domainkit 0.8.0 → 0.9.0

package/dist/verify-DvGPb5C9.mjs

@@ -1,2402 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { A as Error$1, D as decode$5, E as Schema$2, b as assertAttachment, c as Evidence$1, d as codec, k as parse$1, p as AuthorizationError, s as Service$1, x as authorizationError } from "./canonical-json-CQYKsZw7.mjs";
-import { n as Method$1, t as Error$2 } from "./connect-oI8hcMxc.mjs";
-import { C as authorize$1, I as Error$3, L as Service$3, R as fromAsync$1, V as toAsync$4, Y as Opaque, i as Service$2, it as equals, n as Error$4, nt as decode$6, o as toAsync$5, r as Resolution$1, tt as data, ut as candidates } from "./resolver-BeGz1ukw.mjs";
-import { Clock, Context, Crypto, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
-import * as oauth from "oauth4webapi";
-import * as DnsPacket from "@leichtgewicht/dns-packet";
-//#region package.json
-var version = "0.8.0";
-//#endregion
-//#region src/auth/diagnostic.ts
-var diagnostic_exports = /* @__PURE__ */ __exportAll({
-	Category: () => Category,
-	Fields: () => Fields,
-	RetryAdvice: () => RetryAdvice,
-	from: () => from
-});
-const Category = Schema.Literals([
-	"authorization",
-	"configuration",
-	"provider",
-	"storage",
-	"validation"
-]);
-const RetryAdvice = Schema.Literals([
-	"never",
-	"after-user-action",
-	"safe",
-	"unknown"
-]);
-const Fields = {
-	category: Category,
-	message: Schema.String,
-	operation: Schema.String,
-	retry: RetryAdvice
-};
-function from(error) {
-	return {
-		category: error.category,
-		message: error.message,
-		operation: error.operation,
-		retry: error.retry,
-		tag: error._tag
-	};
-}
-//#endregion
-//#region src/auth/manifest.ts
-var manifest_exports = /* @__PURE__ */ __exportAll({
-	Method: () => Method,
-	Schema: () => Schema$1,
-	decode: () => decode$4
-});
-const MethodSchema = Schema.TaggedUnion({
-	integration: {
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		installUrl: Schema.String,
-		tokenEndpoint: Schema.String
-	},
-	oauth2: {
-		authorizationServer: Schema.Struct({
-			authorization_endpoint: Schema.String,
-			issuer: Schema.String,
-			revocation_endpoint: Schema.optionalKey(Schema.String),
-			token_endpoint: Schema.String
-		}),
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		clientAuth: Schema.Literals([
-			"none",
-			"client_secret_basic",
-			"client_secret_post"
-		]),
-		scopes: Schema.Array(Schema.String)
-	},
-	token: {
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		instructionsUrl: Schema.String
-	}
-});
-/** Provider authentication method schema and constructors for trusted manifests. */
-const Method = {
-	Schema: MethodSchema,
-	integration: (input) => MethodSchema.cases.integration.make(input),
-	oauth2: (input) => MethodSchema.cases.oauth2.make(input),
-	token: (input) => MethodSchema.cases.token.make(input)
-};
-const Schema$1 = Schema.Struct({
-	methods: Schema.Array(Method.Schema),
-	providerId: Schema.String
-});
-const decode$4 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
-//#endregion
-//#region src/auth/secret.ts
-var secret_exports = /* @__PURE__ */ __exportAll({
-	Value: () => Value,
-	make: () => make$6
-});
-/** A deliberately non-serializable credential value. */
-var Value = class Value {
-	#value;
-	constructor(value) {
-		this.#value = value;
-	}
-	static from(value) {
-		if (value.length === 0) throw new Error("Secret values cannot be empty");
-		return new Value(value);
-	}
-	expose() {
-		return this.#value;
-	}
-	toJSON() {
-		return "[REDACTED]";
-	}
-	toString() {
-		return "[REDACTED]";
-	}
-};
-const make$6 = Value.from;
-//#endregion
-//#region src/discovery/selection.ts
-var selection_exports = /* @__PURE__ */ __exportAll({
-	Evidence: () => Evidence,
-	Selection: () => Selection,
-	select: () => select
-});
-const Evidence = Schema.Struct({
-	accountId: Schema.String,
-	connectionId: Schema.String,
-	decisiveNameserverMatch: Schema.Boolean,
-	matchedNameservers: Schema.Array(Schema$2),
-	providerId: Schema.String,
-	zone: Schema$2
-});
-const SelectionSchema = Schema.TaggedUnion({
-	selected: {
-		candidate: Evidence,
-		evidence: Schema.Array(Evidence),
-		reason: Schema.Literals(["explicit", "unique-nameserver-match"])
-	},
-	manual: {
-		evidence: Schema.Array(Evidence),
-		reason: Schema.Literals(["ambiguous", "unsupported"])
-	}
-});
-/** Provider selection schema and constructors for trusted discovery results. */
-const Selection = {
-	Schema: SelectionSchema,
-	manual: (input) => SelectionSchema.cases.manual.make(input),
-	selected: (input) => SelectionSchema.cases.selected.make(input)
-};
-function select(input) {
-	const domain = parse$1(input.domain);
-	const zoneCandidates = new Set(candidates(domain));
-	const authoritative = nameserverSet(input.authoritativeNameservers);
-	const eligible = input.connectedZones.filter((connected) => {
-		if (!zoneCandidates.has(connected.attachment.target.zoneName)) return false;
-		try {
-			assertAttachment({
-				attachment: connected.attachment,
-				capability: "dns:read",
-				connection: connected.connection,
-				domain,
-				...input.now === void 0 ? {} : { now: input.now },
-				providerId: connected.connection.providerId,
-				authorization: connected.authorization
-			});
-			return true;
-		} catch {
-			return false;
-		}
-	});
-	const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));
-	if (input.explicit !== void 0) {
-		const explicitZone = parse$1(input.explicit.zone);
-		const index = eligible.findIndex((connected) => connected.connection.providerId === input.explicit?.providerId && connected.attachment.target.accountId === input.explicit.accountId && connected.attachment.target.zoneName === explicitZone);
-		if (index < 0) throw authorizationError("Explicit provider zone is not connected for this domain", "ProviderDiscovery.select");
-		const candidate = evidence[index];
-		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
-		return Selection.selected({
-			candidate,
-			evidence,
-			reason: "explicit"
-		});
-	}
-	const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);
-	const candidate = decisive[0];
-	return decisive.length === 1 && candidate !== void 0 ? Selection.selected({
-		candidate,
-		evidence,
-		reason: "unique-nameserver-match"
-	}) : Selection.manual({
-		evidence,
-		reason: decisive.length > 1 ? "ambiguous" : "unsupported"
-	});
-}
-function evidenceFor(connected, authoritative) {
-	const configured = new Set(nameserverSet(connected.nameservers));
-	const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));
-	return {
-		accountId: connected.attachment.target.accountId,
-		connectionId: connected.connection.id,
-		decisiveNameserverMatch: authoritative.length > 0 && matchedNameservers.length === authoritative.length,
-		matchedNameservers,
-		providerId: connected.connection.providerId,
-		zone: connected.attachment.target.zoneName
-	};
-}
-function nameserverSet(nameservers) {
-	return [...new Set(nameservers.map(parse$1))].sort();
-}
-//#endregion
-//#region src/provider/session.ts
-var session_exports = /* @__PURE__ */ __exportAll({
-	Resolution: () => Resolution,
-	fromAsync: () => fromAsync,
-	toAsync: () => toAsync$3
-});
-const Resolution = Data.taggedEnum();
-/** Adapts a Promise-shaped session to the Effect-native session boundary. */
-const fromAsync = (session) => ({
-	providerId: session.providerId,
-	listTargets: (input) => Effect.tryPromise({
-		try: () => session.listTargets(input),
-		catch: (cause) => sessionFailure(session.providerId, "listTargets", cause)
-	}),
-	resolveTarget: (domain) => Effect.tryPromise({
-		try: () => session.resolveTarget(domain),
-		catch: (cause) => sessionFailure(session.providerId, "resolveTarget", cause)
-	}),
-	forTarget: (target) => Effect.tryPromise({
-		try: () => session.forTarget(target),
-		catch: (cause) => sessionFailure(session.providerId, "forTarget", cause)
-	}).pipe(Effect.map(fromAsync$1))
-});
-/** Adapts an Effect-native session to the Promise facade. */
-const toAsync$3 = (session) => ({
-	providerId: session.providerId,
-	listTargets: (input) => Effect.runPromise(session.listTargets(input)),
-	resolveTarget: (domain) => Effect.runPromise(session.resolveTarget(domain)),
-	forTarget: (target) => Effect.runPromise(session.forTarget(target)).then(toAsync$4)
-});
-function sessionFailure(providerId, operation, cause) {
-	return cause instanceof Error$3 ? cause : new Error$3({
-		message: cause instanceof globalThis.Error ? cause.message : String(cause),
-		operation: `ProviderSession.${operation}`,
-		providerId,
-		reason: "transport"
-	});
-}
-//#endregion
-//#region src/plan/connection-authorization.ts
-var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize });
-const authorize = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
-	const aggregate = yield* (yield* Service$1).getByConnectionId(input.connection.id);
-	const storedConnection = aggregate?.connections.find(({ id }) => id === input.connection.id);
-	const storedAttachment = aggregate?.attachments.find(({ id }) => id === input.attachment.id);
-	if (aggregate === null || storedConnection === void 0 || storedAttachment === void 0 || storedConnection.ownerId !== input.connection.ownerId || storedConnection.providerId !== input.connection.providerId || storedConnection.method !== aggregate.authorization.method || storedConnection.authorizationId !== input.authorization.id || storedAttachment.connectionId !== storedConnection.id) return yield* authorizationError("Domain attachment is not owned by the active provider connection", "ConnectionAuthorization.authorize");
-	const domain = yield* Effect.try({
-		try: () => assertAttachment({
-			attachment: storedAttachment,
-			capability: "dns:write",
-			authorization: aggregate.authorization,
-			connection: storedConnection,
-			credential: aggregate.credential,
-			domain: input.domain,
-			providerId: input.plan.providerId
-		}),
-		catch: (cause) => cause instanceof AuthorizationError || cause instanceof Error$1 ? cause : authorizationError("Domain attachment is invalid", "ConnectionAuthorization.authorize")
-	});
-	const authorization = yield* authorize$1(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
-	const selected = new Set(authorization.operationIds);
-	if (input.plan.operations.filter((operation) => operation._tag === "create" && selected.has(operation.id) && operation.requirement.name !== domain && !operation.requirement.name.endsWith(`.${domain}`)).length > 0) return yield* authorizationError(`Plan operations are outside the attached domain ${domain}`, "ConnectionAuthorization.authorize");
-	return authorization;
-});
-//#endregion
-//#region src/auth/authorization-code.ts
-const start = Effect.fn("AuthorizationCode.start")(function* (input) {
-	const crypto = yield* Crypto.Crypto;
-	const codeVerifier = base64Url(yield* randomBytes(crypto, 32));
-	const challenge = base64Url(yield* digest(crypto, codeVerifier));
-	const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);
-	authorizationUrl.search = new URLSearchParams({
-		client_id: input.client.clientId,
-		code_challenge: challenge,
-		code_challenge_method: "S256",
-		redirect_uri: input.redirectUri,
-		response_type: "code",
-		scope: input.method.scopes.join(" "),
-		state: input.state
-	}).toString();
-	return {
-		authorizationUrl,
-		payload: make$6(JSON.stringify({
-			codeVerifier,
-			redirectUri: input.redirectUri,
-			state: input.state
-		}))
-	};
-});
-const complete = Effect.fn("AuthorizationCode.complete")(function* (input) {
-	const payload = yield* decodePayload(input.payload);
-	if (input.callbackUrl.searchParams.get("state") !== payload.state) return yield* failure$6("Authorization callback state does not match its continuation");
-	const server = input.method.authorizationServer;
-	const client = { client_id: input.client.clientId };
-	const authentication = yield* clientAuthentication$1(input.method, input.client);
-	return yield* Effect.tryPromise({
-		try: async (signal) => {
-			const callback = oauth.validateAuthResponse(server, client, input.callbackUrl, payload.state);
