domainkit 0.7.0 → 0.9.0

package/dist/index.mjs

@@ -1,362 +1,39 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { A as client_exports$1, G as make, J as session_exports, M as make$1, N as auth_exports, U as client_exports, W as discovery, X as secret_exports, Y as selection_exports, b as dns_data_exports, et as manifest_exports, g as cloudflare_doh_exports, j as discovery$1, k as AccountContext, m as google_doh_exports, nt as version, p as resolver_pool_exports, q as connection_authorization_exports, s as verify_exports, tt as diagnostic_exports, v as doh_exports, x as auth_exports$1 } from "./verify-DDnK8U7C.mjs";
-import { C as encode, O as domain_name_exports, S as decode, T as validate, _ as ProviderTarget, a as AggregateSchema, f as provider_context_exports, g as ProviderConnection, h as DomainAttachment, j as invalid_input_exports, m as ConnectionStatus, o as Error, p as AuthorizationError, s as Service$1, t as canonical_json_exports, u as authorization_exports, v as ProviderTargetEvidence, w as project, x as authorizationError, y as StoredConnection } from "./canonical-json-CQYKsZw7.mjs";
-import { a as start, i as complete, n as Method$1, r as StartResult, t as Error$1 } from "./connect-oI8hcMxc.mjs";
-import { B as provider_exports, F as types_exports, T as plan_exports, a as resolver_exports, dt as zones_exports, g as deletion_exports, lt as zone_discovery_exports, rt as dns_record_exports } from "./resolver-DPJs8h0a.mjs";
-import { Context, Data, Effect, Layer, Schema } from "effect";
-//#region src/auth/connection-lifecycle.ts
-/** Attach one exact provider target to one organization domain. */
-const attach = Effect.fn("ManagedDnsConnections.attach")(function* (input) {
-	return yield* (yield* Service$1).attach(input);
-});
-/** Remove one domain attachment while retaining the organization connection. */
-const detach = Effect.fn("ManagedDnsConnections.detach")(function* (input) {
-	return yield* (yield* Service$1).detach(input);
-});
-/** Disconnect one organization connection, revoking the shared authorization only when final. */
-function disconnect(input) {
-	return Effect.gen(function* () {
-		return yield* (yield* Service$1).disconnect({
-			connectionId: input.connectionId,
-			ownerId: input.ownerId,
-			revoke: input.revokeAuthorization
-		});
-	});
-}
-//#endregion
-//#region src/auth/connection-api.ts
-var connection_api_exports = /* @__PURE__ */ __exportAll({
-	AuthorizationError: () => AuthorizationError,
-	ConnectionStatus: () => ConnectionStatus,
-	DomainAttachment: () => DomainAttachment,
-	Error: () => Error$1,
-	Method: () => Method$1,
-	ProviderConnection: () => ProviderConnection,
-	ProviderTarget: () => ProviderTarget,
-	ProviderTargetEvidence: () => ProviderTargetEvidence,
-	StartResult: () => StartResult,
-	attach: () => attach,
-	authorizationError: () => authorizationError,
-	complete: () => complete,
-	decode: () => decode,
-	detach: () => detach,
-	disconnect: () => disconnect,
-	encode: () => encode,
-	project: () => project,
-	start: () => start,
-	validate: () => validate
-});
-//#endregion
-//#region src/auth/lifecycle-api.ts
-var lifecycle_api_exports = /* @__PURE__ */ __exportAll({
-	AggregateSchema: () => AggregateSchema,
-	Authorization: () => authorization_exports,
-	Error: () => Error,
-	Service: () => Service$1,
-	StoredConnection: () => StoredConnection
-});
-//#endregion
-//#region src/providers/cloudflare/index.ts
-var cloudflare_exports = /* @__PURE__ */ __exportAll({
-	Auth: () => auth_exports,
-	Client: () => client_exports,
-	discovery: () => discovery,
-	make: () => make
-});
-//#endregion
-//#region src/providers/vercel/index.ts
-var vercel_exports = /* @__PURE__ */ __exportAll({
-	AccountContext: () => AccountContext,
-	Auth: () => auth_exports$1,
-	Client: () => client_exports$1,
-	discovery: () => discovery$1,
-	make: () => make$1
-});
-//#endregion
-//#region src/transport.ts
-var transport_exports = /* @__PURE__ */ __exportAll({
-	ApplyResult: () => ApplyResult,
-	AuthenticationMethod: () => AuthenticationMethod,
-	AuthenticationParameter: () => AuthenticationParameter,
-	CleanupOperation: () => CleanupOperation,
-	CleanupPlan: () => CleanupPlan,
-	CleanupResult: () => CleanupResult,
-	Connected: () => Connected,
-	ConnectionResult: () => ConnectionResult,
-	ConnectionSnapshot: () => ConnectionSnapshot,
-	DetachResult: () => DetachResult,
-	Disconnected: () => Disconnected,
-	DnsRecord: () => DnsRecord,
-	DomainAttachment: () => DomainAttachment,
-	Failure: () => Failure,
-	Method: () => Method,
-	Observation: () => Observation,
-	ObservationEvidence: () => ObservationEvidence,
-	OperationResult: () => OperationResult,
-	PlanOperation: () => PlanOperation,
-	Provider: () => Provider,
-	ProviderConnection: () => ProviderConnection,
-	ProviderTarget: () => ProviderTarget,
-	ProviderTargetEvidence: () => ProviderTargetEvidence,
-	ProvisioningPlan: () => ProvisioningPlan,
-	Redirect: () => Redirect,
-	ReusableConnection: () => ReusableConnection,
-	Service: () => Service,
-	Unsupported: () => Unsupported,
-	fromAsync: () => fromAsync,
-	fromDnsRecord: () => fromDnsRecord,
-	layerFromAsync: () => layerFromAsync,
-	toAsync: () => toAsync
-});
-/** A user-presentable failure at the application transport boundary. */
-var Failure = class extends Schema.TaggedError()("Failure", {
-	message: Schema.String,
-	operation: Schema.String,
-	retry: Schema.Literals([
-		"never",
-		"after-user-action",
-		"safe",
-		"unknown"
-	])
-}) {};
-const AuthenticationParameter = Schema.Struct({
-	description: Schema.optionalKey(Schema.String),
-	key: Schema.String,
-	label: Schema.String,
-	placeholder: Schema.optionalKey(Schema.String),
-	required: Schema.optionalKey(Schema.Boolean)
-});
-const AuthenticationMethod = Schema.TaggedUnion({
-	Integration: { label: Schema.String },
-	OAuth: { label: Schema.String },
-	Token: {
-		label: Schema.String,
-		parameters: Schema.optionalKey(Schema.Array(AuthenticationParameter)),
