@domainkit/react 0.8.0 → 0.9.1

package/dist/index.mjs

@@ -1,37 +1,18 @@
+"use client";
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { AlertDialog } from "@base-ui/react/alert-dialog";
-import { RegistryProvider, useAtomSet, useAtomValue } from "@effect/atom-react";
-import { DomainName, Transport } from "domainkit";
-import * as Data from "effect/Data";
+import { DnsRecord, DomainKit, Reason, Receipt } from "domainkit";
 import * as Effect from "effect/Effect";
-import * as Atom from "effect/unstable/reactivity/Atom";
 import { createContext, useCallback, useContext, useEffect, useLayoutEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+import * as Data from "effect/Data";
+import { Transport } from "domainkit/client";
 import { useRender } from "@base-ui/react/use-render";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import * as Exit from "effect/Exit";
+import * as Option from "effect/Option";
 import { Dialog } from "@base-ui/react/dialog";
-import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
-import { Menu } from "@base-ui/react/menu";
 import { Popover } from "@base-ui/react/popover";
-//#region src/atom.ts
-const Failure = Data.taggedEnum();
-const failureFromError = (error) => Failure.Failure({
-	message: error.message,
-	operation: error.operation,
-	retry: error.retry
-});
-const failureFromDefect = (operation, message) => Failure.Failure({
-	message,
-	operation,
-	retry: "safe"
-});
-const recordsIdentity = (records) => JSON.stringify(records.map(({ id, name, priority, type, value }) => ({
-	id,
-	name,
-	priority,
-	type,
-	value
-})));
-//#endregion
+import * as DateTime from "effect/DateTime";
+import { Testing } from "domainkit/testing";
 //#region src/composition.tsx
 function usePart(defaultTagName, componentProps, state, internalProps) {
 	const { className, render, style, ...externalProps } = componentProps;
@@ -45,6 +26,12 @@ function usePart(defaultTagName, componentProps, state, internalProps) {
 	};
 	return useRender(parameters);
 }
+/** A part with no state of its own: one tag, one `data-domainkit-part`, host props on top. */
+function leafPart(defaultTagName, part) {
+	return function Leaf(props) {
+		return usePart(defaultTagName, props, {}, { "data-domainkit-part": part });
+	};
+}
 //#endregion
 //#region src/icons.tsx
 function Glyph({ children }) {
@@ -60,6 +47,7 @@ function Glyph({ children }) {
 	});
 }
 const defaultIcons = {
+	close: /* @__PURE__ */ jsxs(Glyph, { children: [/* @__PURE__ */ jsx("path", { d: "M18 6 6 18" }), /* @__PURE__ */ jsx("path", { d: "m6 6 12 12" })] }),
 	copied: /* @__PURE__ */ jsx(Glyph, { children: /* @__PURE__ */ jsx("path", { d: "M20 6 9 17l-5-5" }) }),
 	copy: /* @__PURE__ */ jsxs(Glyph, { children: [/* @__PURE__ */ jsx("rect", {
 		height: "14",
@@ -72,14 +60,37 @@ const defaultIcons = {
 		/* @__PURE__ */ jsx("path", { d: "M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" }),
 		/* @__PURE__ */ jsx("path", { d: "m7 10 5 5 5-5" }),
 		/* @__PURE__ */ jsx("path", { d: "M12 15V3" })
-	] })
+	] }),
+	external: /* @__PURE__ */ jsxs(Glyph, { children: [
+		/* @__PURE__ */ jsx("path", { d: "M15 3h6v6" }),
+		/* @__PURE__ */ jsx("path", { d: "M10 14 21 3" }),
+		/* @__PURE__ */ jsx("path", { d: "M21 14v5a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5" })
+	] }),
+	failure: /* @__PURE__ */ jsxs(Glyph, { children: [
+		/* @__PURE__ */ jsx("circle", {
+			cx: "12",
+			cy: "12",
+			r: "9"
+		}),
+		/* @__PURE__ */ jsx("path", { d: "M15 9 9 15" }),
+		/* @__PURE__ */ jsx("path", { d: "m9 9 6 6" })
+	] }),
+	pending: /* @__PURE__ */ jsxs(Glyph, { children: [/* @__PURE__ */ jsx("circle", {
+		cx: "12",
+		cy: "12",
+		r: "9"
+	}), /* @__PURE__ */ jsx("path", { d: "M12 7v5l3 2" })] }),
+	success: /* @__PURE__ */ jsxs(Glyph, { children: [/* @__PURE__ */ jsx("circle", {
+		cx: "12",
+		cy: "12",
+		r: "9"
+	}), /* @__PURE__ */ jsx("path", { d: "m8.5 12.5 2.5 2.5 4.5-5" })] })
 };
 const IconsContext = createContext(defaultIcons);
 function IconsProvider({ children, icons }) {
 	const value = useMemo(() => ({
-		copied: icons?.copied ?? defaultIcons.copied,
-		copy: icons?.copy ?? defaultIcons.copy,
-		download: icons?.download ?? defaultIcons.download
+		...defaultIcons,
+		...icons
 	}), [icons]);
 	return /* @__PURE__ */ jsx(IconsContext.Provider, {
 		value,
@@ -93,54 +104,237 @@ function useIcons() {
 //#region src/messages.ts
 var messages_exports = /* @__PURE__ */ __exportAll({
 	english: () => english,
+	failure: () => failure,
 	merge: () => merge
 });
+const entity = {
+	approval: "approval",
+	attachment: "domain attachment",
+	authorization: "provider authorization",
+	connection: "provider connection",
+	continuation: "sign-in attempt",
+	plan: "plan",
+	provider: "provider",
+	receipt: "receipt",
+	record: "DNS record",
+	zone: "DNS zone"
+};
+const expiredEntity = {
+	approval: "approval",
+	continuation: "sign-in attempt",
+	credential: "provider credential",
+	plan: "plan"
+};
+const recordTypes = {
+	A: "A",
+	AAAA: "AAAA",
+	CAA: "CAA",
+	CNAME: "CNAME",
+	MX: "MX",
+	NS: "NS",
+	SRV: "SRV",
+	TXT: "TXT"
+};
+/** `accountId` reads as "Account id" until a host names the field itself. */
+const humanize = (name) => {
+	const spaced = name.replaceAll(/([a-z0-9])([A-Z])/g, "$1 $2").replaceAll(/[_-]+/g, " ").trim();
+	return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
+};
 const english = {
-	applyCleanup: "Remove records",
-	applyDns: "Add records",
-	applyingDns: "Adding records…",
-	authenticationAlternative: "or",
-	automaticUnavailable: "Automatic connection is not available for this domain",
+	connect: "Connect",
+	connectWith: (method) => method,
+	disconnect: "Disconnect",
+	detach: "Detach domain",
 	cancel: "Cancel",
-	checkAgain: "Check again",
-	checkingDns: "Checking DNS…",
+	close: "Close",
+	retry: "Try again",
+	approve: "Approve",
+	decline: "Decline",
+	reviewChanges: "Review changes",
+	cleanUp: "Remove records",
 	checkDns: "Check DNS",
-	cleanupConsent: "Only records proven by the apply receipt will be deleted.",
-	cleanupPartial: "Some DNS records could not be deleted. Review and retry safely.",
-	cleaningDns: "Removing records…",
-	connectProvider: () => "Connect",
-	connected: (provider) => `${provider} connected`,
-	providerAvailable: (provider) => `${provider} manages DNS for this domain`,
+	checkAgain: "Check again",
+	moreActions: "More actions",
+	copy: "Copy",
+	copied: "Copied",
+	copyZone: "Copy zone file",
+	download: "Download",
+	useConnection: (label) => `Use ${label}`,
+	chooseZone: "Choose the zone that serves this domain",
+	getToken: "Where do I find this?",
+	loading: "Loading…",
 	connecting: "Connecting…",
-	close: "Close",
-	detectingProvider: "Detecting DNS provider…",
-	disconnectDomain: "Disconnect",
-	disconnectConsent: "This domain will be detached from the provider. Existing DNS records will be preserved.",
+	redirecting: "Opening the provider…",
+	detaching: "Detaching…",
 	disconnecting: "Disconnecting…",
-	detaching: "Detaching domain…",
-	disconnectTitle: (provider) => `Detach ${provider}?`,
-	domainDisconnected: "Domain detached. DNS records were preserved.",
-	dialogDescription: (domain) => `Authorize DNS changes for ${domain}.`,
-	dialogTitle: (provider) => `Connect ${provider}`,
-	openingAuthorization: "Opening provider authorization…",
-	moreActions: "More connection actions",
-	noChanges: "No changes needed",
-	planConsent: "Review the exact DNS operations before approving this plan.",
+	planning: "Preparing DNS changes…",
+	approving: "Approving…",
+	applying: "Adding records…",
+	rejecting: "Declining…",
 	planningCleanup: "Preparing cleanup…",
-	planningDns: "Preparing DNS changes…",
-	recordsPartiallyApplied: "Some DNS changes failed. Review and retry safely.",
-	reviewCleanup: "Remove records",
-	reviewDns: "Review changes",
-	retry: "Try again",
-	existingConnection: "Existing provider connection",
-	targetUnavailable: "No provider targets are available for this connection.",
-	attachTarget: (target) => `Use ${target}`,
-	tokenLabel: "API token"
+	cleaning: "Removing records…",
+	observing: "Checking DNS…",
+	connectTitle: (provider) => `Connect ${provider}`,
+	connectAnyTitle: "Connect your DNS provider",
+	connectDescription: (domain) => `Authorize DNS changes for ${domain}.`,
+	connectedTo: (provider) => `${provider} connected`,
+	notConnected: "No DNS provider is connected.",
+	reconnectRequired: (provider) => `${provider} needs to be reconnected`,
+	disconnectTitle: (provider) => `Disconnect ${provider}?`,
+	disconnectConsent: "The provider connection is removed. Existing DNS records are preserved.",
+	detachConsent: "This domain is detached from the provider. Existing DNS records are preserved.",
+	detached: "Domain detached. DNS records were preserved.",
+	reusableConnections: "Connections you already have",
+	authenticationAlternative: "or",
+	discoveredConnection: (label) => `${label} already serves this domain`,
+	discoveryAmbiguous: "More than one connection can serve this domain. Pick one.",
+	discoveryNotFound: (nameservers) => nameservers.length === 0 ? "No connected provider serves this domain yet." : `No connected provider serves this domain. Its nameservers are ${nameservers.join(", ")}.`,
+	noProviders: "No DNS providers are available.",
+	fieldLabel: humanize,
+	optionalField: "optional",
+	planTitle: "Review DNS changes",
+	planConsent: "Review the exact DNS operations before approving this plan.",
+	cleanupTitle: "Review the records to remove",
+	cleanupConsent: "Only records the apply receipt proves DomainKit created will be deleted.",
+	noChanges: "No changes needed",
+	planExpires: (at) => `This plan expires at ${at}.`,
+	declinedBy: (actor) => `Declined by ${actor}. Build a new plan to continue.`,
+	declineReason: (reason) => `Reason: ${reason}`,
+	operation: (operation) => {
+		switch (operation._tag) {
+			case "Create": return "Add";
+			case "Noop": return "Already in place";
+			case "Delete": return "Remove";
+			case "Conflict": return "Blocked";
+		}
+	},
+	conflictReason: (reason) => {
+		switch (reason) {
+			case "exclusive-name": return "Another record already owns this name.";
+			case "cname-collision": return "A CNAME cannot share a name with other records.";
+			case "value-mismatch": return "A record with this name holds a different value.";
+			case "opaque": return "A record here uses a form DomainKit will not overwrite.";
+			case "missing": return "The record this plan expected is gone.";
+		}
+	},
+	attemptStatus: (status) => {
+		switch (status) {
+			case "planned": return "Awaiting review";
+			case "approved": return "Approved";
+			case "applying": return "Applying";
+			case "complete": return "Applied";
+			case "partial": return "Partly applied";
+			case "failed": return "Failed";
+			case "expired": return "Expired";
+			case "rejected": return "Declined";
+		}
+	},
+	recordsCaption: (domain) => `DNS records for ${domain}`,
+	headingType: "Type",
+	headingName: "Name",
+	headingValue: "Value",
+	headingStatus: "Status",
+	headingPurpose: "Purpose",
+	priority: (priority) => `Priority ${priority}`,
+	ttl: (seconds) => `TTL ${seconds}s`,
+	recordType: (record) => record._tag === "Opaque" ? record.type : recordTypes[record._tag],
+	applied: (receipt) => receipt.status === "complete" ? "DNS records added." : "Some DNS records were not added.",
+	cleaned: (receipt) => receipt.status === "complete" ? "DNS records removed." : "Some DNS records were not removed.",
+	partiallyApplied: "Some DNS changes failed. Review and retry safely.",
+	partiallyCleaned: "Some DNS records could not be deleted. Review and retry safely.",
+	outcome: (outcome) => {
+		switch (outcome._tag) {
+			case "Applied": return "Done";
+			case "Skipped": return "Skipped";
+			case "Failed": return outcome.message;
+		}
+	},
+	skippedReason: (reason) => {
+		switch (reason) {
+			case "noop": return "The record was already in place.";
+			case "not-approved": return "The approval left this operation out.";
+			case "not-attempted": return "An earlier operation failed before this one ran.";
+		}
+	},
+	requirementStatus: (status) => {
+		switch (status) {
+			case "satisfied": return "Found";
+			case "missing": return "Missing";
+			case "mismatch": return "Different value";
+			case "unknown": return "Not checked";
+		}
+	},
+	overall: (overall) => {
+		switch (overall) {
+			case "ready": return "Ready";
+			case "pending": return "Pending";
+			case "failed": return "Failed";
+		}
+	},
+	evidenceSource: (evidence) => {
+		switch (evidence._tag) {
+			case "Host": return evidence.label;
+			case "Provider": return `${evidence.provider} records`;
+			case "PublicDns": return `Public DNS via ${evidence.resolver}`;
+		}
+	},
+	hostEvidenceStatus: (status) => {
+		switch (status) {
+			case "ok": return "Ready";
+			case "pending": return "Pending";
+			case "failed": return "Failed";
+		}
+	},
+	expectedValue: (value) => `Expected ${value}`,
+	observedValues: (values) => `Found ${values.join(", ")}`,
+	observedNothing: "Found nothing",
+	checkedAt: (at) => `Checked ${at}`,
+	nextCheckAt: (at) => `Next check ${at}`,
+	hostEvidence: "Other checks",
+	noEvidence: "Nothing has been checked yet.",
+	invalidInput: (reason) => reason.field === void 0 ? reason.message : `${humanize(reason.field)}: ${reason.message}`,
+	unauthenticated: () => "The provider rejected these credentials.",
+	forbidden: () => "You do not have access to this domain.",
+	notFound: (reason) => `That ${entity[reason.entity]} no longer exists.`,
+	conflict: (reason) => reason.operations.length === 1 ? "One DNS record conflicts with what is already in the zone." : `${reason.operations.length} DNS records conflict with what is already in the zone.`,
+	stale: () => "The zone changed while you were reviewing. Build a new plan.",
+	expired: (reason) => `That ${expiredEntity[reason.entity]} expired. Start again.`,
+	busy: () => "Another change is running. Try again in a moment.",
+	providerRejected: (reason) => `${reason.provider} refused the change: ${reason.message}`,
+	providerUnavailable: (reason) => `${reason.provider} is unreachable right now.`,
+	providerConflict: (reason) => `${reason.provider} already holds a conflicting record.`,
+	unsupported: (reason) => `${reason.provider} cannot ${reason.operation}.`,
+	reconnect: (reason) => `Reconnect ${reason.provider} to continue.`,
+	storageFailed: () => "The change could not be saved. Try again.",
+	cryptoFailed: () => "A stored credential could not be read.",
+	resolverFailed: (reason) => `DNS lookups through ${reason.resolver} failed.`
 };
 const merge = (overrides = {}) => ({
 	...english,
 	...overrides
 });
+/** The user-facing sentence for a failure, chosen by the error's reason. */
+const failure = (error, catalog) => {
+	const reason = error.reason;
+	switch (reason._tag) {
+		case "InvalidInput": return catalog.invalidInput(reason);
+		case "Unauthenticated": return catalog.unauthenticated(reason);
+		case "Forbidden": return catalog.forbidden(reason);
+		case "NotFound": return catalog.notFound(reason);
+		case "Conflict": return catalog.conflict(reason);
+		case "Stale": return catalog.stale(reason);
+		case "Expired": return catalog.expired(reason);
+		case "Busy": return catalog.busy(reason);
+		case "ProviderRejected": return catalog.providerRejected(reason);
+		case "ProviderUnavailable": return catalog.providerUnavailable(reason);
+		case "ProviderConflict": return catalog.providerConflict(reason);
+		case "Unsupported": return catalog.unsupported(reason);
+		case "Reconnect": return catalog.reconnect(reason);
+		case "StorageFailed": return catalog.storageFailed(reason);
+		case "CryptoFailed": return catalog.cryptoFailed(reason);
+		case "ResolverFailed": return catalog.resolverFailed(reason);
+	}
+};
 //#endregion
 //#region src/theme.ts
 var theme_exports = /* @__PURE__ */ __exportAll({ toStyle: () => toStyle });
@@ -166,14 +360,45 @@ function toStyle(theme = {}) {
 //#endregion
 //#region src/domain-kit.tsx
 var domain_kit_exports = /* @__PURE__ */ __exportAll({
+	ReadOnly: () => ReadOnly,
 	Root: () => Root$6,
-	useDomainKit: () => useDomainKit
+	useCapabilities: () => useCapabilities,
+	useDomainKit: () => useDomainKit,
+	useReadOnly: () => useReadOnly,
+	useTransport: () => useTransport
 });
 const Context = createContext(null);
 const navigateInBrowser = (url) => {
-	if (typeof window === "undefined") throw new Error("DomainKit OAuth navigation requires a browser or a custom navigate function");
+	if (typeof window === "undefined") throw new Error("DomainKit provider authorization requires a browser or a `navigate` prop");
 	window.location.assign(url);
 };
+/**
+* A transport whose identity survives re-renders. Each method reads the newest transport when it
+* runs, so a host may write `<DomainKit.Root transport={Transport.fromFetch("/api/domainkit")}>`
+* inline and controllers still see one transport for the whole mount. Swapping in a transport
+* that declares different capability groups rebuilds it, and every controller re-runs.
