domainkit 0.0.1 → 0.1.0-beta.1

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["decode","Connection.decode","Lifecycle.updateGrant","ConnectionStore.layerFromAsync","Lifecycle.detach","Lifecycle.Error","ProviderAuthorizationStore.layerFromAsync","CredentialStore.layerFromAsync","decode","ProviderAuthorization.decode","decode","ProviderAuth.decode","DnsPlan.decode","DnsPlan.decodeReceipt","create","DeletionEffect.create","DnsProvider.layerFromAsync","authorize","DeletionEffect.authorize","apply","DeletionEffect.apply","OAuthEffect.begin","OAuthStateStore.layerFromAsync","OAuthEffect.complete","ProviderAuthorizationStore.layerFromAsync","ConnectionStore.layerFromAsync","CredentialStore.layerFromAsync","OAuthEffect.refresh","OAuthEffect.revoke","InvalidInputError","DnsProvider.Error","ProvisioningEffect.create","DnsProvider.layerFromAsync","ProvisioningEffect.authorize","ProvisioningEffect.apply","ConnectionAuthorization.authorize","ProvisioningEffect.renderManualInstructions","TokenEffect.connect","InvalidInputError","DnsProvider.Error","ConnectionStore.layerFromAsync","ProviderAuthorizationStore.layerFromAsync","CredentialStore.layerFromAsync","VerificationEffect.record","DnsProvider.layerFromAsync","DnsResolver.layerFromAsync","make","CloudflareDnsOverHttps.toAsync","DnsOverHttps.toAsync","packageJson.version"],"sources":["../src/promise/connection.ts","../src/promise/connection-lifecycle.ts","../src/promise/provider-authorization.ts","../src/promise/provider-auth.ts","../src/promise/dns-record.ts","../src/promise/domain-name.ts","../src/promise/dns-plan.ts","../src/promise/deletion.ts","../src/promise/oauth.ts","../src/promise/provisioning.ts","../src/promise/token.ts","../src/promise/verification.ts","../src/promise/cloudflare-doh.ts","../src/promise/doh.ts","../src/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\n\nexport { assertGrant, AuthorizationError, encode, Grant, Schema } from \"../auth/connection.ts\";\nexport type { Connection, OAuthContinuation, StoredCredential } from \"../auth/connection.ts\";\n\nexport function decode(input: unknown): Promise<Connection.Connection> {\n  return Effect.runPromise(Connection.decode(input));\n}\n","import { Effect, Layer } from \"effect\";\n\nimport type * as Connection from \"../auth/connection.ts\";\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as Lifecycle from \"../auth/connection-lifecycle.ts\";\nimport * as ConnectionStore from \"../stores/connection.ts\";\nimport * as CredentialStore from \"../stores/credential.ts\";\nimport * as ProviderAuthorizationStore from \"../stores/authorization.ts\";\n\nexport function updateGrant(input: {\n  readonly connection: Parameters<typeof Lifecycle.updateGrant>[0][\"connection\"];\n  readonly connectionStore: ConnectionStore.AsyncInterface;\n  readonly grant: Parameters<typeof Lifecycle.updateGrant>[0][\"grant\"];\n}): Promise<Connection.Connection> {\n  return Effect.runPromise(\n    Lifecycle.updateGrant({ connection: input.connection, grant: input.grant }).pipe(\n      Effect.provide(ConnectionStore.layerFromAsync(input.connectionStore)),\n    ),\n  );\n}\n\nexport function detach(input: {\n  readonly authorizationStore: ProviderAuthorizationStore.AsyncInterface;\n  readonly connectionId: string;\n  readonly connectionStore: ConnectionStore.AsyncInterface;\n  readonly credentialStore: CredentialStore.AsyncInterface;\n  readonly revokeAuthorization: (\n    authorization: ProviderAuthorization.ProviderAuthorization,\n  ) => Promise<void>;\n}): Promise<Lifecycle.DetachResult> {\n  return Effect.runPromise(\n    Lifecycle.detach({\n      connectionId: input.connectionId,\n      revokeAuthorization: (authorization) =>\n        Effect.tryPromise({\n          try: () => input.revokeAuthorization(authorization),\n          catch: (cause) =>\n            new Lifecycle.Error({\n              message: cause instanceof globalThis.Error ? cause.message : String(cause),\n            }),\n        }),\n    }).pipe(\n      Effect.provide(\n        Layer.mergeAll(\n          ProviderAuthorizationStore.layerFromAsync(input.authorizationStore),\n          ConnectionStore.layerFromAsync(input.connectionStore),\n          CredentialStore.layerFromAsync(input.credentialStore),\n        ),\n      ),\n    ),\n  );\n}\n\nexport { Error } from \"../auth/connection-lifecycle.ts\";\nexport type { DetachResult } from \"../auth/connection-lifecycle.ts\";\n","import { Effect } from \"effect\";\n\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\n\nexport { Capability, encode, Schema } from \"../auth/authorization.ts\";\nexport type { ProviderAuthorization } from \"../auth/authorization.ts\";\n\nexport function decode(input: unknown): Promise<ProviderAuthorization.ProviderAuthorization> {\n  return