domainkit 0.2.2 → 0.3.1

package/dist/verify-BKbvq7IN.mjs

@@ -1,642 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { E as decode$1, O as parse$1, T as Schema$2, _ as equals, b as Service$1, k as Error$1, m as data } from "./dns-record-BLeqo56C.mjs";
-import { t as candidates } from "./zones-DKHTpX9C.mjs";
-import { a as authorizationError, i as assertGrant, t as AuthorizationError } from "./connection-CjNQe_E-.mjs";
-import { i as toAsync$3, n as Service$2, t as Error$2, x as authorize$1 } from "./resolver-CxE-VDw4.mjs";
-import { Context, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
-import * as DnsPacket from "@leichtgewicht/dns-packet";
-//#region package.json
-var version = "0.2.2";
-//#endregion
-//#region src/auth/diagnostic.ts
-var diagnostic_exports = /* @__PURE__ */ __exportAll({
-	Category: () => Category,
-	Fields: () => Fields,
-	RetryAdvice: () => RetryAdvice,
-	from: () => from
-});
-const Category = Schema.Literals([
-	"authorization",
-	"configuration",
-	"provider",
-	"storage",
-	"validation"
-]);
-const RetryAdvice = Schema.Literals([
-	"never",
-	"after-user-action",
-	"safe",
-	"unknown"
-]);
-const Fields = {
-	category: Category,
-	message: Schema.String,
-	operation: Schema.String,
-	retry: RetryAdvice
-};
-function from(error) {
-	return {
-		category: error.category,
-		message: error.message,
-		operation: error.operation,
-		retry: error.retry,
-		tag: error._tag
-	};
-}
-//#endregion
-//#region src/auth/manifest.ts
-var manifest_exports = /* @__PURE__ */ __exportAll({
-	Method: () => Method,
-	Schema: () => Schema$1,
-	decode: () => decode
-});
-const Method = Schema.TaggedUnion({
-	integration: {
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		installUrl: Schema.String,
-		tokenEndpoint: Schema.String
-	},
-	oauth2: {
-		authorizationServer: Schema.Struct({
-			authorization_endpoint: Schema.String,
-			issuer: Schema.String,
-			revocation_endpoint: Schema.optionalKey(Schema.String),
-			token_endpoint: Schema.String
-		}),
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		clientAuth: Schema.Literals([
-			"none",
-			"client_secret_basic",
-			"client_secret_post"
-		]),
-		scopes: Schema.Array(Schema.String)
-	},
-	token: {
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		instructionsUrl: Schema.String
-	}
-});
-const Schema$1 = Schema.Struct({
-	methods: Schema.Array(Method),
-	providerId: Schema.String
-});
-const decode = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
-//#endregion
-//#region src/discovery/selection.ts
-var selection_exports = /* @__PURE__ */ __exportAll({
-	Evidence: () => Evidence,
-	Selection: () => Selection,
-	select: () => select
-});
-const Evidence = Schema.Struct({
-	accountId: Schema.String,
-	connectionId: Schema.String,
-	decisiveNameserverMatch: Schema.Boolean,
-	matchedNameservers: Schema.Array(Schema$2),
-	providerId: Schema.String,
-	zone: Schema$2
-});
-const Selection = Schema.TaggedUnion({
-	selected: {
-		candidate: Evidence,
-		evidence: Schema.Array(Evidence),
-		reason: Schema.Literals(["explicit", "unique-nameserver-match"])
-	},
-	manual: {
-		evidence: Schema.Array(Evidence),
-		reason: Schema.Literals(["ambiguous", "unsupported"])
-	}
-});
-function select(input) {
-	const domain = parse$1(input.domain);
-	const zoneCandidates = new Set(candidates(domain));
-	const authoritative = nameserverSet(input.authoritativeNameservers);
-	const eligible = input.connectedZones.filter((connected) => {
-		if (!zoneCandidates.has(parse$1(connected.zone))) return false;
-		try {
-			assertGrant(connected.connection, connected.authorization, {
-				capability: "dns:read",
-				domain,
-				...input.now === void 0 ? {} : { now: input.now },
-				providerId: connected.providerId
-			});
-			return true;
-		} catch {
-			return false;
-		}
-	});
-	const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));
-	if (input.explicit !== void 0) {
-		const explicitZone = parse$1(input.explicit.zone);
-		const index = eligible.findIndex((connected) => connected.providerId === input.explicit?.providerId && connected.authorization.providerAccountId === input.explicit.accountId && parse$1(connected.zone) === explicitZone);
