}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		}
+		case "SRV": {
+			const data = yield* decodeData(record);
+			return yield* decode$9({
+				...common,
+				_tag: "SRV",
+				...data
+			}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		}
+		default: return yield* decodeOpaque$1(record);
+	}
+}));
+const decodeOpaque$1 = Effect.fn("CloudflareRecords.decodeOpaque")((record) => Schema.decodeUnknownEffect(Opaque)({
+	_tag: "Opaque",
+	name: record.name,
+	providerRecordId: record.id,
+	providerType: record.type
+}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message))));
+function encode$1(record) {
+	const common = {
+		name: record.name,
+		proxied: false,
+		ttl: record.ttl ?? 1,
+		type: record._tag
+	};
+	switch (record._tag) {
+		case "A":
+		case "AAAA": return {
+			...common,
+			content: record.address
+		};
+		case "CNAME":
+		case "NS": return {
+			...common,
+			content: record.target
+		};
+		case "TXT": return {
+			...common,
+			content: record.value
+		};
+		case "MX": return {
+			...common,
+			content: record.exchange,
+			priority: record.priority
+		};
+		case "CAA": return {
+			...common,
+			data: {
+				flags: record.flags,
+				tag: record.tag,
+				value: record.value
+			}
+		};
+		case "SRV": return {
+			...common,
+			data: {
+				port: record.port,
+				priority: record.priority,
+				target: record.target,
+				weight: record.weight
+			}
+		};
+	}
+}
+const decodeData = Effect.fn("CloudflareRecords.decodeData")((record) => Schema.decodeUnknownEffect(Data$1)(record.data).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message))));
+function failure$4(operation, message, fields = {}) {
+	return new Error$3({
+		message,
+		operation,
+		providerId: "cloudflare",
+		reason: fields.reason ?? "response"
+	});
+}
+//#endregion
+//#region src/providers/cloudflare/client.ts
+var client_exports$1 = /* @__PURE__ */ __exportAll({
+	discoverAuthorizationAccount: () => discoverAuthorizationAccount,
+	discovery: () => discovery$1,
+	make: () => make$5,
+	validateDomainToken: () => validateDomainToken
+});
+/** Exposes Cloudflare zone lookup as the optional provider discovery capability. */
+function discovery$1(client) {
+	return {
+		listZones: (name) => client.listZones({ name }).pipe(Effect.map((zones) => zones.map((zone) => ({
+			...zone,
+			status: zone.status === "active" || zone.status === "pending" ? zone.status : "unknown"
+		})))),
+		provider: client
+	};
+}
+const makeTransport = (options) => {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const baseUrl = (options.baseUrl ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "");
+	const request = Effect.fn("CloudflareClient.request")((path, operation, init) => Effect.gen(function* () {
+		const response = yield* Effect.tryPromise({
+			try: () => fetch(`${baseUrl}${path}`, {
+				...init,
+				headers: {
+					Accept: "application/json",
+					Authorization: `Bearer ${options.token.expose()}`,
+					...init?.body === void 0 ? {} : { "Content-Type": "application/json" },
+					...init?.headers
+				}
+			}),
+			catch: () => failure$3(operation, "Cloudflare request failed", { reason: "transport" })
+		});
+		return {
+			body: yield* Effect.tryPromise({
+				try: () => response.json(),
+				catch: () => {
+					const retryAfterMs = retryAfter(response.headers.get("retry-after"));
+					return failure$3(operation, response.ok ? "Cloudflare returned a non-JSON response" : `Cloudflare request failed with HTTP ${response.status}`, {
+						reason: response.ok ? "response" : reason$1(response.status),
+						...retryAfterMs === void 0 ? {} : { retryAfterMs },
+						status: response.status
+					});
+				}
+			}),
+			response
+		};
+	}));
+	const listZonesPage = Effect.fn("CloudflareClient.listZonesPage")((accountId, name, page) => Effect.gen(function* () {
+		const query = new URLSearchParams({
+			page: String(page),
+			per_page: "50"
+		});
+		query.set("type", "full,partial,secondary,internal");
+		if (accountId !== void 0) query.set("account.id", accountId);
+		if (name !== void 0) query.set("name", name);
+		const { body, response } = yield* request(`/zones?${query}`, "listZones");
+		yield* ensureSuccess(body, "listZones", response);
+		return yield* decode$2(ZoneListEnvelope, body, "listZones", response);
+	}));
+	return {
+		allZones: Effect.fn("CloudflareClient.allZones")((accountId, name) => Effect.gen(function* () {
+			const zones = [];
+			let page = 1;
+			while (true) {
+				const envelope = yield* listZonesPage(accountId, name, page);
+				zones.push(...envelope.result);
+				const totalPages = envelope.result_info?.total_pages;
+				if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 50) return zones;
+				page += 1;
+			}
+		})),
+		inspectToken: Effect.fn("CloudflareClient.inspectToken")((path) => Effect.gen(function* () {
+			const { body, response } = yield* request(path, "validateToken");
+			yield* ensureSuccess(body, "validateToken", response);
+			const envelope = yield* decode$2(TokenEnvelope, body, "validateToken", response);
+			if (envelope.result.status !== "active") return yield* Effect.fail(failure$3("validateToken", `Cloudflare token is ${envelope.result.status}`, {
+				reason: "authentication",
+				status: response.status
+			}));
+			const expiresAt = envelope.result.expires_on === void 0 ? null : new Date(envelope.result.expires_on);
+			if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) return yield* Effect.fail(failure$3("validateToken", "Cloudflare token expiry is not a valid timestamp", {
+				reason: "response",
+				status: response.status
+			}));
+			return expiresAt;
+		})),
+		request
+	};
+};
+const discoverAccount = Effect.fn("CloudflareClient.discoverAccount")((options) => Effect.gen(function* () {
+	const { allZones } = makeTransport(options);
+	for (const candidate of candidates(options.domain)) {
+		const matches = yield* allZones(void 0, candidate);
+		const match = matches[0];
+		if (matches.length === 0) continue;
+		if (matches.length === 1 && match !== void 0) return match.account;
+		return yield* Effect.fail(failure$3("discoverAccount", `Cloudflare returned multiple accessible zones named ${candidate}`, { reason: "conflict" }));
+	}
+	return yield* Effect.fail(failure$3("discoverAccount", `Cloudflare did not expose an accessible zone for ${options.domain}`, { reason: "not_found" }));
+}));
+const discoverAuthorizationAccount = discoverAccount;
+const validateDomainToken = Effect.fn("CloudflareClient.validateDomainToken")((options) => Effect.gen(function* () {
+	const transport = makeTransport(options);
+	const account = options.tokenKind === "account" ? yield* discoverAccount(options) : void 0;
+	const expiresAt = yield* transport.inspectToken(account === void 0 ? "/user/tokens/verify" : `/accounts/${encodeURIComponent(account.id)}/tokens/verify`);
+	return {
+		accountId: (account ?? (yield* discoverAccount(options))).id,
+		capabilities: options.capabilities,
+		expiresAt,
+		scopes: []
+	};
+}));
+/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
+function make$5(options) {
+	const { allZones, inspectToken, request } = makeTransport(options);
+	const resolveZone = Effect.fn("CloudflareClient.resolveZone")((name) => Effect.gen(function* () {
+		const matches = yield* allZones(options.accountId, name);
+		const match = matches[0];
+		if (matches.length === 1 && match !== void 0) return match;
+		return yield* Effect.fail(failure$3("resolveZone", matches.length === 0 ? `Cloudflare zone ${name} was not found in account ${options.accountId}` : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`, { reason: matches.length === 0 ? "not_found" : "response" }));
+	}));
+	const listRecords = Effect.fn("CloudflareClient.listRecords")((zoneName) => Effect.gen(function* () {
+		const zone = yield* resolveZone(zoneName);
+		const records = [];
+		let page = 1;
+		while (true) {
+			const query = new URLSearchParams({
