domainkit 0.1.0 → 0.2.0

package/dist/effect.d.mts

@@ -1,47 +1,10 @@
-import { B as domain_name_d_exports, F as dns_record_d_exports, H as Error$3, N as Type, U as invalid_input_d_exports, d as Value, f as secret_d_exports, h as Error$2, l as TokenValidation, u as manifest_d_exports, v as provider_d_exports } from "./manifest-CP85ePFn.mjs";
-import { t as index_d_exports } from "./index-CS9Rl5LQ.mjs";
-import { t as index_d_exports$1 } from "./index-CEzk2gbZ.mjs";
-import { A as Service$2, B as Error$4, C as types_d_exports, D as oauth_state_d_exports, F as credential_d_exports, H as AuthorizationError, P as Service$1, Q as ProviderAuthorization, R as Service, U as Connection, V as error_d_exports, W as Grant, Y as connection_d_exports, et as authorization_d_exports, g as DnsPlan, j as authorization_d_exports$1, l as resolver_d_exports, p as receipt_d_exports, z as connection_d_exports$1 } from "./resolver-BHPsADzE.mjs";
-import { E as canonical_json_d_exports, T as CryptoError, b as zones_d_exports, g as AuthorizeError, h as deletion_d_exports, i as cloudflare_doh_d_exports, k as connection_lifecycle_d_exports, n as verify_d_exports, o as doh_d_exports, v as plan_d_exports, w as oauth_d_exports, x as selection_d_exports } from "./verify-B80xCBh2.mjs";
+import { A as Connection, At as dns_record_d_exports, Ft as domain_name_d_exports, J as CryptoError, K as authorization_d_exports, Lt as Error$1, O as lifecycle_repository_d_exports, Ot as Type, Rt as invalid_input_d_exports, S as provider_context_d_exports, W as ProviderAuthorization, Y as canonical_json_d_exports, at as manifest_d_exports, i as zone_discovery_d_exports, k as AuthorizationError, pt as provider_d_exports, st as secret_d_exports } from "./zone-discovery-BA5I24vu.mjs";
+import { t as index_d_exports } from "./index-B1opsgls.mjs";
+import { t as connection_api_d_exports } from "./connection-api-DftK7eHo.mjs";
+import { t as index_d_exports$1 } from "./index-Ewc__bQu.mjs";
+import { _ as selection_d_exports, a as verify_d_exports, d as google_doh_d_exports, g as zones_d_exports, h as doh_d_exports, l as resolver_pool_d_exports, p as cloudflare_doh_d_exports, v as diagnostic_d_exports } from "./verify-DZWLM91T.mjs";
+import { B as types_d_exports, N as DnsPlan, b as AuthorizeError, k as plan_d_exports, l as resolver_d_exports, v as deletion_d_exports } from "./resolver-CJOR9mQ8.mjs";
 import { Crypto, Effect } from "effect";
-declare namespace token_d_exports {
-  export { Error$1 as Error, Input, Requirements$1 as Requirements, connect };
-}
-interface Input {
-  readonly grant: Grant;
-  readonly ownerId: string;
-  readonly providerId: string;
-  readonly subjectId: string;
-  readonly token: Value;
-  readonly validate: (token: Value) => Effect.Effect<TokenValidation, Error$2 | Error$3>;
-}
-declare const connect: (input: Input) => Effect.Effect<{
-  authorization: {
-    readonly accountId: string;
-    readonly capabilities: readonly ("dns:read" | "dns:write")[];
-    readonly createdAt: Date;
-    readonly expiresAt: Date | null;
-    readonly id: string;
-    readonly kind: "oauth2" | "token";
-    readonly providerId: string;
-    readonly scopes: readonly string[];
-    readonly subjectId: string;
-  };
-  connection: {
-    readonly authorizationId: string;
-    readonly createdAt: Date;
-    readonly grant: {
-      readonly _tag: "account";
-    } | {
-      readonly _tag: "domains";
