domainkit 0.8.0 → 0.9.1

package/dist/resolver-BeGz1ukw.mjs

@@ -1,921 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { A as Error$4, D as decode$2, E as Schema$2, k as parse$1, n as sha256Encoded, r as stringify } from "./canonical-json-CQYKsZw7.mjs";
-import { Cause, Clock, Context, Data, Effect, Layer, Schema } from "effect";
-import { getDomain } from "tldts";
-//#region src/discovery/zones.ts
-var zones_exports = /* @__PURE__ */ __exportAll({ candidates: () => candidates });
-function candidates(input) {
-	const domain = parse$1(input);
-	const registrable = getDomain(domain, { allowPrivateDomains: true });
-	if (registrable === null) throw new Error$4({ message: "Domain does not have a registrable DNS zone" });
-	const labels = domain.split(".");
-	const registrableLabels = registrable.split(".").length;
-	const values = [];
-	for (let index = 0; index <= labels.length - registrableLabels; index += 1) values.push(parse$1(labels.slice(index).join(".")));
-	return values;
-}
-//#endregion
-//#region src/discovery/zone-discovery.ts
-var zone_discovery_exports = /* @__PURE__ */ __exportAll({
-	Candidate: () => Candidate,
-	Outcome: () => Outcome,
-	Service: () => Service$2,
-	make: () => make
-});
-/** Display-safe identity and nameserver evidence for one provider-owned zone. */
-const Candidate = Schema.Struct({
-	accountId: Schema.String,
-	id: Schema.String,
-	name: Schema$2,
-	nameservers: Schema.Array(Schema$2),
-	providerId: Schema.String,
-	status: Schema.Literals([
-		"active",
-		"pending",
-		"unknown"
-	])
-});
-const Outcome = Data.taggedEnum();
-var Service$2 = class extends Context.Service()("@domainkit/ZoneDiscovery") {};
-/** Compose provider-account discovery sources without expanding the record-provider contract. */
-function make(sources) {
-	return Service$2.of({ discover: Effect.fn("ZoneDiscovery.discover")(function* (domain) {
-		for (const name of candidates(domain)) {
-			const matches = deduplicate((yield* Effect.forEach(sources, (source) => source.listZones(name).pipe(Effect.map((zones) => zones.filter((zone) => zone.name === name).map((zone) => ({
-				candidate: {
-					...zone,
-					providerId: source.provider.id
-				},
-				provider: source.provider
-			})))), { concurrency: "unbounded" })).flat());
-			const match = matches[0];
-			if (matches.length === 1 && match !== void 0) return Outcome.Resolved(match);
-			if (matches.length > 1) return Outcome.SelectionRequired({ candidates: matches.map(({ candidate }) => candidate) });
-		}
-		return Outcome.NotFound({ domain });
-	}) });
-}
-function deduplicate(matches) {
-	const unique = /* @__PURE__ */ new Map();
-	for (const match of matches) {
-		const key = [
-			match.candidate.providerId,
-			match.candidate.accountId,
-			match.candidate.id,
-			match.candidate.name
-		].join(":");
-		if (unique.get(key) === void 0) unique.set(key, match);
-	}
-	return [...unique.values()].sort((left, right) => candidateKey(left.candidate).localeCompare(candidateKey(right.candidate)));
-}
-function candidateKey(candidate) {
-	return [
-		candidate.name,
-		candidate.providerId,
-		candidate.accountId,
-		candidate.id
-	].join(":");
-}
-//#endregion
-//#region src/domain/dns-record.ts
-var dns_record_exports = /* @__PURE__ */ __exportAll({
-	A: () => A,
-	Aaaa: () => Aaaa,
-	Caa: () => Caa,
-	Cname: () => Cname,
-	Mx: () => Mx,
-	Ns: () => Ns,
-	Observed: () => Observed,
-	Opaque: () => Opaque,
-	RequirementMetadata: () => RequirementMetadata,
-	Schema: () => RecordSchema,
-	Srv: () => Srv,
-	Txt: () => Txt,
-	Type: () => Type,
-	data: () => data,
-	decode: () => decode$1,
-	equals: () => equals,
-	parse: () => parse
-});
-const Type = Schema.Literals([
-	"A",
-	"AAAA",
-	"CNAME",
-	"TXT",
-	"MX",
-	"CAA",
-	"NS",
-	"SRV"
-]);
-const RequirementMetadata = Schema.Struct({
-	ownership: Schema.String.check(Schema.isMinLength(1)),
-	provenance: Schema.String.check(Schema.isMinLength(1)),
-	purpose: Schema.String.check(Schema.isMinLength(1))
-});
-const CommonFields = {
-	metadata: RequirementMetadata,
-	name: Schema$2,
-	policy: Schema.Literals(["exclusive", "append"]),
-	ttl: Schema.NullOr(Schema.Int.check(Schema.isBetween({
-		minimum: 60,
-		maximum: 2147483647
-	})))
-};
-const ExclusiveCommonFields = {
-	...CommonFields,
-	policy: Schema.Literal("exclusive")
-};
-const Address = Schema.String.check(Schema.makeFilter((value) => isIpv4(value) ? void 0 : "Expected an IPv4 address"));
-const Ipv6Address = Schema.String.check(Schema.makeFilter((value) => isIpv6(value) ? void 0 : "Expected an IPv6 address"));
