domainkit 0.1.0 → 0.2.0

package/dist/connection-BWrBwqjk.mjs

@@ -0,0 +1,58 @@
+import { O as parse, T as Schema$2, k as Error$1 } from "./dns-record-BLeqo56C.mjs";
+import { l as evidenceFor } from "./authorization-DOg2Re1D.mjs";
+import { Effect, Schema } from "effect";
+//#region src/auth/connection.ts
+const Grant = Schema.TaggedUnion({
+	account: {},
+	domains: { domains: Schema.Array(Schema$2) }
+});
+/** An owner-scoped grant bound to one provider authorization. */
+const Schema$1 = Schema.Struct({
+	authorizationId: Schema.String,
+	createdAt: Schema.DateFromString,
+	grant: Grant,
+	id: Schema.String,
+	ownerId: Schema.String
+});
+const decode = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const validate = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$1))(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
+const encode = Schema.encodeSync(Schema$1);
+var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", {
+	category: Schema.Literal("authorization"),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+const authorizationError = (message, operation) => new AuthorizationError({
+	category: "authorization",
+	message,
+	operation,
+	retry: "after-user-action"
+});
+function assertGrant(connection, authorization, request) {
+	if (connection.authorizationId !== authorization.id || authorization.providerId !== request.providerId || authorization.revocation._tag !== "Active") throw authorizationError("Connection does not grant this provider account", "Connection.assertGrant");
+	if (authorization.expiresAt !== null) {
+		if (Number.isNaN(authorization.expiresAt.getTime())) throw authorizationError("Connection expiration is invalid", "Connection.assertGrant");
+		if (authorization.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw authorizationError("Connection has expired", "Connection.assertGrant");
+	}
+	if (!authorization.requiredCapabilities.includes(request.capability)) throw authorizationError(`Connection lacks the ${request.capability} capability`, "Connection.assertGrant");
+	if (evidenceFor(authorization, request.capability) === void 0) throw authorizationError(`Connection has no evidence for the ${request.capability} capability`, "Connection.assertGrant");
+	let domain;
+	try {
+		domain = parse(request.domain);
+	} catch (cause) {
+		if (cause instanceof Error$1) throw cause;
+		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
+	}
+	if (connection.grant._tag === "domains" && !connection.grant.domains.includes(domain)) throw authorizationError("Connection does not grant this domain", "Connection.assertGrant");
+	return domain;
+}
+//#endregion
+export { authorizationError as a, validate as c, assertGrant as i, Grant as n, decode as o, Schema$1 as r, encode as s, AuthorizationError as t };
+
+//# sourceMappingURL=connection-BWrBwqjk.mjs.map

package/dist/connection-BWrBwqjk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-BWrBwqjk.mjs","names":["S","DomainName.Schema","Schema","InvalidInputError","ProviderAuthorization.evidenceFor","DomainName.parse"],"sources":["../src/auth/connection.ts"],"sourcesContent":["import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\nimport type { OAuthMethod } from \"./manifest.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\n\nexport const Grant = S.TaggedUnion({\n  account: {},\n  domains: { domains: S.Array(DomainName.Schema) },\n});\nexport type Grant = typeof Grant.Type;\n\n/** An owner-scoped grant bound to one provider authorization. */\nexport const Schema = S.Struct({\n  authorizationId: S.String,\n  createdAt: S.DateFromString,\n  grant: Grant,\n  id: S.String,\n  ownerId: S.String,\n});\nexport interface Connection extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"Connection.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"Connection.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport interface OAuthContinuation {\n  readonly clientId: string;\n  readonly codeVerifier: Secret;\n  readonly expiresAt: Date;\n  readonly grant: Grant;\n  readonly method: OAuthMethod;\n  readonly ownerId: string;\n  readonly redirectUri: string;\n  readonly stateHash: string;\n  readonly authorizedById: string;\n}\n\nexport interface StoredCredential {\n  readonly accessToken: Secret;\n  readonly refreshToken: Secret | null;\n  readonly tokenType: string;\n}\n\nexport class AuthorizationError extends S.TaggedError<AuthorizationError>()(\"AuthorizationError\", {\n  category: S.Literal(\"authorization\"),\n  message: S.String,\n  operation: S.String,\n  retry: S.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport const authorizationError = (message: string, operation: string): AuthorizationError =>\n  new AuthorizationError({\n    category: \"authorization\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n\nexport function assertGrant(\n  connection: Connection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  request: {\n    readonly capability: ProviderAuthorization.Capability;\n    readonly domain: string;\n    readonly now?: Date;\n    readonly providerId: string;\n  },\n): DomainName.DomainName {\n  if (\n    connection.authorizationId !== authorization.id ||\n    authorization.providerId !== request.providerId ||\n    authorization.revocation._tag !== \"Active\"\n  ) {\n    throw authorizationError(\n      \"Connection does not grant this provider account\",\n      \"Connection.assertGrant\",\n    );\n  }\n  if (authorization.expiresAt !== null) {\n    if (Number.isNaN(authorization.expiresAt.getTime())) {\n      throw authorizationError(\"Connection expiration is invalid\", \"Connection.assertGrant\");\n    }\n    if (authorization.expiresAt <= (request.now ?? new Date())) {\n      throw authorizationError(\"Connection has expired\", \"Connection.assertGrant\");\n    }\n  }\n  if (!authorization.requiredCapabilities.includes(request.capability)) {\n    throw authorizationError(\n      `Connection lacks the ${request.capability} capability`,\n      \"Connection.assertGrant\",\n    );\n  }\n  if (ProviderAuthorization.evidenceFor(authorization, request.capability) === undefined) {\n    throw authorizationError(\n      `Connection has no evidence for the ${request.capability} capability`,\n      \"Connection.assertGrant\",\n    );\n  }\n  let domain: DomainName.DomainName;\n  try {\n    domain = DomainName.parse(request.domain);\n  } catch (cause) {\n    if (cause instanceof InvalidInputError) throw cause;\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n  if (connection.grant._tag === \"domains\" && !connection.grant.domains.includes(domain)) {\n    throw authorizationError(\"Connection does not grant this domain\", \"Connection.assertGrant\");\n  }\n  return domain;\n}\n"],"mappings":";;;;AAQA,MAAa,QAAQA,OAAE,YAAY;CACjC,SAAS,CAAC;CACV,SAAS,EAAE,SAASA,OAAE,MAAMC,QAAiB,EAAE;AACjD,CAAC;;AAID,MAAaC,WAASF,OAAE,OAAO;CAC7B,iBAAiBA,OAAE;CACnB,WAAWA,OAAE;CACb,OAAO;CACP,IAAIA,OAAE;CACN,SAASA,OAAE;AACb,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACpDA,OAAE,oBAAoBE,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,EAAE,UACxDH,OAAE,oBAAoBA,OAAE,OAAOE,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASH,OAAE,WAAWE,QAAM;AAoBzC,IAAa,qBAAb,cAAwCF,OAAE,YAAgC,CAAC,CAAC,sBAAsB;CAChG,UAAUA,OAAE,QAAQ,eAAe;CACnC,SAASA,OAAE;CACX,WAAWA,OAAE;CACb,OAAOA,OAAE,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AACrE,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,sBAAsB,SAAiB,cAClD,IAAI,mBAAmB;CACrB,UAAU;CACV;CACA;CACA,OAAO;AACT,CAAC;AAEH,SAAgB,YACd,YACA,eACA,SAMuB;CACvB,IACE,WAAW,oBAAoB,cAAc,MAC7C,cAAc,eAAe,QAAQ,cACrC,cAAc,WAAW,SAAS,UAElC,MAAM,mBACJ,mDACA,wBACF;CAEF,IAAI,cAAc,cAAc,MAAM;EACpC,IAAI,OAAO,MAAM,cAAc,UAAU,QAAQ,CAAC,GAChD,MAAM,mBAAmB,oCAAoC,wBAAwB;EAEvF,IAAI,cAAc,cAAc,QAAQ,uBAAO,IAAI,KAAK,IACtD,MAAM,mBAAmB,0BAA0B,wBAAwB;CAE/E;CACA,IAAI,CAAC,cAAc,qBAAqB,SAAS,QAAQ,UAAU,GACjE,MAAM,mBACJ,wBAAwB,QAAQ,WAAW,cAC3C,wBACF;CAEF,IAAII,YAAkC,eAAe,QAAQ,UAAU,MAAM,KAAA,GAC3E,MAAM,mBACJ,sCAAsC,QAAQ,WAAW,cACzD,wBACF;CAEF,IAAI;CACJ,IAAI;EACF,SAASC,MAAiB,QAAQ,MAAM;CAC1C,SAAS,OAAO;EACd,IAAI,iBAAiBF,SAAmB,MAAM;EAC9C,MAAM,IAAIA,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;CACA,IAAI,WAAW,MAAM,SAAS,aAAa,CAAC,WAAW,MAAM,QAAQ,SAAS,MAAM,GAClF,MAAM,mBAAmB,yCAAyC,wBAAwB;CAE5F,OAAO;AACT"}