+*/
+const useStableTransport = (transport) => {
+	const latest = useRef(transport);
+	useLayoutEffect(() => {
+		latest.current = transport;
+	});
+	const signature = Transport.capabilities(transport).join(",");
+	return useMemo(() => {
+		const capabilities = Transport.capabilities(latest.current);
+		return {
+			capabilities,
+			transport: Object.fromEntries(capabilities.map((capability) => {
+				const group = latest.current[capability];
+				return [capability, Object.fromEntries(Object.keys(group).map((name) => [name, (...args) => Effect.suspend(() => {
+					const method = latest.current[capability][name];
+					if (method === void 0) throw new Error(`The transport no longer declares ${capability}.${name}`);
+					return method(...args);
+				})]))];
+			}))
+		};
+	}, [signature]);
+};
 const resolvePortalContainer = (container, ownerDocument) => {
 	if (container === null || ownerDocument === null) return null;
 	return container.ownerDocument === ownerDocument && container.getRootNode() === ownerDocument ? container : null;
@@ -192,8 +417,8 @@ const usePortalContainer = (container) => {
 	const getSnapshot = useCallback(() => resolvePortalContainer(container, ownerDocument), [container, ownerDocument]);
 	return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
 };
-function Root$6({ children, colorScheme = "inherit", icons, marks = {}, messages, navigate = navigateInBrowser, onEvent, portalContainer = null, theme, transport, ...props }) {
-	const runtime = useMemo(() => Atom.runtime(transport), [transport]);
+function Root$6({ children, colorScheme = "inherit", icons, marks = {}, messages, navigate = navigateInBrowser, onEvent, portalContainer = null, readOnly = false, revision = 0, theme, transport, ...props }) {
+	const { capabilities, transport: stable } = useStableTransport(transport);
 	const onEventRef = useRef(onEvent);
 	useLayoutEffect(() => {
 		onEventRef.current = onEvent;
@@ -206,844 +431,340 @@ function Root$6({ children, colorScheme = "inherit", icons, marks = {}, messages
 	const themeStyle = toStyle(theme);
 	const resolvedPortalContainer = usePortalContainer(portalContainer);
 	const portalContainerRef = useMemo(() => ({ current: resolvedPortalContainer }), [resolvedPortalContainer]);
+	const value = {
+		capabilities,
+		colorScheme,
+		emit,
+		marks,
+		messages: merge(messages),
+		navigate,
+		portalContainer: portalContainerRef,
+		readOnly,
+		revision,
+		themeStyle,
+		transport: stable
+	};
 	const content = usePart("div", props, { colorScheme }, {
 		children,
 		"data-color-scheme": colorScheme,
 		"data-domainkit-root": "",
 		style: themeStyle
 	});
-	return /* @__PURE__ */ jsx(RegistryProvider, { children: /* @__PURE__ */ jsx(Context.Provider, {
-		value: {
-			colorScheme,
-			emit,
-			marks,
-			messages: merge(messages),
-			navigate,
-			portalContainer: portalContainerRef,
-			runtime,
-			themeStyle
-		},
+	return /* @__PURE__ */ jsx(Context.Provider, {
+		value,
 		children: /* @__PURE__ */ jsx(IconsProvider, {
 			...icons === void 0 ? {} : { icons },
 			children: content
 		})
-	}) });
+	});
 }
 function useDomainKit() {
 	const value = useContext(Context);
 	if (value === null) throw new Error("DomainKit components must be rendered inside DomainKit.Root");
 	return value;
 }
-//#endregion
-//#region src/lifecycle.ts
-var lifecycle_exports = /* @__PURE__ */ __exportAll({ Event: () => Event });
-const Event = Data.taggedEnum();
-//#endregion
-//#region src/operations.tsx
-var operations_exports = /* @__PURE__ */ __exportAll({
-	Item: () => Item,
-	Kind: () => Kind,
-	List: () => List,
-	Name: () => Name,
-	Priority: () => Priority$1,
-	Reason: () => Reason,
-	Record: () => Record,
-	Root: () => Root$5,
-	Type: () => Type,
-	Value: () => Value$1
-});
-function leafPart$1(defaultTagName, part) {
-	return function Leaf(props) {
-		return usePart(defaultTagName, props, {}, { "data-domainkit-part": part });
-	};
+/** The transport `DomainKit.Root` holds, with the identity it keeps for the whole mount. */
+function useTransport() {
+	return useDomainKit().transport;
 }
-const Kind = leafPart$1("span", "operation-kind");
-const Type = leafPart$1("strong", "operation-type");
-const Record = leafPart$1("span", "operation-record");
-const Name = leafPart$1("span", "operation-name");
-const Value$1 = leafPart$1("code", "operation-value");
-const Priority$1 = leafPart$1("span", "operation-priority");
-const Reason = leafPart$1("span", "operation-reason");
-function Item({ operation, ...props }) {
-	return usePart("li", props, { operation: operation._tag }, {
-		children: /* @__PURE__ */ jsxs(Fragment, { children: [
-			/* @__PURE__ */ jsx(Kind, { children: operation._tag }),
-			" ",
-			/* @__PURE__ */ jsx(Type, { children: operation.record.type }),
-			" ",
-			/* @__PURE__ */ jsxs(Record, { children: [
-				/* @__PURE__ */ jsx(Name, { children: operation.record.name }),
-				/* @__PURE__ */ jsx(Value$1, { children: operation.record.value }),
-				operation.record.priority === void 0 ? null : /* @__PURE__ */ jsxs(Priority$1, { children: ["Priority ", operation.record.priority] }),
-				"reason" in operation ? /* @__PURE__ */ jsx(Reason, { children: operation.reason }) : null
-			] })
-		] }),
-		"data-domainkit-part": "operation-item",
-		"data-operation": operation._tag
+const ReadOnlyContext = createContext(null);
+/** Narrow one subtree to read-only without touching the rest of the page. */
+function ReadOnly({ children, value }) {
+	return /* @__PURE__ */ jsx(ReadOnlyContext.Provider, {
+		value,
+		children
 	});
 }
-function Root$5({ count = 0, lifecycle, ...props }) {
-	return usePart("ul", props, {
-		count,
-		lifecycle
-	}, {
-		"data-domainkit-part": lifecycle === "provisioning" ? "plan-operations" : "cleanup-operations",
-		"data-lifecycle": lifecycle
-	});
+/** Whether this part may offer controls that change the domain. */
+function useReadOnly() {
+	const scoped = useContext(ReadOnlyContext);
+	const root = useDomainKit().readOnly;
+	return scoped ?? root;
 }
-function List({ lifecycle, operations, ...props }) {
-	return /* @__PURE__ */ jsx(Root$5, {
-		count: operations.length,
-		lifecycle,
-		...props,
-		children: operations.map((operation) => /* @__PURE__ */ jsx(Item, { operation }, operation.id))
-	});
+/** Which capability groups the host's transport declares, for gating a custom part. */
+function useCapabilities() {
+	return useDomainKit().capabilities;
 }
 //#endregion
-//#region src/cleanup.tsx
-var cleanup_exports = /* @__PURE__ */ __exportAll({
-	Command: () => Command$3,
-	Dialog: () => Dialog$3,
-	Flow: () => Flow$3,
-	Outcome: () => Outcome$2,
-	Root: () => Root$4,
-	State: () => State$3,
-	useController: () => useController$3,
-	useModel: () => useModel$3
-});
-const State$3 = Data.taggedEnum();
-const Command$3 = Data.taggedEnum();
-function useModel$3(connection, receiptId, onCleaned) {
-	const { emit, runtime } = useDomainKit();
-	const onCleanedRef = useRef(onCleaned);
-	onCleanedRef.current = onCleaned;
+//#region src/events.ts
+const Event = Data.taggedEnum();
+//#endregion
+//#region src/task.ts
+/**
+* The one place the package leaves Effect. Every controller runs its transport calls through
+* `useRunner`, which interrupts the call in flight when a newer one starts or the component
+* unmounts, and drops results that arrive after either.
+*/
+/** A defect is not a lifecycle failure; report it in the shape the UI already renders. */
+const defect = (cause) => new DomainKit.Error({ reason: new Reason.ProviderUnavailable({
+	provider: "domainkit",
+	message: `The transport failed: ${String(cause)}`
+}) });
+function useRunner() {
+	const state = useRef({
+		live: null,
+		mounted: true,
+		next: 0
+	});
+	useEffect(() => {
+		const current = state.current;
+		current.mounted = true;
+		return () => {
+			current.mounted = false;
+			current.live?.interrupt?.();
+			current.live = null;
+		};
+	}, []);
 	return useMemo(() => {
-		const state = Atom.make(State$3.Idle());
-		return {
-			command: runtime.fn()((command, get) => {
-				const current = get(state);
-				if (command._tag === "Dismiss") {
-					if (current._tag === "Planning" || current._tag === "Cleaning") return Effect.void;
-					get.set(state, State$3.Idle());
-					return Effect.void;
-				}
-				if (command._tag === "Plan") {
-					if (current._tag === "Planning" || current._tag === "Cleaning") return Effect.void;
-					get.set(state, State$3.Planning());
-					return Effect.flatMap(Transport.Service, (transport) => transport.cleanup.plan({
-						attachmentId: connection.attachment.id,
-						domain: connection.attachment.domain,
-						receiptId
-					})).pipe(Effect.tap((plan) => Effect.sync(() => get.set(state, State$3.Review({ plan })))), Effect.catch((error) => Effect.sync(() => get.set(state, failureFromError(error)))), Effect.asVoid);
-				}
-				if (current._tag !== "Review" || current.plan.operations.some((operation) => operation._tag === "Blocked")) return Effect.void;
-				const plan = current.plan;
-				get.set(state, State$3.Cleaning({ plan }));
-				return Effect.flatMap(Transport.Service, (transport) => transport.cleanup.apply({
-					attachmentId: connection.attachment.id,
-					domain: connection.attachment.domain,
-					planDigest: plan.digest,
-					receiptId
-				})).pipe(Effect.tap((result) => Effect.sync(() => {
-					if (result._tag === "Cleaned") {
-						get.set(state, State$3.Cleaned({ result }));
-						onCleanedRef.current?.(result);
-						emit(Event.RecordsCleaned({
-							connection,
-							result
-						}));
-					} else if (result._tag === "Partial") {
-						get.set(state, State$3.Partial({ result }));
-						onCleanedRef.current?.(result);
-						emit(Event.RecordsPartiallyCleaned({
-							connection,
-							result
-						}));
-					} else get.set(state, result);
-				})), Effect.catch((error) => Effect.sync(() => get.set(state, failureFromError(error)))), Effect.asVoid);
-			}),
-			state
+		const stop = () => {
+			state.current.live?.interrupt?.();
+			state.current.live = null;
 		};
-	}, [
-		connection.attachment.domain,
-		connection.attachment.id,
-		emit,
-		receiptId,
-		runtime
-	]);
-}
-function useController$3(connection, receiptId, onCleaned) {
-	const model = useModel$3(connection, receiptId, onCleaned);
-	const state = useAtomValue(model.state);
-	const execute = useAtomSet(model.command);
-	return {
-		apply: () => execute(Command$3.Apply()),
-		dismiss: () => execute(Command$3.Dismiss()),
-		plan: () => execute(Command$3.Plan()),
-		retry: () => execute(Command$3.Plan()),
-		state
-	};
-}
-function Root$4({ status, ...props }) {
-	return usePart("div", props, { status }, {
-		"data-domainkit-part": "cleanup-flow",
-		"data-state": status
-	});
-}
-function Outcome$2({ state }) {
-	const { messages } = useDomainKit();
-	if (state._tag === "Partial" || state._tag === "Failure" || state._tag === "Stale") return /* @__PURE__ */ jsx("p", {
-		"data-domainkit-part": "flow-outcome",
-		"data-tone": "danger",
-		role: "alert",
-		children: state._tag === "Partial" ? messages.cleanupPartial : state.message
-	});
-	return null;
-}
-function Dialog$3({ controller, onOpenChange, onOpenChangeComplete, trigger }) {
-	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
-	const state = controller.state;
-	const planRef = useRef(void 0);
-	if (state._tag === "Idle") planRef.current = void 0;
-	if (state._tag === "Review" || state._tag === "Cleaning") planRef.current = state.plan;
-	const plan = planRef.current;
-	const busy = state._tag === "Planning" || state._tag === "Cleaning";
-	const open = state._tag !== "Idle" && state._tag !== "Cleaned";
-	return /* @__PURE__ */ jsxs(AlertDialog.Root, {
-		onOpenChange: (nextOpen, eventDetails) => {
-			if (!nextOpen && busy) {
-				eventDetails.cancel();
-				return;
+		return {
+			cancel: stop,
+			run: (effect, handlers) => {
+				stop();
+				const live = {
+					id: state.current.next += 1,
+					interrupt: null
+				};
+				state.current.live = live;
+				const interrupt = Effect.runCallback(effect, { onExit: (exit) => {
+					if (state.current.live?.id !== live.id || !state.current.mounted) return;
+					state.current.live = null;
+					if (Exit.isSuccess(exit)) {
+						handlers.onSuccess(exit.value);
+						return;
+					}
+					const cause = exit.cause;
+					const error = Exit.findErrorOption(exit);
+					if (Exit.hasInterrupts(exit)) return;
+					handlers.onFailure(Option.isSome(error) ? error.value : defect(cause));
+				} });
+				if (state.current.live?.id === live.id) live.interrupt = () => interrupt();
 			}
-			if (!nextOpen) controller.dismiss();
-			onOpenChange?.(nextOpen);
-		},
-		onOpenChangeComplete,
-		open,
-		children: [trigger === null ? null : /* @__PURE__ */ jsx(AlertDialog.Trigger, {
-			"data-domainkit-part": "cleanup-trigger",
-			disabled: state._tag !== "Idle",
-			onClick: () => controller.plan(),
-			...trigger === void 0 ? {} : { render: trigger },
-			children: messages.reviewCleanup
-		}), /* @__PURE__ */ jsxs(AlertDialog.Portal, {
-			container: portalContainer,
-			children: [/* @__PURE__ */ jsx(AlertDialog.Backdrop, {
-				"data-color-scheme": colorScheme,
-				"data-domainkit-part": "dialog-backdrop",
-				"data-domainkit-root": "",
-				style: themeStyle
-			}), /* @__PURE__ */ jsxs(AlertDialog.Popup, {
-				"data-color-scheme": colorScheme,
-				"data-domainkit-part": "cleanup-dialog",
-				"data-domainkit-root": "",
-				style: themeStyle,
-				children: [
-					/* @__PURE__ */ jsxs("div", {
-						"data-domainkit-part": "dialog-header",
-						children: [/* @__PURE__ */ jsxs("div", {
-							"data-domainkit-part": "dialog-heading",
-							children: [/* @__PURE__ */ jsx(AlertDialog.Title, {
-								"data-domainkit-part": "dialog-title",
-								children: messages.reviewCleanup
-							}), /* @__PURE__ */ jsx(AlertDialog.Description, {
-								"data-domainkit-part": "dialog-description",
-								children: messages.cleanupConsent
-							})]
-						}), busy ? null : /* @__PURE__ */ jsx(AlertDialog.Close, {
-							"aria-label": messages.close,
-							"data-domainkit-part": "dialog-close",
-							children: "×"
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						"data-domainkit-part": "dialog-body",
-						children: [plan === void 0 ? /* @__PURE__ */ jsx("p", {
-							"data-domainkit-part": "dialog-progress",
-							role: "status",
-							children: messages.planningCleanup
-						}) : /* @__PURE__ */ jsx(List, {
-							lifecycle: "cleanup",
-							operations: plan.operations
-						}), /* @__PURE__ */ jsx(Outcome$2, { state })]
-					}),
-					/* @__PURE__ */ jsx("div", {
-						"data-domainkit-part": "dialog-footer",
-						children: busy ? /* @__PURE__ */ jsx("button", {
-							"data-domainkit-part": "cleanup-apply",
-							disabled: true,
-							type: "button",
-							children: state._tag === "Cleaning" ? messages.cleaningDns : messages.planningCleanup
-						}) : state._tag === "Review" && plan !== void 0 ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(AlertDialog.Close, {
-							"data-domainkit-part": "dialog-cancel",
-							children: messages.cancel
-						}), /* @__PURE__ */ jsx("button", {
-							"data-domainkit-part": "cleanup-apply",
-							disabled: plan.operations.some((operation) => operation._tag === "Blocked"),
-							onClick: () => controller.apply(),
-							type: "button",
-							children: messages.applyCleanup
-						})] }) : /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(AlertDialog.Close, {
-							"data-domainkit-part": "dialog-cancel",
-							children: messages.close
-						}), /* @__PURE__ */ jsx("button", {
-							"data-domainkit-part": "cleanup-retry",
-							onClick: () => controller.retry(),
-							type: "button",
-							children: messages.retry
-						})] })
-					})
-				]
-			})]
-		})]
-	});
-}
-function Flow$3({ connection, onCleaned, receiptId, trigger, ...props }) {
-	const controller = useController$3(connection, receiptId, onCleaned);
-	const state = controller.state;
-	return /* @__PURE__ */ jsx(Root$4, {
-		status: state._tag,
-		...props,
-		children: /* @__PURE__ */ jsx(Dialog$3, {
-			controller,
-			...trigger === void 0 ? {} : { trigger }
-		})
-	});
+		};
+	}, []);
 }
 //#endregion
-//#region src/provider.tsx
-var provider_exports = /* @__PURE__ */ __exportAll({ Mark: () => Mark });
-const logoHosts = {
-	amazonroute53: "route53.com",
-	aws: "amazonaws.com",
-	bluehost: "bluehost.com",
-	cloudflare: "cloudflare.com",
-	digitalocean: "digitalocean.com",
-	dnsimple: "dnsimple.com",
-	dreamhost: "dreamhost.com",
-	dynadot: "dynadot.com",
-	gandi: "gandi.net",
-	godaddy: "godaddy.com",
-	google: "cloud.google.com",
-	googlecloud: "cloud.google.com",
-	googleclouddns: "cloud.google.com",
-	hostgator: "hostgator.com",
-	hostinger: "hostinger.com",
-	hover: "hover.com",
-	ionos: "ionos.com",
-	namecheap: "namecheap.com",
-	namecom: "name.com",
-	netlify: "netlify.com",
-	ns1: "ns1.com",
-	ovh: "ovh.com",
-	porkbun: "porkbun.com",
-	route53: "route53.com",
-	spaceship: "spaceship.com",
-	squarespace: "squarespace.com",
-	vercel: "vercel.com"
-};
-const logoKey = (providerId) => providerId.trim().toLowerCase().replace(/[^a-z0-9]+/g, "");
-const logoHost = (providerId) => logoHosts[logoKey(providerId)];
-const letterMark = (provider) => provider.name.trim().charAt(0).toUpperCase() || "?";
-function DefaultMark({ provider }) {
-	const host = logoHost(provider.id);
-	const [failed, setFailed] = useState(false);
-	if (host === void 0 || failed) return letterMark(provider);
-	return /* @__PURE__ */ jsx("img", {
-		alt: "",
-		height: 32,
-		onError: () => setFailed(true),
-		referrerPolicy: "no-referrer",
-		src: `https://integrations.sh/logo/${host}?sz=64`,
-		width: 32
+//#region src/attempt.ts