-			const response = await oauth.authorizationCodeGrantRequest(server, client, authentication, callback, payload.redirectUri, payload.codeVerifier, requestOptions(input.fetch, signal));
-			return oauth.processAuthorizationCodeResponse(server, client, response);
-		},
-		catch: (cause) => new Error$2({
-			category: "provider",
-			message: cause instanceof globalThis.Error ? cause.name : "OAuth provider request failed",
-			operation: "AuthorizationCode.complete",
-			retry: "unknown"
-		})
-	});
-});
-const PayloadSchema = Schema.Struct({
-	codeVerifier: Schema.String,
-	redirectUri: Schema.String,
-	state: Schema.String
-});
-function decodePayload(payload) {
-	return Schema.decodeUnknownEffect(Schema.fromJsonString(PayloadSchema))(payload.expose()).pipe(Effect.mapError(() => new Error$2({
-		category: "authorization",
-		message: "OAuth continuation payload is invalid",
-		operation: "AuthorizationCode",
-		retry: "after-user-action"
-	})));
-}
-function clientAuthentication$1(method, client) {
-	switch (method.clientAuth) {
-		case "none": return Effect.succeed(oauth.None());
-		case "client_secret_basic": return client.clientSecret === void 0 ? failure$6("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));
-		case "client_secret_post": return client.clientSecret === void 0 ? failure$6("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretPost(client.clientSecret.expose()));
-	}
-}
-function requestOptions(fetchImplementation, signal) {
-	return fetchImplementation === void 0 ? { signal } : {
-		signal,
-		[oauth.customFetch]: (url, options) => fetchImplementation(url, {
-			...options,
-			body: options.body
-		})
-	};
-}
-const failure$6 = (message) => Effect.fail(new Error$2({
-	category: "authorization",
-	message,
-	operation: "AuthorizationCode",
-	retry: "after-user-action"
-}));
-function randomBytes(crypto, size) {
-	return crypto.randomBytes(size).pipe(Effect.mapError((cause) => new Error$2({
-		category: "validation",
-		message: cause.message,
-		operation: "AuthorizationCode.start",
-		retry: "safe"
-	})));
-}
-function digest(crypto, value) {
-	return crypto.digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new Error$2({
-		category: "validation",
-		message: cause.message,
-		operation: "AuthorizationCode.start",
-		retry: "safe"
-	})));
-}
-function base64Url(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-//#endregion
-//#region src/providers/cloudflare/protocol.ts
-const ErrorDetail$1 = Schema.Struct({
-	code: Schema.Number,
-	message: Schema.String
-});
-const ResultInfo = Schema.Struct({
-	count: Schema.optionalKey(Schema.Number),
-	page: Schema.optionalKey(Schema.Number),
-	per_page: Schema.optionalKey(Schema.Number),
-	total_count: Schema.optionalKey(Schema.Number),
-	total_pages: Schema.optionalKey(Schema.Number)
-});
-const Message = Schema.Struct({
-	code: Schema.optionalKey(Schema.Number),
-	message: Schema.String
-});
-const BaseEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail$1),
-	messages: Schema.Array(Message),
-	success: Schema.Boolean
-});
-const Account = Schema.Struct({
-	id: Schema.String,
-	name: Schema.String
-});
-const Zone = Schema.Struct({
-	account: Account,
-	id: Schema.String,
-	name: Schema.String,
-	name_servers: Schema.Array(Schema.String),
-	status: Schema.optionalKey(Schema.String),
-	type: Schema.optionalKey(Schema.Literals([
-		"full",
-		"partial",
-		"secondary",
-		"internal"
-	]))
-});
-const Record$1 = Schema.Struct({
-	content: Schema.optionalKey(Schema.String),
-	data: Schema.optionalKey(Schema.Unknown),
-	id: Schema.String,
-	name: Schema.String,
-	priority: Schema.optionalKey(Schema.Number),
-	proxied: Schema.optionalKey(Schema.Boolean),
-	ttl: Schema.Number,
-	type: Schema.String
-});
-const Token = Schema.Struct({
-	expires_on: Schema.optionalKey(Schema.String),
-	id: Schema.String,
-	not_before: Schema.optionalKey(Schema.String),
-	status: Schema.Literals([
-		"active",
-		"disabled",
-		"expired"
-	])
-});
-const ZoneListEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail$1),
-	messages: Schema.Array(Message),
-	result: Schema.Array(Zone),
-	result_info: Schema.optionalKey(ResultInfo),
-	success: Schema.Boolean
-});
-const RecordListEnvelope$1 = Schema.Struct({
-	errors: Schema.Array(ErrorDetail$1),
-	messages: Schema.Array(Message),
-	result: Schema.Array(Record$1),
-	result_info: Schema.optionalKey(ResultInfo),
-	success: Schema.Boolean
-});
-const RecordEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail$1),
-	messages: Schema.Array(Message),
-	result: Record$1,
-	success: Schema.Boolean
-});
-const TokenEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail$1),
-	messages: Schema.Array(Message),
-	result: Token,
-	success: Schema.Boolean
-});
-//#endregion
-//#region src/providers/cloudflare/records.ts
-const Data$1 = Schema.Struct({
-	flags: Schema.optionalKey(Schema.Number),
-	port: Schema.optionalKey(Schema.Number),
-	priority: Schema.optionalKey(Schema.Number),
-	tag: Schema.optionalKey(Schema.String),
-	target: Schema.optionalKey(Schema.String),
-	value: Schema.optionalKey(Schema.String),
-	weight: Schema.optionalKey(Schema.Number)
-});
-const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(function* () {
-	const name = yield* decode$5(record.name).pipe(Effect.match({
-		onFailure: () => null,
-		onSuccess: (value) => value
-	}));
-	if (name === null) return yield* decodeOpaque$1(record);
-	const common = {
-		metadata: {
-			ownership: "provider",
-			provenance: record.proxied === true ? "cloudflare:proxied" : "cloudflare",
-			purpose: "existing DNS record"
-		},
-		name,
-		policy: record.type === "CNAME" ? "exclusive" : "append",
-		ttl: record.ttl === 1 ? null : record.ttl
-	};
-	const content = () => record.content === void 0 ? Effect.fail(failure$5("decodeRecord", `Cloudflare ${record.type} record has no content`)) : Effect.succeed(record.content);
-	switch (record.type) {
-		case "A":
-		case "AAAA": return yield* decode$6({
-			...common,
-			_tag: record.type,
-			address: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		case "CNAME":
-		case "NS": return yield* decode$6({
-			...common,
-			_tag: record.type,
-			target: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		case "TXT": return yield* decode$6({
-			...common,
-			_tag: "TXT",
-			value: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		case "MX": return yield* decode$6({
-			...common,
-			_tag: "MX",
-			exchange: yield* content(),
-			priority: record.priority
-		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		case "CAA": {
-			const data = yield* decodeData(record);
-			return yield* decode$6({
-				...common,
-				_tag: "CAA",
-				...data
-			}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		}
-		case "SRV": {
-			const data = yield* decodeData(record);
-			return yield* decode$6({
-				...common,
-				_tag: "SRV",
-				...data
-			}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		}
-		default: return yield* decodeOpaque$1(record);
-	}
-}));
-const decodeOpaque$1 = Effect.fn("CloudflareRecords.decodeOpaque")((record) => Schema.decodeUnknownEffect(Opaque.Schema)({
-	_tag: "Opaque",
-	name: record.name,
-	providerRecordId: record.id,
-	providerType: record.type
-}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message))));
-function encode$1(record) {
-	const common = {
-		name: record.name,
-		proxied: false,
-		ttl: record.ttl ?? 1,
-		type: record._tag
-	};
-	switch (record._tag) {
-		case "A":
-		case "AAAA": return {
-			...common,
-			content: record.address
-		};
-		case "CNAME":
-		case "NS": return {
-			...common,
-			content: record.target
-		};
-		case "TXT": return {
-			...common,
-			content: record.value
-		};
-		case "MX": return {
-			...common,
-			content: record.exchange,
-			priority: record.priority
-		};
-		case "CAA": return {
-			...common,
-			data: {
-				flags: record.flags,
-				tag: record.tag,
-				value: record.value
-			}
-		};
-		case "SRV": return {
-			...common,
-			data: {
-				port: record.port,
-				priority: record.priority,
-				target: record.target,
-				weight: record.weight
-			}
-		};
-	}
-}
-const decodeData = Effect.fn("CloudflareRecords.decodeData")((record) => Schema.decodeUnknownEffect(Data$1)(record.data).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message))));
-function failure$5(operation, message, fields = {}) {
-	return new Error$3({
-		message,
-		operation,
-		providerId: "cloudflare",
-		reason: fields.reason ?? "response"
-	});
-}
-//#endregion
-//#region src/providers/cloudflare/client.ts
-var client_exports$1 = /* @__PURE__ */ __exportAll({
-	discoverAuthorizationAccount: () => discoverAuthorizationAccount,
-	discovery: () => discovery$1,
-	make: () => make$5,
-	validateDomainToken: () => validateDomainToken
-});
-/** Exposes Cloudflare zone lookup as the optional provider discovery capability. */
-function discovery$1(client) {
-	return {
-		listZones: (name) => client.listZones({ name }).pipe(Effect.map((zones) => zones.map((zone) => ({
-			...zone,
-			status: zone.status === "active" || zone.status === "pending" ? zone.status : "unknown"
-		})))),
-		provider: client
-	};
-}
-const makeTransport = (options) => {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "");
-	const request = Effect.fn("CloudflareClient.request")((path, operation, init) => Effect.gen(function* () {
-		const response = yield* Effect.tryPromise({
-			try: () => fetch(`${baseUrl}${path}`, {
-				...init,
-				headers: {
-					Accept: "application/json",
-					Authorization: `Bearer ${options.token.expose()}`,
-					...init?.body === void 0 ? {} : { "Content-Type": "application/json" },
-					...init?.headers
-				}
-			}),
-			catch: () => failure$4(operation, "Cloudflare request failed", { reason: "transport" })
-		});
-		return {
-			body: yield* Effect.tryPromise({
-				try: () => response.json(),
-				catch: () => {
-					const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-					return failure$4(operation, response.ok ? "Cloudflare returned a non-JSON response" : `Cloudflare request failed with HTTP ${response.status}`, {
-						reason: response.ok ? "response" : reason$1(response.status),
-						...retryAfterMs === void 0 ? {} : { retryAfterMs },
-						status: response.status
-					});
-				}
-			}),
-			response
-		};
-	}));
-	const listZonesPage = Effect.fn("CloudflareClient.listZonesPage")((accountId, name, page) => Effect.gen(function* () {
-		const query = new URLSearchParams({
-			page: String(page),
-			per_page: "50"
-		});
-		query.set("type", "full,partial,secondary,internal");
-		if (accountId !== void 0) query.set("account.id", accountId);
-		if (name !== void 0) query.set("name", name);
-		const { body, response } = yield* request(`/zones?${query}`, "listZones");
-		yield* ensureSuccess(body, "listZones", response);
-		return yield* decode$2(ZoneListEnvelope, body, "listZones", response);
-	}));
-	return {
-		allZones: Effect.fn("CloudflareClient.allZones")((accountId, name) => Effect.gen(function* () {
-			const zones = [];
-			let page = 1;
-			while (true) {
-				const envelope = yield* listZonesPage(accountId, name, page);
-				zones.push(...envelope.result);
-				const totalPages = envelope.result_info?.total_pages;
-				if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 50) return zones;
-				page += 1;
-			}
-		})),
-		inspectToken: Effect.fn("CloudflareClient.inspectToken")((path) => Effect.gen(function* () {
-			const { body, response } = yield* request(path, "validateToken");
-			yield* ensureSuccess(body, "validateToken", response);
-			const envelope = yield* decode$2(TokenEnvelope, body, "validateToken", response);
-			if (envelope.result.status !== "active") return yield* Effect.fail(failure$4("validateToken", `Cloudflare token is ${envelope.result.status}`, {
-				reason: "authentication",
-				status: response.status
-			}));
-			const expiresAt = envelope.result.expires_on === void 0 ? null : new Date(envelope.result.expires_on);
-			if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) return yield* Effect.fail(failure$4("validateToken", "Cloudflare token expiry is not a valid timestamp", {
-				reason: "response",
-				status: response.status
-			}));
-			return expiresAt;
-		})),
-		request