Effect.runPromise(ProviderAuthorization.decode(input));\n}\n","import { Effect } from \"effect\";\n\nimport * as ProviderAuth from \"../auth/manifest.ts\";\n\nexport { Method, Schema } from \"../auth/manifest.ts\";\nexport type {\n  AsyncOAuthSubjectResolver as OAuthSubjectResolver,\n  Manifest,\n  OAuthClientConfiguration,\n  OAuthMethod,\n  TokenValidation,\n} from \"../auth/manifest.ts\";\n\nexport function decode(input: unknown): Promise<ProviderAuth.Manifest> {\n  return Effect.runPromise(ProviderAuth.decode(input));\n}\n","export {\n  A,\n  Aaaa,\n  Caa,\n  Cname,\n  data,\n  equals,\n  Mx,\n  Ns,\n  Opaque,\n  Observed,\n  parse,\n  RequirementMetadata,\n  Schema,\n  Srv,\n  Txt,\n  Type,\n} from \"../domain/dns-record.ts\";\nexport type { DnsRecord, Encoded } from \"../domain/dns-record.ts\";\n","export { parse, Schema } from \"../domain/domain-name.ts\";\nexport type { DomainName } from \"../domain/domain-name.ts\";\n","import { Effect } from \"effect\";\n\nimport * as DnsPlan from \"../plan/types.ts\";\n\nexport { Authorization, encode, encodeReceipt, Operation, Receipt, Schema } from \"../plan/types.ts\";\nexport type { ApplyReceipt, DnsPlan, PlanAuthorization } from \"../plan/types.ts\";\n\nexport function decode(input: unknown): Promise<DnsPlan.DnsPlan> {\n  return Effect.runPromise(DnsPlan.decode(input));\n}\n\nexport function decodeReceipt(input: unknown): Promise<DnsPlan.ApplyReceipt> {\n  return Effect.runPromise(DnsPlan.decodeReceipt(input));\n}\n","import { Effect, Layer } from \"effect\";\n\nimport { webCryptoLayer } from \"../plan/canonical-json.ts\";\nimport * as DeletionEffect from \"../plan/deletion.ts\";\nimport type * as DnsPlan from \"../plan/types.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\n\nexport function create(input: {\n  readonly plan: DnsPlan.DnsPlan;\n  readonly provider: DnsProvider.AsyncInterface;\n  readonly receipt: DnsPlan.ApplyReceipt;\n  readonly ttlMs?: number;\n}): Promise<DeletionEffect.Plan> {\n  return Effect.runPromise(\n    DeletionEffect.create({\n      plan: input.plan,\n      receipt: input.receipt,\n      ...(input.ttlMs === undefined ? {} : { ttlMs: input.ttlMs }),\n    }).pipe(\n      Effect.provide(Layer.merge(DnsProvider.layerFromAsync(input.provider), webCryptoLayer)),\n    ),\n  );\n}\n\nexport function authorize(\n  plan: DeletionEffect.Plan,\n  operationIds?: ReadonlyArray<string>,\n): Promise<DeletionEffect.Authorization> {\n  return Effect.runPromise(\n    DeletionEffect.authorize(plan, operationIds).pipe(Effect.provide(webCryptoLayer)),\n  );\n}\n\nexport function apply(input: {\n  readonly authorization: DeletionEffect.Authorization;\n  readonly plan: DeletionEffect.Plan;\n  readonly priorReceipt?: DeletionEffect.Receipt;\n  readonly provider: DnsProvider.AsyncInterface;\n}): Promise<DeletionEffect.Receipt> {\n  return Effect.runPromise(\n    DeletionEffect.apply({\n      authorization: input.authorization,\n      plan: input.plan,\n      ...(input.priorReceipt === undefined ? {} : { priorReceipt: input.priorReceipt }),\n    }).pipe(\n      Effect.provide(Layer.merge(DnsProvider.layerFromAsync(input.provider), webCryptoLayer)),\n    ),\n  );\n}\n\nexport { Authorization, Error, Operation, PartialError, Plan, Receipt } from \"../plan/deletion.ts\";\nexport type {\n  ApplyError,\n  Authorization as DeletionAuthorization,\n  CreateError,\n  Operation as DeletionOperation,\n  Plan as DeletionPlan,\n  Receipt as DeletionReceipt,\n} from \"../plan/deletion.ts\";\n","import { Effect, Layer } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as OAuthEffect from \"../auth/oauth.ts\";\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport { webCryptoLayer } from \"../plan/canonical-json.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as ConnectionStore from \"../stores/connection.ts\";\nimport * as CredentialStore from \"../stores/credential.ts\";\nimport * as ProviderAuthorizationStore from \"../stores/authorization.ts\";\nimport * as OAuthStateStore from \"../stores/oauth-state.ts\";\n\nexport interface BeginInput extends OAuthEffect.BeginInput {\n  readonly stateStore: OAuthStateStore.AsyncInterface;\n}\n\nexport function begin(input: BeginInput): Promise<{ readonly authorizationUrl: URL }> {\n  const { stateStore, ...programInput } = input;\n  return Effect.runPromise(\n    OAuthEffect.begin(programInput).pipe(\n      Effect.provide(Layer.merge(OAuthStateStore.layerFromAsync(stateStore), webCryptoLayer)),\n    ),\n  );\n}\n\nexport function complete(input: {\n  readonly callbackUrl: URL;\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly connectionStore: ConnectionStore.AsyncInterface;\n  readonly credentialStore: CredentialStore.AsyncInterface;\n  readonly authorizationStore: ProviderAuthorizationStore.AsyncInterface;\n  readonly fetch?: OAuthEffect.Fetch;\n  readonly providerId: string;\n  readonly resolveSubject: ProviderAuth.AsyncOAuthSubjectResolver;\n  readonly stateStore: OAuthStateStore.AsyncInterface;\n}): Promise<{\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n}> {\n  return Effect.runPromise(\n    OAuthEffect.complete({\n      callbackUrl: input.callbackUrl,\n      client: input.client,\n      ...