+const State$2 = Data.taggedEnum();
+/** Reasons that mean the plan itself is gone: retrying the same step would fail the same way. */
+const needsNewPlan = (error) => error.reason._tag === "Stale" || error.reason._tag === "Expired" || error.reason._tag === "Conflict";
+function useAttempt(options) {
+	const { domain, done, group, key, onDone } = options;
+	const { emit } = useDomainKit();
+	const readOnly = useReadOnly();
+	const runner = useRunner();
+	const [state, setState] = useState(State$2.Idle());
+	const held = useRef({
+		approval: null,
+		key,
+		plan: null
 	});
-}
-function Mark({ provider, ...props }) {
-	const { marks } = useDomainKit();
-	const replacement = marks[provider.id];
-	const content = typeof replacement === "function" ? replacement(provider) : replacement ?? /* @__PURE__ */ jsx(DefaultMark, { provider }, provider.id);
-	return usePart("span", props, { providerId: provider.id }, {
-		"aria-label": provider.name,
-		children: content,
-		"data-domainkit-part": "provider-mark",
-		"data-domainkit-provider": logoKey(provider.id),
-		role: "img"
+	const lastCommand = useRef(null);
+	const build = useRef(options.plan);
+	useEffect(() => {
+		build.current = options.plan;
 	});
-}
-//#endregion
-//#region src/connection.tsx
-var connection_exports = /* @__PURE__ */ __exportAll({
-	AttachAction: () => AttachAction,
-	Card: () => Card$1,
-	CardActions: () => CardActions,
-	CardIdentity: () => CardIdentity,
-	Command: () => Command$2,
-	ConnectTrigger: () => ConnectTrigger,
-	Dialog: () => Dialog$2,
-	DisconnectDialog: () => DisconnectDialog,
-	Flow: () => Flow$2,
-	IntegrationAction: () => IntegrationAction,
-	OAuthAction: () => OAuthAction,
-	RetryAction: () => RetryAction$1,
-	Root: () => Root$3,
-	State: () => State$2,
-	Status: () => Status$2,
-	TokenAction: () => TokenAction,
-	Trigger: () => Trigger,
-	targetLabel: () => targetLabel,
-	useController: () => useController$2,
-	useModel: () => useModel$2
-});
-const State$2 = Data.taggedEnum();
-const sameTarget = (left, right) => left.accountId === right.accountId && left.accountKind === right.accountKind && left.zoneId === right.zoneId && left.zoneName === right.zoneName;
-const Command$2 = Data.taggedEnum();
-function useModel$2(domain) {
-	const { emit, navigate, runtime } = useDomainKit();
-	return useMemo(() => {
-		const actionState = Atom.make(void 0);
-		const inspect = runtime.atom(Effect.flatMap(Transport.Service, (transport) => transport.connection.inspect({ domain })));
-		const state = Atom.make((get) => {
-			const action = get(actionState);
-			if (action !== void 0) return action;
-			const inspection = get(inspect);
-			return AsyncResult.matchWithError(inspection, {
-				onDefect: () => failureFromDefect("connection.inspect", "Provider detection failed"),
-				onError: failureFromError,
-				onInitial: () => State$2.Loading(),
-				onSuccess: ({ value }) => value
+	const [current, setCurrent] = useState(key);
+	if (current !== key) {
+		setCurrent(key);
+		runner.cancel();
+		held.current = {
+			approval: null,
+			key,
+			plan: null
+		};
+		lastCommand.current = null;
+		setState(State$2.Idle());
+	}
+	const onFailure = useCallback((error) => {
+		setState(State$2.Failure({ error }));
+		emit(Event.Failed({
+			domain,
+			error
+		}));
+	}, [domain, emit]);
+	const applyWith = useCallback((plan, approval) => {
+		if (group === void 0 || held.current.key !== key) return;
+		const command = () => {
+			setState(State$2.Applying({
+				approval,
+				plan
+			}));
+			runner.run(group.apply(approval.id), {
+				onFailure,
+				onSuccess: (receipt) => {
+					setState(State$2.Applied({
+						plan,
+						receipt
+					}));
+					emit(done(receipt));
+					onDone?.(receipt);
+				}
 			});
-		});
-		return {
-			command: runtime.fn()((input, get) => {
-				if (input._tag === "Retry") {
-					get.set(actionState, void 0);
-					get.refresh(inspect);
-					return Effect.void;
+		};
+		lastCommand.current = {
+			key,
+			run: command
+		};
+		command();
+	}, [
+		done,
+		emit,
+		group,
+		key,
+		onDone,
+		onFailure,
+		runner
+	]);
+	const buildPlan = useCallback(() => {
+		const effect = build.current();
+		if (effect === null) return;
+		const command = () => {
+			setState(State$2.Planning());
+			runner.run(effect, {
+				onFailure,
+				onSuccess: (plan) => {
+					if (held.current.key !== key) return;
+					held.current = {
+						approval: null,
+						key,
+						plan
+					};
+					setState(State$2.Planned({ plan }));
 				}
-				const snapshot = get(state);
-				if (input._tag === "Detach") {
-					if (snapshot._tag !== "Connected") return Effect.void;
-					get.set(actionState, State$2.Detaching({ snapshot }));
-					return Effect.flatMap(Transport.Service, (transport) => Effect.flatMap(transport.connection.detach({
-						attachmentId: snapshot.attachment.id,
-						preserveDns: true
-					}), (result) => {
-						const detached = Transport.Disconnected({
-							domain: snapshot.attachment.domain,
-							provider: snapshot.provider,
-							reusableConnections: []
-						});
-						return Effect.flatMap(Effect.sync(() => {
-							get.set(actionState, detached);
-							emit(Event.DomainDetached({
-								connection: snapshot,
-								result
-							}));
-						}), () => transport.connection.inspect({ domain }).pipe(Effect.catch(() => Effect.succeed(detached)), Effect.tap((refreshed) => Effect.sync(() => get.set(actionState, refreshed)))));
-					})).pipe(Effect.catch((error) => Effect.sync(() => get.set(actionState, failureFromError(error)))), Effect.asVoid);
+			});
+		};
+		lastCommand.current = {
+			key,
+			run: command
+		};
+		command();
+	}, [
+		key,
+		onFailure,
+		runner
+	]);
+	const approve = useCallback((operationIds) => {
+		const plan = held.current.plan;
+		if (group === void 0 || plan === null || held.current.key !== key) return;
+		const command = () => {
+			setState(State$2.Approving({ plan }));
+			runner.run(group.approve({
+				planId: plan.id,
+				...operationIds === void 0 ? {} : { operationIds }
+			}), {
+				onFailure,
+				onSuccess: (approval) => {
+					if (held.current.key !== key) return;
+					held.current = {
+						approval,
+						key,
+						plan
+					};
+					applyWith(plan, approval);
 				}
-				if (snapshot._tag !== "Disconnected") return Effect.void;
-				const complete = (request, source) => request.pipe(Effect.tap((result) => Effect.sync(() => {
-					if (result._tag === "Redirect") {
-						get.set(actionState, State$2.Redirecting({ snapshot }));
-						navigate(result.authorizationUrl);
-					} else {
-						get.set(actionState, result);
-						emit(Event.ConnectionEstablished({
-							connection: result,
-							source
-						}));
-					}
-				})), Effect.catch((error) => Effect.sync(() => get.set(actionState, failureFromError(error)))), Effect.asVoid);
-				if (input._tag === "Attach") {
-					const reusableConnection = snapshot.reusableConnections.find(({ connection }) => connection.id === input.connectionId);
-					if (reusableConnection === void 0) return Effect.void;
-					const target = reusableConnection.targets.find((candidate) => sameTarget(candidate, input.target));
-					if (target === void 0) return Effect.void;
-					get.set(actionState, State$2.Submitting({ snapshot }));
-					return complete(Effect.flatMap(Transport.Service, (transport) => transport.connection.attach({
-						connectionId: input.connectionId,
-						domain,
-						target
-					})), "attach");
+			});
+		};
+		lastCommand.current = {
+			key,
+			run: command
+		};
+		command();
+	}, [
+		applyWith,
+		group,
+		key,
+		onFailure,
+		runner
+	]);
+	const reject = useCallback((reason) => {
+		const plan = held.current.plan;
+		if (group === void 0 || plan === null || held.current.key !== key) return;
+		const command = () => {
+			setState(State$2.Rejecting({ plan }));
+			runner.run(group.reject({
+				planId: plan.id,
+				...reason === void 0 ? {} : { reason }
+			}), {
+				onFailure,
+				onSuccess: (attempt) => {
+					setState(State$2.Rejected({
+						attempt,
+						plan
+					}));
+					emit(Event.Declined({
+						attempt,
+						domain
+					}));
 				}
-				get.set(actionState, State$2.Submitting({ snapshot }));
-				if (input._tag === "Connect") return complete(Effect.flatMap(Transport.Service, (transport) => transport.connection.connect({
-					domain,
-					method: input.method,
-					providerId: snapshot.provider.id
-				})), "connect");
-				return Effect.void;
-			}),
-			state
+			});
 		};
+		lastCommand.current = {
+			key,
+			run: command
+		};
+		command();
 	}, [
 		domain,
 		emit,
-		navigate,
-		runtime
+		group,
+		key,
+		onFailure,
+		runner
+	]);
+	const apply = useCallback(() => {
+		const { approval, plan } = held.current;
+		if (approval === null || plan === null) return;
+		applyWith(plan, approval);
+	}, [applyWith]);
+	const retry = useCallback(() => {
+		if (readOnly) return;
+		if (state._tag === "Failure" && needsNewPlan(state.error)) {
+			held.current = {
+				approval: null,
+				key,
+				plan: null
+			};
+			buildPlan();
+			return;
+		}
+		const command = lastCommand.current;
+		if (command === null || command.key !== key) buildPlan();
+		else command.run();
+	}, [
+		buildPlan,
+		key,
+		readOnly,
+		state
 	]);
-}
-function useController$2(domain) {
-	const model = useModel$2(domain);
-	const state = useAtomValue(model.state);
-	const execute = useAtomSet(model.command);
 	return {
-		attach: (connection, target) => execute(Command$2.Attach({
-			connectionId: connection.connection.id,
-			target
-		})),
-		connect: (method) => execute(Command$2.Connect({ method })),
-		detach: () => execute(Command$2.Detach()),
-		retry: () => execute(Command$2.Retry()),
+		apply,
+		approve,
+		plan: buildPlan,
+		reject,
+		reset: useCallback(() => {
+			runner.cancel();
+			held.current = {
+				approval: null,
+				key,
+				plan: null
+			};
+			lastCommand.current = null;
+			setState(State$2.Idle());
+		}, [key, runner]),
+		retry,
 		state
 	};
 }
-function Root$3({ children, status = "Loading", ...props }) {
-	return usePart("div", props, { status }, {
-		children,
-		"data-domainkit-part": "connection-root"
-	});
-}
-function Status$2({ children, state, ...props }) {
-	const { messages } = useDomainKit();
-	const text = state._tag === "Loading" ? messages.detectingProvider : state._tag === "Connected" ? messages.connected(state.provider.name) : state._tag === "Detaching" ? messages.detaching : state._tag === "Unsupported" ? messages.automaticUnavailable : state._tag === "Failure" ? state.message : state._tag === "Redirecting" ? messages.openingAuthorization : state._tag === "Submitting" ? messages.connecting : messages.providerAvailable(state.provider.name);
-	return usePart("div", props, { status: state._tag }, {
-		children: children ?? text,
-		"data-domainkit-part": "connection-status",
-		"data-state": state._tag
-	});
-}
-function Trigger({ children, ...props }) {
-	return /* @__PURE__ */ jsx(Dialog.Trigger, {
-		"data-domainkit-part": "connection-trigger",
-		...props,
-		children
-	});
-}
-function ConnectTrigger({ children, provider, ...props }) {
-	const { messages } = useDomainKit();
-	return /* @__PURE__ */ jsx(Trigger, {
-		...props,
-		"data-domainkit-recipe": "connect",
-		children: children ?? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Mark, {
-			"aria-hidden": "true",
-			provider
-		}), messages.connectProvider(provider.name)] })
-	});
-}
-function OAuthAction({ controller, label, ...props }) {
-	return usePart("button", props, { authentication: "oauth" }, {
-		children: label,
-		"data-domainkit-part": "oauth-connect",
-		disabled: controller.state._tag === "Submitting" || controller.state._tag === "Redirecting",
-		onClick: () => controller.connect(Transport.Method.OAuth()),
-		type: "button"
-	});
-}
-function IntegrationAction({ controller, label, ...props }) {
-	return usePart("button", props, { authentication: "integration" }, {
-		children: label,
-		"data-domainkit-part": "integration-connect",
-		disabled: controller.state._tag === "Submitting" || controller.state._tag === "Redirecting",
-		onClick: () => controller.connect(Transport.Method.Integration()),
-		type: "button"
-	});
-}
-function AttachAction({ connection, controller, label, target, ...props }) {
-	return usePart("button", props, { authentication: "attach" }, {
-		children: label,
-		"data-domainkit-part": "attach-target",
-		disabled: controller.state._tag === "Submitting" || controller.state._tag === "Redirecting",
-		onClick: () => controller.attach(connection, target),
-		type: "button"
-	});
-}
-function TokenAction({ controller, method, ...props }) {
-	const { messages } = useDomainKit();
-	const pending = controller.state._tag === "Submitting" || controller.state._tag === "Redirecting";
-	const [token, setToken] = useState("");
-	const [parameters, setParameters] = useState({});
-	const submit = (event) => {
-		event.preventDefault();
-		if (token.length > 0) {
-			const populated = Object.fromEntries(Object.entries(parameters).filter(([, value]) => value.length > 0));
-			controller.connect(Transport.Method.Token({
-				token,
-				...Object.keys(populated).length === 0 ? {} : { parameters: populated }
-			}));
-		}
-	};
-	const missingRequiredParameter = method.parameters?.some((parameter) => parameter.required === true && !parameters[parameter.key]);
-	return usePart("form", props, { authentication: "token" }, {
-		children: /* @__PURE__ */ jsxs(Fragment, { children: [
-			method.parameters?.map((parameter) => /* @__PURE__ */ jsxs("label", { children: [
-				parameter.label,
-				/* @__PURE__ */ jsx("input", {
-					name: parameter.key,
-					disabled: pending,
-					onChange: (event) => {
-						const value = event.currentTarget.value;
-						setParameters((current) => ({
-							...current,
-							[parameter.key]: value
-						}));
-					},
-					placeholder: parameter.placeholder,
-					required: parameter.required,
-					type: "text",
-					value: parameters[parameter.key] ?? ""
-				}),
-				parameter.description === void 0 ? null : /* @__PURE__ */ jsx("small", { children: parameter.description })
-			] }, parameter.key)),
-			/* @__PURE__ */ jsxs("label", { children: [messages.tokenLabel, /* @__PURE__ */ jsx("input", {
-				autoComplete: "off",
-				disabled: pending,
-				name: "token",
-				onChange: (event) => setToken(event.currentTarget.value),
-				placeholder: method.placeholder,
-				type: "password",
-				value: token
-			})] }),
-			/* @__PURE__ */ jsx("button", {
-				disabled: pending || token.length === 0 || missingRequiredParameter === true,
-				type: "submit",
-				children: method.label
-			})
-		] }),
-		"data-domainkit-part": "token-connect",
-		onSubmit: submit
-	});
-}
-const targetLabel = (target) => `${target.evidence?.accountName ?? target.accountId} · ${target.zoneName}`;
-function Dialog$2({ controller, snapshot }) {
-	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
-	const pending = controller.state._tag === "Submitting" || controller.state._tag === "Redirecting";
-	const integrationMethods = snapshot.provider.authentication.filter((method) => method._tag === "Integration");
-	const oauthMethods = snapshot.provider.authentication.filter((method) => method._tag === "OAuth");
-	const tokenMethods = snapshot.provider.authentication.filter((method) => method._tag === "Token");
-	const hasProviderAccountPath = integrationMethods.length > 0 || oauthMethods.length > 0 || snapshot.reusableConnections.length > 0;
-	return /* @__PURE__ */ jsxs(Dialog.Portal, {
-		container: portalContainer,
-		children: [/* @__PURE__ */ jsx(Dialog.Backdrop, {
-			"data-color-scheme": colorScheme,
-			"data-domainkit-part": "dialog-backdrop",
-			"data-domainkit-root": "",
-			style: themeStyle
-		}), /* @__PURE__ */ jsxs(Dialog.Popup, {
-			"data-domainkit-part": "connection-dialog",
-			"data-domainkit-root": "",
-			"data-color-scheme": colorScheme,
-			style: themeStyle,
-			children: [
-				/* @__PURE__ */ jsxs("div", {
-					"data-domainkit-part": "dialog-header",
-					children: [
-						/* @__PURE__ */ jsx(Mark, { provider: snapshot.provider }),
-						/* @__PURE__ */ jsxs("div", {
-							"data-domainkit-part": "dialog-heading",
-							children: [/* @__PURE__ */ jsx(Dialog.Title, {
-								"data-domainkit-part": "dialog-title",
-								children: messages.dialogTitle(snapshot.provider.name)
-							}), /* @__PURE__ */ jsx(Dialog.Description, {
-								"data-domainkit-part": "dialog-description",
-								children: messages.dialogDescription(snapshot.domain)
-							})]
-						}),
-						pending ? null : /* @__PURE__ */ jsx(Dialog.Close, {
-							"aria-label": messages.close,
-							"data-domainkit-part": "dialog-close",
-							children: "×"
-						})
-					]
-				}),
-				/* @__PURE__ */ jsxs("div", {
-					"data-domainkit-part": "dialog-body",
-					children: [
-						hasProviderAccountPath ? /* @__PURE__ */ jsxs("div", {
-							"data-domainkit-part": "provider-authentication",
-							children: [
-								integrationMethods.map((method) => /* @__PURE__ */ jsx(IntegrationAction, {
-									controller,
-									label: method.label
-								}, method._tag)),
-								oauthMethods.map((method) => /* @__PURE__ */ jsx(OAuthAction, {
-									controller,
-									label: method.label
-								}, method._tag)),
-								snapshot.reusableConnections.map((connection) => /* @__PURE__ */ jsxs("section", {
-									"data-connection-id": connection.connection.id,
-									"data-domainkit-part": "reusable-connection",
-									children: [/* @__PURE__ */ jsxs("div", {
-										"data-domainkit-part": "reusable-connection-heading",
-										children: [/* @__PURE__ */ jsx("strong", { children: messages.existingConnection }), /* @__PURE__ */ jsx("span", { children: connection.connection.providerId })]