+				page: String(page),
+				per_page: "100"
+			});
+			const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records?${query}`, "listRecords");
+			yield* ensureSuccess(body, "listRecords", response);
+			const envelope = yield* decode$2(RecordListEnvelope$1, body, "listRecords", response);
+			records.push(...yield* Effect.forEach(envelope.result, decode$3));
+			const totalPages = envelope.result_info?.total_pages;
+			if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 100) return records;
+			page += 1;
+		}
+	}));
+	const createRecord = Effect.fn("CloudflareClient.createRecord")((zoneName, record) => Effect.gen(function* () {
+		const zone = yield* resolveZone(zoneName);
+		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records`, "createRecord", {
+			body: JSON.stringify(encode$1(record)),
+			method: "POST"
+		});
+		yield* ensureSuccess(body, "createRecord", response);
+		return { providerRecordId: (yield* decode$2(RecordEnvelope, body, "createRecord", response)).result.id };
+	}));
+	const getRecord = Effect.fn("CloudflareClient.getRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
+		const zone = yield* resolveZone(zoneName);
+		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "getRecord");
+		if (response.status === 404) return null;
+		yield* ensureSuccess(body, "getRecord", response);
+		const envelope = yield* decode$2(RecordEnvelope, body, "getRecord", response);
+		return yield* decode$3(envelope.result);
+	}));
+	return {
+		id: "cloudflare",
+		createRecord,
+		deleteRecord: Effect.fn("CloudflareClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
+			const zone = yield* resolveZone(zoneName);
+			const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "deleteRecord", { method: "DELETE" });
+			yield* ensureSuccess(body, "deleteRecord", response);
+		})),
+		getRecord,
+		listAccounts: Effect.fn("CloudflareClient.listAccounts")(() => allZones().pipe(Effect.map((zones) => {
+			const accounts = /* @__PURE__ */ new Map();
+			for (const zone of zones) accounts.set(zone.account.id, zone.account);
+			return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));
+		}))),
+		listRecords,
+		listZones: Effect.fn("CloudflareClient.listZones")((input = {}) => allZones(input.accountId ?? options.accountId, input.name).pipe(Effect.flatMap((zones) => Effect.forEach(zones, projectZone$1)))),
+		validateToken: Effect.fn("CloudflareClient.validateToken")(() => Effect.gen(function* () {
+			const path = options.tokenKind === "account" ? `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify` : "/user/tokens/verify";
+			const expiresAt = yield* inspectToken(path);
+			yield* allZones(options.accountId);
+			return {
+				accountId: options.accountId,
+				capabilities: options.capabilities,
+				expiresAt,
+				scopes: []
+			};
+		}))
+	};
+}
+const projectZone$1 = Effect.fn("CloudflareClient.projectZone")((zone) => Effect.gen(function* () {
+	const name = yield* decode$8(zone.name).pipe(Effect.mapError((cause) => failure$3("listZones", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$8(nameserver).pipe(Effect.mapError((cause) => failure$3("listZones", cause.message, { reason: "response" }))));
+	return {
+		accountId: zone.account.id,
+		id: zone.id,
+		name,
+		nameservers,
+		status: zone.status ?? null
+	};
+}));
+function decode$2(schema, input, operation, response) {
+	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$3(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {
+		reason: "response",
+		status: response.status
+	})));
+}
+function ensureSuccess(input, operation, response) {
+	return Schema.decodeUnknownEffect(BaseEnvelope)(input).pipe(Effect.mapError(() => failure$3(operation, "Cloudflare response did not contain a valid API envelope", {
+		reason: "response",
+		status: response.status
+	})), Effect.flatMap((envelope) => {
+		if (response.ok && envelope.success) return Effect.void;
+		const detail = envelope.errors[0];
+		const retryAfterMs = retryAfter(response.headers.get("retry-after"));
+		return Effect.fail(failure$3(operation, detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`, {
+			...detail === void 0 ? {} : { code: detail.code },
+			reason: reason$1(response.status, detail?.code),
+			...retryAfterMs === void 0 ? {} : { retryAfterMs },
+			status: response.status
+		}));
+	}));
+}
+function reason$1(status, code) {
+	if (status === 401) return "authentication";
+	if (status === 403) return "authorization";
+	if (status === 404) return "not_found";
+	if (status === 409 || code === 81056 || code === 81057 || code === 81058) return "conflict";
+	if (status === 429) return "rate_limit";
+	if (status >= 500) return "response";
+	return "request";
+}
+function retryAfter(value) {
+	if (value === null) return void 0;
+	const seconds = Number(value);
+	if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+	const date = Date.parse(value);
+	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
+}
+function failure$3(operation, message, fields = {}) {
+	return new Error$3({
+		...fields,
+		message,
+		operation,
+		providerId: "cloudflare"
+	});
+}
+//#endregion
+//#region src/providers/cloudflare/auth.ts
+var auth_exports$1 = /* @__PURE__ */ __exportAll({
+	contextCodec: () => contextCodec$1,
+	manifest: () => manifest$1,
+	oauthAuthentication: () => oauthAuthentication,
+	oauthFlow: () => oauthFlow,
+	oauthMethod: () => oauthMethod,
+	subjectResolver: () => subjectResolver,
+	tokenConnectionMethod: () => tokenConnectionMethod$1,
+	tokenMethod: () => tokenMethod$1,
+	tokenValidator: () => tokenValidator
+});
+const authorizationServer = {
+	authorization_endpoint: "https://dash.cloudflare.com/oauth2/auth",
+	issuer: "https://dash.cloudflare.com",
+	revocation_endpoint: "https://dash.cloudflare.com/oauth2/revoke",
+	token_endpoint: "https://dash.cloudflare.com/oauth2/token"
+};
+const contextCodec$1 = codec("cloudflare.v1", Schema.Struct({ tokenKind: Schema.Literals(["account", "user"]) }));
+/** Describes Cloudflare's caller-created API-token authorization method. */
+function tokenMethod$1(capabilities) {
+	return {
+		_tag: "token",
+		capabilities: [...capabilities],
+		instructionsUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/"
+	};
+}
+/** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */
+function oauthMethod(options) {
+	return {
+		_tag: "oauth2",
+		authorizationServer,
+		capabilities: [...options.capabilities],
+		clientAuth: options.clientAuth,
+		scopes: [...options.scopes]
+	};
+}
+/** Creates the Cloudflare token and OAuth authorization manifest. */
+function manifest$1(options) {
+	return {
+		methods: [tokenMethod$1(options.capabilities), oauthMethod(options)],
+		providerId: "cloudflare"
+	};
+}
+/** Resolves the Cloudflare account selected by a completed OAuth grant. */
+function subjectResolver(options) {
+	return (tokens, accessToken) => Effect.gen(function* () {
+		const accountId = options.accountId ?? (yield* discoverAuthorizationAccount({
+			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+			domain: options.domain,
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
+			token: accessToken
+		}).pipe(Effect.map((account) => account.id)));
+		if (options.accountId !== void 0) yield* make$5({
+			accountId: options.accountId,
+			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+			capabilities: options.capabilities,
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
+			token: accessToken,
+			tokenKind: "user"
+		}).listZones();
+		const now = yield* Clock.currentTimeMillis;
+		return {
+			accountId,
+			expiresAt: typeof tokens.expires_in === "number" ? new Date(now + tokens.expires_in * 1e3) : null
+		};
+	});
+}
+/** Creates a host callback that validates a Cloudflare API token. */
+function tokenValidator(options) {
+	return (token) => options.accountId === void 0 ? validateDomainToken({
+		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+		capabilities: options.capabilities,