-		placeholder: Schema.optionalKey(Schema.String)
-	}
-});
-const Method = Data.taggedEnum();
-const Provider = Schema.Struct({
-	authentication: Schema.Array(AuthenticationMethod),
-	id: Schema.String,
-	name: Schema.String
-});
-const Connected = Schema.TaggedStruct("Connected", {
-	attachment: DomainAttachment,
-	connection: ProviderConnection,
-	provider: Provider
-});
-const ReusableConnection = Schema.Struct({
-	connection: ProviderConnection,
-	targets: Schema.Array(ProviderTarget)
-});
-const Disconnected = Schema.TaggedStruct("Disconnected", {
-	domain: Schema.String,
-	provider: Provider,
-	reusableConnections: Schema.Array(ReusableConnection)
-});
-const Unsupported = Schema.TaggedStruct("Unsupported", { domain: Schema.String });
-const ConnectionSnapshot = Schema.Union([
-	Connected,
-	Disconnected,
-	Unsupported
-]).pipe(Schema.toTaggedUnion("_tag"));
-const Redirect = Schema.TaggedStruct("Redirect", { authorizationUrl: Schema.String });
-const ConnectionResult = Schema.Union([Connected, Redirect]).pipe(Schema.toTaggedUnion("_tag"));
-const DetachResult = Schema.TaggedStruct("Detached", {
-	attachment: DomainAttachment,
-	connection: ProviderConnection,
-	remainingAttachments: Schema.Int
-});
-/** A presentation projection of a DNS requirement. */
-const DnsRecord = Schema.Struct({
-	id: Schema.String,
-	name: Schema.String,
-	priority: Schema.optionalKey(Schema.Int),
-	type: Schema.String,
-	value: Schema.String
-});
-/** Projects DomainKit's operational record into its application transport representation. */
-const fromDnsRecord = (id, record) => {
-	switch (record._tag) {
-		case "A":
-		case "AAAA": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: record.address
-		};
-		case "CNAME":
-		case "NS": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: record.target
-		};
-		case "TXT": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: record.value
-		};
-		case "MX": return {
-			id,
-			name: record.name,
-			priority: record.priority,
-			type: record._tag,
-			value: record.exchange
-		};
-		case "CAA": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: `${record.flags} ${record.tag} ${record.value}`
-		};
-		case "SRV": return {
-			id,
-			name: record.name,
-			priority: record.priority,
-			type: record._tag,
-			value: `${record.weight} ${record.port} ${record.target}`
-		};
-	}
-};
-const PlanOperation = Schema.TaggedUnion({
-	Conflict: {
-		id: Schema.String,
-		reason: Schema.String,
-		record: DnsRecord
-	},
-	Create: {
-		id: Schema.String,
-		record: DnsRecord
-	},
-	Noop: {
-		id: Schema.String,
-		record: DnsRecord
-	}
-});
-const ProvisioningPlan = Schema.TaggedStruct("Plan", {
-	digest: Schema.String,
-	expiresAt: Schema.String,
-	operations: Schema.Array(PlanOperation)
-});
-const OperationResult = Schema.TaggedUnion({
-	Applied: { operationId: Schema.String },
-	Failed: {
-		message: Schema.String,
-		operationId: Schema.String
-	},
-	Unchanged: { operationId: Schema.String }
-});
-const ApplyOutcomeFields = {
-	operationId: Schema.String,
-	receiptId: Schema.String,
-	results: Schema.Array(OperationResult)
-};
-const ApplyResult = Schema.TaggedUnion({
-	Applied: ApplyOutcomeFields,
-	Partial: ApplyOutcomeFields,
-	Stale: { message: Schema.String }
-});
-const ObservationEvidence = Schema.TaggedUnion({
-	Found: { recordId: Schema.String },
-	Mismatch: {
-		message: Schema.String,
-		recordId: Schema.String
-	},
-	Missing: { recordId: Schema.String },
-	Unavailable: {
-		message: Schema.String,
-		recordId: Schema.String
-	}
-});
-const Observation = Schema.TaggedStruct("Observation", {
-	provider: Schema.Array(ObservationEvidence),
-	publicDns: Schema.Array(ObservationEvidence)
-});
-const CleanupOperation = Schema.TaggedUnion({
-	AlreadyAbsent: {
-		id: Schema.String,
-		record: DnsRecord
-	},
-	Blocked: {
-		id: Schema.String,
-		reason: Schema.String,
-		record: DnsRecord
-	},
-	Delete: {
-		id: Schema.String,
-		record: DnsRecord
-	}
-});
-const CleanupPlan = Schema.TaggedStruct("CleanupPlan", {
-	digest: Schema.String,
-	expiresAt: Schema.String,
-	operations: Schema.Array(CleanupOperation)
-});
-const CleanupOutcomeFields = {
-	operationId: Schema.String,
-	results: Schema.Array(OperationResult)
-};
-const CleanupResult = Schema.TaggedUnion({
-	Cleaned: CleanupOutcomeFields,
-	Partial: CleanupOutcomeFields,
-	Stale: { message: Schema.String }
-});
-var Service = class extends Context.Service()("@domainkit/Transport") {};
-/** Converts a Promise-shaped host implementation into the canonical Effect service. */
-const fromAsync = (transport, options = {}) => {
-	const attempt = (operation, evaluate) => Effect.tryPromise({
-		try: evaluate,
-		catch: (cause) => options.onError?.(operation, cause) ?? (cause instanceof Failure ? cause : new Failure({
-			message: cause instanceof globalThis.Error ? cause.message : String(cause),
-			operation,
-			retry: "unknown"
-		}))
-	});
-	return Service.of({
-		cleanup: {
-			apply: (input) => attempt("cleanup.apply", () => transport.cleanup.apply(input)),
-			plan: (input) => attempt("cleanup.plan", () => transport.cleanup.plan(input))
-		},
-		connection: {
-			attach: (input) => attempt("connection.attach", () => transport.connection.attach(input)),
-			connect: (input) => attempt("connection.connect", () => transport.connection.connect(input)),
-			inspect: (input) => attempt("connection.inspect", () => transport.connection.inspect(input)),
-			detach: (input) => attempt("connection.detach", () => transport.connection.detach(input))
-		},
-		provisioning: {
-			apply: (input) => attempt("provisioning.apply", () => transport.provisioning.apply(input)),
-			plan: (input) => attempt("provisioning.plan", () => transport.provisioning.plan(input))
-		},
-		verification: { observe: (input) => attempt("verification.observe", () => transport.verification.observe(input)) }
-	});
-};
-const layerFromAsync = (transport, options) => Layer.succeed(Service, fromAsync(transport, options));