-		if (index < 0) throw authorizationError("Explicit provider zone is not connected or granted", "ProviderDiscovery.select");
-		const candidate = evidence[index];
-		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
-		return {
-			_tag: "selected",
-			candidate,
-			evidence,
-			reason: "explicit"
-		};
-	}
-	const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);
-	const candidate = decisive[0];
-	return decisive.length === 1 && candidate !== void 0 ? {
-		_tag: "selected",
-		candidate,
-		evidence,
-		reason: "unique-nameserver-match"
-	} : {
-		_tag: "manual",
-		evidence,
-		reason: decisive.length > 1 ? "ambiguous" : "unsupported"
-	};
-}
-function evidenceFor(connected, authoritative) {
-	const configured = new Set(nameserverSet(connected.nameservers));
-	const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));
-	return {
-		accountId: connected.authorization.providerAccountId,
-		connectionId: connected.connection.id,
-		decisiveNameserverMatch: authoritative.length > 0 && matchedNameservers.length === authoritative.length,
-		matchedNameservers,
-		providerId: connected.providerId,
-		zone: parse$1(connected.zone)
-	};
-}
-function nameserverSet(nameservers) {
-	return [...new Set(nameservers.map(parse$1))].sort();
-}
-//#endregion
-//#region src/plan/connection-authorization.ts
-var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize });
-const authorize = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
-	const domain = yield* Effect.try({
-		try: () => assertGrant(input.connection, input.authorization, {
-			capability: "dns:write",
-			domain: input.domain,
-			providerId: input.plan.providerId
-		}),
-		catch: (cause) => cause instanceof AuthorizationError || cause instanceof Error$1 ? cause : authorizationError("Connection grant is invalid", "ConnectionAuthorization.authorize")
-	});
-	const authorization = yield* authorize$1(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
-	const selected = new Set(authorization.operationIds);
-	if (input.plan.operations.filter((operation) => operation._tag === "create" && selected.has(operation.id) && operation.requirement.name !== domain && !operation.requirement.name.endsWith(`.${domain}`)).length > 0) return yield* authorizationError(`Plan operations are outside the granted domain ${domain}`, "ConnectionAuthorization.authorize");
-	return authorization;
-});
-//#endregion
-//#region src/verification/dns-data.ts
-var dns_data_exports = /* @__PURE__ */ __exportAll({ parse: () => parse });
-const CanonicalAddress = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => value.trim().toLowerCase(),
-	encode: (value) => value
-})));
-const CanonicalDomain = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
-	decode: (value, options) => Effect.try({
-		try: () => parse$1(value).toString(),
-		catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
-	}),
-	encode: (value) => Effect.succeed(value)
-})));
-const CanonicalMx = tokenizedDomain(2, 1);
-const CanonicalSrv = tokenizedDomain(4, 3);
-const CanonicalTxt = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => {
-		const trimmed = value.trim();
-		const chunks = [...trimmed.matchAll(/"((?:\\.|[^"])*)"/g)];
-		return chunks.length === 0 ? trimmed : chunks.map((match) => (match[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")).join("");
-	},
-	encode: (value) => value
-})));
-const CanonicalCaa = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => value.trim().replace(/\s+"([\s\S]*)"$/, " $1"),
-	encode: (value) => value
-})));
-function parse(type, input) {
-	const schema = (() => {
-		switch (type) {
-			case "A":
-			case "AAAA": return CanonicalAddress;
-			case "CNAME":
-			case "NS": return CanonicalDomain;
-			case "MX": return CanonicalMx;
-			case "SRV": return CanonicalSrv;
-			case "TXT": return CanonicalTxt;
-			case "CAA": return CanonicalCaa;
-		}
-	})();
-	try {
-		return Schema.decodeUnknownSync(schema)(input);
-	} catch (cause) {
-		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
-	}
-}
-function tokenizedDomain(length, domainIndex) {
-	return Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