package/dist/connection-CEqadXSm.d.mts

@@ -0,0 +1,182 @@
+import { A as Connection, B as Capability, C as Aggregate, D as Service, E as Interface, F as assertGrant, M as OAuthContinuation, N as Schema$1, Nt as DomainName, P as StoredCredential, R as encode, T as Error, V as CapabilityEvidence, _ as StartResult, a as Authentication, ct as AsyncInterface, d as Error$1, h as Method$1, j as Grant, k as AuthorizationError, l as Continuation, m as InteractiveStart, ot as Value, p as InteractiveFlow$1, r as Source$1, s as BaseInput, t as Candidate, u as ContinuationStore$1, w as DetachResult } from "./zone-discovery-BA5I24vu.mjs";
+import "./connection-api-DftK7eHo.mjs";
+import { Data, Layer } from "effect";
+declare namespace zone_discovery_d_exports {
+  export { Candidate, Outcome, Source, discover, toEffectSource };
+}
+interface Source {
+  readonly listZones: (name: DomainName) => Promise<ReadonlyArray<Omit<Candidate, "providerId">>>;
+  readonly provider: AsyncInterface;
+}
+type Outcome = {
+  readonly _tag: "NotFound";
+  readonly domain: DomainName;
+} | {
+  readonly _tag: "Resolved";
+  readonly candidate: Candidate;
+} | {
+  readonly _tag: "SelectionRequired";
+  readonly candidates: ReadonlyArray<Candidate>;
+};
+declare function discover(input: {
+  readonly domain: DomainName;
+  readonly sources: ReadonlyArray<Source>;
+}): Promise<Outcome>;
+declare function toEffectSource(source: Source): Source$1;
+declare namespace authorization_lifecycle_d_exports {
+  export { Aggregate, DetachResult, Error, Repository, from, layerFrom, toAsync };
+}
+interface Repository {
+  readonly bind: (authorizationId: string, binding: Connection) => Promise<Aggregate>;
+  readonly connect: (aggregate: Aggregate) => Promise<Aggregate>;
+  readonly detach: (input: {
+    readonly connectionId: string;
+    readonly revoke: (aggregate: Aggregate) => Promise<void>;
+  }) => Promise<DetachResult>;
+  readonly findByProviderAccount: (providerId: string, providerAccountId: string) => Promise<Aggregate | null>;
+  readonly get: (authorizationId: string) => Promise<Aggregate | null>;
+  readonly getByConnectionId: (connectionId: string) => Promise<Aggregate | null>;
+  readonly promoteEvidence: (authorizationId: string, evidence: ReadonlyArray<CapabilityEvidence>) => Promise<Aggregate>;
+  readonly recover: (input: {
+    readonly authorizationId: string;
+    readonly revoke: (aggregate: Aggregate) => Promise<void>;
+  }) => Promise<DetachResult>;
+  readonly rotate: (authorizationId: string, credential: StoredCredential, expiresAt: Date | null) => Promise<Aggregate>;
+}
+declare const layerFrom: (repository: Repository) => Layer.Layer<Service>;
+declare const toAsync: (repository: Interface) => Repository;
+declare const from: (repository: Repository) => Repository;
+declare namespace connection_d_exports {
+  export { Authentication, AuthorizationError, Connection, StartResult as ConnectionStartResult, ContinuationStore, Error$1 as Error, Grant, InteractiveFlow, Method, OAuthContinuation, Schema$1 as Schema, StartResult, StoredCredential, assertGrant, complete, decode, encode, fromEffectFlow, fromEffectTokenMethod, start, toAsyncContinuations };
+}
+declare function decode(input: unknown): Promise<Connection>;
+type Method = Data.TaggedEnum<{
+  Interactive: {
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  };
+  Token: {
+    readonly authenticate: (token: Value) => Promise<Authentication>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  };
+}>;
+declare const Method: {
+  readonly $is: <Tag extends "Interactive" | "Token">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "Interactive";
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Token";
+    readonly authenticate: (token: Value) => Promise<Authentication>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Promise<Authentication>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Promise<Authentication>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
+    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Promise<Authentication>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Promise<Authentication>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
+  };
+  readonly Interactive: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Interactive";
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  }, "_tag">;
+  readonly Token: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Token";
+    readonly authenticate: (token: Value) => Promise<Authentication>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  }, "_tag">;
+};
+interface ContinuationStore {
+  readonly consume: (id: string, now: Date) => Promise<Continuation | null>;
+  readonly put: (continuation: Continuation) => Promise<void>;
+}
+interface InteractiveFlow {
+  readonly complete: (payload: Value, callbackUrl: URL) => Promise<Authentication>;
+  readonly method: "integration" | "oauth2";
+  readonly providerId: string;
+  readonly requiredCapabilities: ReadonlyArray<Capability>;
+  readonly start: (continuationId: string) => Promise<InteractiveStart>;
+}
+declare const toAsyncContinuations: (store: ContinuationStore$1) => ContinuationStore;
+/** Adapts an Effect-native provider flow to the Promise facade. */
+declare const fromEffectFlow: (flow: InteractiveFlow$1) => InteractiveFlow;
+/** Adapts an Effect-native token method to the Promise facade. */
+declare function fromEffectTokenMethod(method: Extract<Method$1, {
+  readonly _tag: "Token";
+}>): Extract<Method, {
+  readonly _tag: "Token";
+}>;
+declare function start(input: BaseInput & {
+  readonly method: Method;
+  readonly repository: Repository;
+}): Promise<StartResult>;
+declare function complete(input: {
+  readonly callbackUrl: URL;
+  readonly continuationId: string;
+  readonly continuations: ContinuationStore;
+  readonly flow: InteractiveFlow;
+  readonly repository: Repository;
+}): Promise<Aggregate>;
+//#endregion
+export { Source as a, authorization_lifecycle_d_exports as i, Method as n, zone_discovery_d_exports as o, connection_d_exports as r, InteractiveFlow as t };
+//# sourceMappingURL=connection-CEqadXSm.d.mts.map