-const Port = Schema.Int.check(Schema.isBetween({
-	minimum: 0,
-	maximum: 65535
-}));
-const Priority = Schema.Int.check(Schema.isBetween({
-	minimum: 0,
-	maximum: 65535
-}));
-const RecordSchema = Schema.TaggedUnion({
-	A: {
-		...CommonFields,
-		address: Address
-	},
-	AAAA: {
-		...CommonFields,
-		address: Ipv6Address
-	},
-	CNAME: {
-		...ExclusiveCommonFields,
-		target: Schema$2
-	},
-	TXT: {
-		...CommonFields,
-		value: Schema.String.check(Schema.isMinLength(1))
-	},
-	MX: {
-		...CommonFields,
-		exchange: Schema$2,
-		priority: Priority
-	},
-	CAA: {
-		...CommonFields,
-		flags: Schema.Int.check(Schema.isBetween({
-			minimum: 0,
-			maximum: 255
-		})),
-		tag: Schema.Literals([
-			"issue",
-			"issuewild",
-			"iodef"
-		]),
-		value: Schema.String.check(Schema.isMinLength(1))
-	},
-	NS: {
-		...CommonFields,
-		target: Schema$2
-	},
-	SRV: {
-		...CommonFields,
-		port: Port,
-		priority: Priority,
-		target: Schema$2,
-		weight: Priority
-	}
-});
-/** Constructs an A record requirement from trusted application data. */
-function A(input) {
-	return RecordSchema.cases.A.make(input);
-}
-(function(_A) {
-	_A.Schema = RecordSchema.cases.A;
-})(A || (A = {}));
-/** Constructs an AAAA record requirement from trusted application data. */
-function Aaaa(input) {
-	return RecordSchema.cases.AAAA.make(input);
-}
-(function(_Aaaa) {
-	_Aaaa.Schema = RecordSchema.cases.AAAA;
-})(Aaaa || (Aaaa = {}));
-/** Constructs a CAA record requirement from trusted application data. */
-function Caa(input) {
-	return RecordSchema.cases.CAA.make(input);
-}
-(function(_Caa) {
-	_Caa.Schema = RecordSchema.cases.CAA;
-})(Caa || (Caa = {}));
-/** Constructs a CNAME record requirement from trusted application data. */
-function Cname(input) {
-	return RecordSchema.cases.CNAME.make(input);
-}
-(function(_Cname) {
-	_Cname.Schema = RecordSchema.cases.CNAME;
-})(Cname || (Cname = {}));
-/** Constructs an MX record requirement from trusted application data. */
-function Mx(input) {
-	return RecordSchema.cases.MX.make(input);
-}
-(function(_Mx) {
-	_Mx.Schema = RecordSchema.cases.MX;
-})(Mx || (Mx = {}));
-/** Constructs an NS record requirement from trusted application data. */
-function Ns(input) {
-	return RecordSchema.cases.NS.make(input);
-}
-(function(_Ns) {
-	_Ns.Schema = RecordSchema.cases.NS;
-})(Ns || (Ns = {}));
-/** Constructs an SRV record requirement from trusted application data. */
-function Srv(input) {
-	return RecordSchema.cases.SRV.make(input);
-}
-(function(_Srv) {
-	_Srv.Schema = RecordSchema.cases.SRV;
-})(Srv || (Srv = {}));
-/** Constructs a TXT record requirement from trusted application data. */
-function Txt(input) {
-	return RecordSchema.cases.TXT.make(input);
-}
-(function(_Txt) {
-	_Txt.Schema = RecordSchema.cases.TXT;
-})(Txt || (Txt = {}));
-/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
-const OpaqueSchema = Schema.TaggedStruct("Opaque", {
-	name: Schema.String.check(Schema.isMinLength(1)),
-	providerRecordId: Schema.NullOr(Schema.String),
-	providerType: Schema.String.check(Schema.isMinLength(1))
-});
-/** Constructs an opaque provider record from trusted adapter data. */
-function Opaque(input) {
-	return OpaqueSchema.make(input);
-}
-(function(_Opaque) {
-	_Opaque.Schema = OpaqueSchema;
-})(Opaque || (Opaque = {}));
-/** Any DNS record observed through a provider, including non-portable record types. */
-const Observed = Schema.Union([RecordSchema, OpaqueSchema]);
-const decode$1 = Effect.fn("DnsRecord.decode")((input) => Schema.decodeUnknownEffect(RecordSchema)(input).pipe(Effect.mapError((cause) => new Error$4({ message: cause.message }))));
-function parse(input) {
-	try {
-		return Schema.decodeUnknownSync(RecordSchema)(input);
-	} catch (cause) {
-		throw new Error$4({ message: cause instanceof Error ? cause.message : String(cause) });
-	}
-}
-function data(record) {
-	switch (record._tag) {
-		case "A":
-		case "AAAA": return { address: record.address };
-		case "CNAME":
-		case "NS": return { target: record.target };
-		case "TXT": return { value: record.value };
-		case "MX": return {
-			exchange: record.exchange,
-			priority: record.priority
-		};
-		case "CAA": return {
-			flags: record.flags,
-			tag: record.tag,
-			value: record.value
-		};
-		case "SRV": return {
-			port: record.port,
-			priority: record.priority,
-			target: record.target,
-			weight: record.weight
-		};
-	}
-}
-function equals(left, right) {
-	return left._tag === right._tag && left.name === right.name && JSON.stringify(data(left)) === JSON.stringify(data(right));
-}
-function isIpv4(value) {