+		domain: options.domain,
+		...options.fetch === void 0 ? {} : { fetch: options.fetch },
+		token,
+		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
+	}) : make$5({
+		accountId: options.accountId,
+		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+		capabilities: options.capabilities,
+		...options.fetch === void 0 ? {} : { fetch: options.fetch },
+		token,
+		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
+	}).validateToken();
+}
+/** Creates a provider-independent token connection method backed by Cloudflare validation. */
+function tokenConnectionMethod$1(options) {
+	const requiredCapabilities = [...options.capabilities];
+	return Method$1.Token({
+		authenticate: Effect.fn("CloudflareAuth.authenticateToken")(function* (token) {
+			const validated = yield* tokenValidator(options)(token);
+			const observedAt = new Date(yield* Clock.currentTimeMillis);
+			return {
+				capabilityEvidence: validated.capabilities.map((capability) => ({
+					capability,
+					evidence: Evidence$1.Introspected({ observedAt })
+				})),
+				credential: {
+					accessToken: token,
+					refreshToken: null,
+					tokenType: "bearer"
+				},
+				expiresAt: validated.expiresAt,
+				providerAccountId: validated.accountId,
+				providerContext: yield* contextCodec$1.encode({ tokenKind: options.tokenKind ?? "user" }),
+				scopes: [...validated.scopes]
+			};
+		}),
+		providerId: "cloudflare",
+		requiredCapabilities,
+		token: options.token
+	});
+}
+/** Converts a completed Cloudflare OAuth grant into the canonical connection authentication. */
+const oauthAuthentication = Effect.fn("CloudflareAuth.oauthAuthentication")(function* (options) {
+	const resolved = yield* subjectResolver(options)(options.tokens, options.accessToken);
+	const observedAt = new Date(yield* Clock.currentTimeMillis);
+	return {
+		capabilityEvidence: options.capabilities.map((capability) => ({
+			capability,
+			evidence: Evidence$1.Introspected({ observedAt })
+		})),
+		credential: {
+			accessToken: options.accessToken,
+			refreshToken: options.tokens.refresh_token === void 0 ? null : Value.from(options.tokens.refresh_token),
+			tokenType: options.tokens.token_type
+		},
+		expiresAt: resolved.expiresAt,
+		providerAccountId: resolved.accountId,
+		providerContext: yield* contextCodec$1.encode({ tokenKind: "user" }),
+		scopes: (options.tokens.scope ?? "").split(" ").filter(Boolean)
+	};
+});
+/** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */
+function oauthFlow(options) {
+	const method = oauthMethod({
+		capabilities: options.capabilities,
+		clientAuth: options.clientAuth,
+		scopes: options.scopes
+	});
+	return {
+		complete: Effect.fn("CloudflareAuth.oauthFlow.complete")(function* (payload, callbackUrl) {
+			const tokens = yield* complete({
+				callbackUrl,
+				client: options.client,
+				...options.fetch === void 0 ? {} : { fetch: options.fetch },
+				method,
+				payload,
+				providerId: "cloudflare"
+			});
+			return yield* oauthAuthentication({
+				...options.accountId === void 0 ? { domain: options.domain } : { accountId: options.accountId },
+				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+				capabilities: options.capabilities,
+				...options.fetch === void 0 ? {} : { fetch: options.fetch },
+				accessToken: make$6(tokens.access_token),
+				tokens
+			});
+		}),
+		method: "oauth2",
+		providerId: "cloudflare",
+		requiredCapabilities: [...options.capabilities],
+		start: (continuationId) => start({
+			client: options.client,
+			method,
+			redirectUri: options.redirectUri,
+			state: continuationId
+		})
+	};
+}
+//#endregion
+//#region src/providers/vercel/protocol.ts
+const Pagination = Schema.Struct({
+	count: Schema.Number,
+	next: Schema.NullOr(Schema.Number),
+	prev: Schema.NullOr(Schema.Number)
+});
+const ErrorDetail = Schema.Struct({
+	code: Schema.String,
+	message: Schema.String,
+	limit: Schema.optionalKey(Schema.Struct({
+		remaining: Schema.Number,
+		reset: Schema.optionalKey(Schema.Number),
+		resetMs: Schema.optionalKey(Schema.Number),
+		total: Schema.Number
+	}))
+});
+const ErrorEnvelope = Schema.Struct({ error: ErrorDetail });
+const User = Schema.Struct({
+	id: Schema.String,
+	name: Schema.NullOr(Schema.String),
+	username: Schema.String
+});
+const UserEnvelope = Schema.Struct({ user: User });
+const Team = Schema.Struct({
+	id: Schema.String,
+	name: Schema.NullOr(Schema.String),
+	slug: Schema.String
+});
+const TeamListEnvelope = Schema.Struct({
+	pagination: Pagination,
+	teams: Schema.Array(Team)
+});
+const Domain = Schema.Struct({
+	id: Schema.String,
+	intendedNameservers: Schema.Array(Schema.String),
+	name: Schema.String,
+	nameservers: Schema.Array(Schema.String),
+	serviceType: Schema.Literals([
+		"zeit.world",
+		"external",
+		"na"
+	]),
+	teamId: Schema.NullOr(Schema.String),
+	userId: Schema.String,
+	verified: Schema.Boolean,
+	zone: Schema.optionalKey(Schema.Boolean)
+});
+const DomainConfig = Schema.Struct({
+	misconfigured: Schema.Boolean,
+	serviceType: Schema.Literals([
+		"zeit.world",
+		"external",
+		"na"
+	])
+});
+const DomainEnvelope = Schema.Struct({ domain: Domain });
+const DomainListEnvelope = Schema.Struct({
+	domains: Schema.Array(Domain),
+	pagination: Pagination
+});
+const Record = Schema.Struct({
+	id: Schema.String,
+	mxPriority: Schema.optionalKey(Schema.Number),
+	name: Schema.String,
+	priority: Schema.optionalKey(Schema.Number),
+	ttl: Schema.optionalKey(Schema.Number),
+	type: Schema.String,
+	value: Schema.String
+});
+const RecordListEnvelope = Schema.Struct({
+	pagination: Schema.optionalKey(Pagination),
+	records: Schema.Array(Record)
+});
+const CreateRecordEnvelope = Schema.Struct({
+	uid: Schema.String,
+	updated: Schema.optionalKey(Schema.Number)
+});
+const IntegrationToken = Schema.Struct({
+	access_token: Schema.String,
+	installation_id: Schema.optionalKey(Schema.String),
+	team_id: Schema.NullOr(Schema.String),
+	token_type: Schema.optionalKey(Schema.String),
+	user_id: Schema.String
+});
+//#endregion
+//#region src/providers/vercel/records.ts
+const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(function* () {
+	const absolute = absoluteNameCandidate(zone, record.name);
+	const name = yield* decode$8(absolute).pipe(Effect.match({
+		onFailure: () => null,
+		onSuccess: (value) => value
+	}));
+	if (name === null) return yield* decodeOpaque(record, absolute);
+	const common = {
+		metadata: {
+			ownership: "provider",
+			provenance: "vercel",
+			purpose: "existing DNS record"
+		},
+		name,
+		policy: record.type === "CNAME" ? "exclusive" : "append",
+		ttl: record.ttl ?? 60
+	};
+	const fromRecord = (input) => decode$9(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
+	switch (record.type) {
+		case "A":
+		case "AAAA": return yield* fromRecord({
+			...common,
+			_tag: record.type,
+			address: record.value
+		});
+		case "CNAME":
+		case "NS": return yield* fromRecord({
+			...common,
+			_tag: record.type,
+			target: record.value
+		});
+		case "TXT": return yield* fromRecord({
+			...common,
+			_tag: "TXT",
+			value: record.value
+		});
+		case "MX": return yield* fromRecord({
+			...common,
+			_tag: "MX",
+			exchange: record.value,
+			priority: record.mxPriority ?? record.priority
+		});
+		case "CAA": {
+			const match = record.value.match(/^(\d{1,3})\s+(issue|issuewild|iodef)\s+(?:"((?:\\.|[^"])*)"|(\S.*))$/);
+			if (match === null) return yield* Effect.fail(failure$2("decodeRecord", "Vercel CAA record has an invalid value"));
+			return yield* fromRecord({
+				...common,
+				_tag: "CAA",
+				flags: Number(match[1]),
+				tag: match[2],
+				value: unescapeQuoted(match[3] ?? match[4] ?? "")
+			});
+		}
+		case "SRV": {
+			const parts = record.value.trim().split(/\s+/);
+			const [priority, weight, port, target] = parts.length === 4 ? parts : [
+				String(record.priority ?? ""),
+				parts[0],
+				parts[1],
+				parts[2]
+			];
+			return yield* fromRecord({
