domainkit 0.1.0-beta.0 → 0.1.0

package/dist/{verify-DPB1OfZ5.d.mts → verify-B80xCBh2.d.mts}

@@ -1,7 +1,45 @@
-import { C as DnsRecord, H as Error, R as DomainName, _ as Service, a as OAuthClientConfiguration, d as Value, h as Error$1, o as OAuthMethod, w as Encoded } from "./manifest-DjH3BVB9.mjs";
-import { A as Service$3, B as Connection, E as Service$1, I as Error$2, P as Service$2, R as AuthorizationError$1, V as Grant, a as Interface, c as Service$4, g as DnsPlan, m as ApplyReceipt, n as AsyncInterface, v as PlanAuthorization } from "./resolver-BjZwN2JE.mjs";
+import { C as DnsRecord, H as Error$2, R as DomainName, _ as Service, a as OAuthClientConfiguration, d as Value, h as Error$3, o as OAuthMethod, w as Encoded } from "./manifest-CP85ePFn.mjs";
+import { A as Service$3, B as Error$4, E as Service$4, H as AuthorizationError$1, P as Service$2, Q as ProviderAuthorization, R as Service$1, U as Connection, W as Grant, a as Interface, c as Service$5, g as DnsPlan, m as ApplyReceipt, n as AsyncInterface, v as PlanAuthorization } from "./resolver-BHPsADzE.mjs";
 import { Cause, Crypto, Effect, Layer, Schema } from "effect";
 import * as oauth from "oauth4webapi";
+declare namespace connection_lifecycle_d_exports {
+  export { DetachResult, Error$1 as Error, Requirements$1 as Requirements, detach, updateGrant };
+}
+declare const Error_base$1: Schema.Class<Error$1, Schema.TaggedStruct<"ConnectionLifecycleError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$1 extends Error_base$1 {}
+interface DetachResult {
+  readonly connection: Connection;
+  readonly remainingBindings: number;
+  readonly revokedAuthorization: boolean;
+}
+/** Replace the grant on an owner binding after the host has obtained explicit consent. */
+declare const updateGrant: (input: {
+  readonly connection: Connection;
+  readonly grant: Grant;
+}) => Effect.Effect<{
+  readonly authorizationId: string;
+  readonly createdAt: Date;
+  readonly grant: {
+    readonly _tag: "account";
+  } | {
+    readonly _tag: "domains";
+    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
+  };
+  readonly id: string;
+  readonly ownerId: string;
+}, Error$2 | Error$4, Service$1>;
+/**
+ * Detach one owner binding. The final binding invokes provider revocation before deleting local
+ * credential and authorization state. The callback keeps provider-specific revocation outside the
+ * portable authorization model.
+ */
+declare function detach<E, R>(input: {
+  readonly connectionId: string;
+  readonly revokeAuthorization: (authorization: ProviderAuthorization) => Effect.Effect<void, E, R>;
+}): Effect.Effect<DetachResult, Error$1 | Error$4 | E, R | Requirements$1>;
+type Requirements$1 = Service$1 | Service$2 | Service$3;
 declare namespace canonical_json_d_exports {
   export { CryptoError, Json, sha256Encoded, sha256Json, sha256Text, stringify, webCryptoLayer };
 }
@@ -27,6 +65,7 @@ interface BeginInput {
   readonly client: OAuthClientConfiguration;
   readonly grant: Grant;
   readonly method: OAuthMethod;
+  readonly ownerId: string;
   readonly redirectUri: string;
   readonly subjectId: string;
   readonly ttlMs?: number;
@@ -35,36 +74,39 @@ interface OAuthSubjectResolver {
   (tokens: oauth.TokenEndpointResponse, accessToken: Value): Effect.Effect<{
     readonly accountId: string;
     readonly expiresAt: Date | null;
-  }, Error | Error$1>;
+  }, Error$2 | Error$3>;
 }
-type OAuthError = AuthorizationError$1 | CryptoError | Error | Error$1 | Error$2;
+type OAuthError = AuthorizationError$1 | CryptoError | Error$2 | Error$3 | Error$4;
 declare const begin: (input: BeginInput) => Effect.Effect<{
   readonly authorizationUrl: URL;
-}, CryptoError | Error$2, Crypto.Crypto | Service$1>;
+}, CryptoError | Error$4, Crypto.Crypto | Service$4>;
 declare const complete: (input: {
   readonly callbackUrl: URL;
   readonly client: OAuthClientConfiguration;
   readonly fetch?: Fetch$1;
   readonly providerId: string;
   readonly resolveSubject: OAuthSubjectResolver;