-	const parts = value.split(".");
-	return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part);
-}
-function isIpv6(value) {
-	try {
-		return new URL(`http://[${value}]/`).hostname.startsWith("[");
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region src/provider/provider.ts
-var provider_exports = /* @__PURE__ */ __exportAll({
-	Error: () => Error$3,
-	ErrorReason: () => ErrorReason,
-	Service: () => Service$1,
-	fromAsync: () => fromAsync,
-	layerFromAsync: () => layerFromAsync$1,
-	toAsync: () => toAsync$1
-});
-const ErrorReason = Schema.Literals([
-	"authentication",
-	"authorization",
-	"conflict",
-	"not_found",
-	"rate_limit",
-	"request",
-	"response",
-	"transport",
-	"unsupported"
-]);
-var Error$3 = class extends Schema.TaggedError()("ProviderError", {
-	cause: Schema.optionalKey(Schema.Unknown),
-	code: Schema.optionalKey(Schema.Union([Schema.Number, Schema.String])),
-	message: Schema.String,
-	operation: Schema.String,
-	providerId: Schema.String,
-	reason: Schema.optionalKey(ErrorReason),
-	retryAfterMs: Schema.optionalKey(Schema.Number),
-	status: Schema.optionalKey(Schema.Number)
-}) {};
-var Service$1 = class extends Context.Service()("@domainkit/DnsProvider") {};
-const fromAsync = (provider) => Service$1.of({
-	id: provider.id,
-	createRecord: Effect.fn("DnsProvider.createRecord")((zone, record) => Effect.tryPromise({
-		try: () => provider.createRecord(zone, record),
-		catch: (cause) => failure(provider, "createRecord", cause)
-	})),
-	deleteRecord: Effect.fn("DnsProvider.deleteRecord")((zone, providerRecordId) => Effect.tryPromise({
-		try: () => provider.deleteRecord(zone, providerRecordId),
-		catch: (cause) => failure(provider, "deleteRecord", cause)
-	})),
-	getRecord: Effect.fn("DnsProvider.getRecord")((zone, providerRecordId) => Effect.tryPromise({
-		try: () => provider.getRecord(zone, providerRecordId),
-		catch: (cause) => failure(provider, "getRecord", cause)
-	})),
-	listRecords: Effect.fn("DnsProvider.listRecords")((zone) => Effect.tryPromise({
-		try: () => provider.listRecords(zone),
-		catch: (cause) => failure(provider, "listRecords", cause)
-	}))
-});
-const layerFromAsync$1 = (provider) => Layer.succeed(Service$1, fromAsync(provider));
-const toAsync$1 = (provider) => ({
-	id: provider.id,
-	createRecord: (zone, record) => Effect.runPromise(provider.createRecord(zone, record)),
-	deleteRecord: (zone, providerRecordId) => Effect.runPromise(provider.deleteRecord(zone, providerRecordId)),
-	getRecord: (zone, providerRecordId) => Effect.runPromise(provider.getRecord(zone, providerRecordId)),
-	listRecords: (zone) => Effect.runPromise(provider.listRecords(zone))
-});
-function failure(provider, operation, cause) {
-	return cause instanceof Error$3 ? cause : new Error$3({
-		cause,
-		message: cause instanceof globalThis.Error ? cause.message : String(cause),
-		operation,
-		providerId: provider.id
-	});
-}
-//#endregion
-//#region src/plan/types.ts
-var types_exports = /* @__PURE__ */ __exportAll({
-	Authorization: () => Authorization$1,
-	Operation: () => Operation$1,
-	Receipt: () => Receipt$1,
-	Schema: () => Schema$1,
-	decode: () => decode,
-	decodeReceipt: () => decodeReceipt,
-	encode: () => encode,
-	encodeReceipt: () => encodeReceipt
-});
-const OperationSchema = Schema.TaggedUnion({
-	create: {
-		id: Schema.String,
-		requirement: RecordSchema
-	},
-	noop: {
-		id: Schema.String,
-		requirement: RecordSchema,
-		ttlDrift: Schema.Boolean
-	},
-	conflict: {
-		existing: Schema.Array(Observed),
-		id: Schema.String,
-		reason: Schema.String,
-		requirement: RecordSchema
-	}
-});
-/** DNS plan operation schema and callable constructors for trusted plan values. */
-const Operation$1 = {
-	Schema: OperationSchema,
-	conflict: (input) => OperationSchema.cases.conflict.make(input),
-	create: (input) => OperationSchema.cases.create.make(input),
-	noop: (input) => OperationSchema.cases.noop.make(input)
-};
-const Schema$1 = Schema.Struct({
-	digest: Schema.String,
-	operations: Schema.Array(Operation$1.Schema),
-	providerId: Schema.String,
-	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$2
-});
-const Authorization$1 = Schema.Struct({
-	allowPartial: Schema.Boolean,
-	operationIds: Schema.Array(Schema.String),
-	planDigest: Schema.String,
-	version: Schema.Literal("domainkit.plan-authorization.v1")
-});
-const Receipt$1 = Schema.Struct({
-	appliedAt: Schema.DateFromString,
-	operations: Schema.Array(Schema.Struct({
-		operationId: Schema.String,
-		providerRecordId: Schema.NullOr(Schema.String)
-	})),
-	planDigest: Schema.String,
-	providerId: Schema.String,