-      readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-    };
-    readonly id: string;
-    readonly ownerId: string;
-  };
-}, CryptoError | Error$3 | Error$2 | Error$4, Crypto.Crypto | Service | Service$1 | Service$2>;
-type Error$1 = Error$2 | Error$3 | CryptoError | Error$4;
-type Requirements$1 = Service$2 | Service | Service$1 | Crypto.Crypto;
 declare namespace connection_authorization_d_exports {
   export { Error, Requirements, authorize };
 }
@@ -57,8 +20,8 @@ declare const authorize: (input: {
   operationIds: string[];
   planDigest: string;
   version: "domainkit.plan-authorization.v1";
-}, AuthorizationError | Error$3 | AuthorizeError, Crypto.Crypto>;
-type Error = AuthorizationError | Error$3 | CryptoError;
+}, AuthorizationError | Error$1 | AuthorizeError, Crypto.Crypto>;
+type Error = AuthorizationError | Error$1 | CryptoError;
 type Requirements = Crypto.Crypto;
 declare namespace dns_data_d_exports {
   export { parse };
@@ -69,5 +32,5 @@ declare function parse(type: Type, input: unknown): string;
 /** The current package version from the package manifest. */
 declare const VERSION: string;
 //#endregion
-export { index_d_exports as Cloudflare, cloudflare_doh_d_exports as CloudflareDnsOverHttps, connection_d_exports as Connection, connection_authorization_d_exports as ConnectionAuthorization, connection_lifecycle_d_exports as ConnectionLifecycle, connection_d_exports$1 as ConnectionStore, credential_d_exports as CredentialStore, deletion_d_exports as Deletion, canonical_json_d_exports as Digest, dns_data_d_exports as DnsData, doh_d_exports as DnsOverHttps, types_d_exports as DnsPlan, provider_d_exports as DnsProvider, dns_record_d_exports as DnsRecord, resolver_d_exports as DnsResolver, domain_name_d_exports as DomainName, invalid_input_d_exports as InvalidInput, oauth_d_exports as OAuth, oauth_state_d_exports as OAuthStateStore, manifest_d_exports as ProviderAuth, authorization_d_exports as ProviderAuthorization, authorization_d_exports$1 as ProviderAuthorizationStore, selection_d_exports as ProviderDiscovery, plan_d_exports as Provisioning, receipt_d_exports as ReceiptStore, secret_d_exports as Secret, error_d_exports as Storage, token_d_exports as TokenConnection, VERSION, index_d_exports$1 as Vercel, verify_d_exports as Verification, zones_d_exports as Zones };
+export { lifecycle_repository_d_exports as AuthorizationLifecycle, index_d_exports as Cloudflare, cloudflare_doh_d_exports as CloudflareDnsOverHttps, connection_api_d_exports as Connection, connection_authorization_d_exports as ConnectionAuthorization, deletion_d_exports as Deletion, diagnostic_d_exports as Diagnostic, canonical_json_d_exports as Digest, dns_data_d_exports as DnsData, doh_d_exports as DnsOverHttps, types_d_exports as DnsPlan, provider_d_exports as DnsProvider, dns_record_d_exports as DnsRecord, resolver_d_exports as DnsResolver, resolver_pool_d_exports as DnsResolverPool, domain_name_d_exports as DomainName, google_doh_d_exports as GoogleDnsOverHttps, invalid_input_d_exports as InvalidInput, manifest_d_exports as ProviderAuth, authorization_d_exports as ProviderAuthorization, provider_context_d_exports as ProviderContext, selection_d_exports as ProviderDiscovery, plan_d_exports as Provisioning, secret_d_exports as Secret, VERSION, index_d_exports$1 as Vercel, verify_d_exports as Verification, zone_discovery_d_exports as ZoneDiscovery, zones_d_exports as Zones };
 //# sourceMappingURL=effect.d.mts.map

