domainkit 0.8.0 → 0.9.1

package/dist/index.mjs

@@ -1,468 +1,39 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { A as client_exports$1, G as make, J as session_exports, M as make$1, N as auth_exports, U as client_exports, W as discovery, X as secret_exports, Y as selection_exports, b as dns_data_exports, et as manifest_exports, g as cloudflare_doh_exports, j as discovery$1, k as AccountContext, m as google_doh_exports, nt as version, p as resolver_pool_exports, q as connection_authorization_exports, s as verify_exports, tt as diagnostic_exports, v as doh_exports, x as auth_exports$1 } from "./verify-DvGPb5C9.mjs";
-import { C as encode, O as domain_name_exports, S as decode, T as validate, _ as ProviderTarget, a as AggregateSchema, f as provider_context_exports, g as ProviderConnection, h as DomainAttachment, j as invalid_input_exports, m as ConnectionStatus, o as Error, p as AuthorizationError, s as Service$1, t as canonical_json_exports, u as authorization_exports, v as ProviderTargetEvidence, w as project, x as authorizationError, y as StoredConnection } from "./canonical-json-CQYKsZw7.mjs";
-import { a as start, i as complete, n as Method$1, r as StartResult, t as Error$1 } from "./connect-oI8hcMxc.mjs";
-import { B as provider_exports, F as types_exports, T as plan_exports, a as resolver_exports, dt as zones_exports, g as deletion_exports, lt as zone_discovery_exports, rt as dns_record_exports } from "./resolver-BeGz1ukw.mjs";
-import { Context, Data, Effect, Layer, Schema } from "effect";
-//#region src/auth/connection-lifecycle.ts
-/** Attach one exact provider target to one organization domain. */
-const attach = Effect.fn("ManagedDnsConnections.attach")(function* (input) {
-	return yield* (yield* Service$1).attach(input);
-});
-/** Remove one domain attachment while retaining the organization connection. */
-const detach = Effect.fn("ManagedDnsConnections.detach")(function* (input) {
-	return yield* (yield* Service$1).detach(input);
-});
-/** Disconnect one organization connection, revoking the shared authorization only when final. */
-function disconnect(input) {
-	return Effect.gen(function* () {
-		return yield* (yield* Service$1).disconnect({
-			connectionId: input.connectionId,
-			ownerId: input.ownerId,
-			revoke: input.revokeAuthorization
-		});
-	});
-}
-//#endregion
-//#region src/auth/connection-api.ts
-var connection_api_exports = /* @__PURE__ */ __exportAll({
-	AuthorizationError: () => AuthorizationError,
-	ConnectionStatus: () => ConnectionStatus,
-	DomainAttachment: () => DomainAttachment,
-	Error: () => Error$1,
-	Method: () => Method$1,
-	ProviderConnection: () => ProviderConnection,
-	ProviderTarget: () => ProviderTarget,
-	ProviderTargetEvidence: () => ProviderTargetEvidence,
-	StartResult: () => StartResult,
-	attach: () => attach,
-	authorizationError: () => authorizationError,
-	complete: () => complete,
-	decode: () => decode,
-	detach: () => detach,
-	disconnect: () => disconnect,
-	encode: () => encode,
-	project: () => project,
-	start: () => start,
-	validate: () => validate
-});
-//#endregion
-//#region src/auth/lifecycle-api.ts
-var lifecycle_api_exports = /* @__PURE__ */ __exportAll({
-	AggregateSchema: () => AggregateSchema,
-	Authorization: () => authorization_exports,
-	Error: () => Error,
-	Service: () => Service$1,
-	StoredConnection: () => StoredConnection
-});
-//#endregion
-//#region src/providers/cloudflare/index.ts
-var cloudflare_exports = /* @__PURE__ */ __exportAll({
-	Auth: () => auth_exports,
-	Client: () => client_exports,
-	discovery: () => discovery,
-	make: () => make
-});
-//#endregion
-//#region src/providers/vercel/index.ts
-var vercel_exports = /* @__PURE__ */ __exportAll({
-	AccountContext: () => AccountContext,
-	Auth: () => auth_exports$1,
-	Client: () => client_exports$1,
-	discovery: () => discovery$1,
-	make: () => make$1
-});
-//#endregion
-//#region src/transport.ts
-var transport_exports = /* @__PURE__ */ __exportAll({
-	ApplyResult: () => ApplyResult,
-	AuthenticationMethod: () => AuthenticationMethod,
-	AuthenticationParameter: () => AuthenticationParameter,
-	CleanupOperation: () => CleanupOperation,
-	CleanupPlan: () => CleanupPlan,
-	CleanupResult: () => CleanupResult,
-	Connected: () => Connected,
-	ConnectionResult: () => ConnectionResult,
-	ConnectionSnapshot: () => ConnectionSnapshot,
-	DetachResult: () => DetachResult,
-	Disconnected: () => Disconnected,
-	DnsRecord: () => DnsRecord,
-	DomainAttachment: () => DomainAttachment,
-	Failure: () => Failure,
-	Method: () => Method,
-	Observation: () => Observation,
-	ObservationEvidence: () => ObservationEvidence,
-	OperationResult: () => OperationResult,
-	PlanOperation: () => PlanOperation,
-	Provider: () => Provider,
-	ProviderConnection: () => ProviderConnection,
-	ProviderTarget: () => ProviderTarget,
-	ProviderTargetEvidence: () => ProviderTargetEvidence,
-	ProvisioningPlan: () => ProvisioningPlan,
-	Redirect: () => Redirect,
-	ReusableConnection: () => ReusableConnection,
-	Service: () => Service,
-	Unsupported: () => Unsupported,
-	fromAsync: () => fromAsync,
-	fromDnsRecord: () => fromDnsRecord,
-	layerFromAsync: () => layerFromAsync,
-	toAsync: () => toAsync
-});
-/** A user-presentable failure at the application transport boundary. */
-var Failure = class extends Schema.TaggedError()("Failure", {
-	message: Schema.String,
-	operation: Schema.String,
-	retry: Schema.Literals([
-		"never",
-		"after-user-action",
-		"safe",
-		"unknown"
-	])
-}) {};
-const AuthenticationParameter = Schema.Struct({
-	description: Schema.optionalKey(Schema.String),
-	key: Schema.String,
-	label: Schema.String,
-	placeholder: Schema.optionalKey(Schema.String),
-	required: Schema.optionalKey(Schema.Boolean)
-});
-const AuthenticationMethodSchema = Schema.TaggedUnion({
-	Integration: { label: Schema.String },
-	OAuth: { label: Schema.String },
-	Token: {
-		label: Schema.String,
-		parameters: Schema.optionalKey(Schema.Array(AuthenticationParameter)),
-		placeholder: Schema.optionalKey(Schema.String)
-	}
-});
-/** Authentication method schema and constructors for trusted host transport responses. */
-const AuthenticationMethod = {
-	Schema: AuthenticationMethodSchema,
-	Integration: (input) => AuthenticationMethodSchema.cases.Integration.make(input),
-	OAuth: (input) => AuthenticationMethodSchema.cases.OAuth.make(input),
-	Token: (input) => AuthenticationMethodSchema.cases.Token.make(input)
-};
-const Method = Data.taggedEnum();
-const Provider = Schema.Struct({
-	authentication: Schema.Array(AuthenticationMethod.Schema),
-	id: Schema.String,
-	name: Schema.String
-});
-const ConnectedSchema = Schema.TaggedStruct("Connected", {
-	attachment: DomainAttachment,
-	connection: ProviderConnection,
-	provider: Provider
-});
-/** Constructs a connected transport snapshot from trusted host data. */
-function Connected(input) {
-	return ConnectedSchema.make(input);
-}
-(function(_Connected) {
-	_Connected.Schema = ConnectedSchema;
-})(Connected || (Connected = {}));
-const ReusableConnection = Schema.Struct({
-	connection: ProviderConnection,
-	targets: Schema.Array(ProviderTarget)
-});
-const DisconnectedSchema = Schema.TaggedStruct("Disconnected", {
-	domain: Schema.String,
-	provider: Provider,
-	reusableConnections: Schema.Array(ReusableConnection)
-});
-/** Constructs a disconnected transport snapshot from trusted host data. */
-function Disconnected(input) {
-	return DisconnectedSchema.make(input);
-}
-(function(_Disconnected) {
-	_Disconnected.Schema = DisconnectedSchema;
-})(Disconnected || (Disconnected = {}));
-const UnsupportedSchema = Schema.TaggedStruct("Unsupported", { domain: Schema.String });
-/** Constructs an unsupported transport snapshot from trusted host data. */
-function Unsupported(input) {
-	return UnsupportedSchema.make(input);
-}
-(function(_Unsupported) {
-	_Unsupported.Schema = UnsupportedSchema;
-})(Unsupported || (Unsupported = {}));
-const ConnectionSnapshot = Schema.Union([
-	ConnectedSchema,
-	DisconnectedSchema,
-	UnsupportedSchema
-]).pipe(Schema.toTaggedUnion("_tag"));
-const RedirectSchema = Schema.TaggedStruct("Redirect", { authorizationUrl: Schema.String });
-/** Constructs an OAuth redirect response from trusted host data. */
-function Redirect(input) {
-	return RedirectSchema.make(input);
-}
-(function(_Redirect) {
-	_Redirect.Schema = RedirectSchema;
-})(Redirect || (Redirect = {}));
-const ConnectionResult = Schema.Union([ConnectedSchema, RedirectSchema]).pipe(Schema.toTaggedUnion("_tag"));
-const DetachResultSchema = Schema.TaggedStruct("Detached", {
-	attachment: DomainAttachment,
-	connection: ProviderConnection,
-	remainingAttachments: Schema.Int
-});
-/** Constructs a detach response from trusted host data. */
-function DetachResult(input) {
-	return DetachResultSchema.make(input);
-}
-(function(_DetachResult) {
-	_DetachResult.Schema = DetachResultSchema;
-})(DetachResult || (DetachResult = {}));
-/** A presentation projection of a DNS requirement. */
-const DnsRecord = Schema.Struct({
-	id: Schema.String,
-	name: Schema.String,
-	priority: Schema.optionalKey(Schema.Int),
-	type: Schema.String,
-	value: Schema.String
-});
-/** Projects DomainKit's operational record into its application transport representation. */
-const fromDnsRecord = (id, record) => {
-	switch (record._tag) {
-		case "A":
-		case "AAAA": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: record.address
-		};
-		case "CNAME":