-		decode: (value, options) => Effect.try({
-			try: () => {
-				const parts = value.trim().split(/\s+/);
-				if (parts.length !== length) throw new Error("DNS record data has an invalid field count");
-				const domain = parts[domainIndex];
-				if (domain === void 0) throw new Error("DNS record target is missing");
-				parts[domainIndex] = parse$1(domain);
-				return parts.join(" ");
-			},
-			catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
-		}),
-		encode: (value) => Effect.succeed(value)
-	})));
-}
-//#endregion
-//#region src/verification/doh.ts
-var doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$2,
-	make: () => make$3,
-	toAsync: () => toAsync$2
-});
-function make$3(options) {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const timeoutMs = options.timeoutMs ?? 5e3;
-	return { resolve: Effect.fn("DnsOverHttps.resolve")((query) => Effect.tryPromise({
-		try: (effectSignal) => request({
-			effectSignal,
-			fetch,
-			query,
-			timeoutMs,
-			endpoint: options.endpoint
-		}),
-		catch: (cause) => cause instanceof Error$2 ? cause : new Error$2({
-			cause,
-			message: cause instanceof Error ? cause.message : "DNS resolution failed",
-			reason: "transport"
-		})
-	}).pipe(Effect.flatMap((message) => decodeResolution(query, message)))) };
-}
-const layer$2 = (options) => Layer.succeed(Service$2, make$3(options));
-const toAsync$2 = (options) => toAsync$3(make$3(options));
-function decodeResolution(query, message) {
-	return Effect.try({
-		try: () => DnsPacket.decode(message),
-		catch: (cause) => new Error$2({
-			cause,
-			message: "DoH returned an invalid DNS message",
-			reason: "response"
-		})
-	}).pipe(Effect.flatMap((packet) => validatePacket(query, packet)), Effect.flatMap(decodePacket));
-}
-function decodePacket(packet) {
-	if (packet.rcode === "NXDOMAIN") return Effect.succeed({ _tag: "nodata" });
-	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$2({
-		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
-		reason: "response"
-	}));
-	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed({ _tag: "nodata" });
-	return Effect.forEach(packet.answers, decodeAnswer, { concurrency: "unbounded" }).pipe(Effect.map((answers) => {
-		const supportedAnswers = answers.filter((answer) => answer !== null);
-		return supportedAnswers.length === 0 ? { _tag: "nodata" } : {
-			_tag: "answer",
-			answers: supportedAnswers
-		};
-	}));
-}
-function validatePacket(query, packet) {
-	return Effect.try({
-		try: () => {
-			if (packet.type !== "response") throw new Error("DoH returned a DNS query");
-			if (packet.id !== 0) throw new Error("DoH response used an unexpected message ID");
-			if (packet.flag_tc) throw new Error("DoH returned a truncated DNS response");
-			const questions = packet.questions ?? [];
-			if (questions.length !== 1) throw new Error("DoH returned an unexpected question count");
-			const question = questions[0];
-			if (question === void 0) throw new Error("DoH response omitted the DNS question");
-			if (question.class !== "IN" || question.type !== query.type || parse$1(question.name) !== query.name) throw new Error("DoH response did not match the DNS question");
-			return packet;
-		},
-		catch: (cause) => new Error$2({
-			cause,
-			message: cause instanceof Error ? cause.message : "DoH returned an invalid DNS response",
-			reason: "response"
-		})
-	});
-}
-function decodeAnswer(answer) {
-	return Effect.gen(function* () {
-		if (answer.class !== "IN") return null;
-		const decoded = yield* Effect.try({
-			try: () => answerData(answer),
-			catch: (cause) => new Error$2({
-				cause,
-				message: "DoH returned invalid DNS record data",
-				reason: "response"
-			})
-		});
-		if (decoded === void 0) return null;
-		const name = yield* decode$1(answer.name);
-		const data = yield* Effect.try({
-			try: () => parse(decoded.type, decoded.data),
-			catch: (cause) => new Error$2({
-				cause,
-				message: "DoH returned invalid DNS record data",
-				reason: "response"
-			})
-		});
-		if (answer.ttl === void 0) return yield* new Error$2({
-			message: "DoH response omitted the DNS record TTL",
