domainkit 0.9.1 → 0.10.0

package/dist/internal/conformance/provider.mjs

@@ -4,7 +4,7 @@ import { DomainKitError, fail } from "../error.mjs";
 import { Service } from "../../Custody.mjs";
 import { fresh } from "../ids.mjs";
 import { Service as Service$1, make } from "../../Principal.mjs";
-import { encodeContext } from "../../Provider.mjs";
+import { encodeContext, tokenFields } from "../../Provider.mjs";
 import { Service as Service$2 } from "../../Resolver.mjs";
 import { applied } from "../../Receipt.mjs";
 import { Attachment, Authorization, Credential, Service as Service$3 } from "../../Storage.mjs";
@@ -12,7 +12,7 @@ import { attach, session } from "../../Connect.mjs";
 import { apply, approve, plan } from "../../Provision.mjs";
 import { apply as apply$1, approve as approve$1, plan as plan$1 } from "../../Cleanup.mjs";
 import { layerMemory } from "../../DomainKit.mjs";
-import { DateTime, Effect, Layer } from "effect";
+import { DateTime, Effect, Layer, Redacted } from "effect";
 //#region src/internal/conformance/provider.ts
 const principal = make({
 	ownerId: "conformance",
@@ -67,8 +67,9 @@ const txt = (zone, label, value) => txt$1({
 });
 const recordIds = (receipt) => applied(receipt).map(({ providerRecordId }) => providerRecordId);
 /**
-* Runs create/readback/cleanup, exact-noop, conflict, stale-plan, and partial-apply against a
-* real provider definition, through the same Provision and Cleanup services hosts use.
+* Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and
+* rejected-token against a real provider definition, through the same Provision and Cleanup
+* services hosts use.
 */
 const provider = (definition, credential, zone, options = {}) => {
 	const prefix = options.prefix ?? "domainkit-conformance";
@@ -86,12 +87,12 @@ const provider = (definition, credential, zone, options = {}) => {
 		const name = "create-readback-cleanup";
 		return Effect.gen(function* () {
 			const requirements = [cname(zone, `${prefix}-create`), txt(zone, `${prefix}-page`, "domainkit")];
-			const plan$2 = yield* plan({
+			const plan$4 = yield* plan({
 				domain: attachment.domain,
 				requirements
 			});
-			yield* expect(name, plan$2.operations.every(({ _tag }) => _tag === "Create"), "expected two Create operations");
-			const receipt = yield* apply(yield* approve(plan$2));
+			yield* expect(name, plan$4.operations.every(({ _tag }) => _tag === "Create"), "expected two Create operations");
+			const receipt = yield* apply(yield* approve(plan$4));
 			created = recordIds(receipt);
 			yield* expect(name, receipt.status === "complete" && created.length === 2, "apply must return a complete receipt with provider record ids");
 			const observed = yield* dns.list(zone);
@@ -111,12 +112,12 @@ const provider = (definition, credential, zone, options = {}) => {
 			const requirement = cname(zone, `${prefix}-exact`);
 			const { providerRecordId } = yield* dns.create(zone, requirement);
 			created = [providerRecordId];
-			const plan$3 = yield* plan({
+			const plan$5 = yield* plan({
 				domain: attachment.domain,
 				requirements: [requirement]
 			});
-			yield* expect(name, plan$3.operations[0]?._tag === "Noop", "an exact record must plan as Noop");
-			const receipt = yield* apply(yield* approve(plan$3));
+			yield* expect(name, plan$5.operations[0]?._tag === "Noop", "an exact record must plan as Noop");
+			const receipt = yield* apply(yield* approve(plan$5));
 			yield* expect(name, applied(receipt).length === 0, "an exact plan must not create another record");
 		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
 	});
@@ -126,12 +127,12 @@ const provider = (definition, credential, zone, options = {}) => {
 		return Effect.gen(function* () {
 			const { providerRecordId } = yield* dns.create(zone, txt(zone, `${prefix}-conflict`, "occupied"));
 			created = [providerRecordId];
-			const plan$6 = yield* plan({
+			const plan$3 = yield* plan({
 				domain: attachment.domain,
 				requirements: [cname(zone, `${prefix}-conflict`)]
 			});
-			yield* expect(name, plan$6.operations[0]?._tag === "Conflict", "a CNAME over an occupied name must plan as Conflict");
-			const rejected = yield* approve(plan$6).pipe(Effect.result);
+			yield* expect(name, plan$3.operations[0]?._tag === "Conflict", "a CNAME over an occupied name must plan as Conflict");
+			const rejected = yield* approve(plan$3).pipe(Effect.result);
 			yield* expect(name, rejected._tag === "Failure" && rejected.failure.reason._tag === "Conflict", "approve must fail closed on conflicts");
 		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
 	});
@@ -140,11 +141,11 @@ const provider = (definition, credential, zone, options = {}) => {
 		const name = "stale-plan";
 		return Effect.gen(function* () {
 			const requirement = cname(zone, `${prefix}-stale`);
-			const plan$4 = yield* plan({
+			const plan$6 = yield* plan({
 				domain: attachment.domain,
 				requirements: [requirement]
 			});
-			const approval = yield* approve(plan$4);
+			const approval = yield* approve(plan$6);
 			const { providerRecordId } = yield* dns.create(zone, requirement);
 			created = [providerRecordId];
 			const stale = yield* apply(approval).pipe(Effect.result);
@@ -177,11 +178,11 @@ const provider = (definition, credential, zone, options = {}) => {
 		let created = [];
 		const name = "partial-apply-cleanup";
 		return Effect.gen(function* () {
-			const plan$5 = yield* plan({
+			const plan$2 = yield* plan({
 				domain: attachment.domain,
 				requirements: [cname(zone, `${prefix}-partial-one`), txt(zone, `${prefix}-partial-two`, "domainkit")]
 			});
-			const receipt = yield* apply(yield* approve(plan$5));
+			const receipt = yield* apply(yield* approve(plan$2));
 			created = recordIds(receipt);
 			yield* expect(name, receipt.status === "partial" && created.length === 1, "a later write failure must preserve the first confirmed write in a partial receipt");
 			const cleanupPlan = yield* plan$1({ receiptId: receipt.id });
@@ -191,12 +192,24 @@ const provider = (definition, credential, zone, options = {}) => {
 			created = [];
 		}).pipe(Effect.ensuring(cleanup(dns, () => created)));
 	});
+	/** A token the provider rejects must read as `Unauthenticated`, so a host tells the customer the provider refused it. */
+	const rejectedToken = Effect.gen(function* () {
+		const name = "rejected-token";
+		const auth = definition.auth.token;
+		if (auth === void 0) return;
+		const required = tokenFields(auth).filter((field) => field.required);
+		if (options.rejectedToken === void 0 && required.some((field) => !field.secret)) return yield* Effect.fail(failure(name, `the token method requires ${required.filter((field) => !field.secret).map((field) => field.name).join(", ")}; pass options.rejectedToken with values the provider rejects`));
+		const values = options.rejectedToken ?? Object.fromEntries(required.map((field) => [field.name, Redacted.make("")]));
+		const outcome = yield* auth.authenticate(values).pipe(Effect.result);
+		yield* expect(name, outcome._tag === "Failure" && outcome.failure.reason._tag === "Unauthenticated", "authenticating a rejected token must fail Unauthenticated");
+	});
 	return Effect.all([
 		createReadbackCleanup,
 		exactNoop,
 		conflict,
 		stalePlan,
-		partialApplyCleanup
+		partialApplyCleanup,
+		rejectedToken
 	], { discard: true });
 };
 /** Verification is out of scope for the provider contract; keep the pool quiet. */