(input.fetch === undefined ? {} : { fetch: input.fetch }),\n      providerId: input.providerId,\n      resolveSubject: (tokens, accessToken) =>\n        Effect.tryPromise({\n          try: () => input.resolveSubject(tokens, accessToken),\n          catch: (cause) => providerFailure(input.providerId, \"resolveSubject\", cause),\n        }),\n    }).pipe(\n      Effect.provide(\n        Layer.mergeAll(\n          OAuthStateStore.layerFromAsync(input.stateStore),\n          ProviderAuthorizationStore.layerFromAsync(input.authorizationStore),\n          ConnectionStore.layerFromAsync(input.connectionStore),\n          CredentialStore.layerFromAsync(input.credentialStore),\n          webCryptoLayer,\n        ),\n      ),\n    ),\n  );\n}\n\nexport function refresh(input: {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly credentialStore: CredentialStore.AsyncInterface;\n  readonly fetch?: OAuthEffect.Fetch;\n  readonly method: ProviderAuth.OAuthMethod;\n}): Promise<void> {\n  return Effect.runPromise(\n    OAuthEffect.refresh({\n      client: input.client,\n      authorization: input.authorization,\n      ...(input.fetch === undefined ? {} : { fetch: input.fetch }),\n      method: input.method,\n    }).pipe(Effect.provide(CredentialStore.layerFromAsync(input.credentialStore))),\n  );\n}\n\nexport function revoke(input: {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly client: ProviderAuth.OAuthClientConfiguration;\n  readonly credentialStore: CredentialStore.AsyncInterface;\n  readonly fetch?: OAuthEffect.Fetch;\n  readonly method: ProviderAuth.OAuthMethod;\n}): Promise<void> {\n  return Effect.runPromise(\n    OAuthEffect.revoke({\n      client: input.client,\n      authorization: input.authorization,\n      ...(input.fetch === undefined ? {} : { fetch: input.fetch }),\n      method: input.method,\n    }).pipe(Effect.provide(CredentialStore.layerFromAsync(input.credentialStore))),\n  );\n}\n\nfunction providerFailure(\n  providerId: string,\n  operation: string,\n  cause: unknown,\n): DnsProvider.Error | InvalidInputError {\n  return cause instanceof InvalidInputError || cause instanceof DnsProvider.Error\n    ? cause\n    : new DnsProvider.Error({\n        cause,\n        message: cause instanceof Error ? cause.message : \"Provider callback failed\",\n        operation,\n        providerId,\n      });\n}\n\nexport type Fetch = OAuthEffect.Fetch;\n","import { Effect, Layer } from \"effect\";\n\nimport type * as Connection from \"../auth/connection.ts\";\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport * as ConnectionAuthorization from \"../plan/connection-authorization.ts\";\nimport { webCryptoLayer } from \"../plan/canonical-json.ts\";\nimport * as ProvisioningEffect from \"../plan/plan.ts\";\nimport type * as DnsPlan from \"../plan/types.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\n\nexport interface CreateInput extends ProvisioningEffect.CreateInput {\n  readonly provider: DnsProvider.AsyncInterface;\n}\n\nexport function create(input: CreateInput): Promise<DnsPlan.DnsPlan> {\n  const { provider, ...programInput } = input;\n  return Effect.runPromise(\n    ProvisioningEffect.create(programInput).pipe(\n      Effect.provide(Layer.merge(DnsProvider.layerFromAsync(provider), webCryptoLayer)),\n    ),\n  );\n}\n\nexport function authorize(\n  plan: DnsPlan.DnsPlan,\n  operationIds?: ReadonlyArray<string>,\n  options: { readonly allowPartial?: boolean } = {},\n): Promise<DnsPlan.PlanAuthorization> {\n  return Effect.runPromise(\n    ProvisioningEffect.authorize(plan, operationIds, options).pipe(Effect.provide(webCryptoLayer)),\n  );\n}\n\nexport function apply(input: {\n  readonly authorization: DnsPlan.PlanAuthorization;\n  readonly plan: DnsPlan.DnsPlan;\n  readonly provider: DnsProvider.AsyncInterface;\n}): Promise<DnsPlan.ApplyReceipt> {\n  return Effect.runPromise(\n    ProvisioningEffect.apply({ authorization: input.authorization, plan: input.plan }).pipe(\n      Effect.provide(Layer.merge(DnsProvider.layerFromAsync(input.provider), webCryptoLayer)),\n    ),\n  );\n}\n\nexport function authorizeForConnection(input: {\n  readonly allowPartial?: boolean;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n  readonly domain: string;\n  readonly operationIds?: ReadonlyArray<string>;\n  readonly plan: DnsPlan.DnsPlan;\n}): Promise<DnsPlan.PlanAuthorization> {\n  return Effect.runPromise(\n    ConnectionAuthorization.authorize(input).pipe(Effect.provide(webCryptoLayer)),\n  );\n}\n\nexport const renderManualInstructions = ProvisioningEffect.renderManualInstructions;\n","import { Effect, Layer } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport type * as ProviderAuth from \"../auth/manifest.ts\";\nimport { Value as Secret } from \"../auth/secret.ts\";\nimport * as TokenEffect from \"../auth/token.