package/dist/connection-CcQokgrd.mjs

@@ -0,0 +1,186 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { M as Service, j as Error } from "./dns-record-BLeqo56C.mjs";
+import { _ as StartResult, g as Method$1, h as Error$1, v as complete$1, y as start$1 } from "./authorization-DOg2Re1D.mjs";
+import { i as assertGrant, n as Grant, o as decode$1, r as Schema$1, s as encode, t as AuthorizationError } from "./connection-BWrBwqjk.mjs";
+import { i as webCryptoLayer } from "./canonical-json-CpvqGMcr.mjs";
+import { Data, Effect, Layer } from "effect";
+//#region src/promise/authorization-lifecycle.ts
+var authorization_lifecycle_exports = /* @__PURE__ */ __exportAll({
+	Error: () => Error,
+	from: () => from,
+	layerFrom: () => layerFrom,
+	toAsync: () => toAsync
+});
+const failure = (operation, cause) => cause instanceof Error ? cause : new Error({
+	category: "storage",
+	message: cause instanceof globalThis.Error ? cause.message : String(cause),
+	operation,
+	retry: "safe"
+});
+const layerFrom = (repository) => Layer.succeed(Service, {
+	bind: Effect.fn("AuthorizationLifecycleRepository.bind")((authorizationId, binding) => Effect.tryPromise({
+		try: () => repository.bind(authorizationId, binding),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.bind", cause)
+	})),
+	connect: Effect.fn("AuthorizationLifecycleRepository.connect")((aggregate) => Effect.tryPromise({
+		try: () => repository.connect(aggregate),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.connect", cause)
+	})),
+	detach: ({ connectionId, revoke }) => Effect.tryPromise({
+		try: () => repository.detach({
+			connectionId,
+			revoke: (aggregate) => Effect.runPromise(revoke(aggregate))
+		}),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.detach", cause)
+	}),
+	findByProviderAccount: Effect.fn("AuthorizationLifecycleRepository.findByProviderAccount")((providerId, providerAccountId) => Effect.tryPromise({
+		try: () => repository.findByProviderAccount(providerId, providerAccountId),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.findByProviderAccount", cause)
+	})),
+	get: Effect.fn("AuthorizationLifecycleRepository.get")((authorizationId) => Effect.tryPromise({
+		try: () => repository.get(authorizationId),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.get", cause)
+	})),
+	getByConnectionId: Effect.fn("AuthorizationLifecycleRepository.getByConnectionId")((connectionId) => Effect.tryPromise({
+		try: () => repository.getByConnectionId(connectionId),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.getByConnectionId", cause)
+	})),
+	promoteEvidence: Effect.fn("AuthorizationLifecycleRepository.promoteEvidence")((authorizationId, evidence) => Effect.tryPromise({
+		try: () => repository.promoteEvidence(authorizationId, evidence),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.promoteEvidence", cause)
+	})),
+	recover: ({ authorizationId, revoke }) => Effect.tryPromise({
+		try: () => repository.recover({
+			authorizationId,
+			revoke: (aggregate) => Effect.runPromise(revoke(aggregate))
+		}),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.recover", cause)
+	}),
+	rotate: Effect.fn("AuthorizationLifecycleRepository.rotate")((authorizationId, credential, expiresAt) => Effect.tryPromise({
+		try: () => repository.rotate(authorizationId, credential, expiresAt),
+		catch: (cause) => failure("AuthorizationLifecycleRepository.rotate", cause)
+	}))
+});
+const toAsync = (repository) => ({
+	bind: (authorizationId, binding) => Effect.runPromise(repository.bind(authorizationId, binding)),
+	connect: (aggregate) => Effect.runPromise(repository.connect(aggregate)),
+	detach: ({ connectionId, revoke }) => Effect.runPromise(repository.detach({
+		connectionId,
+		revoke: (aggregate) => Effect.tryPromise(() => revoke(aggregate))
+	})),
+	findByProviderAccount: (providerId, providerAccountId) => Effect.runPromise(repository.findByProviderAccount(providerId, providerAccountId)),
+	get: (authorizationId) => Effect.runPromise(repository.get(authorizationId)),
+	getByConnectionId: (connectionId) => Effect.runPromise(repository.getByConnectionId(connectionId)),
+	promoteEvidence: (authorizationId, evidence) => Effect.runPromise(repository.promoteEvidence(authorizationId, evidence)),
+	recover: ({ authorizationId, revoke }) => Effect.runPromise(repository.recover({
+		authorizationId,
+		revoke: (aggregate) => Effect.tryPromise(() => revoke(aggregate))
+	})),
+	rotate: (authorizationId, credential, expiresAt) => Effect.runPromise(repository.rotate(authorizationId, credential, expiresAt))
+});
+const from = (repository) => repository;
+//#endregion
+//#region src/promise/connection.ts
+var connection_exports = /* @__PURE__ */ __exportAll({
+	AuthorizationError: () => AuthorizationError,
+	Error: () => Error$1,
+	Grant: () => Grant,
+	Method: () => Method,
+	Schema: () => Schema$1,
+	StartResult: () => StartResult,
+	assertGrant: () => assertGrant,
+	complete: () => complete,
+	decode: () => decode,
+	encode: () => encode,
+	fromEffectFlow: () => fromEffectFlow,
+	fromEffectTokenMethod: () => fromEffectTokenMethod,
+	start: () => start,
+	toAsyncContinuations: () => toAsyncContinuations
+});
+function decode(input) {
+	return Effect.runPromise(decode$1(input));
+}
+const Method = Data.taggedEnum();
+const connectionFailure = (operation, cause) => cause instanceof Error$1 ? cause : new Error$1({
+	category: "provider",
+	message: cause instanceof globalThis.Error ? cause.message : String(cause),
+	operation,
+	retry: "unknown"
+});
+const effectMethod = (method) => method._tag === "Interactive" ? Method$1.Interactive({
+	continuations: effectContinuations(method.continuations),
+	flow: effectFlow(method.flow),
+	...method.ttlMs === void 0 ? {} : { ttlMs: method.ttlMs }
+}) : Method$1.Token({
+	authenticate: (token) => Effect.tryPromise({
+		try: () => method.authenticate(token),
+		catch: (cause) => connectionFailure("Connection.start", cause)
+	}),
+	providerId: method.providerId,
+	requiredCapabilities: method.requiredCapabilities,
+	token: method.token
+});
+const effectContinuations = (store) => ({
+	consume: (id, now) => Effect.tryPromise({
+		try: () => store.consume(id, now),
+		catch: (cause) => connectionFailure("ConnectionContinuations.consume", cause)
+	}),
+	put: (continuation) => Effect.tryPromise({
+		try: () => store.put(continuation),
+		catch: (cause) => connectionFailure("ConnectionContinuations.put", cause)
+	})
+});
+const toAsyncContinuations = (store) => ({
+	consume: (id, now) => Effect.runPromise(store.consume(id, now)),
+	put: (continuation) => Effect.runPromise(store.put(continuation))
+});
+const effectFlow = (flow) => ({
+	complete: (payload, callbackUrl) => Effect.tryPromise({
+		try: () => flow.complete(payload, callbackUrl),
+		catch: (cause) => connectionFailure("Connection.complete", cause)
+	}),
+	method: flow.method,
+	providerId: flow.providerId,
+	requiredCapabilities: flow.requiredCapabilities,
+	start: (continuationId) => Effect.tryPromise({
+		try: () => flow.start(continuationId),
+		catch: (cause) => connectionFailure("Connection.start", cause)
+	})
+});
+/** Adapts an Effect-native provider flow to the Promise facade. */
+const fromEffectFlow = (flow) => ({
+	complete: (payload, callbackUrl) => Effect.runPromise(flow.complete(payload, callbackUrl)),
+	method: flow.method,
+	providerId: flow.providerId,
+	requiredCapabilities: flow.requiredCapabilities,
+	start: (continuationId) => Effect.runPromise(flow.start(continuationId).pipe(Effect.provide(webCryptoLayer)))
+});
+/** Adapts an Effect-native token method to the Promise facade. */
+function fromEffectTokenMethod(method) {
+	return Method.Token({
+		authenticate: (token) => Effect.runPromise(method.authenticate(token)),
+		providerId: method.providerId,
+		requiredCapabilities: method.requiredCapabilities,
+		token: method.token
+	});
+}
+async function start(input) {
+	return Effect.runPromise(start$1({
+		authorizedById: input.authorizedById,
+		grant: input.grant,
+		method: effectMethod(input.method),
+		ownerId: input.ownerId
+	}).pipe(Effect.provide(Layer.merge(layerFrom(input.repository), webCryptoLayer))));
+}
+async function complete(input) {
+	return Effect.runPromise(complete$1({
+		callbackUrl: input.callbackUrl,
+		continuationId: input.continuationId,
+		continuations: effectContinuations(input.continuations),
+		flow: effectFlow(input.flow)
+	}).pipe(Effect.provide(Layer.merge(layerFrom(input.repository), webCryptoLayer))));
+}
+//#endregion
+export { authorization_lifecycle_exports as i, fromEffectFlow as n, fromEffectTokenMethod as r, connection_exports as t };
+
+//# sourceMappingURL=connection-CcQokgrd.mjs.map