-	status: Schema.Literals(["complete", "partial"]),
-	version: Schema.Literal("domainkit.apply-receipt.v1"),
-	zone: Schema$2
-});
-const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$4({ message: cause.message }))));
-const encode = Schema.encodeSync(Schema$1);
-const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt$1)(input).pipe(Effect.mapError((cause) => new Error$4({ message: cause.message }))));
-const encodeReceipt = Schema.encodeSync(Receipt$1);
-//#endregion
-//#region src/plan/plan.ts
-var plan_exports = /* @__PURE__ */ __exportAll({
-	AuthorizationError: () => AuthorizationError,
-	ConflictError: () => ConflictError,
-	CreateResult: () => CreateResult,
-	PartialApplyError: () => PartialApplyError,
-	StaleError: () => StaleError,
-	Target: () => Target,
-	apply: () => apply$1,
-	authorize: () => authorize$1,
-	create: () => create$1,
-	renderManualInstructions: () => renderManualInstructions,
-	validate: () => validate$1
-});
-const UnsignedPlan$1 = Schema.Struct({
-	operations: Schema.Array(Operation$1.Schema),
-	providerId: Schema.String,
-	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$2
-});
-const RequirementDigest = Schema.Struct({ requirement: RecordSchema });
-var ConflictError = class extends Schema.TaggedError()("PlanConflictError", { operationIds: Schema.Array(Schema.String) }) {};
-var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
-var StaleError = class extends Schema.TaggedError()("StalePlanError", {
-	approvedPlanDigest: Schema.String,
-	currentPlanDigest: Schema.String
-}) {};
-var PartialApplyError = class extends Schema.TaggedError()("PartialApplyError", {
-	causeTag: Schema.Literals([
-		"CryptoError",
-		"InvalidInputError",
-		"Interrupted",
-		"ProviderError",
-		"StalePlanError"
-	]),
-	failedOperationId: Schema.String,
-	message: Schema.String,
-	receipt: Receipt$1
-}) {};
-const Target = Data.taggedEnum();
-const CreateResult = Data.taggedEnum();
-function create$1(input) {
-	const target = input.target;
-	if (target._tag === "ExactZone") return Effect.gen(function* () {
-		const provider = yield* Service$1;
-		const zone = yield* decode$2(target.zone);
-		return CreateResult.Resolved({
-			candidate: null,
-			plan: yield* planAgainst(provider, zone, input.requirements)
-		});
-	}).pipe(Effect.withSpan("Provisioning.create"));
-	return Effect.gen(function* () {
-		const discovery = yield* Service$2;
-		const domain = yield* decode$2(target.domain);
-		const outcome = yield* discovery.discover(domain);
-		switch (outcome._tag) {
-			case "NotFound": return CreateResult.NotFound({ domain: outcome.domain });
-			case "SelectionRequired": return CreateResult.SelectionRequired({ candidates: outcome.candidates });
-			case "Resolved": return CreateResult.Resolved({
-				candidate: outcome.candidate,
-				plan: yield* planAgainst(outcome.provider, outcome.candidate.name, input.requirements)
-			});
-		}
-	}).pipe(Effect.withSpan("Provisioning.create"));
-}
-const planAgainst = Effect.fn("Provisioning.planAgainst")(function* (provider, zone, inputs) {
-	const requirements = (yield* Effect.forEach(inputs, decode$1, { concurrency: "unbounded" })).sort(compareRecords);
-	const existing = [...yield* provider.listRecords(zone)].sort(compareRecords);
-	const { operations } = yield* Effect.reduce(requirements, () => ({
-		operations: [],
-		projected: existing
-	}), (state, requirement) => reconcileRequirement(requirement, state.projected).pipe(Effect.map((operation) => ({
-		operations: [...state.operations, operation],
-		projected: operation._tag === "create" ? [...state.projected, operation.requirement].sort(compareRecords) : state.projected
-	}))));
-	const unsigned = {
-		operations,
-		providerId: provider.id,
-		version: "domainkit.dns-plan.v1",
-		zone
-	};
-	return {
-		...unsigned,
-		digest: yield* sha256Encoded(UnsignedPlan$1, unsigned)
-	};
-});
-/** Authorizes all or a selected subset of create operations in a digest-bound plan. */
-const authorize$1 = Effect.fn("Provisioning.authorize")(function* (plan, operationIds, options = {}) {
-	yield* validate$1(plan);
-	const createIds = plan.operations.filter((operation) => operation._tag === "create").map(({ id }) => id);
-	const selected = [...new Set(operationIds ?? createIds)].sort();
-	const unknown = selected.filter((id) => !createIds.includes(id));
-	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Unknown operation IDs: ${unknown.join(", ")}` });
-	if (!options.allowPartial && selected.length !== createIds.length) return yield* new AuthorizationError({ message: "Partial authorization requires allowPartial" });