-/** Converts an environment-free Effect service into its Promise-shaped host seam. */
-const toAsync = (transport) => ({
-	cleanup: {
-		apply: (input) => Effect.runPromise(transport.cleanup.apply(input)),
-		plan: (input) => Effect.runPromise(transport.cleanup.plan(input))
-	},
-	connection: {
-		attach: (input) => Effect.runPromise(transport.connection.attach(input)),
-		connect: (input) => Effect.runPromise(transport.connection.connect(input)),
-		inspect: (input) => Effect.runPromise(transport.connection.inspect(input)),
-		detach: (input) => Effect.runPromise(transport.connection.detach(input))
-	},
-	provisioning: {
-		apply: (input) => Effect.runPromise(transport.provisioning.apply(input)),
-		plan: (input) => Effect.runPromise(transport.provisioning.plan(input))
-	},
-	verification: { observe: (input) => Effect.runPromise(transport.verification.observe(input)) }
-});
-//#endregion
+import { DomainName_exports } from "./DomainName.mjs";
+import { DnsRecord_exports } from "./DnsRecord.mjs";
+import { Plan_exports } from "./Plan.mjs";
+import { Reason_exports } from "./Reason.mjs";
+import { Approval_exports } from "./Approval.mjs";
+import { Custody_exports } from "./Custody.mjs";
+import { Principal_exports } from "./Principal.mjs";
+import { Provider_exports } from "./Provider.mjs";
+import { Providers_exports } from "./Providers.mjs";
+import { Resolver_exports } from "./Resolver.mjs";
+import { Receipt_exports } from "./Receipt.mjs";
+import { Storage_exports } from "./Storage.mjs";
+import { Connect_exports } from "./Connect.mjs";
+import { Provision_exports } from "./Provision.mjs";
+import { Cleanup_exports } from "./Cleanup.mjs";
+import { Cloudflare_exports } from "./Cloudflare.mjs";
+import { Verify_exports } from "./Verify.mjs";
+import { DomainKit_exports } from "./DomainKit.mjs";
+import { Vercel_exports } from "./Vercel.mjs";
+import { version } from "./package.mjs";
 //#region src/index.ts
+/**
+* domainkit — the Effect-native root. One module per concept: services expose `Service` (the tag)
+* and `Interface` (its shape), value modules expose `Model` (the schema).
+*
+* Lifecycle services: Connect, Provision, Cleanup, Verify.
+* Host seams:         Storage, Custody, Principal.
+* Providers:          Provider, Providers, Cloudflare, Vercel.
+* Values:             DomainName, DnsRecord, Plan, Approval, Receipt.
+* Everything else:    Reason, Resolver, DomainKit (the composed layer and `DomainKit.Error`).
+*
+* Subpath: domainkit/testing.
+*/
 /** The current package version from the package manifest. */
 const VERSION = version;
 //#endregion
-export { cloudflare_exports as Cloudflare, cloudflare_doh_exports as CloudflareDnsOverHttps, connection_api_exports as Connection, connection_authorization_exports as ConnectionAuthorization, deletion_exports as Deletion, diagnostic_exports as Diagnostic, canonical_json_exports as Digest, dns_data_exports as DnsData, doh_exports as DnsOverHttps, types_exports as DnsPlan, provider_exports as DnsProvider, dns_record_exports as DnsRecord, resolver_exports as DnsResolver, resolver_pool_exports as DnsResolverPool, domain_name_exports as DomainName, google_doh_exports as GoogleDnsOverHttps, invalid_input_exports as InvalidInput, lifecycle_api_exports as ManagedDnsConnections, manifest_exports as ProviderAuth, provider_context_exports as ProviderContext, selection_exports as ProviderDiscovery, session_exports as ProviderSession, plan_exports as Provisioning, secret_exports as Secret, transport_exports as Transport, VERSION, vercel_exports as Vercel, verify_exports as Verification, zone_discovery_exports as ZoneDiscovery, zones_exports as Zones };
+export { Approval_exports as Approval, Cleanup_exports as Cleanup, Cloudflare_exports as Cloudflare, Connect_exports as Connect, Custody_exports as Custody, DnsRecord_exports as DnsRecord, DomainKit_exports as DomainKit, DomainName_exports as DomainName, Plan_exports as Plan, Principal_exports as Principal, Provider_exports as Provider, Providers_exports as Providers, Provision_exports as Provision, Reason_exports as Reason, Receipt_exports as Receipt, Resolver_exports as Resolver, Storage_exports as Storage, VERSION, Vercel_exports as Vercel, Verify_exports as Verify };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["Lifecycle.Service","Connection.DomainAttachment","Connection.ProviderConnection","Connection.ProviderTarget","packageJson.version"],"sources":["../src/auth/connection-lifecycle.ts","../src/auth/connection-api.ts","../src/auth/lifecycle-api.ts","../src/providers/cloudflare/index.ts","../src/providers/vercel/index.ts","../src/transport.ts","../src/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Connection from \"./connection.ts\";\nimport * as Lifecycle from \"./lifecycle-repository.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\n\n/** Attach one exact provider target to one organization domain. */\nexport const attach = Effect.fn(\"ManagedDnsConnections.attach\")(function* (input: {\n  readonly attachment: Connection.DomainAttachment;\n  readonly connectionId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.attach(input);\n});\n\n/** Remove one domain attachment while retaining the organization connection. */\nexport const detach = Effect.fn(\"ManagedDnsConnections.detach\")(function* (input: {\n  readonly attachmentId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.detach(input);\n});\n\n/** Disconnect one organization connection, revoking the shared authorization only when final. */\nexport function disconnect<E>(input: {\n  readonly connectionId: string;\n  readonly ownerId: string;\n  readonly revokeAuthorization: (\n    authorization: ProviderAuthorization.ProviderAuthorization,\n  ) => Effect.Effect<void, E>;\n}): Effect.Effect<Lifecycle.DisconnectResult, Lifecycle.Error | E, Lifecycle.Service> {\n  return Effect.gen(function* () {\n    const service = yield* Lifecycle.Service;\n    