package/dist/connection-CcQokgrd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-CcQokgrd.mjs","names":["Lifecycle.Error","Lifecycle.Service","Connection.decode","Connect.Error","Connect.start","LifecycleRepository.layerFrom","Connect.complete"],"sources":["../src/promise/authorization-lifecycle.ts","../src/promise/connection.ts"],"sourcesContent":["import { Effect, Layer } from \"effect\";\n\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport type * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface Repository {\n  readonly bind: (\n    authorizationId: string,\n    binding: Connection.Connection,\n  ) => Promise<Lifecycle.Aggregate>;\n  readonly connect: (aggregate: Lifecycle.Aggregate) => Promise<Lifecycle.Aggregate>;\n  readonly detach: (input: {\n    readonly connectionId: string;\n    readonly revoke: (aggregate: Lifecycle.Aggregate) => Promise<void>;\n  }) => Promise<Lifecycle.DetachResult>;\n  readonly findByProviderAccount: (\n    providerId: string,\n    providerAccountId: string,\n  ) => Promise<Lifecycle.Aggregate | null>;\n  readonly get: (authorizationId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly getByConnectionId: (connectionId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly promoteEvidence: (\n    authorizationId: string,\n    evidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  ) => Promise<Lifecycle.Aggregate>;\n  readonly recover: (input: {\n    readonly authorizationId: string;\n    readonly revoke: (aggregate: Lifecycle.Aggregate) => Promise<void>;\n  }) => Promise<Lifecycle.DetachResult>;\n  readonly rotate: (\n    authorizationId: string,\n    credential: Connection.StoredCredential,\n    expiresAt: Date | null,\n  ) => Promise<Lifecycle.Aggregate>;\n}\n\nconst failure = (operation: string, cause: unknown): Lifecycle.Error =>\n  cause instanceof Lifecycle.Error\n    ? cause\n    : new Lifecycle.Error({\n        category: \"storage\",\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        retry: \"safe\",\n      });\n\nexport const layerFrom = (repository: Repository): Layer.Layer<Lifecycle.Service> =>\n  Layer.succeed(Lifecycle.Service, {\n    bind: Effect.fn(\"AuthorizationLifecycleRepository.bind\")((authorizationId, binding) =>\n      Effect.tryPromise({\n        try: () => repository.bind(authorizationId, binding),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.bind\", cause),\n      }),\n    ),\n    connect: Effect.fn(\"AuthorizationLifecycleRepository.connect\")((aggregate) =>\n      Effect.tryPromise({\n        try: () => repository.connect(aggregate),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.connect\", cause),\n      }),\n    ),\n    detach: ({ connectionId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.detach({\n            connectionId,\n            revoke: (aggregate) => Effect.runPromise(revoke(aggregate)),\n          }),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.detach\", cause),\n      }),\n    findByProviderAccount: Effect.fn(\"AuthorizationLifecycleRepository.findByProviderAccount\")(\n      (providerId, providerAccountId) =>\n        Effect.tryPromise({\n          try: () => repository.findByProviderAccount(providerId, providerAccountId),\n          catch: (cause) =>\n            failure(\"AuthorizationLifecycleRepository.findByProviderAccount\", cause),\n        }),\n    ),\n    get: Effect.fn(\"AuthorizationLifecycleRepository.get\")((authorizationId) =>\n      Effect.tryPromise({\n        try: () => repository.get(authorizationId),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.get\", cause),\n      }),\n    ),\n    getByConnectionId: Effect.fn(\"AuthorizationLifecycleRepository.getByConnectionId\")(\n      (connectionId) =>\n        Effect.tryPromise({\n          try: () => repository.getByConnectionId(connectionId),\n          catch: (cause) => failure(\"AuthorizationLifecycleRepository.getByConnectionId\", cause),\n        }),\n    ),\n    promoteEvidence: Effect.fn(\"AuthorizationLifecycleRepository.promoteEvidence\")(\n      (authorizationId, evidence) =>\n        Effect.tryPromise({\n          try: () => repository.promoteEvidence(authorizationId, evidence),\n          catch: (cause) => failure(\"AuthorizationLifecycleRepository.promoteEvidence\", cause),\n        }),\n    ),\n    recover: ({ authorizationId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.recover({\n            authorizationId,\n            revoke: (aggregate) => Effect.runPromise(revoke(aggregate)),\n          }),\n        catch: (cause) => failure(\"AuthorizationLifecycleRepository.recover\", cause),\n      }),\n    rotate: Effect.fn(\"AuthorizationLifecycleRepository.rotate\")(\n      (authorizationId, credential, expiresAt) =>\n        Effect.tryPromise({\n          try: () => repository.rotate(authorizationId, credential, expiresAt),\n          catch: (cause) => failure(\"AuthorizationLifecycleRepository.rotate\", cause),\n        }),\n    ),\n  });\n\nexport const toAsync = (repository: Lifecycle.Interface): Repository => ({\n  bind: (authorizationId, binding) => Effect.runPromise(repository.bind(authorizationId, binding)),\n  connect: (aggregate) => Effect.runPromise(repository.connect(aggregate)),\n  detach: ({ connectionId, revoke }) =>\n    Effect.runPromise(\n      repository.detach({\n        connectionId,\n        revoke: (aggregate) => Effect.tryPromise(() => revoke(aggregate)),\n      }),\n    ),\n  findByProviderAccount: (providerId, providerAccountId) =>\n    Effect.runPromise(repository.findByProviderAccount(providerId, providerAccountId)),\n  get: (authorizationId) => Effect.runPromise(repository.get(authorizationId)),\n  getByConnectionId: (connectionId) =>\n    Effect.runPromise(repository.getByConnectionId(connectionId)),\n  promoteEvidence: (authorizationId, evidence) =>\n    Effect.runPromise(repository.promoteEvidence(authorizationId, evidence)),\n  recover: ({ authorizationId, revoke }) =>\n    Effect.runPromise(\n      repository.recover({\n        authorizationId,\n        revoke: (aggregate) => Effect.tryPromise(() => revoke(aggregate)),\n      }),\n    ),\n  rotate: (authorizationId, credential, expiresAt) =>\n    Effect.runPromise(repository.rotate(authorizationId, credential, expiresAt)),\n});\n\nexport const from = (repository: Repository): Repository => repository;\n\nexport { Error } from \"../auth/lifecycle-repository.ts\";\nexport type { Aggregate, DetachResult } from \"../auth/lifecycle-repository.ts\";\n","import { Data, Effect, Layer } from \"effect\";\n\nimport * as Connection from \"../auth/connection.ts\";\nimport * as Connect from \"../auth/connect.ts\";\nimport type * as Repository from \"./authorization-lifecycle.ts\";\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport { webCryptoLayer } from \"../plan/canonical-json.ts\";\nimport * as LifecycleRepository from \"./authorization-lifecycle.ts\";\nimport type * as Secret from \"../auth/secret.ts\";\n\nexport { assertGrant, AuthorizationError, encode, Grant, Schema } from \"../auth/connection.ts\";\nexport type { Connection, OAuthContinuation, StoredCredential } from \"../auth/connection.ts\";\n\nexport function decode(input: unknown): Promise<Connection.Connection> {\n  return Effect.runPromise(Connection.decode(input));\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (token: Secret.Value) => Promise<Connect.Authentication>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Promise<Connect.Continuation | null>;\n  readonly put: (continuation: Connect.Continuation) => Promise<void>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (payload: Secret.Value, callbackUrl: URL) => Promise<Connect.Authentication>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (continuationId: string) => Promise<Connect.InteractiveStart>;\n}\n\nconst connectionFailure = (operation: string, cause: unknown): Connect.Error =>\n  cause instanceof Connect.Error\n    ? cause\n    : new Connect.Error({\n        category: \"provider\",\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        retry: \"unknown\",\n      });\n\nconst effectMethod = (method: Method): Connect.Method =>\n  method._tag === \"Interactive\"\n    ? Connect.Method.Interactive({\n        continuations: effectContinuations(method.continuations),\n        flow: effectFlow(method.flow),\n        ...(method.ttlMs === undefined ? {} : { ttlMs: method.ttlMs }),\n      })\n    : Connect.Method.Token({\n        authenticate: (token) =>\n          Effect.tryPromise({\n            try: () => method.authenticate(token),\n            catch: (cause) => connectionFailure(\"Connection.start\", cause),\n          }),\n        providerId: method.providerId,\n        requiredCapabilities: method.requiredCapabilities,\n        token: method.token,\n      });\n\nconst effectContinuations = (store: ContinuationStore): Connect.ContinuationStore => ({\n  consume: (id, now) =>\n    Effect.tryPromise({\n      try: () => store.consume(id, now),\n      catch: (cause) => connectionFailure(\"ConnectionContinuations.consume\", cause),\n    }),\n  put: (continuation) =>\n    Effect.tryPromise({\n      try: () => store.put(continuation),\n      catch: (cause) => connectionFailure(\"ConnectionContinuations.put\", cause),\n    }),\n});\n\nexport const toAsyncContinuations = (store: Connect.ContinuationStore): ContinuationStore => ({\n  consume: (id, now) => Effect.runPromise(store.consume(id, now)),\n  put: (continuation) => Effect.runPromise(store.put(continuation)),\n});\n\nconst effectFlow = (flow: InteractiveFlow): Connect.InteractiveFlow => ({\n  complete: (payload, callbackUrl) =>\n    Effect.tryPromise({\n      try: () => flow.complete(payload, callbackUrl),\n      catch: (cause) => connectionFailure(\"Connection.complete\", cause),\n    }),\n  method: flow.method,\n  providerId: flow.providerId,\n  requiredCapabilities: flow.requiredCapabilities,\n  start: (continuationId) =>\n    Effect.tryPromise({\n      try: () => flow.start(continuationId),\n      catch: (cause) => connectionFailure(\"Connection.start\", cause),\n    }),\n});\n\n/** Adapts an Effect-native provider flow to the Promise facade. */\nexport const fromEffectFlow = (flow: Connect.InteractiveFlow): InteractiveFlow => ({\n  complete: (payload, callbackUrl) => Effect.runPromise(flow.complete(payload, callbackUrl)),\n  method: flow.method,\n  providerId: flow.providerId,\n  requiredCapabilities: flow.requiredCapabilities,\n  start: (continuationId) =>\n    Effect.runPromise(flow.start(continuationId).pipe(Effect.provide(webCryptoLayer))),\n});\n\n/** Adapts an Effect-native token method to the Promise facade. */\nexport function fromEffectTokenMethod(\n  method: Extract<Connect.Method, { readonly _tag: \"Token\" }>,\n): Extract<Method, { readonly _tag: \"Token\" }> {\n  return Method.Token({\n    authenticate: (token) => Effect.runPromise(method.authenticate(token)),\n    providerId: method.providerId,\n    requiredCapabilities: method.requiredCapabilities,\n    token: method.token,\n  });\n}\n\nexport async function start(\n  input: Connect.BaseInput & {\n    readonly method: Method;\n    readonly repository: Repository.Repository;\n  },\n): Promise<Connect.StartResult> {\n  return Effect.runPromise(\n    Connect.start({\n      authorizedById: input.authorizedById,\n      grant: input.grant,\n      method: effectMethod(input.method),\n      ownerId: input.ownerId,\n    }).pipe(\n      Effect.provide(Layer.merge(LifecycleRepository.layerFrom(input.repository), webCryptoLayer)),\n    ),\n  );\n}\n\nexport async function complete(input: {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n  readonly repository: Repository.Repository;\n}): Promise<Repository.Aggregate> {\n  return Effect.runPromise(\n    Connect.complete({\n      callbackUrl: input.callbackUrl,\n      continuationId: input.continuationId,\n      continuations: effectContinuations(input.continuations),\n      flow: effectFlow(input.flow),\n    }).pipe(\n      Effect.provide(Layer.merge(LifecycleRepository.layerFrom(input.repository), webCryptoLayer)),\n    ),\n  );\n}\n\nexport { Error, StartResult } from \"../auth/connect.ts\";\nexport type { Authentication, ConnectionStartResult } from \"../auth/connection-api.ts\";\n"],"mappings":";;;;;;;;;;;;;AAqCA,MAAM,WAAW,WAAmB,UAClC,iBAAiBA,QACb,QACA,IAAIA,MAAgB;CAClB,UAAU;CACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;CACzE;CACA,OAAO;AACT,CAAC;AAEP,MAAa,aAAa,eACxB,MAAM,QAAQC,SAAmB;CAC/B,MAAM,OAAO,GAAG,uCAAuC,CAAC,EAAE,iBAAiB,YACzE,OAAO,WAAW;EAChB,WAAW,WAAW,KAAK,iBAAiB,OAAO;EACnD,QAAQ,UAAU,QAAQ,yCAAyC,KAAK;CAC1E,CAAC,CACH;CACA,SAAS,OAAO,GAAG,0CAA0C,CAAC,EAAE,cAC9D,OAAO,WAAW;EAChB,WAAW,WAAW,QAAQ,SAAS;EACvC,QAAQ,UAAU,QAAQ,4CAA4C,KAAK;CAC7E,CAAC,CACH;CACA,SAAS,EAAE,cAAc,aACvB,OAAO,WAAW;EAChB,WACE,WAAW,OAAO;GAChB;GACA,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC;EAC5D,CAAC;EACH,QAAQ,UAAU,QAAQ,2CAA2C,KAAK;CAC5E,CAAC;CACH,uBAAuB,OAAO,GAAG,wDAAwD,CAAC,EACvF,YAAY,sBACX,OAAO,WAAW;EAChB,WAAW,WAAW,sBAAsB,YAAY,iBAAiB;EACzE,QAAQ,UACN,QAAQ,0DAA0D,KAAK;CAC3E,CAAC,CACL;CACA,KAAK,OAAO,GAAG,sCAAsC,CAAC,EAAE,oBACtD,OAAO,WAAW;EAChB,WAAW,WAAW,IAAI,eAAe;EACzC,QAAQ,UAAU,QAAQ,wCAAwC,KAAK;CACzE,CAAC,CACH;CACA,mBAAmB,OAAO,GAAG,oDAAoD,CAAC,EAC/E,iBACC,OAAO,WAAW;EAChB,WAAW,WAAW,kBAAkB,YAAY;EACpD,QAAQ,UAAU,QAAQ,sDAAsD,KAAK;CACvF,CAAC,CACL;CACA,iBAAiB,OAAO,GAAG,kDAAkD,CAAC,EAC3E,iBAAiB,aAChB,OAAO,WAAW;EAChB,WAAW,WAAW,gBAAgB,iBAAiB,QAAQ;EAC/D,QAAQ,UAAU,QAAQ,oDAAoD,KAAK;CACrF,CAAC,CACL;CACA,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WAAW;EAChB,WACE,WAAW,QAAQ;GACjB;GACA,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC;EAC5D,CAAC;EACH,QAAQ,UAAU,QAAQ,4CAA4C,KAAK;CAC7E,CAAC;CACH,QAAQ,OAAO,GAAG,yCAAyC,CAAC,EACzD,iBAAiB,YAAY,cAC5B,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,iBAAiB,YAAY,SAAS;EACnE,QAAQ,UAAU,QAAQ,2CAA2C,KAAK;CAC5E,CAAC,CACL;AACF,CAAC;AAEH,MAAa,WAAW,gBAAiD;CACvE,OAAO,iBAAiB,YAAY,OAAO,WAAW,WAAW,KAAK,iBAAiB,OAAO,CAAC;CAC/F,UAAU,cAAc,OAAO,WAAW,WAAW,QAAQ,SAAS,CAAC;CACvE,SAAS,EAAE,cAAc,aACvB,OAAO,WACL,WAAW,OAAO;EAChB;EACA,SAAS,cAAc,OAAO,iBAAiB,OAAO,SAAS,CAAC;CAClE,CAAC,CACH;CACF,wBAAwB,YAAY,sBAClC,OAAO,WAAW,WAAW,sBAAsB,YAAY,iBAAiB,CAAC;CACnF,MAAM,oBAAoB,OAAO,WAAW,WAAW,IAAI,eAAe,CAAC;CAC3E,oBAAoB,iBAClB,OAAO,WAAW,WAAW,kBAAkB,YAAY,CAAC;CAC9D,kBAAkB,iBAAiB,aACjC,OAAO,WAAW,WAAW,gBAAgB,iBAAiB,QAAQ,CAAC;CACzE,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WACL,WAAW,QAAQ;EACjB;EACA,SAAS,cAAc,OAAO,iBAAiB,OAAO,SAAS,CAAC;CAClE,CAAC,CACH;CACF,SAAS,iBAAiB,YAAY,cACpC,OAAO,WAAW,WAAW,OAAO,iBAAiB,YAAY,SAAS,CAAC;AAC/E;AAEA,MAAa,QAAQ,eAAuC;;;;;;;;;;;;;;;;;;;ACnI5D,SAAgB,OAAO,OAAgD;CACrE,OAAO,OAAO,WAAWC,SAAkB,KAAK,CAAC;AACnD;AAeA,MAAa,SAAS,KAAK,WAAmB;AAe9C,MAAM,qBAAqB,WAAmB,UAC5C,iBAAiBC,UACb,QACA,IAAIA,QAAc;CAChB,UAAU;CACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;CACzE;CACA,OAAO;AACT,CAAC;AAEP,MAAM,gBAAgB,WACpB,OAAO,SAAS,gBAAA,SACG,YAAY;CACzB,eAAe,oBAAoB,OAAO,aAAa;CACvD,MAAM,WAAW,OAAO,IAAI;CAC5B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;AAC9D,CAAC,IAAA,SACc,MAAM;CACnB,eAAe,UACb,OAAO,WAAW;EAChB,WAAW,OAAO,aAAa,KAAK;EACpC,QAAQ,UAAU,kBAAkB,oBAAoB,KAAK;CAC/D,CAAC;CACH,YAAY,OAAO;CACnB,sBAAsB,OAAO;CAC7B,OAAO,OAAO;AAChB,CAAC;AAEP,MAAM,uBAAuB,WAAyD;CACpF,UAAU,IAAI,QACZ,OAAO,WAAW;EAChB,WAAW,MAAM,QAAQ,IAAI,GAAG;EAChC,QAAQ,UAAU,kBAAkB,mCAAmC,KAAK;CAC9E,CAAC;CACH,MAAM,iBACJ,OAAO,WAAW;EAChB,WAAW,MAAM,IAAI,YAAY;EACjC,QAAQ,UAAU,kBAAkB,+BAA+B,KAAK;CAC1E,CAAC;AACL;AAEA,MAAa,wBAAwB,WAAyD;CAC5F,UAAU,IAAI,QAAQ,OAAO,WAAW,MAAM,QAAQ,IAAI,GAAG,CAAC;CAC9D,MAAM,iBAAiB,OAAO,WAAW,MAAM,IAAI,YAAY,CAAC;AAClE;AAEA,MAAM,cAAc,UAAoD;CACtE,WAAW,SAAS,gBAClB,OAAO,WAAW;EAChB,WAAW,KAAK,SAAS,SAAS,WAAW;EAC7C,QAAQ,UAAU,kBAAkB,uBAAuB,KAAK;CAClE,CAAC;CACH,QAAQ,KAAK;CACb,YAAY,KAAK;CACjB,sBAAsB,KAAK;CAC3B,QAAQ,mBACN,OAAO,WAAW;EAChB,WAAW,KAAK,MAAM,cAAc;EACpC,QAAQ,UAAU,kBAAkB,oBAAoB,KAAK;CAC/D,CAAC;AACL;;AAGA,MAAa,kBAAkB,UAAoD;CACjF,WAAW,SAAS,gBAAgB,OAAO,WAAW,KAAK,SAAS,SAAS,WAAW,CAAC;CACzF,QAAQ,KAAK;CACb,YAAY,KAAK;CACjB,sBAAsB,KAAK;CAC3B,QAAQ,mBACN,OAAO,WAAW,KAAK,MAAM,cAAc,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC,CAAC;AACrF;;AAGA,SAAgB,sBACd,QAC6C;CAC7C,OAAO,OAAO,MAAM;EAClB,eAAe,UAAU,OAAO,WAAW,OAAO,aAAa,KAAK,CAAC;EACrE,YAAY,OAAO;EACnB,sBAAsB,OAAO;EAC7B,OAAO,OAAO;CAChB,CAAC;AACH;AAEA,eAAsB,MACpB,OAI8B;CAC9B,OAAO,OAAO,WACZC,QAAc;EACZ,gBAAgB,MAAM;EACtB,OAAO,MAAM;EACb,QAAQ,aAAa,MAAM,MAAM;EACjC,SAAS,MAAM;CACjB,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,MAAM,MAAMC,UAA8B,MAAM,UAAU,GAAG,cAAc,CAAC,CAC7F,CACF;AACF;AAEA,eAAsB,SAAS,OAMG;CAChC,OAAO,OAAO,WACZC,WAAiB;EACf,aAAa,MAAM;EACnB,gBAAgB,MAAM;EACtB,eAAe,oBAAoB,MAAM,aAAa;EACtD,MAAM,WAAW,MAAM,IAAI;CAC7B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,MAAM,MAAMD,UAA8B,MAAM,UAAU,GAAG,cAAc,CAAC,CAC7F,CACF;AACF"}