-	return {
-		allowPartial: options.allowPartial ?? false,
-		operationIds: selected,
-		planDigest: plan.digest,
-		version: "domainkit.plan-authorization.v1"
-	};
-});
-/** Applies approved creates sequentially after full and per-operation revalidation. */
-const apply$1 = Effect.fn("Provisioning.apply")(function* (input) {
-	const { authorization, plan } = input;
-	const provider = yield* Service$1;
-	yield* validate$1(plan);
-	if (authorization.planDigest !== plan.digest) return yield* new AuthorizationError({ message: "Authorization belongs to a different plan" });
-	if (provider.id !== plan.providerId) return yield* new AuthorizationError({ message: "Provider does not match the approved plan" });
-	const conflicts = plan.operations.filter((operation) => operation._tag === "conflict");
-	if (conflicts.length > 0) return yield* new ConflictError({ operationIds: conflicts.map(({ id }) => id) });
-	const creates = plan.operations.filter((operation) => operation._tag === "create");
-	const approved = new Set(authorization.operationIds);
-	const unknown = authorization.operationIds.filter((id) => !creates.some((operation) => operation.id === id));
-	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Authorization contains unknown operations: ${unknown.join(", ")}` });
-	if (!authorization.allowPartial && creates.some(({ id }) => !approved.has(id))) return yield* new AuthorizationError({ message: "Authorization does not cover every create operation" });
-	const currentPlan = yield* planAgainst(provider, plan.zone, plan.operations.map(({ requirement }) => requirement));
-	if (currentPlan.digest !== plan.digest) return yield* new StaleError({
-		approvedPlanDigest: plan.digest,
-		currentPlanDigest: currentPlan.digest
-	});
-	const operations = [];
-	for (const operation of creates) {
-		if (!approved.has(operation.id)) continue;
-		yield* Effect.gen(function* () {
-			yield* assertStillCreatable(plan, operation);
-			const result = yield* provider.createRecord(plan.zone, operation.requirement);
-			operations.push({
-				operationId: operation.id,
-				providerRecordId: result.providerRecordId
-			});
-		}).pipe(Effect.catch((failure) => operations.length === 0 ? Effect.fail(failure) : makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
-			causeTag: failure._tag,
-			failedOperationId: operation.id,
-			message: failureMessage(failure),
-			receipt
-		}))))), Effect.catchCause((cause) => {
-			if (!Cause.hasInterruptsOnly(cause) || operations.length === 0) return Effect.failCause(cause);
-			return makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
-				causeTag: "Interrupted",
-				failedOperationId: operation.id,
-				message: "DNS apply was interrupted after confirmed writes",
-				receipt
-			}))));
-		}));
-	}
-	return yield* makeReceipt$1(input, operations, "complete");
-});
-function renderManualInstructions(plan) {
-	return plan.operations.map((operation) => {
-		const record = operation.requirement;
-		const data$1 = Object.entries(data(record)).map(([key, value]) => `${key}=${value}`).join(" ");
-		return `${operation._tag.toUpperCase()} ${record._tag} ${record.name} ${data$1}`.trim();
-	});
-}
-function makeReceipt$1(input, operations, status) {
-	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
-		appliedAt: new Date(now),
-		operations,
-		planDigest: input.plan.digest,
-		providerId: input.plan.providerId,
-		status,
-		version: "domainkit.apply-receipt.v1",
-		zone: input.plan.zone
-	})));
-}
-function assertStillCreatable(plan, operation) {
-	return Service$1.pipe(Effect.flatMap((provider) => planAgainst(provider, plan.zone, [operation.requirement])), Effect.flatMap((currentPlan) => {
-		const currentOperation = currentPlan.operations[0];
-		return currentOperation?._tag === "create" && currentOperation.id === operation.id ? Effect.void : Effect.fail(new StaleError({
-			approvedPlanDigest: plan.digest,
-			currentPlanDigest: currentPlan.digest
-		}));
-	}));
-}
-function reconcileRequirement(requirement, allExisting) {
-	return Effect.gen(function* () {
-		const sameName = allExisting.filter((record) => record.name === requirement.name);
-		const sameSet = sameName.filter((record) => record._tag !== "Opaque" && record._tag === requirement._tag);
-		const exact = sameSet.find((record) => equals(record, requirement));
-		const id = yield* sha256Encoded(RequirementDigest, { requirement });
-		if (exact !== void 0) return Operation$1.noop({
-			id,
-			requirement,
-			ttlDrift: exact.ttl !== requirement.ttl
-		});