return yield* service.disconnect({\n      connectionId: input.connectionId,\n      ownerId: input.ownerId,\n      revoke: input.revokeAuthorization,\n    });\n  });\n}\n","export {\n  AuthorizationError,\n  authorizationError,\n  ConnectionStatus,\n  decode,\n  DomainAttachment,\n  encode,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n  project,\n  validate,\n} from \"./connection.ts\";\nexport { attach, detach, disconnect } from \"./connection-lifecycle.ts\";\nexport type { AttachmentResult, DetachResult, DisconnectResult } from \"./lifecycle-repository.ts\";\nexport { complete, Error, Method, start, StartResult } from \"./connect.ts\";\nexport type {\n  Authentication,\n  AuthenticationFailure,\n  BaseInput,\n  CompleteInput,\n  Continuation,\n  ContinuationStore,\n  Failure,\n  InteractiveFlow,\n  InteractiveStart,\n  Method as ConnectionMethod,\n  StartResult as ConnectionStartResult,\n} from \"./connect.ts\";\n","/** Public surface for the cohesive managed-DNS persistence capability. */\nexport { AggregateSchema, Error, Service } from \"./lifecycle-repository.ts\";\nexport * as Authorization from \"./authorization.ts\";\nexport { StoredConnection } from \"./connection.ts\";\nexport type { StoredCredential } from \"./connection.ts\";\nexport type {\n  Aggregate,\n  AttachmentResult,\n  ConnectInput,\n  DetachResult,\n  DisconnectResult,\n  Interface,\n} from \"./lifecycle-repository.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { AccountContext, discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","import { Context, Data, Effect, Layer, Schema } from \"effect\";\n\nimport * as Connection from \"./auth/connection.ts\";\nimport type * as DomainDnsRecord from \"./domain/dns-record.ts\";\n\nexport {\n  DomainAttachment,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n} from \"./auth/connection.ts\";\n\n/** A user-presentable failure at the application transport boundary. */\nexport class Failure extends Schema.TaggedError<Failure>()(\"Failure\", {\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport const AuthenticationParameter = Schema.Struct({\n  description: Schema.optionalKey(Schema.String),\n  key: Schema.String,\n  label: Schema.String,\n  placeholder: Schema.optionalKey(Schema.String),\n  required: Schema.optionalKey(Schema.Boolean),\n});\nexport type AuthenticationParameter = typeof AuthenticationParameter.Type;\n\nexport const AuthenticationMethod = Schema.TaggedUnion({\n  Integration: { label: Schema.String },\n  OAuth: { label: Schema.String },\n  Token: {\n    label: Schema.String,\n    parameters: Schema.optionalKey(Schema.Array(AuthenticationParameter)),\n    placeholder: Schema.optionalKey(Schema.String),\n  },\n});\nexport type AuthenticationMethod = typeof AuthenticationMethod.Type;\n\n/** The authentication choice supplied to a connection request. */\nexport type Method = Data.TaggedEnum<{\n  Integration: {};\n  OAuth: {};\n  Token: {\n    readonly parameters?: Readonly<Record<string, string>>;\n    readonly token: string;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport const Provider = Schema.Struct({\n  authentication: Schema.Array(AuthenticationMethod),\n  id: Schema.String,\n  name: Schema.String,\n});\nexport type Provider = typeof Provider.Type;\n\nexport const Connected = Schema.TaggedStruct(\"Connected\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  provider: Provider,\n});\nexport type Connected = typeof Connected.Type;\n\nexport const ReusableConnection = Schema.Struct({\n  connection: Connection.ProviderConnection,\n  targets: Schema.Array(Connection.ProviderTarget),\n});\nexport type ReusableConnection = typeof ReusableConnection.Type;\n\nexport const Disconnected = Schema.TaggedStruct(\"Disconnected\", {\n  domain: Schema.String,\n  provider: Provider,\n  reusableConnections: Schema.Array(ReusableConnection),\n});\nexport type Disconnected = typeof Disconnected.Type;\n\nexport const Unsupported = Schema.TaggedStruct(\"Unsupported\", { domain: Schema.String });\nexport type Unsupported = typeof Unsupported.Type;\n\nexport const ConnectionSnapshot = Schema.Union([Connected, Disconnected, Unsupported]).pipe(\n  Schema.toTaggedUnion(\"_tag\"),\n);\nexport type ConnectionSnapshot = typeof ConnectionSnapshot.Type;\n\nexport const Redirect = Schema.TaggedStruct(\"Redirect\", { authorizationUrl: Schema.String });\nexport type Redirect = typeof Redirect.Type;\n\nexport const ConnectionResult = Schema.Union([Connected, Redirect]).pipe(\n  Schema.toTaggedUnion(\"_tag\"),\n);\nexport type ConnectionResult = typeof ConnectionResult.Type;\n\nexport const DetachResult = Schema.TaggedStruct(\"Detached\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  remainingAttachments: Schema.Int,\n});\nexport type DetachResult = typeof DetachResult.Type;\n\n/** A presentation projection of a DNS requirement. */\nexport const DnsRecord = Schema.Struct({\n  id: Schema.String,\n  name: Schema.String,\n  priority: Schema.optionalKey(Schema.Int),\n  type: Schema.String,\n  value: Schema.String,\n});\nexport type DnsRecord = typeof DnsRecord.Type;\n\n/** Projects DomainKit's operational record into its application transport representation. */\nexport const fromDnsRecord = (id: string, record: DomainDnsRecord.DnsRecord): DnsRecord => {\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { id, name: record.name, type: record._tag, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { id, name: record.name, type: record._tag, value: record.target };\n    case \"TXT\":\n      return { id, name: record.name, type: record._tag, value: record.value };\n    case \"MX\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: record.exchange,\n      };\n    case \"CAA\":\n      return {\n        id,\n        name: record.name,\n        type: record._tag,\n        value: `${record.flags} ${record.tag} ${record.value}`,\n      };\n    case \"SRV\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: `${record.weight} ${record.port} ${record.target}`,\n      };\n  }\n};\n\nexport const PlanOperation = Schema.TaggedUnion({\n  Conflict: { id: Schema.String, reason: Schema.String, record: DnsRecord },\n  Create: { id: Schema.String, record: DnsRecord },\n  Noop: { id: Schema.String, record: DnsRecord },\n});\nexport type PlanOperation = typeof PlanOperation.Type;\n\nexport const ProvisioningPlan = Schema.TaggedStruct(\"Plan\", {\n  digest: Schema.String,\n  expiresAt: Schema.String,\n  operations: Schema.Array(PlanOperation),\n});\nexport type ProvisioningPlan = typeof ProvisioningPlan.Type;\n\nexport const OperationResult = Schema.TaggedUnion({\n  Applied: { operationId: Schema.String },\n  Failed: { message: Schema.String, operationId: Schema.String },\n  Unchanged: { operationId: Schema.String },\n});\nexport type OperationResult = typeof OperationResult.Type;\n\nconst ApplyOutcomeFields = {\n  operationId: Schema.String,\n  receiptId: Schema.String,\n  results: Schema.Array(OperationResult),\n};\nexport const ApplyResult = Schema.TaggedUnion({\n  Applied: ApplyOutcomeFields,\n  Partial: ApplyOutcomeFields,\n  Stale: { message: Schema.String },\n});\nexport type ApplyResult = typeof ApplyResult.Type;\n\nexport const ObservationEvidence = Schema.TaggedUnion({\n  Found: { recordId: Schema.String },\n  Mismatch: { message: Schema.String, recordId: Schema.String },\n  Missing: { recordId: Schema.String },\n  Unavailable: { message: Schema.String, recordId: Schema.String },\n});\nexport type ObservationEvidence = typeof ObservationEvidence.Type;\n\nexport const Observation = Schema.TaggedStruct(\"Observation\", {\n  provider: Schema.Array(ObservationEvidence),\n  publicDns: Schema.Array(ObservationEvidence),\n});\nexport type Observation = typeof Observation.Type;\n\nexport const CleanupOperation = Schema.TaggedUnion({\n  AlreadyAbsent: { id: Schema.String, record: DnsRecord },\n  Blocked: { id: Schema.String, reason: Schema.String, record: DnsRecord },\n  Delete: { id: Schema.String, record: DnsRecord },\n});\nexport type CleanupOperation = typeof CleanupOperation.Type;\n\nexport const CleanupPlan = Schema.TaggedStruct(\"CleanupPlan\", {\n  digest: Schema.String,\n  expiresAt: Schema.String,\n  operations: Schema.Array(CleanupOperation),\n});\nexport type CleanupPlan = typeof CleanupPlan.Type;\n\nconst CleanupOutcomeFields = {\n  operationId: Schema.String,\n  results: Schema.Array(OperationResult),\n};\nexport const CleanupResult = Schema.TaggedUnion({\n  Cleaned: CleanupOutcomeFields,\n  Partial: CleanupOutcomeFields,\n  Stale: { message: Schema.String },\n});\nexport type CleanupResult = typeof CleanupResult.Type;\n\nexport interface ConnectInput {\n  readonly domain: string;\n  readonly method: Method;\n  readonly providerId: string;\n}\n\nexport interface InspectInput {\n  readonly domain: string;\n}\n\nexport interface AttachInput {\n  readonly connectionId: string;\n  readonly domain: string;\n  readonly target: Connection.ProviderTarget;\n}\n\nexport interface DetachInput {\n  readonly attachmentId: string;\n  readonly preserveDns: true;\n}\n\nexport interface ProvisioningPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n}\n\nexport interface ProvisioningApplyInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly planDigest: string;\n}\n\nexport interface ObserveInput {\n  readonly attachmentId?: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n  readonly sources: {\n    readonly provider: boolean;\n    readonly publicDns: boolean;\n  };\n}\n\nexport interface CleanupPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly receiptId: string;\n}\n\nexport interface CleanupApplyInput extends CleanupPlanInput {\n  readonly planDigest: string;\n}\n\n/** Application-facing DNS connection and provisioning capability. */\nexport interface Interface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Effect.Effect<CleanupResult, Failure>;\n    readonly plan: (input: CleanupPlanInput) => Effect.Effect<CleanupPlan, Failure>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Effect.Effect<Connected, Failure>;\n    readonly connect: (input: ConnectInput) => Effect.Effect<ConnectionResult, Failure>;\n    readonly inspect: (input: InspectInput) => Effect.Effect<ConnectionSnapshot, Failure>;\n    readonly detach: (input: DetachInput) => Effect.Effect<DetachResult, Failure>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Effect.Effect<ApplyResult, Failure>;\n    readonly plan: (input: ProvisioningPlanInput) => Effect.Effect<ProvisioningPlan, Failure>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Effect.Effect<Observation, Failure>;\n  };\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Transport\") {}\n\n/** Promise-shaped host seam for foreign runtimes and framework actions. */\nexport interface AsyncInterface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Promise<CleanupResult>;\n    readonly plan: (input: CleanupPlanInput) => Promise<CleanupPlan>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Promise<Connected>;\n    readonly connect: (input: ConnectInput) => Promise<ConnectionResult>;\n    readonly inspect: (input: InspectInput) => Promise<ConnectionSnapshot>;\n    readonly detach: (input: DetachInput) => Promise<DetachResult>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Promise<ApplyResult>;\n    readonly plan: (input: ProvisioningPlanInput) => Promise<ProvisioningPlan>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Promise<Observation>;\n  };\n}\n\nexport interface AsyncOptions {\n  readonly onError?: (operation: string, cause: unknown) => Failure;\n}\n\n/** Converts a Promise-shaped host implementation into the canonical Effect service. */\nexport const fromAsync = (transport: AsyncInterface, options: AsyncOptions = {}): Interface => {\n  const attempt = <A>(operation: string, evaluate: () => Promise<A>) =>\n    Effect.tryPromise({\n      try: evaluate,\n      catch: (cause) =>\n        options.onError?.