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport { webCryptoLayer } from \"../plan/canonical-json.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as ConnectionStore from \"../stores/connection.ts\";\nimport * as CredentialStore from \"../stores/credential.ts\";\nimport * as ProviderAuthorizationStore from \"../stores/authorization.ts\";\n\nexport function connect(input: {\n  readonly connectionStore: ConnectionStore.AsyncInterface;\n  readonly credentialStore: CredentialStore.AsyncInterface;\n  readonly authorizationStore: ProviderAuthorizationStore.AsyncInterface;\n  readonly grant: Connection.Grant;\n  readonly ownerId: string;\n  readonly providerId: string;\n  readonly subjectId: string;\n  readonly token: Secret;\n  readonly validate: (token: Secret) => Promise<ProviderAuth.TokenValidation>;\n}): Promise<{\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.Connection;\n}> {\n  return Effect.runPromise(\n    TokenEffect.connect({\n      grant: input.grant,\n      ownerId: input.ownerId,\n      providerId: input.providerId,\n      subjectId: input.subjectId,\n      token: input.token,\n      validate: (token) =>\n        Effect.tryPromise({\n          try: () => input.validate(token),\n          catch: (cause) =>\n            cause instanceof InvalidInputError || cause instanceof DnsProvider.Error\n              ? cause\n              : new DnsProvider.Error({\n                  cause,\n                  message: cause instanceof Error ? cause.message : \"Token validation failed\",\n                  operation: \"validateToken\",\n                  providerId: input.providerId,\n                }),\n        }),\n    }).pipe(\n      Effect.provide(\n        Layer.mergeAll(\n          ConnectionStore.layerFromAsync(input.connectionStore),\n          ProviderAuthorizationStore.layerFromAsync(input.authorizationStore),\n          CredentialStore.layerFromAsync(input.credentialStore),\n          webCryptoLayer,\n        ),\n      ),\n    ),\n  );\n}\n","import { Effect, Layer } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\nimport * as DnsProvider from \"../provider/provider.ts\";\nimport * as DnsResolver from \"../verification/resolver.ts\";\nimport * as VerificationEffect from \"../verification/verify.ts\";\n\nexport function record(input: {\n  readonly provider: DnsProvider.AsyncInterface;\n  readonly record: DnsRecord.DnsRecord;\n  readonly resolver: DnsResolver.AsyncInterface;\n  readonly zone: DomainName.DomainName;\n}): Promise<VerificationEffect.Result> {\n  return Effect.runPromise(\n    VerificationEffect.record({ record: input.record, zone: input.zone }).pipe(\n      Effect.provide(\n        Layer.merge(\n          DnsProvider.layerFromAsync(input.provider),\n          DnsResolver.layerFromAsync(input.resolver),\n        ),\n      ),\n    ),\n  );\n}\n","import * as CloudflareDnsOverHttps from \"../verification/cloudflare-doh.ts\";\nimport type * as DnsResolver from \"../verification/resolver.ts\";\n\nexport type Options = CloudflareDnsOverHttps.Options;\n\nexport function make(options: Options = {}): DnsResolver.AsyncInterface {\n  return CloudflareDnsOverHttps.toAsync(options);\n}\n","import * as DnsOverHttps from \"../verification/doh.ts\";\nimport type * as DnsResolver from \"../verification/resolver.ts\";\n\nexport type Options = DnsOverHttps.Options;\n\nexport function make(options: Options): DnsResolver.AsyncInterface {\n  return DnsOverHttps.toAsync(options);\n}\n","import packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Connection from \"./promise/connection.ts\";\nexport * as ConnectionLifecycle from \"./promise/connection-lifecycle.ts\";\nexport * as ProviderAuthorization from \"./promise/provider-authorization.ts\";\nexport * as ProviderAuth from \"./promise/provider-auth.ts\";\nexport * as Secret from \"./auth/secret.ts\";\nexport * as ProviderDiscovery from \"./discovery/selection.ts\";\nexport * as Zones from \"./discovery/zones.ts\";\nexport * as DnsRecord from \"./promise/dns-record.ts\";\nexport * as DomainName from \"./promise/domain-name.ts\";\nexport * as InvalidInput from \"./invalid-input.ts\";\nexport * as DnsPlan from \"./promise/dns-plan.ts\";\nexport * as Deletion from \"./promise/deletion.ts\";\nexport type * as DnsProvider from \"./promise/dns-provider.ts\";\nexport * as Cloudflare from \"./promise/cloudflare.ts\";\nexport * as Vercel from \"./promise/vercel.ts\";\nexport type * as DnsResolver from \"./promise/dns-resolver.ts\";\nexport * as OAuth from \"./promise/oauth.ts\";\nexport * as Provisioning from \"./promise/provisioning.ts\";\nexport type * as Stores from \"./promise/stores.ts\";\nexport * as TokenConnection from \"./promise/token.ts\";\nexport * as Verification from \"./promise/verification.ts\";\nexport * as CloudflareDnsOverHttps from \"./promise/cloudflare-doh.ts\";\nexport * as DnsOverHttps from \"./promise/doh.