-			reason: "response"
-		});
-		return {
-			data,
-			name,
-			ttl: answer.ttl,
-			type: decoded.type
-		};
-	}).pipe(Effect.mapError((cause) => cause instanceof Error$2 ? cause : new Error$2({
-		cause,
-		message: cause.message,
-		reason: "response"
-	})));
-}
-function answerData(answer) {
-	switch (answer.type) {
-		case "A":
-		case "AAAA":
-		case "CNAME":
-		case "NS": return {
-			data: answer.data,
-			type: answer.type
-		};
-		case "CAA": return {
-			data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,
-			type: answer.type
-		};
-		case "MX": return {
-			data: `${requiredNumber(answer.data.preference, "MX preference")} ${answer.data.exchange}`,
-			type: answer.type
-		};
-		case "SRV": return {
-			data: [
-				requiredNumber(answer.data.priority, "SRV priority"),
-				requiredNumber(answer.data.weight, "SRV weight"),
-				requiredNumber(answer.data.port, "SRV port"),
-				answer.data.target
-			].join(" "),
-			type: answer.type
-		};
-		case "TXT": return {
-			data: decodeTxt(answer.data),
-			type: answer.type
-		};
-		default: return;
-	}
-}
-function decodeTxt(data) {
-	const encoded = (Array.isArray(data) ? data : [data]).map((chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
-	const length = encoded.reduce((total, chunk) => total + chunk.length, 0);
-	const joined = new Uint8Array(length);
-	let offset = 0;
-	for (const chunk of encoded) {
-		joined.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return new TextDecoder("utf-8", { fatal: true }).decode(joined);
-}
-function requiredNumber(value, field) {
-	if (value === void 0) throw new Error(`DoH response omitted ${field}`);
-	return value;
-}
-async function request(input) {
-	const controller = new AbortController();
-	let timedOut = false;
-	const abortFromEffect = () => controller.abort(input.effectSignal.reason);
-	const abortFromHost = () => controller.abort(input.query.signal?.reason);
-	input.effectSignal.addEventListener("abort", abortFromEffect, { once: true });
-	input.query.signal?.addEventListener("abort", abortFromHost, { once: true });
-	const timer = setTimeout(() => {
-		timedOut = true;
-		controller.abort(/* @__PURE__ */ new Error("DNS resolution timed out"));
-	}, input.timeoutMs);
-	try {
-		const query = Uint8Array.from(DnsPacket.encode({
-			flags: DnsPacket.RECURSION_DESIRED,
-			id: 0,
-			questions: [{
-				name: input.query.name,
-				type: input.query.type
-			}],
-			type: "query"
-		}));
-		const response = await input.fetch(new URL(input.endpoint), {
-			body: query,
-			headers: {
-				accept: "application/dns-message",
-				"content-type": "application/dns-message"
-			},
-			method: "POST",
-			signal: controller.signal
-		});
-		if (!response.ok) throw new Error$2({
-			message: `DoH returned HTTP ${response.status}`,
-			reason: "transport"
-		});
-		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-		if (contentType !== "application/dns-message") throw new Error$2({
-			message: `DoH returned unsupported content type ${contentType ?? "<missing>"}`,
-			reason: "response"
-		});
-		return new Uint8Array(await response.arrayBuffer());
-	} catch (cause) {
-		if (timedOut) throw new Error$2({
-			message: "DNS query timed out",
-			reason: "timeout"
-		});
-		throw cause;
-	} finally {
-		clearTimeout(timer);
-		input.effectSignal.removeEventListener("abort", abortFromEffect);
-		input.query.signal?.removeEventListener("abort", abortFromHost);
-	}
-}
-//#endregion
-//#region src/verification/cloudflare-doh.ts
-var cloudflare_doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$1,
-	make: () => make$2,
-	toAsync: () => toAsync$1
-});
-const endpoint$1 = "https://cloudflare-dns.com/dns-query";
-function make$2(options = {}) {
-	return make$3({
-		...options,
-		endpoint: options.endpoint ?? endpoint$1
-	});
-}
-const layer$1 = (options = {}) => Layer.succeed(Service$2, make$2(options));
-const toAsync$1 = (options = {}) => toAsync$3(make$2(options));
-//#endregion
-//#region src/verification/google-doh.ts
-var google_doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer,
-	make: () => make$1,
-	toAsync: () => toAsync
-});
-const endpoint = "https://dns.google/dns-query";