-		case "NS": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: record.target
-		};
-		case "TXT": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: record.value
-		};
-		case "MX": return {
-			id,
-			name: record.name,
-			priority: record.priority,
-			type: record._tag,
-			value: record.exchange
-		};
-		case "CAA": return {
-			id,
-			name: record.name,
-			type: record._tag,
-			value: `${record.flags} ${record.tag} ${record.value}`
-		};
-		case "SRV": return {
-			id,
-			name: record.name,
-			priority: record.priority,
-			type: record._tag,
-			value: `${record.weight} ${record.port} ${record.target}`
-		};
-	}
-};
-const PlanOperationSchema = Schema.TaggedUnion({
-	Conflict: {
-		id: Schema.String,
-		reason: Schema.String,
-		record: DnsRecord
-	},
-	Create: {
-		id: Schema.String,
-		record: DnsRecord
-	},
-	Noop: {
-		id: Schema.String,
-		record: DnsRecord
-	}
-});
-/** Provisioning operation schema and constructors for trusted host responses. */
-const PlanOperation = {
-	Schema: PlanOperationSchema,
-	Conflict: (input) => PlanOperationSchema.cases.Conflict.make(input),
-	Create: (input) => PlanOperationSchema.cases.Create.make(input),
-	Noop: (input) => PlanOperationSchema.cases.Noop.make(input)
-};
-const ProvisioningPlanSchema = Schema.TaggedStruct("Plan", {
-	digest: Schema.String,
-	expiresAt: Schema.String,
-	operations: Schema.Array(PlanOperation.Schema)
-});
-/** Constructs a provisioning plan response from trusted host data. */
-function ProvisioningPlan(input) {
-	return ProvisioningPlanSchema.make(input);
-}
-(function(_ProvisioningPlan) {
-	_ProvisioningPlan.Schema = ProvisioningPlanSchema;
-})(ProvisioningPlan || (ProvisioningPlan = {}));
-const OperationResultSchema = Schema.TaggedUnion({
-	Applied: { operationId: Schema.String },
-	Failed: {
-		message: Schema.String,
-		operationId: Schema.String
-	},
-	Unchanged: { operationId: Schema.String }
-});
-/** Per-operation result schema and constructors for trusted host responses. */
-const OperationResult = {
-	Schema: OperationResultSchema,
-	Applied: (input) => OperationResultSchema.cases.Applied.make(input),
-	Failed: (input) => OperationResultSchema.cases.Failed.make(input),
-	Unchanged: (input) => OperationResultSchema.cases.Unchanged.make(input)
-};
-const ApplyOutcomeFields = {
-	operationId: Schema.String,
-	receiptId: Schema.String,
-	results: Schema.Array(OperationResult.Schema)
-};
-const ApplyResultSchema = Schema.TaggedUnion({
-	Applied: ApplyOutcomeFields,
-	Partial: ApplyOutcomeFields,
-	Stale: { message: Schema.String }
-});
-/** Apply result schema and constructors for trusted host responses. */
-const ApplyResult = {
-	Schema: ApplyResultSchema,
-	Applied: (input) => ApplyResultSchema.cases.Applied.make(input),
-	Partial: (input) => ApplyResultSchema.cases.Partial.make(input),
-	Stale: (input) => ApplyResultSchema.cases.Stale.make(input)
-};
-const ObservationEvidenceSchema = Schema.TaggedUnion({
-	Found: { recordId: Schema.String },
-	Mismatch: {
-		message: Schema.String,
-		recordId: Schema.String
-	},
-	Missing: { recordId: Schema.String },
-	Unavailable: {
-		message: Schema.String,
-		recordId: Schema.String
-	}
-});
-/** DNS observation evidence schema and constructors for trusted host responses. */
-const ObservationEvidence = {
-	Schema: ObservationEvidenceSchema,
-	Found: (input) => ObservationEvidenceSchema.cases.Found.make(input),
-	Mismatch: (input) => ObservationEvidenceSchema.cases.Mismatch.make(input),
-	Missing: (input) => ObservationEvidenceSchema.cases.Missing.make(input),
-	Unavailable: (input) => ObservationEvidenceSchema.cases.Unavailable.make(input)
-};
-const ObservationSchema = Schema.TaggedStruct("Observation", {
-	provider: Schema.Array(ObservationEvidence.Schema),
-	publicDns: Schema.Array(ObservationEvidence.Schema)
-});
-/** Constructs a DNS observation response from trusted host data. */
-function Observation(input) {
-	return ObservationSchema.make(input);
-}
-(function(_Observation) {
-	_Observation.Schema = ObservationSchema;
-})(Observation || (Observation = {}));
-const CleanupOperationSchema = Schema.TaggedUnion({
-	AlreadyAbsent: {
-		id: Schema.String,
-		record: DnsRecord
-	},
-	Blocked: {
-		id: Schema.String,
-		reason: Schema.String,
-		record: DnsRecord
-	},
-	Delete: {
-		id: Schema.String,
-		record: DnsRecord
-	}
-});
-/** Cleanup operation schema and constructors for trusted host responses. */
-const CleanupOperation = {
-	Schema: CleanupOperationSchema,
-	AlreadyAbsent: (input) => CleanupOperationSchema.cases.AlreadyAbsent.make(input),
-	Blocked: (input) => CleanupOperationSchema.cases.Blocked.make(input),
-	Delete: (input) => CleanupOperationSchema.cases.Delete.make(input)
-};
-const CleanupPlanSchema = Schema.TaggedStruct("CleanupPlan", {
-	digest: Schema.String,
-	expiresAt: Schema.String,
-	operations: Schema.Array(CleanupOperation.Schema)
-});
-/** Constructs a cleanup plan response from trusted host data. */
-function CleanupPlan(input) {
-	return CleanupPlanSchema.make(input);
-}
-(function(_CleanupPlan) {
-	_CleanupPlan.Schema = CleanupPlanSchema;
-})(CleanupPlan || (CleanupPlan = {}));
-const CleanupOutcomeFields = {
-	operationId: Schema.String,
-	results: Schema.Array(OperationResult.Schema)
-};
-const CleanupResultSchema = Schema.TaggedUnion({
-	Cleaned: CleanupOutcomeFields,
-	Partial: CleanupOutcomeFields,
-	Stale: { message: Schema.String }
-});
-/** Cleanup result schema and constructors for trusted host responses. */
-const CleanupResult = {
-	Schema: CleanupResultSchema,
-	Cleaned: (input) => CleanupResultSchema.cases.Cleaned.make(input),
-	Partial: (input) => CleanupResultSchema.cases.Partial.make(input),
-	Stale: (input) => CleanupResultSchema.cases.Stale.make(input)
-};
-var Service = class extends Context.Service()("@domainkit/Transport") {};
-/** Converts a Promise-shaped host implementation into the canonical Effect service. */
-const fromAsync = (transport, options = {}) => {
-	const attempt = (operation, evaluate) => Effect.tryPromise({
-		try: evaluate,
-		catch: (cause) => options.onError?.(operation, cause) ?? (cause instanceof Failure ? cause : new Failure({
-			message: cause instanceof globalThis.Error ? cause.message : String(cause),
-			operation,
-			retry: "unknown"
-		}))
-	});
-	return Service.of({
-		cleanup: {
-			apply: (input) => attempt("cleanup.apply", () => transport.cleanup.apply(input)),
-			plan: (input) => attempt("cleanup.plan", () => transport.cleanup.plan(input))
-		},
-		connection: {
-			attach: (input) => attempt("connection.attach", () => transport.connection.attach(input)),
-			connect: (input) => attempt("connection.connect", () => transport.connection.connect(input)),
-			inspect: (input) => attempt("connection.inspect", () => transport.connection.inspect(input)),
-			detach: (input) => attempt("connection.detach", () => transport.connection.detach(input))
-		},
-		provisioning: {
-			apply: (input) => attempt("provisioning.apply", () => transport.provisioning.apply(input)),
-			plan: (input) => attempt("provisioning.plan", () => transport.provisioning.plan(input))
-		},
-		verification: { observe: (input) => attempt("verification.observe", () => transport.verification.observe(input)) }
-	});
-};
-const layerFromAsync = (transport, options) => Layer.succeed(Service, fromAsync(transport, options));
-/** Converts an environment-free Effect service into its Promise-shaped host seam. */
-const toAsync = (transport) => ({
-	cleanup: {
-		apply: (input) => Effect.runPromise(transport.cleanup.apply(input)),
-		plan: (input) => Effect.runPromise(transport.cleanup.plan(input))
-	},
-	connection: {
-		attach: (input) => Effect.runPromise(transport.connection.attach(input)),
-		connect: (input) => Effect.runPromise(transport.connection.connect(input)),
-		inspect: (input) => Effect.runPromise(transport.connection.inspect(input)),
-		detach: (input) => Effect.runPromise(transport.connection.detach(input))
-	},
-	provisioning: {
-		apply: (input) => Effect.runPromise(transport.provisioning.apply(input)),
-		plan: (input) => Effect.runPromise(transport.provisioning.plan(input))
-	},
-	verification: { observe: (input) => Effect.runPromise(transport.verification.observe(input)) }
-});
-//#endregion
+import { DomainName_exports } from "./DomainName.mjs";
+import { DnsRecord_exports } from "./DnsRecord.mjs";
+import { Plan_exports } from "./Plan.mjs";
+import { Reason_exports } from "./Reason.mjs";
+import { Approval_exports } from "./Approval.mjs";
+import { Custody_exports } from "./Custody.mjs";
+import { Principal_exports } from "./Principal.mjs";
+import { Provider_exports } from "./Provider.mjs";
+import { Providers_exports } from "./Providers.mjs";
+import { Resolver_exports } from "./Resolver.mjs";
+import { Receipt_exports } from "./Receipt.mjs";
+import { Storage_exports } from "./Storage.mjs";
+import { Connect_exports } from "./Connect.mjs";
+import { Provision_exports } from "./Provision.mjs";
+import { Cleanup_exports } from "./Cleanup.mjs";
+import { Cloudflare_exports } from "./Cloudflare.mjs";
+import { Verify_exports } from "./Verify.mjs";
+import { DomainKit_exports } from "./DomainKit.mjs";
+import { Vercel_exports } from "./Vercel.mjs";
+import { version } from "./package.mjs";
 //#region src/index.ts
+/**
+* domainkit — the Effect-native root. One module per concept: services expose `Service` (the tag)
+* and `Interface` (its shape), value modules expose `Model` (the schema).