package/dist/internal/conformance/provider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider.mjs","names":["Principal.make","Errors.DomainKitError","Reason.InvalidInput","Storage.Service","Custody.Service","Storage.Authorization","Provider.encodeContext","Storage.Credential","Connect.attach","Storage.Attachment","DnsRecord.cname","DnsRecord.txt","Receipt.applied","Connect.session","session","Principal.Service","DomainKit.layerMemory","Resolver.Service","plan","Provision.plan","Provision.apply","Provision.approve","DnsRecord.equals","Cleanup.plan","Cleanup.apply","Cleanup.approve","Errors.fail","Reason.ProviderUnavailable"],"sources":["../../../src/internal/conformance/provider.ts"],"sourcesContent":["import { DateTime, Effect, Layer } from \"effect\";\n\nimport * as Cleanup from \"../../Cleanup.ts\";\nimport * as Connect from \"../../Connect.ts\";\nimport * as Custody from \"../../Custody.ts\";\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport * as DomainKit from \"../../DomainKit.ts\";\nimport * as Principal from \"../../Principal.ts\";\nimport * as Provider from \"../../Provider.ts\";\nimport * as Provision from \"../../Provision.ts\";\nimport * as Receipt from \"../../Receipt.ts\";\nimport * as Resolver from \"../../Resolver.ts\";\nimport * as Storage from \"../../Storage.ts\";\nimport { fresh } from \"../ids.ts\";\n\nexport const cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n] as const;\nexport type Case = (typeof cases)[number];\n\nconst principal = Principal.make({ ownerId: \"conformance\", actorId: \"conformance\" });\n\nconst failure = (name: Case, message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({\n      message: `provider conformance ${name}: ${message}`,\n      field: \"conformance\",\n    }),\n  });\n\nconst expect = (name: Case, condition: boolean, message: string) =>\n  condition ? Effect.void : Effect.fail(failure(name, message));\n\ntype Env = Storage.Service | Connect.Service | Provision.Service | Cleanup.Service;\n\n/** Attach `zone` to a connection built straight from `credential`, bypassing `authenticate`. */\nconst attachZone = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n) =>\n  Effect.gen(function* () {\n    const storage = yield* Storage.Service;\n    const custody = yield* Custody.Service;\n    const now = yield* DateTime.now;\n    const authorization = new Storage.Authorization({\n      id: yield* fresh(\"auth\"),\n      ownerId: principal.ownerId,\n      provider: definition.id,\n      method: \"token\",\n      capabilities: [\"dns:read\", \"dns:write\"],\n      context: yield* Provider.encodeContext(definition, credential.context),\n      revocation: \"active\",\n      createdBy: principal.actorId,\n      createdAt: now,\n    });\n    yield* storage.authorizations.upsert({\n      authorization,\n      credential: new Storage.Credential({\n        ciphertext: yield* custody.seal(credential.secret),\n        expiresAt: null,\n        rotatedAt: now,\n      }),\n    });\n    const connection = yield* storage.connections.create(authorization.id);\n    const attached = yield* Connect.attach({ connectionId: connection.id, domain: zone });\n    if (!(attached instanceof Storage.Attachment)) {\n      return yield* Effect.fail(\n        failure(\"create-readback-cleanup\", `zone ${zone} needs a selection; pass an exact zone`),\n      );\n    }\n    return attached;\n  });\n\nconst cname = (zone: string, label: string) =>\n  DnsRecord.cname({ name: `${label}.${zone}`, target: \"target.example.net\", ttl: 300 });\nconst txt = (zone: string, label: string, value: string) =>\n  DnsRecord.txt({ name: `${label}.${zone}`, value, ttl: 300 });\n\nconst recordIds = (receipt: Receipt.Model) =>\n  Receipt.applied(receipt).map(({ providerRecordId }) => providerRecordId);\n\n/**\n * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, and partial-apply against a\n * real provider definition, through the same Provision and Cleanup services hosts use.\n */\nexport const provider = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n  options: { readonly prefix?: string } = {},\n): Effect.Effect<void, Errors.DomainKitError> => {\n  const prefix = options.prefix ?? \"domainkit-conformance\";\n  const run = <A>(\n    target: Provider.Definition,\n    body: (\n      dns: Provider.Dns,\n      attachment: Storage.Attachment,\n    ) => Effect.Effect<A, Errors.DomainKitError, Env | Principal.Service>,\n  ) =>\n    Effect.gen(function* () {\n      const attachment = yield* attachZone(target, credential, zone);\n      const { session, target: resolved } = yield* Connect.session(attachment.id);\n      return yield* body(session.dns(resolved), attachment);\n    }).pipe(\n      Effect.provideService(Principal.Service, principal),\n      Effect.provide(\n        DomainKit.layerMemory({\n          providers: [target],\n          resolver: Layer.succeed(Resolver.Service)(silentResolver),\n        }),\n      ),\n    );\n\n  const cleanup = (dns: Provider.Dns, ids: () => ReadonlyArray<string>) =>\n    Effect.suspend(() =>\n      Effect.forEach(ids(), (id) => dns.delete(zone, id).pipe(Effect.ignore), { discard: true }),\n    );\n\n  const createReadbackCleanup = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"create-readback-cleanup\";\n    return Effect.gen(function* () {\n      const requirements = [\n        cname(zone, `${prefix}-create`),\n        txt(zone, `${prefix}-page`, \"domainkit\"),\n      ];\n      const plan = yield* Provision.plan({ domain: attachment.domain, requirements });\n      yield* expect(\n        name,\n        plan.operations.every(({ _tag }) => _tag === \"Create\"),\n        \"expected two Create operations\",\n      );\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"complete\" && created.length === 2,\n        \"apply must return a complete receipt with provider record ids\",\n      );\n      const observed = yield* dns.list(zone);\n      yield* expect(\n        name,\n        requirements.every((requirement) =>\n          observed.some(({ record }) => DnsRecord.equals(record, requirement)),\n        ),\n        \"list must return every created record, including across provider pages\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* expect(\n        name,\n        cleanupPlan.operations.every(({ _tag }) => _tag === \"Delete\"),\n        \"cleanup plan must delete both records\",\n      );\n      const cleaned = yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        cleaned.status === \"complete\" && remaining.every((record) => record === null),\n        \"receipt-bound cleanup must remove every created record\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const exactNoop = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"exact-noop\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-exact`);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      yield* expect(name, plan.operations[0]?._tag === \"Noop\", \"an exact record must plan as Noop\");\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      yield* expect(\n        name,\n        Receipt.applied(receipt).length === 0,\n        \"an exact plan must not create another record\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const conflict = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"conflict\";\n    return Effect.gen(function* () {\n      const { providerRecordId } = yield* dns.create(\n        zone,\n        txt(zone, `${prefix}-conflict`, \"occupied\"),\n      );\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [cname(zone, `${prefix}-conflict`)],\n      });\n      yield* expect(\n        name,\n        plan.operations[0]?._tag === \"Conflict\",\n        \"a CNAME over an occupied name must plan as Conflict\",\n      );\n      const rejected = yield* Provision.approve(plan).pipe(Effect.result);\n      yield* expect(\n        name,\n        rejected._tag === \"Failure\" && rejected.failure.reason._tag === \"Conflict\",\n        \"approve must fail closed on conflicts\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const stalePlan = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"stale-plan\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-stale`);\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      const approval = yield* Provision.approve(plan);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const stale = yield* Provision.apply(approval).pipe(Effect.result);\n      yield* expect(\n        name,\n        stale._tag === \"Failure\" && stale.failure.reason._tag === \"Stale\",\n        \"apply must reject provider state