(operation, cause) ??\n        (cause instanceof Failure\n          ? cause\n          : new Failure({\n              message: cause instanceof globalThis.Error ? cause.message : String(cause),\n              operation,\n              retry: \"unknown\",\n            })),\n    });\n  return Service.of({\n    cleanup: {\n      apply: (input) => attempt(\"cleanup.apply\", () => transport.cleanup.apply(input)),\n      plan: (input) => attempt(\"cleanup.plan\", () => transport.cleanup.plan(input)),\n    },\n    connection: {\n      attach: (input) => attempt(\"connection.attach\", () => transport.connection.attach(input)),\n      connect: (input) => attempt(\"connection.connect\", () => transport.connection.connect(input)),\n      inspect: (input) => attempt(\"connection.inspect\", () => transport.connection.inspect(input)),\n      detach: (input) => attempt(\"connection.detach\", () => transport.connection.detach(input)),\n    },\n    provisioning: {\n      apply: (input) => attempt(\"provisioning.apply\", () => transport.provisioning.apply(input)),\n      plan: (input) => attempt(\"provisioning.plan\", () => transport.provisioning.plan(input)),\n    },\n    verification: {\n      observe: (input) =>\n        attempt(\"verification.observe\", () => transport.verification.observe(input)),\n    },\n  });\n};\n\nexport const layerFromAsync = (\n  transport: AsyncInterface,\n  options?: AsyncOptions,\n): Layer.Layer<Service> => Layer.succeed(Service, fromAsync(transport, options));\n\n/** Converts an environment-free Effect service into its Promise-shaped host seam. */\nexport const toAsync = (transport: Interface): AsyncInterface => ({\n  cleanup: {\n    apply: (input) => Effect.runPromise(transport.cleanup.apply(input)),\n    plan: (input) => Effect.runPromise(transport.cleanup.plan(input)),\n  },\n  connection: {\n    attach: (input) => Effect.runPromise(transport.connection.attach(input)),\n    connect: (input) => Effect.runPromise(transport.connection.connect(input)),\n    inspect: (input) => Effect.runPromise(transport.connection.inspect(input)),\n    detach: (input) => Effect.runPromise(transport.connection.detach(input)),\n  },\n  provisioning: {\n    apply: (input) => Effect.runPromise(transport.provisioning.apply(input)),\n    plan: (input) => Effect.runPromise(transport.provisioning.plan(input)),\n  },\n  verification: {\n    observe: (input) => Effect.runPromise(transport.verification.observe(input)),\n  },\n});\n","import packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Connection from \"./auth/connection-api.ts\";\nexport * as ManagedDnsConnections from \"./auth/lifecycle-api.ts\";\nexport * as Diagnostic from \"./auth/diagnostic.ts\";\nexport * as ProviderAuth from \"./auth/manifest.ts\";\nexport * as ProviderContext from \"./auth/provider-context.ts\";\nexport * as Secret from \"./auth/secret.ts\";\nexport * as ProviderDiscovery from \"./discovery/selection.ts\";\nexport * as ZoneDiscovery from \"./discovery/zone-discovery.ts\";\nexport * as Zones from \"./discovery/zones.ts\";\nexport * as DnsRecord from \"./domain/dns-record.ts\";\nexport * as DomainName from \"./domain/domain-name.ts\";\nexport * as InvalidInput from \"./invalid-input.ts\";\nexport * as DnsProvider from \"./provider/provider.ts\";\nexport * as ProviderSession from \"./provider/session.ts\";\nexport * as ConnectionAuthorization from \"./plan/connection-authorization.ts\";\nexport * as Digest from \"./plan/canonical-json.ts\";\nexport * as Deletion from \"./plan/deletion.ts\";\nexport * as Provisioning from \"./plan/plan.ts\";\nexport * as DnsPlan from \"./plan/types.ts\";\nexport * as Cloudflare from \"./providers/cloudflare/index.ts\";\nexport * as Vercel from \"./providers/vercel/index.ts\";\nexport * as Transport from \"./transport.ts\";\nexport * as CloudflareDnsOverHttps from \"./verification/cloudflare-doh.ts\";\nexport * as DnsData from \"./verification/dns-data.ts\";\nexport * as DnsOverHttps from \"./verification/doh.ts\";\nexport * as GoogleDnsOverHttps from \"./verification/google-doh.ts\";\nexport * as DnsResolverPool from \"./verification/resolver-pool.ts\";\nexport * as DnsResolver from \"./verification/resolver.ts\";\nexport * as Verification from \"./verification/verify.ts\";\n"],"mappings":";;;;;;;;AAOA,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAIxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAGxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,SAAgB,WAAc,OAMwD;CACpF,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,QAAO,OADSA,UAAAA,CACD,WAAW;GAC/B,cAAc,MAAM;GACpB,SAAS,MAAM;GACf,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AK5BA,IAAa,UAAb,cAA6B,OAAO,YAAqB,CAAC,CAAC,WAAW;CACpE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,0BAA0B,OAAO,OAAO;CACnD,aAAa,OAAO,YAAY,OAAO,MAAM;CAC7C,KAAK,OAAO;CACZ,OAAO,OAAO;CACd,aAAa,OAAO,YAAY,OAAO,MAAM;CAC7C,UAAU,OAAO,YAAY,OAAO,OAAO;AAC7C,CAAC;AAGD,MAAa,uBAAuB,OAAO,YAAY;CACrD,aAAa,EAAE,OAAO,OAAO,OAAO;CACpC,OAAO,EAAE,OAAO,OAAO,OAAO;CAC9B,OAAO;EACL,OAAO,OAAO;EACd,YAAY,OAAO,YAAY,OAAO,MAAM,uBAAuB,CAAC;EACpE,aAAa,OAAO,YAAY,OAAO,MAAM;CAC/C;AACF,CAAC;AAYD,MAAa,SAAS,KAAK,WAAmB;AAE9C,MAAa,WAAW,OAAO,OAAO;CACpC,gBAAgB,OAAO,MAAM,oBAAoB;CACjD,IAAI,OAAO;CACX,MAAM,OAAO;AACf,CAAC;AAGD,MAAa,YAAY,OAAO,aAAa,aAAa;CACxD,YAAYC;CACZ,YAAYC;CACZ,UAAU;AACZ,CAAC;AAGD,MAAa,qBAAqB,OAAO,OAAO;CAC9C,YAAYA;CACZ,SAAS,OAAO,MAAMC,cAAyB;AACjD,CAAC;AAGD,MAAa,eAAe,OAAO,aAAa,gBAAgB;CAC9D,QAAQ,OAAO;CACf,UAAU;CACV,qBAAqB,OAAO,MAAM,kBAAkB;AACtD,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe,EAAE,QAAQ,OAAO,OAAO,CAAC;AAGvF,MAAa,qBAAqB,OAAO,MAAM;CAAC;CAAW;CAAc;AAAW,CAAC,CAAC,CAAC,KACrF,OAAO,cAAc,MAAM,CAC7B;AAGA,MAAa,WAAW,OAAO,aAAa,YAAY,EAAE,kBAAkB,OAAO,OAAO,CAAC;AAG3F,MAAa,mBAAmB,OAAO,MAAM,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,KAClE,OAAO,cAAc,MAAM,CAC7B;AAGA,MAAa,eAAe,OAAO,aAAa,YAAY;CAC1D,YAAYF;CACZ,YAAYC;CACZ,sBAAsB,OAAO;AAC/B,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,IAAI,OAAO;CACX,MAAM,OAAO;CACb,UAAU,OAAO,YAAY,OAAO,GAAG;CACvC,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC;;AAID,MAAa,iBAAiB,IAAY,WAAiD;CACzF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAQ;EAC3E,KAAK;EACL,KAAK,MACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAO;EAC1E,KAAK,OACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAM;EACzE,KAAK,MACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,GAAG,OAAO;EACjD;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,GAAG,OAAO,KAAK,GAAG,OAAO;EACnD;CACJ;AACF;AAEA,MAAa,gBAAgB,OAAO,YAAY;CAC9C,UAAU;EAAE,IAAI,OAAO;EAAQ,QAAQ,OAAO;EAAQ,QAAQ;CAAU;CACxE,QAAQ;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;CAC/C,MAAM;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;AAC/C,CAAC;AAGD,MAAa,mBAAmB,OAAO,aAAa,QAAQ;CAC1D,QAAQ,OAAO;CACf,WAAW,OAAO;CAClB,YAAY,OAAO,MAAM,aAAa;AACxC,CAAC;AAGD,MAAa,kBAAkB,OAAO,YAAY;CAChD,SAAS,EAAE,aAAa,OAAO,OAAO;CACtC,QAAQ;EAAE,SAAS,OAAO;EAAQ,aAAa,OAAO;CAAO;CAC7D,WAAW,EAAE,aAAa,OAAO,OAAO;AAC1C,CAAC;AAGD,MAAM,qBAAqB;CACzB,aAAa,OAAO;CACpB,WAAW,OAAO;CAClB,SAAS,OAAO,MAAM,eAAe;AACvC;AACA,MAAa,cAAc,OAAO,YAAY;CAC5C,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAAS,OAAO,OAAO;AAClC,CAAC;AAGD,MAAa,sBAAsB,OAAO,YAAY;CACpD,OAAO,EAAE,UAAU,OAAO,OAAO;CACjC,UAAU;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAO;CAC5D,SAAS,EAAE,UAAU,OAAO,OAAO;CACnC,aAAa;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAO;AACjE,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe;CAC5D,UAAU,OAAO,MAAM,mBAAmB;CAC1C,WAAW,OAAO,MAAM,mBAAmB;AAC7C,CAAC;AAGD,MAAa,mBAAmB,OAAO,YAAY;CACjD,eAAe;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;CACtD,SAAS;EAAE,IAAI,OAAO;EAAQ,QAAQ,OAAO;EAAQ,QAAQ;CAAU;CACvE,QAAQ;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;AACjD,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe;CAC5D,QAAQ,OAAO;CACf,WAAW,OAAO;CAClB,YAAY,OAAO,MAAM,gBAAgB;AAC3C,CAAC;AAGD,MAAM,uBAAuB;CAC3B,aAAa,OAAO;CACpB,SAAS,OAAO,MAAM,eAAe;AACvC;AACA,MAAa,gBAAgB,OAAO,YAAY;CAC9C,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAAS,OAAO,OAAO;AAClC,CAAC;AA6ED,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;;AA4B5F,MAAa,aAAa,WAA2B,UAAwB,CAAC,MAAiB;CAC7F,MAAM,WAAc,WAAmB,aACrC,OAAO,WAAW;EAChB,KAAK;EACL,QAAQ,UACN,QAAQ,UAAU,WAAW,KAAK,MACjC,iBAAiB,UACd,QACA,IAAI,QAAQ;GACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;GACzE;GACA,OAAO;EACT,CAAC;CACT,CAAC;CACH,OAAO,QAAQ,GAAG;EAChB,SAAS;GACP,QAAQ,UAAU,QAAQ,uBAAuB,UAAU,QAAQ,MAAM,KAAK,CAAC;GAC/E,OAAO,UAAU,QAAQ,sBAAsB,UAAU,QAAQ,KAAK,KAAK,CAAC;EAC9E;EACA,YAAY;GACV,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;GACxF,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;EAC1F;EACA,cAAc;GACZ,QAAQ,UAAU,QAAQ,4BAA4B,UAAU,aAAa,MAAM,KAAK,CAAC;GACzF,OAAO,UAAU,QAAQ,2BAA2B,UAAU,aAAa,KAAK,KAAK,CAAC;EACxF;EACA,cAAc,EACZ,UAAU,UACR,QAAQ,8BAA8B,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC/E;CACF,CAAC;AACH;AAEA,MAAa,kBACX,WACA,YACyB,MAAM,QAAQ,SAAS,UAAU,WAAW,OAAO,CAAC;;AAG/E,MAAa,WAAW,eAA0C;CAChE,SAAS;EACP,QAAQ,UAAU,OAAO,WAAW,UAAU,QAAQ,MAAM,KAAK,CAAC;EAClE,OAAO,UAAU,OAAO,WAAW,UAAU,QAAQ,KAAK,KAAK,CAAC;CAClE;CACA,YAAY;EACV,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;EACvE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;CACzE;CACA,cAAc;EACZ,QAAQ,UAAU,OAAO,WAAW,UAAU,aAAa,MAAM,KAAK,CAAC;EACvE,OAAO,UAAU,OAAO,WAAW,UAAU,aAAa,KAAK,KAAK,CAAC;CACvE;CACA,cAAc,EACZ,UAAU,UAAU,OAAO,WAAW,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC7E;AACF;;;;AC1XA,MAAa,UAAUE"}
+{"version":3,"file":"index.mjs","names":["packageJson.version"],"sources":["../src/index.ts"],"sourcesContent":["/**\n * domainkit — the Effect-native root. One module per concept: services expose `Service` (the tag)\n * and `Interface` (its shape), value modules expose `Model` (the schema).\n *\n * Lifecycle services: Connect, Provision, Cleanup, Verify.\n * Host seams:         Storage, Custody, Principal.\n * Providers:          Provider, Providers, Cloudflare, Vercel.\n * Values:             DomainName, DnsRecord, Plan, Approval, Receipt.\n * Everything else:    Reason, Resolver, DomainKit (the composed layer and `DomainKit.Error`).\n *\n * Subpath: domainkit/testing.\n */\nimport packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Approval from \"./Approval.ts\";\nexport * as Cleanup from \"./Cleanup.ts\";\nexport * as Cloudflare from \"./Cloudflare.ts\";\nexport * as Connect from \"./Connect.ts\";\nexport * as Custody from \"./Custody.ts\";\nexport * as DnsRecord from \"./DnsRecord.ts\";\nexport * as DomainKit from \"./DomainKit.ts\";\nexport * as DomainName from \"./DomainName.ts\";\nexport * as Plan from \"./Plan.ts\";\nexport * as Principal from \"./Principal.ts\";\nexport * as Provider from \"./Provider.ts\";\nexport * as Providers from \"./Providers.ts\";\nexport * as Provision from \"./Provision.ts\";\nexport * as Reason from \"./Reason.ts\";\nexport * as Receipt from \"./Receipt.ts\";\nexport * as Resolver from \"./Resolver.ts\";\nexport * as Storage from \"./Storage.ts\";\nexport * as Vercel from \"./Vercel.ts\";\nexport * as Verify from \"./Verify.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,UAAUA"}

package/dist/internal/aes.mjs

@@ -0,0 +1,61 @@
+import { CryptoFailed } from "../Reason.mjs";
+import { DomainKitError } from "./error.mjs";
+import { Effect, Redacted } from "effect";
+//#region src/internal/aes.ts
+const version = "v1";
+const ivBytes = 12;
+const cryptoFailed = (operation) => () => new DomainKitError({ reason: new CryptoFailed({ operation }) });
+/** Accepts a 32-byte key as base64, base64url, or hex. */
+const decodeKey = (encoded) => {
+	const trimmed = encoded.trim();
+	if (/^[0-9a-fA-F]{64}$/.test(trimmed)) return Uint8Array.from(trimmed.match(/../g) ?? [], (byte) => Number.parseInt(byte, 16));
+	try {
+		const bytes = fromBase64(trimmed);
+		return bytes.length === 32 ? bytes : null;
+	} catch {
+		return null;
+	}
+};
+const importKey = (raw) => Effect.tryPromise({
+	try: () => crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]),