+				...common,
+				_tag: "SRV",
+				port: Number(port),
+				priority: Number(priority),
+				target,
+				weight: Number(weight)
+			});
+		}
+		default: return yield* decodeOpaque(record, name);
+	}
+}));
+const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => Schema.decodeUnknownEffect(Opaque)({
+	_tag: "Opaque",
+	name,
+	providerRecordId: record.id,
+	providerType: record.type
+}).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message))));
+function encode(zone, record) {
+	const common = {
+		name: relativeName(zone, record.name),
+		...record.ttl === null ? {} : { ttl: record.ttl },
+		type: record._tag
+	};
+	switch (record._tag) {
+		case "A":
+		case "AAAA": return {
+			...common,
+			value: record.address
+		};
+		case "CNAME":
+		case "NS": return {
+			...common,
+			value: record.target
+		};
+		case "TXT": return {
+			...common,
+			value: record.value
+		};
+		case "MX": return {
+			...common,
+			mxPriority: record.priority,
+			value: record.exchange
+		};
+		case "CAA": return {
+			...common,
+			value: `${record.flags} ${record.tag} "${escapeQuoted(record.value)}"`
+		};
+		case "SRV": return {
+			...common,
+			srv: {
+				port: record.port,
+				priority: record.priority,
+				target: record.target,
+				weight: record.weight
+			}
+		};
+	}
+}
+function absoluteNameCandidate(zone, name) {
+	return name === "" || name === "@" ? zone : name === zone || name.endsWith(`.${zone}`) ? name : `${name}.${zone}`;
+}
+function relativeName(zone, name) {
+	if (name === zone) return "";
+	const suffix = `.${zone}`;
+	if (!name.endsWith(suffix)) throw failure$2("encodeRecord", `DNS record ${name} is outside Vercel zone ${zone}`, { reason: "request" });
+	return name.slice(0, -suffix.length);
+}
+function escapeQuoted(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
+}
+function unescapeQuoted(value) {
+	return value.replace(/\\([\\"])/g, "$1");
+}
+function failure$2(operation, message, fields = {}) {
+	return new Error$3({
+		message,
+		operation,
+		providerId: "vercel",
+		reason: fields.reason ?? "response"
+	});
+}
+//#endregion
+//#region src/providers/vercel/client.ts
+var client_exports = /* @__PURE__ */ __exportAll({
+	discovery: () => discovery,
+	make: () => make$4
+});
+/** Exposes Vercel zone lookup as the optional provider discovery capability. */
+function discovery(client) {
+	return {
+		listZones: (name) => client.listZones({ name }),
+		provider: client
+	};
+}
+/** Creates an Effect-native Vercel client without owning the credential lifecycle. */
+function make$4(options) {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
+	const withContext = (path, values = {}) => {
+		const url = new URL(`${baseUrl}${path}`);
+		for (const [key, value] of Object.entries(values)) url.searchParams.set(key, value);
+		if (options.context._tag === "team") url.searchParams.set("teamId", options.context.teamId);
+		return url;
+	};
+	const request = Effect.fn("VercelClient.request")((url, operation, init) => Effect.gen(function* () {
+		const response = yield* Effect.tryPromise({
+			try: () => fetch(url, {
+				...init,
+				headers: {
+					Accept: "application/json",
+					Authorization: `Bearer ${options.token.expose()}`,
+					...init?.body === void 0 ? {} : { "Content-Type": "application/json" },
+					...init?.headers
+				}
+			}),
+			catch: () => failure$1(operation, "Vercel request failed", { reason: "transport" })
+		});
+		const body = yield* Effect.tryPromise({
+			try: () => response.json(),
+			catch: () => failure$1(operation, response.ok ? "Vercel returned a non-JSON response" : `Vercel request failed with HTTP ${response.status}`, {
+				reason: response.ok ? "response" : reason(response.status),
+				...rateLimit(response),
+				status: response.status
+			})
+		});
+		if (!response.ok) return yield* Effect.fail(apiFailure(body, operation, response));
+		return {
+			body,
+			response
+		};
+	}));
+	const allTeams = Effect.fn("VercelClient.allTeams")(() => Effect.gen(function* () {
+		const teams = [];
+		let until = null;
+		while (true) {
+			const url = new URL(`${baseUrl}/v2/teams`);
+			url.searchParams.set("limit", "100");
+			if (until !== null) url.searchParams.set("until", String(until));
+			const { body, response } = yield* request(url, "listAccounts");
+			const envelope = yield* decode(TeamListEnvelope, body, "listAccounts", response);
+			teams.push(...envelope.teams);
+			if (envelope.pagination.next === null) return teams;
+			until = envelope.pagination.next;
+		}
+	}));
+	const allDomains = Effect.fn("VercelClient.allDomains")(() => Effect.gen(function* () {
+		const domains = [];
+		let until = null;
+		while (true) {
+			const values = { limit: "100" };
+			if (until !== null) values.until = String(until);
+			const { body, response } = yield* request(withContext("/v5/domains", values), "listZones");
+			const envelope = yield* decode(DomainListEnvelope, body, "listZones", response);
+			domains.push(...envelope.domains);
+			if (envelope.pagination.next === null) return domains;
+			until = envelope.pagination.next;
+		}
+	}));
+	const discoverZone = Effect.fn("VercelClient.discoverZone")((name) => Effect.gen(function* () {
+		const configResult = yield* request(withContext(`/v6/domains/${encodeURIComponent(name)}/config`), "resolveZone");
+		const config = yield* decode(DomainConfig, configResult.body, "resolveZone", configResult.response);
+		const domainResult = yield* request(withContext(`/v5/domains/${encodeURIComponent(name)}`), "resolveZone");
+		const envelope = yield* decode(DomainEnvelope, domainResult.body, "resolveZone", domainResult.response);
+		if (!hasDnsStorage(envelope.domain, config.serviceType)) return null;
+		return envelope.domain;
+	}).pipe(Effect.catchTag("ProviderError", (cause) => cause.reason === "not_found" ? Effect.succeed(null) : Effect.fail(cause))));
+	const resolveZone = Effect.fn("VercelClient.resolveZone")((name) => Effect.gen(function* () {
+		const domain = yield* discoverZone(name);
+		if (domain === null) return yield* Effect.fail(failure$1("resolveZone", `Vercel zone ${name} is not configured for authoritative DNS in the selected account`, { reason: "not_found" }));
+		return yield* decode$8(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
+	}));
+	const listRecords = Effect.fn("VercelClient.listRecords")((zoneName) => Effect.gen(function* () {
+		const storageZone = yield* resolveZone(zoneName);
+		const records = [];
+		let until = null;
+		while (true) {
+			const values = { limit: "100" };
+			if (until !== null) values.until = String(until);
+			const { body, response } = yield* request(withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values), "listRecords");
+			const envelope = yield* decode(RecordListEnvelope, body, "listRecords", response);
+			records.push(...yield* Effect.forEach(envelope.records, (record) => decode$1(storageZone, record)));
+			const next = envelope.pagination?.next ?? null;
+			if (next === null) return records.filter((record) => record.name === zoneName || record.name.endsWith(`.${zoneName}`));
+			until = next;
+		}
+	}));
+	const createRecord = Effect.fn("VercelClient.createRecord")((zoneName, record) => Effect.gen(function* () {
+		const storageZone = yield* resolveZone(zoneName);
+		const body = yield* Effect.try({
+			try: () => encode(storageZone, record),
+			catch: (cause) => cause instanceof Error$3 ? cause : failure$1("createRecord", "Vercel record could not be encoded", { reason: "request" })
+		});
+		const result = yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`), "createRecord", {
+			body: JSON.stringify(body),
+			method: "POST"
+		});
+		return { providerRecordId: (yield* decode(CreateRecordEnvelope, result.body, "createRecord", result.response)).uid };
+	}));
+	const getRecord = Effect.fn("VercelClient.getRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
+		const storageZone = yield* resolveZone(zoneName);