-	};
-};
-const discoverAccount = Effect.fn("CloudflareClient.discoverAccount")((options) => Effect.gen(function* () {
-	const { allZones } = makeTransport(options);
-	for (const candidate of candidates(options.domain)) {
-		const matches = yield* allZones(void 0, candidate);
-		const match = matches[0];
-		if (matches.length === 0) continue;
-		if (matches.length === 1 && match !== void 0) return match.account;
-		return yield* Effect.fail(failure$4("discoverAccount", `Cloudflare returned multiple accessible zones named ${candidate}`, { reason: "conflict" }));
-	}
-	return yield* Effect.fail(failure$4("discoverAccount", `Cloudflare did not expose an accessible zone for ${options.domain}`, { reason: "not_found" }));
-}));
-const discoverAuthorizationAccount = discoverAccount;
-const validateDomainToken = Effect.fn("CloudflareClient.validateDomainToken")((options) => Effect.gen(function* () {
-	const transport = makeTransport(options);
-	const account = options.tokenKind === "account" ? yield* discoverAccount(options) : void 0;
-	const expiresAt = yield* transport.inspectToken(account === void 0 ? "/user/tokens/verify" : `/accounts/${encodeURIComponent(account.id)}/tokens/verify`);
-	return {
-		accountId: (account ?? (yield* discoverAccount(options))).id,
-		capabilities: options.capabilities,
-		expiresAt,
-		scopes: []
-	};
-}));
-/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
-function make$5(options) {
-	return makeClient$1(options);
-}
-function makeClient$1(options) {
-	const { allZones, inspectToken, request } = makeTransport(options);
-	const resolveZone = Effect.fn("CloudflareClient.resolveZone")((name) => Effect.gen(function* () {
-		if (options.target !== void 0) {
-			if (name !== options.target.zoneName && !name.endsWith(`.${options.target.zoneName}`)) return yield* Effect.fail(failure$4("resolveZone", `Cloudflare target ${options.target.zoneName} does not cover ${name}`, { reason: "not_found" }));
-			return {
-				account: {
-					id: options.target.accountId,
-					name: options.target.accountId
-				},
-				id: options.target.zoneId,
-				name: options.target.zoneName,
-				name_servers: options.target.evidence?.nameservers ?? []
-			};
-		}
-		const matches = yield* allZones(options.accountId, name);
-		const match = matches[0];
-		if (matches.length === 1 && match !== void 0) return match;
-		return yield* Effect.fail(failure$4("resolveZone", matches.length === 0 ? options.accountId === void 0 ? `Cloudflare zone ${name} was not found in the authorized accounts` : `Cloudflare zone ${name} was not found in account ${options.accountId}` : options.accountId === void 0 ? `Cloudflare returned multiple zones named ${name} across authorized accounts` : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`, { reason: matches.length === 0 ? "not_found" : "response" }));
-	}));
-	const listRecords = Effect.fn("CloudflareClient.listRecords")((zoneName) => Effect.gen(function* () {
-		const zone = yield* resolveZone(zoneName);
-		const records = [];
-		let page = 1;
-		while (true) {
-			const query = new URLSearchParams({
-				page: String(page),
-				per_page: "100"
-			});
-			const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records?${query}`, "listRecords");
-			yield* ensureSuccess(body, "listRecords", response);
-			const envelope = yield* decode$2(RecordListEnvelope$1, body, "listRecords", response);
-			records.push(...yield* Effect.forEach(envelope.result, decode$3));
-			const totalPages = envelope.result_info?.total_pages;
-			if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 100) return records;
-			page += 1;
-		}
-	}));
-	const createRecord = Effect.fn("CloudflareClient.createRecord")((zoneName, record) => Effect.gen(function* () {
-		const zone = yield* resolveZone(zoneName);
-		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records`, "createRecord", {
-			body: JSON.stringify(encode$1(record)),
-			method: "POST"
-		});
-		yield* ensureSuccess(body, "createRecord", response);
-		return { providerRecordId: (yield* decode$2(RecordEnvelope, body, "createRecord", response)).result.id };
-	}));
-	const getRecord = Effect.fn("CloudflareClient.getRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-		const zone = yield* resolveZone(zoneName);
-		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "getRecord");
-		if (response.status === 404) return null;
-		yield* ensureSuccess(body, "getRecord", response);
-		const envelope = yield* decode$2(RecordEnvelope, body, "getRecord", response);
-		return yield* decode$3(envelope.result);
-	}));
-	const deleteRecord = Effect.fn("CloudflareClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-		const zone = yield* resolveZone(zoneName);
-		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "deleteRecord", { method: "DELETE" });
-		yield* ensureSuccess(body, "deleteRecord", response);
-	}));
-	const listAccounts = Effect.fn("CloudflareClient.listAccounts")(() => allZones().pipe(Effect.map((zones) => {
-		const accounts = /* @__PURE__ */ new Map();
-		for (const zone of zones) accounts.set(zone.account.id, zone.account);
-		return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));
-	})));
-	const listZones = Effect.fn("CloudflareClient.listZones")((input = {}) => allZones(input.accountId ?? options.accountId, input.name).pipe(Effect.flatMap((zones) => Effect.forEach(zones, projectZone$1))));
-	const listTargets = Effect.fn("CloudflareClient.listTargets")((input = {}) => Effect.gen(function* () {
-		const names = input.domain === void 0 ? void 0 : new Set(candidates(input.domain).map((name) => String(name)));
-		const zones = yield* allZones(input.accountId ?? options.accountId);
-		return yield* Effect.forEach(zones.filter((zone) => zone.type !== "internal" && (names === void 0 || names.has(zone.name))), targetFromZone);
-	}));
-	return {
-		id: "cloudflare",
-		providerId: "cloudflare",
-		createRecord,
-		deleteRecord,
-		getRecord,
-		listAccounts,
-		listRecords,
-		listZones,
-		listTargets,
-		resolveTarget: Effect.fn("CloudflareClient.resolveTarget")((domain) => Effect.gen(function* () {
-			const candidates$2 = yield* listTargets({ domain });
-			for (const zoneName of candidates(domain)) {
-				const matches = candidates$2.filter((target) => target.zoneName === zoneName);
-				if (matches.length === 1) {
-					const target = matches[0];
-					if (target !== void 0) return Resolution.Resolved({ target });
-				}
-				if (matches.length > 1) return Resolution.SelectionRequired({ candidates: matches });
-			}
-			return Resolution.NotFound({ domain });
-		})),
-		forTarget: Effect.fn("CloudflareClient.forTarget")((target) => Effect.gen(function* () {
-			if (target.accountKind !== null && target.accountKind !== "account") return yield* Effect.fail(failure$4("forTarget", "Cloudflare targets must use the account account kind", { reason: "request" }));
-			if (target.evidence?.zoneType === "internal") return yield* Effect.fail(failure$4("forTarget", "Cloudflare internal zones cannot host managed DNS records", { reason: "unsupported" }));
-			const selected = (yield* listTargets({
-				accountId: target.accountId,
-				domain: target.zoneName
-			})).find((candidate) => candidate.accountId === target.accountId && candidate.zoneId === target.zoneId && candidate.zoneName === target.zoneName);
-			if (selected === void 0) return yield* Effect.fail(failure$4("forTarget", `Cloudflare target ${target.zoneName} is not visible to this credential`, { reason: "authorization" }));
-			if (selected.evidence?.zoneType === "internal") return yield* Effect.fail(failure$4("forTarget", "Cloudflare internal zones cannot host managed DNS records", { reason: "unsupported" }));
-			const client = makeClient$1({
-				...options,
-				accountId: selected.accountId,
-				target: selected
-			});
-			return {
-				id: client.id,
-				createRecord: client.createRecord,
-				deleteRecord: client.deleteRecord,
-				getRecord: client.getRecord,
-				listRecords: client.listRecords
-			};
-		})),
-		validateToken: Effect.fn("CloudflareClient.validateToken")(() => Effect.gen(function* () {
-			const path = options.tokenKind === "account" ? options.accountId === void 0 ? yield* Effect.fail(failure$4("validateToken", "Cloudflare account tokens require an account ID", { reason: "request" })) : `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify` : "/user/tokens/verify";
-			const expiresAt = yield* inspectToken(path);
-			yield* allZones(options.accountId);
-			return {
-				accountId: options.accountId ?? "",
-				capabilities: options.capabilities,
-				expiresAt,
-				scopes: []
-			};
-		}))
-	};
-}
-const targetFromZone = Effect.fn("CloudflareClient.targetFromZone")((zone) => Effect.gen(function* () {
-	const name = yield* decode$5(zone.name).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" }))));
-	return {
-		accountId: zone.account.id,
-		accountKind: "account",
-		evidence: {
-			accountName: zone.account.name,
-			nameservers,
-			status: zone.status ?? "unknown",
-			zoneType: zone.type ?? "unknown"
-		},
-		zoneId: zone.id,
-		zoneName: name
-	};
-}));
-const projectZone$1 = Effect.fn("CloudflareClient.projectZone")((zone) => Effect.gen(function* () {
-	const name = yield* decode$5(zone.name).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" }))));
-	return {
-		accountId: zone.account.id,
-		id: zone.id,
-		name,
-		nameservers,
-		status: zone.status ?? null
-	};
-}));
-function decode$2(schema, input, operation, response) {
-	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$4(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {
-		reason: "response",
-		status: response.status
-	})));
-}
-function ensureSuccess(input, operation, response) {
-	return Schema.decodeUnknownEffect(BaseEnvelope)(input).pipe(Effect.mapError(() => failure$4(operation, "Cloudflare response did not contain a valid API envelope", {
-		reason: "response",
-		status: response.status
-	})), Effect.flatMap((envelope) => {
-		if (response.ok && envelope.success) return Effect.void;
-		const detail = envelope.errors[0];
-		const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-		return Effect.fail(failure$4(operation, detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`, {
-			...detail === void 0 ? {} : { code: detail.code },
-			reason: reason$1(response.status, detail?.code),
-			...retryAfterMs === void 0 ? {} : { retryAfterMs },
-			status: response.status
-		}));
-	}));
-}
-function reason$1(status, code) {
-	if (status === 401) return "authentication";
-	if (status === 403) return "authorization";
-	if (status === 404) return "not_found";
-	if (status === 409 || code === 81056 || code === 81057 || code === 81058) return "conflict";
-	if (status === 429) return "rate_limit";
-	if (status >= 500) return "response";
-	return "request";
-}
-function retryAfter(value) {
-	if (value === null) return void 0;
-	const seconds = Number(value);
-	if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
-	const date = Date.parse(value);
-	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
-}
-function failure$4(operation, message, fields = {}) {
-	return new Error$3({
-		...fields,
-		message,
-		operation,
-		providerId: "cloudflare"
-	});
-}
-//#endregion
-//#region src/providers/cloudflare/auth.ts
-var auth_exports$1 = /* @__PURE__ */ __exportAll({
-	contextCodec: () => contextCodec$1,
-	manifest: () => manifest$1,
-	oauthAuthentication: () => oauthAuthentication,
-	oauthFlow: () => oauthFlow,
-	oauthMethod: () => oauthMethod,
-	refreshCredential: () => refreshCredential,
-	restore: () => restore$1,
-	subjectResolver: () => subjectResolver,
-	tokenConnectionMethod: () => tokenConnectionMethod$1,
-	tokenMethod: () => tokenMethod$1,
-	tokenValidator: () => tokenValidator
-});
-const authorizationServer = {
-	authorization_endpoint: "https://dash.cloudflare.com/oauth2/auth",
-	issuer: "https://dash.cloudflare.com",
-	revocation_endpoint: "https://dash.cloudflare.com/oauth2/revoke",
-	token_endpoint: "https://dash.cloudflare.com/oauth2/token"
-};
-const Context$2 = Schema.Struct({
-	accountId: Schema.optionalKey(Schema.String),
-	tokenKind: Schema.Literals(["account", "user"])