that changed after approval\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const flaky: Provider.Definition = {\n    ...definition,\n    session: (input) => {\n      const session = definition.session(input);\n      return {\n        ...session,\n        dns: (target) => {\n          const dns = session.dns(target);\n          let writes = 0;\n          return {\n            ...dns,\n            create: (targetZone, record) => {\n              writes += 1;\n              return writes === 2\n                ? Errors.fail(\n                    new Reason.ProviderUnavailable({\n                      provider: definition.id,\n                      message: \"injected conformance failure\",\n                    }),\n                  )\n                : dns.create(targetZone, record);\n            },\n          };\n        },\n      };\n    },\n  };\n\n  const partialApplyCleanup = run(flaky, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"partial-apply-cleanup\";\n    return Effect.gen(function* () {\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [\n          cname(zone, `${prefix}-partial-one`),\n          txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n        ],\n      });\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"partial\" && created.length === 1,\n        \"a later write failure must preserve the first confirmed write in a partial receipt\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        remaining.every((record) => record === null),\n        \"partial receipt cleanup must remove the confirmed write\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  return Effect.all([createReadbackCleanup, exactNoop, conflict, stalePlan, partialApplyCleanup], {\n    discard: true,\n  });\n};\n\n/** Verification is out of scope for the provider contract; keep the pool quiet. */\nconst silentResolver: Resolver.Interface = {\n  resolve: () => Effect.succeed([]),\n};\n"],"mappings":";;;;;;;;;;;;;;;;AA0BA,MAAM,YAAYA,KAAe;CAAE,SAAS;CAAe,SAAS;AAAc,CAAC;AAEnF,MAAM,WAAW,MAAY,YAC3B,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAC9B,SAAS,wBAAwB,KAAK,IAAI;CAC1C,OAAO;AACT,CAAC,EACH,CAAC;AAEH,MAAM,UAAU,MAAY,WAAoB,YAC9C,YAAY,OAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO,CAAC;;AAK9D,MAAM,cACJ,YACA,YACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,gBAAgB,IAAIC,cAAsB;EAC9C,IAAI,OAAO,MAAM,MAAM;EACvB,SAAS,UAAU;EACnB,UAAU,WAAW;EACrB,QAAQ;EACR,cAAc,CAAC,YAAY,WAAW;EACtC,SAAS,OAAOC,cAAuB,YAAY,WAAW,OAAO;EACrE,YAAY;EACZ,WAAW,UAAU;EACrB,WAAW;CACb,CAAC;CACD,OAAO,QAAQ,eAAe,OAAO;EACnC;EACA,YAAY,IAAIC,WAAmB;GACjC,YAAY,OAAO,QAAQ,KAAK,WAAW,MAAM;GACjD,WAAW;GACX,WAAW;EACb,CAAC;CACH,CAAC;CACD,MAAM,aAAa,OAAO,QAAQ,YAAY,OAAO,cAAc,EAAE;CACrE,MAAM,WAAW,OAAOC,OAAe;EAAE,cAAc,WAAW;EAAI,QAAQ;CAAK,CAAC;CACpF,IAAI,EAAE,oBAAoBC,aACxB,OAAO,OAAO,OAAO,KACnB,QAAQ,2BAA2B,QAAQ,KAAK,uCAAuC,CACzF;CAEF,OAAO;AACT,CAAC;AAEH,MAAM,SAAS,MAAc,UAC3BC,QAAgB;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ,QAAQ;CAAsB,KAAK;AAAI,CAAC;AACtF,MAAM,OAAO,MAAc,OAAe,UACxCC,MAAc;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ;CAAO,KAAK;AAAI,CAAC;AAE7D,MAAM,aAAa,YACjBC,QAAgB,OAAO,CAAC,CAAC,KAAK,EAAE,uBAAuB,gBAAgB;;;;;AAMzE,MAAa,YACX,YACA,YACA,MACA,UAAwC,CAAC,MACM;CAC/C,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,OACJ,QACA,SAKA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,WAAW,QAAQ,YAAY,IAAI;EAC7D,MAAM,EAAE,SAAA,WAAS,QAAQ,aAAa,OAAOC,QAAgB,WAAW,EAAE;EAC1E,OAAO,OAAO,KAAKC,UAAQ,IAAI,QAAQ,GAAG,UAAU;CACtD,CAAC,CAAC,CAAC,KACD,OAAO,eAAeC,WAAmB,SAAS,GAClD,OAAO,QACLC,YAAsB;EACpB,WAAW,CAAC,MAAM;EAClB,UAAU,MAAM,QAAQC,SAAgB,CAAC,CAAC,cAAc;CAC1D,CAAC,CACH,CACF;CAEF,MAAM,WAAW,KAAmB,QAClC,OAAO,cACL,OAAO,QAAQ,IAAI,IAAI,OAAO,IAAI,OAAO,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,MAAM,GAAG,EAAE,SAAS,KAAK,CAAC,CAC3F;CAEF,MAAM,wBAAwB,IAAI,aAAa,KAAK,eAAe;EACjE,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,QAAQ,GAC9B,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CACzC;GACA,MAAMC,SAAO,OAAOC,KAAe;IAAE,QAAQ,WAAW;IAAQ;GAAa,CAAC;GAC9E,OAAO,OACL,MACAD,OAAK,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GACrD,gCACF;GACA,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,QAAQ,WAAW,GACpD,+DACF;GACA,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;GACrC,OAAO,OACL,MACA,aAAa,OAAO,gBAClB,SAAS,MAAM,EAAE,aAAaI,OAAiB,QAAQ,WAAW,CAAC,CACrE,GACA,wEACF;GACA,MAAM,cAAc,OAAOC,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAO,OACL,MACA,YAAY,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GAC5D,uCACF;GACA,MAAM,UAAU,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxE,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW,IAAI,GAC5E,wDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAMP,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,OAAO,OAAO,MAAMD,OAAK,WAAW,EAAE,EAAE,SAAS,QAAQ,mCAAmC;GAC5F,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,OAAO,OACL,MACAN,QAAgB,OAAO,CAAC,CAAC,WAAW,GACpC,8CACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,WAAW,IAAI,aAAa,KAAK,eAAe;EACpD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,EAAE,qBAAqB,OAAO,IAAI,OACtC,MACA,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU,CAC5C;GACA,UAAU,CAAC,gBAAgB;GAC3B,MAAMM,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC;GAClD,CAAC;GACD,OAAO,OACL,MACAD,OAAK,WAAW,EAAE,EAAE,SAAS,YAC7B,qDACF;GACA,MAAM,WAAW,OAAOG,QAAkBH,MAAI,CAAC,CAAC,KAAK,OAAO,MAAM;GAClE,OAAO,OACL,MACA,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,SAAS,YAChE,uCACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAMA,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,MAAM,WAAW,OAAOE,QAAkBH,MAAI;GAC9C,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAM,QAAQ,OAAOE,MAAgB,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;GACjE,OAAO,OACL,MACA,MAAM,SAAS,aAAa,MAAM,QAAQ,OAAO,SAAS,SAC1D,8DACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CA8BD,MAAM,sBAAsB,IAAI;EA3B9B,GAAG;EACH,UAAU,UAAU;GAClB,MAAM,UAAU,WAAW,QAAQ,KAAK;GACxC,OAAO;IACL,GAAG;IACH,MAAM,WAAW;KACf,MAAM,MAAM,QAAQ,IAAI,MAAM;KAC9B,IAAI,SAAS;KACb,OAAO;MACL,GAAG;MACH,SAAS,YAAY,WAAW;OAC9B,UAAU;OACV,OAAO,WAAW,IACdM,KACE,IAAIC,oBAA2B;QAC7B,UAAU,WAAW;QACrB,SAAS;OACX,CAAC,CACH,IACA,IAAI,OAAO,YAAY,MAAM;MACnC;KACF;IACF;GACF;EACF;CAGkC,IAAI,KAAK,eAAe;EAC1D,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAMT,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CACZ,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;GACF,CAAC;GACD,MAAM,UAAU,OAAOC,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,aAAa,QAAQ,WAAW,GACnD,oFACF;GACA,MAAM,cAAc,OAAOK,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxD,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,UAAU,OAAO,WAAW,WAAW,IAAI,GAC3C,yDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,OAAO,OAAO,IAAI;EAAC;EAAuB;EAAW;EAAU;EAAW;CAAmB,GAAG,EAC9F,SAAS,KACX,CAAC;AACH;;AAGA,MAAM,iBAAqC,EACzC,eAAe,OAAO,QAAQ,CAAC,CAAC,EAClC"}
+{"version":3,"file":"provider.mjs","names":["Principal.make","Errors.DomainKitError","Reason.InvalidInput","Storage.Service","Custody.Service","Storage.Authorization","Provider.encodeContext","Storage.Credential","Connect.attach","Storage.Attachment","DnsRecord.cname","DnsRecord.txt","Receipt.applied","Connect.session","session","Principal.Service","DomainKit.layerMemory","Resolver.Service","plan","Provision.plan","Provision.apply","Provision.approve","DnsRecord.equals","Cleanup.plan","Cleanup.apply","Cleanup.approve","Errors.fail","Reason.ProviderUnavailable","Provider.tokenFields"],"sources":["../../../src/internal/conformance/provider.ts"],"sourcesContent":["import { DateTime, Effect, Layer, Redacted } from \"effect\";\n\nimport * as Cleanup from \"../../Cleanup.ts\";\nimport * as Connect from \"../../Connect.ts\";\nimport * as Custody from \"../../Custody.ts\";\nimport * as DnsRecord from \"../../DnsRecord.ts\";\nimport * as Errors from \"../error.ts\";\nimport * as Reason from \"../../Reason.ts\";\nimport * as DomainKit from \"../../DomainKit.ts\";\nimport * as Principal from \"../../Principal.ts\";\nimport * as Provider from \"../../Provider.ts\";\nimport * as Provision from \"../../Provision.ts\";\nimport * as Receipt from \"../../Receipt.ts\";\nimport * as Resolver from \"../../Resolver.ts\";\nimport * as Storage from \"../../Storage.ts\";\nimport { fresh } from \"../ids.ts\";\n\nexport const cases = [\n  \"create-readback-cleanup\",\n  \"exact-noop\",\n  \"conflict\",\n  \"stale-plan\",\n  \"partial-apply-cleanup\",\n  \"rejected-token\",\n] as const;\nexport type Case = (typeof cases)[number];\n\nconst principal = Principal.make({ ownerId: \"conformance\", actorId: \"conformance\" });\n\nconst