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;AAOA,SAAgBA,SAAO,OAAgD;CACrE,OAAO,OAAO,WAAWC,SAAkB,KAAK,CAAC;AACnD;;;;;;;;ACAA,SAAgB,YAAY,OAIO;CACjC,OAAO,OAAO,WACZC,cAAsB;EAAE,YAAY,MAAM;EAAY,OAAO,MAAM;CAAM,CAAC,CAAC,CAAC,KAC1E,OAAO,QAAQC,iBAA+B,MAAM,eAAe,CAAC,CACtE,CACF;AACF;AAEA,SAAgB,OAAO,OAQa;CAClC,OAAO,OAAO,WACZC,SAAiB;EACf,cAAc,MAAM;EACpB,sBAAsB,kBACpB,OAAO,WAAW;GAChB,WAAW,MAAM,oBAAoB,aAAa;GAClD,QAAQ,UACN,IAAIC,QAAgB,EAClB,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC3E,CAAC;EACL,CAAC;CACL,CAAC,CAAC,CAAC,KACD,OAAO,QACL,MAAM,SACJC,iBAA0C,MAAM,kBAAkB,GAClEH,iBAA+B,MAAM,eAAe,GACpDI,iBAA+B,MAAM,eAAe,CACtD,CACF,CACF,CACF;AACF;;;;;;;;;AC5CA,SAAgBC,SAAO,OAAsE;CAC3F,OAAO,OAAO,WAAWC,SAA6B,KAAK,CAAC;AAC9D;;;;;;;;ACIA,SAAgBC,SAAO,OAAgD;CACrE,OAAO,OAAO,WAAWC,SAAoB,KAAK,CAAC;AACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AGRA,SAAgB,OAAO,OAA0C;CAC/D,OAAO,OAAO,WAAWC,SAAe,KAAK,CAAC;AAChD;AAEA,SAAgB,cAAc,OAA+C;CAC3E,OAAO,OAAO,WAAWC,gBAAsB,KAAK,CAAC;AACvD;;;;;;;;;;;;;;ACNA,SAAgBC,SAAO,OAKU;CAC/B,OAAO,OAAO,WACZC,SAAsB;EACpB,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;CAC5D,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,MAAM,MAAMC,eAA2B,MAAM,QAAQ,GAAG,cAAc,CAAC,CACxF,CACF;AACF;AAEA,SAAgBC,YACd,MACA,cACuC;CACvC,OAAO,OAAO,WACZC,YAAyB,MAAM,YAAY,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC,CAClF;AACF;AAEA,SAAgBC,QAAM,OAKc;CAClC,OAAO,OAAO,WACZC,QAAqB;EACnB,eAAe,MAAM;EACrB,MAAM,MAAM;EACZ,GAAI,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa;CACjF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,MAAM,MAAMJ,eAA2B,MAAM,QAAQ,GAAG,cAAc,CAAC,CACxF,CACF;AACF;;;;;;;;;AC9BA,SAAgB,MAAM,OAAgE;CACpF,MAAM,EAAE,YAAY,GAAG,iBAAiB;CACxC,OAAO,OAAO,WACZK,QAAkB,YAAY,CAAC,CAAC,KAC9B,OAAO,QAAQ,MAAM,MAAMC,iBAA+B,UAAU,GAAG,cAAc,CAAC,CACxF,CACF;AACF;AAEA,SAAgB,SAAS,OAatB;CACD,OAAO,OAAO,WACZC,WAAqB;EACnB,aAAa,MAAM;EACnB,QAAQ,MAAM;EACd,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;EAC1D,YAAY,MAAM;EAClB,iBAAiB,QAAQ,gBACvB,OAAO,WAAW;GAChB,WAAW,MAAM,eAAe,QAAQ,WAAW;GACnD,QAAQ,UAAU,gBAAgB,MAAM,YAAY,kBAAkB,KAAK;EAC7E,CAAC;CACL,CAAC,CAAC,CAAC,KACD,OAAO,QACL,MAAM,SACJD,iBAA+B,MAAM,UAAU,GAC/CE,iBAA0C,MAAM,kBAAkB,GAClEC,iBAA+B,MAAM,eAAe,GACpDC,iBAA+B,MAAM,eAAe,GACpD,cACF,CACF,CACF,CACF;AACF;AAEA,SAAgB,QAAQ,OAMN;CAChB,OAAO,OAAO,WACZC,UAAoB;EAClB,QAAQ,MAAM;EACd,eAAe,MAAM;EACrB,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;EAC1D,QAAQ,MAAM;CAChB,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQD,iBAA+B,MAAM,eAAe,CAAC,CAAC,CAC/E;AACF;AAEA,SAAgB,OAAO,OAML;CAChB,OAAO,OAAO,WACZE,SAAmB;EACjB,QAAQ,MAAM;EACd,eAAe,MAAM;EACrB,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;EAC1D,QAAQ,MAAM;CAChB,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQF,iBAA+B,MAAM,eAAe,CAAC,CAAC,CAC/E;AACF;AAEA,SAAS,gBACP,YACA,WACA,OACuC;CACvC,OAAO,iBAAiBG,WAAqB,iBAAiBC,UAC1D,QACA,IAAIA,QAAkB;EACpB;EACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;EAClD;EACA;CACF,CAAC;AACP;;;;;;;;;;ACnGA,SAAgB,OAAO,OAA8C;CACnE,MAAM,EAAE,UAAU,GAAG,iBAAiB;CACtC,OAAO,OAAO,WACZC,SAA0B,YAAY,CAAC,CAAC,KACtC,OAAO,QAAQ,MAAM,MAAMC,eAA2B,QAAQ,GAAG,cAAc,CAAC,CAClF,CACF;AACF;AAEA,SAAgB,UACd,MACA,cACA,UAA+C,CAAC,GACZ;CACpC,OAAO,OAAO,WACZC,YAA6B,MAAM,cAAc,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC,CAC/F;AACF;AAEA,SAAgB,MAAM,OAIY;CAChC,OAAO,OAAO,WACZC,QAAyB;EAAE,eAAe,MAAM;EAAe,MAAM,MAAM;CAAK,CAAC,CAAC,CAAC,KACjF,OAAO,QAAQ,MAAM,MAAMF,eAA2B,MAAM,QAAQ,GAAG,cAAc,CAAC,CACxF,CACF;AACF;AAEA,SAAgB,uBAAuB,OAOA;CACrC,OAAO,OAAO,WACZG,YAAkC,KAAK,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC,CAC9E;AACF;AAEA,MAAa,2BAA2BC;;;;AC5CxC,SAAgB,QAAQ,OAarB;CACD,OAAO,OAAO,WACZC,UAAoB;EAClB,OAAO,MAAM;EACb,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,WAAW,UACT,OAAO,WAAW;GAChB,WAAW,MAAM,SAAS,KAAK;GAC/B,QAAQ,UACN,iBAAiBC,WAAqB,iBAAiBC,UACnD,QACA,IAAIA,QAAkB;IACpB;IACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU;IAClD,WAAW;IACX,YAAY,MAAM;GACpB,CAAC;EACT,CAAC;CACL,CAAC,CAAC,CAAC,KACD,OAAO,QACL,MAAM,SACJC,iBAA+B,MAAM,eAAe,GACpDC,iBAA0C,MAAM,kBAAkB,GAClEC,iBAA+B,MAAM,eAAe,GACpD,cACF,CACF,CACF,CACF;AACF;;;;ACnDA,SAAgB,OAAO,OAKgB;CACrC,OAAO,OAAO,WACZC,SAA0B;EAAE,QAAQ,MAAM;EAAQ,MAAM,MAAM;CAAK,CAAC,CAAC,CAAC,KACpE,OAAO,QACL,MAAM,MACJC,eAA2B,MAAM,QAAQ,GACzCC,iBAA2B,MAAM,QAAQ,CAC3C,CACF,CACF,CACF;AACF;;;;ACnBA,SAAgBC,OAAK,UAAmB,CAAC,GAA+B;CACtE,OAAOC,QAA+B,OAAO;AAC/C;;;;ACFA,SAAgB,KAAK,SAA8C;CACjE,OAAOC,UAAqB,OAAO;AACrC;;;;ACJA,MAAa,UAAUC"}