-		if (sameName.length > 0 && (requirement._tag === "CNAME" || sameName.some((record) => record._tag === "CNAME"))) return Operation$1.conflict({
-			existing: sameName,
-			id,
-			reason: "CNAME records cannot coexist with other records at the same name",
-			requirement
-		});
-		if (sameSet.length > 0 && (requirement.policy === "exclusive" || sameSet.some(({ policy }) => policy === "exclusive"))) return Operation$1.conflict({
-			existing: sameSet,
-			id,
-			reason: "The exclusive record set already contains incompatible data",
-			requirement
-		});
-		return Operation$1.create({
-			id,
-			requirement
-		});
-	});
-}
-function validate$1(plan) {
-	const unsigned = {
-		operations: plan.operations,
-		providerId: plan.providerId,
-		version: plan.version,
-		zone: plan.zone
-	};
-	return sha256Encoded(UnsignedPlan$1, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new AuthorizationError({ message: "Plan digest does not match its contents" }))));
-}
-function failureMessage(failure) {
-	return failure._tag === "StalePlanError" ? "DNS state changed while applying the approved plan" : failure.message;
-}
-function compareRecords(left, right) {
-	const encode = Schema.encodeSync(Observed);
-	const toJson = Schema.decodeUnknownSync(Schema.Json);
-	const leftJson = stringify(toJson(encode(left)));
-	const rightJson = stringify(toJson(encode(right)));
-	return leftJson < rightJson ? -1 : leftJson > rightJson ? 1 : 0;
-}
-//#endregion
-//#region src/plan/deletion.ts
-var deletion_exports = /* @__PURE__ */ __exportAll({
-	Authorization: () => Authorization,
-	Error: () => Error$2,
-	Operation: () => Operation,
-	PartialError: () => PartialError,
-	Plan: () => Plan,
-	Receipt: () => Receipt,
-	apply: () => apply,
-	authorize: () => authorize,
-	create: () => create,
-	validate: () => validate
-});
-const Operation = Schema.Struct({
-	id: Schema.String,
-	providerRecordId: Schema.String,
-	record: RecordSchema
-});
-const UnsignedPlan = Schema.Struct({
-	createdAt: Schema.DateFromString,
-	expiresAt: Schema.DateFromString,
-	operations: Schema.Array(Operation),
-	providerId: Schema.String,
-	sourcePlanDigest: Schema.String,
-	version: Schema.Literal("domainkit.deletion-plan.v1"),
-	zone: Schema$2
-});
-const Plan = Schema.Struct({
-	...UnsignedPlan.fields,
-	digest: Schema.String
-});
-const Authorization = Schema.Struct({
-	operationIds: Schema.Array(Schema.String),
-	planDigest: Schema.String,
-	version: Schema.Literal("domainkit.deletion-authorization.v1")
-});
-const Receipt = Schema.Struct({
-	deletedAt: Schema.DateFromString,
-	operations: Schema.Array(Schema.Struct({
-		operationId: Schema.String,
-		providerRecordId: Schema.String
-	})),
-	planDigest: Schema.String,
-	providerId: Schema.String,
-	status: Schema.Literals(["complete", "partial"]),
-	version: Schema.Literal("domainkit.deletion-receipt.v1"),
-	zone: Schema$2
-});
-var Error$2 = class extends Schema.TaggedError()("UnsafeDeletionError", {
-	message: Schema.String,
-	operationId: Schema.optionalKey(Schema.String)
-}) {};
-var PartialError = class extends Schema.TaggedError()("PartialDeletionError", {
-	failedOperationId: Schema.String,
-	message: Schema.String,
-	receipt: Receipt
-}) {};
-/** Build a fresh deletion plan only from records proven by a prior create receipt. */
-const create = Effect.fn("Deletion.create")(function* (input) {
-	const provider = yield* Service$1;
-	yield* validate$1(input.plan);
-	if (input.receipt.planDigest !== input.plan.digest || input.receipt.providerId !== input.plan.providerId || input.receipt.zone !== input.plan.zone) return yield* new Error$2({ message: "Create receipt does not belong to the source plan" });
-	if (provider.id !== input.plan.providerId) return yield* new Error$2({ message: "Provider does not match the source receipt" });
-	const operations = yield* Effect.forEach(input.receipt.operations, (applied) => Effect.gen(function* () {
-		const source = input.plan.operations.find((operation) => operation._tag === "create" && operation.id === applied.operationId);
-		if (source === void 0 || source._tag !== "create") return yield* new Error$2({
-			message: "Receipt operation is not a created source record",
-			operationId: applied.operationId
-		});
-		if (applied.providerRecordId === null) return yield* new Error$2({
-			message: "Provider record ID is required for safe deletion",
-			operationId: applied.operationId
-		});
-		yield* assertExact(provider, input.plan.zone, applied.providerRecordId, source.requirement, source.id);
-		return {
-			id: source.id,
-			providerRecordId: applied.providerRecordId,