-}) => Effect.Effect<Connection, OAuthError, Crypto.Crypto | Service$2 | Service$3 | Service$1>;
+}) => Effect.Effect<{
+  readonly authorization: ProviderAuthorization;
+  readonly connection: Connection;
+}, OAuthError, Crypto.Crypto | Service$1 | Service$2 | Service$3 | Service$4>;
 declare const refresh: (input: {
   readonly client: OAuthClientConfiguration;
-  readonly connection: Connection;
+  readonly authorization: ProviderAuthorization;
   readonly fetch?: Fetch$1;
   readonly method: OAuthMethod;
-}) => Effect.Effect<void, OAuthError, Service$3>;
+}) => Effect.Effect<void, OAuthError, Service$2>;
 declare const revoke: (input: {
   readonly client: OAuthClientConfiguration;
-  readonly connection: Connection;
+  readonly authorization: ProviderAuthorization;
   readonly fetch?: Fetch$1;
   readonly method: OAuthMethod;
-}) => Effect.Effect<void, OAuthError, Service$3>;
+}) => Effect.Effect<void, OAuthError, Service$2>;
 declare namespace selection_d_exports {
   export { ConnectedZone, Evidence, Selection, select };
 }
 interface ConnectedZone {
-  readonly accountId: string;
+  readonly authorization: ProviderAuthorization;
   readonly connection: Connection;
   readonly nameservers: ReadonlyArray<string>;
   readonly providerId: string;
@@ -128,7 +170,7 @@ declare namespace zones_d_exports {
 }
 declare function candidates(input: string): ReadonlyArray<DomainName>;
 declare namespace plan_d_exports {
-  export { ApplyError, ApplyInput, AuthorizationError, AuthorizeError, ConflictError, CreateError, CreateInput, PartialApplyError, StaleError, apply, authorize, create, renderManualInstructions };
+  export { ApplyError$1 as ApplyError, ApplyInput, AuthorizationError, AuthorizeError, ConflictError, CreateError$1 as CreateError, CreateInput$1 as CreateInput, PartialApplyError, StaleError, apply$1 as apply, authorize$1 as authorize, create$1 as create, renderManualInstructions, validate$1 as validate };
 }
 declare const ConflictError_base: Schema.Class<ConflictError, Schema.TaggedStruct<"PlanConflictError", {
   readonly operationIds: Schema.$Array<Schema.String>;
@@ -161,7 +203,7 @@ declare const PartialApplyError_base: Schema.Class<PartialApplyError, Schema.Tag
   }>;
 }>, Cause.YieldableError>;
 declare class PartialApplyError extends PartialApplyError_base {}
-interface CreateInput {
+interface CreateInput$1 {
   readonly requirements: ReadonlyArray<Encoded | DnsRecord>;
   readonly zone: string;
 }
@@ -169,19 +211,14 @@ interface ApplyInput {
   readonly authorization: PlanAuthorization;
   readonly plan: DnsPlan;
 }
-type CreateError = Error | Error$1 | CryptoError;
+type CreateError$1 = Error$2 | Error$3 | CryptoError;
 type AuthorizeError = AuthorizationError | CryptoError;
-type ApplyError = Error | Error$1 | CryptoError | AuthorizationError | ConflictError | StaleError | PartialApplyError;
+type ApplyError$1 = Error$2 | Error$3 | CryptoError | AuthorizationError | ConflictError | StaleError | PartialApplyError;
 /** Builds a deterministic DNS plan through the provider in the Effect environment. */
-declare const create: (input: CreateInput) => Effect.Effect<{
+declare const create$1: (input: CreateInput$1) => Effect.Effect<{
   operations: readonly ({
     readonly _tag: "conflict";
     readonly existing: readonly ({
-      readonly _tag: "Opaque";
-      readonly name: string;
-      readonly providerRecordId: string | null;
-      readonly providerType: string;
-    } | {
       readonly _tag: "A";
       readonly metadata: {
         readonly ownership: string;
@@ -275,6 +312,11 @@ declare const create: (input: CreateInput) => Effect.Effect<{
       readonly policy: "append" | "exclusive";
       readonly ttl: number | null;
       readonly value: string;
+    } | {
+      readonly _tag: "Opaque";
+      readonly name: string;
+      readonly providerRecordId: string | null;
+      readonly providerType: string;
     })[];
     readonly id: string;
     readonly reason: string;
@@ -575,9 +617,9 @@ declare const create: (input: CreateInput) => Effect.Effect<{
   version: "domainkit.dns-plan.v1";