package/dist/manifest-CP85ePFn.d.mts

@@ -0,0 +1,583 @@
+import { Context, Effect, Layer, Schema } from "effect";
+import * as oauth from "oauth4webapi";
+declare namespace invalid_input_d_exports {
+  export { Error$1 as Error };
+}
+declare const Error_base$1: Schema.Class<Error$1, Schema.TaggedStruct<"InvalidInputError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$1 extends Error_base$1 {}
+declare namespace domain_name_d_exports {
+  export { DomainName, Schema$3 as Schema, decode$2 as decode, parse$1 as parse };
+}
+declare const Type$1: Schema.brand<Schema.String, "DomainName">;
+/** A lower-case, fully qualified DNS name without a trailing dot. */
+type DomainName = typeof Type$1.Type;
+/** Decodes user and wire strings into canonical domain names. */
+declare const Schema$3: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+declare const decode$2: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$1, never>;
+declare function parse$1(input: unknown): DomainName;
+declare namespace dns_record_d_exports {
+  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$2 as Schema, Srv, Txt, Type, data, decode$1 as decode, equals, parse };
+}
+declare const Type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
+type Type = typeof Type.Type;
+declare const RequirementMetadata: Schema.Struct<{
+  readonly ownership: Schema.String;
+  readonly provenance: Schema.String;
+  readonly purpose: Schema.String;
+}>;
+interface RequirementMetadata extends Schema.Schema.Type<typeof RequirementMetadata> {}
+declare const Schema$2: Schema.TaggedUnion<{
+  readonly A: Schema.TaggedStruct<"A", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly AAAA: Schema.TaggedStruct<"AAAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly CAA: Schema.TaggedStruct<"CAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly flags: Schema.Int;
+    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+    readonly value: Schema.String;
+  }>;
+  readonly CNAME: Schema.TaggedStruct<"CNAME", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly policy: Schema.Literal<"exclusive">;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly MX: Schema.TaggedStruct<"MX", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly priority: Schema.Int;
+  }>;
+  readonly NS: Schema.TaggedStruct<"NS", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly SRV: Schema.TaggedStruct<"SRV", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly port: Schema.Int;
+    readonly priority: Schema.Int;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly weight: Schema.Int;
+  }>;
+  readonly TXT: Schema.TaggedStruct<"TXT", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly value: Schema.String;
+  }>;
+}>;
+declare const A: Schema.TaggedStruct<"A", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly address: Schema.String;
+}>, Aaaa: Schema.TaggedStruct<"AAAA", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly address: Schema.String;
+}>, Caa: Schema.TaggedStruct<"CAA", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly flags: Schema.Int;
+  readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+  readonly value: Schema.String;
+}>, Cname: Schema.TaggedStruct<"CNAME", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly policy: Schema.Literal<"exclusive">;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>, Mx: Schema.TaggedStruct<"MX", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly priority: Schema.Int;
+}>, Ns: Schema.TaggedStruct<"NS", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>, Srv: Schema.TaggedStruct<"SRV", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly port: Schema.Int;
+  readonly priority: Schema.Int;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly weight: Schema.Int;
+}>, Txt: Schema.TaggedStruct<"TXT", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly value: Schema.String;
+}>;
+type DnsRecord = typeof Schema$2.Type;
+type Encoded = typeof Schema$2.Encoded;
+/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
+declare const Opaque: Schema.Struct<{
+  readonly _tag: Schema.Literal<"Opaque">;
+  readonly name: Schema.String;
+  readonly providerRecordId: Schema.NullOr<Schema.String>;
+  readonly providerType: Schema.String;
+}>;
+interface Opaque extends Schema.Schema.Type<typeof Opaque> {}
+/** Any DNS record observed through a provider, including non-portable record types. */
+declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
+  readonly A: Schema.TaggedStruct<"A", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly AAAA: Schema.TaggedStruct<"AAAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly CAA: Schema.TaggedStruct<"CAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly flags: Schema.Int;
