domainkit 0.7.0 → 0.8.0

package/dist/{verify-DDnK8U7C.mjs → verify-DvGPb5C9.mjs}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { A as Error$1, D as decode$5, E as Schema$2, b as assertAttachment, c as Evidence$1, d as codec, k as parse$1, p as AuthorizationError, s as Service$1, x as authorizationError } from "./canonical-json-CQYKsZw7.mjs";
 import { n as Method$1, t as Error$2 } from "./connect-oI8hcMxc.mjs";
-import { C as authorize$1, I as Error$3, L as Service$3, R as fromAsync$1, V as toAsync$4, Y as Opaque, i as Service$2, it as equals, n as Error$4, nt as decode$6, o as toAsync$5, r as Resolution$1, tt as data, ut as candidates } from "./resolver-DPJs8h0a.mjs";
+import { C as authorize$1, I as Error$3, L as Service$3, R as fromAsync$1, V as toAsync$4, Y as Opaque, i as Service$2, it as equals, n as Error$4, nt as decode$6, o as toAsync$5, r as Resolution$1, tt as data, ut as candidates } from "./resolver-BeGz1ukw.mjs";
 import { Clock, Context, Crypto, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
 import * as oauth from "oauth4webapi";
 import * as DnsPacket from "@leichtgewicht/dns-packet";
 //#region package.json
-var version = "0.7.0";
+var version = "0.8.0";
 //#endregion
 //#region src/auth/diagnostic.ts
 var diagnostic_exports = /* @__PURE__ */ __exportAll({
@@ -50,7 +50,7 @@ var manifest_exports = /* @__PURE__ */ __exportAll({
 	Schema: () => Schema$1,
 	decode: () => decode$4
 });
-const Method = Schema.TaggedUnion({
+const MethodSchema = Schema.TaggedUnion({
 	integration: {
 		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
 		installUrl: Schema.String,
@@ -76,8 +76,15 @@ const Method = Schema.TaggedUnion({
 		instructionsUrl: Schema.String
 	}
 });
+/** Provider authentication method schema and constructors for trusted manifests. */
+const Method = {
+	Schema: MethodSchema,
+	integration: (input) => MethodSchema.cases.integration.make(input),
+	oauth2: (input) => MethodSchema.cases.oauth2.make(input),
+	token: (input) => MethodSchema.cases.token.make(input)
+};
 const Schema$1 = Schema.Struct({
-	methods: Schema.Array(Method),
+	methods: Schema.Array(Method.Schema),
 	providerId: Schema.String
 });
 const decode$4 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
@@ -123,7 +130,7 @@ const Evidence = Schema.Struct({
 	providerId: Schema.String,
 	zone: Schema$2
 });
-const Selection = Schema.TaggedUnion({
+const SelectionSchema = Schema.TaggedUnion({
 	selected: {
 		candidate: Evidence,
 		evidence: Schema.Array(Evidence),
@@ -134,6 +141,12 @@ const Selection = Schema.TaggedUnion({
 		reason: Schema.Literals(["ambiguous", "unsupported"])
 	}
 });
+/** Provider selection schema and constructors for trusted discovery results. */
+const Selection = {
+	Schema: SelectionSchema,
+	manual: (input) => SelectionSchema.cases.manual.make(input),
+	selected: (input) => SelectionSchema.cases.selected.make(input)
+};
 function select(input) {
 	const domain = parse$1(input.domain);
 	const zoneCandidates = new Set(candidates(domain));
@@ -162,25 +175,22 @@ function select(input) {
 		if (index < 0) throw authorizationError("Explicit provider zone is not connected for this domain", "ProviderDiscovery.select");
 		const candidate = evidence[index];
 		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
-		return {
-			_tag: "selected",
+		return Selection.selected({
 			candidate,
 			evidence,
 			reason: "explicit"
-		};
+		});
 	}
 	const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);
 	const candidate = decisive[0];
-	return decisive.length === 1 && candidate !== void 0 ? {
-		_tag: "selected",
+	return decisive.length === 1 && candidate !== void 0 ? Selection.selected({
 		candidate,
 		evidence,
 		reason: "unique-nameserver-match"
-	} : {
-		_tag: "manual",
+	}) : Selection.manual({
 		evidence,
 		reason: decisive.length > 1 ? "ambiguous" : "unsupported"
-	};
+	});
 }