failure = (name: Case, message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({\n      message: `provider conformance ${name}: ${message}`,\n      field: \"conformance\",\n    }),\n  });\n\nconst expect = (name: Case, condition: boolean, message: string) =>\n  condition ? Effect.void : Effect.fail(failure(name, message));\n\ntype Env = Storage.Service | Connect.Service | Provision.Service | Cleanup.Service;\n\n/** Attach `zone` to a connection built straight from `credential`, bypassing `authenticate`. */\nconst attachZone = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n) =>\n  Effect.gen(function* () {\n    const storage = yield* Storage.Service;\n    const custody = yield* Custody.Service;\n    const now = yield* DateTime.now;\n    const authorization = new Storage.Authorization({\n      id: yield* fresh(\"auth\"),\n      ownerId: principal.ownerId,\n      provider: definition.id,\n      method: \"token\",\n      capabilities: [\"dns:read\", \"dns:write\"],\n      context: yield* Provider.encodeContext(definition, credential.context),\n      revocation: \"active\",\n      createdBy: principal.actorId,\n      createdAt: now,\n    });\n    yield* storage.authorizations.upsert({\n      authorization,\n      credential: new Storage.Credential({\n        ciphertext: yield* custody.seal(credential.secret),\n        expiresAt: null,\n        rotatedAt: now,\n      }),\n    });\n    const connection = yield* storage.connections.create(authorization.id);\n    const attached = yield* Connect.attach({ connectionId: connection.id, domain: zone });\n    if (!(attached instanceof Storage.Attachment)) {\n      return yield* Effect.fail(\n        failure(\"create-readback-cleanup\", `zone ${zone} needs a selection; pass an exact zone`),\n      );\n    }\n    return attached;\n  });\n\nconst cname = (zone: string, label: string) =>\n  DnsRecord.cname({ name: `${label}.${zone}`, target: \"target.example.net\", ttl: 300 });\nconst txt = (zone: string, label: string, value: string) =>\n  DnsRecord.txt({ name: `${label}.${zone}`, value, ttl: 300 });\n\nconst recordIds = (receipt: Receipt.Model) =>\n  Receipt.applied(receipt).map(({ providerRecordId }) => providerRecordId);\n\n/**\n * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and\n * rejected-token against a real provider definition, through the same Provision and Cleanup\n * services hosts use.\n */\nexport const provider = (\n  definition: Provider.Definition,\n  credential: Provider.Credential,\n  zone: string,\n  options: {\n    readonly prefix?: string;\n    /**\n     * Token values the provider rejects, for the `rejected-token` case. Default: every required\n     * field set to an empty secret, which needs a token method whose required fields are all\n     * secrets.\n     */\n    readonly rejectedToken?: Provider.TokenValues;\n  } = {},\n): Effect.Effect<void, Errors.DomainKitError> => {\n  const prefix = options.prefix ?? \"domainkit-conformance\";\n  const run = <A>(\n    target: Provider.Definition,\n    body: (\n      dns: Provider.Dns,\n      attachment: Storage.Attachment,\n    ) => Effect.Effect<A, Errors.DomainKitError, Env | Principal.Service>,\n  ) =>\n    Effect.gen(function* () {\n      const attachment = yield* attachZone(target, credential, zone);\n      const { session, target: resolved } = yield* Connect.session(attachment.id);\n      return yield* body(session.dns(resolved), attachment);\n    }).pipe(\n      Effect.provideService(Principal.Service, principal),\n      Effect.provide(\n        DomainKit.layerMemory({\n          providers: [target],\n          resolver: Layer.succeed(Resolver.Service)(silentResolver),\n        }),\n      ),\n    );\n\n  const cleanup = (dns: Provider.Dns, ids: () => ReadonlyArray<string>) =>\n    Effect.suspend(() =>\n      Effect.forEach(ids(), (id) => dns.delete(zone, id).pipe(Effect.ignore), { discard: true }),\n    );\n\n  const createReadbackCleanup = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"create-readback-cleanup\";\n    return Effect.gen(function* () {\n      const requirements = [\n        cname(zone, `${prefix}-create`),\n        txt(zone, `${prefix}-page`, \"domainkit\"),\n      ];\n      const plan = yield* Provision.plan({ domain: attachment.domain, requirements });\n      yield* expect(\n        name,\n        plan.operations.every(({ _tag }) => _tag === \"Create\"),\n        \"expected two Create operations\",\n      );\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"complete\" && created.length === 2,\n        \"apply must return a complete receipt with provider record ids\",\n      );\n      const observed = yield* dns.list(zone);\n      yield* expect(\n        name,\n        requirements.every((requirement) =>\n          observed.some(({ record }) => DnsRecord.equals(record, requirement)),\n        ),\n        \"list must return every created record, including across provider pages\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* expect(\n        name,\n        cleanupPlan.operations.every(({ _tag }) => _tag === \"Delete\"),\n        \"cleanup plan must delete both records\",\n      );\n      const cleaned = yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        cleaned.status === \"complete\" && remaining.every((record) => record === null),\n        \"receipt-bound cleanup must remove every created record\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const exactNoop = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"exact-noop\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-exact`);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      yield* expect(name, plan.operations[0]?._tag === \"Noop\", \"an exact record must plan as Noop\");\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      yield* expect(\n        name,\n        Receipt.applied(receipt).length === 0,\n        \"an exact plan must not create another record\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const conflict = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"conflict\";\n    return Effect.gen(function* () {\n      const { providerRecordId } = yield* dns.create(\n        zone,\n        txt(zone, `${prefix}-conflict`, \"occupied\"),\n      );\n      created = [providerRecordId];\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [cname(zone, `${prefix}-conflict`)],\n      });\n      yield* expect(\n        name,\n        plan.operations[0]?._tag === \"Conflict\",\n        \"a CNAME over an occupied name must plan as Conflict\",\n      );\n      const rejected = yield* Provision.approve(plan).pipe(Effect.result);\n      yield* expect(\n        name,\n        rejected._tag === \"Failure\" && rejected.failure.reason._tag === \"Conflict\",\n        \"approve must fail closed on conflicts\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const stalePlan = run(definition, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"stale-plan\";\n    return Effect.gen(function* () {\n      const requirement = cname(zone, `${prefix}-stale`);\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [requirement],\n      });\n      const approval = yield* Provision.approve(plan);\n      const { providerRecordId } = yield* dns.create(zone, requirement);\n      created = [providerRecordId];\n      const stale = yield* Provision.apply(approval).pipe(Effect.result);\n      yield* expect(\n        name,\n        stale._tag === \"Failure\" && stale.failure.reason._tag === \"Stale\",\n        \"apply must reject provider state that changed after approval\",\n      );\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  const flaky: Provider.Definition = {\n    ...definition,\n    session: (input) => {\n      const session = definition.session(input);\n      return {\n        ...session,\n        dns: (target) => {\n          const dns = session.dns(target);\n          let writes = 0;\n          return {\n            ...dns,\n            create: (targetZone, record) => {\n              writes += 1;\n              return writes === 2\n                ? Errors.fail(\n                    new Reason.ProviderUnavailable({\n                      provider: definition.id,\n                      message: \"injected conformance failure\",\n                    }),\n                  )\n                : dns.create(targetZone, record);\n            },\n          };\n        },\n      };\n    },\n  };\n\n  const partialApplyCleanup = run(flaky, (dns, attachment) => {\n    let created: ReadonlyArray<string> = [];\n    const name: Case = \"partial-apply-cleanup\";\n    return