   zone: string & import("effect/Brand").Brand<"DomainName">;
   digest: string;
-}, CryptoError | Error | Error$1, Crypto.Crypto | Service>;
+}, CryptoError | Error$2 | Error$3, Crypto.Crypto | Service>;
 /** Authorizes all or a selected subset of create operations in a digest-bound plan. */
-declare const authorize: (plan: DnsPlan, operationIds?: readonly string[] | undefined, options?: {
+declare const authorize$1: (plan: DnsPlan, operationIds?: readonly string[] | undefined, options?: {
   readonly allowPartial?: boolean;
 } | undefined) => Effect.Effect<{
   allowPartial: boolean;
@@ -586,8 +628,394 @@ declare const authorize: (plan: DnsPlan, operationIds?: readonly string[] | unde
   version: "domainkit.plan-authorization.v1";
 }, AuthorizeError, Crypto.Crypto>;
 /** Applies approved creates sequentially after full and per-operation revalidation. */
-declare const apply: (input: ApplyInput) => Effect.Effect<ApplyReceipt, AuthorizationError | ConflictError | CryptoError | Error | Error$1 | PartialApplyError | StaleError, Crypto.Crypto | Service>;
+declare const apply$1: (input: ApplyInput) => Effect.Effect<ApplyReceipt, AuthorizationError | ConflictError | CryptoError | Error$2 | Error$3 | PartialApplyError | StaleError, Crypto.Crypto | Service>;
 declare function renderManualInstructions(plan: DnsPlan): ReadonlyArray<string>;
+declare function validate$1(plan: DnsPlan): Effect.Effect<void, AuthorizeError, Crypto.Crypto>;
+declare namespace deletion_d_exports {
+  export { ApplyError, Authorization, CreateError, CreateInput, Error, Operation, PartialError, Plan, Receipt, Requirements, apply, authorize, create, validate };
+}
+declare const Operation: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly providerRecordId: Schema.String;
+  readonly record: Schema.TaggedUnion<{
+    readonly A: Schema.TaggedStruct<"A", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly address: Schema.String;
+    }>;
+    readonly AAAA: Schema.TaggedStruct<"AAAA", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly address: Schema.String;
+    }>;
+    readonly CAA: Schema.TaggedStruct<"CAA", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly flags: Schema.Int;
+      readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+      readonly value: Schema.String;
+    }>;
+    readonly CNAME: Schema.TaggedStruct<"CNAME", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly policy: Schema.Literal<"exclusive">;
+      readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    }>;
+    readonly MX: Schema.TaggedStruct<"MX", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly priority: Schema.Int;
+    }>;
+    readonly NS: Schema.TaggedStruct<"NS", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    }>;
+    readonly SRV: Schema.TaggedStruct<"SRV", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly port: Schema.Int;
+      readonly priority: Schema.Int;
+      readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly weight: Schema.Int;
+    }>;
+    readonly TXT: Schema.TaggedStruct<"TXT", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly value: Schema.String;
+    }>;
+  }>;
+}>;
+interface Operation extends Schema.Schema.Type<typeof Operation> {}
+declare const Plan: Schema.Struct<{
+  readonly createdAt: Schema.DateFromString;
+  readonly expiresAt: Schema.DateFromString;
+  readonly operations: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly providerRecordId: Schema.String;
+    readonly record: Schema.TaggedUnion<{
+      readonly A: Schema.TaggedStruct<"A", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly address: Schema.String;
+      }>;
+      readonly AAAA: Schema.TaggedStruct<"AAAA", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly address: Schema.String;
+      }>;
+      readonly CAA: Schema.TaggedStruct<"CAA", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly flags: Schema.Int;
+        readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+        readonly value: Schema.String;
+      }>;