package/dist/connection-api-DftK7eHo.d.mts

@@ -0,0 +1,7 @@
+import { A as Connection, F as assertGrant, I as authorizationError, L as decode, N as Schema, P as StoredCredential, R as encode, _ as StartResult, a as Authentication, c as CompleteInput, d as Error, f as Failure, g as Requirements, h as Method, j as Grant, k as AuthorizationError, l as Continuation, m as InteractiveStart, o as AuthenticationFailure, p as InteractiveFlow, s as BaseInput, u as ContinuationStore, v as complete, y as start, z as validate } from "./zone-discovery-BA5I24vu.mjs";
+declare namespace connection_api_d_exports {
+  export { Authentication, AuthenticationFailure, AuthorizationError, BaseInput, CompleteInput, Connection, Method as ConnectionMethod, StartResult as ConnectionStartResult, Continuation, ContinuationStore, Error, Failure, Grant, InteractiveFlow, InteractiveStart, Method, Requirements, Schema, StartResult, StoredCredential, assertGrant, authorizationError, complete, decode, encode, start, validate };
+}
+//#endregion
+export { connection_api_d_exports as t };
+//# sourceMappingURL=connection-api-DftK7eHo.d.mts.map

package/dist/{dns-record-C_KwGPLf.mjs → dns-record-BLeqo56C.mjs}

@@ -1,5 +1,23 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { Context, Effect, Layer, Schema, SchemaIssue, SchemaTransformation } from "effect";
+//#region src/auth/lifecycle-repository.ts
+var lifecycle_repository_exports = /* @__PURE__ */ __exportAll({
+	Error: () => Error$3,
+	Service: () => Service$1
+});
+var Error$3 = class extends Schema.TaggedError()("LifecycleRepositoryError", {
+	category: Schema.Literal("storage"),
+	message: Schema.String,
+	operation: Schema.String,
+	retry: Schema.Literals([
+		"never",
+		"after-user-action",
+		"safe",
+		"unknown"
+	])
+}) {};
+var Service$1 = class extends Context.Service()("@domainkit/AuthorizationLifecycleRepository") {};
+//#endregion
 //#region src/invalid-input.ts
 var invalid_input_exports = /* @__PURE__ */ __exportAll({ Error: () => Error$2 });
 var Error$2 = class extends Schema.TaggedError()("InvalidInputError", { message: Schema.String }) {};
@@ -42,6 +60,7 @@ var provider_exports = /* @__PURE__ */ __exportAll({
 	Error: () => Error$1,
 	ErrorReason: () => ErrorReason,
 	Service: () => Service,
+	fromAsync: () => fromAsync,
 	layerFromAsync: () => layerFromAsync,
 	toAsync: () => toAsync
 });
@@ -67,7 +86,7 @@ var Error$1 = class extends Schema.TaggedError()("ProviderError", {
 	status: Schema.optionalKey(Schema.Number)
 }) {};
 var Service = class extends Context.Service()("@domainkit/DnsProvider") {};
-const layerFromAsync = (provider) => Layer.succeed(Service, {
+const fromAsync = (provider) => Service.of({
 	id: provider.id,
 	createRecord: Effect.fn("DnsProvider.createRecord")((zone, record) => Effect.tryPromise({
 		try: () => provider.createRecord(zone, record),
@@ -86,6 +105,7 @@ const layerFromAsync = (provider) => Layer.succeed(Service, {
 		catch: (cause) => failure(provider, "listRecords", cause)
 	}))
 });
+const layerFromAsync = (provider) => Layer.succeed(Service, fromAsync(provider));
 const toAsync = (provider) => ({
 	id: provider.id,
 	createRecord: (zone, record) => Effect.runPromise(provider.createRecord(zone, record)),
@@ -264,6 +284,6 @@ function isIpv6(value) {
 	}
 }
 //#endregion
-export { toAsync as C, parse$1 as D, domain_name_exports as E, Error$2 as O, provider_exports as S, decode$1 as T, equals as _, Mx as a, Service as b, Opaque as c, Srv as d, Txt as f, dns_record_exports as g, decode as h, Cname as i, invalid_input_exports as k, RequirementMetadata as l, data as m, Aaaa as n, Ns as o, Type as p, Caa as r, Observed as s, A as t, Schema$1 as u, parse as v, Schema$2 as w, layerFromAsync as x, Error$1 as y };
+export { invalid_input_exports as A, provider_exports as C, domain_name_exports as D, decode$1 as E, Service$1 as M, lifecycle_repository_exports as N, parse$1 as O, layerFromAsync as S, Schema$2 as T, equals as _, Mx as a, Service as b, Opaque as c, Srv as d, Txt as f, dns_record_exports as g, decode as h, Cname as i, Error$3 as j, Error$2 as k, RequirementMetadata as l, data as m, Aaaa as n, Ns as o, Type as p, Caa as r, Observed as s, A as t, Schema$1 as u, parse as v, toAsync as w, fromAsync as x, Error$1 as y };
 
-//# sourceMappingURL=dns-record-C_KwGPLf.mjs.map
+//# sourceMappingURL=dns-record-BLeqo56C.mjs.map