Effect.gen(function* () {\n      const plan = yield* Provision.plan({\n        domain: attachment.domain,\n        requirements: [\n          cname(zone, `${prefix}-partial-one`),\n          txt(zone, `${prefix}-partial-two`, \"domainkit\"),\n        ],\n      });\n      const receipt = yield* Provision.apply(yield* Provision.approve(plan));\n      created = recordIds(receipt);\n      yield* expect(\n        name,\n        receipt.status === \"partial\" && created.length === 1,\n        \"a later write failure must preserve the first confirmed write in a partial receipt\",\n      );\n      const cleanupPlan = yield* Cleanup.plan({ receiptId: receipt.id });\n      yield* Cleanup.apply(yield* Cleanup.approve(cleanupPlan));\n      const remaining = yield* Effect.forEach(created, (id) => dns.get(zone, id));\n      yield* expect(\n        name,\n        remaining.every((record) => record === null),\n        \"partial receipt cleanup must remove the confirmed write\",\n      );\n      created = [];\n    }).pipe(Effect.ensuring(cleanup(dns, () => created)));\n  });\n\n  /** A token the provider rejects must read as `Unauthenticated`, so a host tells the customer the provider refused it. */\n  const rejectedToken = Effect.gen(function* () {\n    const name: Case = \"rejected-token\";\n    const auth = definition.auth.token;\n    if (auth === undefined) return;\n    const required = Provider.tokenFields(auth).filter((field) => field.required);\n    if (options.rejectedToken === undefined && required.some((field) => !field.secret)) {\n      return yield* Effect.fail(\n        failure(\n          name,\n          `the token method requires ${required\n            .filter((field) => !field.secret)\n            .map((field) => field.name)\n            .join(\", \")}; pass options.rejectedToken with values the provider rejects`,\n        ),\n      );\n    }\n    const values =\n      options.rejectedToken ??\n      Object.fromEntries(required.map((field) => [field.name, Redacted.make(\"\")]));\n    const outcome = yield* auth.authenticate(values).pipe(Effect.result);\n    yield* expect(\n      name,\n      outcome._tag === \"Failure\" && outcome.failure.reason._tag === \"Unauthenticated\",\n      \"authenticating a rejected token must fail Unauthenticated\",\n    );\n  });\n\n  return Effect.all(\n    [createReadbackCleanup, exactNoop, conflict, stalePlan, partialApplyCleanup, rejectedToken],\n    { discard: true },\n  );\n};\n\n/** Verification is out of scope for the provider contract; keep the pool quiet. */\nconst silentResolver: Resolver.Interface = {\n  resolve: () => Effect.succeed([]),\n};\n"],"mappings":";;;;;;;;;;;;;;;;AA2BA,MAAM,YAAYA,KAAe;CAAE,SAAS;CAAe,SAAS;AAAc,CAAC;AAEnF,MAAM,WAAW,MAAY,YAC3B,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAC9B,SAAS,wBAAwB,KAAK,IAAI;CAC1C,OAAO;AACT,CAAC,EACH,CAAC;AAEH,MAAM,UAAU,MAAY,WAAoB,YAC9C,YAAY,OAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO,CAAC;;AAK9D,MAAM,cACJ,YACA,YACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,gBAAgB,IAAIC,cAAsB;EAC9C,IAAI,OAAO,MAAM,MAAM;EACvB,SAAS,UAAU;EACnB,UAAU,WAAW;EACrB,QAAQ;EACR,cAAc,CAAC,YAAY,WAAW;EACtC,SAAS,OAAOC,cAAuB,YAAY,WAAW,OAAO;EACrE,YAAY;EACZ,WAAW,UAAU;EACrB,WAAW;CACb,CAAC;CACD,OAAO,QAAQ,eAAe,OAAO;EACnC;EACA,YAAY,IAAIC,WAAmB;GACjC,YAAY,OAAO,QAAQ,KAAK,WAAW,MAAM;GACjD,WAAW;GACX,WAAW;EACb,CAAC;CACH,CAAC;CACD,MAAM,aAAa,OAAO,QAAQ,YAAY,OAAO,cAAc,EAAE;CACrE,MAAM,WAAW,OAAOC,OAAe;EAAE,cAAc,WAAW;EAAI,QAAQ;CAAK,CAAC;CACpF,IAAI,EAAE,oBAAoBC,aACxB,OAAO,OAAO,OAAO,KACnB,QAAQ,2BAA2B,QAAQ,KAAK,uCAAuC,CACzF;CAEF,OAAO;AACT,CAAC;AAEH,MAAM,SAAS,MAAc,UAC3BC,QAAgB;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ,QAAQ;CAAsB,KAAK;AAAI,CAAC;AACtF,MAAM,OAAO,MAAc,OAAe,UACxCC,MAAc;CAAE,MAAM,GAAG,MAAM,GAAG;CAAQ;CAAO,KAAK;AAAI,CAAC;AAE7D,MAAM,aAAa,YACjBC,QAAgB,OAAO,CAAC,CAAC,KAAK,EAAE,uBAAuB,gBAAgB;;;;;;AAOzE,MAAa,YACX,YACA,YACA,MACA,UAQI,CAAC,MAC0C;CAC/C,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,OACJ,QACA,SAKA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,WAAW,QAAQ,YAAY,IAAI;EAC7D,MAAM,EAAE,SAAA,WAAS,QAAQ,aAAa,OAAOC,QAAgB,WAAW,EAAE;EAC1E,OAAO,OAAO,KAAKC,UAAQ,IAAI,QAAQ,GAAG,UAAU;CACtD,CAAC,CAAC,CAAC,KACD,OAAO,eAAeC,WAAmB,SAAS,GAClD,OAAO,QACLC,YAAsB;EACpB,WAAW,CAAC,MAAM;EAClB,UAAU,MAAM,QAAQC,SAAgB,CAAC,CAAC,cAAc;CAC1D,CAAC,CACH,CACF;CAEF,MAAM,WAAW,KAAmB,QAClC,OAAO,cACL,OAAO,QAAQ,IAAI,IAAI,OAAO,IAAI,OAAO,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,MAAM,GAAG,EAAE,SAAS,KAAK,CAAC,CAC3F;CAEF,MAAM,wBAAwB,IAAI,aAAa,KAAK,eAAe;EACjE,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,eAAe,CACnB,MAAM,MAAM,GAAG,OAAO,QAAQ,GAC9B,IAAI,MAAM,GAAG,OAAO,QAAQ,WAAW,CACzC;GACA,MAAMC,SAAO,OAAOC,KAAe;IAAE,QAAQ,WAAW;IAAQ;GAAa,CAAC;GAC9E,OAAO,OACL,MACAD,OAAK,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GACrD,gCACF;GACA,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,QAAQ,WAAW,GACpD,+DACF;GACA,MAAM,WAAW,OAAO,IAAI,KAAK,IAAI;GACrC,OAAO,OACL,MACA,aAAa,OAAO,gBAClB,SAAS,MAAM,EAAE,aAAaI,OAAiB,QAAQ,WAAW,CAAC,CACrE,GACA,wEACF;GACA,MAAM,cAAc,OAAOC,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAO,OACL,MACA,YAAY,WAAW,OAAO,EAAE,WAAW,SAAS,QAAQ,GAC5D,uCACF;GACA,MAAM,UAAU,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxE,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,QAAQ,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW,IAAI,GAC5E,wDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAMP,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,OAAO,OAAO,MAAMD,OAAK,WAAW,EAAE,EAAE,SAAS,QAAQ,mCAAmC;GAC5F,MAAM,UAAU,OAAOE,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,OAAO,OACL,MACAN,QAAgB,OAAO,CAAC,CAAC,WAAW,GACpC,8CACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,WAAW,IAAI,aAAa,KAAK,eAAe;EACpD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,EAAE,qBAAqB,OAAO,IAAI,OACtC,MACA,IAAI,MAAM,GAAG,OAAO,YAAY,UAAU,CAC5C;GACA,UAAU,CAAC,gBAAgB;GAC3B,MAAMM,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC;GAClD,CAAC;GACD,OAAO,OACL,MACAD,OAAK,WAAW,EAAE,EAAE,SAAS,YAC7B,qDACF;GACA,MAAM,WAAW,OAAOG,QAAkBH,MAAI,CAAC,CAAC,KAAK,OAAO,MAAM;GAClE,OAAO,OACL,MACA,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,SAAS,YAChE,uCACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CAED,MAAM,YAAY,IAAI,aAAa,KAAK,eAAe;EACrD,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,cAAc,MAAM,MAAM,GAAG,OAAO,OAAO;GACjD,MAAMA,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CAAC,WAAW;GAC5B,CAAC;GACD,MAAM,WAAW,OAAOE,QAAkBH,MAAI;GAC9C,MAAM,EAAE,qBAAqB,OAAO,IAAI,OAAO,MAAM,WAAW;GAChE,UAAU,CAAC,gBAAgB;GAC3B,MAAM,QAAQ,OAAOE,MAAgB,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;GACjE,OAAO,OACL,MACA,MAAM,SAAS,aAAa,MAAM,QAAQ,OAAO,SAAS,SAC1D,8DACF;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;CA8BD,MAAM,sBAAsB,IAAI;EA3B9B,GAAG;EACH,UAAU,UAAU;GAClB,MAAM,UAAU,WAAW,QAAQ,KAAK;GACxC,OAAO;IACL,GAAG;IACH,MAAM,WAAW;KACf,MAAM,MAAM,QAAQ,IAAI,MAAM;KAC9B,IAAI,SAAS;KACb,OAAO;MACL,GAAG;MACH,SAAS,YAAY,WAAW;OAC9B,UAAU;OACV,OAAO,WAAW,IACdM,KACE,IAAIC,oBAA2B;QAC7B,UAAU,WAAW;QACrB,SAAS;OACX,CAAC,CACH,IACA,IAAI,OAAO,YAAY,MAAM;MACnC;KACF;IACF;GACF;EACF;CAGkC,IAAI,KAAK,eAAe;EAC1D,IAAI,UAAiC,CAAC;EACtC,MAAM,OAAa;EACnB,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAMT,SAAO,OAAOC,KAAe;IACjC,QAAQ,WAAW;IACnB,cAAc,CACZ,MAAM,MAAM,GAAG,OAAO,aAAa,GACnC,IAAI,MAAM,GAAG,OAAO,eAAe,WAAW,CAChD;GACF,CAAC;GACD,MAAM,UAAU,OAAOC,MAAgB,OAAOC,QAAkBH,MAAI,CAAC;GACrE,UAAU,UAAU,OAAO;GAC3B,OAAO,OACL,MACA,QAAQ,WAAW,aAAa,QAAQ,WAAW,GACnD,oFACF;GACA,MAAM,cAAc,OAAOK,OAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;GACjE,OAAOC,QAAc,OAAOC,UAAgB,WAAW,CAAC;GACxD,MAAM,YAAY,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;GAC1E,OAAO,OACL,MACA,UAAU,OAAO,WAAW,WAAW,IAAI,GAC3C,yDACF;GACA,UAAU,CAAC;EACb,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,WAAW,OAAO,CAAC,CAAC;CACtD,CAAC;;CAGD,MAAM,gBAAgB,OAAO,IAAI,aAAa;EAC5C,MAAM,OAAa;EACnB,MAAM,OAAO,WAAW,KAAK;EAC7B,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,WAAWG,YAAqB,IAAI,CAAC,CAAC,QAAQ,UAAU,MAAM,QAAQ;EAC5E,IAAI,QAAQ,kBAAkB,KAAA,KAAa,SAAS,MAAM,UAAU,CAAC,MAAM,MAAM,GAC/E,OAAO,OAAO,OAAO,KACnB,QACE,MACA,6BAA6B,SAC1B,QAAQ,UAAU,CAAC,MAAM,MAAM,CAAC,CAChC,KAAK,UAAU,MAAM,IAAI,CAAC,CAC1B,KAAK,IAAI,EAAE,8DAChB,CACF;EAEF,MAAM,SACJ,QAAQ,iBACR,OAAO,YAAY,SAAS,KAAK,UAAU,CAAC,MAAM,MAAM,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC;EAC7E,MAAM,UAAU,OAAO,KAAK,aAAa,MAAM,CAAC,CAAC,KAAK,OAAO,MAAM;EACnE,OAAO,OACL,MACA,QAAQ,SAAS,aAAa,QAAQ,QAAQ,OAAO,SAAS,mBAC9D,2DACF;CACF,CAAC;CAED,OAAO,OAAO,IACZ;EAAC;EAAuB;EAAW;EAAU;EAAW;EAAqB;CAAa,GAC1F,EAAE,SAAS,KAAK,CAClB;AACF;;AAGA,MAAM,iBAAqC,EACzC,eAAe,OAAO,QAAQ,CAAC,CAAC,EAClC"}