+	catch: cryptoFailed("seal")
+});
+const seal = (key, plaintext) => Effect.tryPromise({
+	try: async () => {
+		const iv = crypto.getRandomValues(new Uint8Array(ivBytes));
+		const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv
+		}, key, new TextEncoder().encode(Redacted.value(plaintext))));
+		return `${version}.${toBase64Url(iv)}.${toBase64Url(ciphertext)}`;
+	},
+	catch: cryptoFailed("seal")
+});
+const open = (key, envelope) => Effect.tryPromise({
+	try: async () => {
+		const [tag, iv, ciphertext] = envelope.split(".");
+		if (tag !== version || iv === void 0 || ciphertext === void 0) throw new Error("unsupported envelope");
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64(iv)
+		}, key, fromBase64(ciphertext));
+		return Redacted.make(new TextDecoder().decode(plaintext));
+	},
+	catch: cryptoFailed("open")
+});
+const generateKey = () => toBase64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+function toBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64(value) {
+	const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+	const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+	const binary = atob(padded);
+	return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+//#endregion
+export { decodeKey, generateKey, importKey, open, seal };
+
+//# sourceMappingURL=aes.mjs.map

package/dist/internal/aes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes.mjs","names":["Errors.DomainKitError","Reason.CryptoFailed"],"sources":["../../src/internal/aes.ts"],"sourcesContent":["import { Effect, Redacted } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\nconst version = \"v1\";\nconst ivBytes = 12;\n\nconst cryptoFailed = (operation: \"seal\" | \"open\") => () =>\n  new Errors.DomainKitError({\n    reason: new Reason.CryptoFailed({ operation }),\n  });\n\n/** Accepts a 32-byte key as base64, base64url, or hex. */\nexport const decodeKey = (encoded: string): Uint8Array<ArrayBuffer> | null => {\n  const trimmed = encoded.trim();\n  if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {\n    return Uint8Array.from(trimmed.match(/../g) ?? [], (byte) => Number.parseInt(byte, 16));\n  }\n  try {\n    const bytes = fromBase64(trimmed);\n    return bytes.length === 32 ? bytes : null;\n  } catch {\n    return null;\n  }\n};\n\nexport const importKey = (\n  raw: Uint8Array<ArrayBuffer>,\n): Effect.Effect<CryptoKey, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: () =>\n      crypto.subtle.importKey(\"raw\", raw, { name: \"AES-GCM\" }, false, [\"encrypt\", \"decrypt\"]),\n    catch: cryptoFailed(\"seal\"),\n  });\n\nexport const seal = (\n  key: CryptoKey,\n  plaintext: Redacted.Redacted<string>,\n): Effect.Effect<string, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async () => {\n      const iv = crypto.getRandomValues(new Uint8Array(ivBytes));\n      const ciphertext = new Uint8Array(\n        await crypto.subtle.encrypt(\n          { name: \"AES-GCM\", iv },\n          key,\n          new TextEncoder().encode(Redacted.value(plaintext)),\n        ),\n      );\n      return `${version}.${toBase64Url(iv)}.${toBase64Url(ciphertext)}`;\n    },\n    catch: cryptoFailed(\"seal\"),\n  });\n\nexport const open = (\n  key: CryptoKey,\n  envelope: string,\n): Effect.Effect<Redacted.Redacted<string>, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async () => {\n      const [tag, iv, ciphertext] = envelope.split(\".\");\n      if (tag !== version || iv === undefined || ciphertext === undefined) {\n        throw new Error(\"unsupported envelope\");\n      }\n      const plaintext = await crypto.subtle.decrypt(\n        { name: \"AES-GCM\", iv: fromBase64(iv) },\n        key,\n        fromBase64(ciphertext),\n      );\n      return Redacted.make(new TextDecoder().decode(plaintext));\n    },\n    catch: cryptoFailed(\"open\"),\n  });\n\nexport const generateKey = (): string => toBase64Url(crypto.getRandomValues(new Uint8Array(32)));\n\nfunction toBase64Url(bytes: Uint8Array<ArrayBuffer>): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\nfunction fromBase64(value: string): Uint8Array<ArrayBuffer> {\n  const normalized = value.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n"],"mappings":";;;;AAKA,MAAM,UAAU;AAChB,MAAM,UAAU;AAEhB,MAAM,gBAAgB,oBACpB,IAAIA,eAAsB,EACxB,QAAQ,IAAIC,aAAoB,EAAE,UAAU,CAAC,EAC/C,CAAC;;AAGH,MAAa,aAAa,YAAoD;CAC5E,MAAM,UAAU,QAAQ,KAAK;CAC7B,IAAI,oBAAoB,KAAK,OAAO,GAClC,OAAO,WAAW,KAAK,QAAQ,MAAM,KAAK,KAAK,CAAC,IAAI,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;CAExF,IAAI;EACF,MAAM,QAAQ,WAAW,OAAO;EAChC,OAAO,MAAM,WAAW,KAAK,QAAQ;CACvC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAa,aACX,QAEA,OAAO,WAAW;CAChB,WACE,OAAO,OAAO,UAAU,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,SAAS,CAAC;CACxF,OAAO,aAAa,MAAM;AAC5B,CAAC;AAEH,MAAa,QACX,KACA,cAEA,OAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;EACzD,MAAM,aAAa,IAAI,WACrB,MAAM,OAAO,OAAO,QAClB;GAAE,MAAM;GAAW;EAAG,GACtB,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,MAAM,SAAS,CAAC,CACpD,CACF;EACA,OAAO,GAAG,QAAQ,GAAG,YAAY,EAAE,EAAE,GAAG,YAAY,UAAU;CAChE;CACA,OAAO,aAAa,MAAM;AAC5B,CAAC;AAEH,MAAa,QACX,KACA,aAEA,OAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,CAAC,KAAK,IAAI,cAAc,SAAS,MAAM,GAAG;EAChD,IAAI,QAAQ,WAAW,OAAO,KAAA,KAAa,eAAe,KAAA,GACxD,MAAM,IAAI,MAAM,sBAAsB;EAExC,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;GAAE,MAAM;GAAW,IAAI,WAAW,EAAE;EAAE,GACtC,KACA,WAAW,UAAU,CACvB;EACA,OAAO,SAAS,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CAAC;CAC1D;CACA,OAAO,aAAa,MAAM;AAC5B,CAAC;AAEH,MAAa,oBAA4B,YAAY,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAE/F,SAAS,YAAY,OAAwC;CAC3D,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACjF;AAEA,SAAS,WAAW,OAAwC;CAC1D,MAAM,aAAa,MAAM,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;CACjE,MAAM,SAAS,aAAa,IAAI,QAAQ,IAAK,WAAW,SAAS,KAAM,CAAC;CACxE,MAAM,SAAS,KAAK,MAAM;CAC1B,OAAO,WAAW,KAAK,SAAS,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE"}