-function make$1(options = {}) {
-	return make$3({
-		...options,
-		endpoint: options.endpoint ?? endpoint
-	});
-}
-const layer = (options = {}) => Layer.succeed(Service$2, make$1(options));
-const toAsync = (options = {}) => toAsync$3(make$1(options));
-//#endregion
-//#region src/verification/resolver-pool.ts
-var resolver_pool_exports = /* @__PURE__ */ __exportAll({
-	Observation: () => Observation,
-	Policy: () => Policy,
-	Service: () => Service,
-	defaultLayer: () => defaultLayer,
-	defaultMake: () => defaultMake,
-	make: () => make
-});
-const Observation = Data.taggedEnum();
-const PolicyVariants = Data.taggedEnum();
-const QuorumMinimum = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));
-const PolicySchema = Schema.TaggedUnion({
-	AllMatch: {},
-	AnyMatch: {},
-	Quorum: { minimum: QuorumMinimum }
-});
-const Policy = {
-	AllMatch: PolicyVariants.AllMatch,
-	AnyMatch: PolicyVariants.AnyMatch,
-	Quorum: ({ minimum }) => PolicyVariants.Quorum({ minimum: Schema.decodeUnknownSync(QuorumMinimum)(minimum) }),
-	Schema: PolicySchema
-};
-var Service = class extends Context.Service()("@domainkit/DnsResolverPool") {};
-function make(entries) {
-	return Service.of({ observe: Effect.fn("DnsResolverPool.observe")((query) => Effect.forEach(entries, (entry) => observe$1(entry, query), { concurrency: "unbounded" })) });
-}
-/** Cloudflare and Google RFC wire-format DoH resolvers. */
-function defaultMake(options = {}) {
-	const timeoutMs = options.timeoutMs ?? 5e3;
-	return make([{
-		id: "cloudflare",
-		resolver: make$2(options),
-		timeoutMs
-	}, {
-		id: "google",
-		resolver: make$1(options),
-		timeoutMs
-	}]);
-}
-const defaultLayer = (options = {}) => Layer.succeed(Service, defaultMake(options));
-function observe$1(entry, query) {
-	const timeoutMs = entry.timeoutMs ?? 5e3;
-	return entry.resolver.resolve(query).pipe(Effect.timeout(timeoutMs), Effect.match({
-		onFailure: (failure) => {
-			if (failure._tag === "TimeoutError" || failure._tag === "ResolverError" && failure.reason === "timeout") return Observation.TimedOut({
-				resolverId: entry.id,
-				timeoutMs
-			});
-			return Observation.Failed({
-				message: failure.message,
-				reason: failure.reason === "response" ? "response" : "transport",
-				resolverId: entry.id
-			});
-		},
-		onSuccess: (resolution) => resolution._tag === "nodata" ? Observation.NoData({ resolverId: entry.id }) : Observation.Answer({
-			answers: resolution.answers,
-			resolverId: entry.id
-		})
-	}));
-}
-//#endregion
-//#region src/verification/verify.ts
-var verify_exports = /* @__PURE__ */ __exportAll({
-	Provider: () => Provider,
-	ProviderObservation: () => ProviderObservation,
-	PublicDns: () => PublicDns,
-	PublicDnsObservation: () => PublicDnsObservation,
-	Result: () => Result,
-	observe: () => observe
-});
-const PublicDns = Data.taggedEnum();
-const Provider = Data.taggedEnum();
-const ProviderObservation = Data.taggedEnum();
-const PublicDnsObservation = Data.taggedEnum();
-const Result = Data.taggedEnum();
-function observe(input) {
-	return observeEffect(input);
-}
-const observeEffect = Effect.fn("Verification.observe")(function* (input) {
-	const publicDns = input.publicDns ?? PublicDns.Enabled({});
-	const provider = input.provider ?? Provider.Disabled();
-	const publicEffect = publicDns._tag === "Disabled" ? Effect.succeed(null) : observePublicDns(input.record, publicDns.policy ?? Policy.AnyMatch());
-	const providerEffect = provider._tag === "Disabled" ? Effect.succeed(null) : Effect.flatMap(Service$1, (service) => observeProvider(service, provider.zone, input.record).pipe(Effect.catch((failure) => Effect.succeed(ProviderObservation.Unavailable({ message: failure.message })))));
-	const [providerObservation, publicDnsObservation] = yield* Effect.all([providerEffect, publicEffect], { concurrency: "unbounded" });
-	return aggregate({
-		provider: providerObservation,
-		publicDns: publicDnsObservation
-	});
-});
-function observeProvider(provider, zone, requirement) {
-	return provider.listRecords(zone).pipe(Effect.map((records) => {