package/dist/internal/http.mjs

@@ -1,5 +1,5 @@
 import { Forbidden, ProviderConflict, ProviderRejected, ProviderUnavailable, Unauthenticated } from "../Reason.mjs";
-import { DomainKitError, isDomainKitError } from "./error.mjs";
+import { DomainKitError, fail, isDomainKitError } from "./error.mjs";
 import { Effect } from "effect";
 //#region src/internal/http.ts
 /** One provider HTTP round trip: transport failures and non-JSON replies are already classified. */
@@ -63,6 +63,11 @@ const classify = (provider, status, headers, message, code) => {
 		code: code ?? String(status)
 	});
 };
+/**
+* During token verification a `Forbidden` answer means the provider did not accept the token, so
+* it reads as `Unauthenticated` with the provider's own message.
+*/
+const rejectedToken = (verification) => verification.pipe(Effect.catchIf((error) => error.reason._tag === "Forbidden", (error) => fail(new Unauthenticated({ message: error.reason.message }))));
 const rejected = (provider, message, code) => new DomainKitError({ reason: new ProviderRejected({
 	provider,
 	message,
@@ -85,6 +90,6 @@ const bearer = (token, init) => ({
 	}
 });
 //#endregion
-export { bearer, classify, headersFrom, rejected, requestJson };
+export { bearer, classify, headersFrom, rejected, rejectedToken, requestJson };
 