-									}), /* @__PURE__ */ jsx("div", {
-										"data-domainkit-part": "target-list",
-										"data-state": connection.targets.length === 0 ? "unavailable" : connection.targets.length === 1 ? "unique" : "ambiguous",
-										children: connection.targets.length === 0 ? /* @__PURE__ */ jsx("p", {
-											"data-domainkit-part": "target-unavailable",
-											children: messages.targetUnavailable
-										}) : connection.targets.map((target) => /* @__PURE__ */ jsx(AttachAction, {
-											connection,
-											controller,
-											label: messages.attachTarget(targetLabel(target)),
-											target
-										}, `${target.accountId}:${target.zoneId}`))
-									})]
-								}, connection.connection.id))
-							]
-						}) : null,
-						hasProviderAccountPath && tokenMethods.length > 0 ? /* @__PURE__ */ jsx("div", {
-							"aria-label": messages.authenticationAlternative,
-							"data-domainkit-part": "authentication-separator",
-							role: "separator",
-							children: /* @__PURE__ */ jsx("span", {
-								"aria-hidden": "true",
-								children: messages.authenticationAlternative
-							})
-						}) : null,
-						tokenMethods.map((method) => /* @__PURE__ */ jsx(TokenAction, {
-							controller,
-							method
-						}, method._tag))
-					]
-				}),
-				pending ? null : /* @__PURE__ */ jsx("div", {
-					"data-domainkit-part": "dialog-footer",
-					children: /* @__PURE__ */ jsx(Dialog.Close, {
-						"data-domainkit-part": "dialog-cancel",
-						children: messages.cancel
-					})
-				})
-			]
-		})]
-	});
-}
-function Flow$2({ domain, ...props }) {
-	const controller = useController$2(domain);
-	const state = controller.state;
-	const snapshot = state._tag === "Disconnected" ? state : state._tag === "Submitting" || state._tag === "Redirecting" ? state.snapshot : void 0;
-	return /* @__PURE__ */ jsxs(Root$3, {
-		...props,
-		status: state._tag,
-		children: [
-			/* @__PURE__ */ jsx(Status$2, { state }),
-			state._tag === "Failure" && state.retry !== "never" ? /* @__PURE__ */ jsx(RetryAction$1, {
-				controller,
-				kind: state.retry === "after-user-action" ? "after-user-action" : "retry"
-			}) : null,
-			snapshot === void 0 ? null : /* @__PURE__ */ jsxs(Dialog.Root, {
-				onOpenChange: (open, eventDetails) => {
-					if (!open && (state._tag === "Submitting" || state._tag === "Redirecting")) eventDetails.cancel();
-				},
-				children: [/* @__PURE__ */ jsx(ConnectTrigger, { provider: snapshot.provider }), /* @__PURE__ */ jsx(Dialog$2, {
-					controller,
-					snapshot
-				})]
-			})
-		]
-	});
-}
-function RetryAction$1({ controller, kind = "retry", ...props }) {
-	const { messages } = useDomainKit();
-	return usePart("button", props, { status: "Failure" }, {
-		children: kind === "after-user-action" ? messages.checkAgain : messages.retry,
-		"data-domainkit-part": "connection-retry",
-		onClick: controller.retry,
-		type: "button"
-	});
-}
-function Card$1({ status, ...props }) {
-	return usePart("div", props, { status }, {
-		"data-domainkit-part": "connected-card",
-		"data-state": status
-	});
-}
-function CardIdentity({ status, ...props }) {
-	return usePart("div", props, { status }, {
-		"data-domainkit-part": "connected-identity",
-		"data-state": status
-	});
-}
-function CardActions({ status, ...props }) {
-	return usePart("div", props, { status }, {
-		"data-domainkit-part": "connected-actions",
-		"data-state": status
-	});
-}
-function DisconnectDialog({ connection, controller, onOpenChange, open: openProp, trigger }) {
-	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
-	const [internalOpen, setInternalOpen] = useState(false);
-	const open = openProp ?? internalOpen;
-	const setOpen = (nextOpen) => {
-		if (openProp === void 0) setInternalOpen(nextOpen);
-		onOpenChange?.(nextOpen);
-	};
-	const detaching = controller.state._tag === "Detaching";
-	return /* @__PURE__ */ jsxs(AlertDialog.Root, {
-		onOpenChange: (nextOpen, eventDetails) => {
-			if (!nextOpen && detaching) {
-				eventDetails.cancel();
-				return;
-			}
-			setOpen(nextOpen);
-		},
-		open,
-		children: [trigger === null ? null : /* @__PURE__ */ jsx(AlertDialog.Trigger, {
-			"data-domainkit-part": "disconnect-trigger",
-			...trigger === void 0 ? {} : { render: trigger },
-			children: messages.disconnectDomain
-		}), /* @__PURE__ */ jsxs(AlertDialog.Portal, {
-			container: portalContainer,
-			children: [/* @__PURE__ */ jsx(AlertDialog.Backdrop, {
-				"data-color-scheme": colorScheme,
-				"data-domainkit-part": "dialog-backdrop",
-				"data-domainkit-root": "",
-				style: themeStyle
-			}), /* @__PURE__ */ jsxs(AlertDialog.Popup, {
-				"data-color-scheme": colorScheme,
-				"data-domainkit-part": "disconnect-dialog",
-				"data-domainkit-root": "",
-				style: themeStyle,
-				children: [/* @__PURE__ */ jsxs("div", {
-					"data-domainkit-part": "dialog-header",
-					children: [/* @__PURE__ */ jsxs("div", {
-						"data-domainkit-part": "dialog-heading",
-						children: [/* @__PURE__ */ jsx(AlertDialog.Title, {
-							"data-domainkit-part": "dialog-title",
-							children: messages.disconnectTitle(connection.provider.name)
-						}), /* @__PURE__ */ jsx(AlertDialog.Description, {
-							"data-domainkit-part": "dialog-description",
-							children: messages.disconnectConsent
-						})]
-					}), detaching ? null : /* @__PURE__ */ jsx(AlertDialog.Close, {
-						"aria-label": messages.close,
-						"data-domainkit-part": "dialog-close",
-						children: "×"
-					})]
-				}), /* @__PURE__ */ jsxs("div", {
-					"data-domainkit-part": "dialog-footer",
-					children: [detaching ? null : /* @__PURE__ */ jsx(AlertDialog.Close, {
-						"data-domainkit-part": "dialog-cancel",
-						children: messages.cancel
-					}), /* @__PURE__ */ jsx("button", {
-						"data-domainkit-part": "disconnect-action",
-						disabled: detaching,
-						onClick: () => controller.detach(),
-						type: "button",
-						children: detaching ? messages.detaching : messages.disconnectDomain
-					})]
-				})]
-			})]
-		})]
-	});
-}
 //#endregion
 //#region src/records.tsx
 var records_exports = /* @__PURE__ */ __exportAll({
-	Body: () => Body,
+	Body: () => Body$1,
 	Caption: () => Caption,
-	Card: () => Card,
+	Card: () => Card$1,
 	CardContent: () => CardContent,
 	CardHeader: () => CardHeader,
 	CardTitle: () => CardTitle,
@@ -1052,35 +773,22 @@ var records_exports = /* @__PURE__ */ __exportAll({
 	Footer: () => Footer,
 	Head: () => Head,
 	Header: () => Header,
-	Priority: () => Priority,
-	Root: () => Root$2,
+	Purpose: () => Purpose,
+	Root: () => Root$5,
 	Row: () => Row,
-	Status: () => Status$1,
+	Status: () => Status$5,
 	Table: () => Table,
 	Value: () => Value,
 	ZoneFile: () => ZoneFile,
 	copyText: () => copyText,
 	downloadZoneFile: () => downloadZoneFile,
+	identity: () => identity,
+	requirementsKey: () => requirementsKey,
+	statusOf: () => statusOf,
 	toZoneFile: () => toZoneFile,
 	useCopy: () => useCopy
 });
-const copyText = (value) => {
-	if (typeof navigator === "undefined" || navigator.clipboard === void 0) return Promise.resolve(false);
-	return navigator.clipboard.writeText(value).then(() => true, () => false);
-};
-const downloadText = (filename, contents) => {
-	if (typeof document === "undefined") return;
-	const blob = new Blob([contents], { type: "text/plain;charset=utf-8" });
-	const url = URL.createObjectURL(blob);
-	const anchor = document.createElement("a");
-	anchor.download = filename;
-	anchor.href = url;
-	document.body.append(anchor);
-	anchor.click();
-	anchor.remove();
-	URL.revokeObjectURL(url);
-};
-const absoluteDomainName = (value) => value.endsWith(".") ? value : `${value}.`;
+const absolute = (value) => value.endsWith(".") ? value : `${value}.`;
 const textEncoder = new TextEncoder();
 const escapeTxtCharacter = (character) => {
 	if (character === "\"" || character === "\\") return `\\${character}`;
@@ -1088,6 +796,7 @@ const escapeTxtCharacter = (character) => {
 	if (codePoint !== void 0 && (codePoint < 32 || codePoint === 127)) return `\\${codePoint.toString().padStart(3, "0")}`;
 	return character;
 };
+/** TXT strings are capped at 255 bytes each, so long values are split and quoted per chunk. */
 const txtValue = (value) => {
 	const chunks = [];
 	let chunk = "";
@@ -1105,29 +814,38 @@ const txtValue = (value) => {
 	chunks.push(chunk);
 	return chunks.map((part) => `"${part}"`).join(" ");
 };
-const srvValue = (value) => {
-	const fields = value.trim().split(/\s+/);
-	if (fields.length !== 3) throw new Error(`Invalid SRV value: ${value}`);
-	const [weight, port, target] = fields;
-	if (weight === void 0 || port === void 0 || target === void 0) throw new Error(`Invalid SRV value: ${value}`);
-	return `${weight} ${port} ${absoluteDomainName(target)}`;
-};
-const zoneValue = (record) => {
-	switch (record.type.toUpperCase()) {
-		case "CNAME":
-		case "MX":
-		case "NS":
-		case "PTR": return absoluteDomainName(record.value);
-		case "SRV": return srvValue(record.value);
+/** The RR type as a zone file spells it. The tag and the type name are the same string. */
+const rrType = (record) => record._tag;
+const zoneData = (record) => {
+	switch (record._tag) {
+		case "A":
+		case "AAAA": return record.address;
+		case "CNAME": return absolute(record.target);
+		case "NS": return absolute(record.nameserver);
 		case "TXT": return txtValue(record.value);
-		default: return record.value;
+		case "MX": return `${record.priority} ${absolute(record.exchange)}`;
+		case "CAA": return `${record.flags} ${record.tag} "${record.value}"`;
+		case "SRV": return `${record.priority} ${record.weight} ${record.port} ${absolute(record.target)}`;
 	}
 };
-function leafPart(defaultTagName, part) {
-	return function Leaf(props) {
-		return usePart(defaultTagName, props, {}, { "data-domainkit-part": part });
-	};
-}
+const toZoneFile = (records) => `${records.map((record) => `${absolute(record.name)}${record.ttl === null ? "" : ` ${record.ttl}`} IN ${rrType(record)} ${zoneData(record)}`).join("\n")}\n`;
+const downloadText = (filename, contents) => {
+	if (typeof document === "undefined") return;
+	const blob = new Blob([contents], { type: "text/plain;charset=utf-8" });
+	const url = URL.createObjectURL(blob);
+	const anchor = document.createElement("a");
+	anchor.download = filename;
+	anchor.href = url;
+	document.body.append(anchor);
+	anchor.click();
+	anchor.remove();
+	URL.revokeObjectURL(url);
+};
+const downloadZoneFile = (domain, records) => downloadText(`${domain}.txt`, toZoneFile(records));
+const copyText = (value) => {
+	if (typeof navigator === "undefined" || navigator.clipboard === void 0) return Promise.resolve(false);
+	return navigator.clipboard.writeText(value).then(() => true, () => false);
+};
 function useCopy(value, resetAfter = 2e3) {
 	const [copied, setCopied] = useState(false);
 	const reset = useRef(void 0);
@@ -1144,279 +862,365 @@ function useCopy(value, resetAfter = 2e3) {
 		}
 	};
 }
-function CopyValue({ copiedIcon, copiedLabel = "Copied", copyIcon, copyLabel = "Copy", value, ...props }) {
+function CopyValue({ value, ...props }) {
+	const { messages } = useDomainKit();
 	const icons = useIcons();
-	const controller = useCopy(value);
-	const copied = controller.copied;
+	const { copied, copy } = useCopy(value);
 	return usePart("span", props, { copied }, {
 		children: /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("code", { children: value }), /* @__PURE__ */ jsxs("button", {
-			"aria-label": `${copied ? copiedLabel : copyLabel} ${value}`,
+			"aria-label": `${copied ? messages.copied : messages.copy} ${value}`,
 			"data-domainkit-part": "copy-action",
-			onClick: controller.copy,
+			onClick: copy,
 			type: "button",
 			children: [/* @__PURE__ */ jsx("span", {
 				"aria-hidden": "true",
 				"data-domainkit-part": "copy-glyph",
 				"data-icon": "",
 				"data-state": "idle",
-				children: copyIcon ?? icons.copy
+				children: icons.copy
 			}), /* @__PURE__ */ jsx("span", {
 				"aria-hidden": "true",
 				"data-domainkit-part": "copy-glyph",
 				"data-icon": "",
 				"data-state": "done",
-				children: copiedIcon ?? icons.copied
+				children: icons.copied
 			})]
 		})] }),
 		"data-copied": copied ? "" : void 0,
 		"data-domainkit-part": "copy-value"
 	});
 }
-function ZoneFile({ copiedIcon, copiedLabel = "Copied", copyIcon, copyLabel = "Copy zone", domain, downloadIcon, downloadLabel = "Download", records, ...props }) {
+function ZoneFile({ domain, records, ...props }) {
+	const { messages } = useDomainKit();
 	const icons = useIcons();
-	const controller = useCopy(toZoneFile(records));
-	const copied = controller.copied;
+	const { copied, copy } = useCopy(toZoneFile(records));
 	return usePart("div", props, { count: records.length }, {
 		children: /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsxs("button", {
-			"aria-label": copied ? copiedLabel : copyLabel,
+			"aria-label": copied ? messages.copied : messages.copyZone,
 			"data-domainkit-part": "zone-copy",
-			onClick: controller.copy,
+			onClick: copy,
 			type: "button",
 			children: [/* @__PURE__ */ jsx("span", {
 				"aria-hidden": "true",
 				"data-icon": "inline-start",
-				children: copied ? copiedIcon ?? icons.copied : copyIcon ?? icons.copy
-			}), copied ? copiedLabel : copyLabel]
+				children: copied ? icons.copied : icons.copy
+			}), copied ? messages.copied : messages.copyZone]
 		}), /* @__PURE__ */ jsxs("button", {
-			"aria-label": downloadLabel,
+			"aria-label": messages.download,
 			"data-domainkit-part": "zone-download",
 			onClick: () => downloadZoneFile(domain, records),
 			type: "button",
 			children: [/* @__PURE__ */ jsx("span", {
 				"aria-hidden": "true",
 				"data-icon": "inline-start",
-				children: downloadIcon ?? icons.download
-			}), downloadLabel]
+				children: icons.download
+			}), messages.download]
 		})] }),
 		"data-domainkit-part": "zone-file"
 	});
 }
-function Status$1({ evidence, ...props }) {
-	return usePart("span", props, { status: evidence._tag }, {
-		children: evidence._tag,
+/** The readiness this record reached, or `null` when nothing has observed it. */
+const statusOf = (record, readiness) => readiness?.requirements.find((requirement) => DnsRecord.equals(requirement.record, record))?.status ?? null;
+function Status$5({ status, ...props }) {
+	const { messages } = useDomainKit();
+	const icons = useIcons();
+	const glyph = status === "satisfied" ? icons.success : status === "unknown" ? icons.pending : icons.failure;
+	return usePart("span", props, { status }, {
+		children: /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("span", {
+			"aria-hidden": "true",
+			"data-icon": "inline-start",
+			children: glyph
+		}), messages.requirementStatus(status)] }),
 		"data-domainkit-part": "record-status",
-		"data-status": evidence._tag
-	});
-}
-function Priority({ children, priority = 0, ...props }) {
-	return usePart("span", props, { priority }, {
-		children: children ?? `Priority ${priority}`,
-		"data-domainkit-part": "record-priority"
+		"data-status": status
 	});
 }
 const Header = leafPart("thead", "records-header");
-const Body = leafPart("tbody", "records-body");
+const Body$1 = leafPart("tbody", "records-body");
 const Footer = leafPart("tfoot", "records-footer");
 const Row = leafPart("tr", "records-row");
 const Head = leafPart("th", "records-head");
 const Cell = leafPart("td", "records-cell");
 const Caption = leafPart("caption", "records-caption");
 const Value = leafPart("span", "record-value");
+const Purpose = leafPart("span", "record-purpose");
 const CardHeader = leafPart("div", "record-card-head");
 const CardTitle = leafPart("strong", "record-card-title");
 const CardContent = leafPart("dl", "record-card-content");
-function Root$2({ count = 0, ...props }) {
+function Root$5({ count = 0, ...props }) {
 	return /* @__PURE__ */ jsx("div", {
 		"data-domainkit-part": "records-panel",
 		children: usePart("table", props, { count }, { "data-domainkit-part": "records-table" })
 	});
 }
-function Card({ copiedIcon, copyIcon, evidence, record, ...props }) {
-	const matching = evidence === void 0 ? [] : evidence.filter((item) => item.recordId === record.id);
-	return usePart("section", props, { recordId: record.id }, {
-		children: /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsxs(CardHeader, { children: [/* @__PURE__ */ jsx(CardTitle, { children: record.type }), matching.map((item, index) => /* @__PURE__ */ jsx(Status$1, { evidence: item }, `${item._tag}-${index}`))] }), /* @__PURE__ */ jsxs(CardContent, { children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("dt", { children: "Name" }), /* @__PURE__ */ jsx("dd", { children: /* @__PURE__ */ jsx(CopyValue, {
-			copiedIcon,
-			copyIcon,
-			value: record.name
-		}) })] }), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("dt", { children: "Value" }), /* @__PURE__ */ jsxs("dd", { children: [/* @__PURE__ */ jsx(CopyValue, {
-			copiedIcon,
-			copyIcon,
-			value: record.value
-		}), record.priority === void 0 ? null : /* @__PURE__ */ jsx(Priority, { priority: record.priority })] })] })] })] }),
+/** A stable React key for a requirement: type, name, and data identify a record. */
+const identity = (record) => [
+	rrType(record),
+	record.name,
+	DnsRecord.data(record)
+].join(":");
+/**
+* A requirement set keyed by everything it carries, for memos that decide whether to re-send it.
+* `identity` is deliberately narrower: it answers "is this the same record" for a React key, while
+* a plan and an observation are built from `ttl`, `policy`, and `purpose` as well. `policy` in
+* particular decides whether a name may hold anything else, so readiness turns on it.