 function evidenceFor(connected, authoritative) {
 	const configured = new Set(nameserverSet(connected.nameservers));
@@ -518,7 +528,7 @@ const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(fu
 		default: return yield* decodeOpaque$1(record);
 	}
 }));
-const decodeOpaque$1 = Effect.fn("CloudflareRecords.decodeOpaque")((record) => Schema.decodeUnknownEffect(Opaque)({
+const decodeOpaque$1 = Effect.fn("CloudflareRecords.decodeOpaque")((record) => Schema.decodeUnknownEffect(Opaque.Schema)({
 	_tag: "Opaque",
 	name: record.name,
 	providerRecordId: record.id,
@@ -926,21 +936,19 @@ const Context$2 = Schema.Struct({
 const contextCodec$1 = codec("cloudflare.v1", Context$2);
 /** Describes Cloudflare's caller-created API-token authorization method. */
 function tokenMethod$1(capabilities) {
-	return {
-		_tag: "token",
+	return Method.token({
 		capabilities: [...capabilities],
 		instructionsUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/"
-	};
+	});
 }
 /** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */
 function oauthMethod(options) {
-	return {
-		_tag: "oauth2",
+	return Method.oauth2({
 		authorizationServer,
 		capabilities: [...options.capabilities],
 		clientAuth: options.clientAuth,
 		scopes: [...options.scopes]
-	};
+	});
 }
 /** Creates the Cloudflare token and OAuth authorization manifest. */
 function manifest$1(options) {
@@ -1322,7 +1330,7 @@ const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(
 		default: return yield* decodeOpaque(record, name);
 	}
 }));
-const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => Schema.decodeUnknownEffect(Opaque)({
+const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => Schema.decodeUnknownEffect(Opaque.Schema)({
 	_tag: "Opaque",
 	name,
 	providerRecordId: record.id,
@@ -1728,20 +1736,18 @@ const Context$1 = Schema.TaggedUnion({
 const contextCodec = codec("vercel.v1", Context$1);
 /** Describes Vercel's caller-created personal access-token method. */
 function tokenMethod(capabilities) {
-	return {
-		_tag: "token",
+	return Method.token({
 		capabilities: [...capabilities],
 		instructionsUrl: "https://vercel.com/account/settings/tokens"
-	};
+	});
 }
 /** Describes Vercel's provider-specific integration installation flow. */
 function integrationMethod(options) {
-	return {
-		_tag: "integration",
+	return Method.integration({
 		capabilities: [...options.capabilities],
 		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
 		tokenEndpoint: "https://api.vercel.com/v2/oauth/access_token"
-	};
+	});
 }
 /** Creates the Vercel token and integration authorization manifest. */
 function manifest(options) {
@@ -2393,4 +2399,4 @@ function recordValue(requirement) {
 //#endregion
 export { decode$4 as $, client_exports as A, tokenConnectionMethod$1 as B, integrationFlow as C, tokenConnectionMethod as D, restore as E, oauthFlow as F, make$5 as G, tokenValidator as H, oauthMethod as I, session_exports as J, authorize as K, refreshCredential as L, make$4 as M, auth_exports$1 as N, tokenMethod as O, manifest$1 as P, Schema$1 as Q, restore$1 as R, exchangeCode as S, manifest as T, client_exports$1 as U, tokenMethod$1 as V, discovery$1 as W, secret_exports as X, selection_exports as Y, Method as Z, toAsync$1 as _, Result as a, dns_data_exports as b, Observation as c, defaultMake as d, manifest_exports as et, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, discovery as j, AccountContext as k, Policy as l, google_doh_exports as m, ProviderObservation as n, version as nt, observe as o, resolver_pool_exports as p, connection_authorization_exports as q, PublicDns as r, verify_exports as s, Provider as t, diagnostic_exports as tt, Service as u, doh_exports as v, integrationMethod as w, auth_exports as x, toAsync$2 as y, subjectResolver as z };
 
-//# sourceMappingURL=verify-DDnK8U7C.mjs.map
+//# sourceMappingURL=verify-DvGPb5C9.mjs.map