+      readonly CNAME: Schema.TaggedStruct<"CNAME", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly policy: Schema.Literal<"exclusive">;
+        readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      }>;
+      readonly MX: Schema.TaggedStruct<"MX", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly priority: Schema.Int;
+      }>;
+      readonly NS: Schema.TaggedStruct<"NS", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      }>;
+      readonly SRV: Schema.TaggedStruct<"SRV", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly port: Schema.Int;
+        readonly priority: Schema.Int;
+        readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly weight: Schema.Int;
+      }>;
+      readonly TXT: Schema.TaggedStruct<"TXT", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly value: Schema.String;
+      }>;
+    }>;
+  }>>;
+  readonly providerId: Schema.String;
+  readonly sourcePlanDigest: Schema.String;
+  readonly version: Schema.Literal<"domainkit.deletion-plan.v1">;
+  readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly digest: Schema.String;
+}>;
+interface Plan extends Schema.Schema.Type<typeof Plan> {}
+declare const Authorization: Schema.Struct<{
+  readonly operationIds: Schema.$Array<Schema.String>;
+  readonly planDigest: Schema.String;
+  readonly version: Schema.Literal<"domainkit.deletion-authorization.v1">;
+}>;
+interface Authorization extends Schema.Schema.Type<typeof Authorization> {}
+declare const Receipt: Schema.Struct<{
+  readonly deletedAt: Schema.DateFromString;
+  readonly operations: Schema.$Array<Schema.Struct<{
+    readonly operationId: Schema.String;
+    readonly providerRecordId: Schema.String;
+  }>>;
+  readonly planDigest: Schema.String;
+  readonly providerId: Schema.String;
+  readonly status: Schema.Literals<readonly ["complete", "partial"]>;
+  readonly version: Schema.Literal<"domainkit.deletion-receipt.v1">;
+  readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>;
+interface Receipt extends Schema.Schema.Type<typeof Receipt> {}
+declare const Error_base: Schema.Class<Error, Schema.TaggedStruct<"UnsafeDeletionError", {
+  readonly message: Schema.String;
+  readonly operationId: Schema.optionalKey<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error extends Error_base {}
+declare const PartialError_base: Schema.Class<PartialError, Schema.TaggedStruct<"PartialDeletionError", {
+  readonly failedOperationId: Schema.String;
+  readonly message: Schema.String;
+  readonly receipt: Schema.Struct<{
+    readonly deletedAt: Schema.DateFromString;
+    readonly operations: Schema.$Array<Schema.Struct<{
+      readonly operationId: Schema.String;
+      readonly providerRecordId: Schema.String;
+    }>>;
+    readonly planDigest: Schema.String;
+    readonly providerId: Schema.String;
+    readonly status: Schema.Literals<readonly ["complete", "partial"]>;
+    readonly version: Schema.Literal<"domainkit.deletion-receipt.v1">;
+    readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+}>, import("effect/Cause").YieldableError>;
+declare class PartialError extends PartialError_base {}
+interface CreateInput {
+  readonly plan: DnsPlan;
+  readonly receipt: ApplyReceipt;
+  readonly ttlMs?: number;
+}
+/** Build a fresh deletion plan only from records proven by a prior create receipt. */
+declare const create: (input: CreateInput) => Effect.Effect<{
+  createdAt: Date;
+  expiresAt: Date;
+  operations: readonly {
+    readonly id: string;
+    readonly providerRecordId: string;
+    readonly record: {
+      readonly _tag: "A";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "AAAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "CAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly flags: number;
+      readonly tag: "iodef" | "issue" | "issuewild";
+      readonly value: string;
+    } | {
+      readonly _tag: "CNAME";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number | null;
+      readonly policy: "exclusive";