-		if (records.some((existing) => existing._tag !== "Opaque" && equals(existing, requirement))) return ProviderObservation.Matched();
-		const sameSet = records.filter((existing) => existing._tag !== "Opaque" && existing.name === requirement.name && existing._tag === requirement._tag);
-		return sameSet.length === 0 ? ProviderObservation.Pending() : ProviderObservation.Mismatch({ records: sameSet });
-	}));
-}
-function observePublicDns(requirement, policy) {
-	return Effect.gen(function* () {
-		const validatedPolicy = yield* Schema.decodeUnknownEffect(Policy.Schema)(policy).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message })));
-		const configuredPool = yield* Effect.serviceOption(Service);
-		const evidence = yield* Option.getOrElse(configuredPool, () => defaultMake()).observe({
-			name: requirement.name,
-			type: requirement._tag
-		});
-		if (validatedPolicy._tag === "Quorum" && validatedPolicy.minimum > evidence.length) return yield* new Error$1({ message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers` });
-		return evaluatePublicDns(requirement, validatedPolicy, evidence);
-	});
-}
-function evaluatePublicDns(requirement, policy, evidence) {
-	const matchedResolverIds = evidence.flatMap((observation) => observation._tag === "Answer" && answersMatch(requirement, observation.answers) ? [observation.resolverId] : []);
-	const required = policy._tag === "AnyMatch" ? 1 : policy._tag === "AllMatch" ? evidence.length : policy.minimum;
-	if (required > 0 && matchedResolverIds.length >= required) return PublicDnsObservation.Verified({
-		evidence,
-		matchedResolverIds
-	});
-	const unavailable = evidence.filter((observation) => observation._tag === "TimedOut" || observation._tag === "Failed").length;
-	if (unavailable > 0 && matchedResolverIds.length + unavailable >= required) return PublicDnsObservation.Unavailable({ evidence });
-	if (evidence.some((observation) => observation._tag === "Answer" && !answersMatch(requirement, observation.answers))) return PublicDnsObservation.Mismatch({ evidence });
-	if (evidence.some((observation) => observation._tag === "NoData")) return PublicDnsObservation.Pending({ evidence });
-	return PublicDnsObservation.Unavailable({ evidence });
-}
-function answersMatch(requirement, answers) {
-	const expected = parse(requirement._tag, recordValue(requirement));
-	return answers.some((answer) => answer.name === requirement.name && answer.type === requirement._tag && parse(requirement._tag, answer.data) === expected);
-}
-function aggregate(evidence) {
-	const requested = [evidence.provider, evidence.publicDns].filter((observation) => observation !== null);
-	if (requested.length === 0) return Result.NotObserved(evidence);
-	if (requested.every((observation) => observation._tag === "Matched" || observation._tag === "Verified")) return Result.Verified(evidence);
-	if (requested.some((observation) => observation._tag === "Unavailable")) return Result.Unavailable(evidence);
-	if (requested.some((observation) => observation._tag === "Mismatch")) return Result.Mismatch(evidence);
-	return Result.Pending(evidence);
-}
-function recordValue(requirement) {
-	const data$1 = data(requirement);
-	switch (requirement._tag) {
-		case "A":
-		case "AAAA": return String(data$1.address);
-		case "CNAME":
-		case "NS": return String(data$1.target);
-		case "TXT": return String(data$1.value);
-		case "MX": return `${data$1.priority} ${data$1.exchange}`;
-		case "CAA": return `${data$1.flags} ${data$1.tag} ${data$1.value}`;
-		case "SRV": return `${data$1.priority} ${data$1.weight} ${data$1.port} ${data$1.target}`;
-	}
-}
-//#endregion
-export { selection_exports as C, manifest_exports as D, decode as E, diagnostic_exports as O, connection_authorization_exports as S, Schema$1 as T, toAsync$1 as _, Result as a, dns_data_exports as b, Observation as c, defaultMake as d, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, version as k, Policy as l, google_doh_exports as m, ProviderObservation as n, observe as o, resolver_pool_exports as p, PublicDns as r, verify_exports as s, Provider as t, Service as u, doh_exports as v, Method as w, authorize as x, toAsync$2 as y };
-
-//# sourceMappingURL=verify-BKbvq7IN.mjs.map