+		let until = null;
+		while (true) {
+			const values = { limit: "100" };
+			if (until !== null) values.until = String(until);
+			const { body, response } = yield* request(withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values), "getRecord");
+			const envelope = yield* decode(RecordListEnvelope, body, "getRecord", response);
+			const record = envelope.records.find(({ id }) => id === providerRecordId);
+			if (record !== void 0) return yield* decode$1(storageZone, record);
+			const next = envelope.pagination?.next ?? null;
+			if (next === null) return null;
+			until = next;
+		}
+	}));
+	return {
+		id: "vercel",
+		createRecord,
+		deleteRecord: Effect.fn("VercelClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
+			const storageZone = yield* resolveZone(zoneName);
+			yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`), "deleteRecord", { method: "DELETE" });
+		})),
+		getRecord,
+		listAccounts: Effect.fn("VercelClient.listAccounts")(() => Effect.gen(function* () {
+			const userResult = yield* request(new URL(`${baseUrl}/v2/user`), "listAccounts");
+			const { user } = yield* decode(UserEnvelope, userResult.body, "listAccounts", userResult.response);
+			const teams = yield* allTeams();
+			return [{
+				id: user.id,
+				name: user.name ?? user.username,
+				type: "personal"
+			}, ...teams.map((team) => ({
+				id: team.id,
+				name: team.name ?? team.slug,
+				type: "team"
+			}))];
+		})),
+		listRecords,
+		listZones: Effect.fn("VercelClient.listZones")((input = {}) => Effect.gen(function* () {
+			const domains = (yield* allDomains()).filter((domain) => hasDnsStorage(domain) && (input.name === void 0 || domain.name === input.name));
+			if (domains.length > 0 || input.name === void 0) return yield* Effect.forEach(domains, projectZone);
+			const discovered = yield* discoverZone(input.name);
+			return discovered === null ? [] : [yield* projectZone(discovered)];
+		})),
+		validateToken: Effect.fn("VercelClient.validateToken")(() => Effect.gen(function* () {
+			let accountId;
+			if (options.context._tag === "team") {
+				yield* allDomains();
+				accountId = options.context.teamId;
+			} else {
+				const result = yield* request(new URL(`${baseUrl}/v2/user`), "validateToken");
+				const { user } = yield* decode(UserEnvelope, result.body, "validateToken", result.response);
+				accountId = user.id;
+			}
+			return {
+				accountId,
+				capabilities: options.capabilities,
+				expiresAt: null,
+				scopes: []
+			};
+		}))
+	};
+}
+function hasDnsStorage(domain, configuredServiceType = domain.serviceType) {
+	return configuredServiceType === "zeit.world" || domain.zone === true || domain.intendedNameservers.length > 0;
+}
+const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen(function* () {
+	const name = yield* decode$8(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$8(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
+	return {
+		accountId: domain.teamId ?? domain.userId,
+		id: domain.id,
+		name,
+		nameservers,
+		status: domain.verified ? "active" : "pending"
+	};
+}));
+function decode(schema, input, operation, response) {
+	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$1(operation, `Vercel response did not match its API contract: ${cause.message}`, {
+		reason: "response",
+		status: response.status
+	})));
+}
+function apiFailure(input, operation, response) {
+	const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
+	return failure$1(operation, detail._tag === "Some" ? detail.value.error.message : `Vercel request failed with HTTP ${response.status}`, {
+		...detail._tag === "Some" ? { code: detail.value.error.code } : {},
+		reason: reason(response.status, detail._tag === "Some" ? detail.value.error.code : void 0),
+		...rateLimit(response, detail._tag === "Some" ? detail.value.error : void 0),
+		status: response.status
+	});
+}
+function reason(status, code) {
+	if (status === 401 || code === "invalid_token") return "authentication";
+	if (status === 403) return "authorization";
+	if (status === 404 || code === "not_found") return "not_found";
+	if (status === 409 || code === "conflict") return "conflict";
+	if (status === 429 || code === "rate_limited") return "rate_limit";
+	if (status >= 500) return "response";
+	return "request";
+}
+function rateLimit(response, detail) {
+	const resetMs = detail?.limit?.resetMs;
+	const header = response.headers.get("x-ratelimit-reset");
+	const reset = resetMs ?? (header === null ? void 0 : Number(header) * 1e3);
+	return reset === void 0 || !Number.isFinite(reset) ? {} : { retryAfterMs: Math.max(0, reset - Date.now()) };
+}
+function failure$1(operation, message, fields = {}) {
+	return new Error$3({
+		...fields,
+		message,
+		operation,
+		providerId: "vercel"
+	});
+}
+//#endregion
+//#region src/providers/vercel/auth.ts
+var auth_exports = /* @__PURE__ */ __exportAll({
+	contextCodec: () => contextCodec,
+	exchangeCode: () => exchangeCode,
+	integrationAuthentication: () => integrationAuthentication,
+	integrationFlow: () => integrationFlow,
+	integrationMethod: () => integrationMethod,
+	manifest: () => manifest,
+	tokenConnectionMethod: () => tokenConnectionMethod,
+	tokenMethod: () => tokenMethod
+});
+const contextCodec = codec("vercel.v1", Schema.TaggedUnion({
+	personal: { installationId: Schema.NullOr(Schema.String) },
+	team: {
+		installationId: Schema.NullOr(Schema.String),
+		teamId: Schema.String
+	}
+}));
+/** Describes Vercel's caller-created personal access-token method. */
+function tokenMethod(capabilities) {
+	return {
+		_tag: "token",
+		capabilities: [...capabilities],
+		instructionsUrl: "https://vercel.com/account/settings/tokens"
+	};
+}
+/** Describes Vercel's provider-specific integration installation flow. */
+function integrationMethod(options) {
+	return {
+		_tag: "integration",
+		capabilities: [...options.capabilities],
+		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
+		tokenEndpoint: "https://api.vercel.com/oauth/access_token"
+	};
+}
+/** Creates the Vercel token and integration authorization manifest. */
+function manifest(options) {
+	return {
+		methods: [tokenMethod(options.capabilities), integrationMethod(options)],
+		providerId: "vercel"
+	};
+}
+/** Exchanges Vercel's one-time integration code and preserves its account context. */
+const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.gen(function* () {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
+	const body = new URLSearchParams({
+		client_id: options.clientId,
+		client_secret: options.clientSecret.expose(),
+		code: options.code.expose(),
+		redirect_uri: options.redirectUri
+	});
+	const response = yield* Effect.tryPromise({
+		try: () => fetch(`${baseUrl}/oauth/access_token`, {
+			body,
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			method: "POST"
+		}),
+		catch: () => failure("exchangeCode", "Vercel token exchange failed", "transport")
+	});
+	const input = yield* Effect.tryPromise({
+		try: () => response.json(),
+		catch: () => failure("exchangeCode", response.ok ? "Vercel returned a non-JSON token response" : `Vercel token exchange failed with HTTP ${response.status}`, response.ok ? "response" : response.status === 401 ? "authentication" : "request", response.status)
+	});
+	if (!response.ok) {
+		const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
+		return yield* Effect.fail(failure("exchangeCode", detail._tag === "Some" ? detail.value.error.message : `Vercel token exchange failed with HTTP ${response.status}`, response.status === 401 ? "authentication" : "request", response.status, detail._tag === "Some" ? detail.value.error.code : void 0));
+	}
+	const token = yield* Schema.decodeUnknownEffect(IntegrationToken)(input).pipe(Effect.mapError((cause) => failure("exchangeCode", `Vercel token response did not match its API contract: ${cause.message}`, "response", response.status)));
+	return {
+		accessToken: make$6(token.access_token),