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "MX";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+      readonly priority: number;
+    } | {
+      readonly _tag: "NS";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "SRV";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly port: number;
+      readonly priority: number;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+      readonly weight: number;
+    } | {
+      readonly _tag: "TXT";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly value: string;
+    };
+  }[];
+  providerId: string;
+  sourcePlanDigest: string;
+  version: "domainkit.deletion-plan.v1";
+  zone: string & import("effect/Brand").Brand<"DomainName">;
+  digest: string;
+}, Error$3 | Error | AuthorizeError, Crypto.Crypto | Service>;
+/** Produce a separate digest-bound consent artifact for destructive operations. */
+declare const authorize: (plan: Plan, operationIds?: readonly string[] | undefined) => Effect.Effect<{
+  operationIds: string[];
+  planDigest: string;
+  version: "domainkit.deletion-authorization.v1";
+}, CryptoError | Error, Crypto.Crypto>;
+/** Re-read every approved record before the first delete, then delete by provider record ID. */
+declare const apply: (input: {
+  readonly authorization: Authorization;
+  readonly plan: Plan;
+  readonly priorReceipt?: Receipt;
+}) => Effect.Effect<Receipt, CryptoError | Error$3 | Error | PartialError, Crypto.Crypto | Service>;
+declare function validate(plan: Plan): Effect.Effect<void, Error | CryptoError, Crypto.Crypto>;
+type CreateError = Error | Error$2 | AuthorizationError | Error$3 | CryptoError;
+type ApplyError = Error | PartialError | Error$3 | CryptoError;
+type Requirements = Service | Crypto.Crypto;
 declare namespace doh_d_exports {
   export { Fetch, Options$1 as Options, layer$1 as layer, make$1 as make, toAsync$1 as toAsync };
 }
@@ -598,7 +1026,7 @@ interface Options$1 {
   readonly timeoutMs?: number;
 }
 declare function make$1(options: Options$1): Interface;
-declare const layer$1: (options: Options$1) => Layer.Layer<Service$4>;
+declare const layer$1: (options: Options$1) => Layer.Layer<Service$5>;
 declare const toAsync$1: (options: Options$1) => AsyncInterface;
 declare namespace cloudflare_doh_d_exports {
   export { Options, layer, make, toAsync };
@@ -607,7 +1035,7 @@ interface Options extends Omit<Options$1, "endpoint"> {
   readonly endpoint?: string;
 }
 declare function make(options?: Options): Interface;
-declare const layer: (options?: Options) => Layer.Layer<Service$4>;
+declare const layer: (options?: Options) => Layer.Layer<Service$5>;
 declare const toAsync: (options?: Options) => AsyncInterface;
 declare namespace verify_d_exports {
   export { ProviderObservation, PublicDnsObservation, Result, record };
@@ -973,7 +1401,7 @@ declare const record: (input: {
     readonly _tag: "timeout";
   };
   status: "mismatch" | "pending" | "unavailable" | "verified";
-}, never, Service | Service$4>;
+}, never, Service | Service$5>;
 //#endregion
-export { canonical_json_d_exports as _, Options$1 as a, CreateInput as c, zones_d_exports as d, selection_d_exports as f, CryptoError as g, oauth_d_exports as h, cloudflare_doh_d_exports as i, plan_d_exports as l, Fetch$1 as m, verify_d_exports as n, doh_d_exports as o, BeginInput as p, Options as r, AuthorizeError as s, Result as t, renderManualInstructions as u };
-//# sourceMappingURL=verify-DPB1OfZ5.d.mts.map
+export { updateGrant as A, Fetch$1 as C, DetachResult as D, canonical_json_d_exports as E, Error$1 as O, BeginInput as S, CryptoError as T, CreateInput$1 as _, Options$1 as a, zones_d_exports as b, Authorization as c, Operation as d, PartialError as f, AuthorizeError as g, deletion_d_exports as h, cloudflare_doh_d_exports as i, connection_lifecycle_d_exports as k, CreateError as l, Receipt as m, verify_d_exports as n, doh_d_exports as o, Plan as p, Options as r, ApplyError as s, Result as t, Error as u, plan_d_exports as v, oauth_d_exports as w, selection_d_exports as x, renderManualInstructions as y };
+//# sourceMappingURL=verify-B80xCBh2.d.mts.map