-});
-const contextCodec$1 = codec("cloudflare.v1", Context$2);
-/** Describes Cloudflare's caller-created API-token authorization method. */
-function tokenMethod$1(capabilities) {
-	return Method.token({
-		capabilities: [...capabilities],
-		instructionsUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/"
-	});
-}
-/** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */
-function oauthMethod(options) {
-	return Method.oauth2({
-		authorizationServer,
-		capabilities: [...options.capabilities],
-		clientAuth: options.clientAuth,
-		scopes: [...options.scopes]
-	});
-}
-/** Creates the Cloudflare token and OAuth authorization manifest. */
-function manifest$1(options) {
-	return {
-		methods: [tokenMethod$1(options.capabilities), oauthMethod(options)],
-		providerId: "cloudflare"
-	};
-}
-/** Resolves the Cloudflare account selected by a completed OAuth authorization. */
-function subjectResolver(options) {
-	return (tokens, accessToken) => Effect.gen(function* () {
-		const accountId = options.accountId ?? (yield* discoverAuthorizationAccount({
-			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-			domain: options.domain,
-			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			token: accessToken
-		}).pipe(Effect.map((account) => account.id)));
-		if (options.accountId !== void 0) yield* make$5({
-			accountId: options.accountId,
-			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-			capabilities: options.capabilities,
-			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			token: accessToken,
-			tokenKind: "user"
-		}).listZones();
-		const now = yield* Clock.currentTimeMillis;
-		return {
-			accountId,
-			expiresAt: typeof tokens.expires_in === "number" ? new Date(now + tokens.expires_in * 1e3) : null
-		};
-	});
-}
-/** Creates a host callback that validates a Cloudflare API token. */
-function tokenValidator(options) {
-	return (token) => options.accountId === void 0 ? validateDomainToken({
-		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-		capabilities: options.capabilities,
-		domain: options.domain,
-		...options.fetch === void 0 ? {} : { fetch: options.fetch },
-		token,
-		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
-	}) : make$5({
-		accountId: options.accountId,
-		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-		capabilities: options.capabilities,
-		...options.fetch === void 0 ? {} : { fetch: options.fetch },
-		token,
-		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
-	}).validateToken();
-}
-/** Creates a provider-independent token connection method backed by Cloudflare validation. */
-function tokenConnectionMethod$1(options) {
-	const requiredCapabilities = [...options.capabilities];
-	return Method$1.Token({
-		authenticate: Effect.fn("CloudflareAuth.authenticateToken")(function* (token) {
-			const validated = yield* tokenValidator(options)(token);
-			const observedAt = new Date(yield* Clock.currentTimeMillis);
-			return {
-				capabilityEvidence: validated.capabilities.map((capability) => ({
-					capability,
-					evidence: Evidence$1.Introspected({ observedAt })
-				})),
-				credential: {
-					accessToken: token,
-					expiresAt: validated.expiresAt,
-					refreshToken: null,
-					tokenType: "bearer"
-				},
-				providerAccountId: validated.accountId,
-				providerContext: yield* contextCodec$1.encode(options.tokenKind === "account" ? {
-					accountId: validated.accountId,
-					tokenKind: "account"
-				} : { tokenKind: "user" }),
-				scopes: [...validated.scopes]
-			};
-		}),
-		providerId: "cloudflare",
-		requiredCapabilities,
-		token: options.token
-	});
-}
-/** Converts a completed Cloudflare OAuth authorization into canonical connection authentication. */
-const oauthAuthentication = Effect.fn("CloudflareAuth.oauthAuthentication")(function* (options) {
-	const resolved = yield* subjectResolver(options)(options.tokens, options.accessToken);
-	const observedAt = new Date(yield* Clock.currentTimeMillis);
-	return {
-		capabilityEvidence: options.capabilities.map((capability) => ({
-			capability,
-			evidence: Evidence$1.Introspected({ observedAt })
-		})),
-		credential: {
-			accessToken: options.accessToken,
-			expiresAt: resolved.expiresAt,
-			refreshToken: options.tokens.refresh_token === void 0 ? null : Value.from(options.tokens.refresh_token),
-			tokenType: options.tokens.token_type
-		},
-		providerAccountId: resolved.accountId,
-		providerContext: yield* contextCodec$1.encode({ tokenKind: "user" }),
-		scopes: (options.tokens.scope ?? "").split(" ").filter(Boolean)
-	};
-});
-/** Restore a credential-scoped Cloudflare session from persisted authorization state. */
-function restore$1(options) {
-	return Effect.gen(function* () {
-		if (options.authorization.providerId !== "cloudflare") return yield* Effect.fail(failure$3("restore", "Provider authorization belongs to another provider", "authorization"));
-		if (options.authorization.method === "integration") return yield* Effect.fail(failure$3("restore", "Cloudflare does not support integration credentials", "unsupported"));
-		if (options.authorization.revocation._tag !== "Active") return yield* Effect.fail(failure$3("restore", "Cloudflare authorization is pending revocation", "authorization"));
-		const missingCapability = options.authorization.requiredCapabilities.find((capability) => !options.authorization.capabilityEvidence.some((item) => item.capability === capability));
-		if (missingCapability !== void 0) return yield* Effect.fail(failure$3("restore", `Cloudflare authorization lacks evidence for ${missingCapability}`, "authorization"));
-		if (options.credential.expiresAt !== null && (Number.isNaN(options.credential.expiresAt.valueOf()) || options.credential.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure$3("restore", "Cloudflare authorization has expired", "authentication"));
-		const context = yield* contextCodec$1.decode(options.authorization.providerContext).pipe(Effect.mapError((cause) => failure$3("restore", cause.message, "response")));
-		return make$5({
-			...context.accountId === void 0 ? {} : { accountId: context.accountId },
-			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-			capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),
-			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			token: options.credential.accessToken,
-			tokenKind: context.tokenKind
-		});
-	});
-}
-/** Exchanges a Cloudflare refresh token for a fresh provider credential. */
-const refreshCredential = Effect.fn("CloudflareAuth.refreshCredential")(function* (options) {
-	if (options.credential.refreshToken === null) return yield* new Error$2({
-		category: "authorization",
-		message: "Cloudflare credential has no refresh token",
-		operation: "CloudflareAuth.refreshCredential",
-		retry: "after-user-action"
-	});
-	const refreshToken = options.credential.refreshToken;
-	const client = { client_id: options.client.clientId };
-	const authentication = yield* Effect.try({
-		try: () => clientAuthentication(options.clientAuth, options.client),
-		catch: () => new Error$2({
-			category: "authorization",
-			message: "Cloudflare OAuth client authentication is invalid",
-			operation: "CloudflareAuth.refreshCredential",
-			retry: "never"
-		})
-	});
-	const fetch = options.fetch;
-	const tokens = yield* Effect.tryPromise({
-		try: async (signal) => {
-			const request = await oauth.refreshTokenGrantRequest(authorizationServer, client, authentication, refreshToken.expose(), fetch === void 0 ? { signal } : {
-				signal,
-				[oauth.customFetch]: (url, init) => fetch(url, {
-					...init,
-					body: init.body
-				})
-			});
-			return oauth.processRefreshTokenResponse(authorizationServer, client, request);
-		},
-		catch: (cause) => refreshFailure(cause)
-	});
-	const now = yield* Clock.currentTimeMillis;
-	return {
-		accessToken: Value.from(tokens.access_token),
-		expiresAt: typeof tokens.expires_in === "number" ? new Date(now + tokens.expires_in * 1e3) : null,
-		refreshToken: tokens.refresh_token === void 0 ? refreshToken : Value.from(tokens.refresh_token),
-		tokenType: tokens.token_type
-	};
-});
-/** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */
-function oauthFlow(options) {
-	const method = oauthMethod({
-		capabilities: options.capabilities,
-		clientAuth: options.clientAuth,
-		scopes: options.scopes
-	});
-	return {
-		complete: Effect.fn("CloudflareAuth.oauthFlow.complete")(function* (payload, callbackUrl) {
-			const tokens = yield* complete({
-				callbackUrl,
-				client: options.client,
-				...options.fetch === void 0 ? {} : { fetch: options.fetch },
-				method,
-				payload,
-				providerId: "cloudflare"
-			});
-			return yield* oauthAuthentication({
-				...options.accountId === void 0 ? { domain: options.domain } : { accountId: options.accountId },
-				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-				capabilities: options.capabilities,
-				...options.fetch === void 0 ? {} : { fetch: options.fetch },
-				accessToken: make$6(tokens.access_token),
-				tokens
-			});
-		}),
-		method: "oauth2",
-		providerId: "cloudflare",
-		requiredCapabilities: [...options.capabilities],
-		start: (continuationId) => start({
-			client: options.client,
-			method,
-			redirectUri: options.redirectUri,
-			state: continuationId
-		})
-	};
-}
-function failure$3(operation, message, reason) {
-	return new Error$3({
-		message,
-		operation,
-		providerId: "cloudflare",
-		reason
-	});
-}
-function clientAuthentication(method, client) {
-	if (method === "none") return oauth.None();
-	if (client.clientSecret === void 0) throw new Error("Client secret is required");
-	return method === "client_secret_basic" ? oauth.ClientSecretBasic(client.clientSecret.expose()) : oauth.ClientSecretPost(client.clientSecret.expose());
-}
-function refreshFailure(cause) {
-	if (cause instanceof oauth.ResponseBodyError && ["invalid_client", "invalid_grant"].includes(cause.error)) return new Error$2({
-		category: "authorization",
-		message: "Cloudflare authorization can no longer be refreshed",
-		operation: "CloudflareAuth.refreshCredential",
-		retry: "after-user-action"
-	});
-	return failure$3("refreshCredential", cause instanceof Error ? cause.message : "Cloudflare token refresh failed", cause instanceof oauth.ResponseBodyError ? "response" : "transport");
-}
-//#endregion
-//#region src/providers/vercel/protocol.ts
-const Pagination = Schema.Struct({
-	count: Schema.Number,
-	next: Schema.NullOr(Schema.Number),
-	prev: Schema.NullOr(Schema.Number)
-});
-const ErrorDetail = Schema.Struct({
-	code: Schema.String,
-	message: Schema.String,
-	limit: Schema.optionalKey(Schema.Struct({
-		remaining: Schema.Number,
-		reset: Schema.optionalKey(Schema.Number),
-		resetMs: Schema.optionalKey(Schema.Number),
-		total: Schema.Number
-	}))
-});
-const ErrorEnvelope = Schema.Struct({ error: ErrorDetail });
-const User = Schema.Struct({
-	id: Schema.String,
-	name: Schema.NullOr(Schema.String),
-	username: Schema.String
-});
-const UserEnvelope = Schema.Struct({ user: User });
-const Team = Schema.Struct({
-	id: Schema.String,
-	name: Schema.NullOr(Schema.String),
-	slug: Schema.String
-});
-const TeamListEnvelope = Schema.Struct({
-	pagination: Pagination,
-	teams: Schema.Array(Team)
-});
-const Domain = Schema.Struct({
-	id: Schema.String,
-	intendedNameservers: Schema.Array(Schema.String),
-	name: Schema.String,
-	nameservers: Schema.Array(Schema.String),
-	serviceType: Schema.Literals([
-		"zeit.world",
-		"external",
-		"na"
-	]),
-	teamId: Schema.NullOr(Schema.String),
-	userId: Schema.String,
-	verified: Schema.Boolean,
-	zone: Schema.optionalKey(Schema.Boolean)
-});
-const DomainConfig = Schema.Struct({
-	misconfigured: Schema.Boolean,
-	serviceType: Schema.Literals([
-		"zeit.world",
-		"external",
-		"na"
-	])
-});
-const DomainEnvelope = Schema.Struct({ domain: Domain });
-const DomainListEnvelope = Schema.Struct({
-	domains: Schema.Array(Domain),
-	pagination: Pagination
-});
-const Record = Schema.Struct({
-	id: Schema.String,
-	mxPriority: Schema.optionalKey(Schema.Number),
-	name: Schema.String,
-	priority: Schema.optionalKey(Schema.Number),