 //# sourceMappingURL=http.mjs.map

package/dist/internal/http.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"http.mjs","names":["Errors.DomainKitError","Reason.ProviderRejected","Errors.isDomainKitError","Reason.ProviderUnavailable","Reason.Unauthenticated","Reason.Forbidden","Reason.ProviderConflict"],"sources":["../../src/internal/http.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Reply {\n  readonly status: number;\n  readonly ok: boolean;\n  readonly headers: Headers;\n  /** Parsed JSON, or `null` for an empty body. */\n  readonly body: unknown;\n}\n\n/** One provider HTTP round trip: transport failures and non-JSON replies are already classified. */\nexport const requestJson = (input: {\n  readonly fetch: Fetch;\n  readonly provider: string;\n  readonly url: URL | string;\n  readonly init?: RequestInit;\n}): Effect.Effect<Reply, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async (signal): Promise<Reply> => {\n      const { fetch: send } = input; // a free call keeps `this` undefined for a native fetch\n      const response = await send(input.url, { ...input.init, signal });\n      const text = await response.text();\n      let body: unknown = null;\n      if (text.length > 0) {\n        try {\n          body = JSON.parse(text);\n        } catch {\n          throw new Errors.DomainKitError({\n            reason: response.ok\n              ? new Reason.ProviderRejected({\n                  provider: input.provider,\n                  message: `${input.provider} returned a non-JSON response`,\n                })\n              : classify(\n                  input.provider,\n                  response.status,\n                  response.headers,\n                  `HTTP ${response.status}`,\n                ),\n          });\n        }\n      }\n      return { status: response.status, ok: response.ok, headers: response.headers, body };\n    },\n    catch: (cause) =>\n      Errors.isDomainKitError(cause)\n        ? cause\n        : new Errors.DomainKitError({\n            reason: new Reason.ProviderUnavailable({\n              provider: input.provider,\n              message: cause instanceof Error ? cause.message : `${input.provider} request failed`,\n            }),\n          }),\n  });\n\n/** Host-supplied request headers, given as a value or as a thunk that may await a fresh token. */\nexport const headersFrom = (\n  source: HeadersInit | (() => HeadersInit | Promise<HeadersInit>) | undefined,\n): Effect.Effect<Headers, Errors.DomainKitError> =>\n  source === undefined\n    ? Effect.sync(() => new Headers())\n    : typeof source !== \"function\"\n      ? Effect.sync(() => new Headers(source))\n      : Effect.tryPromise({\n          try: async () => new Headers(await source()),\n          catch: (cause) =>\n            Errors.isDomainKitError(cause)\n              ? cause\n              : new Errors.DomainKitError({\n                  reason: new Reason.Unauthenticated({\n                    message:\n                      cause instanceof Error ? cause.message : \"Request headers were unavailable\",\n                  }),\n                }),\n        });\n\n/**\n * Map an HTTP failure to a reason: 401 -> Unauthenticated, 403 -> Forbidden, 409 or a provider\n * conflict code -> ProviderConflict, 429/5xx -> ProviderUnavailable, else ProviderRejected.\n */\nexport const classify = (\n  provider: string,\n  status: number,\n  headers: Headers,\n  message: string,\n  code?: string,\n): Reason.Model => {\n  if (status === 401) return new Reason.Unauthenticated({ message });\n  if (status === 403) return new Reason.Forbidden({ message });\n  if (status === 409 || code === \"conflict\") {\n    return new Reason.ProviderConflict({\n      provider,\n      message,\n      code: code ?? String(status),\n    });\n  }\n  if (status === 429 || status >= 500) {\n    const retryAfterMs = retryAfter(headers.get(\"retry-after\"));\n    return new Reason.ProviderUnavailable({\n      provider,\n      message,\n      ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n    });\n  }\n  return new Reason.ProviderRejected({\n    provider,\n    message,\n    code: code ?? String(status),\n  });\n};\n\nexport const rejected = (provider: string, message: string, code?: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.ProviderRejected({\n      provider,\n      message,\n      ...(code === undefined ? {} : { code }),\n    }),\n  });\n\nfunction retryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);\n  const date = Date.parse(value);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\nexport const bearer = (token: string, init?: RequestInit): RequestInit => ({\n  ...init,\n  headers: {\n    Accept: \"application/json\",\n    Authorization: `Bearer ${token}`,\n    ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n    ...init?.headers,\n  },\n});\n"],"mappings":";;;;;AAgBA,MAAa,eAAe,UAM1B,OAAO,WAAW;CAChB,KAAK,OAAO,WAA2B;EACrC,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK;GAAE,GAAG,MAAM;GAAM;EAAO,CAAC;EAChE,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,OAAgB;EACpB,IAAI,KAAK,SAAS,GAChB,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,MAAM,IAAIA,eAAsB,EAC9B,QAAQ,SAAS,KACb,IAAIC,iBAAwB;IAC1B,UAAU,MAAM;IAChB,SAAS,GAAG,MAAM,SAAS;GAC7B,CAAC,IACD,SACE,MAAM,UACN,SAAS,QACT,SAAS,SACT,QAAQ,SAAS,QACnB,EACN,CAAC;EACH;EAEF,OAAO;GAAE,QAAQ,SAAS;GAAQ,IAAI,SAAS;GAAI,SAAS,SAAS;GAAS;EAAK;CACrF;CACA,QAAQ,UACNC,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EACxB,QAAQ,IAAIG,oBAA2B;EACrC,UAAU,MAAM;EAChB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,GAAG,MAAM,SAAS;CACtE,CAAC,EACH,CAAC;AACT,CAAC;;AAGH,MAAa,eACX,WAEA,WAAW,KAAA,IACP,OAAO,WAAW,IAAI,QAAQ,CAAC,IAC/B,OAAO,WAAW,aAChB,OAAO,WAAW,IAAI,QAAQ,MAAM,CAAC,IACrC,OAAO,WAAW;CAChB,KAAK,YAAY,IAAI,QAAQ,MAAM,OAAO,CAAC;CAC3C,QAAQ,UACND,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EACxB,QAAQ,IAAII,gBAAuB,EACjC,SACE,iBAAiB,QAAQ,MAAM,UAAU,mCAC7C,CAAC,EACH,CAAC;AACT,CAAC;;;;;AAMT,MAAa,YACX,UACA,QACA,SACA,SACA,SACiB;CACjB,IAAI,WAAW,KAAK,OAAO,IAAIA,gBAAuB,EAAE,QAAQ,CAAC;CACjE,IAAI,WAAW,KAAK,OAAO,IAAIC,UAAiB,EAAE,QAAQ,CAAC;CAC3D,IAAI,WAAW,OAAO,SAAS,YAC7B,OAAO,IAAIC,iBAAwB;EACjC;EACA;EACA,MAAM,QAAQ,OAAO,MAAM;CAC7B,CAAC;CAEH,IAAI,WAAW,OAAO,UAAU,KAAK;EACnC,MAAM,eAAe,WAAW,QAAQ,IAAI,aAAa,CAAC;EAC1D,OAAO,IAAIH,oBAA2B;GACpC;GACA;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;CACH;CACA,OAAO,IAAIF,iBAAwB;EACjC;EACA;EACA,MAAM,QAAQ,OAAO,MAAM;CAC7B,CAAC;AACH;AAEA,MAAa,YAAY,UAAkB,SAAiB,SAC1D,IAAID,eAAsB,EACxB,QAAQ,IAAIC,iBAAwB;CAClC;CACA;CACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;AACvC,CAAC,EACH,CAAC;AAEH,SAAS,WAAW,OAA0C;CAC5D,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,UAAU,GAAK;CAChE,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,OAAO,OAAO,MAAM,IAAI,IAAI,KAAA,IAAY,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AACvE;AAEA,MAAa,UAAU,OAAe,UAAqC;CACzE,GAAG;CACH,SAAS;EACP,QAAQ;EACR,eAAe,UAAU;EACzB,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;EACzE,GAAG,MAAM;CACX;AACF"}
+{"version":3,"file":"http.mjs","names":["Errors.DomainKitError","Reason.ProviderRejected","Errors.isDomainKitError","Reason.ProviderUnavailable","Reason.Unauthenticated","Reason.Forbidden","Reason.ProviderConflict","Errors.fail"],"sources":["../../src/internal/http.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\nexport type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;\n\nexport interface Reply {\n  readonly status: number;\n  readonly ok: boolean;\n  readonly headers: Headers;\n  /** Parsed JSON, or `null` for an empty body. */\n  readonly body: unknown;\n}\n\n/** One provider HTTP round trip: transport failures and non-JSON replies are already classified. */\nexport const requestJson = (input: {\n  readonly fetch: Fetch;\n  readonly provider: string;\n  readonly url: URL | string;\n  readonly init?: RequestInit;\n}): Effect.Effect<Reply, Errors.DomainKitError> =>\n  Effect.tryPromise({\n    try: async (signal): Promise<Reply> => {\n      const { fetch: send } = input; // a free call keeps `this` undefined for a native fetch\n      const response = await send(input.url, { ...input.init, signal });\n      const text = await response.text();\n      let body: unknown = null;\n      if (text.length > 0) {\n        try {\n          body = JSON.parse(text);\n        } catch {\n          throw new Errors.DomainKitError({\n            reason: response.ok\n              ? new Reason.ProviderRejected({\n                  provider: input.provider,\n                  message: `${input.provider} returned a non-JSON response`,\n                })\n              : classify(\n                  input.provider,\n                  response.status,\n                  response.headers,\n                  `HTTP ${response.status}`,\n                ),\n          });\n        }\n      }\n      return { status: response.status, ok: response.ok, headers: response.headers, body };\n    },\n    catch: (cause) =>\n      Errors.isDomainKitError(cause)\n        ? cause\n        : new Errors.DomainKitError({\n            reason: new Reason.ProviderUnavailable({\n              provider: input.provider,\n              message: cause instanceof Error ? cause.message : `${input.provider} request failed`,\n            }),\n          }),\n  });\n\n/** Host-supplied request headers, given as a value or as a thunk that may await a fresh token. */\nexport const headersFrom = (\n  source: HeadersInit | (() => HeadersInit | Promise<HeadersInit>) | undefined,\n): Effect.Effect<Headers, Errors.DomainKitError> =>\n  source === undefined\n    ? Effect.sync(() => new Headers())\n    : typeof source !== \"function\"\n      ? Effect.sync(() => new Headers(source))\n      : Effect.tryPromise({\n          try: async () => new Headers(await source()),\n          catch: (cause) =>\n            Errors.isDomainKitError(cause)\n              ? cause\n              : new Errors.DomainKitError({\n                  reason: new Reason.Unauthenticated({\n                    message:\n                      cause instanceof Error ? cause.message : \"Request headers were unavailable\",\n                  }),\n                }),\n        });\n\n/**\n * Map an HTTP failure to a reason: 401 -> Unauthenticated, 403 -> Forbidden, 409 or a provider\n * conflict code -> ProviderConflict, 429/5xx -> ProviderUnavailable, else ProviderRejected.\n */\nexport const classify = (\n  provider: string,\n  status: number,\n  headers: Headers,\n  message: string,\n  code?: string,\n): Reason.Model => {\n  if (status === 401) return new Reason.Unauthenticated({ message });\n  if (status === 403) return new Reason.Forbidden({ message });\n  if (status === 409 || code === \"conflict\") {\n    return new Reason.ProviderConflict({\n      provider,\n      message,\n      code: code ?? String(status),\n    });\n  }\n  if (status === 429 || status >= 500) {\n    const retryAfterMs = retryAfter(headers.get(\"retry-after\"));\n    return new Reason.ProviderUnavailable({\n      provider,\n      message,\n      ...(retryAfterMs === undefined ? {} : { retryAfterMs }),\n    });\n  }\n  return new Reason.ProviderRejected({\n    provider,\n    message,\n    code: code ?? String(status),\n  });\n};\n\n/**\n * During token verification a `Forbidden` answer means the provider did not accept the token, so\n * it reads as `Unauthenticated` with the provider's own message.\n */\nexport const rejectedToken = <A, R>(\n  verification: Effect.Effect<A, Errors.DomainKitError, R>,\n): Effect.Effect<A, Errors.DomainKitError, R> =>\n  verification.pipe(\n    Effect.catchIf(\n      (error) => error.reason._tag === \"Forbidden\",\n      (error) => Errors.fail(new Reason.Unauthenticated({ message: error.reason.message })),\n    ),\n  );\n\nexport const rejected = (provider: string, message: string, code?: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.ProviderRejected({\n      provider,\n      message,\n      ...(code === undefined ? {} : { code }),\n    }),\n  });\n\nfunction retryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1_000);\n  const date = Date.parse(value);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\nexport const bearer = (token: string, init?: RequestInit): RequestInit => ({\n  ...init,\n  headers: {\n    Accept: \"application/json\",\n    Authorization: `Bearer ${token}`,\n    ...(init?.body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n    ...init?.headers,\n  },\n});\n"],"mappings":";;;;;AAgBA,MAAa,eAAe,UAM1B,OAAO,WAAW;CAChB,KAAK,OAAO,WAA2B;EACrC,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK;GAAE,GAAG,MAAM;GAAM;EAAO,CAAC;EAChE,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,OAAgB;EACpB,IAAI,KAAK,SAAS,GAChB,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,MAAM,IAAIA,eAAsB,EAC9B,QAAQ,SAAS,KACb,IAAIC,iBAAwB;IAC1B,UAAU,MAAM;IAChB,SAAS,GAAG,MAAM,SAAS;GAC7B,CAAC,IACD,SACE,MAAM,UACN,SAAS,QACT,SAAS,SACT,QAAQ,SAAS,QACnB,EACN,CAAC;EACH;EAEF,OAAO;GAAE,QAAQ,SAAS;GAAQ,IAAI,SAAS;GAAI,SAAS,SAAS;GAAS;EAAK;CACrF;CACA,QAAQ,UACNC,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EACxB,QAAQ,IAAIG,oBAA2B;EACrC,UAAU,MAAM;EAChB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,GAAG,MAAM,SAAS;CACtE,CAAC,EACH,CAAC;AACT,CAAC;;AAGH,MAAa,eACX,WAEA,WAAW,KAAA,IACP,OAAO,WAAW,IAAI,QAAQ,CAAC,IAC/B,OAAO,WAAW,aAChB,OAAO,WAAW,IAAI,QAAQ,MAAM,CAAC,IACrC,OAAO,WAAW;CAChB,KAAK,YAAY,IAAI,QAAQ,MAAM,OAAO,CAAC;CAC3C,QAAQ,UACND,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EACxB,QAAQ,IAAII,gBAAuB,EACjC,SACE,iBAAiB,QAAQ,MAAM,UAAU,mCAC7C,CAAC,EACH,CAAC;AACT,CAAC;;;;;AAMT,MAAa,YACX,UACA,QACA,SACA,SACA,SACiB;CACjB,IAAI,WAAW,KAAK,OAAO,IAAIA,gBAAuB,EAAE,QAAQ,CAAC;CACjE,IAAI,WAAW,KAAK,OAAO,IAAIC,UAAiB,EAAE,QAAQ,CAAC;CAC3D,IAAI,WAAW,OAAO,SAAS,YAC7B,OAAO,IAAIC,iBAAwB;EACjC;EACA;EACA,MAAM,QAAQ,OAAO,MAAM;CAC7B,CAAC;CAEH,IAAI,WAAW,OAAO,UAAU,KAAK;EACnC,MAAM,eAAe,WAAW,QAAQ,IAAI,aAAa,CAAC;EAC1D,OAAO,IAAIH,oBAA2B;GACpC;GACA;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;CACH;CACA,OAAO,IAAIF,iBAAwB;EACjC;EACA;EACA,MAAM,QAAQ,OAAO,MAAM;CAC7B,CAAC;AACH;;;;;AAMA,MAAa,iBACX,iBAEA,aAAa,KACX,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,cAChC,UAAUM,KAAY,IAAIH,gBAAuB,EAAE,SAAS,MAAM,OAAO,QAAQ,CAAC,CAAC,CACtF,CACF;AAEF,MAAa,YAAY,UAAkB,SAAiB,SAC1D,IAAIJ,eAAsB,EACxB,QAAQ,IAAIC,iBAAwB;CAClC;CACA;CACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;AACvC,CAAC,EACH,CAAC;AAEH,SAAS,WAAW,OAA0C;CAC5D,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,OAAO,SAAS,OAAO,GAAG,OAAO,KAAK,IAAI,GAAG,UAAU,GAAK;CAChE,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,OAAO,OAAO,MAAM,IAAI,IAAI,KAAA,IAAY,KAAK,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC;AACvE;AAEA,MAAa,UAAU,OAAe,UAAqC;CACzE,GAAG;CACH,SAAS;EACP,QAAQ;EACR,eAAe,UAAU;EACzB,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;EACzE,GAAG,MAAM;CACX;AACF"}

package/dist/package.mjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.9.1";
+var version = "0.10.0";
 //#endregion
 export { version };
 