+*
+* Lifecycle services: Connect, Provision, Cleanup, Verify.
+* Host seams:         Storage, Custody, Principal.
+* Providers:          Provider, Providers, Cloudflare, Vercel.
+* Values:             DomainName, DnsRecord, Plan, Approval, Receipt.
+* Everything else:    Reason, Resolver, DomainKit (the composed layer and `DomainKit.Error`).
+*
+* Subpath: domainkit/testing.
+*/
 /** The current package version from the package manifest. */
 const VERSION = version;
 //#endregion
-export { cloudflare_exports as Cloudflare, cloudflare_doh_exports as CloudflareDnsOverHttps, connection_api_exports as Connection, connection_authorization_exports as ConnectionAuthorization, deletion_exports as Deletion, diagnostic_exports as Diagnostic, canonical_json_exports as Digest, dns_data_exports as DnsData, doh_exports as DnsOverHttps, types_exports as DnsPlan, provider_exports as DnsProvider, dns_record_exports as DnsRecord, resolver_exports as DnsResolver, resolver_pool_exports as DnsResolverPool, domain_name_exports as DomainName, google_doh_exports as GoogleDnsOverHttps, invalid_input_exports as InvalidInput, lifecycle_api_exports as ManagedDnsConnections, manifest_exports as ProviderAuth, provider_context_exports as ProviderContext, selection_exports as ProviderDiscovery, session_exports as ProviderSession, plan_exports as Provisioning, secret_exports as Secret, transport_exports as Transport, VERSION, vercel_exports as Vercel, verify_exports as Verification, zone_discovery_exports as ZoneDiscovery, zones_exports as Zones };
+export { Approval_exports as Approval, Cleanup_exports as Cleanup, Cloudflare_exports as Cloudflare, Connect_exports as Connect, Custody_exports as Custody, DnsRecord_exports as DnsRecord, DomainKit_exports as DomainKit, DomainName_exports as DomainName, Plan_exports as Plan, Principal_exports as Principal, Provider_exports as Provider, Providers_exports as Providers, Provision_exports as Provision, Reason_exports as Reason, Receipt_exports as Receipt, Resolver_exports as Resolver, Storage_exports as Storage, VERSION, Vercel_exports as Vercel, Verify_exports as Verify };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["Lifecycle.Service","S","Connection.DomainAttachment","Connection.ProviderConnection","Connection.ProviderTarget","packageJson.version"],"sources":["../src/auth/connection-lifecycle.ts","../src/auth/connection-api.ts","../src/auth/lifecycle-api.ts","../src/providers/cloudflare/index.ts","../src/providers/vercel/index.ts","../src/transport.ts","../src/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Connection from \"./connection.ts\";\nimport * as Lifecycle from \"./lifecycle-repository.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\n\n/** Attach one exact provider target to one organization domain. */\nexport const attach = Effect.fn(\"ManagedDnsConnections.attach\")(function* (input: {\n  readonly attachment: Connection.DomainAttachment;\n  readonly connectionId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.attach(input);\n});\n\n/** Remove one domain attachment while retaining the organization connection. */\nexport const detach = Effect.fn(\"ManagedDnsConnections.detach\")(function* (input: {\n  readonly attachmentId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.detach(input);\n});\n\n/** Disconnect one organization connection, revoking the shared authorization only when final. */\nexport function disconnect<E>(input: {\n  readonly connectionId: string;\n  readonly ownerId: string;\n  readonly revokeAuthorization: (\n    authorization: ProviderAuthorization.ProviderAuthorization,\n  ) => Effect.Effect<void, E>;\n}): Effect.Effect<Lifecycle.DisconnectResult, Lifecycle.Error | E, Lifecycle.Service> {\n  return Effect.gen(function* () {\n    const service = yield* Lifecycle.Service;\n    return yield* service.disconnect({\n      connectionId: input.connectionId,\n      ownerId: input.ownerId,\n      revoke: input.revokeAuthorization,\n    });\n  });\n}\n","export {\n  AuthorizationError,\n  authorizationError,\n  ConnectionStatus,\n  decode,\n  DomainAttachment,\n  encode,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n  project,\n  validate,\n} from \"./connection.ts\";\nexport { attach, detach, disconnect } from \"./connection-lifecycle.ts\";\nexport type { AttachmentResult, DetachResult, DisconnectResult } from \"./lifecycle-repository.ts\";\nexport { complete, Error, Method, start, StartResult } from \"./connect.ts\";\nexport type {\n  Authentication,\n  AuthenticationFailure,\n  BaseInput,\n  CompleteInput,\n  Continuation,\n  ContinuationStore,\n  Failure,\n  InteractiveFlow,\n  InteractiveStart,\n  Method as ConnectionMethod,\n  StartResult as ConnectionStartResult,\n} from \"./connect.ts\";\n","/** Public surface for the cohesive managed-DNS persistence capability. */\nexport { AggregateSchema, Error, Service } from \"./lifecycle-repository.ts\";\nexport * as Authorization from \"./authorization.ts\";\nexport { StoredConnection } from \"./connection.ts\";\nexport type { StoredCredential } from \"./connection.ts\";\nexport type {\n  Aggregate,\n  AttachmentResult,\n  ConnectInput,\n  DetachResult,\n  DisconnectResult,\n  Interface,\n} from \"./lifecycle-repository.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { AccountContext, discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","import { Context, Data, Effect, Layer, Schema as S } from \"effect\";\n\nimport * as Connection from \"./auth/connection.ts\";\nimport type * as DomainDnsRecord from \"./domain/dns-record.ts\";\n\nexport {\n  DomainAttachment,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n} from \"./auth/connection.ts\";\n\n/** A user-presentable failure at the application transport boundary. */\nexport class Failure extends S.TaggedError<Failure>()(\"Failure\", {\n  message: S.String,\n  operation: S.String,\n  retry: S.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport const AuthenticationParameter = S.Struct({\n  description: S.optionalKey(S.String),\n  key: S.String,\n  label: S.String,\n  placeholder: S.optionalKey(S.String),\n  required: S.optionalKey(S.Boolean),\n});\nexport type AuthenticationParameter = typeof AuthenticationParameter.Type;\n\nconst AuthenticationMethodSchema = S.TaggedUnion({\n  Integration: { label: S.String },\n  OAuth: { label: S.String },\n  Token: {\n    label: S.String,\n    parameters: S.optionalKey(S.Array(AuthenticationParameter)),\n    placeholder: S.optionalKey(S.String),\n  },\n});\n\n/** Authentication method schema and constructors for trusted host transport responses. */\nexport const AuthenticationMethod = {\n  Schema: AuthenticationMethodSchema,\n  Integration: (input: Parameters<typeof AuthenticationMethodSchema.cases.Integration.make>[0]) =>\n    AuthenticationMethodSchema.cases.Integration.make(input),\n  OAuth: (input: Parameters<typeof AuthenticationMethodSchema.cases.OAuth.make>[0]) =>\n    AuthenticationMethodSchema.cases.OAuth.make(input),\n  Token: (input: Parameters<typeof AuthenticationMethodSchema.cases.Token.make>[0]) =>\n    