+    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+    readonly value: Schema.String;
+  }>;
+  readonly CNAME: Schema.TaggedStruct<"CNAME", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly policy: Schema.Literal<"exclusive">;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly MX: Schema.TaggedStruct<"MX", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly priority: Schema.Int;
+  }>;
+  readonly NS: Schema.TaggedStruct<"NS", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly SRV: Schema.TaggedStruct<"SRV", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly port: Schema.Int;
+    readonly priority: Schema.Int;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly weight: Schema.Int;
+  }>;
+  readonly TXT: Schema.TaggedStruct<"TXT", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly value: Schema.String;
+  }>;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"Opaque">;
+  readonly name: Schema.String;
+  readonly providerRecordId: Schema.NullOr<Schema.String>;
+  readonly providerType: Schema.String;
+}>]>;
+type Observed = typeof Observed.Type;
+declare const decode$1: (input: unknown) => Effect.Effect<{
+  readonly _tag: "A";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+} | {
+  readonly _tag: "AAAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+} | {
+  readonly _tag: "CAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly flags: number;
+  readonly tag: "iodef" | "issue" | "issuewild";
+  readonly value: string;
+} | {
+  readonly _tag: "CNAME";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly ttl: number | null;
+  readonly policy: "exclusive";
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+} | {
+  readonly _tag: "MX";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+  readonly priority: number;
+} | {
+  readonly _tag: "NS";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+} | {
+  readonly _tag: "SRV";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly port: number;
+  readonly priority: number;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+  readonly weight: number;
+} | {
+  readonly _tag: "TXT";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly value: string;
+}, Error$1, never>;
+declare function parse(input: unknown): DnsRecord;
+declare function data(record: DnsRecord): Readonly<Record<string, number | string>>;
+declare function equals(left: DnsRecord, right: DnsRecord): boolean;
+declare namespace provider_d_exports {
+  export { AsyncInterface, CreateResult, Error, ErrorReason, Interface, Service, layerFromAsync, toAsync };
+}
+interface CreateResult {
+  readonly providerRecordId: string | null;
+}
+declare const ErrorReason: Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>;
+type ErrorReason = typeof ErrorReason.Type;
+declare const Error_base: Schema.Class<Error, Schema.TaggedStruct<"ProviderError", {
+  readonly cause: Schema.optionalKey<Schema.Unknown>;
+  readonly code: Schema.optionalKey<Schema.Union<readonly [Schema.Number, Schema.String]>>;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly providerId: Schema.String;
+  readonly reason: Schema.optionalKey<Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>>;
+  readonly retryAfterMs: Schema.optionalKey<Schema.Number>;
+  readonly status: Schema.optionalKey<Schema.Number>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error extends Error_base {}
+/** The provider capability used by DNS planning, application, and verification. */
+interface Interface {
+  readonly id: string;
+  readonly createRecord: (zone: DomainName, record: DnsRecord) => Effect.Effect<CreateResult, Error>;
+  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<void, Error>;
+  readonly getRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<Observed | null, Error>;
+  readonly listRecords: (zone: DomainName) => Effect.Effect<ReadonlyArray<Observed>, Error>;
+}
+declare const Service_base: Context.ServiceClass<Service, "@domainkit/DnsProvider", Interface>;
+declare class Service extends Service_base {}
+/** Minimal Promise-shaped provider contract for hosts that do not use Effect directly. */
+interface AsyncInterface {
+  readonly id: string;
+  readonly createRecord: (zone: DomainName, record: DnsRecord) => Promise<CreateResult>;
+  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Promise<void>;
+  readonly getRecord: (zone: DomainName, providerRecordId: string) => Promise<Observed | null>;
+  readonly listRecords: (zone: DomainName) => Promise<ReadonlyArray<Observed>>;
+}
+declare const layerFromAsync: (provider: AsyncInterface) => Layer.Layer<Service>;
+declare const toAsync: (provider: Interface) => AsyncInterface;
+declare namespace secret_d_exports {
+  export { Value, make };
+}
+/** A deliberately non-serializable credential value. */