+*/
+const requirementsKey = (records) => JSON.stringify(records);
+function Card$1({ readiness, record, ...props }) {
+	const { messages } = useDomainKit();
+	const status = statusOf(record, readiness);
+	return usePart("section", props, { record: identity(record) }, {
+		children: /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsxs(CardHeader, { children: [/* @__PURE__ */ jsx(CardTitle, { children: messages.recordType(record) }), status === null ? null : /* @__PURE__ */ jsx(Status$5, { status })] }), /* @__PURE__ */ jsxs(CardContent, { children: [
+			/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("dt", { children: messages.headingName }), /* @__PURE__ */ jsx("dd", { children: /* @__PURE__ */ jsx(CopyValue, { value: record.name }) })] }),
+			/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("dt", { children: messages.headingValue }), /* @__PURE__ */ jsx("dd", { children: /* @__PURE__ */ jsx(CopyValue, { value: DnsRecord.data(record) }) })] }),
+			record.purpose === void 0 ? null : /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("dt", { children: messages.headingPurpose }), /* @__PURE__ */ jsx("dd", { children: /* @__PURE__ */ jsx(Purpose, { children: record.purpose }) })] })
+		] })] }),
 		"data-domainkit-part": "record-card"
 	});
 }
-function Table({ copiedIcon, copyIcon, evidence, records, ...props }) {
-	const status = evidence !== void 0;
-	return /* @__PURE__ */ jsxs(Root$2, {
+/** The default records presentation: one row per requirement, with readiness when there is any. */
+function Table({ caption, readiness, records, ...props }) {
+	const { messages } = useDomainKit();
+	const withStatus = readiness !== null && readiness !== void 0;
+	return /* @__PURE__ */ jsxs(Root$5, {
 		count: records.length,
 		...props,
-		children: [/* @__PURE__ */ jsx(Header, { children: /* @__PURE__ */ jsxs(Row, { children: [
-			/* @__PURE__ */ jsx(Head, {
-				scope: "col",
-				children: "Type"
-			}),
-			/* @__PURE__ */ jsx(Head, {
-				scope: "col",
-				children: "Name"
-			}),
-			/* @__PURE__ */ jsx(Head, {
-				scope: "col",
-				children: "Value"
-			}),
-			status ? /* @__PURE__ */ jsx(Head, {
-				"data-column": "status",
-				scope: "col",
-				children: "Status"
-			}) : null
-		] }) }), /* @__PURE__ */ jsx(Body, { children: records.map((record) => /* @__PURE__ */ jsxs(Row, { children: [
-			/* @__PURE__ */ jsx(Cell, { children: record.type }),
-			/* @__PURE__ */ jsx(Cell, { children: /* @__PURE__ */ jsx(CopyValue, {
-				copiedIcon,
-				copyIcon,
-				value: record.name
-			}) }),
-			/* @__PURE__ */ jsx(Cell, { children: /* @__PURE__ */ jsxs(Value, { children: [/* @__PURE__ */ jsx(CopyValue, {
-				copiedIcon,
-				copyIcon,
-				value: record.value
-			}), record.priority === void 0 ? null : /* @__PURE__ */ jsx(Priority, { priority: record.priority })] }) }),
-			status ? /* @__PURE__ */ jsx(Cell, {
-				"data-column": "status",
-				children: evidence.filter((item) => item.recordId === record.id).map((item, index) => /* @__PURE__ */ jsx(Status$1, { evidence: item }, `${item._tag}-${index}`))
-			}) : null
-		] }, record.id)) })]
+		children: [
+			caption === void 0 ? null : /* @__PURE__ */ jsx(Caption, { children: caption }),
+			/* @__PURE__ */ jsx(Header, { children: /* @__PURE__ */ jsxs(Row, { children: [
+				/* @__PURE__ */ jsx(Head, {
+					scope: "col",
+					children: messages.headingType
+				}),
+				/* @__PURE__ */ jsx(Head, {
+					scope: "col",
+					children: messages.headingName
+				}),
+				/* @__PURE__ */ jsx(Head, {
+					scope: "col",
+					children: messages.headingValue
+				}),
+				withStatus ? /* @__PURE__ */ jsx(Head, {
+					"data-column": "status",
+					scope: "col",
+					children: messages.headingStatus
+				}) : null
+			] }) }),
+			/* @__PURE__ */ jsx(Body$1, { children: records.map((record) => {
+				const status = statusOf(record, readiness);
+				return /* @__PURE__ */ jsxs(Row, { children: [
+					/* @__PURE__ */ jsx(Cell, { children: messages.recordType(record) }),
+					/* @__PURE__ */ jsx(Cell, { children: /* @__PURE__ */ jsx(CopyValue, { value: record.name }) }),
+					/* @__PURE__ */ jsx(Cell, { children: /* @__PURE__ */ jsxs(Value, { children: [/* @__PURE__ */ jsx(CopyValue, { value: DnsRecord.data(record) }), record.purpose === void 0 ? null : /* @__PURE__ */ jsx(Purpose, { children: record.purpose })] }) }),
+					withStatus ? /* @__PURE__ */ jsx(Cell, {
+						"data-column": "status",
+						children: status === null ? null : /* @__PURE__ */ jsx(Status$5, { status })
+					}) : null
+				] }, identity(record));
+			}) })
+		]
 	});
 }
-const toZoneFile = (records) => `${records.map((record) => `${absoluteDomainName(record.name)} IN ${record.type} ${record.priority === void 0 ? "" : `${record.priority} `}${zoneValue(record)}`).join("\n")}\n`;
-const downloadZoneFile = (domain, records) => downloadText(`${domain}.txt`, toZoneFile(records));
 //#endregion
-//#region src/provisioning.tsx
-var provisioning_exports = /* @__PURE__ */ __exportAll({
-	Command: () => Command$1,
-	Dialog: () => Dialog$1,
-	Flow: () => Flow$1,
-	Outcome: () => Outcome$1,
-	RetryAction: () => RetryAction,
-	Root: () => Root$1,
-	State: () => State$1,
-	useController: () => useController$1,
-	useModel: () => useModel$1
+//#region src/operations.tsx
+var operations_exports = /* @__PURE__ */ __exportAll({
+	Item: () => Item,
+	Kind: () => Kind,
+	List: () => List,
+	Name: () => Name,
+	Reason: () => Reason$1,
+	Record: () => Record,
+	Root: () => Root$4,
+	Type: () => Type
 });
-const State$1 = Data.taggedEnum();
-const Command$1 = Data.taggedEnum();
-function useModel$1(connection, records, onApplied) {
-	const { emit, runtime } = useDomainKit();
-	const recordKey = recordsIdentity(records);
-	const onAppliedRef = useRef(onApplied);
-	onAppliedRef.current = onApplied;
-	return useMemo(() => {
-		const state = Atom.make(State$1.Idle());
-		return {
-			command: runtime.fn()((command, get) => {
-				const current = get(state);
-				if (command._tag === "Dismiss") {
-					if (current._tag === "Planning" || current._tag === "Applying") return Effect.void;
-					get.set(state, State$1.Idle());
-					return Effect.void;
-				}
-				if (command._tag === "Plan") {
-					if (current._tag === "Planning" || current._tag === "Applying") return Effect.void;
-					get.set(state, State$1.Planning());
-					return Effect.flatMap(Transport.Service, (transport) => transport.provisioning.plan({
-						attachmentId: connection.attachment.id,
-						domain: connection.attachment.domain,
-						records
-					})).pipe(Effect.tap((plan) => Effect.sync(() => get.set(state, State$1.Review({ plan })))), Effect.catch((error) => Effect.sync(() => get.set(state, failureFromError(error)))), Effect.asVoid);
-				}
-				if (current._tag !== "Review" || current.plan.operations.some((operation) => operation._tag === "Conflict")) return Effect.void;
-				const plan = current.plan;
-				get.set(state, State$1.Applying({ plan }));
-				return Effect.flatMap(Transport.Service, (transport) => transport.provisioning.apply({
-					attachmentId: connection.attachment.id,
-					domain: connection.attachment.domain,
-					planDigest: plan.digest
-				})).pipe(Effect.tap((result) => Effect.sync(() => {
-					if (result._tag === "Applied") {
-						get.set(state, State$1.Complete({ result }));
-						emit(Event.RecordsApplied({
-							connection,
-							result
-						}));
-						onAppliedRef.current?.(result);
-					} else if (result._tag === "Partial") {
-						get.set(state, State$1.Partial({ result }));
-						emit(Event.RecordsPartiallyApplied({
-							connection,
-							result
-						}));
-						onAppliedRef.current?.(result);
-					} else get.set(state, result);
-				})), Effect.catch((error) => Effect.sync(() => get.set(state, failureFromError(error)))), Effect.asVoid);
-			}),
-			state
-		};
-	}, [
-		connection.attachment.domain,
-		connection.attachment.id,
-		emit,
-		recordKey,
-		runtime
-	]);
+const Kind = leafPart("span", "operation-kind");
+const Type = leafPart("strong", "operation-type");
+const Record = leafPart("span", "operation-record");
+const Name = leafPart("span", "operation-name");
+const Reason$1 = leafPart("span", "operation-reason");
+function Item({ operation, ...props }) {
+	const { messages } = useDomainKit();
+	return usePart("li", props, { operation: operation._tag }, {
+		children: /* @__PURE__ */ jsxs(Fragment, { children: [
+			/* @__PURE__ */ jsx(Kind, { children: messages.operation(operation) }),
+			" ",
+			/* @__PURE__ */ jsx(Type, { children: messages.recordType(operation.record) }),
+			" ",
+			/* @__PURE__ */ jsxs(Record, { children: [/* @__PURE__ */ jsx(Name, { children: operation.record.name }), /* @__PURE__ */ jsx(CopyValue, { value: DnsRecord.data(operation.record) })] }),
+			operation._tag === "Conflict" ? /* @__PURE__ */ jsx(Reason$1, { children: messages.conflictReason(operation.reason) }) : null
+		] }),
+		"data-domainkit-part": "operation-item",
+		"data-operation": operation._tag
+	});
 }
-function useController$1(connection, records, onApplied) {
-	const model = useModel$1(connection, records, onApplied);
-	const state = useAtomValue(model.state);
-	const execute = useAtomSet(model.command);
-	return {
-		apply: () => execute(Command$1.Apply()),
-		dismiss: () => execute(Command$1.Dismiss()),
-		plan: () => execute(Command$1.Plan()),
-		retry: () => execute(Command$1.Plan()),
-		state
-	};
+function Root$4({ count = 0, kind, ...props }) {
+	return usePart("ul", props, {
+		count,
+		kind
+	}, {
+		"data-domainkit-part": kind === "provisioning" ? "plan-operations" : "cleanup-operations",
+		"data-kind": kind
+	});
 }
-function Root$1({ status, ...props }) {
-	return usePart("div", props, { status }, {
-		"data-domainkit-part": "provisioning-flow",
-		"data-state": status
+/** Every operation the plan holds, in plan order, so a customer reviews exactly what will run. */
+function List({ plan, ...props }) {
+	return /* @__PURE__ */ jsx(Root$4, {
+		count: plan.operations.length,
+		kind: plan.kind,
+		...props,
+		children: plan.operations.map((operation) => /* @__PURE__ */ jsx(Item, { operation }, operation.id))
+	});
+}
+//#endregion
+//#region src/review.tsx
+/**
+* The review surface both `Provision` and `Cleanup` render: what the plan will do, the Approve
+* and Decline actions D35 defines, and the outcome. `kind` picks the wording; nothing else about
+* the two flows differs on screen.
+*/
+const busy = (status) => status === "Planning" || status === "Approving" || status === "Applying" || status === "Rejecting";
+/** What the flow is doing right now, or what it finished doing. */
+function Status$4({ controller, kind, ...props }) {
+	const { messages } = useDomainKit();
+	const state = controller.state;
+	const text = () => {
+		switch (state._tag) {
+			case "Idle": return "";
+			case "Planning": return kind === "provisioning" ? messages.planning : messages.planningCleanup;
+			case "Planned": return kind === "provisioning" ? messages.planConsent : messages.cleanupConsent;
+			case "Approving": return messages.approving;
+			case "Applying": return kind === "provisioning" ? messages.applying : messages.cleaning;
+			case "Rejecting": return messages.rejecting;
+			case "Rejected": return messages.declinedBy(state.attempt.rejection?.actorId ?? "");
+			case "Applied": return kind === "provisioning" ? messages.applied(state.receipt) : messages.cleaned(state.receipt);
+			case "Failure": return "";
+		}
+	};
+	return usePart("p", props, { status: state._tag }, {
+		children: text(),
+		"data-domainkit-part": kind === "provisioning" ? "provisioning-status" : "cleanup-status",
+		"data-state": state._tag,
+		role: busy(state._tag) ? "status" : void 0
 	});
 }
-function Outcome$1({ state }) {
+/** The failure sentence from the error's reason, with the retry the flow allows. */
+function Outcome$4({ controller, kind, ...props }) {
 	const { messages } = useDomainKit();
-	if (state._tag === "Partial" || state._tag === "Failure" || state._tag === "Stale") return /* @__PURE__ */ jsx("p", {
+	const readOnly = useReadOnly();
+	const state = controller.state;
+	const partial = state._tag === "Applied" && state.receipt.status === "partial";
+	const element = usePart("p", props, { status: state._tag }, {
+		children: state._tag === "Failure" ? /* @__PURE__ */ jsxs(Fragment, { children: [failure(state.error, messages), readOnly ? null : /* @__PURE__ */ jsxs(Fragment, { children: [" ", /* @__PURE__ */ jsx("button", {
+			"data-domainkit-part": kind === "provisioning" ? "provisioning-retry" : "cleanup-retry",
+			onClick: controller.retry,
+			type: "button",
+			children: messages.retry
+		})] })] }) : partial ? kind === "provisioning" ? messages.partiallyApplied : messages.partiallyCleaned : null,
 		"data-domainkit-part": "flow-outcome",
 		"data-tone": "danger",
-		role: "alert",
-		children: state._tag === "Partial" ? messages.recordsPartiallyApplied : state.message
+		role: "alert"
 	});
-	return null;
+	return state._tag === "Failure" || partial ? element : null;
 }
-function Dialog$1({ controller, trigger }) {
-	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
+/**
+* Approve and Decline. Approve authorizes the digest and applies it; Decline records the refusal
+* and ends the attempt. Neither renders until there is a plan to act on.
+*/
+function Actions$2({ controller, kind, ...props }) {
+	const { messages } = useDomainKit();
+	const readOnly = useReadOnly();
 	const state = controller.state;
-	const planRef = useRef(void 0);
-	if (state._tag === "Idle") planRef.current = void 0;
-	if (state._tag === "Review" || state._tag === "Applying") planRef.current = state.plan;
-	const plan = planRef.current;
-	const busy = state._tag === "Planning" || state._tag === "Applying";
-	const open = state._tag !== "Idle" && state._tag !== "Complete";
-	const isNoopOnly = plan !== void 0 && plan.operations.every((operation) => operation._tag === "Noop");
+	const plan = state._tag === "Planned" ? state.plan : null;
+	const running = busy(state._tag);
+	const element = usePart("div", props, { status: state._tag }, {
+		children: /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("button", {
+			"data-domainkit-part": kind === "provisioning" ? "plan-apply" : "cleanup-apply",
+			disabled: running || plan === null || plan.operations.length === 0,
+			onClick: () => controller.approve(),
+			type: "button",
+			children: messages.approve
+		}), /* @__PURE__ */ jsx("button", {
+			"data-domainkit-part": "plan-decline",
+			disabled: running || plan === null,
+			onClick: () => controller.reject(),
+			type: "button",
+			children: messages.decline
+		})] }),
+		"data-domainkit-part": "review-actions"
+	});
+	if (readOnly) return null;
+	return plan === null && !running ? null : element;
+}
+/** The operations under review, or the reason there is nothing to review. */
+function Body({ controller, kind }) {
+	const { messages } = useDomainKit();
+	const state = controller.state;
+	const plan = state._tag === "Planned" || state._tag === "Approving" || state._tag === "Applying" || state._tag === "Rejecting" || state._tag === "Rejected" ? state.plan : state._tag === "Applied" ? state.plan : null;
+	return /* @__PURE__ */ jsxs("div", {
+		"data-domainkit-part": "dialog-body",
+		children: [
+			/* @__PURE__ */ jsx(Status$4, {
+				controller,
+				kind
+			}),
+			plan === null ? null : plan.operations.length === 0 ? /* @__PURE__ */ jsx("p", {
+				"data-domainkit-part": "plan-empty",
+				children: messages.noChanges
+			}) : /* @__PURE__ */ jsx(List, { plan }),
+			state._tag === "Rejected" && state.attempt.rejection?.reason != null ? /* @__PURE__ */ jsx("p", {
+				"data-domainkit-part": "plan-decline-reason",
+				children: messages.declineReason(state.attempt.rejection.reason)
+			}) : null,
+			/* @__PURE__ */ jsx(Outcome$4, {
+				controller,
+				kind
+			})
+		]
+	});
+}
+/** The review dialog. `render` swaps the surface; the contents stay the flow's. */
+function Dialog$4({ children, controller, kind, onOpenChange, open, render, trigger }) {
+	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
+	const readOnly = useReadOnly();
+	const [uncontrolled, setUncontrolled] = useState(false);
+	const isOpen = open ?? uncontrolled;
+	const setOpen = (next) => {
+		if (open === void 0) setUncontrolled(next);
+		onOpenChange?.(next);
+	};
+	const running = busy(controller.state._tag);
+	const body = children ?? /* @__PURE__ */ jsx(Body, {
+		controller,
+		kind
+	});
+	const title = kind === "provisioning" ? messages.planTitle : messages.cleanupTitle;
+	const label = trigger ?? (kind === "provisioning" ? messages.reviewChanges : messages.cleanUp);
+	if (readOnly) return /* @__PURE__ */ jsx(Fragment, {});
+	if (render !== void 0) return /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("button", {
+		"data-domainkit-part": kind === "provisioning" ? "plan-trigger" : "cleanup-trigger",
+		onClick: () => {
+			setOpen(true);
+			controller.plan();
+		},
+		type: "button",
+		children: label
+	}), render({
+		children: body,
+		open: isOpen
+	})] });
 	return /* @__PURE__ */ jsxs(Dialog.Root, {
-		onOpenChange: (nextOpen, eventDetails) => {
-			if (!nextOpen && busy) {
-				eventDetails.cancel();
+		onOpenChange: (next, details) => {
+			if (!next && running) {
+				details.cancel();
 				return;
 			}
-			if (!nextOpen) controller.dismiss();
+			setOpen(next);
 		},
-		open,
+		open: isOpen,
 		children: [/* @__PURE__ */ jsx(Dialog.Trigger, {
-			"data-domainkit-part": "plan-trigger",
-			disabled: state._tag !== "Idle",
-			onClick: () => controller.plan(),
-			...trigger === void 0 ? {} : { render: trigger },
-			children: messages.reviewDns
+			"data-domainkit-part": kind === "provisioning" ? "plan-trigger" : "cleanup-trigger",
+			onClick: controller.plan,
+			children: label
 		}), /* @__PURE__ */ jsxs(Dialog.Portal, {
 			container: portalContainer,
 			children: [/* @__PURE__ */ jsx(Dialog.Backdrop, {
@@ -1426,7 +1230,7 @@ function Dialog$1({ controller, trigger }) {
 				style: themeStyle
 			}), /* @__PURE__ */ jsxs(Dialog.Popup, {
 				"data-color-scheme": colorScheme,
-				"data-domainkit-part": "plan-dialog",
+				"data-domainkit-part": kind === "provisioning" ? "plan-dialog" : "cleanup-dialog",
 				"data-domainkit-root": "",
 				style: themeStyle,
 				children: [
@@ -1436,203 +1240,911 @@ function Dialog$1({ controller, trigger }) {
 							"data-domainkit-part": "dialog-heading",
 							children: [/* @__PURE__ */ jsx(Dialog.Title, {
 								"data-domainkit-part": "dialog-title",
-								children: messages.reviewDns
+								children: title
 							}), /* @__PURE__ */ jsx(Dialog.Description, {
 								"data-domainkit-part": "dialog-description",
-								children: messages.planConsent
+								children: kind === "provisioning" ? messages.planConsent : messages.cleanupConsent
 							})]
-						}), busy ? null : /* @__PURE__ */ jsx(Dialog.Close, {
+						}), running ? null : /* @__PURE__ */ jsx(Dialog.Close, {
 							"aria-label": messages.close,
 							"data-domainkit-part": "dialog-close",
 							children: "×"
 						})]
 					}),
+					body,
 					/* @__PURE__ */ jsxs("div", {
-						"data-domainkit-part": "dialog-body",
-						children: [plan === void 0 ? /* @__PURE__ */ jsx("p", {
-							"data-domainkit-part": "dialog-progress",
-							role: "status",
-							children: messages.planningDns
-						}) : /* @__PURE__ */ jsx(List, {
-							lifecycle: "provisioning",
-							operations: plan.operations
-						}), /* @__PURE__ */ jsx(Outcome$1, { state })]
-					}),
-					/* @__PURE__ */ jsx("div", {
 						"data-domainkit-part": "dialog-footer",
-						children: busy ? /* @__PURE__ */ jsx("button", {
-							"data-domainkit-part": "plan-apply",
-							disabled: true,
-							type: "button",
-							children: state._tag === "Applying" ? messages.applyingDns : messages.planningDns
-						}) : state._tag === "Review" && plan !== void 0 ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Dialog.Close, {
+						children: [/* @__PURE__ */ jsx(Actions$2, {
+							controller,
+							kind
+						}), running ? null : /* @__PURE__ */ jsx(Dialog.Close, {
 							"data-domainkit-part": "dialog-cancel",
 							children: messages.cancel
-						}), /* @__PURE__ */ jsx("button", {
-							"data-domainkit-part": "plan-apply",
-							disabled: isNoopOnly || plan.operations.some((operation) => operation._tag === "Conflict"),
-							onClick: () => controller.apply(),
-							type: "button",
-							children: isNoopOnly ? messages.noChanges : messages.applyDns
-						})] }) : /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Dialog.Close, {
-							"data-domainkit-part": "dialog-cancel",
-							children: messages.close
-						}), /* @__PURE__ */ jsx("button", {
-							"data-domainkit-part": "provisioning-retry",
-							onClick: () => controller.retry(),
-							type: "button",
-							children: messages.retry
-						})] })
+						})]
 					})
 				]
 			})]
 		})]
 	});
 }
-function RetryAction({ controller }) {
-	const { messages } = useDomainKit();
-	const state = controller.state;
-	if (state._tag !== "Failure" && state._tag !== "Stale" && state._tag !== "Partial") return null;
-	return /* @__PURE__ */ jsx("button", {
-		"data-domainkit-part": "provisioning-retry",
-		onClick: () => controller.retry(),
-		type: "button",
-		children: messages.retry
+//#endregion
+//#region src/cleanup.tsx
+var cleanup_exports = /* @__PURE__ */ __exportAll({
+	Actions: () => Actions$1,
+	Dialog: () => Dialog$3,
+	Flow: () => Flow$3,
+	Outcome: () => Outcome$3,
+	Root: () => Root$3,
+	State: () => State$2,
+	Status: () => Status$3,
+	useController: () => useController$3
+});
+/**
+* Cleanup is bound to a receipt: it removes only what an apply proved DomainKit created. When the
+* host does not name one, the controller reads the domain's latest from the snapshot.