AuthenticationMethodSchema.cases.Token.make(input),\n};\nexport type AuthenticationMethod = typeof AuthenticationMethodSchema.Type;\n\n/** The authentication choice supplied to a connection request. */\nexport type Method = Data.TaggedEnum<{\n  Integration: {};\n  OAuth: {};\n  Token: {\n    readonly parameters?: Readonly<Record<string, string>>;\n    readonly token: string;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport const Provider = S.Struct({\n  authentication: S.Array(AuthenticationMethod.Schema),\n  id: S.String,\n  name: S.String,\n});\nexport type Provider = typeof Provider.Type;\n\nconst ConnectedSchema = S.TaggedStruct(\"Connected\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  provider: Provider,\n});\n/** Constructs a connected transport snapshot from trusted host data. */\nexport function Connected(input: Parameters<typeof ConnectedSchema.make>[0]): Connected {\n  return ConnectedSchema.make(input);\n}\nexport namespace Connected {\n  export const Schema = ConnectedSchema;\n}\nexport type Connected = typeof ConnectedSchema.Type;\n\nexport const ReusableConnection = S.Struct({\n  connection: Connection.ProviderConnection,\n  targets: S.Array(Connection.ProviderTarget),\n});\nexport type ReusableConnection = typeof ReusableConnection.Type;\n\nconst DisconnectedSchema = S.TaggedStruct(\"Disconnected\", {\n  domain: S.String,\n  provider: Provider,\n  reusableConnections: S.Array(ReusableConnection),\n});\n/** Constructs a disconnected transport snapshot from trusted host data. */\nexport function Disconnected(input: Parameters<typeof DisconnectedSchema.make>[0]): Disconnected {\n  return DisconnectedSchema.make(input);\n}\nexport namespace Disconnected {\n  export const Schema = DisconnectedSchema;\n}\nexport type Disconnected = typeof DisconnectedSchema.Type;\n\nconst UnsupportedSchema = S.TaggedStruct(\"Unsupported\", { domain: S.String });\n/** Constructs an unsupported transport snapshot from trusted host data. */\nexport function Unsupported(input: Parameters<typeof UnsupportedSchema.make>[0]): Unsupported {\n  return UnsupportedSchema.make(input);\n}\nexport namespace Unsupported {\n  export const Schema = UnsupportedSchema;\n}\nexport type Unsupported = typeof UnsupportedSchema.Type;\n\nexport const ConnectionSnapshot = S.Union([\n  ConnectedSchema,\n  DisconnectedSchema,\n  UnsupportedSchema,\n]).pipe(S.toTaggedUnion(\"_tag\"));\nexport type ConnectionSnapshot = typeof ConnectionSnapshot.Type;\n\nconst RedirectSchema = S.TaggedStruct(\"Redirect\", { authorizationUrl: S.String });\n/** Constructs an OAuth redirect response from trusted host data. */\nexport function Redirect(input: Parameters<typeof RedirectSchema.make>[0]): Redirect {\n  return RedirectSchema.make(input);\n}\nexport namespace Redirect {\n  export const Schema = RedirectSchema;\n}\nexport type Redirect = typeof RedirectSchema.Type;\n\nexport const ConnectionResult = S.Union([ConnectedSchema, RedirectSchema]).pipe(\n  S.toTaggedUnion(\"_tag\"),\n);\nexport type ConnectionResult = typeof ConnectionResult.Type;\n\nconst DetachResultSchema = S.TaggedStruct(\"Detached\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  remainingAttachments: S.Int,\n});\n/** Constructs a detach response from trusted host data. */\nexport function DetachResult(input: Parameters<typeof DetachResultSchema.make>[0]): DetachResult {\n  return DetachResultSchema.make(input);\n}\nexport namespace DetachResult {\n  export const Schema = DetachResultSchema;\n}\nexport type DetachResult = typeof DetachResultSchema.Type;\n\n/** A presentation projection of a DNS requirement. */\nexport const DnsRecord = S.Struct({\n  id: S.String,\n  name: S.String,\n  priority: S.optionalKey(S.Int),\n  type: S.String,\n  value: S.String,\n});\nexport type DnsRecord = typeof DnsRecord.Type;\n\n/** Projects DomainKit's operational record into its application transport representation. */\nexport const fromDnsRecord = (id: string, record: DomainDnsRecord.DnsRecord): DnsRecord => {\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { id, name: record.name, type: record._tag, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { id, name: record.name, type: record._tag, value: record.target };\n    case \"TXT\":\n      return { id, name: record.name, type: record._tag, value: record.value };\n    case \"MX\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: record.exchange,\n      };\n    case \"CAA\":\n      return {\n        id,\n        name: record.name,\n        type: record._tag,\n        value: `${record.flags} ${record.tag} ${record.value}`,\n      };\n    case \"SRV\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: `${record.weight} ${record.port} ${record.target}`,\n      };\n  }\n};\n\nconst PlanOperationSchema = S.TaggedUnion({\n  Conflict: { id: S.String, reason: S.String, record: DnsRecord },\n  Create: { id: S.String, record: DnsRecord },\n  Noop: { id: S.String, record: DnsRecord },\n});\n/** Provisioning operation schema and constructors for trusted host responses. */\nexport const PlanOperation = {\n  Schema: PlanOperationSchema,\n  Conflict: (input: Parameters<typeof PlanOperationSchema.cases.Conflict.make>[0]) =>\n    PlanOperationSchema.cases.Conflict.make(input),\n  Create: (input: Parameters<typeof PlanOperationSchema.cases.Create.make>[0]) =>\n    PlanOperationSchema.cases.Create.make(input),\n  Noop: (input: Parameters<typeof PlanOperationSchema.cases.Noop.make>[0]) =>\n    PlanOperationSchema.cases.Noop.make(input),\n};\nexport type PlanOperation = typeof PlanOperationSchema.Type;\n\nconst ProvisioningPlanSchema = S.TaggedStruct(\"Plan\", {\n  digest: S.String,\n  expiresAt: S.String,\n  operations: S.Array(PlanOperation.Schema),\n});\n/** Constructs a provisioning plan response from trusted host data. */\nexport function ProvisioningPlan(\n  input: Parameters<typeof ProvisioningPlanSchema.make>[0],\n): ProvisioningPlan {\n  return ProvisioningPlanSchema.make(input);\n}\nexport namespace ProvisioningPlan {\n  export const Schema = ProvisioningPlanSchema;\n}\nexport type ProvisioningPlan = typeof ProvisioningPlanSchema.Type;\n\nconst OperationResultSchema = S.TaggedUnion({\n  Applied: { operationId: S.String },\n  Failed: { message: S.String, operationId: S.String },\n  Unchanged: { operationId: S.String },\n});\n/** Per-operation result schema and constructors for trusted host responses. */\nexport const OperationResult = {\n  Schema: OperationResultSchema,\n  Applied: (input: Parameters<typeof OperationResultSchema.cases.Applied.make>[0]) =>\n    OperationResultSchema.cases.Applied.make(input),\n  Failed: (input: Parameters<typeof OperationResultSchema.cases.Failed.make>[0]) =>\n    OperationResultSchema.cases.Failed.make(input),\n  Unchanged: (input: Parameters<typeof OperationResultSchema.cases.Unchanged.make>[0]) =>\n    OperationResultSchema.cases.Unchanged.make(input),\n};\nexport type OperationResult = typeof OperationResultSchema.Type;\n\nconst ApplyOutcomeFields = {\n  operationId: S.String,\n  