+		context: token.team_id === null ? { _tag: "personal" } : {
+			_tag: "team",
+			teamId: token.team_id
+		},
+		installationId: token.installation_id ?? null,
+		userId: token.user_id
+	};
+}));
+/** Creates a provider-independent token connection method backed by Vercel validation. */
+function tokenConnectionMethod(options) {
+	const requiredCapabilities = [...options.capabilities];
+	return Method$1.Token({
+		authenticate: Effect.fn("VercelAuth.authenticateToken")(function* (token) {
+			const validated = yield* make$4({
+				...options,
+				token
+			}).validateToken();
+			const observedAt = new Date(yield* Clock.currentTimeMillis);
+			return {
+				capabilityEvidence: validated.capabilities.map((capability) => ({
+					capability,
+					evidence: Evidence$1.Introspected({ observedAt })
+				})),
+				credential: {
+					accessToken: token,
+					refreshToken: null,
+					tokenType: "bearer"
+				},
+				expiresAt: validated.expiresAt,
+				providerAccountId: validated.accountId,
+				providerContext: yield* contextCodec.encode(options.context._tag === "team" ? {
+					_tag: "team",
+					installationId: null,
+					teamId: options.context.teamId
+				} : {
+					_tag: "personal",
+					installationId: null
+				}),
+				scopes: [...validated.scopes]
+			};
+		}),
+		providerId: "vercel",
+		requiredCapabilities,
+		token: options.token
+	});
+}
+/** Converts a completed Vercel Integration exchange into canonical connection authentication. */
+const integrationAuthentication = Effect.fn("VercelAuth.integrationAuthentication")(function* (options) {
+	const exchanged = yield* exchangeCode(options);
+	const observedAt = new Date(yield* Clock.currentTimeMillis);
+	return {
+		capabilityEvidence: options.capabilities.map((capability) => ({
+			capability,
+			evidence: Evidence$1.Introspected({ observedAt })
+		})),
+		credential: {
+			accessToken: exchanged.accessToken,
+			refreshToken: null,
+			tokenType: "bearer"
+		},
+		expiresAt: null,
+		providerAccountId: exchanged.context._tag === "team" ? exchanged.context.teamId : exchanged.userId,
+		providerContext: yield* contextCodec.encode(exchanged.context._tag === "team" ? {
+			_tag: "team",
+			installationId: exchanged.installationId,
+			teamId: exchanged.context.teamId
+		} : {
+			_tag: "personal",
+			installationId: exchanged.installationId
+		}),
+		scopes: []
+	};
+});
+/** Creates Vercel Integration's implementation of the common interactive connection capability. */
+function integrationFlow(options) {
+	const method = integrationMethod(options);
+	const Payload = Schema.fromJsonString(Schema.Struct({ state: Schema.String }));
+	return {
+		complete: Effect.fn("VercelAuth.integrationFlow.complete")(function* (payload, callbackUrl) {
+			const continuation = yield* Schema.decodeUnknownEffect(Payload)(payload.expose()).pipe(Effect.mapError(() => new Error$1({
+				category: "authorization",
+				message: "Vercel Integration continuation payload is invalid",
+				operation: "VercelAuth.integrationFlow.complete",
+				retry: "after-user-action"
+			})));
+			const code = callbackUrl.searchParams.get("code");
+			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null) return yield* new Error$1({
+				category: "authorization",
+				message: "Vercel Integration callback does not match its continuation",
+				operation: "VercelAuth.integrationFlow.complete",
+				retry: "after-user-action"
+			});
+			return yield* integrationAuthentication({
+				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+				capabilities: options.capabilities,
+				clientId: options.clientId,
+				clientSecret: options.clientSecret,
+				code: make$6(code),
+				...options.fetch === void 0 ? {} : { fetch: options.fetch },
+				redirectUri: options.redirectUri
+			});
+		}),
+		method: "integration",
+		providerId: "vercel",
+		requiredCapabilities: [...options.capabilities],
+		start: (continuationId) => {
+			const authorizationUrl = new URL(method.installUrl);
+			authorizationUrl.searchParams.set("source", "external");
+			authorizationUrl.searchParams.set("state", continuationId);
+			return Effect.succeed({
+				authorizationUrl,
+				payload: make$6(JSON.stringify({ state: continuationId }))
+			});
+		}
+	};
+}
+function failure(operation, message, reason, status, code) {
+	return new Error$3({
+		...code === void 0 ? {} : { code },
+		message,
+		operation,
+		providerId: "vercel",
+		reason,
+		...status === void 0 ? {} : { status }
+	});
+}
+//#endregion
+//#region src/verification/dns-data.ts
+var dns_data_exports = /* @__PURE__ */ __exportAll({ parse: () => parse });
+const CanonicalAddress = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode: (value) => value.trim().toLowerCase(),
+	encode: (value) => value
+})));
+const CanonicalDomain = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
+	decode: (value, options) => Effect.try({
+		try: () => parse$1(value).toString(),
+		catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
+	}),
+	encode: (value) => Effect.succeed(value)
+})));
+const CanonicalMx = tokenizedDomain(2, 1);
+const CanonicalSrv = tokenizedDomain(4, 3);
+const CanonicalTxt = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode: (value) => {
+		const trimmed = value.trim();
+		const chunks = [...trimmed.matchAll(/"((?:\\.|[^"])*)"/g)];
+		return chunks.length === 0 ? trimmed : chunks.map((match) => (match[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")).join("");
+	},
+	encode: (value) => value
+})));
+const CanonicalCaa = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode: (value) => value.trim().replace(/\s+"([\s\S]*)"$/, " $1"),
+	encode: (value) => value
+})));
+function parse(type, input) {
+	const schema = (() => {
+		switch (type) {
+			case "A":
+			case "AAAA": return CanonicalAddress;
+			case "CNAME":
+			case "NS": return CanonicalDomain;
+			case "MX": return CanonicalMx;
+			case "SRV": return CanonicalSrv;
+			case "TXT": return CanonicalTxt;
+			case "CAA": return CanonicalCaa;
+		}
+	})();
+	try {
+		return Schema.decodeUnknownSync(schema)(input);
+	} catch (cause) {
+		throw new Error$2({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+}
+function tokenizedDomain(length, domainIndex) {
+	return Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
+		decode: (value, options) => Effect.try({
+			try: () => {
+				const parts = value.trim().split(/\s+/);
+				if (parts.length !== length) throw new Error("DNS record data has an invalid field count");
+				const domain = parts[domainIndex];
+				if (domain === void 0) throw new Error("DNS record target is missing");
+				parts[domainIndex] = parse$1(domain);
+				return parts.join(" ");
+			},
+			catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
+		}),
+		encode: (value) => Effect.succeed(value)
+	})));
+}
+//#endregion
+//#region src/verification/doh.ts
+var doh_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer$2,
+	make: () => make$3,
+	toAsync: () => toAsync$2
+});
+function make$3(options) {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	return { resolve: Effect.fn("DnsOverHttps.resolve")((query) => Effect.tryPromise({
+		try: (effectSignal) => request({
+			effectSignal,
+			fetch,
+			query,
+			timeoutMs,
+			endpoint: options.endpoint
+		}),
+		catch: (cause) => cause instanceof Error$4 ? cause : new Error$4({
+			cause,
+			message: cause instanceof Error ? cause.message : "DNS resolution failed",
+			reason: "transport"
+		})
+	}).pipe(Effect.flatMap((message) => decodeResolution(query, message)))) };
+}
+const layer$2 = (options) => Layer.succeed(Service$2, make$3(options));
+const toAsync$2 = (options) => toAsync$3(make$3(options));
+function decodeResolution(query, message) {
+	return Effect.try({
+		try: () => DnsPacket.decode(message),
+		catch: (cause) => new Error$4({
+			cause,
+			message: "DoH returned an invalid DNS message",
+			reason: "response"
+		})