+*/
+function useController$3({ domain, onCleaned, receiptId }) {
+	const { transport } = useDomainKit();
+	const group = transport.cleanup;
+	const connection = transport.connection;
+	return useAttempt({
+		domain,
+		key: [domain, receiptId ?? ""].join("|"),
+		done: (receipt) => Event.Cleaned({
+			domain,
+			receipt
+		}),
+		group,
+		onDone: onCleaned,
+		plan: useCallback(() => {
+			if (group === void 0) return null;
+			if (receiptId !== void 0) return group.plan(receiptId);
+			if (connection === void 0) return null;
+			return Effect.flatMap(connection.inspect(domain), (snapshot) => snapshot.lastReceiptId === null ? Effect.fail(new DomainKit.Error({ reason: new Reason.NotFound({
+				entity: "receipt",
+				id: snapshot.domain
+			}) })) : group.plan(Receipt.ReceiptId.make(snapshot.lastReceiptId)));
+		}, [
+			connection,
+			domain,
+			group,
+			receiptId
+		])
 	});
 }
-function Flow$1({ connection, onApplied, records, showRecords = true, trigger, ...props }) {
-	const controller = useController$1(connection, records, onApplied);
-	const state = controller.state;
-	return /* @__PURE__ */ jsxs(Root$1, {
-		status: state._tag,
+function Root$3({ controller, ...props }) {
+	return usePart("div", props, { status: controller.state._tag }, {
+		"data-domainkit-part": "cleanup-flow",
+		"data-state": controller.state._tag
+	});
+}
+function Dialog$3(props) {
+	return /* @__PURE__ */ jsx(Dialog$4, {
 		...props,
-		children: [showRecords ? /* @__PURE__ */ jsx(Table, { records }) : null, /* @__PURE__ */ jsx(Dialog$1, {
-			controller,
-			...trigger === void 0 ? {} : { trigger }
-		})]
+		kind: "cleanup"
 	});
 }
-//#endregion
-//#region src/verification.tsx
-var verification_exports = /* @__PURE__ */ __exportAll({
-	Command: () => Command,
-	Evidence: () => Evidence,
-	ObserveAction: () => ObserveAction,
-	Outcome: () => Outcome,
-	Root: () => Root,
-	State: () => State,
-	Status: () => Status,
-	useController: () => useController,
-	useModel: () => useModel
-});
-const State = Data.taggedEnum();
-const Command = Data.taggedEnum();
-function useModel(config) {
-	const { runtime } = useDomainKit();
-	const provider = config.sources?.provider ?? config.connection !== void 0;
-	const publicDns = config.sources?.publicDns ?? true;
-	const recordKey = recordsIdentity(config.records);
-	return useMemo(() => {
-		const state = Atom.make(State.Idle());
-		return {
-			command: runtime.fn()((command, get) => {
-				if (command._tag === "Reset") {
-					get.set(state, State.Idle());
-					return Effect.void;
-				}
-				const current = get(state);
-				if (current._tag === "Observing") return Effect.void;
-				const previous = current._tag === "Observation" ? current : current._tag === "Failed" ? current.previous : void 0;
-				get.set(state, State.Observing({ ...previous === void 0 ? {} : { previous } }));
-				return Effect.flatMap(Transport.Service, (transport) => transport.verification.observe({
-					...config.connection === void 0 ? {} : { attachmentId: config.connection.attachment.id },
-					domain: config.domain,
-					records: config.records,
-					sources: {
-						provider,
-						publicDns
-					}
-				})).pipe(Effect.tap((observation) => Effect.sync(() => get.set(state, observation))), Effect.catch((error) => Effect.sync(() => get.set(state, State.Failed({
-					failure: failureFromError(error),
-					...previous === void 0 ? {} : { previous }
-				})))), Effect.asVoid);
-			}),
-			state
+function Actions$1(props) {
+	return /* @__PURE__ */ jsx(Actions$2, {
+		...props,
+		kind: "cleanup"
+	});
+}
+function Outcome$3(props) {
+	return /* @__PURE__ */ jsx(Outcome$4, {
+		...props,
+		kind: "cleanup"
+	});
+}
+function Status$3(props) {
+	return /* @__PURE__ */ jsx(Status$4, {
+		...props,
+		kind: "cleanup"
+	});
+}
+/** Cleanup on its own: a trigger that plans the removal, then the same review dialog. */
+function Flow$3({ domain, onCleaned, receiptId, trigger, ...props }) {
+	const controller = useController$3({
+		domain,
+		...onCleaned === void 0 ? {} : { onCleaned },
+		...receiptId === void 0 ? {} : { receiptId }
+	});
+	return /* @__PURE__ */ jsxs(Root$3, {
+		controller,
+		...props,
+		children: [/* @__PURE__ */ jsx(Dialog$3, {
+			controller,
+			...trigger === void 0 ? {} : { trigger }
+		}), /* @__PURE__ */ jsx(Outcome$3, { controller })]
+	});
+}
+//#endregion
+//#region src/provider.tsx
+var provider_exports = /* @__PURE__ */ __exportAll({ Mark: () => Mark });
+const key = (providerId) => providerId.trim().toLowerCase().replaceAll(/[^a-z0-9]+/g, "");
+/** No network call: the fallback is the provider's own initial, drawn with the theme's tokens. */
+const monogram = (provider) => provider.name.trim().charAt(0).toUpperCase() || "?";
+/**
+* A provider's artwork. `DomainKit.Root`'s `marks` decides what a provider looks like; without an
+* entry the mark is the provider's initial. Nothing is fetched at render time.
+*/
+function Mark({ provider, ...props }) {
+	const { marks } = useDomainKit();
+	const replacement = marks[provider.id];
+	const content = typeof replacement === "function" ? replacement(provider) : replacement ?? monogram(provider);
+	return usePart("span", props, { providerId: provider.id }, {
+		"aria-label": provider.name,
+		children: content,
+		"data-domainkit-part": "provider-mark",
+		"data-domainkit-provider": key(provider.id),
+		role: "img"
+	});
+}
+//#endregion
+//#region src/connect.tsx
+var connect_exports = /* @__PURE__ */ __exportAll({
+	Card: () => Card,
+	Dialog: () => Dialog$2,
+	Flow: () => Flow$2,
+	Form: () => Form,
+	Outcome: () => Outcome$2,
+	Root: () => Root$2,
+	State: () => State$1,
+	Status: () => Status$2,
+	useController: () => useController$2
+});
+const State$1 = Data.taggedEnum();
+/** Read at connect time, not at render, so it is the page the customer is actually on. */
+const currentUrl = () => typeof window === "undefined" ? null : window.location.href;
+const snapshotOf = (state) => {
+	switch (state._tag) {
+		case "Connected":
+		case "Reconnect":
+		case "Disconnected": return state.snapshot;
+		case "Loading":
+		case "Submitting":
+		case "SelectionRequired": return state.snapshot;
+		case "Redirecting":
+		case "Failure": return null;
+	}
+};
+const settled = (snapshot, discovery) => {
+	switch (snapshot.status) {
+		case "connected": return State$1.Connected({ snapshot });
+		case "reconnect": return State$1.Reconnect({ snapshot });
+		case "disconnected": return State$1.Disconnected({
+			discovery,
+			snapshot
+		});
+	}
+};
+/**
+* The domain's connection, and the four ways to change it. Discovery runs on mount whenever the
+* transport declares it and the domain has no connection yet; a discovery failure is not the
+* customer's problem, so the provider list still renders.
+*/
+function useController$2({ domain, returnTo }) {
+	const { emit, navigate, revision, transport } = useDomainKit();
+	const readOnly = useReadOnly();
+	const connection = transport.connection;
+	const runner = useRunner();
+	const [state, setState] = useState(State$1.Loading({ snapshot: null }));
+	const held = useRef({
+		discovery: null,
+		domain,
+		snapshot: null
+	});
+	const lastCommand = useRef(null);
+	const [inspected, setInspected] = useState(domain);
+	if (inspected !== domain) {
+		setInspected(domain);
+		runner.cancel();
+		held.current = {
+			discovery: null,
+			domain,
+			snapshot: null
+		};
+		lastCommand.current = null;
+		setState(State$1.Loading({ snapshot: null }));
+	}
+	const onFailure = useCallback((error) => {
+		setState(State$1.Failure({ error }));
+		emit(Event.Failed({
+			domain,
+			error
+		}));
+	}, [domain, emit]);
+	const load = useCallback(() => {
+		if (connection === void 0) return;
+		lastCommand.current = null;
+		held.current = {
+			discovery: null,
+			domain,
+			snapshot: null
 		};
+		setState((previous) => State$1.Loading({ snapshot: snapshotOf(previous) }));
+		runner.run(Effect.flatMap(connection.inspect(domain), (snapshot) => snapshot.status === "disconnected" ? Effect.map(connection.discover(domain).pipe(Effect.catch(() => Effect.succeed(null))), (discovery) => ({
+			discovery,
+			snapshot
+		})) : Effect.succeed({
+			discovery: null,
+			snapshot
+		})), {
+			onFailure,
+			onSuccess: ({ discovery, snapshot }) => {
+				if (held.current.domain !== domain) return;
+				held.current = {
+					discovery,
+					domain,
+					snapshot
+				};
+				setState(settled(snapshot, discovery));
+			}
+		});
 	}, [
-		config.connection?.attachment.id,
-		config.domain,
-		provider,
-		publicDns,
-		recordKey,
-		runtime
+		connection,
+		domain,
+		onFailure,
+		runner
+	]);
+	useEffect(load, [load, revision]);
+	const started = useCallback((result) => {
+		if (held.current.domain !== domain) return;
+		switch (result._tag) {
+			case "Connected":
+				held.current = {
+					discovery: null,
+					domain,
+					snapshot: result.snapshot
+				};
+				setState(settled(result.snapshot, null));
+				if (result.snapshot.connectionId !== null) emit(Event.Connected({
+					connectionId: result.snapshot.connectionId,
+					domain,
+					snapshot: result.snapshot
+				}));
+				return;
+			case "Redirect":
+				setState(State$1.Redirecting({ url: result.authorizationUrl }));
+				navigate(result.authorizationUrl);
+				return;
+			case "SelectionRequired":
+				setState(State$1.SelectionRequired({
+					candidates: result.candidates,
+					connectionId: result.connectionId,
+					snapshot: held.current.snapshot
+				}));
+				return;
+		}
+	}, [
+		domain,
+		emit,
+		navigate
+	]);
+	const submit = useCallback((effect) => {
+		if (held.current.domain !== domain) return;
+		const command = () => {
+			setState(State$1.Submitting({ snapshot: held.current.snapshot }));
+			runner.run(effect, {
+				onFailure,
+				onSuccess: started
+			});
+		};
+		lastCommand.current = {
+			domain,
+			run: command
+		};
+		command();
+	}, [
+		domain,
+		onFailure,
+		runner,
+		started
+	]);
+	const connect = useCallback((input) => {
+		if (connection === void 0) return;
+		const destination = input.returnTo ?? (returnTo === void 0 ? currentUrl() : returnTo);
+		const interactive = destination === null ? {} : { returnTo: destination };
+		const method = input.method === "token" ? Transport.Method.token(input.values ?? {}) : input.method === "oauth" ? Transport.Method.oauth(interactive) : Transport.Method.integration(interactive);
+		submit(connection.start({
+			domain,
+			method,
+			provider: input.provider
+		}));
+	}, [
+		connection,
+		domain,
+		returnTo,
+		submit
+	]);
+	const reuse = useCallback((input) => {
+		if (connection === void 0) return;
+		submit(connection.attach({
+			connectionId: input.connectionId,
+			domain,
+			...input.zone === void 0 ? {} : { zone: input.zone }
+		}));
+	}, [
+		connection,
+		domain,
+		submit
+	]);
+	const select = useCallback((zone) => {
+		if (state._tag !== "SelectionRequired") return;
+		reuse({
+			connectionId: state.connectionId,
+			zone
+		});
+	}, [reuse, state]);
+	const release = useCallback((effect, event) => {
+		if (held.current.domain !== domain) return;
+		const command = () => {
+			setState(State$1.Submitting({ snapshot: held.current.snapshot }));
+			runner.run(effect, {
+				onFailure,
+				onSuccess: () => {
+					emit(event);
+					load();
+				}
+			});
+		};
+		lastCommand.current = {
+			domain,
+			run: command
+		};
+		command();
+	}, [
+		domain,
+		emit,
+		load,
+		onFailure,
+		runner
+	]);
+	const detach = useCallback(() => {
+		const attachmentId = held.current.snapshot?.attachmentId;
+		if (connection === void 0 || attachmentId == null || held.current.domain !== domain) return;
+		release(connection.detach(attachmentId), Event.Detached({ domain }));
+	}, [
+		connection,
+		domain,
+		release
+	]);
+	const disconnect = useCallback(() => {
+		const connectionId = held.current.snapshot?.connectionId;
+		if (connection === void 0 || connectionId == null || held.current.domain !== domain) return;
+		release(connection.disconnect(connectionId), Event.Disconnected({
+			connectionId,
+			domain
+		}));
+	}, [
+		connection,
+		domain,
+		release
+	]);
+	const retry = useCallback(() => {
+		const command = lastCommand.current;
+		if (readOnly || command === null || command.domain !== domain) load();
+		else command.run();
+	}, [
+		domain,
+		load,
+		readOnly
 	]);
-}
-function useController(config) {
-	const model = useModel(config);
-	const state = useAtomValue(model.state);
-	const dispatch = useAtomSet(model.command);
-	const observe = () => dispatch(Command.Observe());
-	const reset = () => dispatch(Command.Reset());
 	return {
-		observe,
-		reset,
+		connect,
+		detach,
+		disconnect,
+		discovery: state._tag === "Disconnected" ? state.discovery : null,
+		providers: snapshotOf(state)?.providers ?? [],
+		refresh: load,
+		retry,
+		reuse,
+		select,
+		snapshot: snapshotOf(state),
 		state
 	};
 }
-const evidenceNote = (evidence) => {
-	switch (evidence._tag) {
-		case "Mismatch":
-		case "Unavailable": return evidence.message;
-		case "Found":
-		case "Missing": return;
-		default: return evidence;
-	}
-};
-const observationGroups = (observation) => [{
-	evidence: observation.provider,
-	label: "Provider"
-}, {
-	evidence: observation.publicDns,
-	label: "Public DNS"
-}].filter((group) => group.evidence.length > 0);
-function Root({ status, ...props }) {
-	return usePart("div", props, { status }, {
-		"data-domainkit-part": "verification-status",
-		"data-state": status
+function Root$2({ controller, ...props }) {
+	return usePart("div", props, { status: controller.state._tag }, {
+		"data-domainkit-part": "connection-root",
+		"data-state": controller.state._tag
 	});
 }
-function Evidence({ observation }) {
-	return /* @__PURE__ */ jsx("div", {
-		"data-domainkit-part": "observation-list",
-		children: observationGroups(observation).map((group) => /* @__PURE__ */ jsxs("section", {
-			"data-domainkit-part": "observation-group",
-			children: [/* @__PURE__ */ jsx("h3", {
-				"data-domainkit-part": "observation-source",
-				children: group.label
-			}), /* @__PURE__ */ jsx("ul", { children: group.evidence.map((evidence, index) => {
-				const note = evidenceNote(evidence);
-				return /* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsxs("div", {
-					"data-domainkit-part": "observation-row",
-					children: [/* @__PURE__ */ jsx("span", {
-						"data-domainkit-part": "observation-record",
-						children: evidence.recordId
-					}), /* @__PURE__ */ jsx(Status$1, { evidence })]
-				}), note === void 0 ? null : /* @__PURE__ */ jsx("p", {
-					"data-domainkit-part": "observation-note",
-					children: note
-				})] }, `${evidence._tag}-${evidence.recordId}-${index}`);
-			}) })]
-		}, group.label))
-	});
-}
-function Outcome({ state }) {
-	if (state._tag !== "Failed") return null;
-	return /* @__PURE__ */ jsx("p", {
+/** The failure sentence, chosen by the error's reason, plus the retry that reason allows. */
+function Outcome$2({ controller, ...props }) {
+	const { messages } = useDomainKit();
+	const readOnly = useReadOnly();
+	const state = controller.state;
+	const element = usePart("p", props, { status: state._tag }, {
+		children: state._tag === "Failure" ? /* @__PURE__ */ jsxs(Fragment, { children: [failure(state.error, messages), readOnly ? null : /* @__PURE__ */ jsxs(Fragment, { children: [" ", /* @__PURE__ */ jsx("button", {
+			"data-domainkit-part": "connection-retry",
+			onClick: controller.retry,
+			type: "button",
+			children: messages.retry
+		})] })] }) : null,
 		"data-domainkit-part": "flow-outcome",
 		"data-tone": "danger",
-		role: "alert",
-		children: state.failure.message
+		role: "alert"
+	});
+	return state._tag === "Failure" ? element : null;
+}
+function Status$2({ controller, ...props }) {
+	const { messages } = useDomainKit();
+	const state = controller.state;
+	const provider = controller.snapshot?.provider ?? "";
+	const text = () => {
+		switch (state._tag) {
+			case "Loading": return messages.loading;
+			case "Submitting": return messages.connecting;
+			case "Redirecting": return messages.redirecting;
+			case "Connected": return messages.connectedTo(provider);
+			case "Reconnect": return messages.reconnectRequired(provider);
+			case "SelectionRequired": return messages.chooseZone;
+			case "Disconnected": return messages.notConnected;
+			case "Failure": return "";
+		}
+	};
+	return usePart("p", props, { status: state._tag }, {
+		children: text(),
+		"data-domainkit-part": "connection-status",
+		"data-state": state._tag,
+		role: state._tag === "Submitting" || state._tag === "Loading" ? "status" : void 0
+	});
+}
+/**
+* One auth method, rendered from its descriptor. A token method draws an input per declared
+* field, so a provider that needs an account id alongside a token needs no code here.
+*/
+function Method({ controller, method, provider }) {
+	const { messages } = useDomainKit();
+	const icons = useIcons();
+	const busy = controller.state._tag === "Submitting";
+	if (method.fields === null) return /* @__PURE__ */ jsx("button", {
+		"data-domainkit-part": method.kind === "oauth" ? "oauth-connect" : "integration-connect",
+		"data-provider": provider.id,
+		disabled: busy,
+		onClick: () => controller.connect({
+			method: method.kind,
+			provider: provider.id
+		}),
+		type: "button",
+		children: messages.connectWith(method.label)
+	});
+	const fields = method.fields;
+	return /* @__PURE__ */ jsxs("form", {
+		"data-domainkit-part": "token-connect",
+		"data-provider": provider.id,
+		onSubmit: (event) => {
+			event.preventDefault();
+			const data = new FormData(event.currentTarget);
+			const values = {};
+			for (const field of fields) {
+				const value = data.get(field.name);
+				if (typeof value === "string" && (value !== "" || field.required)) values[field.name] = value;
+			}
+			controller.connect({
+				method: method.kind,
+				provider: provider.id,
+				values
+			});
+		},
+		children: [
+			fields.map((field) => /* @__PURE__ */ jsxs("label", {
+				"data-domainkit-part": "token-field",
+				children: [/* @__PURE__ */ jsxs("span", {
+					"data-domainkit-part": "token-field-label",
+					children: [messages.fieldLabel(field.name), field.required ? null : /* @__PURE__ */ jsx("span", {
+						"data-domainkit-part": "token-field-optional",
+						children: messages.optionalField
+					})]
+				}), /* @__PURE__ */ jsx("input", {
+					autoComplete: "off",
+					"data-domainkit-part": "token-field-input",
+					name: field.name,
+					required: field.required,
+					type: field.secret ? "password" : "text"
+				})]
+			}, field.name)),
+			method.docsUrl === null ? null : /* @__PURE__ */ jsxs("a", {
+				"data-domainkit-part": "token-docs",
+				href: method.docsUrl,
+				rel: "noreferrer",
+				target: "_blank",
+				children: [messages.getToken, /* @__PURE__ */ jsx("span", {
+					"aria-hidden": "true",
+					"data-icon": "inline-end",
+					children: icons.external
+				})]
+			}),
+			/* @__PURE__ */ jsx("button", {
+				"data-domainkit-part": "token-submit",
+				disabled: busy,
+				type: "submit",
+				children: messages.connectWith(method.label)
+			})
+		]
+	});
+}
+/**
+* Everything a disconnected domain can do: a connection discovery already found, the connections
+* this owner already has, then each provider's declared methods.