receiptId: S.String,\n  results: S.Array(OperationResult.Schema),\n};\nconst ApplyResultSchema = S.TaggedUnion({\n  Applied: ApplyOutcomeFields,\n  Partial: ApplyOutcomeFields,\n  Stale: { message: S.String },\n});\n/** Apply result schema and constructors for trusted host responses. */\nexport const ApplyResult = {\n  Schema: ApplyResultSchema,\n  Applied: (input: Parameters<typeof ApplyResultSchema.cases.Applied.make>[0]) =>\n    ApplyResultSchema.cases.Applied.make(input),\n  Partial: (input: Parameters<typeof ApplyResultSchema.cases.Partial.make>[0]) =>\n    ApplyResultSchema.cases.Partial.make(input),\n  Stale: (input: Parameters<typeof ApplyResultSchema.cases.Stale.make>[0]) =>\n    ApplyResultSchema.cases.Stale.make(input),\n};\nexport type ApplyResult = typeof ApplyResultSchema.Type;\n\nconst ObservationEvidenceSchema = S.TaggedUnion({\n  Found: { recordId: S.String },\n  Mismatch: { message: S.String, recordId: S.String },\n  Missing: { recordId: S.String },\n  Unavailable: { message: S.String, recordId: S.String },\n});\n/** DNS observation evidence schema and constructors for trusted host responses. */\nexport const ObservationEvidence = {\n  Schema: ObservationEvidenceSchema,\n  Found: (input: Parameters<typeof ObservationEvidenceSchema.cases.Found.make>[0]) =>\n    ObservationEvidenceSchema.cases.Found.make(input),\n  Mismatch: (input: Parameters<typeof ObservationEvidenceSchema.cases.Mismatch.make>[0]) =>\n    ObservationEvidenceSchema.cases.Mismatch.make(input),\n  Missing: (input: Parameters<typeof ObservationEvidenceSchema.cases.Missing.make>[0]) =>\n    ObservationEvidenceSchema.cases.Missing.make(input),\n  Unavailable: (input: Parameters<typeof ObservationEvidenceSchema.cases.Unavailable.make>[0]) =>\n    ObservationEvidenceSchema.cases.Unavailable.make(input),\n};\nexport type ObservationEvidence = typeof ObservationEvidenceSchema.Type;\n\nconst ObservationSchema = S.TaggedStruct(\"Observation\", {\n  provider: S.Array(ObservationEvidence.Schema),\n  publicDns: S.Array(ObservationEvidence.Schema),\n});\n/** Constructs a DNS observation response from trusted host data. */\nexport function Observation(input: Parameters<typeof ObservationSchema.make>[0]): Observation {\n  return ObservationSchema.make(input);\n}\nexport namespace Observation {\n  export const Schema = ObservationSchema;\n}\nexport type Observation = typeof ObservationSchema.Type;\n\nconst CleanupOperationSchema = S.TaggedUnion({\n  AlreadyAbsent: { id: S.String, record: DnsRecord },\n  Blocked: { id: S.String, reason: S.String, record: DnsRecord },\n  Delete: { id: S.String, record: DnsRecord },\n});\n/** Cleanup operation schema and constructors for trusted host responses. */\nexport const CleanupOperation = {\n  Schema: CleanupOperationSchema,\n  AlreadyAbsent: (input: Parameters<typeof CleanupOperationSchema.cases.AlreadyAbsent.make>[0]) =>\n    CleanupOperationSchema.cases.AlreadyAbsent.make(input),\n  Blocked: (input: Parameters<typeof CleanupOperationSchema.cases.Blocked.make>[0]) =>\n    CleanupOperationSchema.cases.Blocked.make(input),\n  Delete: (input: Parameters<typeof CleanupOperationSchema.cases.Delete.make>[0]) =>\n    CleanupOperationSchema.cases.Delete.make(input),\n};\nexport type CleanupOperation = typeof CleanupOperationSchema.Type;\n\nconst CleanupPlanSchema = S.TaggedStruct(\"CleanupPlan\", {\n  digest: S.String,\n  expiresAt: S.String,\n  operations: S.Array(CleanupOperation.Schema),\n});\n/** Constructs a cleanup plan response from trusted host data. */\nexport function CleanupPlan(input: Parameters<typeof CleanupPlanSchema.make>[0]): CleanupPlan {\n  return CleanupPlanSchema.make(input);\n}\nexport namespace CleanupPlan {\n  export const Schema = CleanupPlanSchema;\n}\nexport type CleanupPlan = typeof CleanupPlanSchema.Type;\n\nconst CleanupOutcomeFields = {\n  operationId: S.String,\n  results: S.Array(OperationResult.Schema),\n};\nconst CleanupResultSchema = S.TaggedUnion({\n  Cleaned: CleanupOutcomeFields,\n  Partial: CleanupOutcomeFields,\n  Stale: { message: S.String },\n});\n/** Cleanup result schema and constructors for trusted host responses. */\nexport const CleanupResult = {\n  Schema: CleanupResultSchema,\n  Cleaned: (input: Parameters<typeof CleanupResultSchema.cases.Cleaned.make>[0]) =>\n    CleanupResultSchema.cases.Cleaned.make(input),\n  Partial: (input: Parameters<typeof CleanupResultSchema.cases.Partial.make>[0]) =>\n    CleanupResultSchema.cases.Partial.make(input),\n  Stale: (input: Parameters<typeof CleanupResultSchema.cases.Stale.make>[0]) =>\n    CleanupResultSchema.cases.Stale.make(input),\n};\nexport type CleanupResult = typeof CleanupResultSchema.Type;\n\nexport interface ConnectInput {\n  readonly domain: string;\n  readonly method: Method;\n  readonly providerId: string;\n}\n\nexport interface InspectInput {\n  readonly domain: string;\n}\n\nexport interface AttachInput {\n  readonly connectionId: string;\n  readonly domain: string;\n  readonly target: Connection.ProviderTarget;\n}\n\nexport interface DetachInput {\n  readonly attachmentId: string;\n  readonly preserveDns: true;\n}\n\nexport interface ProvisioningPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n}\n\nexport interface ProvisioningApplyInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly planDigest: string;\n}\n\nexport interface ObserveInput {\n  readonly attachmentId?: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n  readonly sources: {\n    readonly provider: boolean;\n    readonly publicDns: boolean;\n  };\n}\n\nexport interface CleanupPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly receiptId: string;\n}\n\nexport interface CleanupApplyInput extends CleanupPlanInput {\n  readonly planDigest: string;\n}\n\n/** Application-facing DNS connection and provisioning capability. */\nexport interface Interface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Effect.Effect<CleanupResult, Failure>;\n    readonly plan: (input: CleanupPlanInput) => Effect.Effect<CleanupPlan, Failure>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Effect.Effect<Connected, Failure>;\n    readonly connect: (input: ConnectInput) => Effect.Effect<ConnectionResult, Failure>;\n    readonly inspect: (input: InspectInput) => Effect.Effect<ConnectionSnapshot, Failure>;\n    readonly detach: (input: DetachInput) => Effect.Effect<DetachResult, Failure>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Effect.Effect<ApplyResult, Failure>;\n    readonly plan: (input: ProvisioningPlanInput) => Effect.Effect<ProvisioningPlan, Failure>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Effect.Effect<Observation, Failure>;\n  };\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Transport\") {}\n\n/** Promise-shaped host seam for foreign runtimes and framework actions. */\nexport interface AsyncInterface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Promise<CleanupResult>;\n    readonly plan: (input: CleanupPlanInput) => Promise<CleanupPlan>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Promise<Connected>;\n    readonly connect: (input: ConnectInput) => Promise<ConnectionResult>;\n    readonly inspect: (input: InspectInput) => Promise<ConnectionSnapshot>;\n    readonly detach: (input: DetachInput) => Promise<DetachResult>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Promise<ApplyResult>;\n    readonly plan: (input: ProvisioningPlanInput) => Promise<ProvisioningPlan>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Promise<Observation>;\n  };\n}\n\nexport interface AsyncOptions {\n  readonly onError?: (operation: string, cause: unknown) => Failure;\n}\n\n/** Converts a Promise-shaped host implementation into the canonical Effect service. */\nexport const fromAsync = (transport: AsyncInterface, options: AsyncOptions = {}): Interface => {\n  const attempt = <A>(operation: string, evaluate: () => Promise<A>) =>\n    Effect.tryPromise({\n      try: evaluate,\n      catch: (cause) =>\n        options.onError?.