+	}).pipe(Effect.flatMap((packet) => validatePacket(query, packet)), Effect.flatMap(decodePacket));
+}
+function decodePacket(packet) {
+	if (packet.rcode === "NXDOMAIN") return Effect.succeed({ _tag: "nodata" });
+	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$4({
+		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
+		reason: "response"
+	}));
+	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed({ _tag: "nodata" });
+	return Effect.forEach(packet.answers, decodeAnswer, { concurrency: "unbounded" }).pipe(Effect.map((answers) => {
+		const supportedAnswers = answers.filter((answer) => answer !== null);
+		return supportedAnswers.length === 0 ? { _tag: "nodata" } : {
+			_tag: "answer",
+			answers: supportedAnswers
+		};
+	}));
+}
+function validatePacket(query, packet) {
+	return Effect.try({
+		try: () => {
+			if (packet.type !== "response") throw new Error("DoH returned a DNS query");
+			if (packet.id !== 0) throw new Error("DoH response used an unexpected message ID");
+			if (packet.flag_tc) throw new Error("DoH returned a truncated DNS response");
+			const questions = packet.questions ?? [];
+			if (questions.length !== 1) throw new Error("DoH returned an unexpected question count");
+			const question = questions[0];
+			if (question === void 0) throw new Error("DoH response omitted the DNS question");
+			if (question.class !== "IN" || question.type !== query.type || parse$1(question.name) !== query.name) throw new Error("DoH response did not match the DNS question");
+			return packet;
+		},
+		catch: (cause) => new Error$4({
+			cause,
+			message: cause instanceof Error ? cause.message : "DoH returned an invalid DNS response",
+			reason: "response"
+		})
+	});
+}
+function decodeAnswer(answer) {
+	return Effect.gen(function* () {
+		if (answer.class !== "IN") return null;
+		const decoded = yield* Effect.try({
+			try: () => answerData(answer),
+			catch: (cause) => new Error$4({
+				cause,
+				message: "DoH returned invalid DNS record data",
+				reason: "response"
+			})
+		});
+		if (decoded === void 0) return null;
+		const name = yield* decode$8(answer.name);
+		const data = yield* Effect.try({
+			try: () => parse(decoded.type, decoded.data),
+			catch: (cause) => new Error$4({
+				cause,
+				message: "DoH returned invalid DNS record data",
+				reason: "response"
+			})
+		});
+		if (answer.ttl === void 0) return yield* new Error$4({
+			message: "DoH response omitted the DNS record TTL",
+			reason: "response"
+		});
+		return {
+			data,
+			name,
+			ttl: answer.ttl,
+			type: decoded.type
+		};
+	}).pipe(Effect.mapError((cause) => cause instanceof Error$4 ? cause : new Error$4({
+		cause,
+		message: cause.message,
+		reason: "response"
+	})));
+}
+function answerData(answer) {
+	switch (answer.type) {
+		case "A":
+		case "AAAA":
+		case "CNAME":
+		case "NS": return {
+			data: answer.data,
+			type: answer.type
+		};
+		case "CAA": return {
+			data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,
+			type: answer.type
+		};
+		case "MX": return {
+			data: `${requiredNumber(answer.data.preference, "MX preference")} ${answer.data.exchange}`,
+			type: answer.type
+		};
+		case "SRV": return {
+			data: [
+				requiredNumber(answer.data.priority, "SRV priority"),
+				requiredNumber(answer.data.weight, "SRV weight"),
+				requiredNumber(answer.data.port, "SRV port"),
+				answer.data.target
+			].join(" "),
+			type: answer.type
+		};
+		case "TXT": return {
+			data: decodeTxt(answer.data),
+			type: answer.type
+		};
+		default: return;
+	}
+}
+function decodeTxt(data) {
+	const encoded = (Array.isArray(data) ? data : [data]).map((chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
+	const length = encoded.reduce((total, chunk) => total + chunk.length, 0);
+	const joined = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of encoded) {
+		joined.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return new TextDecoder("utf-8", { fatal: true }).decode(joined);
+}
+function requiredNumber(value, field) {
+	if (value === void 0) throw new Error(`DoH response omitted ${field}`);
+	return value;
+}
+async function request(input) {
+	const controller = new AbortController();
+	let timedOut = false;
+	const abortFromEffect = () => controller.abort(input.effectSignal.reason);
+	const abortFromHost = () => controller.abort(input.query.signal?.reason);
+	input.effectSignal.addEventListener("abort", abortFromEffect, { once: true });
+	input.query.signal?.addEventListener("abort", abortFromHost, { once: true });
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort(/* @__PURE__ */ new Error("DNS resolution timed out"));
+	}, input.timeoutMs);
+	try {
+		const query = Uint8Array.from(DnsPacket.encode({
+			flags: DnsPacket.RECURSION_DESIRED,
+			id: 0,
+			questions: [{
+				name: input.query.name,
+				type: input.query.type
+			}],
+			type: "query"
+		}));
+		const response = await input.fetch(new URL(input.endpoint), {
+			body: query,
+			headers: {
+				accept: "application/dns-message",
+				"content-type": "application/dns-message"
+			},
+			method: "POST",
+			signal: controller.signal
+		});
+		if (!response.ok) throw new Error$4({
+			message: `DoH returned HTTP ${response.status}`,
+			reason: "transport"
+		});
+		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+		if (contentType !== "application/dns-message") throw new Error$4({
+			message: `DoH returned unsupported content type ${contentType ?? "<missing>"}`,
+			reason: "response"
+		});
+		return new Uint8Array(await response.arrayBuffer());
+	} catch (cause) {
+		if (timedOut) throw new Error$4({
+			message: "DNS query timed out",
+			reason: "timeout"
+		});
+		throw cause;
+	} finally {
+		clearTimeout(timer);
+		input.effectSignal.removeEventListener("abort", abortFromEffect);
+		input.query.signal?.removeEventListener("abort", abortFromHost);
+	}
+}
+//#endregion
+//#region src/verification/cloudflare-doh.ts
+var cloudflare_doh_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer$1,
+	make: () => make$2,
+	toAsync: () => toAsync$1
+});
+const endpoint$1 = "https://cloudflare-dns.com/dns-query";
+function make$2(options = {}) {
+	return make$3({
+		...options,
+		endpoint: options.endpoint ?? endpoint$1
+	});
+}
+const layer$1 = (options = {}) => Layer.succeed(Service$2, make$2(options));
+const toAsync$1 = (options = {}) => toAsync$3(make$2(options));
+//#endregion
+//#region src/verification/google-doh.ts
+var google_doh_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer,
+	make: () => make$1,
+	toAsync: () => toAsync
+});
+const endpoint = "https://dns.google/dns-query";
+function make$1(options = {}) {
+	return make$3({
+		...options,
+		endpoint: options.endpoint ?? endpoint
+	});
+}
+const layer = (options = {}) => Layer.succeed(Service$2, make$1(options));
+const toAsync = (options = {}) => toAsync$3(make$1(options));
+//#endregion
+//#region src/verification/resolver-pool.ts
+var resolver_pool_exports = /* @__PURE__ */ __exportAll({
+	Observation: () => Observation,
+	Policy: () => Policy,
+	Service: () => Service,
+	defaultLayer: () => defaultLayer,
+	defaultMake: () => defaultMake,
+	make: () => make
+});
+const Observation = Data.taggedEnum();
+const PolicyVariants = Data.taggedEnum();
+const QuorumMinimum = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));
+const PolicySchema = Schema.TaggedUnion({
+	AllMatch: {},
+	AnyMatch: {},
+	Quorum: { minimum: QuorumMinimum }
+});
+const Policy = {
+	AllMatch: PolicyVariants.AllMatch,
+	AnyMatch: PolicyVariants.AnyMatch,
+	Quorum: ({ minimum }) => PolicyVariants.Quorum({ minimum: Schema.decodeUnknownSync(QuorumMinimum)(minimum) }),
+	Schema: PolicySchema
+};
+var Service = class extends Context.Service()("@domainkit/DnsResolverPool") {};
+function make(entries) {
+	return Service.of({ observe: Effect.fn("DnsResolverPool.observe")((query) => Effect.forEach(entries, (entry) => observe$1(entry, query), { concurrency: "unbounded" })) });
+}