-	ttl: Schema.optionalKey(Schema.Number),
-	type: Schema.String,
-	value: Schema.String
-});
-const RecordListEnvelope = Schema.Struct({
-	pagination: Schema.optionalKey(Pagination),
-	records: Schema.Array(Record)
-});
-const CreateRecordEnvelope = Schema.Struct({
-	uid: Schema.String,
-	updated: Schema.optionalKey(Schema.Number)
-});
-const IntegrationToken = Schema.Struct({
-	access_token: Schema.String,
-	installation_id: Schema.optionalKey(Schema.String),
-	team_id: Schema.NullOr(Schema.String),
-	token_type: Schema.optionalKey(Schema.String),
-	user_id: Schema.String
-});
-//#endregion
-//#region src/providers/vercel/records.ts
-const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(function* () {
-	const absolute = absoluteNameCandidate(zone, record.name);
-	const name = yield* decode$5(absolute).pipe(Effect.match({
-		onFailure: () => null,
-		onSuccess: (value) => value
-	}));
-	if (name === null) return yield* decodeOpaque(record, absolute);
-	const common = {
-		metadata: {
-			ownership: "provider",
-			provenance: "vercel",
-			purpose: "existing DNS record"
-		},
-		name,
-		policy: record.type === "CNAME" ? "exclusive" : "append",
-		ttl: record.ttl ?? 60
-	};
-	const fromRecord = (input) => decode$6(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
-	switch (record.type) {
-		case "A":
-		case "AAAA": return yield* fromRecord({
-			...common,
-			_tag: record.type,
-			address: record.value
-		});
-		case "CNAME":
-		case "NS": return yield* fromRecord({
-			...common,
-			_tag: record.type,
-			target: record.value
-		});
-		case "TXT": return yield* fromRecord({
-			...common,
-			_tag: "TXT",
-			value: record.value
-		});
-		case "MX": return yield* fromRecord({
-			...common,
-			_tag: "MX",
-			exchange: record.value,
-			priority: record.mxPriority ?? record.priority
-		});
-		case "CAA": {
-			const match = record.value.match(/^(\d{1,3})\s+(issue|issuewild|iodef)\s+(?:"((?:\\.|[^"])*)"|(\S.*))$/);
-			if (match === null) return yield* Effect.fail(failure$2("decodeRecord", "Vercel CAA record has an invalid value"));
-			return yield* fromRecord({
-				...common,
-				_tag: "CAA",
-				flags: Number(match[1]),
-				tag: match[2],
-				value: unescapeQuoted(match[3] ?? match[4] ?? "")
-			});
-		}
-		case "SRV": {
-			const parts = record.value.trim().split(/\s+/);
-			const [priority, weight, port, target] = parts.length === 4 ? parts : [
-				String(record.priority ?? ""),
-				parts[0],
-				parts[1],
-				parts[2]
-			];
-			return yield* fromRecord({
-				...common,
-				_tag: "SRV",
-				port: Number(port),
-				priority: Number(priority),
-				target,
-				weight: Number(weight)
-			});
-		}
-		default: return yield* decodeOpaque(record, name);
-	}
-}));
-const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => Schema.decodeUnknownEffect(Opaque.Schema)({
-	_tag: "Opaque",
-	name,
-	providerRecordId: record.id,
-	providerType: record.type
-}).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message))));
-function encode(zone, record) {
-	const common = {
-		name: relativeName(zone, record.name),
-		...record.ttl === null ? {} : { ttl: record.ttl },
-		type: record._tag
-	};
-	switch (record._tag) {
-		case "A":
-		case "AAAA": return {
-			...common,
-			value: record.address
-		};
-		case "CNAME":
-		case "NS": return {
-			...common,
-			value: record.target
-		};
-		case "TXT": return {
-			...common,
-			value: record.value
-		};
-		case "MX": return {
-			...common,
-			mxPriority: record.priority,
-			value: record.exchange
-		};
-		case "CAA": return {
-			...common,
-			value: `${record.flags} ${record.tag} "${escapeQuoted(record.value)}"`
-		};
-		case "SRV": return {
-			...common,
-			srv: {
-				port: record.port,
-				priority: record.priority,
-				target: record.target,
-				weight: record.weight
-			}
-		};
-	}
-}
-function absoluteNameCandidate(zone, name) {
-	return name === "" || name === "@" ? zone : name === zone || name.endsWith(`.${zone}`) ? name : `${name}.${zone}`;
-}
-function relativeName(zone, name) {
-	if (name === zone) return "";
-	const suffix = `.${zone}`;
-	if (!name.endsWith(suffix)) throw failure$2("encodeRecord", `DNS record ${name} is outside Vercel zone ${zone}`, { reason: "request" });
-	return name.slice(0, -suffix.length);
-}
-function escapeQuoted(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
-}
-function unescapeQuoted(value) {
-	return value.replace(/\\([\\"])/g, "$1");
-}
-function failure$2(operation, message, fields = {}) {
-	return new Error$3({
-		message,
-		operation,
-		providerId: "vercel",
-		reason: fields.reason ?? "response"
-	});
-}
-//#endregion
-//#region src/providers/vercel/client.ts
-var client_exports = /* @__PURE__ */ __exportAll({
-	AccountContext: () => AccountContext,
-	discovery: () => discovery,
-	make: () => make$4
-});
-/** Constructs the account scope used by Vercel API requests. */
-const AccountContext = {
-	personal: () => ({ _tag: "personal" }),
-	team: ({ teamId }) => ({
-		_tag: "team",
-		teamId
-	})
-};
-/** Exposes Vercel zone lookup as the optional provider discovery capability. */
-function discovery(client) {
-	return {
-		listZones: (name) => client.listZones({ name }),
-		provider: client
-	};
-}
-/** Creates an Effect-native Vercel client without owning the credential lifecycle. */
-function make$4(options) {
-	return makeClient(options);
-}
-function makeClient(options) {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
-	const withContext = (path, values = {}) => {
-		const url = new URL(`${baseUrl}${path}`);
-		for (const [key, value] of Object.entries(values)) url.searchParams.set(key, value);
-		if (options.context._tag === "team") url.searchParams.set("teamId", options.context.teamId);
-		return url;
-	};
-	const request = Effect.fn("VercelClient.request")((url, operation, init) => Effect.gen(function* () {
-		const response = yield* Effect.tryPromise({
-			try: () => fetch(url, {
-				...init,
-				headers: {
-					Accept: "application/json",
-					Authorization: `Bearer ${options.token.expose()}`,
-					...init?.body === void 0 ? {} : { "Content-Type": "application/json" },
-					...init?.headers
-				}
-			}),
-			catch: () => failure$1(operation, "Vercel request failed", { reason: "transport" })
-		});
-		const body = yield* Effect.tryPromise({
-			try: () => response.json(),
-			catch: () => failure$1(operation, response.ok ? "Vercel returned a non-JSON response" : `Vercel request failed with HTTP ${response.status}`, {
-				reason: response.ok ? "response" : reason(response.status),
-				...rateLimit(response),
-				status: response.status
-			})
-		});
-		if (!response.ok) return yield* Effect.fail(apiFailure(body, operation, response));
-		return {
-			body,
-			response
-		};
-	}));
-	const allTeams = Effect.fn("VercelClient.allTeams")(() => Effect.gen(function* () {
-		const teams = [];
-		let until = null;
-		while (true) {
-			const url = new URL(`${baseUrl}/v2/teams`);
-			url.searchParams.set("limit", "100");
-			if (until !== null) url.searchParams.set("until", String(until));
-			const { body, response } = yield* request(url, "listAccounts");
-			const envelope = yield* decode(TeamListEnvelope, body, "listAccounts", response);
-			teams.push(...envelope.teams);
-			if (envelope.pagination.next === null) return teams;
-			until = envelope.pagination.next;
-		}
-	}));
-	const allDomains = Effect.fn("VercelClient.allDomains")(() => Effect.gen(function* () {
-		const domains = [];
-		let until = null;
-		while (true) {
-			const values = { limit: "100" };
-			if (until !== null) values.until = String(until);
-			const { body, response } = yield* request(withContext("/v5/domains", values), "listZones");
-			const envelope = yield* decode(DomainListEnvelope, body, "listZones", response);
-			domains.push(...envelope.domains);
-			if (envelope.pagination.next === null) return domains;
-			until = envelope.pagination.next;
-		}
-	}));
-	const discoverZone = Effect.fn("VercelClient.discoverZone")((name) => Effect.gen(function* () {
-		const configResult = yield* request(withContext(`/v6/domains/${encodeURIComponent(name)}/config`), "resolveZone");
-		const config = yield* decode(DomainConfig, configResult.body, "resolveZone", configResult.response);
-		const domainResult = yield* request(withContext(`/v5/domains/${encodeURIComponent(name)}`), "resolveZone");
-		const envelope = yield* decode(DomainEnvelope, domainResult.body, "resolveZone", domainResult.response);
-		if (!hasDnsStorage(envelope.domain, config.serviceType)) return null;
-		return envelope.domain;
-	}).pipe(Effect.catchTag("ProviderError", (cause) => cause.reason === "not_found" ? Effect.succeed(null) : Effect.fail(cause))));
-	const resolveZone = Effect.fn("VercelClient.resolveZone")((name) => Effect.gen(function* () {
-		if (options.target !== void 0) {
-			if (name !== options.target.zoneName && !name.endsWith(`.${options.target.zoneName}`)) return yield* Effect.fail(failure$1("resolveZone", `Vercel target ${options.target.zoneName} does not cover ${name}`, { reason: "not_found" }));
-			return options.target.zoneName;
-		}
-		const domain = yield* discoverZone(name);
-		if (domain === null) return yield* Effect.fail(failure$1("resolveZone", `Vercel zone ${name} is not configured for authoritative DNS in the selected account`, { reason: "not_found" }));
-		return yield* decode$5(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
-	}));
-	const listRecords = Effect.fn("VercelClient.listRecords")((zoneName) => Effect.gen(function* () {
-		const storageZone = yield* resolveZone(zoneName);
-		const records = [];
-		let until = null;
-		while (true) {
-			const values = { limit: "100" };
-			if (until !== null) values.until = String(until);
-			const { body, response } = yield* request(withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values), "listRecords");
-			const envelope = yield* decode(RecordListEnvelope, body, "listRecords", response);
-			records.push(...yield* Effect.forEach(envelope.records, (record) => decode$1(storageZone, record)));
-			const next = envelope.pagination?.next ?? null;
-			if (next === null) return records.filter((record) => record.name === zoneName || record.name.endsWith(`.${zoneName}`));
-			until = next;
-		}
-	}));
-	const createRecord = Effect.fn("VercelClient.createRecord")((zoneName, record) => Effect.gen(function* () {
-		const storageZone = yield* resolveZone(zoneName);
-		const body = yield* Effect.try({
-			try: () => encode(storageZone, record),
-			catch: (cause) => cause instanceof Error$3 ? cause : failure$1("createRecord", "Vercel record could not be encoded", { reason: "request" })
-		});
-		const result = yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`), "createRecord", {
-			body: JSON.stringify(body),
-			method: "POST"
-		});
-		return { providerRecordId: (yield* decode(CreateRecordEnvelope, result.body, "createRecord", result.response)).uid };
-	}));
-	const getRecord = Effect.fn("VercelClient.getRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-		const storageZone = yield* resolveZone(zoneName);
-		let until = null;
-		while (true) {
-			const values = { limit: "100" };
-			if (until !== null) values.until = String(until);
-			const { body, response } = yield* request(withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values), "getRecord");
-			const envelope = yield* decode(RecordListEnvelope, body, "getRecord", response);
-			const record = envelope.records.find(({ id }) => id === providerRecordId);
-			if (record !== void 0) return yield* decode$1(storageZone, record);
-			const next = envelope.pagination?.next ?? null;
-			if (next === null) return null;
-			until = next;
-		}
-	}));
-	const deleteRecord = Effect.fn("VercelClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-		const storageZone = yield* resolveZone(zoneName);
-		yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`), "deleteRecord", { method: "DELETE" });
-	}));
-	const listAccounts = Effect.fn("VercelClient.listAccounts")(() => Effect.gen(function* () {
-		const userResult = yield* request(new URL(`${baseUrl}/v2/user`), "listAccounts");