-			record: source.requirement
-		};
-	}));
-	const now = yield* Clock.currentTimeMillis;
-	const unsigned = {
-		createdAt: new Date(now),
-		expiresAt: new Date(now + (input.ttlMs ?? 9e5)),
-		operations,
-		providerId: input.plan.providerId,
-		sourcePlanDigest: input.plan.digest,
-		version: "domainkit.deletion-plan.v1",
-		zone: input.plan.zone
-	};
-	return {
-		...unsigned,
-		digest: yield* sha256Encoded(UnsignedPlan, unsigned)
-	};
-});
-/** Produce a separate digest-bound consent artifact for destructive operations. */
-const authorize = Effect.fn("Deletion.authorize")(function* (plan, operationIds) {
-	yield* validate(plan);
-	const selected = [...new Set(operationIds ?? plan.operations.map(({ id }) => id))].sort();
-	const unknown = selected.filter((id) => !plan.operations.some((operation) => operation.id === id));
-	if (unknown.length > 0) return yield* new Error$2({ message: `Unknown deletion operation IDs: ${unknown.join(", ")}` });
-	return {
-		operationIds: selected,
-		planDigest: plan.digest,
-		version: "domainkit.deletion-authorization.v1"
-	};
-});
-/** Re-read every approved record before the first delete, then delete by provider record ID. */
-const apply = Effect.fn("Deletion.apply")(function* (input) {
-	const provider = yield* Service$1;
-	yield* validate(input.plan);
-	if (input.authorization.planDigest !== input.plan.digest) return yield* new Error$2({ message: "Deletion authorization belongs to a different plan" });
-	if (provider.id !== input.plan.providerId) return yield* new Error$2({ message: "Provider does not match the deletion plan" });
-	const now = yield* Clock.currentTimeMillis;
-	if (input.plan.expiresAt <= new Date(now)) return yield* new Error$2({ message: "Deletion plan has expired" });
-	const selected = input.plan.operations.filter(({ id }) => input.authorization.operationIds.includes(id));
-	if (selected.length !== input.authorization.operationIds.length) return yield* new Error$2({ message: "Deletion authorization contains unknown operations" });
-	const previouslyDeleted = yield* validatePriorReceipt(input.plan, input.priorReceipt);
-	const completedIds = new Set(previouslyDeleted.map(({ operationId }) => operationId));
-	if (previouslyDeleted.some(({ operationId }) => !input.authorization.operationIds.includes(operationId))) return yield* new Error$2({ message: "Prior receipt contains an unauthorized operation" });
-	const remaining = selected.filter(({ id }) => !completedIds.has(id));
-	yield* Effect.forEach(remaining, (operation) => assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id));
-	const deleted = [...previouslyDeleted];
-	for (const operation of remaining) {
-		const failure = yield* Effect.gen(function* () {
-			yield* assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id);
-			yield* provider.deleteRecord(input.plan.zone, operation.providerRecordId);
-			deleted.push({
-				operationId: operation.id,
-				providerRecordId: operation.providerRecordId
-			});
-		}).pipe(Effect.match({
-			onFailure: (cause) => cause,
-			onSuccess: () => null
-		}));
-		if (failure !== null) {
-			if (deleted.length === 0) return yield* failure;
-			return yield* new PartialError({
-				failedOperationId: operation.id,
-				message: failure.message,
-				receipt: yield* makeReceipt(input.plan, deleted, "partial")
-			});
-		}
-	}
-	return yield* makeReceipt(input.plan, deleted, "complete");
-});
-function validate(plan) {
-	const unsigned = {
-		createdAt: plan.createdAt,
-		expiresAt: plan.expiresAt,
-		operations: plan.operations,
-		providerId: plan.providerId,
-		sourcePlanDigest: plan.sourcePlanDigest,
-		version: plan.version,
-		zone: plan.zone
-	};
-	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new Error$2({ message: "Deletion plan digest does not match its contents" }))));
-}
-function validatePriorReceipt(plan, receipt) {
-	if (receipt === void 0) return Effect.succeed([]);
-	if (receipt.planDigest !== plan.digest || receipt.providerId !== plan.providerId || receipt.zone !== plan.zone || receipt.status !== "partial") return Effect.fail(new Error$2({ message: "Prior receipt does not belong to this deletion plan" }));
-	for (const completed of receipt.operations) {
-		const operation = plan.operations.find(({ id }) => id === completed.operationId);
-		if (operation === void 0 || operation.providerRecordId !== completed.providerRecordId) return Effect.fail(new Error$2({ message: "Prior receipt operation does not match the deletion plan" }));
-	}
-	return Effect.succeed([...receipt.operations]);
-}
-function assertExact(provider, zone, providerRecordId, expected, operationId) {