+/** Cloudflare and Google RFC wire-format DoH resolvers. */
+function defaultMake(options = {}) {
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	return make([{
+		id: "cloudflare",
+		resolver: make$2(options),
+		timeoutMs
+	}, {
+		id: "google",
+		resolver: make$1(options),
+		timeoutMs
+	}]);
+}
+const defaultLayer = (options = {}) => Layer.succeed(Service, defaultMake(options));
+function observe$1(entry, query) {
+	const timeoutMs = entry.timeoutMs ?? 5e3;
+	return entry.resolver.resolve(query).pipe(Effect.timeout(timeoutMs), Effect.match({
+		onFailure: (failure) => {
+			if (failure._tag === "TimeoutError" || failure._tag === "ResolverError" && failure.reason === "timeout") return Observation.TimedOut({
+				resolverId: entry.id,
+				timeoutMs
+			});
+			return Observation.Failed({
+				message: failure.message,
+				reason: failure.reason === "response" ? "response" : "transport",
+				resolverId: entry.id
+			});
+		},
+		onSuccess: (resolution) => resolution._tag === "nodata" ? Observation.NoData({ resolverId: entry.id }) : Observation.Answer({
+			answers: resolution.answers,
+			resolverId: entry.id
+		})
+	}));
+}
+//#endregion
+//#region src/verification/verify.ts
+var verify_exports = /* @__PURE__ */ __exportAll({
+	Provider: () => Provider,
+	ProviderObservation: () => ProviderObservation,
+	PublicDns: () => PublicDns,
+	PublicDnsObservation: () => PublicDnsObservation,
+	Result: () => Result,
+	observe: () => observe
+});
+const PublicDns = Data.taggedEnum();
+const Provider = Data.taggedEnum();
+const ProviderObservation = Data.taggedEnum();
+const PublicDnsObservation = Data.taggedEnum();
+const Result = Data.taggedEnum();
+function observe(input) {
+	return observeEffect(input);
+}
+const observeEffect = Effect.fn("Verification.observe")(function* (input) {
+	const publicDns = input.publicDns ?? PublicDns.Enabled({});
+	const provider = input.provider ?? Provider.Disabled();
+	const publicEffect = publicDns._tag === "Disabled" ? Effect.succeed(null) : observePublicDns(input.record, publicDns.policy ?? Policy.AnyMatch());
+	const providerEffect = provider._tag === "Disabled" ? Effect.succeed(null) : Effect.flatMap(Service$3, (service) => observeProvider(service, provider.zone, input.record).pipe(Effect.catch((failure) => Effect.succeed(ProviderObservation.Unavailable({ message: failure.message })))));
+	const [providerObservation, publicDnsObservation] = yield* Effect.all([providerEffect, publicEffect], { concurrency: "unbounded" });
+	return aggregate({
+		provider: providerObservation,
+		publicDns: publicDnsObservation
+	});
+});
+function observeProvider(provider, zone, requirement) {
+	return provider.listRecords(zone).pipe(Effect.map((records) => {
+		if (records.some((existing) => existing._tag !== "Opaque" && equals(existing, requirement))) return ProviderObservation.Matched();
+		const sameSet = records.filter((existing) => existing._tag !== "Opaque" && existing.name === requirement.name && existing._tag === requirement._tag);
+		return sameSet.length === 0 ? ProviderObservation.Pending() : ProviderObservation.Mismatch({ records: sameSet });
+	}));
+}
+function observePublicDns(requirement, policy) {
+	return Effect.gen(function* () {
+		const validatedPolicy = yield* Schema.decodeUnknownEffect(Policy.Schema)(policy).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })));
+		const configuredPool = yield* Effect.serviceOption(Service);
+		const evidence = yield* Option.getOrElse(configuredPool, () => defaultMake()).observe({
+			name: requirement.name,
+			type: requirement._tag
+		});
+		if (validatedPolicy._tag === "Quorum" && validatedPolicy.minimum > evidence.length) return yield* new Error$2({ message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers` });
+		return evaluatePublicDns(requirement, validatedPolicy, evidence);
+	});
+}
+function evaluatePublicDns(requirement, policy, evidence) {
+	const matchedResolverIds = evidence.flatMap((observation) => observation._tag === "Answer" && answersMatch(requirement, observation.answers) ? [observation.resolverId] : []);
+	const required = policy._tag === "AnyMatch" ? 1 : policy._tag === "AllMatch" ? evidence.length : policy.minimum;
+	if (required > 0 && matchedResolverIds.length >= required) return PublicDnsObservation.Verified({
+		evidence,
+		matchedResolverIds
+	});
+	const unavailable = evidence.filter((observation) => observation._tag === "TimedOut" || observation._tag === "Failed").length;
+	if (unavailable > 0 && matchedResolverIds.length + unavailable >= required) return PublicDnsObservation.Unavailable({ evidence });
+	if (evidence.some((observation) => observation._tag === "Answer" && !answersMatch(requirement, observation.answers))) return PublicDnsObservation.Mismatch({ evidence });
+	if (evidence.some((observation) => observation._tag === "NoData")) return PublicDnsObservation.Pending({ evidence });
+	return PublicDnsObservation.Unavailable({ evidence });
+}
+function answersMatch(requirement, answers) {
+	const expected = parse(requirement._tag, recordValue(requirement));
+	return answers.some((answer) => answer.name === requirement.name && answer.type === requirement._tag && parse(requirement._tag, answer.data) === expected);
+}
+function aggregate(evidence) {
+	const requested = [evidence.provider, evidence.publicDns].filter((observation) => observation !== null);
+	if (requested.length === 0) return Result.NotObserved(evidence);
+	if (requested.every((observation) => observation._tag === "Matched" || observation._tag === "Verified")) return Result.Verified(evidence);
+	if (requested.some((observation) => observation._tag === "Unavailable")) return Result.Unavailable(evidence);
+	if (requested.some((observation) => observation._tag === "Mismatch")) return Result.Mismatch(evidence);
+	return Result.Pending(evidence);
+}
+function recordValue(requirement) {
+	const data$1 = data(requirement);
+	switch (requirement._tag) {
+		case "A":
+		case "AAAA": return String(data$1.address);
+		case "CNAME":
+		case "NS": return String(data$1.target);
+		case "TXT": return String(data$1.value);
+		case "MX": return `${data$1.priority} ${data$1.exchange}`;
+		case "CAA": return `${data$1.flags} ${data$1.tag} ${data$1.value}`;
+		case "SRV": return `${data$1.priority} ${data$1.weight} ${data$1.port} ${data$1.target}`;
+	}
+}
+//#endregion
+export { RemoveDomainResult as $, make$4 as A, discovery$1 as B, integrationFlow as C, encode$3 as Ct, tokenMethod as D, tokenConnectionMethod as E, subjectResolver as F, secret_exports as G, authorize as H, tokenConnectionMethod$1 as I, decode$4 as J, Method as K, tokenMethod$1 as L, manifest$1 as M, oauthFlow as N, client_exports as O, oauthMethod as P, Method$1 as Q, tokenValidator as R, exchangeCode as S, decode$6 as St, manifest as T, version as Tt, connection_authorization_exports as U, make$5 as V, selection_exports as W, diagnostic_exports as X, manifest_exports as Y, Error$1 as Z, toAsync$1 as _, CapabilityEvidence as _t, Result as a, AuthorizationError as at, dns_data_exports as b, Schema$3 as bt, Observation as c, assertGrant as ct, defaultMake as d, decode$5 as dt, StartResult as et, make as f, encode$2 as ft, cloudflare_doh_exports as g, Capability as gt, toAsync as h, validate as ht, PublicDnsObservation as i, start$1 as it, auth_exports$1 as j, discovery as k, Policy as l, authorizationError as lt, google_doh_exports as m, removeDomain$1 as mt, ProviderObservation as n, extend as nt, observe as o, Grant as ot, resolver_pool_exports as p, includeDomains as pt, Schema$1 as q, PublicDns as r, removeDomain as rt, verify_exports as s, Schema$2 as st, Provider as t, complete$1 as tt, Service as u, coversDomain as ut, doh_exports as v, Evidence$1 as vt, integrationMethod as w, provider_context_exports as wt, auth_exports as x, authorization_exports as xt, toAsync$2 as y, EvidenceSchema as yt, client_exports$1 as z };
+
+//# sourceMappingURL=verify-B00c81-n.mjs.map