package/dist/dns-record-BLeqo56C.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-record-BLeqo56C.mjs","names":["Error","Service","Error","Type","S","Schema","decode","InvalidInputError","parse","Error","S","DomainName.Schema","Schema","InvalidInputError"],"sources":["../src/auth/lifecycle-repository.ts","../src/invalid-input.ts","../src/domain/domain-name.ts","../src/provider/provider.ts","../src/domain/dns-record.ts"],"sourcesContent":["import { Context, Effect, Schema } from \"effect\";\n\nimport type * as ProviderAuthorization from \"./authorization.ts\";\nimport type * as Connection from \"./connection.ts\";\n\nexport interface Aggregate {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly bindings: ReadonlyArray<Connection.Connection>;\n  readonly credential: Connection.StoredCredential;\n}\n\nexport interface DetachResult {\n  readonly authorizationId: string;\n  readonly remainingBindings: number;\n  readonly revokedAuthorization: boolean;\n}\n\nexport class Error extends Schema.TaggedError<Error>()(\"LifecycleRepositoryError\", {\n  category: Schema.Literal(\"storage\"),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport interface Interface {\n  readonly bind: (\n    authorizationId: string,\n    binding: Connection.Connection,\n  ) => Effect.Effect<Aggregate, Error>;\n  readonly connect: (aggregate: Aggregate) => Effect.Effect<Aggregate, Error>;\n  readonly detach: <E>(input: {\n    readonly connectionId: string;\n    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;\n  }) => Effect.Effect<DetachResult, Error | E>;\n  readonly findByProviderAccount: (\n    providerId: string,\n    providerAccountId: string,\n  ) => Effect.Effect<Aggregate | null, Error>;\n  readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error>;\n  readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error>;\n  readonly promoteEvidence: (\n    authorizationId: string,\n    evidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  ) => Effect.Effect<Aggregate, Error>;\n  readonly recover: <E>(input: {\n    readonly authorizationId: string;\n    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;\n  }) => Effect.Effect<DetachResult, Error | E>;\n  readonly rotate: (\n    authorizationId: string,\n    credential: Connection.StoredCredential,\n    expiresAt: Date | null,\n  ) => Effect.Effect<Aggregate, Error>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\n  \"@domainkit/AuthorizationLifecycleRepository\",\n) {}\n","import { Schema } from \"effect\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"InvalidInputError\", {\n  message: Schema.String,\n}) {}\n","import { Effect, Schema as S, SchemaIssue, SchemaTransformation } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nconst labelPattern = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;\n\nconst Type = S.String.check(\n  S.makeFilter<string>(\n    (value) =>\n      value.length <= 253 &&\n      value.includes(\".\") &&\n      value.split(\".\").every((label) => labelPattern.test(label))\n        ? undefined\n        : \"Expected a fully qualified DNS name\",\n    { identifier: \"DomainName\" },\n  ),\n).pipe(S.brand(\"DomainName\"));\n\n/** A lower-case, fully qualified DNS name without a trailing dot. */\nexport type DomainName = typeof Type.Type;\n\n/** Decodes user and wire strings into canonical domain names. */\nexport const Schema = S.String.pipe(\n  S.decodeTo(\n    Type,\n    SchemaTransformation.transformOrFail({\n      decode: (input, options) =>\n        Effect.try({\n          try: () => normalize(input),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue(\n              { message: cause instanceof Error ? cause.message : String(cause) },\n              input,\n              options,\n            ),\n        }),\n      encode: (domain) => Effect.succeed(domain),\n    }),\n  ),\n);\n\nexport const decode = Effect.fn(\"DomainName.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport function parse(input: unknown): DomainName {\n  try {\n    return S.decodeUnknownSync(Schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nfunction normalize(input: string): string {\n  const labels = input\n    .trim()\n    .replace(/\\.+$/, \"\")\n    .split(\".\")\n    .map((label) => {\n      if (label.includes(\"_\") || [...label].every((character) => character.charCodeAt(0) <= 127)) {\n        return label.toLowerCase();\n      }\n      const hostname = new URL(`http://${label}.example`).hostname;\n      const normalized = hostname.split(\".\")[0];\n      if (normalized === undefined) throw new Error(\"Domain label could not be normalized\");\n      return normalized.toLowerCase();\n    });\n  return labels.join(\".\");\n}\n","import { Context, Effect, Layer, Schema } from \"effect\";\n\nimport type * as DomainName from \"../domain/domain-name.ts\";\nimport type * as DnsRecord from \"../domain/dns-record.ts\";\n\nexport interface CreateResult {\n  readonly providerRecordId: string | null;\n}\n\nexport const ErrorReason = Schema.Literals([\n  \"authentication\",\n  \"authorization\",\n  \"conflict\",\n  \"not_found\",\n  \"rate_limit\",\n  \"request\",\n  \"response\",\n  \"transport\",\n  \"unsupported\",\n]);\nexport type ErrorReason = typeof ErrorReason.Type;\n\nexport class Error extends Schema.TaggedError<Error>()(\"ProviderError\", {\n  cause: Schema.optionalKey(Schema.Unknown),\n  code: Schema.optionalKey(Schema.Union([Schema.Number, Schema.String])),\n  message: Schema.String,\n  operation: Schema.String,\n  providerId: Schema.String,\n  reason: Schema.optionalKey(ErrorReason),\n  retryAfterMs: Schema.optionalKey(Schema.Number),\n  status: Schema.optionalKey(Schema.Number),\n}) {}\n\n/** The provider capability used by DNS planning, application, and verification. */\nexport interface Interface {\n  readonly id: string;\n  readonly createRecord: (\n    zone: DomainName.DomainName,\n    record: DnsRecord.DnsRecord,\n  ) => Effect.Effect<CreateResult, Error>;\n  readonly deleteRecord: (\n    zone: DomainName.DomainName,\n    providerRecordId: string,\n  ) => Effect.Effect<void, Error>;\n  readonly getRecord: (\n    zone: DomainName.DomainName,\n    providerRecordId: string,\n  ) => Effect.Effect<DnsRecord.Observed | null, Error>;\n  readonly listRecords: (\n    zone: DomainName.DomainName,\n  ) => Effect.Effect<ReadonlyArray<DnsRecord.Observed>, Error>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/DnsProvider\") {}\n\n/** Minimal Promise-shaped provider contract for hosts that do not use Effect directly. */\nexport interface AsyncInterface {\n  readonly id: string;\n  readonly createRecord: (\n    zone: DomainName.DomainName,\n    record: DnsRecord.DnsRecord,\n  ) => Promise<CreateResult>;\n  readonly deleteRecord: (zone: DomainName.DomainName, providerRecordId: string) => Promise<void>;\n  readonly getRecord: (\n    zone: DomainName.DomainName,\n    providerRecordId: string,\n  ) => Promise<DnsRecord.Observed | null>;\n  readonly listRecords: (zone: DomainName.DomainName) => Promise<ReadonlyArray<DnsRecord.Observed>>;\n}\n\nexport const fromAsync = (provider: AsyncInterface): Interface =>\n  Service.of({\n    id: provider.id,\n    createRecord: Effect.fn(\"DnsProvider.createRecord\")((zone, record) =>\n      Effect.tryPromise({\n        try: () => provider.createRecord(zone, record),\n        catch: (cause) => failure(provider, \"createRecord\", cause),\n      }),\n    ),\n    deleteRecord: Effect.fn(\"DnsProvider.deleteRecord\")((zone, providerRecordId) =>\n      Effect.tryPromise({\n        try: () => provider.deleteRecord(zone, providerRecordId),\n        catch: (cause) => failure(provider, \"deleteRecord\", cause),\n      }),\n    ),\n    getRecord: Effect.fn(\"DnsProvider.getRecord\")((zone, providerRecordId) =>\n      Effect.tryPromise({\n        try: () => provider.getRecord(zone, providerRecordId),\n        catch: (cause) => failure(provider, \"getRecord\", cause),\n      }),\n    ),\n    listRecords: Effect.fn(\"DnsProvider.listRecords\")((zone) =>\n      Effect.tryPromise({\n        try: () => provider.listRecords(zone),\n        catch: (cause) => failure(provider, \"listRecords\", cause),\n      }),\n    ),\n  });\n\nexport const layerFromAsync = (provider: AsyncInterface): Layer.Layer<Service> =>\n  Layer.succeed(Service, fromAsync(provider));\n\nexport const toAsync = (provider: Interface): AsyncInterface => ({\n  id: provider.id,\n  createRecord: (zone, record) => Effect.runPromise(provider.createRecord(zone, record)),\n  deleteRecord: (zone, providerRecordId) =>\n    Effect.runPromise(provider.deleteRecord(zone, providerRecordId)),\n  getRecord: (zone, providerRecordId) =>\n    Effect.runPromise(provider.getRecord(zone, providerRecordId)),\n  listRecords: (zone) => Effect.runPromise(provider.listRecords(zone)),\n});\n\nfunction failure(provider: AsyncInterface, operation: string, cause: unknown): Error {\n  return cause instanceof Error\n    ? cause\n    : new Error({\n        cause,\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        providerId: provider.id,\n      });\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as DomainName from \"./domain-name.ts\";\n\nexport const Type = S.Literals([\"A\", \"AAAA\", \"CNAME\", \"TXT\", \"MX\", \"CAA\", \"NS\", \"SRV\"]);\nexport type Type = typeof Type.Type;\n\nexport const RequirementMetadata = S.Struct({\n  ownership: S.String.check(S.isMinLength(1)),\n  provenance: S.String.check(S.isMinLength(1)),\n  purpose: S.String.check(S.isMinLength(1)),\n});\nexport interface RequirementMetadata extends S.Schema.Type<typeof RequirementMetadata> {}\n\nconst CommonFields = {\n  metadata: RequirementMetadata,\n  name: DomainName.Schema,\n  policy: S.Literals([\"exclusive\", \"append\"]),\n  ttl: S.NullOr(S.Int.check(S.isBetween({ minimum: 60, maximum: 2_147_483_647 }))),\n};\n\nconst ExclusiveCommonFields = { ...CommonFields, policy: S.Literal(\"exclusive\") };\nconst Address = S.String.check(\n  S.makeFilter((value) => (isIpv4(value) ? undefined : \"Expected an IPv4 address\")),\n);\nconst Ipv6Address = S.String.check(\n  S.makeFilter((value) => (isIpv6(value) ? undefined : \"Expected an IPv6 address\")),\n);\nconst Port = S.Int.check(S.isBetween({ minimum: 0, maximum: 65_535 }));\nconst Priority = S.Int.check(S.isBetween({ minimum: 0, maximum: 65_535 }));\n\nexport const Schema = S.TaggedUnion({\n  A: { ...CommonFields, address: Address },\n  AAAA: { ...CommonFields, address: Ipv6Address },\n  CNAME: { ...ExclusiveCommonFields, target: DomainName.Schema },\n  TXT: { ...CommonFields, value: S.String.check(S.isMinLength(1)) },\n  MX: { ...CommonFields, exchange: DomainName.Schema, priority: Priority },\n  CAA: {\n    ...CommonFields,\n    flags: S.Int.check(S.isBetween({ minimum: 0, maximum: 255 })),\n    tag: S.Literals([\"issue\", \"issuewild\", \"iodef\"]),\n    value: S.String.check(S.isMinLength(1)),\n  },\n  NS: { ...CommonFields, target: DomainName.Schema },\n  SRV: {\n    ...CommonFields,\n    port: Port,\n    priority: Priority,\n    target: DomainName.Schema,\n    weight: Priority,\n  },\n});\nexport const {\n  A,\n  AAAA: Aaaa,\n  CAA: Caa,\n  CNAME: Cname,\n  MX: Mx,\n  NS: Ns,\n  SRV: Srv,\n  TXT: Txt,\n} = Schema.cases;\nexport type DnsRecord = typeof Schema.Type;\nexport type Encoded = typeof Schema.Encoded;\n\n/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */\nexport const Opaque = S.Struct({\n  _tag: S.Literal(\"Opaque\"),\n  name: S.String.check(S.isMinLength(1)),\n  providerRecordId: S.NullOr(S.String),\n  providerType: S.String.check(S.isMinLength(1)),\n});\nexport interface Opaque extends S.Schema.Type<typeof Opaque> {}\n\n/** Any DNS record observed through a provider, including non-portable record types. */\nexport const Observed = S.Union([Schema, Opaque]);\nexport type Observed = typeof Observed.Type;\n\nexport const decode = Effect.fn(\"DnsRecord.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport function parse(input: unknown): DnsRecord {\n  try {\n    return S.decodeUnknownSync(Schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nexport function data(record: DnsRecord): Readonly<Record<string, number | string>> {\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { address: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { target: record.target };\n    case \"TXT\":\n      return { value: record.value };\n    case \"MX\":\n      return { exchange: record.exchange, priority: record.priority };\n    case \"CAA\":\n      return { flags: record.flags, tag: record.tag, value: record.value };\n    case \"SRV\":\n      return {\n        port: record.port,\n        priority: record.priority,\n        target: record.target,\n        weight: record.weight,\n      };\n  }\n}\n\nexport function equals(left: DnsRecord, right: DnsRecord): boolean {\n  return (\n    left._tag === right._tag &&\n    left.name === right.name &&\n    JSON.stringify(data(left)) === JSON.stringify(data(right))\n  );\n}\n\nfunction isIpv4(value: string): boolean {\n  const parts = value.split(\".\");\n  return (\n    parts.length === 4 &&\n    parts.every(\n      (part) => /^\\d{1,3}$/.test(part) && Number(part) <= 255 && String(Number(part)) === part,\n    )\n  );\n}\n\nfunction isIpv6(value: string): boolean {\n  try {\n    return new URL(`http://[${value}]/`).hostname.startsWith(\"[\");\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaA,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,UAAU,OAAO,QAAQ,SAAS;CAClC,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAiCJ,IAAaC,YAAb,cAA6B,QAAQ,QAA4B,CAAC,CAChE,6CACF,CAAC,CAAC,CAAC;;;;ACvDH,IAAaC,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,qBAAqB,EAC1E,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;;;;;;;ACAJ,MAAM,eAAe;AAErB,MAAMC,SAAOC,OAAE,OAAO,MACpBA,OAAE,YACC,UACC,MAAM,UAAU,OAChB,MAAM,SAAS,GAAG,KAClB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,UAAU,aAAa,KAAK,KAAK,CAAC,IACtD,KAAA,IACA,uCACN,EAAE,YAAY,aAAa,CAC7B,CACF,CAAC,CAAC,KAAKA,OAAE,MAAM,YAAY,CAAC;;AAM5B,MAAaC,WAASD,OAAE,OAAO,KAC7BA,OAAE,SACAD,QACA,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAW,UAAU,KAAK;EAC1B,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;CACJ,CAAC;CACH,SAAS,WAAW,OAAO,QAAQ,MAAM;AAC3C,CAAC,CACH,CACF;AAEA,MAAaG,WAAS,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACpDF,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,SAAgBC,QAAM,OAA4B;CAChD,IAAI;EACF,OAAOJ,OAAE,kBAAkBC,QAAM,CAAC,CAAC,KAAK;CAC1C,SAAS,OAAO;EACd,MAAM,IAAIE,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAS,UAAU,OAAuB;CAcxC,OAbe,MACZ,KAAK,CAAC,CACN,QAAQ,QAAQ,EAAE,CAAC,CACnB,MAAM,GAAG,CAAC,CACV,KAAK,UAAU;EACd,IAAI,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,cAAc,UAAU,WAAW,CAAC,KAAK,GAAG,GACvF,OAAO,MAAM,YAAY;EAG3B,MAAM,aADW,IAAI,IAAI,UAAU,MAAM,SAAS,CAAC,CAAC,SACxB,MAAM,GAAG,CAAC,CAAC;EACvC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,OAAO,WAAW,YAAY;CAChC,CACU,CAAC,CAAC,KAAK,GAAG;AACxB;;;;;;;;;;;AC/DA,MAAa,cAAc,OAAO,SAAS;CACzC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,IAAaE,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,iBAAiB;CACtE,OAAO,OAAO,YAAY,OAAO,OAAO;CACxC,MAAM,OAAO,YAAY,OAAO,MAAM,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,YAAY,OAAO;CACnB,QAAQ,OAAO,YAAY,WAAW;CACtC,cAAc,OAAO,YAAY,OAAO,MAAM;CAC9C,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC,CAAC,CAAC,CAAC;AAsBJ,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAiB9F,MAAa,aAAa,aACxB,QAAQ,GAAG;CACT,IAAI,SAAS;CACb,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,MAAM,WACzD,OAAO,WAAW;EAChB,WAAW,SAAS,aAAa,MAAM,MAAM;EAC7C,QAAQ,UAAU,QAAQ,UAAU,gBAAgB,KAAK;CAC3D,CAAC,CACH;CACA,cAAc,OAAO,GAAG,0BAA0B,CAAC,EAAE,MAAM,qBACzD,OAAO,WAAW;EAChB,WAAW,SAAS,aAAa,MAAM,gBAAgB;EACvD,QAAQ,UAAU,QAAQ,UAAU,gBAAgB,KAAK;CAC3D,CAAC,CACH;CACA,WAAW,OAAO,GAAG,uBAAuB,CAAC,EAAE,MAAM,qBACnD,OAAO,WAAW;EAChB,WAAW,SAAS,UAAU,MAAM,gBAAgB;EACpD,QAAQ,UAAU,QAAQ,UAAU,aAAa,KAAK;CACxD,CAAC,CACH;CACA,aAAa,OAAO,GAAG,yBAAyB,CAAC,EAAE,SACjD,OAAO,WAAW;EAChB,WAAW,SAAS,YAAY,IAAI;EACpC,QAAQ,UAAU,QAAQ,UAAU,eAAe,KAAK;CAC1D,CAAC,CACH;AACF,CAAC;AAEH,MAAa,kBAAkB,aAC7B,MAAM,QAAQ,SAAS,UAAU,QAAQ,CAAC;AAE5C,MAAa,WAAW,cAAyC;CAC/D,IAAI,SAAS;CACb,eAAe,MAAM,WAAW,OAAO,WAAW,SAAS,aAAa,MAAM,MAAM,CAAC;CACrF,eAAe,MAAM,qBACnB,OAAO,WAAW,SAAS,aAAa,MAAM,gBAAgB,CAAC;CACjE,YAAY,MAAM,qBAChB,OAAO,WAAW,SAAS,UAAU,MAAM,gBAAgB,CAAC;CAC9D,cAAc,SAAS,OAAO,WAAW,SAAS,YAAY,IAAI,CAAC;AACrE;AAEA,SAAS,QAAQ,UAA0B,WAAmB,OAAuB;CACnF,OAAO,iBAAiBA,UACpB,QACA,IAAIA,QAAM;EACR;EACA,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzE;EACA,YAAY,SAAS;CACvB,CAAC;AACP;;;;;;;;;;;;;;;;;;;;;;ACpHA,MAAa,OAAOC,OAAE,SAAS;CAAC;CAAK;CAAQ;CAAS;CAAO;CAAM;CAAO;CAAM;AAAK,CAAC;AAGtF,MAAa,sBAAsBA,OAAE,OAAO;CAC1C,WAAWA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CAC1C,YAAYA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CAC3C,SAASA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAGD,MAAM,eAAe;CACnB,UAAU;CACV,MAAMC;CACN,QAAQD,OAAE,SAAS,CAAC,aAAa,QAAQ,CAAC;CAC1C,KAAKA,OAAE,OAAOA,OAAE,IAAI,MAAMA,OAAE,UAAU;EAAE,SAAS;EAAI,SAAS;CAAc,CAAC,CAAC,CAAC;AACjF;AAEA,MAAM,wBAAwB;CAAE,GAAG;CAAc,QAAQA,OAAE,QAAQ,WAAW;AAAE;AAChF,MAAM,UAAUA,OAAE,OAAO,MACvBA,OAAE,YAAY,UAAW,OAAO,KAAK,IAAI,KAAA,IAAY,0BAA2B,CAClF;AACA,MAAM,cAAcA,OAAE,OAAO,MAC3BA,OAAE,YAAY,UAAW,OAAO,KAAK,IAAI,KAAA,IAAY,0BAA2B,CAClF;AACA,MAAM,OAAOA,OAAE,IAAI,MAAMA,OAAE,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AACrE,MAAM,WAAWA,OAAE,IAAI,MAAMA,OAAE,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AAEzE,MAAaE,WAASF,OAAE,YAAY;CAClC,GAAG;EAAE,GAAG;EAAc,SAAS;CAAQ;CACvC,MAAM;EAAE,GAAG;EAAc,SAAS;CAAY;CAC9C,OAAO;EAAE,GAAG;EAAuB,QAAQC;CAAkB;CAC7D,KAAK;EAAE,GAAG;EAAc,OAAOD,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CAAE;CAChE,IAAI;EAAE,GAAG;EAAc,UAAUC;EAAmB,UAAU;CAAS;CACvE,KAAK;EACH,GAAG;EACH,OAAOD,OAAE,IAAI,MAAMA,OAAE,UAAU;GAAE,SAAS;GAAG,SAAS;EAAI,CAAC,CAAC;EAC5D,KAAKA,OAAE,SAAS;GAAC;GAAS;GAAa;EAAO,CAAC;EAC/C,OAAOA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CACxC;CACA,IAAI;EAAE,GAAG;EAAc,QAAQC;CAAkB;CACjD,KAAK;EACH,GAAG;EACH,MAAM;EACN,UAAU;EACV,QAAQA;EACR,QAAQ;CACV;AACF,CAAC;AACD,MAAa,EACX,GACA,MAAM,MACN,KAAK,KACL,OAAO,OACP,IAAI,IACJ,IAAI,IACJ,KAAK,KACL,KAAK,QACHC,SAAO;;AAKX,MAAa,SAASF,OAAE,OAAO;CAC7B,MAAMA,OAAE,QAAQ,QAAQ;CACxB,MAAMA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;CACrC,kBAAkBA,OAAE,OAAOA,OAAE,MAAM;CACnC,cAAcA,OAAE,OAAO,MAAMA,OAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;;AAID,MAAa,WAAWA,OAAE,MAAM,CAACE,UAAQ,MAAM,CAAC;AAGhD,MAAa,SAAS,OAAO,GAAG,kBAAkB,CAAC,EAAE,UACnDF,OAAE,oBAAoBE,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIC,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,SAAgB,MAAM,OAA2B;CAC/C,IAAI;EACF,OAAOH,OAAE,kBAAkBE,QAAM,CAAC,CAAC,KAAK;CAC1C,SAAS,OAAO;EACd,MAAM,IAAIC,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAgB,KAAK,QAA8D;CACjF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO,EAAE,SAAS,OAAO,QAAQ;EACnC,KAAK;EACL,KAAK,MACH,OAAO,EAAE,QAAQ,OAAO,OAAO;EACjC,KAAK,OACH,OAAO,EAAE,OAAO,OAAO,MAAM;EAC/B,KAAK,MACH,OAAO;GAAE,UAAU,OAAO;GAAU,UAAU,OAAO;EAAS;EAChE,KAAK,OACH,OAAO;GAAE,OAAO,OAAO;GAAO,KAAK,OAAO;GAAK,OAAO,OAAO;EAAM;EACrE,KAAK,OACH,OAAO;GACL,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,QAAQ,OAAO;GACf,QAAQ,OAAO;EACjB;CACJ;AACF;AAEA,SAAgB,OAAO,MAAiB,OAA2B;CACjE,OACE,KAAK,SAAS,MAAM,QACpB,KAAK,SAAS,MAAM,QACpB,KAAK,UAAU,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,KAAK,KAAK,CAAC;AAE7D;AAEA,SAAS,OAAO,OAAwB;CACtC,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OACE,MAAM,WAAW,KACjB,MAAM,OACH,SAAS,YAAY,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO,OAAO,OAAO,IAAI,CAAC,MAAM,IACtF;AAEJ;AAEA,SAAS,OAAO,OAAwB;CACtC,IAAI;EACF,OAAO,IAAI,IAAI,WAAW,MAAM,GAAG,CAAC,CAAC,SAAS,WAAW,GAAG;CAC9D,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/effect-cloudflare.d.mts