-	return provider.getRecord(zone, providerRecordId).pipe(Effect.flatMap((observed) => observed !== null && observed._tag !== "Opaque" && equals(observed, expected) ? Effect.void : Effect.fail(new Error$2({
-		message: observed === null ? "Created record no longer exists" : "Created record content no longer matches its receipt",
-		operationId
-	}))));
-}
-function makeReceipt(plan, operations, status) {
-	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
-		deletedAt: new Date(now),
-		operations,
-		planDigest: plan.digest,
-		providerId: plan.providerId,
-		status,
-		version: "domainkit.deletion-receipt.v1",
-		zone: plan.zone
-	})));
-}
-//#endregion
-//#region src/verification/resolver.ts
-var resolver_exports = /* @__PURE__ */ __exportAll({
-	Answer: () => Answer,
-	AsyncResolution: () => AsyncResolution,
-	Error: () => Error$1,
-	Resolution: () => Resolution,
-	Service: () => Service,
-	layerFromAsync: () => layerFromAsync,
-	toAsync: () => toAsync
-});
-const Answer = Schema.Struct({
-	data: Schema.String,
-	name: Schema$2,
-	ttl: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-	type: Type
-});
-const ResolutionSchema = Schema.TaggedUnion({
-	answer: { answers: Schema.Array(Answer) },
-	nodata: {}
-});
-/** DNS answer schema and callable constructors for trusted resolver values. */
-const Resolution = {
-	Schema: ResolutionSchema,
-	answer: (input) => ResolutionSchema.cases.answer.make(input),
-	nodata: () => ResolutionSchema.cases.nodata.make({})
-};
-var Error$1 = class extends Schema.TaggedError()("ResolverError", {
-	cause: Schema.optionalKey(Schema.Unknown),
-	message: Schema.String,
-	reason: Schema.Literals([
-		"response",
-		"timeout",
-		"transport"
-	])
-}) {};
-var Service = class extends Context.Service()("@domainkit/DnsResolver") {};
-const AsyncResolutionSchema = Schema.TaggedUnion({
-	answer: { answers: Schema.Array(Answer) },
-	nodata: {},
-	timeout: {},
-	failure: { message: Schema.String }
-});
-/** Promise bridge result schema and callable constructors, including typed failures. */
-const AsyncResolution = {
-	Schema: AsyncResolutionSchema,
-	answer: (input) => AsyncResolutionSchema.cases.answer.make(input),
-	failure: (input) => AsyncResolutionSchema.cases.failure.make(input),
-	nodata: () => AsyncResolutionSchema.cases.nodata.make({}),
-	timeout: () => AsyncResolutionSchema.cases.timeout.make({})
-};
-const layerFromAsync = (resolver) => Layer.succeed(Service, { resolve: Effect.fn("DnsResolver.resolve")((query) => Effect.tryPromise({
-	try: () => resolver.resolve(query),
-	catch: (cause) => new Error$1({
-		cause,
-		message: cause instanceof globalThis.Error ? cause.message : String(cause),
-		reason: "transport"
-	})
-}).pipe(Effect.flatMap((resolution) => {
-	switch (resolution._tag) {
-		case "answer":
-		case "nodata": return Effect.succeed(resolution);
-		case "timeout": return Effect.fail(new Error$1({
-			message: "DNS query timed out",
-			reason: "timeout"
-		}));
-		case "failure": return Effect.fail(new Error$1({
-			message: resolution.message,
-			reason: "transport"
-		}));
-	}
-}))) });
-const toAsync = (resolver) => ({ resolve: (query) => Effect.runPromise(resolver.resolve(query).pipe(Effect.match({
-	onFailure: (failure) => failure.reason === "timeout" ? AsyncResolution.timeout() : AsyncResolution.failure({ message: failure.message }),
-	onSuccess: (resolution) => resolution
-}))) });
-//#endregion
-export { Txt as $, Schema$1 as A, provider_exports as B, authorize$1 as C, Authorization$1 as D, renderManualInstructions as E, types_exports as F, Cname as G, A as H, Error$3 as I, Observed as J, Mx as K, Service$1 as L, decodeReceipt as M, encode as N, Operation$1 as O, encodeReceipt as P, Srv as Q, fromAsync as R, apply$1 as S, plan_exports as T, Aaaa as U, toAsync$1 as V, Caa as W, RecordSchema as X, Opaque as Y, RequirementMetadata as Z, ConflictError as _, resolver_exports as a, parse as at, StaleError as b, Error$2 as c, make as ct, Plan as d, zones_exports as dt, Type as et, Receipt as f, deletion_exports as g, create as h, Service as i, equals as it, decode as j, Receipt$1 as k, Operation as l, zone_discovery_exports as lt, authorize as m, Error$1 as n, decode$1 as nt, toAsync as o, Candidate as ot, apply as p, Ns as q, Resolution as r, dns_record_exports as rt, Authorization as s, Service$2 as st, AsyncResolution as t, data as tt, PartialError as u, candidates as ut, CreateResult as v, create$1 as w, Target as x, PartialApplyError as y, layerFromAsync$1 as z };
-
-//# sourceMappingURL=resolver-BeGz1ukw.mjs.map