+*/
+function Form({ controller, ...props }) {
+	const { messages } = useDomainKit();
+	const state = controller.state;
+	const snapshot = controller.snapshot;
+	const discovery = controller.discovery;
+	const candidates = state._tag === "SelectionRequired" ? state.candidates.map((candidate) => ({
+		...candidate,
+		connectionId: state.connectionId
+	})) : discovery !== null && discovery._tag === "SelectionRequired" ? discovery.candidates : [];
+	const resolved = discovery !== null && discovery._tag === "Resolved" ? discovery : null;
+	const reusable = snapshot?.reusable ?? [];
+	const providers = controller.providers;
+	return usePart("div", props, { status: state._tag }, {
+		children: /* @__PURE__ */ jsxs(Fragment, { children: [
+			resolved === null ? null : /* @__PURE__ */ jsxs("section", {
+				"data-domainkit-part": "discovery-resolved",
+				children: [/* @__PURE__ */ jsx("p", { children: messages.discoveredConnection(resolved.label) }), /* @__PURE__ */ jsx("button", {
+					"data-domainkit-part": "attach-target",
+					onClick: () => controller.reuse({
+						connectionId: resolved.connectionId,
+						zone: resolved.zone
+					}),
+					type: "button",
+					children: messages.useConnection(resolved.label)
+				})]
+			}),
+			candidates.length === 0 ? null : /* @__PURE__ */ jsxs("section", {
+				"data-domainkit-part": "discovery-candidates",
+				children: [/* @__PURE__ */ jsx("p", { children: state._tag === "SelectionRequired" ? messages.chooseZone : messages.discoveryAmbiguous }), /* @__PURE__ */ jsx("div", {
+					"data-domainkit-part": "target-list",
+					"data-state": "ambiguous",
+					children: candidates.map((candidate) => /* @__PURE__ */ jsx("button", {
+						"data-domainkit-part": "attach-target",
+						onClick: () => controller.reuse({
+							connectionId: candidate.connectionId,
+							zone: candidate.zone
+						}),
+						type: "button",
+						children: messages.useConnection(candidate.label)
+					}, `${candidate.connectionId}:${candidate.zone}`))
+				})]
+			}),
+			reusable.length === 0 ? null : /* @__PURE__ */ jsxs("section", {
+				"data-domainkit-part": "reusable-connection",
+				children: [/* @__PURE__ */ jsx("div", {
+					"data-domainkit-part": "reusable-connection-heading",
+					children: /* @__PURE__ */ jsx("strong", { children: messages.reusableConnections })
+				}), reusable.map((connection) => /* @__PURE__ */ jsx("button", {
+					"data-connection-id": connection.connectionId,
+					"data-domainkit-part": "attach-target",
+					onClick: () => controller.reuse({ connectionId: connection.connectionId }),
+					type: "button",
+					children: messages.useConnection(connection.provider)
+				}, connection.connectionId))]
+			}),
+			providers.length === 0 ? /* @__PURE__ */ jsx("p", {
+				"data-domainkit-part": "target-unavailable",
+				children: messages.noProviders
+			}) : providers.map((provider) => /* @__PURE__ */ jsxs("section", {
+				"data-domainkit-part": "provider-authentication",
+				children: [/* @__PURE__ */ jsxs("div", {
+					"data-domainkit-part": "provider-heading",
+					children: [/* @__PURE__ */ jsx(Mark, { provider }), /* @__PURE__ */ jsx("strong", { children: provider.name })]
+				}), provider.methods.map((method) => /* @__PURE__ */ jsx(Method, {
+					controller,
+					method,
+					provider
+				}, `${provider.id}:${method.kind}`))]
+			}, provider.id))
+		] }),
+		"data-domainkit-part": "connection-form"
+	});
+}
+/** The connect surface. Without `render` it is a Base UI dialog behind `trigger`. */
+function Dialog$2({ children, controller, render, title, trigger }) {
+	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
+	const readOnly = useReadOnly();
+	const [open, setOpen] = useState(false);
+	const busy = controller.state._tag === "Submitting";
+	const snapshot = controller.snapshot;
+	const provider = snapshot?.provider;
+	const heading = title ?? (provider === null || provider === void 0 ? messages.connectAnyTitle : messages.connectTitle(provider));
+	const body = children ?? /* @__PURE__ */ jsx(Form, { controller });
+	if (readOnly) return /* @__PURE__ */ jsx(Fragment, {});
+	if (render !== void 0) return /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("button", {
+		"data-domainkit-part": "connection-trigger",
+		onClick: () => setOpen(!open),
+		type: "button",
+		children: trigger ?? messages.connect
+	}), render({
+		children: body,
+		open
+	})] });
+	return /* @__PURE__ */ jsxs(Dialog.Root, {
+		onOpenChange: (next, details) => {
+			if (!next && busy) {
+				details.cancel();
+				return;
+			}
+			setOpen(next);
+		},
+		open,
+		children: [/* @__PURE__ */ jsx(Dialog.Trigger, {
+			"data-domainkit-part": "connection-trigger",
+			children: trigger ?? messages.connect
+		}), /* @__PURE__ */ jsxs(Dialog.Portal, {
+			container: portalContainer,
+			children: [/* @__PURE__ */ jsx(Dialog.Backdrop, {
+				"data-color-scheme": colorScheme,
+				"data-domainkit-part": "dialog-backdrop",
+				"data-domainkit-root": "",
+				style: themeStyle
+			}), /* @__PURE__ */ jsxs(Dialog.Popup, {
+				"data-color-scheme": colorScheme,
+				"data-domainkit-part": "connection-dialog",
+				"data-domainkit-root": "",
+				style: themeStyle,
+				children: [
+					/* @__PURE__ */ jsxs("div", {
+						"data-domainkit-part": "dialog-header",
+						children: [/* @__PURE__ */ jsxs("div", {
+							"data-domainkit-part": "dialog-heading",
+							children: [/* @__PURE__ */ jsx(Dialog.Title, {
+								"data-domainkit-part": "dialog-title",
+								children: heading
+							}), /* @__PURE__ */ jsx(Dialog.Description, {
+								"data-domainkit-part": "dialog-description",
+								children: messages.connectDescription(snapshot?.domain ?? "")
+							})]
+						}), busy ? null : /* @__PURE__ */ jsx(Dialog.Close, {
+							"aria-label": messages.close,
+							"data-domainkit-part": "dialog-close",
+							children: "×"
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						"data-domainkit-part": "dialog-body",
+						children: [
+							/* @__PURE__ */ jsx(Status$2, { controller }),
+							body,
+							/* @__PURE__ */ jsx(Outcome$2, { controller })
+						]
+					}),
+					busy ? null : /* @__PURE__ */ jsx("div", {
+						"data-domainkit-part": "dialog-footer",
+						children: /* @__PURE__ */ jsx(Dialog.Close, {
+							"data-domainkit-part": "dialog-cancel",
+							children: messages.cancel
+						})
+					})
+				]
+			})]
+		})]
+	});
+}
+/** A connected domain: which provider holds it, and how to let it go. */
+function Card({ controller, ...props }) {
+	const { messages } = useDomainKit();
+	const readOnly = useReadOnly();
+	const state = controller.state;
+	const snapshot = controller.snapshot;
+	const provider = controller.providers.find((entry) => entry.id === snapshot?.provider);
+	return usePart("div", props, { status: state._tag }, {
+		children: /* @__PURE__ */ jsxs(Fragment, { children: [
+			/* @__PURE__ */ jsxs("div", {
+				"data-domainkit-part": "connected-identity",
+				children: [provider === void 0 ? null : /* @__PURE__ */ jsx(Mark, { provider }), /* @__PURE__ */ jsx(Status$2, { controller })]
+			}),
+			readOnly ? null : /* @__PURE__ */ jsxs("div", {
+				"data-domainkit-part": "connected-actions",
+				children: [/* @__PURE__ */ jsx("button", {
+					"data-domainkit-part": "disconnect-trigger",
+					disabled: state._tag === "Submitting",
+					onClick: controller.detach,
+					type: "button",
+					children: messages.detach
+				}), /* @__PURE__ */ jsx("button", {
+					"data-domainkit-part": "disconnect-action",
+					disabled: state._tag === "Submitting",
+					onClick: controller.disconnect,
+					type: "button",
+					children: messages.disconnect
+				})]
+			}),
+			/* @__PURE__ */ jsx(Outcome$2, { controller })
+		] }),
+		"data-domainkit-part": "connected-card"
+	});
+}
+/** Connection on its own: the card once connected, the dialog until then. */
+function Flow$2({ domain, returnTo, ...props }) {
+	const controller = useController$2({
+		domain,
+		...returnTo === void 0 ? {} : { returnTo }
+	});
+	const state = controller.state;
+	return /* @__PURE__ */ jsx(Root$2, {
+		controller,
+		...props,
+		children: state._tag === "Connected" ? /* @__PURE__ */ jsx(Card, { controller }) : /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Dialog$2, { controller }), /* @__PURE__ */ jsx(Outcome$2, { controller })] })
+	});
+}
+//#endregion
+//#region src/provision.tsx
+var provision_exports = /* @__PURE__ */ __exportAll({
+	Actions: () => Actions,
+	Dialog: () => Dialog$1,
+	Flow: () => Flow$1,
+	Outcome: () => Outcome$1,
+	Root: () => Root$1,
+	State: () => State$2,
+	Status: () => Status$1,
+	useController: () => useController$1
+});
+/** Plan, approve, apply. `approve` authorizes the digest and applies it in the same action. */
+/**
+* Requirements identify themselves by content, so an inline array does not abandon the attempt.
+* Every field counts: a plan turns on `policy`, and `ttl` and `purpose` ride the wire with it.
+*/
+const keyOf = (domain, requirements) => [domain, requirementsKey(requirements)].join("|");
+function useController$1({ domain, onApplied, requirements }) {
+	const { transport } = useDomainKit();
+	const group = transport.provisioning;
+	return useAttempt({
+		domain,
+		key: keyOf(domain, requirements),
+		done: (receipt) => Event.Applied({
+			domain,
+			receipt
+		}),
+		group,
+		onDone: onApplied,
+		plan: useCallback(() => group === void 0 ? null : group.plan({
+			domain,
+			requirements
+		}), [
+			domain,
+			group,
+			requirements
+		])
+	});
+}
+function Root$1({ controller, ...props }) {
+	return usePart("div", props, { status: controller.state._tag }, {
+		"data-domainkit-part": "provisioning-flow",
+		"data-state": controller.state._tag
+	});
+}
+function Dialog$1(props) {
+	return /* @__PURE__ */ jsx(Dialog$4, {
+		...props,
+		kind: "provisioning"
+	});
+}
+/** Approve and Decline for a plan already under review. */
+function Actions(props) {
+	return /* @__PURE__ */ jsx(Actions$2, {
+		...props,
+		kind: "provisioning"
+	});
+}
+function Outcome$1(props) {
+	return /* @__PURE__ */ jsx(Outcome$4, {
+		...props,
+		kind: "provisioning"
+	});
+}
+function Status$1(props) {
+	return /* @__PURE__ */ jsx(Status$4, {
+		...props,
+		kind: "provisioning"
+	});
+}
+/** Provisioning on its own: a trigger that plans, then the review dialog. */
+function Flow$1({ domain, onApplied, requirements, trigger, ...props }) {
+	const controller = useController$1({
+		domain,
+		requirements,
+		...onApplied === void 0 ? {} : { onApplied }
+	});
+	return /* @__PURE__ */ jsxs(Root$1, {
+		controller,
+		...props,
+		children: [/* @__PURE__ */ jsx(Dialog$1, {
+			controller,
+			...trigger === void 0 ? {} : { trigger }
+		}), /* @__PURE__ */ jsx(Outcome$1, { controller })]
+	});
+}
+//#endregion
+//#region src/verify.tsx
+var verify_exports = /* @__PURE__ */ __exportAll({
+	Evidence: () => Evidence,
+	ObserveAction: () => ObserveAction,
+	Outcome: () => Outcome,
+	Root: () => Root,
+	State: () => State,
+	Status: () => Status,
+	useController: () => useController
+});
+/**
+* What the observer read back for the requirement's name, or `null` when it read nothing back at
+* all. Host evidence reports a status the host reached rather than values read off a name, and an
+* `unknown` observation is a lookup that never answered, which is not the same as finding nothing.
+*/
+const valuesOf = (evidence) => evidence._tag === "Host" || evidence.status === "unknown" ? null : evidence.values;
+const State = Data.taggedEnum();
+const readinessOf = (state) => state._tag === "Idle" ? null : state.readiness;
+/** Observe once on mount, then follow the readiness's own `nextCheckAt` while polling is on. */
+function useController({ domain, polling = true, requirements }) {
+	const { emit, revision, transport } = useDomainKit();
+	const verification = transport.verification;
+	const runner = useRunner();
+	const [state, setState] = useState(State.Idle());
+	const timer = useRef(void 0);
+	const signature = requirements === void 0 ? null : requirementsKey(requirements);
+	const requested = useMemo(() => requirements === void 0 ? void 0 : { requirements }, [signature]);
+	const [observed, setObserved] = useState(domain);
+	if (observed !== domain) {
+		setObserved(domain);
+		setState(State.Idle());
+	}
+	const observe = useCallback(() => {
+		if (verification === void 0) return;
+		clearTimeout(timer.current);
+		setState((previous) => State.Observing({ readiness: readinessOf(previous) }));
+		runner.run(requested === void 0 ? verification.observe(domain) : verification.observe(domain, requested), {
+			onFailure: (error) => {
+				setState((previous) => State.Failure({
+					error,
+					readiness: readinessOf(previous)
+				}));
+				emit(Event.Failed({
+					domain,
+					error
+				}));
+			},
+			onSuccess: (readiness) => setState(State.Observed({ readiness }))
+		});
+	}, [
+		domain,
+		emit,
+		requested,
+		runner,
+		verification
+	]);
+	useEffect(() => {
+		observe();
+	}, [observe, revision]);
+	useEffect(() => {
+		if (!polling || state._tag !== "Observed") return;
+		const next = state.readiness.nextCheckAt;
+		if (next === null) return;
+		const delay = Math.max(0, DateTime.toEpochMillis(next) - Date.now());
+		timer.current = setTimeout(observe, delay);
+		return () => clearTimeout(timer.current);
+	}, [
+		observe,
+		polling,
+		state
+	]);
+	useEffect(() => () => clearTimeout(timer.current), []);
+	return {
+		observe,
+		polling,
+		readiness: readinessOf(state),
+		retry: observe,
+		state
+	};
+}
+function Root({ controller, ...props }) {
+	const overall = controller.readiness?.overall ?? null;
+	return usePart("div", props, { status: controller.state._tag }, {
+		"data-domainkit-part": "verification-status",
+		"data-overall": overall ?? void 0,
+		"data-state": controller.state._tag
 	});
 }
 function ObserveAction({ controller, ...props }) {
@@ -1640,402 +2152,292 @@ function ObserveAction({ controller, ...props }) {
 	const observing = controller.state._tag === "Observing";
 	return usePart("button", props, { status: controller.state._tag }, {
 		"aria-busy": observing,
-		children: messages.checkDns,
+		children: controller.readiness === null ? messages.checkDns : messages.checkAgain,
 		"data-domainkit-part": "observe-action",
 		"data-loading": observing ? "" : void 0,
 		disabled: observing,
-		onClick: () => controller.observe(),
+		onClick: controller.observe,
 		type: "button"
 	});
 }
-function Status({ config, ...props }) {
-	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
-	const controller = useController(config);
+/** Evidence carries no id; its source and position identify it within one requirement. */
+const evidenceKey = (evidence, index) => [evidence._tag, index].join("-");
+/**
+* Per-requirement readiness and, below it, the host's own evidence: an SES identity, a certificate,
+* anything DomainKit cannot observe but the host feeds in.