-		const { user } = yield* decode(UserEnvelope, userResult.body, "listAccounts", userResult.response);
-		const teams = yield* allTeams();
-		return [{
-			id: user.id,
-			name: user.name ?? user.username,
-			type: "personal"
-		}, ...teams.map((team) => ({
-			id: team.id,
-			name: team.name ?? team.slug,
-			type: "team"
-		}))];
-	}));
-	const listZones = Effect.fn("VercelClient.listZones")((input = {}) => Effect.gen(function* () {
-		const domains = (yield* allDomains()).filter((domain) => hasDnsStorage(domain) && (input.name === void 0 || domain.name === input.name));
-		if (domains.length > 0 || input.name === void 0) return yield* Effect.forEach(domains, projectZone);
-		const discovered = yield* discoverZone(input.name);
-		return discovered === null ? [] : [yield* projectZone(discovered)];
-	}));
-	const listTargets = Effect.fn("VercelClient.listTargets")((input = {}) => Effect.gen(function* () {
-		const names = input.domain === void 0 ? void 0 : new Set(candidates(input.domain).map((name) => String(name)));
-		const domains = (yield* allDomains()).filter((domain) => hasDnsStorage(domain) && (names === void 0 || names.has(domain.name)) && (input.accountId === void 0 || (domain.teamId ?? domain.userId) === input.accountId));
-		if (domains.length > 0 || input.domain === void 0) return yield* Effect.forEach(domains, targetFromDomain);
-		for (const name of candidates(input.domain)) {
-			const discovered = yield* discoverZone(name);
-			if (discovered !== null && (input.accountId === void 0 || (discovered.teamId ?? discovered.userId) === input.accountId)) return [yield* targetFromDomain(discovered)];
-		}
-		return [];
-	}));
-	return {
-		id: "vercel",
-		providerId: "vercel",
-		createRecord,
-		deleteRecord,
-		getRecord,
-		listAccounts,
-		listRecords,
-		listZones,
-		listTargets,
-		resolveTarget: Effect.fn("VercelClient.resolveTarget")((domain) => Effect.gen(function* () {
-			const candidates$1 = yield* listTargets({ domain });
-			for (const zoneName of candidates(domain)) {
-				const matches = candidates$1.filter((target) => target.zoneName === zoneName);
-				if (matches.length === 1) {
-					const target = matches[0];
-					if (target !== void 0) return Resolution.Resolved({ target });
-				}
-				if (matches.length > 1) return Resolution.SelectionRequired({ candidates: matches });
-			}
-			return Resolution.NotFound({ domain });
-		})),
-		forTarget: Effect.fn("VercelClient.forTarget")((target) => Effect.gen(function* () {
-			if (target.accountKind === "team") {
-				if (options.context._tag !== "team" || options.context.teamId !== target.accountId) return yield* Effect.fail(failure$1("forTarget", "Vercel team target is outside the selected installation", { reason: "authorization" }));
-			} else if (target.accountKind === "personal" && options.context._tag !== "personal") return yield* Effect.fail(failure$1("forTarget", "Vercel personal target is outside the selected installation", { reason: "authorization" }));
-			else if (target.accountKind === "account") return yield* Effect.fail(failure$1("forTarget", "Vercel does not support account-kind targets", { reason: "unsupported" }));
-			else if (target.accountKind === null) return yield* Effect.fail(failure$1("forTarget", "Vercel targets must identify a personal or team account", { reason: "request" }));
-			const selected = (yield* listTargets({
-				accountId: target.accountId,
-				domain: target.zoneName
-			})).find((candidate) => candidate.accountId === target.accountId && candidate.accountKind === target.accountKind && candidate.zoneId === target.zoneId && candidate.zoneName === target.zoneName);
-			if (selected === void 0) return yield* Effect.fail(failure$1("forTarget", `Vercel target ${target.zoneName} is not visible to this installation`, { reason: "authorization" }));
-			const client = makeClient({
-				...options,
-				target: selected
-			});
-			return {
-				id: client.id,
-				createRecord: client.createRecord,
-				deleteRecord: client.deleteRecord,
-				getRecord: client.getRecord,
-				listRecords: client.listRecords
-			};
-		})),
-		validateToken: Effect.fn("VercelClient.validateToken")(() => Effect.gen(function* () {
-			let accountId;
-			if (options.context._tag === "team") {
-				yield* allDomains();
-				accountId = options.context.teamId;
-			} else {
-				const result = yield* request(new URL(`${baseUrl}/v2/user`), "validateToken");
-				const { user } = yield* decode(UserEnvelope, result.body, "validateToken", result.response);
-				accountId = user.id;
-			}
-			return {
-				accountId,
-				capabilities: options.capabilities,
-				expiresAt: null,
-				scopes: []
-			};
-		}))
-	};
-}
-function hasDnsStorage(domain, configuredServiceType = domain.serviceType) {
-	return configuredServiceType === "zeit.world" || domain.zone === true || domain.intendedNameservers.length > 0;
-}
-const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen(function* () {
-	const name = yield* decode$5(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
-	return {
-		accountId: domain.teamId ?? domain.userId,
-		id: domain.id,
-		name,
-		nameservers,
-		status: domain.verified ? "active" : "pending"
-	};
-}));
-const targetFromDomain = Effect.fn("VercelClient.targetFromDomain")((domain) => Effect.gen(function* () {
-	const zoneName = yield* decode$5(domain.name).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" }))));
-	return {
-		accountId: domain.teamId ?? domain.userId,
-		accountKind: domain.teamId === null ? "personal" : "team",
-		evidence: {
-			nameservers,
-			status: domain.verified ? "active" : "pending",
-			zoneType: domain.serviceType
-		},
-		zoneId: domain.id,
-		zoneName
-	};
-}));
-function decode(schema, input, operation, response) {
-	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$1(operation, `Vercel response did not match its API contract: ${cause.message}`, {
-		reason: "response",
-		status: response.status
-	})));
-}
-function apiFailure(input, operation, response) {
-	const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
-	return failure$1(operation, detail._tag === "Some" ? detail.value.error.message : `Vercel request failed with HTTP ${response.status}`, {
-		...detail._tag === "Some" ? { code: detail.value.error.code } : {},
-		reason: reason(response.status, detail._tag === "Some" ? detail.value.error.code : void 0),
-		...rateLimit(response, detail._tag === "Some" ? detail.value.error : void 0),
-		status: response.status
-	});
-}
-function reason(status, code) {
-	if (status === 401 || code === "invalid_token") return "authentication";
-	if (status === 403) return "authorization";
-	if (status === 404 || code === "not_found") return "not_found";
-	if (status === 409 || code === "conflict") return "conflict";
-	if (status === 429 || code === "rate_limited") return "rate_limit";
-	if (status >= 500) return "response";
-	return "request";
-}
-function rateLimit(response, detail) {
-	const resetMs = detail?.limit?.resetMs;
-	const header = response.headers.get("x-ratelimit-reset");
-	const reset = resetMs ?? (header === null ? void 0 : Number(header) * 1e3);
-	return reset === void 0 || !Number.isFinite(reset) ? {} : { retryAfterMs: Math.max(0, reset - Date.now()) };
-}
-function failure$1(operation, message, fields = {}) {
-	return new Error$3({
-		...fields,
-		message,
-		operation,
-		providerId: "vercel"
-	});
-}
-//#endregion
-//#region src/providers/vercel/auth.ts
-var auth_exports = /* @__PURE__ */ __exportAll({
-	contextCodec: () => contextCodec,
-	exchangeCode: () => exchangeCode,
-	integrationAuthentication: () => integrationAuthentication,
-	integrationFlow: () => integrationFlow,
-	integrationMethod: () => integrationMethod,
-	manifest: () => manifest,
-	restore: () => restore,
-	tokenConnectionMethod: () => tokenConnectionMethod,
-	tokenMethod: () => tokenMethod
-});
-const Context$1 = Schema.TaggedUnion({
-	personal: { installationId: Schema.NullOr(Schema.String) },
-	team: {
-		installationId: Schema.NullOr(Schema.String),
-		teamId: Schema.String
-	}
-});
-const contextCodec = codec("vercel.v1", Context$1);
-/** Describes Vercel's caller-created personal access-token method. */
-function tokenMethod(capabilities) {
-	return Method.token({
-		capabilities: [...capabilities],
-		instructionsUrl: "https://vercel.com/account/settings/tokens"
-	});
-}
-/** Describes Vercel's provider-specific integration installation flow. */
-function integrationMethod(options) {
-	return Method.integration({
-		capabilities: [...options.capabilities],
-		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
-		tokenEndpoint: "https://api.vercel.com/v2/oauth/access_token"
-	});
-}
-/** Creates the Vercel token and integration authorization manifest. */
-function manifest(options) {
-	return {
-		methods: [tokenMethod(options.capabilities), integrationMethod(options)],
-		providerId: "vercel"
-	};
-}
-/** Exchanges Vercel's one-time integration code and preserves its account context. */
-const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.gen(function* () {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
-	const body = new URLSearchParams({
-		client_id: options.clientId,
-		client_secret: options.clientSecret.expose(),
-		code: options.code.expose(),
-		redirect_uri: options.redirectUri
-	});
-	const response = yield* Effect.tryPromise({
-		try: () => fetch(`${baseUrl}/v2/oauth/access_token`, {
-			body,
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			method: "POST"
-		}),
-		catch: () => failure("exchangeCode", "Vercel token exchange failed", "transport")
-	});
-	const input = yield* Effect.tryPromise({
-		try: () => response.json(),
-		catch: () => failure("exchangeCode", response.ok ? "Vercel returned a non-JSON token response" : `Vercel token exchange failed with HTTP ${response.status}`, response.ok ? "response" : response.status === 401 ? "authentication" : "request", response.status)
-	});
-	if (!response.ok) {
-		const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
-		return yield* Effect.fail(failure("exchangeCode", detail._tag === "Some" ? detail.value.error.message : `Vercel token exchange failed with HTTP ${response.status}`, response.status === 401 ? "authentication" : "request", response.status, detail._tag === "Some" ? detail.value.error.code : void 0));
-	}
-	const token = yield* Schema.decodeUnknownEffect(IntegrationToken)(input).pipe(Effect.mapError((cause) => failure("exchangeCode", `Vercel token response did not match its API contract: ${cause.message}`, "response", response.status)));
-	return {
-		accessToken: make$6(token.access_token),
-		context: token.team_id === null ? AccountContext.personal() : AccountContext.team({ teamId: token.team_id }),
-		installationId: token.installation_id ?? options.configurationId ?? null,
-		userId: token.user_id
-	};
-}));
-/** Creates a provider-independent token connection method backed by Vercel validation. */
-function tokenConnectionMethod(options) {
-	const requiredCapabilities = [...options.capabilities];
-	return Method$1.Token({
-		authenticate: Effect.fn("VercelAuth.authenticateToken")(function* (token) {
-			const validated = yield* make$4({
-				...options,
-				token
-			}).validateToken();
-			const observedAt = new Date(yield* Clock.currentTimeMillis);
-			return {
-				capabilityEvidence: validated.capabilities.map((capability) => ({
-					capability,
-					evidence: Evidence$1.Introspected({ observedAt })
-				})),
-				credential: {
-					accessToken: token,
-					expiresAt: validated.expiresAt,
-					refreshToken: null,
-					tokenType: "bearer"
-				},
-				providerAccountId: validated.accountId,
-				providerContext: yield* contextCodec.encode(options.context._tag === "team" ? {
-					_tag: "team",
-					installationId: null,
-					teamId: options.context.teamId
-				} : {
-					_tag: "personal",
-					installationId: null
-				}),
-				scopes: [...validated.scopes]
-			};
-		}),
-		providerId: "vercel",
-		requiredCapabilities,
-		token: options.token
-	});
-}
-/** Converts a completed Vercel Integration exchange into canonical connection authentication. */
-const integrationAuthentication = Effect.fn("VercelAuth.integrationAuthentication")(function* (options) {