+declare class Value {
+  #private;
+  private constructor();
+  static from(value: string): Value;
+  expose(): string;
+  toJSON(): string;
+  toString(): string;
+}
+declare const make: typeof Value.from;
+declare namespace manifest_d_exports {
+  export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$1 as Schema, TokenValidation, decode };
+}
+declare const Method: Schema.TaggedUnion<{
+  readonly integration: Schema.TaggedStruct<"integration", {
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly installUrl: Schema.String;
+    readonly tokenEndpoint: Schema.String;
+  }>;
+  readonly oauth2: Schema.TaggedStruct<"oauth2", {
+    readonly authorizationServer: Schema.Struct<{
+      readonly authorization_endpoint: Schema.String;
+      readonly issuer: Schema.String;
+      readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
+      readonly token_endpoint: Schema.String;
+    }>;
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+    readonly scopes: Schema.$Array<Schema.String>;
+  }>;
+  readonly token: Schema.TaggedStruct<"token", {
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly instructionsUrl: Schema.String;
+  }>;
+}>;
+declare const Schema$1: Schema.Struct<{
+  readonly methods: Schema.$Array<Schema.TaggedUnion<{
+    readonly integration: Schema.TaggedStruct<"integration", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly installUrl: Schema.String;
+      readonly tokenEndpoint: Schema.String;
+    }>;
+    readonly oauth2: Schema.TaggedStruct<"oauth2", {
+      readonly authorizationServer: Schema.Struct<{
+        readonly authorization_endpoint: Schema.String;
+        readonly issuer: Schema.String;
+        readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
+        readonly token_endpoint: Schema.String;
+      }>;
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+      readonly scopes: Schema.$Array<Schema.String>;
+    }>;
+    readonly token: Schema.TaggedStruct<"token", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly instructionsUrl: Schema.String;
+    }>;
+  }>>;
+  readonly providerId: Schema.String;
+}>;
+interface Manifest extends Schema.Schema.Type<typeof Schema$1> {}
+type OAuthMethod = Extract<Manifest["methods"][number], {
+  readonly _tag: "oauth2";
+}>;
+/** A provider-owned installation flow that returns a credential from a one-time code. */
+type IntegrationMethod = Extract<Manifest["methods"][number], {
+  readonly _tag: "integration";
+}>;
+declare const decode: (input: unknown) => Effect.Effect<{
+  readonly methods: readonly ({
+    readonly _tag: "integration";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly installUrl: string;
+    readonly tokenEndpoint: string;
+  } | {
+    readonly _tag: "oauth2";
+    readonly authorizationServer: {
+      readonly authorization_endpoint: string;
+      readonly issuer: string;
+      readonly revocation_endpoint?: string;
+      readonly token_endpoint: string;
+    };
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly clientAuth: "client_secret_basic" | "client_secret_post" | "none";
+    readonly scopes: readonly string[];
+  } | {
+    readonly _tag: "token";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly instructionsUrl: string;
+  })[];
+  readonly providerId: string;
+}, Error$1, never>;
+interface OAuthClientConfiguration {
+  readonly clientId: string;
+  readonly clientSecret?: Value;
+}
+interface TokenValidation {
+  readonly accountId: string;
+  readonly capabilities: ReadonlyArray<"dns:read" | "dns:write">;
+  readonly expiresAt: Date | null;
+  readonly scopes: ReadonlyArray<string>;
+}
+interface OAuthSubjectResolver {
+  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Effect.Effect<{
+    readonly accountId: string;
+    readonly expiresAt: Date | null;
+  }, Error>;
+}
+interface AsyncOAuthSubjectResolver {
+  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Promise<{
+    readonly accountId: string;
+    readonly expiresAt: Date | null;
+  }>;
+}
+//#endregion
+export { Schema$2 as A, domain_name_d_exports as B, DnsRecord as C, Observed as D, Ns as E, dns_record_d_exports as F, Error$1 as H, equals as I, parse as L, Txt as M, Type as N, Opaque as O, data as P, DomainName as R, Cname as S, Mx as T, invalid_input_d_exports as U, parse$1 as V, Service as _, OAuthClientConfiguration as a, Aaaa as b, Schema$1 as c, Value as d, secret_d_exports as f, Interface as g, Error as h, Method as i, Srv as j, RequirementMetadata as k, TokenValidation as l, CreateResult as m, IntegrationMethod as n, OAuthMethod as o, AsyncInterface as p, Manifest as r, OAuthSubjectResolver as s, AsyncOAuthSubjectResolver as t, manifest_d_exports as u, provider_d_exports as v, Encoded as w, Caa as x, A as y, Schema$3 as z };
+//# sourceMappingURL=manifest-CP85ePFn.d.mts.map