+*/
+function Evidence({ readiness }) {
+	const { messages } = useDomainKit();
+	const icons = useIcons();
+	return /* @__PURE__ */ jsxs("div", {
+		"data-domainkit-part": "observation-list",
+		children: [readiness.requirements.map((requirement) => {
+			const settled = requirement.status === "satisfied";
+			return /* @__PURE__ */ jsxs("section", {
+				"data-domainkit-part": "observation-group",
+				children: [
+					/* @__PURE__ */ jsxs("div", {
+						"data-domainkit-part": "observation-row",
+						children: [/* @__PURE__ */ jsxs("span", {
+							"data-domainkit-part": "observation-record",
+							children: [
+								messages.recordType(requirement.record),
+								" ",
+								requirement.record.name
+							]
+						}), /* @__PURE__ */ jsx(Status$5, { status: requirement.status })]
+					}),
+					settled ? null : /* @__PURE__ */ jsx("p", {
+						"data-domainkit-part": "observation-expected",
+						children: messages.expectedValue(DnsRecord.data(requirement.record))
+					}),
+					/* @__PURE__ */ jsx("ul", { children: requirement.evidence.map((evidence, index) => {
+						const values = settled ? null : valuesOf(evidence);
+						return /* @__PURE__ */ jsxs("li", {
+							"data-domainkit-part": "observation-source",
+							children: [
+								messages.evidenceSource(evidence),
+								values === null ? null : /* @__PURE__ */ jsx("span", {
+									"data-domainkit-part": "observation-observed",
+									children: values.length === 0 ? messages.observedNothing : messages.observedValues(values)
+								}),
+								evidence.detail === null ? null : /* @__PURE__ */ jsx("p", {
+									"data-domainkit-part": "observation-note",
+									children: evidence.detail
+								})
+							]
+						}, evidenceKey(evidence, index));
+					}) })
+				]
+			}, identity(requirement.record));
+		}), readiness.host.length === 0 ? null : /* @__PURE__ */ jsxs("section", {
+			"data-domainkit-part": "observation-group",
+			"data-source": "host",
+			children: [/* @__PURE__ */ jsx("h3", {
+				"data-domainkit-part": "observation-source",
+				children: messages.hostEvidence
+			}), /* @__PURE__ */ jsx("ul", { children: readiness.host.map((evidence, index) => /* @__PURE__ */ jsxs("li", {
+				"data-domainkit-part": "host-evidence",
+				children: [
+					/* @__PURE__ */ jsx("span", {
+						"aria-hidden": "true",
+						"data-icon": "inline-start",
+						children: evidence.status === "ok" ? icons.success : evidence.status === "pending" ? icons.pending : icons.failure
+					}),
+					/* @__PURE__ */ jsx("span", {
+						"data-domainkit-part": "observation-record",
+						children: evidence.label
+					}),
+					/* @__PURE__ */ jsx("span", {
+						"data-domainkit-part": "record-status",
+						"data-status": evidence.status,
+						children: messages.hostEvidenceStatus(evidence.status)
+					}),
+					evidence.detail === null ? null : /* @__PURE__ */ jsx("p", {
+						"data-domainkit-part": "observation-note",
+						children: evidence.detail
+					})
+				]
+			}, `${evidence.source}-${index}`)) })]
+		})]
+	});
+}
+function Outcome({ controller, ...props }) {
+	const { messages } = useDomainKit();
 	const state = controller.state;
-	const observation = state._tag === "Observation" ? state : state._tag === "Observing" || state._tag === "Failed" ? state.previous : void 0;
+	const element = usePart("p", props, { status: state._tag }, {
+		children: state._tag === "Failure" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+			failure(state.error, messages),
+			" ",
+			/* @__PURE__ */ jsx("button", {
+				"data-domainkit-part": "verification-retry",
+				onClick: controller.retry,
+				type: "button",
+				children: messages.retry
+			})
+		] }) : null,
+		"data-domainkit-part": "flow-outcome",
+		"data-tone": "danger",
+		role: "alert"
+	});
+	return state._tag === "Failure" ? element : null;
+}
+/** The default verification slot: a button that observes, with the evidence behind it. */
+function Status({ controller, render, ...props }) {
+	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
+	const readiness = controller.readiness;
+	const body = /* @__PURE__ */ jsxs(Fragment, { children: [
+		controller.state._tag === "Observing" ? /* @__PURE__ */ jsx("p", {
+			"data-domainkit-part": "verification-progress",
+			role: "status",
+			children: messages.observing
+		}) : null,
+		readiness === null ? /* @__PURE__ */ jsx("p", {
+			"data-domainkit-part": "verification-progress",
+			children: messages.noEvidence
+		}) : /* @__PURE__ */ jsx(Evidence, { readiness }),
+		/* @__PURE__ */ jsx(Outcome, { controller })
+	] });
 	return /* @__PURE__ */ jsx(Root, {
-		status: state._tag,
+		controller,
 		...props,
-		children: /* @__PURE__ */ jsxs(Popover.Root, { children: [/* @__PURE__ */ jsx(Popover.Trigger, { render: /* @__PURE__ */ jsx(ObserveAction, { controller }) }), /* @__PURE__ */ jsx(Popover.Portal, {
+		children: render === void 0 ? /* @__PURE__ */ jsxs(Popover.Root, { children: [/* @__PURE__ */ jsx(Popover.Trigger, { render: /* @__PURE__ */ jsx(ObserveAction, { controller }) }), /* @__PURE__ */ jsx(Popover.Portal, {
 			container: portalContainer,
 			children: /* @__PURE__ */ jsx(Popover.Positioner, {
 				align: "end",
 				"data-domainkit-part": "verification-positioner",
 				sideOffset: 6,
 				children: /* @__PURE__ */ jsxs(Popover.Popup, {
+					"aria-busy": controller.state._tag === "Observing",
 					"aria-label": messages.checkDns,
-					"aria-busy": state._tag === "Observing",
 					"data-color-scheme": colorScheme,
 					"data-domainkit-part": "verification-popover",
 					"data-domainkit-root": "",
 					style: themeStyle,
-					children: [
-						/* @__PURE__ */ jsx(Popover.Arrow, { "data-domainkit-part": "verification-arrow" }),
-						state._tag === "Observing" ? /* @__PURE__ */ jsx("p", {
-							"data-domainkit-part": "verification-progress",
-							role: "status",
-							children: messages.checkingDns
-						}) : null,
-						observation === void 0 ? null : /* @__PURE__ */ jsx(Evidence, { observation }),
-						/* @__PURE__ */ jsx(Outcome, { state })
-					]
+					children: [/* @__PURE__ */ jsx(Popover.Arrow, { "data-domainkit-part": "verification-arrow" }), body]
 				})
 			})
+		})] }) : /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(ObserveAction, { controller }), render({
+			children: body,
+			open: controller.state._tag !== "Idle"
 		})] })
 	});
 }
 //#endregion
 //#region src/domain.tsx
 var domain_exports = /* @__PURE__ */ __exportAll({ Flow: () => Flow });
-function Flow({ domain, receiptId, records }) {
-	const controller = useController$2(domain);
-	const state = controller.state;
-	const connected = state._tag === "Connected" ? state : state._tag === "Detaching" ? state.snapshot : void 0;
-	return /* @__PURE__ */ jsxs(Root$3, {
-		status: state._tag,
-		children: [
-			state._tag === "Connected" || state._tag === "Detaching" ? /* @__PURE__ */ jsx(ConnectedCard, {
-				connection: state._tag === "Connected" ? state : state.snapshot,
-				controller,
-				...receiptId === void 0 ? {} : { initialReceiptId: receiptId },
-				records,
-				status: state._tag
-			}) : /* @__PURE__ */ jsx(AvailableCard, {
-				controller,
-				state
-			}),
-			/* @__PURE__ */ jsx(Table, { records }),
-			/* @__PURE__ */ jsx(Status, { config: {
-				...connected === void 0 ? {} : { connection: connected },
-				domain,
-				records
-			} })
-		]
-	});
+function DefaultConnection({ controller }) {
+	return controller.state._tag === "Connected" ? /* @__PURE__ */ jsx(Card, { controller }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+		/* @__PURE__ */ jsx(Status$2, { controller }),
+		/* @__PURE__ */ jsx(Dialog$2, { controller }),
+		/* @__PURE__ */ jsx(Outcome$2, { controller })
+	] });
 }
-function AvailableCard({ controller, state }) {
-	const { messages } = useDomainKit();
-	const snapshot = state._tag === "Disconnected" ? state : state._tag === "Submitting" || state._tag === "Redirecting" ? state.snapshot : void 0;
-	return /* @__PURE__ */ jsxs(Card$1, {
-		status: state._tag,
-		children: [/* @__PURE__ */ jsxs(CardIdentity, {
-			status: state._tag,
-			children: [snapshot === void 0 ? null : /* @__PURE__ */ jsx(Mark, { provider: snapshot.provider }), /* @__PURE__ */ jsx(Status$2, { state })]
-		}), /* @__PURE__ */ jsxs(CardActions, {
-			status: state._tag,
-			children: [state._tag === "Failure" && state.retry !== "never" ? /* @__PURE__ */ jsx(RetryAction$1, {
-				controller,
-				kind: state.retry === "after-user-action" ? "after-user-action" : "retry"
-			}) : null, snapshot === void 0 ? null : /* @__PURE__ */ jsxs(Dialog.Root, {
-				onOpenChange: (open, eventDetails) => {
-					if (!open && (state._tag === "Submitting" || state._tag === "Redirecting")) eventDetails.cancel();
-				},
-				children: [/* @__PURE__ */ jsx(ConnectTrigger, {
-					disabled: state._tag === "Submitting" || state._tag === "Redirecting",
-					provider: snapshot.provider,
-					children: messages.connectProvider(snapshot.provider.name)
-				}), /* @__PURE__ */ jsx(Dialog$2, {
-					controller,
-					snapshot
-				})]
-			})]
-		})]
+function DefaultActions({ cleanup, connection, provisioning }) {
+	const { capabilities, messages } = useDomainKit();
+	const readOnly = useReadOnly();
+	const icons = useIcons();
+	const connected = connection.state._tag === "Connected";
+	if (readOnly) return null;
+	const hasReceipt = connection.snapshot?.lastReceiptId != null;
+	return /* @__PURE__ */ jsxs(Fragment, { children: [capabilities.includes("provisioning") && connected ? /* @__PURE__ */ jsxs(Fragment, { children: [
+		/* @__PURE__ */ jsx("button", {
+			"data-domainkit-part": "plan-trigger",
+			disabled: provisioning.state._tag === "Planning",
+			onClick: provisioning.plan,
+			type: "button",
+			children: messages.reviewChanges
+		}),
+		/* @__PURE__ */ jsx(Status$1, { controller: provisioning }),
+		/* @__PURE__ */ jsx(Actions, { controller: provisioning }),
+		/* @__PURE__ */ jsx(Outcome$1, { controller: provisioning })
+	] }) : null, capabilities.includes("cleanup") && connected && hasReceipt ? /* @__PURE__ */ jsxs(Fragment, { children: [
+		/* @__PURE__ */ jsxs("button", {
+			"data-domainkit-part": "cleanup-trigger",
+			disabled: cleanup.state._tag === "Planning",
+			onClick: cleanup.plan,
+			type: "button",
+			children: [/* @__PURE__ */ jsx("span", {
+				"aria-hidden": "true",
+				"data-icon": "inline-start",
+				children: icons.close
+			}), messages.cleanUp]
+		}),
+		/* @__PURE__ */ jsx(Status$3, { controller: cleanup }),
+		/* @__PURE__ */ jsx(Actions$1, { controller: cleanup }),
+		/* @__PURE__ */ jsx(Outcome$3, { controller: cleanup })
+	] }) : null] });
+}
+/**
+* The whole lifecycle for one domain: connect, review, apply, observe, clean up. The flow renders
+* only what the transport declares, and every part of it is a slot with a default. It adds no
+* layout containers of its own, so a host's grid can place the slot output directly.
+*/
+function Flow({ domain, onApplied, onCleaned, readOnly, requirements, returnTo, slots = {}, ...props }) {
+	const { capabilities } = useDomainKit();
+	const inherited = useReadOnly();
+	const connection = useController$2({
+		domain,
+		...returnTo === void 0 ? {} : { returnTo }
 	});
-}
-function ConnectedCard({ connection, controller, initialReceiptId, records, status }) {
-	const [receipt, setReceipt] = useState({
-		host: initialReceiptId,
-		value: initialReceiptId
+	const refresh = connection.refresh;
+	const provisioning = useController$1({
+		domain,
+		onApplied: useCallback((receipt) => {
+			refresh();
+			onApplied?.(receipt);
+		}, [onApplied, refresh]),
+		requirements
+	});
+	const cleanup = useController$3({
+		domain,
+		onCleaned: useCallback((receipt) => {
+			refresh();
+			onCleaned?.(receipt);
+		}, [onCleaned, refresh]),
+		...connection.snapshot?.lastReceiptId == null ? {} : { receiptId: Receipt.ReceiptId.make(connection.snapshot.lastReceiptId) }
 	});
-	if (receipt.host !== initialReceiptId) setReceipt({
-		host: initialReceiptId,
-		value: initialReceiptId
+	const verification = useController({
+		domain,
+		requirements
 	});
-	const receiptId = receipt.host === initialReceiptId ? receipt.value : initialReceiptId;
-	const disabled = status === "Detaching";
-	const actionsTriggerRef = useRef(null);
-	return /* @__PURE__ */ jsxs(Card$1, {
-		status,
-		children: [/* @__PURE__ */ jsxs(CardIdentity, {
-			status,
-			children: [/* @__PURE__ */ jsx(Mark, { provider: connection.provider }), /* @__PURE__ */ jsx(Status$2, { state: status === "Connected" ? connection : controller.state })]
-		}), /* @__PURE__ */ jsxs(CardActions, {
-			status,
-			children: [/* @__PURE__ */ jsx(Flow$1, {
-				connection,
-				onApplied: (result) => setReceipt({
-					host: initialReceiptId,
-					value: result.receiptId
+	const readiness = verification.readiness;
+	return usePart("div", props, {
+		connection: connection.state._tag,
+		provisioning: provisioning.state._tag
+	}, {
+		children: /* @__PURE__ */ jsxs(ReadOnly, {
+			value: readOnly ?? inherited,
+			children: [
+				!capabilities.includes("connection") ? null : slots.connection === void 0 ? /* @__PURE__ */ jsx(DefaultConnection, {
+					controller: connection,
+					domain
+				}) : slots.connection({
+					controller: connection,
+					domain
 				}),
-				records,
-				showRecords: false
-			}), receiptId === void 0 ? /* @__PURE__ */ jsx(ProviderActions, {
-				actionsTriggerRef,
-				connection,
-				controller,
-				disabled
-			}) : /* @__PURE__ */ jsx(ProviderActionsWithCleanup, {
-				actionsTriggerRef,
-				connection,
-				controller,
-				disabled,
-				onCleaned: () => setReceipt({
-					host: initialReceiptId,
-					value: void 0
+				slots.records === void 0 ? /* @__PURE__ */ jsx(Table, {
+					readiness,
+					records: requirements
+				}) : slots.records({
+					controller: verification,
+					domain,
+					readiness,
+					records: requirements
 				}),
-				receiptId
-			}, receiptId)]
-		})]
-	});
-}
-function ProviderActionsWithCleanup({ actionsTriggerRef, connection, controller, disabled, onCleaned, receiptId }) {
-	const [cleaned, setCleaned] = useState(false);
-	const cleanup = useController$3(connection, receiptId, (result) => {
-		if (result._tag === "Cleaned") setCleaned(true);
-	});
-	return /* @__PURE__ */ jsx(ProviderActions, {
-		actionsTriggerRef,
-		cleanup,
-		connection,
-		controller,
-		disabled,
-		onCleanupCloseComplete: () => {
-			if (cleaned) onCleaned();
-		}
-	});
-}
-function ProviderActions({ actionsTriggerRef: actionsTriggerRefProp, cleanup, connection, controller, disabled, onCleanupCloseComplete }) {
-	const { colorScheme, messages, portalContainer, themeStyle } = useDomainKit();
-	const fallbackActionsTriggerRef = useRef(null);
-	const actionsTriggerRef = actionsTriggerRefProp ?? fallbackActionsTriggerRef;
-	const [menuOpen, setMenuOpen] = useState(false);
-	const [disconnectOpen, setDisconnectOpen] = useState(false);
-	return /* @__PURE__ */ jsxs(Fragment, { children: [
-		/* @__PURE__ */ jsxs(Menu.Root, {
-			disabled,
-			modal: false,
-			onOpenChange: setMenuOpen,
-			open: menuOpen,
-			children: [/* @__PURE__ */ jsx(Menu.Trigger, {
-				"aria-label": messages.moreActions,
-				"data-domainkit-part": "actions-trigger",
-				ref: actionsTriggerRef,
-				children: /* @__PURE__ */ jsx("span", {
-					"aria-hidden": "true",
-					children: "⋯"
-				})
-			}), /* @__PURE__ */ jsx(Menu.Portal, {
-				container: portalContainer,
-				keepMounted: true,
-				children: /* @__PURE__ */ jsx(Menu.Positioner, {
-					align: "end",
-					sideOffset: 6,
-					children: /* @__PURE__ */ jsxs(Menu.Popup, {
-						"data-color-scheme": colorScheme,
-						"data-domainkit-part": "actions-menu",
-						"data-domainkit-root": "",
-						style: themeStyle,
-						children: [cleanup === void 0 ? null : /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Menu.Item, {
-							closeOnClick: false,
-							"data-domainkit-part": "actions-item",
-							nativeButton: true,
-							onClickCapture: () => {
-								setMenuOpen(false);
-								queueMicrotask(() => cleanup.plan());
-							},
-							render: /* @__PURE__ */ jsx("button", { type: "button" }),
-							children: messages.reviewCleanup
-						}), /* @__PURE__ */ jsx(Menu.Separator, { "data-domainkit-part": "actions-separator" })] }), /* @__PURE__ */ jsx(Menu.Item, {
-							closeOnClick: false,
-							"data-domainkit-part": "actions-item",
-							"data-tone": "danger",
-							nativeButton: true,
-							onClickCapture: () => {
-								setMenuOpen(false);
-								queueMicrotask(() => setDisconnectOpen(true));
-							},
-							render: /* @__PURE__ */ jsx("button", { type: "button" }),
-							children: messages.disconnectDomain
-						})]
-					})
+				!capabilities.includes("verification") ? null : slots.verification === void 0 ? /* @__PURE__ */ jsx(Status, { controller: verification }) : slots.verification({
+					controller: verification,
+					domain
+				}),
+				slots.actions === void 0 ? /* @__PURE__ */ jsx(DefaultActions, {
+					cleanup,
+					connection,
+					domain,
+					provisioning
+				}) : slots.actions({
+					cleanup,
+					connection,
+					domain,
+					provisioning
 				})
-			})]
-		}),
-		cleanup === void 0 ? null : /* @__PURE__ */ jsx(Dialog$3, {
-			controller: cleanup,
-			onOpenChangeComplete: (open) => {
-				if (!open) {
-					onCleanupCloseComplete?.();
-					queueMicrotask(() => actionsTriggerRef.current?.focus());
-				}
-			},
-			trigger: null
+			]
 		}),
-		/* @__PURE__ */ jsx(DisconnectDialog, {
-			connection,
-			controller,
-			onOpenChange: (open) => {
-				setDisconnectOpen(open);
-				if (!open) queueMicrotask(() => actionsTriggerRef.current?.focus());
-			},
-			open: disconnectOpen,
-			trigger: null
-		})
-	] });
+		"data-domainkit-part": "domain-flow",
+		"data-domain": domain
+	});
 }
 //#endregion
 //#region src/testing.ts
-var testing_exports = /* @__PURE__ */ __exportAll({
-	attachment: () => attachment,
-	connected: () => connected,
-	connection: () => connection,
-	makeFakeTransport: () => makeFakeTransport,
-	provider: () => provider,
-	target: () => target
-});
-const provider = (overrides = {}) => ({
-	authentication: [Transport.AuthenticationMethod.OAuth({ label: "Continue with OAuth" }), Transport.AuthenticationMethod.Token({
-		label: "Connect with token",
-		placeholder: "Paste API token"
-	})],
-	id: "cloudflare",
-	name: "Cloudflare",
-	...overrides
-});
-const target = (overrides = {}) => ({
-	accountId: "account-1",
-	accountKind: "account",
-	zoneId: "zone-1",
-	zoneName: DomainName.parse("example.com"),
-	...overrides
-});
-const connection = (overrides = {}) => ({
-	createdAt: /* @__PURE__ */ new Date("2026-08-30T00:00:00.000Z"),
-	id: "connection-1",
-	method: "oauth2",
-	ownerId: "organization-1",
-	providerId: "cloudflare",
-	status: "active",
-	...overrides
-});
-const attachment = (overrides = {}) => ({
-	connectionId: "connection-1",
-	createdAt: /* @__PURE__ */ new Date("2026-08-30T00:00:00.000Z"),
-	domain: DomainName.parse("mail.example.com"),
-	id: "attachment-1",
-	target: target(),
-	...overrides
-});
-const connected = (overrides = {}) => Transport.Connected({
-	attachment: attachment(),
-	connection: connection(),
-	provider: provider(),
-	...overrides
-});
-function makeFakeTransport(options) {
-	const calls = {
-		apply: [],
-		attach: [],
-		cleanupApply: [],
-		cleanupPlan: [],
-		connect: [],
-		detach: [],
-		inspect: [],
-		observe: [],
-		plan: []
-	};
-	const inspections = Array.isArray(options.inspect) ? [...options.inspect] : [options.inspect];
-	const transport = {
-		cleanup: {
-			apply: async (input) => {
-				calls.cleanupApply.push(input);
-				return options.cleanupApply ?? Transport.CleanupResult.Cleaned({
-					operationId: "cleanup-operation-1",
-					results: []
-				});
-			},
-			plan: async (input) => {
-				calls.cleanupPlan.push(input);
-				return options.cleanupPlan ?? Transport.CleanupPlan({
-					digest: "cleanup-digest-1",
-					expiresAt: "2099-01-01T00:00:00.000Z",
-					operations: []
-				});
-			}
-		},
-		connection: {
-			connect: async (input) => {
-				calls.connect.push(input);
-				return options.connect ?? Transport.Connected({
-					attachment: attachment({ domain: DomainName.parse(input.domain) }),
-					connection: connection(),
-					provider: provider()
-				});
-			},
-			inspect: async (input) => {
-				calls.inspect.push(input);
-				const snapshot = inspections.shift() ?? inspections.at(-1) ?? options.inspect;
-				if (Array.isArray(snapshot)) throw new Error("Fake inspection sequence is empty");
-				if (snapshot._tag === "Failure") throw new Transport.Failure({
-					message: snapshot.message,
-					operation: snapshot.operation ?? "connection.inspect",
-					retry: snapshot.retry
-				});
-				return snapshot;
-			},
-			attach: async (input) => {
-				calls.attach.push(input);
-				return options.attach ?? Transport.Connected({
-					attachment: attachment({
-						connectionId: input.connectionId,
-						domain: DomainName.parse(input.domain),
-						target: input.target
-					}),
-					connection: connection({ id: input.connectionId }),
-					provider: provider()
-				});
-			},
-			detach: async (input) => {
-				calls.detach.push(input);
-				return options.detach ?? Transport.DetachResult({
-					attachment: attachment(),
-					connection: connection(),
-					remainingAttachments: 0
-				});
-			}
-		},
-		provisioning: {
-			apply: async (input) => {
-				calls.apply.push(input);
-				return options.apply ?? Transport.ApplyResult.Applied({
-					operationId: "apply-operation-1",
-					receiptId: "receipt-1",
-					results: []
-				});
-			},
-			plan: async (input) => {
-				calls.plan.push(input);
-				return options.plan ?? Transport.ProvisioningPlan({
-					digest: "plan-digest-1",
-					expiresAt: "2099-01-01T00:00:00.000Z",
-					operations: input.records.map((record) => Transport.PlanOperation.Create({
-						id: `create-${record.id}`,
-						record
-					}))
-				});
-			}
-		},
-		verification: { observe: async (input) => {
-			calls.observe.push(input);
-			return options.observe ?? Transport.Observation({
-				provider: input.sources.provider ? input.records.map((record) => Transport.ObservationEvidence.Found({ recordId: record.id })) : [],
-				publicDns: input.sources.publicDns ? input.records.map((record) => Transport.ObservationEvidence.Found({ recordId: record.id })) : []
-			});
-		} }
-	};
-	return Object.assign(Transport.layerFromAsync(transport), transport, { calls });
-}
+/**
+* The fake transport `@domainkit/react` tests render against: an in-memory `domainkit/server`
+* with memory storage and a fake provider, recording every call.
+*/
+var testing_exports = /* @__PURE__ */ __exportAll({ transport: () => transport });
+const transport = Testing.transport;
+//#endregion
+//#region src/failure.ts
+const Failure = Data.taggedEnum();
 //#endregion
-export { cleanup_exports as Cleanup, connection_exports as Connection, domain_exports as Domain, domain_kit_exports as DomainKit, lifecycle_exports as Lifecycle, messages_exports as Messages, operations_exports as Operations, provider_exports as Provider, provisioning_exports as Provisioning, records_exports as Records, testing_exports as Testing, theme_exports as Theme, verification_exports as Verification };
+export { cleanup_exports as Cleanup, connect_exports as Connect, domain_exports as Domain, domain_kit_exports as DomainKit, Event, Failure, messages_exports as Messages, operations_exports as Operations, provider_exports as Provider, provision_exports as Provision, records_exports as Records, testing_exports as Testing, theme_exports as Theme, verify_exports as Verify, defaultIcons, useIcons };
 
 //# sourceMappingURL=index.mjs.map