-	const exchanged = yield* exchangeCode(options);
-	const observedAt = new Date(yield* Clock.currentTimeMillis);
-	return {
-		capabilityEvidence: options.capabilities.map((capability) => ({
-			capability,
-			evidence: Evidence$1.Introspected({ observedAt })
-		})),
-		credential: {
-			accessToken: exchanged.accessToken,
-			expiresAt: null,
-			refreshToken: null,
-			tokenType: "bearer"
-		},
-		providerAccountId: exchanged.context._tag === "team" ? exchanged.context.teamId : exchanged.userId,
-		providerContext: yield* contextCodec.encode(exchanged.context._tag === "team" ? {
-			_tag: "team",
-			installationId: exchanged.installationId,
-			teamId: exchanged.context.teamId
-		} : {
-			_tag: "personal",
-			installationId: exchanged.installationId
-		}),
-		scopes: []
-	};
-});
-/** Restore a credential-scoped Vercel session from persisted authorization state. */
-function restore(options) {
-	return Effect.gen(function* () {
-		if (options.authorization.providerId !== "vercel") return yield* Effect.fail(failure("restore", "Provider authorization belongs to another provider", "authorization"));
-		if (options.authorization.revocation._tag !== "Active") return yield* Effect.fail(failure("restore", "Vercel authorization is pending revocation", "authorization"));
-		const missingCapability = options.authorization.requiredCapabilities.find((capability) => !options.authorization.capabilityEvidence.some((item) => item.capability === capability));
-		if (missingCapability !== void 0) return yield* Effect.fail(failure("restore", `Vercel authorization lacks evidence for ${missingCapability}`, "authorization"));
-		if (options.credential.expiresAt !== null && (Number.isNaN(options.credential.expiresAt.valueOf()) || options.credential.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure("restore", "Vercel authorization has expired", "authentication"));
-		const context = yield* contextCodec.decode(options.authorization.providerContext).pipe(Effect.mapError((cause) => failure("restore", cause.message, "response")));
-		return make$4({
-			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-			capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),
-			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			context: context._tag === "team" ? AccountContext.team({ teamId: context.teamId }) : AccountContext.personal(),
-			token: options.credential.accessToken
-		});
-	});
-}
-/** Creates Vercel Integration's implementation of the common interactive connection capability. */
-function integrationFlow(options) {
-	const method = integrationMethod(options);
-	const Payload = Schema.fromJsonString(Schema.Struct({ state: Schema.String }));
-	return {
-		complete: Effect.fn("VercelAuth.integrationFlow.complete")(function* (payload, callbackUrl) {
-			const continuation = yield* Schema.decodeUnknownEffect(Payload)(payload.expose()).pipe(Effect.mapError(() => new Error$2({
-				category: "authorization",
-				message: "Vercel Integration continuation payload is invalid",
-				operation: "VercelAuth.integrationFlow.complete",
-				retry: "after-user-action"
-			})));
-			const code = callbackUrl.searchParams.get("code");
-			const configurationId = callbackUrl.searchParams.get("configurationId");
-			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null || configurationId === null) return yield* new Error$2({
-				category: "authorization",
-				message: "Vercel Integration callback does not match its continuation",
-				operation: "VercelAuth.integrationFlow.complete",
-				retry: "after-user-action"
-			});
-			const authentication = yield* integrationAuthentication({
-				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-				capabilities: options.capabilities,
-				clientId: options.clientId,
-				clientSecret: options.clientSecret,
-				code: make$6(code),
-				configurationId,
-				...options.fetch === void 0 ? {} : { fetch: options.fetch },
-				redirectUri: options.redirectUri
-			});
-			const callbackTeamId = callbackUrl.searchParams.get("teamId");
-			if (callbackTeamId !== null) {
-				const context = yield* contextCodec.decode(authentication.providerContext).pipe(Effect.mapError((cause) => new Error$2({
-					category: "provider",
-					message: cause.message,
-					operation: "VercelAuth.integrationFlow.complete",
-					retry: "unknown"
-				})));
-				if (context._tag !== "team" || context.teamId !== callbackTeamId) return yield* new Error$2({
-					category: "authorization",
-					message: "Vercel Integration callback team does not match the exchanged installation",
-					operation: "VercelAuth.integrationFlow.complete",
-					retry: "after-user-action"
-				});
-			}
-			return authentication;
-		}),
-		method: "integration",
-		providerId: "vercel",
-		requiredCapabilities: [...options.capabilities],
-		start: (continuationId) => {
-			const authorizationUrl = new URL(method.installUrl);
-			authorizationUrl.searchParams.set("source", "external");
-			authorizationUrl.searchParams.set("state", continuationId);
-			return Effect.succeed({
-				authorizationUrl,
-				payload: make$6(JSON.stringify({ state: continuationId }))
-			});
-		}
-	};
-}
-function failure(operation, message, reason, status, code) {
-	return new Error$3({
-		...code === void 0 ? {} : { code },
-		message,
-		operation,
-		providerId: "vercel",
-		reason,
-		...status === void 0 ? {} : { status }
-	});
-}
-//#endregion
-//#region src/verification/dns-data.ts
-var dns_data_exports = /* @__PURE__ */ __exportAll({ parse: () => parse });
-const CanonicalAddress = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => value.trim().toLowerCase(),
-	encode: (value) => value
-})));
-const CanonicalDomain = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
-	decode: (value, options) => Effect.try({
-		try: () => parse$1(value).toString(),
-		catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
-	}),
-	encode: (value) => Effect.succeed(value)
-})));
-const CanonicalMx = tokenizedDomain(2, 1);
-const CanonicalSrv = tokenizedDomain(4, 3);
-const CanonicalTxt = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => {
-		const trimmed = value.trim();
-		const chunks = [...trimmed.matchAll(/"((?:\\.|[^"])*)"/g)];
-		return chunks.length === 0 ? trimmed : chunks.map((match) => (match[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")).join("");
-	},
-	encode: (value) => value
-})));
-const CanonicalCaa = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => value.trim().replace(/\s+"([\s\S]*)"$/, " $1"),
-	encode: (value) => value
-})));
-function parse(type, input) {
-	const schema = (() => {
-		switch (type) {
-			case "A":
-			case "AAAA": return CanonicalAddress;
-			case "CNAME":
-			case "NS": return CanonicalDomain;
-			case "MX": return CanonicalMx;
-			case "SRV": return CanonicalSrv;
-			case "TXT": return CanonicalTxt;
-			case "CAA": return CanonicalCaa;
-		}
-	})();
-	try {
-		return Schema.decodeUnknownSync(schema)(input);
-	} catch (cause) {
-		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
-	}
-}
-function tokenizedDomain(length, domainIndex) {
-	return Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
-		decode: (value, options) => Effect.try({
-			try: () => {
-				const parts = value.trim().split(/\s+/);
-				if (parts.length !== length) throw new Error("DNS record data has an invalid field count");
-				const domain = parts[domainIndex];
-				if (domain === void 0) throw new Error("DNS record target is missing");
-				parts[domainIndex] = parse$1(domain);
-				return parts.join(" ");
-			},
-			catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
-		}),
-		encode: (value) => Effect.succeed(value)
-	})));
-}
-//#endregion
-//#region src/verification/doh.ts
-var doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$2,
-	make: () => make$3,
-	toAsync: () => toAsync$2
-});
-function make$3(options) {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const timeoutMs = options.timeoutMs ?? 5e3;
-	return { resolve: Effect.fn("DnsOverHttps.resolve")((query) => Effect.tryPromise({
-		try: (effectSignal) => request({
-			effectSignal,
-			fetch,
-			query,
-			timeoutMs,
-			endpoint: options.endpoint
-		}),
-		catch: (cause) => cause instanceof Error$4 ? cause : new Error$4({
-			cause,
-			message: cause instanceof Error ? cause.message : "DNS resolution failed",
-			reason: "transport"
-		})
-	}).pipe(Effect.flatMap((message) => decodeResolution(query, message)))) };
-}
-const layer$2 = (options) => Layer.succeed(Service$2, make$3(options));
-const toAsync$2 = (options) => toAsync$5(make$3(options));
-function decodeResolution(query, message) {
-	return Effect.try({
-		try: () => DnsPacket.decode(message),
-		catch: (cause) => new Error$4({
-			cause,
-			message: "DoH returned an invalid DNS message",
-			reason: "response"
-		})
-	}).pipe(Effect.flatMap((packet) => validatePacket(query, packet)), Effect.flatMap(decodePacket));
-}
-function decodePacket(packet) {
-	if (packet.rcode === "NXDOMAIN") return Effect.succeed(Resolution$1.nodata());
-	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$4({
-		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
-		reason: "response"
-	}));
-	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed(Resolution$1.nodata());
-	return Effect.forEach(packet.answers, decodeAnswer, { concurrency: "unbounded" }).pipe(Effect.map((answers) => {
-		const supportedAnswers = answers.filter((answer) => answer !== null);
-		return supportedAnswers.length === 0 ? Resolution$1.nodata() : Resolution$1.answer({ answers: supportedAnswers });
-	}));
-}
-function validatePacket(query, packet) {
-	return Effect.try({
-		try: () => {
-			if (packet.type !== "response") throw new Error("DoH returned a DNS query");
-			if (packet.id !== 0) throw new Error("DoH response used an unexpected message ID");
-			if (packet.flag_tc) throw new Error("DoH returned a truncated DNS response");
-			const questions = packet.questions ?? [];
-			if (questions.length !== 1) throw new Error("DoH returned an unexpected question count");
-			const question = questions[0];
-			if (question === void 0) throw new Error("DoH response omitted the DNS question");
-			if (question.class !== "IN" || question.type !== query.type || parse$1(question.name) !== query.name) throw new Error("DoH response did not match the DNS question");
-			return packet;
-		},
-		catch: (cause) => new Error$4({
-			cause,
-			message: cause instanceof Error ? cause.message : "DoH returned an invalid DNS response",
-			reason: "response"
-		})
-	});
-}
-function decodeAnswer(answer) {
-	return Effect.gen(function* () {
-		if (answer.class !== "IN") return null;
-		const decoded = yield* Effect.try({
-			try: () => answerData(answer),
-			catch: (cause) => new Error$4({
-				cause,
-				message: "DoH returned invalid DNS record data",
-				reason: "response"
-			})
-		});
-		if (decoded === void 0) return null;
-		const name = yield* decode$5(answer.name);
-		const data = yield* Effect.try({
-			try: () => parse(decoded.type, decoded.data),
-			catch: (cause) => new Error$4({
-				cause,
-				message: "DoH returned invalid DNS record data",
-				reason: "response"
-			})
-		});
-		if (answer.ttl === void 0) return yield* new Error$4({
-			message: "DoH response omitted the DNS record TTL",
-			reason: "response"
-		});
-		return {
-			data,
-			name,
-			ttl: answer.ttl,
-			type: decoded.type
-		};
-	}).pipe(Effect.mapError((cause) => cause instanceof Error$4 ? cause : new Error$4({
-		cause,
-		message: cause.message,
-		reason: "response"
-	})));
-}
-function answerData(answer) {
-	switch (answer.type) {
-		case "A":
-		case "AAAA":
-		case "CNAME":
-		case "NS": return {
-			data: answer.data,
-			type: answer.type
-		};
-		case "CAA": return {
-			data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,
-			type: answer.type
-		};
-		case "MX": return {
-			data: `${requiredNumber(answer.data.preference, "MX preference")} ${answer.data.exchange}`,
-			type: answer.type
-		};
-		case "SRV": return {
-			data: [
-				requiredNumber(answer.data.priority, "SRV priority"),
-				requiredNumber(answer.data.weight, "SRV weight"),