@@ -1,2 +1,2 @@
-import { c as Account, d as ListZonesInput, f as Options, h as make, i as auth_d_exports, l as Fetch, m as client_d_exports, p as Zone, u as Interface } from "./index-CS9Rl5LQ.mjs";
-export { type Account, auth_d_exports as Auth, client_d_exports as Client, type Fetch, type Interface, type ListZonesInput, type Options, type Zone, make };
+import { _ as Zone, b as make, c as auth_d_exports, f as Account, g as Options, h as ListZonesInput, m as Interface, p as Fetch, v as client_d_exports, y as discovery } from "./index-B1opsgls.mjs";
+export { type Account, auth_d_exports as Auth, client_d_exports as Client, type Fetch, type Interface, type ListZonesInput, type Options, type Zone, discovery, make };

package/dist/effect-cloudflare.mjs

@@ -1,2 +1,2 @@
-import { o as client_exports, s as make, t as auth_exports } from "./auth-Vi-hhXbV.mjs";
-export { auth_exports as Auth, client_exports as Client, make };
+import { d as make, l as client_exports, t as auth_exports, u as discovery } from "./auth-CZ1pZHMZ.mjs";
+export { auth_exports as Auth, client_exports as Client, discovery, make };

package/dist/effect-vercel.d.mts

@@ -1,2 +1,2 @@
-import { _ as make, a as auth_d_exports, d as Fetch, f as Interface, g as client_d_exports, h as Zone, l as Account, m as Options, p as ListZonesInput, u as AccountContext } from "./index-CEzk2gbZ.mjs";
-export { type Account, type AccountContext, auth_d_exports as Auth, client_d_exports as Client, type Fetch, type Interface, type ListZonesInput, type Options, type Zone, make };
+import { _ as Zone, b as make, d as Account, f as AccountContext, g as Options, h as ListZonesInput, m as Interface, p as Fetch, s as auth_d_exports, v as client_d_exports, y as discovery } from "./index-Ewc__bQu.mjs";
+export { type Account, type AccountContext, auth_d_exports as Auth, client_d_exports as Client, type Fetch, type Interface, type ListZonesInput, type Options, type Zone, discovery, make };

package/dist/effect-vercel.mjs

@@ -1,2 +1,2 @@
-import { n as make, r as auth_exports, t as client_exports } from "./client-BnD7QLRF.mjs";
-export { auth_exports as Auth, client_exports as Client, make };
+import { c as client_exports, l as discovery, t as auth_exports, u as make } from "./auth-CzhZ3Cuc.mjs";
+export { auth_exports as Auth, client_exports as Client, discovery, make };