package/dist/types/Connect.d.ts

@@ -283,14 +283,24 @@ export type Discovery = Data.TaggedEnum<{
             readonly target: Provider.Target;
         }>;
     };
+    /**
+     * No connection reaches the domain. `host` names the one registered provider whose declared
+     * nameserver suffixes cover every authoritative nameserver; `null` when none or several do.
+     */
     NotFound: {
         readonly nameservers: ReadonlyArray<string>;
+        readonly host: {
+            readonly provider: string;
+        } | null;
     };
 }>;
 export declare const Discovery: {
     readonly $is: <Tag extends "NotFound" | "Resolved" | "SelectionRequired">(tag: Tag) => (u: unknown) => u is Extract<{
         readonly _tag: "NotFound";
         readonly nameservers: ReadonlyArray<string>;
+        readonly host: {
+            readonly provider: string;
+        } | null;
     }, {
         readonly _tag: Tag;
     }> | Extract<{
@@ -312,6 +322,9 @@ export declare const Discovery: {
         <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
             readonly _tag: "NotFound";
             readonly nameservers: ReadonlyArray<string>;
+            readonly host: {
+                readonly provider: string;
+            } | null;
         } | {
             readonly _tag: "Resolved";
             readonly connectionId: string;
@@ -327,6 +340,9 @@ export declare const Discovery: {
         }>) => any; }>(cases: Cases): (value: {
             readonly _tag: "NotFound";
             readonly nameservers: ReadonlyArray<string>;
+            readonly host: {
+                readonly provider: string;
+            } | null;
         } | {
             readonly _tag: "Resolved";
             readonly connectionId: string;
@@ -341,6 +357,9 @@ export declare const Discovery: {
         <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
             readonly _tag: "NotFound";
             readonly nameservers: ReadonlyArray<string>;
+            readonly host: {
+                readonly provider: string;
+            } | null;
         } | {
             readonly _tag: "Resolved";
             readonly connectionId: string;
@@ -356,6 +375,9 @@ export declare const Discovery: {
         }>) => any; }>(value: {
             readonly _tag: "NotFound";
             readonly nameservers: ReadonlyArray<string>;
+            readonly host: {
+                readonly provider: string;
+            } | null;
         } | {
             readonly _tag: "Resolved";
             readonly connectionId: string;
@@ -371,6 +393,9 @@ export declare const Discovery: {
     readonly NotFound: Data.TaggedEnum.ConstructorFrom<{
         readonly _tag: "NotFound";
         readonly nameservers: ReadonlyArray<string>;
+        readonly host: {
+            readonly provider: string;
+        } | null;
     }, "_tag">;
     readonly Resolved: Data.TaggedEnum.ConstructorFrom<{
         readonly _tag: "Resolved";
@@ -446,6 +471,9 @@ export declare const inspect: (domain: string) => Effect.Effect<Snapshot, Errors
 export declare const discover: (domain: string) => Effect.Effect<{
     readonly _tag: "NotFound";
     readonly nameservers: ReadonlyArray<string>;
+    readonly host: {
+        readonly provider: string;
+    } | null;
 } | {
     readonly _tag: "Resolved";
     readonly connectionId: string;

package/dist/types/Provider.d.ts

@@ -210,6 +210,12 @@ export interface IntegrationAuth {
 export interface Definition<Context = unknown> {
     readonly id: string;
     readonly name: string;
+    /**
+     * Hostname suffixes of the nameservers this provider operates, e.g. `ns.cloudflare.com`.
+     * `Connect.discover` names the provider as a domain's host when every authoritative nameserver
+     * ends in one of them.
+     */
+    readonly nameservers?: ReadonlyArray<string>;
     readonly auth: {
         readonly token?: TokenAuth;
         readonly oauth?: OAuthAuth;

package/dist/types/Server.d.ts

@@ -198,7 +198,11 @@ export declare class DiscoverySelectionRequired extends DiscoverySelectionRequir
 }
 declare const DiscoveryNotFound_base: Schema.Class<DiscoveryNotFound, Schema.TaggedStruct<"NotFound", {
     readonly nameservers: Schema.$Array<Schema.String>;
+    readonly host: Schema.NullOr<Schema.Struct<{
+        readonly provider: Schema.String;
+    }>>;
 }>, {}>;
+/** `host` names the registered provider whose nameservers serve the domain, by definition id. */
 export declare class DiscoveryNotFound extends DiscoveryNotFound_base {
 }
 export declare const Discovery: Schema.Union<readonly [typeof DiscoveryResolved, typeof DiscoverySelectionRequired, typeof DiscoveryNotFound]>;

package/dist/types/Testing.d.ts

@@ -29,6 +29,8 @@ export interface FakeProviderOptions {
     readonly failWrite?: (index: number) => boolean;
     /** Nameservers per zone; default `ns1.<zone>`, `ns2.<zone>`. `resolver()` answers NS queries from them. */
     readonly nameservers?: Readonly<Record<string, ReadonlyArray<string>>>;
+    /** Suffixes the fake declares as `Definition.nameservers`, so `Connect.discover` can name it as a host. */
+    readonly nameserverSuffixes?: ReadonlyArray<string>;
 }
 export interface FakeProvider extends Provider.Definition<FakeContext> {
     readonly records: (zone: string) => ReadonlyArray<DnsRecord.Observed>;
@@ -79,6 +81,6 @@ export type { Case as StorageCase } from "./internal/conformance/storage.ts";
 export declare const conformance: {
     /** Runs every Storage invariant (tenant isolation, leases, exactly-once continuations, revocation recovery). */
     storage: typeof storageCases;
-    /** Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply against a real provider definition. */
+    /** Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and rejected-token against a real provider definition. */
     provider: typeof providerCases;
 };

package/dist/types/Vercel.d.ts

@@ -1,6 +1,6 @@
 /** Vercel: personal tokens and marketplace integrations. */
 import { type Config, Redacted, Schema } from "effect";
-import type { Fetch } from "./internal/http.ts";
+import { type Fetch } from "./internal/http.ts";
 import * as Provider from "./Provider.ts";
 /** `teamId` is `null` for a personal account; targets carry the team that owns the zone. */
 export declare const TeamContext: Schema.Struct<{

package/dist/types/internal/cloudflare/client.d.ts

@@ -12,8 +12,10 @@ export interface Options {
 type Fx<A> = Effect.Effect<A, Errors.DomainKitError>;
 /** Every zone the credential can see, across accounts; internal zones cannot host records. */
 export declare const listZones: (options: Options, accountId?: string) => Fx<ReadonlyArray<Protocol.Zone>>;
-/** Token expiry from the verify endpoint; `null` when the token never expires or verification is unavailable. */
-/** Token status and expiry from a verify endpoint; an inactive token is `Unauthenticated`. */
+/**
+ * Token status and expiry from a verify endpoint; `null` expiry means the token never expires. An
+ * inactive token, or a 403 from the verify endpoint, is `Unauthenticated`.
+ */
 export declare const verifyToken: (options: Options, path: string) => Fx<DateTime.Utc | null>;
 export declare const tokenExpiry: (options: Options, accountId: string | null) => Fx<{
     readonly expiresAt: DateTime.Utc | null;

package/dist/types/internal/conformance/provider.d.ts

@@ -1,12 +1,19 @@
 import { Effect } from "effect";
 import * as Errors from "../error.ts";
 import * as Provider from "../../Provider.ts";
-export declare const cases: readonly ["create-readback-cleanup", "exact-noop", "conflict", "stale-plan", "partial-apply-cleanup"];
+export declare const cases: readonly ["create-readback-cleanup", "exact-noop", "conflict", "stale-plan", "partial-apply-cleanup", "rejected-token"];
 export type Case = (typeof cases)[number];
 /**
- * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, and partial-apply against a
- * real provider definition, through the same Provision and Cleanup services hosts use.
+ * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and
+ * rejected-token against a real provider definition, through the same Provision and Cleanup
+ * services hosts use.
  */
 export declare const provider: (definition: Provider.Definition, credential: Provider.Credential, zone: string, options?: {
     readonly prefix?: string;
+    /**
+     * Token values the provider rejects, for the `rejected-token` case. Default: every required
+     * field set to an empty secret, which needs a token method whose required fields are all
+     * secrets.
+     */
+    readonly rejectedToken?: Provider.TokenValues;
 }) => Effect.Effect<void, Errors.DomainKitError>;

package/dist/types/internal/http.d.ts

@@ -23,5 +23,10 @@ export declare const headersFrom: (source: HeadersInit | (() => HeadersInit | Pr
  * conflict code -> ProviderConflict, 429/5xx -> ProviderUnavailable, else ProviderRejected.
  */
 export declare const classify: (provider: string, status: number, headers: Headers, message: string, code?: string) => Reason.Model;
+/**
+ * During token verification a `Forbidden` answer means the provider did not accept the token, so
+ * it reads as `Unauthenticated` with the provider's own message.
+ */
+export declare const rejectedToken: <A, R>(verification: Effect.Effect<A, Errors.DomainKitError, R>) => Effect.Effect<A, Errors.DomainKitError, R>;
 export declare const rejected: (provider: string, message: string, code?: string) => Errors.DomainKitError;
 export declare const bearer: (token: string, init?: RequestInit) => RequestInit;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domainkit",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Build reviewable DNS plans for custom domains in TypeScript",
   "keywords": [
     "custom-domains",