(operation, cause) ??\n        (cause instanceof Failure\n          ? cause\n          : new Failure({\n              message: cause instanceof globalThis.Error ? cause.message : String(cause),\n              operation,\n              retry: \"unknown\",\n            })),\n    });\n  return Service.of({\n    cleanup: {\n      apply: (input) => attempt(\"cleanup.apply\", () => transport.cleanup.apply(input)),\n      plan: (input) => attempt(\"cleanup.plan\", () => transport.cleanup.plan(input)),\n    },\n    connection: {\n      attach: (input) => attempt(\"connection.attach\", () => transport.connection.attach(input)),\n      connect: (input) => attempt(\"connection.connect\", () => transport.connection.connect(input)),\n      inspect: (input) => attempt(\"connection.inspect\", () => transport.connection.inspect(input)),\n      detach: (input) => attempt(\"connection.detach\", () => transport.connection.detach(input)),\n    },\n    provisioning: {\n      apply: (input) => attempt(\"provisioning.apply\", () => transport.provisioning.apply(input)),\n      plan: (input) => attempt(\"provisioning.plan\", () => transport.provisioning.plan(input)),\n    },\n    verification: {\n      observe: (input) =>\n        attempt(\"verification.observe\", () => transport.verification.observe(input)),\n    },\n  });\n};\n\nexport const layerFromAsync = (\n  transport: AsyncInterface,\n  options?: AsyncOptions,\n): Layer.Layer<Service> => Layer.succeed(Service, fromAsync(transport, options));\n\n/** Converts an environment-free Effect service into its Promise-shaped host seam. */\nexport const toAsync = (transport: Interface): AsyncInterface => ({\n  cleanup: {\n    apply: (input) => Effect.runPromise(transport.cleanup.apply(input)),\n    plan: (input) => Effect.runPromise(transport.cleanup.plan(input)),\n  },\n  connection: {\n    attach: (input) => Effect.runPromise(transport.connection.attach(input)),\n    connect: (input) => Effect.runPromise(transport.connection.connect(input)),\n    inspect: (input) => Effect.runPromise(transport.connection.inspect(input)),\n    detach: (input) => Effect.runPromise(transport.connection.detach(input)),\n  },\n  provisioning: {\n    apply: (input) => Effect.runPromise(transport.provisioning.apply(input)),\n    plan: (input) => Effect.runPromise(transport.provisioning.plan(input)),\n  },\n  verification: {\n    observe: (input) => Effect.runPromise(transport.verification.observe(input)),\n  },\n});\n","import packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Connection from \"./auth/connection-api.ts\";\nexport * as ManagedDnsConnections from \"./auth/lifecycle-api.ts\";\nexport * as Diagnostic from \"./auth/diagnostic.ts\";\nexport * as ProviderAuth from \"./auth/manifest.ts\";\nexport * as ProviderContext from \"./auth/provider-context.ts\";\nexport * as Secret from \"./auth/secret.ts\";\nexport * as ProviderDiscovery from \"./discovery/selection.ts\";\nexport * as ZoneDiscovery from \"./discovery/zone-discovery.ts\";\nexport * as Zones from \"./discovery/zones.ts\";\nexport * as DnsRecord from \"./domain/dns-record.ts\";\nexport * as DomainName from \"./domain/domain-name.ts\";\nexport * as InvalidInput from \"./invalid-input.ts\";\nexport * as DnsProvider from \"./provider/provider.ts\";\nexport * as ProviderSession from \"./provider/session.ts\";\nexport * as ConnectionAuthorization from \"./plan/connection-authorization.ts\";\nexport * as Digest from \"./plan/canonical-json.ts\";\nexport * as Deletion from \"./plan/deletion.ts\";\nexport * as Provisioning from \"./plan/plan.ts\";\nexport * as DnsPlan from \"./plan/types.ts\";\nexport * as Cloudflare from \"./providers/cloudflare/index.ts\";\nexport * as Vercel from \"./providers/vercel/index.ts\";\nexport * as Transport from \"./transport.ts\";\nexport * as CloudflareDnsOverHttps from \"./verification/cloudflare-doh.ts\";\nexport * as DnsData from \"./verification/dns-data.ts\";\nexport * as DnsOverHttps from \"./verification/doh.ts\";\nexport * as GoogleDnsOverHttps from \"./verification/google-doh.ts\";\nexport * as DnsResolverPool from \"./verification/resolver-pool.ts\";\nexport * as DnsResolver from \"./verification/resolver.ts\";\nexport * as Verification from \"./verification/verify.ts\";\n"],"mappings":";;;;;;;;AAOA,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAIxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAGxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,SAAgB,WAAc,OAMwD;CACpF,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,QAAO,OADSA,UAAAA,CACD,WAAW;GAC/B,cAAc,MAAM;GACpB,SAAS,MAAM;GACf,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AK5BA,IAAa,UAAb,cAA6BC,OAAE,YAAqB,CAAC,CAAC,WAAW;CAC/D,SAASA,OAAE;CACX,WAAWA,OAAE;CACb,OAAOA,OAAE,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AACrE,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,0BAA0BA,OAAE,OAAO;CAC9C,aAAaA,OAAE,YAAYA,OAAE,MAAM;CACnC,KAAKA,OAAE;CACP,OAAOA,OAAE;CACT,aAAaA,OAAE,YAAYA,OAAE,MAAM;CACnC,UAAUA,OAAE,YAAYA,OAAE,OAAO;AACnC,CAAC;AAGD,MAAM,6BAA6BA,OAAE,YAAY;CAC/C,aAAa,EAAE,OAAOA,OAAE,OAAO;CAC/B,OAAO,EAAE,OAAOA,OAAE,OAAO;CACzB,OAAO;EACL,OAAOA,OAAE;EACT,YAAYA,OAAE,YAAYA,OAAE,MAAM,uBAAuB,CAAC;EAC1D,aAAaA,OAAE,YAAYA,OAAE,MAAM;CACrC;AACF,CAAC;;AAGD,MAAa,uBAAuB;CAClC,QAAQ;CACR,cAAc,UACZ,2BAA2B,MAAM,YAAY,KAAK,KAAK;CACzD,QAAQ,UACN,2BAA2B,MAAM,MAAM,KAAK,KAAK;CACnD,QAAQ,UACN,2BAA2B,MAAM,MAAM,KAAK,KAAK;AACrD;AAYA,MAAa,SAAS,KAAK,WAAmB;AAE9C,MAAa,WAAWA,OAAE,OAAO;CAC/B,gBAAgBA,OAAE,MAAM,qBAAqB,MAAM;CACnD,IAAIA,OAAE;CACN,MAAMA,OAAE;AACV,CAAC;AAGD,MAAM,kBAAkBA,OAAE,aAAa,aAAa;CAClD,YAAYC;CACZ,YAAYC;CACZ,UAAU;AACZ,CAAC;;AAED,SAAgB,UAAU,OAA8D;CACtF,OAAO,gBAAgB,KAAK,KAAK;AACnC;CACO,SAAA,YAAA;CACiB,WAAA,SAAA;AACvB,EAAA,CAAA,cAAA,YAAA,CAAA,EAAD;AAGA,MAAa,qBAAqBF,OAAE,OAAO;CACzC,YAAYE;CACZ,SAASF,OAAE,MAAMG,cAAyB;AAC5C,CAAC;AAGD,MAAM,qBAAqBH,OAAE,aAAa,gBAAgB;CACxD,QAAQA,OAAE;CACV,UAAU;CACV,qBAAqBA,OAAE,MAAM,kBAAkB;AACjD,CAAC;;AAED,SAAgB,aAAa,OAAoE;CAC/F,OAAO,mBAAmB,KAAK,KAAK;AACtC;CACO,SAAA,eAAA;CACiB,cAAA,SAAA;AACvB,EAAA,CAAA,iBAAA,eAAA,CAAA,EAAD;AAGA,MAAM,oBAAoBA,OAAE,aAAa,eAAe,EAAE,QAAQA,OAAE,OAAO,CAAC;;AAE5E,SAAgB,YAAY,OAAkE;CAC5F,OAAO,kBAAkB,KAAK,KAAK;AACrC;CACO,SAAA,cAAA;CACiB,aAAA,SAAA;AACvB,EAAA,CAAA,gBAAA,cAAA,CAAA,EAAD;AAGA,MAAa,qBAAqBA,OAAE,MAAM;CACxC;CACA;CACA;AACF,CAAC,CAAC,CAAC,KAAKA,OAAE,cAAc,MAAM,CAAC;AAG/B,MAAM,iBAAiBA,OAAE,aAAa,YAAY,EAAE,kBAAkBA,OAAE,OAAO,CAAC;;AAEhF,SAAgB,SAAS,OAA4D;CACnF,OAAO,eAAe,KAAK,KAAK;AAClC;CACO,SAAA,WAAA;CACiB,UAAA,SAAA;AACvB,EAAA,CAAA,aAAA,WAAA,CAAA,EAAD;AAGA,MAAa,mBAAmBA,OAAE,MAAM,CAAC,iBAAiB,cAAc,CAAC,CAAC,CAAC,KACzEA,OAAE,cAAc,MAAM,CACxB;AAGA,MAAM,qBAAqBA,OAAE,aAAa,YAAY;CACpD,YAAYC;CACZ,YAAYC;CACZ,sBAAsBF,OAAE;AAC1B,CAAC;;AAED,SAAgB,aAAa,OAAoE;CAC/F,OAAO,mBAAmB,KAAK,KAAK;AACtC;CACO,SAAA,eAAA;CACiB,cAAA,SAAA;AACvB,EAAA,CAAA,iBAAA,eAAA,CAAA,EAAD;;AAIA,MAAa,YAAYA,OAAE,OAAO;CAChC,IAAIA,OAAE;CACN,MAAMA,OAAE;CACR,UAAUA,OAAE,YAAYA,OAAE,GAAG;CAC7B,MAAMA,OAAE;CACR,OAAOA,OAAE;AACX,CAAC;;AAID,MAAa,iBAAiB,IAAY,WAAiD;CACzF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAQ;EAC3E,KAAK;EACL,KAAK,MACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAO;EAC1E,KAAK,OACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAM;EACzE,KAAK,MACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,GAAG,OAAO;EACjD;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,GAAG,OAAO,KAAK,GAAG,OAAO;EACnD;CACJ;AACF;AAEA,MAAM,sBAAsBA,OAAE,YAAY;CACxC,UAAU;EAAE,IAAIA,OAAE;EAAQ,QAAQA,OAAE;EAAQ,QAAQ;CAAU;CAC9D,QAAQ;EAAE,IAAIA,OAAE;EAAQ,QAAQ;CAAU;CAC1C,MAAM;EAAE,IAAIA,OAAE;EAAQ,QAAQ;CAAU;AAC1C,CAAC;;AAED,MAAa,gBAAgB;CAC3B,QAAQ;CACR,WAAW,UACT,oBAAoB,MAAM,SAAS,KAAK,KAAK;CAC/C,SAAS,UACP,oBAAoB,MAAM,OAAO,KAAK,KAAK;CAC7C,OAAO,UACL,oBAAoB,MAAM,KAAK,KAAK,KAAK;AAC7C;AAGA,MAAM,yBAAyBA,OAAE,aAAa,QAAQ;CACpD,QAAQA,OAAE;CACV,WAAWA,OAAE;CACb,YAAYA,OAAE,MAAM,cAAc,MAAM;AAC1C,CAAC;;AAED,SAAgB,iBACd,OACkB;CAClB,OAAO,uBAAuB,KAAK,KAAK;AAC1C;CACO,SAAA,mBAAA;CACiB,kBAAA,SAAA;AACvB,EAAA,CAAA,qBAAA,mBAAA,CAAA,EAAD;AAGA,MAAM,wBAAwBA,OAAE,YAAY;CAC1C,SAAS,EAAE,aAAaA,OAAE,OAAO;CACjC,QAAQ;EAAE,SAASA,OAAE;EAAQ,aAAaA,OAAE;CAAO;CACnD,WAAW,EAAE,aAAaA,OAAE,OAAO;AACrC,CAAC;;AAED,MAAa,kBAAkB;CAC7B,QAAQ;CACR,UAAU,UACR,sBAAsB,MAAM,QAAQ,KAAK,KAAK;CAChD,SAAS,UACP,sBAAsB,MAAM,OAAO,KAAK,KAAK;CAC/C,YAAY,UACV,sBAAsB,MAAM,UAAU,KAAK,KAAK;AACpD;AAGA,MAAM,qBAAqB;CACzB,aAAaA,OAAE;CACf,WAAWA,OAAE;CACb,SAASA,OAAE,MAAM,gBAAgB,MAAM;AACzC;AACA,MAAM,oBAAoBA,OAAE,YAAY;CACtC,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAASA,OAAE,OAAO;AAC7B,CAAC;;AAED,MAAa,cAAc;CACzB,QAAQ;CACR,UAAU,UACR,kBAAkB,MAAM,QAAQ,KAAK,KAAK;CAC5C,UAAU,UACR,kBAAkB,MAAM,QAAQ,KAAK,KAAK;CAC5C,QAAQ,UACN,kBAAkB,MAAM,MAAM,KAAK,KAAK;AAC5C;AAGA,MAAM,4BAA4BA,OAAE,YAAY;CAC9C,OAAO,EAAE,UAAUA,OAAE,OAAO;CAC5B,UAAU;EAAE,SAASA,OAAE;EAAQ,UAAUA,OAAE;CAAO;CAClD,SAAS,EAAE,UAAUA,OAAE,OAAO;CAC9B,aAAa;EAAE,SAASA,OAAE;EAAQ,UAAUA,OAAE;CAAO;AACvD,CAAC;;AAED,MAAa,sBAAsB;CACjC,QAAQ;CACR,QAAQ,UACN,0BAA0B,MAAM,MAAM,KAAK,KAAK;CAClD,WAAW,UACT,0BAA0B,MAAM,SAAS,KAAK,KAAK;CACrD,UAAU,UACR,0BAA0B,MAAM,QAAQ,KAAK,KAAK;CACpD,cAAc,UACZ,0BAA0B,MAAM,YAAY,KAAK,KAAK;AAC1D;AAGA,MAAM,oBAAoBA,OAAE,aAAa,eAAe;CACtD,UAAUA,OAAE,MAAM,oBAAoB,MAAM;CAC5C,WAAWA,OAAE,MAAM,oBAAoB,MAAM;AAC/C,CAAC;;AAED,SAAgB,YAAY,OAAkE;CAC5F,OAAO,kBAAkB,KAAK,KAAK;AACrC;CACO,SAAA,cAAA;CACiB,aAAA,SAAA;AACvB,EAAA,CAAA,gBAAA,cAAA,CAAA,EAAD;AAGA,MAAM,yBAAyBA,OAAE,YAAY;CAC3C,eAAe;EAAE,IAAIA,OAAE;EAAQ,QAAQ;CAAU;CACjD,SAAS;EAAE,IAAIA,OAAE;EAAQ,QAAQA,OAAE;EAAQ,QAAQ;CAAU;CAC7D,QAAQ;EAAE,IAAIA,OAAE;EAAQ,QAAQ;CAAU;AAC5C,CAAC;;AAED,MAAa,mBAAmB;CAC9B,QAAQ;CACR,gBAAgB,UACd,uBAAuB,MAAM,cAAc,KAAK,KAAK;CACvD,UAAU,UACR,uBAAuB,MAAM,QAAQ,KAAK,KAAK;CACjD,SAAS,UACP,uBAAuB,MAAM,OAAO,KAAK,KAAK;AAClD;AAGA,MAAM,oBAAoBA,OAAE,aAAa,eAAe;CACtD,QAAQA,OAAE;CACV,WAAWA,OAAE;CACb,YAAYA,OAAE,MAAM,iBAAiB,MAAM;AAC7C,CAAC;;AAED,SAAgB,YAAY,OAAkE;CAC5F,OAAO,kBAAkB,KAAK,KAAK;AACrC;CACO,SAAA,cAAA;CACiB,aAAA,SAAA;AACvB,EAAA,CAAA,gBAAA,cAAA,CAAA,EAAD;AAGA,MAAM,uBAAuB;CAC3B,aAAaA,OAAE;CACf,SAASA,OAAE,MAAM,gBAAgB,MAAM;AACzC;AACA,MAAM,sBAAsBA,OAAE,YAAY;CACxC,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAASA,OAAE,OAAO;AAC7B,CAAC;;AAED,MAAa,gBAAgB;CAC3B,QAAQ;CACR,UAAU,UACR,oBAAoB,MAAM,QAAQ,KAAK,KAAK;CAC9C,UAAU,UACR,oBAAoB,MAAM,QAAQ,KAAK,KAAK;CAC9C,QAAQ,UACN,oBAAoB,MAAM,MAAM,KAAK,KAAK;AAC9C;AA6EA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;;AA4B5F,MAAa,aAAa,WAA2B,UAAwB,CAAC,MAAiB;CAC7F,MAAM,WAAc,WAAmB,aACrC,OAAO,WAAW;EAChB,KAAK;EACL,QAAQ,UACN,QAAQ,UAAU,WAAW,KAAK,MACjC,iBAAiB,UACd,QACA,IAAI,QAAQ;GACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;GACzE;GACA,OAAO;EACT,CAAC;CACT,CAAC;CACH,OAAO,QAAQ,GAAG;EAChB,SAAS;GACP,QAAQ,UAAU,QAAQ,uBAAuB,UAAU,QAAQ,MAAM,KAAK,CAAC;GAC/E,OAAO,UAAU,QAAQ,sBAAsB,UAAU,QAAQ,KAAK,KAAK,CAAC;EAC9E;EACA,YAAY;GACV,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;GACxF,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;EAC1F;EACA,cAAc;GACZ,QAAQ,UAAU,QAAQ,4BAA4B,UAAU,aAAa,MAAM,KAAK,CAAC;GACzF,OAAO,UAAU,QAAQ,2BAA2B,UAAU,aAAa,KAAK,KAAK,CAAC;EACxF;EACA,cAAc,EACZ,UAAU,UACR,QAAQ,8BAA8B,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC/E;CACF,CAAC;AACH;AAEA,MAAa,kBACX,WACA,YACyB,MAAM,QAAQ,SAAS,UAAU,WAAW,OAAO,CAAC;;AAG/E,MAAa,WAAW,eAA0C;CAChE,SAAS;EACP,QAAQ,UAAU,OAAO,WAAW,UAAU,QAAQ,MAAM,KAAK,CAAC;EAClE,OAAO,UAAU,OAAO,WAAW,UAAU,QAAQ,KAAK,KAAK,CAAC;CAClE;CACA,YAAY;EACV,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;EACvE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;CACzE;CACA,cAAc;EACZ,QAAQ,UAAU,OAAO,WAAW,UAAU,aAAa,MAAM,KAAK,CAAC;EACvE,OAAO,UAAU,OAAO,WAAW,UAAU,aAAa,KAAK,KAAK,CAAC;CACvE;CACA,cAAc,EACZ,UAAU,UAAU,OAAO,WAAW,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC7E;AACF;;;;AC/fA,MAAa,UAAUI"}
+{"version":3,"file":"index.mjs","names":["packageJson.version"],"sources":["../src/index.ts"],"sourcesContent":["/**\n * domainkit — the Effect-native root. One module per concept: services expose `Service` (the tag)\n * and `Interface` (its shape), value modules expose `Model` (the schema).\n *\n * Lifecycle services: Connect, Provision, Cleanup, Verify.\n * Host seams:         Storage, Custody, Principal.\n * Providers:          Provider, Providers, Cloudflare, Vercel.\n * Values:             DomainName, DnsRecord, Plan, Approval, Receipt.\n * Everything else:    Reason, Resolver, DomainKit (the composed layer and `DomainKit.Error`).\n *\n * Subpath: domainkit/testing.\n */\nimport packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Approval from \"./Approval.ts\";\nexport * as Cleanup from \"./Cleanup.ts\";\nexport * as Cloudflare from \"./Cloudflare.ts\";\nexport * as Connect from \"./Connect.ts\";\nexport * as Custody from \"./Custody.ts\";\nexport * as DnsRecord from \"./DnsRecord.ts\";\nexport * as DomainKit from \"./DomainKit.ts\";\nexport * as DomainName from \"./DomainName.ts\";\nexport * as Plan from \"./Plan.ts\";\nexport * as Principal from \"./Principal.ts\";\nexport * as Provider from \"./Provider.ts\";\nexport * as Providers from \"./Providers.ts\";\nexport * as Provision from \"./Provision.ts\";\nexport * as Reason from \"./Reason.ts\";\nexport * as Receipt from \"./Receipt.ts\";\nexport * as Resolver from \"./Resolver.ts\";\nexport * as Storage from \"./Storage.ts\";\nexport * as Vercel from \"./Vercel.ts\";\nexport * as Verify from \"./Verify.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,UAAUA"}