-				requiredNumber(answer.data.port, "SRV port"),
-				answer.data.target
-			].join(" "),
-			type: answer.type
-		};
-		case "TXT": return {
-			data: decodeTxt(answer.data),
-			type: answer.type
-		};
-		default: return;
-	}
-}
-function decodeTxt(data) {
-	const encoded = (Array.isArray(data) ? data : [data]).map((chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
-	const length = encoded.reduce((total, chunk) => total + chunk.length, 0);
-	const joined = new Uint8Array(length);
-	let offset = 0;
-	for (const chunk of encoded) {
-		joined.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return new TextDecoder("utf-8", { fatal: true }).decode(joined);
-}
-function requiredNumber(value, field) {
-	if (value === void 0) throw new Error(`DoH response omitted ${field}`);
-	return value;
-}
-async function request(input) {
-	const controller = new AbortController();
-	let timedOut = false;
-	const abortFromEffect = () => controller.abort(input.effectSignal.reason);
-	const abortFromHost = () => controller.abort(input.query.signal?.reason);
-	input.effectSignal.addEventListener("abort", abortFromEffect, { once: true });
-	input.query.signal?.addEventListener("abort", abortFromHost, { once: true });
-	const timer = setTimeout(() => {
-		timedOut = true;
-		controller.abort(/* @__PURE__ */ new Error("DNS resolution timed out"));
-	}, input.timeoutMs);
-	try {
-		const query = Uint8Array.from(DnsPacket.encode({
-			flags: DnsPacket.RECURSION_DESIRED,
-			id: 0,
-			questions: [{
-				name: input.query.name,
-				type: input.query.type
-			}],
-			type: "query"
-		}));
-		const response = await input.fetch(new URL(input.endpoint), {
-			body: query,
-			headers: {
-				accept: "application/dns-message",
-				"content-type": "application/dns-message"
-			},
-			method: "POST",
-			signal: controller.signal
-		});
-		if (!response.ok) throw new Error$4({
-			message: `DoH returned HTTP ${response.status}`,
-			reason: "transport"
-		});
-		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-		if (contentType !== "application/dns-message") throw new Error$4({
-			message: `DoH returned unsupported content type ${contentType ?? "<missing>"}`,
-			reason: "response"
-		});
-		return new Uint8Array(await response.arrayBuffer());
-	} catch (cause) {
-		if (timedOut) throw new Error$4({
-			message: "DNS query timed out",
-			reason: "timeout"
-		});
-		throw cause;
-	} finally {
-		clearTimeout(timer);
-		input.effectSignal.removeEventListener("abort", abortFromEffect);
-		input.query.signal?.removeEventListener("abort", abortFromHost);
-	}
-}
-//#endregion
-//#region src/verification/cloudflare-doh.ts
-var cloudflare_doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$1,
-	make: () => make$2,
-	toAsync: () => toAsync$1
-});
-const endpoint$1 = "https://cloudflare-dns.com/dns-query";
-function make$2(options = {}) {
-	return make$3({
-		...options,
-		endpoint: options.endpoint ?? endpoint$1
-	});
-}
-const layer$1 = (options = {}) => Layer.succeed(Service$2, make$2(options));
-const toAsync$1 = (options = {}) => toAsync$5(make$2(options));
-//#endregion
-//#region src/verification/google-doh.ts
-var google_doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer,
-	make: () => make$1,
-	toAsync: () => toAsync
-});
-const endpoint = "https://dns.google/dns-query";
-function make$1(options = {}) {
-	return make$3({
-		...options,
-		endpoint: options.endpoint ?? endpoint
-	});
-}
-const layer = (options = {}) => Layer.succeed(Service$2, make$1(options));
-const toAsync = (options = {}) => toAsync$5(make$1(options));
-//#endregion
-//#region src/verification/resolver-pool.ts
-var resolver_pool_exports = /* @__PURE__ */ __exportAll({
-	Observation: () => Observation,
-	Policy: () => Policy,
-	Service: () => Service,
-	defaultLayer: () => defaultLayer,
-	defaultMake: () => defaultMake,
-	make: () => make
-});
-const Observation = Data.taggedEnum();
-const PolicyVariants = Data.taggedEnum();
-const QuorumMinimum = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));
-const PolicySchema = Schema.TaggedUnion({
-	AllMatch: {},
-	AnyMatch: {},
-	Quorum: { minimum: QuorumMinimum }
-});
-const Policy = {
-	AllMatch: PolicyVariants.AllMatch,
-	AnyMatch: PolicyVariants.AnyMatch,
-	Quorum: ({ minimum }) => PolicyVariants.Quorum({ minimum: Schema.decodeUnknownSync(QuorumMinimum)(minimum) }),
-	Schema: PolicySchema
-};
-var Service = class extends Context.Service()("@domainkit/DnsResolverPool") {};
-function make(entries) {
-	return Service.of({ observe: Effect.fn("DnsResolverPool.observe")((query) => Effect.forEach(entries, (entry) => observe$1(entry, query), { concurrency: "unbounded" })) });
-}
-/** Cloudflare and Google RFC wire-format DoH resolvers. */
-function defaultMake(options = {}) {
-	const timeoutMs = options.timeoutMs ?? 5e3;
-	return make([{
-		id: "cloudflare",
-		resolver: make$2(options),
-		timeoutMs
-	}, {
-		id: "google",
-		resolver: make$1(options),
-		timeoutMs
-	}]);
-}
-const defaultLayer = (options = {}) => Layer.succeed(Service, defaultMake(options));
-function observe$1(entry, query) {
-	const timeoutMs = entry.timeoutMs ?? 5e3;
-	return entry.resolver.resolve(query).pipe(Effect.timeout(timeoutMs), Effect.match({
-		onFailure: (failure) => {
-			if (failure._tag === "TimeoutError" || failure._tag === "ResolverError" && failure.reason === "timeout") return Observation.TimedOut({
-				resolverId: entry.id,
-				timeoutMs
-			});
-			return Observation.Failed({
-				message: failure.message,
-				reason: failure.reason === "response" ? "response" : "transport",
-				resolverId: entry.id
-			});
-		},
-		onSuccess: (resolution) => resolution._tag === "nodata" ? Observation.NoData({ resolverId: entry.id }) : Observation.Answer({
-			answers: resolution.answers,
-			resolverId: entry.id
-		})
-	}));
-}
-//#endregion
-//#region src/verification/verify.ts
-var verify_exports = /* @__PURE__ */ __exportAll({
-	Provider: () => Provider,
-	ProviderObservation: () => ProviderObservation,
-	PublicDns: () => PublicDns,
-	PublicDnsObservation: () => PublicDnsObservation,
-	Result: () => Result,
-	observe: () => observe
-});
-const PublicDns = Data.taggedEnum();
-const Provider = Data.taggedEnum();
-const ProviderObservation = Data.taggedEnum();
-const PublicDnsObservation = Data.taggedEnum();
-const Result = Data.taggedEnum();
-function observe(input) {
-	return observeEffect(input);
-}
-const observeEffect = Effect.fn("Verification.observe")(function* (input) {
-	const publicDns = input.publicDns ?? PublicDns.Enabled({});
-	const provider = input.provider ?? Provider.Disabled();
-	const publicEffect = publicDns._tag === "Disabled" ? Effect.succeed(null) : observePublicDns(input.record, publicDns.policy ?? Policy.AnyMatch());
-	const providerEffect = provider._tag === "Disabled" ? Effect.succeed(null) : Effect.flatMap(Service$3, (service) => observeProvider(service, provider.zone, input.record).pipe(Effect.catch((failure) => Effect.succeed(ProviderObservation.Unavailable({ message: failure.message })))));
-	const [providerObservation, publicDnsObservation] = yield* Effect.all([providerEffect, publicEffect], { concurrency: "unbounded" });
-	return aggregate({
-		provider: providerObservation,
-		publicDns: publicDnsObservation
-	});
-});
-function observeProvider(provider, zone, requirement) {
-	return provider.listRecords(zone).pipe(Effect.map((records) => {
-		if (records.some((existing) => existing._tag !== "Opaque" && equals(existing, requirement))) return ProviderObservation.Matched();
-		const sameSet = records.filter((existing) => existing._tag !== "Opaque" && existing.name === requirement.name && existing._tag === requirement._tag);
-		return sameSet.length === 0 ? ProviderObservation.Pending() : ProviderObservation.Mismatch({ records: sameSet });
-	}));
-}
-function observePublicDns(requirement, policy) {
-	return Effect.gen(function* () {
-		const validatedPolicy = yield* Schema.decodeUnknownEffect(Policy.Schema)(policy).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message })));
-		const configuredPool = yield* Effect.serviceOption(Service);
-		const evidence = yield* Option.getOrElse(configuredPool, () => defaultMake()).observe({
-			name: requirement.name,
-			type: requirement._tag
-		});
-		if (validatedPolicy._tag === "Quorum" && validatedPolicy.minimum > evidence.length) return yield* new Error$1({ message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers` });
-		return evaluatePublicDns(requirement, validatedPolicy, evidence);
-	});
-}
-function evaluatePublicDns(requirement, policy, evidence) {
-	const matchedResolverIds = evidence.flatMap((observation) => observation._tag === "Answer" && answersMatch(requirement, observation.answers) ? [observation.resolverId] : []);
-	const required = policy._tag === "AnyMatch" ? 1 : policy._tag === "AllMatch" ? evidence.length : policy.minimum;
-	if (required > 0 && matchedResolverIds.length >= required) return PublicDnsObservation.Verified({
-		evidence,
-		matchedResolverIds
-	});
-	const unavailable = evidence.filter((observation) => observation._tag === "TimedOut" || observation._tag === "Failed").length;
-	if (unavailable > 0 && matchedResolverIds.length + unavailable >= required) return PublicDnsObservation.Unavailable({ evidence });
-	if (evidence.some((observation) => observation._tag === "Answer" && !answersMatch(requirement, observation.answers))) return PublicDnsObservation.Mismatch({ evidence });
-	if (evidence.some((observation) => observation._tag === "NoData")) return PublicDnsObservation.Pending({ evidence });
-	return PublicDnsObservation.Unavailable({ evidence });
-}
-function answersMatch(requirement, answers) {
-	const expected = parse(requirement._tag, recordValue(requirement));
-	return answers.some((answer) => answer.name === requirement.name && answer.type === requirement._tag && parse(requirement._tag, answer.data) === expected);
-}
-function aggregate(evidence) {
-	const requested = [evidence.provider, evidence.publicDns].filter((observation) => observation !== null);
-	if (requested.length === 0) return Result.NotObserved(evidence);
-	if (requested.every((observation) => observation._tag === "Matched" || observation._tag === "Verified")) return Result.Verified(evidence);
-	if (requested.some((observation) => observation._tag === "Unavailable")) return Result.Unavailable(evidence);
-	if (requested.some((observation) => observation._tag === "Mismatch")) return Result.Mismatch(evidence);
-	return Result.Pending(evidence);
-}
-function recordValue(requirement) {
-	const data$1 = data(requirement);
-	switch (requirement._tag) {
-		case "A":
-		case "AAAA": return String(data$1.address);
-		case "CNAME":
-		case "NS": return String(data$1.target);
-		case "TXT": return String(data$1.value);
-		case "MX": return `${data$1.priority} ${data$1.exchange}`;
-		case "CAA": return `${data$1.flags} ${data$1.tag} ${data$1.value}`;
-		case "SRV": return `${data$1.priority} ${data$1.weight} ${data$1.port} ${data$1.target}`;
-	}
-}
-//#endregion
-export { decode$4 as $, client_exports as A, tokenConnectionMethod$1 as B, integrationFlow as C, tokenConnectionMethod as D, restore as E, oauthFlow as F, make$5 as G, tokenValidator as H, oauthMethod as I, session_exports as J, authorize as K, refreshCredential as L, make$4 as M, auth_exports$1 as N, tokenMethod as O, manifest$1 as P, Schema$1 as Q, restore$1 as R, exchangeCode as S, manifest as T, client_exports$1 as U, tokenMethod$1 as V, discovery$1 as W, secret_exports as X, selection_exports as Y, Method as Z, toAsync$1 as _, Result as a, dns_data_exports as b, Observation as c, defaultMake as d, manifest_exports as et, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, discovery as j, AccountContext as k, Policy as l, google_doh_exports as m, ProviderObservation as n, version as nt, observe as o, resolver_pool_exports as p, connection_authorization_exports as q, PublicDns as r, verify_exports as s, Provider as t, diagnostic_exports as tt, Service as u, doh_exports as v, integrationMethod as w, auth_exports as x, toAsync$2 as y, subjectResolver as z };
-
-//# sourceMappingURL=verify-DvGPb5C9.mjs.map