package/dist/internal/aes.mjs

@@ -0,0 +1,61 @@
+import { CryptoFailed } from "../Reason.mjs";
+import { DomainKitError } from "./error.mjs";
+import { Effect, Redacted } from "effect";
+//#region src/internal/aes.ts
+const version = "v1";
+const ivBytes = 12;
+const cryptoFailed = (operation) => () => new DomainKitError({ reason: new CryptoFailed({ operation }) });
+/** Accepts a 32-byte key as base64, base64url, or hex. */
+const decodeKey = (encoded) => {
+	const trimmed = encoded.trim();
+	if (/^[0-9a-fA-F]{64}$/.test(trimmed)) return Uint8Array.from(trimmed.match(/../g) ?? [], (byte) => Number.parseInt(byte, 16));
+	try {
+		const bytes = fromBase64(trimmed);
+		return bytes.length === 32 ? bytes : null;
+	} catch {
+		return null;
+	}
+};
+const importKey = (raw) => Effect.tryPromise({
+	try: () => crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]),
+	catch: cryptoFailed("seal")
+});
+const seal = (key, plaintext) => Effect.tryPromise({
+	try: async () => {
+		const iv = crypto.getRandomValues(new Uint8Array(ivBytes));
+		const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv
+		}, key, new TextEncoder().encode(Redacted.value(plaintext))));
+		return `${version}.${toBase64Url(iv)}.${toBase64Url(ciphertext)}`;
+	},
+	catch: cryptoFailed("seal")
+});
+const open = (key, envelope) => Effect.tryPromise({
+	try: async () => {
+		const [tag, iv, ciphertext] = envelope.split(".");
+		if (tag !== version || iv === void 0 || ciphertext === void 0) throw new Error("unsupported envelope");
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64(iv)
+		}, key, fromBase64(ciphertext));
+		return Redacted.make(new TextDecoder().decode(plaintext));
+	},
+	catch: cryptoFailed("open")
+});
+const generateKey = () => toBase64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+function toBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64(value) {
+	const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+	const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+	const binary = atob(padded);
+	return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+//#endregion
+export { decodeKey, generateKey, importKey, open, seal };
+
+//# sourceMappingURL=aes.mjs.map

package/dist/internal/aes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes.mjs","names":["Errors.DomainKitError","Reason.CryptoFailed"],"sources":["../../src/internal/aes.ts"],"sourcesContent":["import { Effect, Redacted } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\nconst version = \"v1\";\nconst ivBytes = 12;\n\nconst cryptoFailed = (operation: \"seal\" | \"open\") => () =>\n  new Errors.DomainKitError({\n    reason: new Reason.CryptoFailed({ operation }),\n  });\n\n/** Accepts a 32-byte key as base64, base64url, or hex. */\nexport const decodeKey = (encoded: string): Uint8Array<ArrayBuffer> | null => {\n  const trimmed = encoded.trim();\n  if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {\n    return Uint8Array.from(trimmed.match(/../g) ?? [], (byte) => Number.parseInt(byte, 16));\n  }\n  try {\n    const bytes = fromBase64(trimmed);\n    return bytes.length === 32 ? bytes : null;\n  } catch {\n    return null;\n  }\n};\n\nexport const importKey = (\n  raw: Uint8Array<ArrayBuffer>,\n): Effect.Effect<CryptoKey, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: () =>\n      crypto.subtle.importKey(\"raw\", raw, { name: \"AES-GCM\" }, false, [\"encrypt\", \"decrypt\"]),\n    catch: cryptoFailed(\"seal\"),\n  });\n\nexport const seal = (\n  key: CryptoKey,\n  plaintext: Redacted.Redacted<string>,\n): Effect.Effect<string, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async () => {\n      const iv = crypto.getRandomValues(new Uint8Array(ivBytes));\n      const ciphertext = new Uint8Array(\n        await crypto.subtle.encrypt(\n          { name: \"AES-GCM\", iv },\n          key,\n          new TextEncoder().encode(Redacted.value(plaintext)),\n        ),\n      );\n      return `${version}.${toBase64Url(iv)}.${toBase64Url(ciphertext)}`;\n    },\n    catch: cryptoFailed(\"seal\"),\n  });\n\nexport const open = (\n  key: CryptoKey,\n  envelope: string,\n): Effect.Effect<Redacted.Redacted<string>, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async () => {\n      const [tag, iv, ciphertext] = envelope.split(\".\");\n      if (tag !== version || iv === undefined || ciphertext === undefined) {\n        throw new Error(\"unsupported envelope\");\n      }\n      const plaintext = await crypto.subtle.decrypt(\n        { name: \"AES-GCM\", iv: fromBase64(iv) },\n        key,\n        fromBase64(ciphertext),\n      );\n      return Redacted.make(new TextDecoder().decode(plaintext));\n    },\n    catch: cryptoFailed(\"open\"),\n  });\n\nexport const generateKey = (): string => toBase64Url(crypto.getRandomValues(new Uint8Array(32)));\n\nfunction toBase64Url(bytes: Uint8Array<ArrayBuffer>): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\nfunction fromBase64(value: string): Uint8Array<ArrayBuffer> {\n  const normalized = value.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\");\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n  const binary = atob(padded);\n  return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n"],"mappings":";;;;AAKA,MAAM,UAAU;AAChB,MAAM,UAAU;AAEhB,MAAM,gBAAgB,oBACpB,IAAIA,eAAsB,EACxB,QAAQ,IAAIC,aAAoB,EAAE,UAAU,CAAC,EAC/C,CAAC;;AAGH,MAAa,aAAa,YAAoD;CAC5E,MAAM,UAAU,QAAQ,KAAK;CAC7B,IAAI,oBAAoB,KAAK,OAAO,GAClC,OAAO,WAAW,KAAK,QAAQ,MAAM,KAAK,KAAK,CAAC,IAAI,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;CAExF,IAAI;EACF,MAAM,QAAQ,WAAW,OAAO;EAChC,OAAO,MAAM,WAAW,KAAK,QAAQ;CACvC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAa,aACX,QAEA,OAAO,WAAW;CAChB,WACE,OAAO,OAAO,UAAU,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,SAAS,CAAC;CACxF,OAAO,aAAa,MAAM;AAC5B,CAAC;AAEH,MAAa,QACX,KACA,cAEA,OAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,OAAO,CAAC;EACzD,MAAM,aAAa,IAAI,WACrB,MAAM,OAAO,OAAO,QAClB;GAAE,MAAM;GAAW;EAAG,GACtB,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,MAAM,SAAS,CAAC,CACpD,CACF;EACA,OAAO,GAAG,QAAQ,GAAG,YAAY,EAAE,EAAE,GAAG,YAAY,UAAU;CAChE;CACA,OAAO,aAAa,MAAM;AAC5B,CAAC;AAEH,MAAa,QACX,KACA,aAEA,OAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,CAAC,KAAK,IAAI,cAAc,SAAS,MAAM,GAAG;EAChD,IAAI,QAAQ,WAAW,OAAO,KAAA,KAAa,eAAe,KAAA,GACxD,MAAM,IAAI,MAAM,sBAAsB;EAExC,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;GAAE,MAAM;GAAW,IAAI,WAAW,EAAE;EAAE,GACtC,KACA,WAAW,UAAU,CACvB;EACA,OAAO,SAAS,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CAAC;CAC1D;CACA,OAAO,aAAa,MAAM;AAC5B,CAAC;AAEH,MAAa,oBAA4B,YAAY,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAE/F,SAAS,YAAY,OAAwC;CAC3D,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACjF;AAEA,SAAS,WAAW,OAAwC;CAC1D,MAAM,aAAa,MAAM,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;CACjE,MAAM,SAAS,aAAa,IAAI,QAAQ,IAAK,WAAW,SAAS,KAAM,CAAC;CACxE,MAAM,SAAS,KAAK,MAAM;CAC1B,OAAO,WAAW,KAAK,SAAS,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE"}