package/dist/effect.mjs

@@ -1,21 +1,43 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { E as domain_name_exports, S as provider_exports, g as dns_record_exports, k as invalid_input_exports } from "./dns-record-C_KwGPLf.mjs";
-import { o as client_exports, s as make, t as auth_exports } from "./auth-Vi-hhXbV.mjs";
-import { C as plan_exports, F as zones_exports, L as token_exports, N as types_exports, P as selection_exports, V as manifest_exports, W as oauth_exports, Z as authorization_exports, _ as deletion_exports, a as doh_exports, ct as connection_exports, dt as version, n as verify_exports, q as canonical_json_exports, r as cloudflare_doh_exports, s as dns_data_exports, tt as connection_lifecycle_exports, y as connection_authorization_exports } from "./verify-BjrR_4NF.mjs";
-import { S as error_exports, c as oauth_state_exports, d as authorization_exports$1, h as credential_exports, i as resolver_exports, y as connection_exports$1 } from "./resolver-tEXpKxmH.mjs";
-import { l as secret_exports, n as make$1, r as auth_exports$1, t as client_exports$1 } from "./client-BnD7QLRF.mjs";
-import { n as receipt_exports } from "./receipt-CGSnfZQ6.mjs";
+import { A as invalid_input_exports, C as provider_exports, D as domain_name_exports, N as lifecycle_repository_exports, g as dns_record_exports } from "./dns-record-BLeqo56C.mjs";
+import { _ as StartResult, d as provider_context_exports, g as Method, h as Error, m as secret_exports, o as authorization_exports, v as complete, y as start } from "./authorization-DOg2Re1D.mjs";
+import { d as make, l as client_exports, t as auth_exports, u as discovery } from "./auth-CZ1pZHMZ.mjs";
+import { n as zones_exports } from "./zones-DKHTpX9C.mjs";
+import { a as authorizationError, c as validate, i as assertGrant, n as Grant, o as decode, r as Schema, s as encode, t as AuthorizationError } from "./connection-BWrBwqjk.mjs";
+import { t as canonical_json_exports } from "./canonical-json-CpvqGMcr.mjs";
+import { C as selection_exports, D as manifest_exports, O as diagnostic_exports, S as connection_authorization_exports, b as dns_data_exports, g as cloudflare_doh_exports, k as version, m as google_doh_exports, p as resolver_pool_exports, s as verify_exports, v as doh_exports } from "./verify-BzpiA0Es.mjs";
+import { C as plan_exports, L as zone_discovery_exports, N as types_exports, m as deletion_exports, r as resolver_exports } from "./resolver-CxE-VDw4.mjs";
+import { c as client_exports$1, l as discovery$1, t as auth_exports$1, u as make$1 } from "./auth-CzhZ3Cuc.mjs";
 //#region src/providers/cloudflare/index.ts
 var cloudflare_exports = /* @__PURE__ */ __exportAll({
 	Auth: () => auth_exports,
 	Client: () => client_exports,
+	discovery: () => discovery,
 	make: () => make
 });
 //#endregion
+//#region src/auth/connection-api.ts
+var connection_api_exports = /* @__PURE__ */ __exportAll({
+	AuthorizationError: () => AuthorizationError,
+	Error: () => Error,
+	Grant: () => Grant,
+	Method: () => Method,
+	Schema: () => Schema,
+	StartResult: () => StartResult,
+	assertGrant: () => assertGrant,
+	authorizationError: () => authorizationError,
+	complete: () => complete,
+	decode: () => decode,
+	encode: () => encode,
+	start: () => start,
+	validate: () => validate
+});
+//#endregion
 //#region src/providers/vercel/index.ts
 var vercel_exports = /* @__PURE__ */ __exportAll({
 	Auth: () => auth_exports$1,
 	Client: () => client_exports$1,
+	discovery: () => discovery$1,
 	make: () => make$1
 });
 //#endregion
@@ -23,6 +45,6 @@ var vercel_exports = /* @__PURE__ */ __exportAll({
 /** The current package version from the package manifest. */
 const VERSION = version;
 //#endregion
-export { cloudflare_exports as Cloudflare, cloudflare_doh_exports as CloudflareDnsOverHttps, connection_exports as Connection, connection_authorization_exports as ConnectionAuthorization, connection_lifecycle_exports as ConnectionLifecycle, connection_exports$1 as ConnectionStore, credential_exports as CredentialStore, deletion_exports as Deletion, canonical_json_exports as Digest, dns_data_exports as DnsData, doh_exports as DnsOverHttps, types_exports as DnsPlan, provider_exports as DnsProvider, dns_record_exports as DnsRecord, resolver_exports as DnsResolver, domain_name_exports as DomainName, invalid_input_exports as InvalidInput, oauth_exports as OAuth, oauth_state_exports as OAuthStateStore, manifest_exports as ProviderAuth, authorization_exports as ProviderAuthorization, authorization_exports$1 as ProviderAuthorizationStore, selection_exports as ProviderDiscovery, plan_exports as Provisioning, receipt_exports as ReceiptStore, secret_exports as Secret, error_exports as Storage, token_exports as TokenConnection, VERSION, vercel_exports as Vercel, verify_exports as Verification, zones_exports as Zones };
+export { lifecycle_repository_exports as AuthorizationLifecycle, cloudflare_exports as Cloudflare, cloudflare_doh_exports as CloudflareDnsOverHttps, connection_api_exports as Connection, connection_authorization_exports as ConnectionAuthorization, deletion_exports as Deletion, diagnostic_exports as Diagnostic, canonical_json_exports as Digest, dns_data_exports as DnsData, doh_exports as DnsOverHttps, types_exports as DnsPlan, provider_exports as DnsProvider, dns_record_exports as DnsRecord, resolver_exports as DnsResolver, resolver_pool_exports as DnsResolverPool, domain_name_exports as DomainName, google_doh_exports as GoogleDnsOverHttps, invalid_input_exports as InvalidInput, manifest_exports as ProviderAuth, authorization_exports as ProviderAuthorization, provider_context_exports as ProviderContext, selection_exports as ProviderDiscovery, plan_exports as Provisioning, secret_exports as Secret, VERSION, vercel_exports as Vercel, verify_exports as Verification, zone_discovery_exports as ZoneDiscovery, zones_exports as Zones };
 
 //# sourceMappingURL=effect.mjs.map

package/dist/effect.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"effect.mjs","names":["packageJson.version"],"sources":["../src/providers/cloudflare/index.ts","../src/providers/vercel/index.ts","../src/effect.ts"],"sourcesContent":["export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { make } from \"./client.ts\";\nexport type {\n  Account,\n  AccountContext,\n  Fetch,\n  Interface,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"./client.ts\";\n","import packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Connection from \"./auth/connection.ts\";\nexport * as ConnectionLifecycle from \"./auth/connection-lifecycle.ts\";\nexport * as ProviderAuthorization from \"./auth/authorization.ts\";\nexport * as OAuth from \"./auth/oauth.ts\";\nexport * as ProviderAuth from \"./auth/manifest.ts\";\nexport * as Secret from \"./auth/secret.ts\";\nexport * as TokenConnection from \"./auth/token.ts\";\nexport * as ProviderDiscovery from \"./discovery/selection.ts\";\nexport * as Zones from \"./discovery/zones.ts\";\nexport * as DnsRecord from \"./domain/dns-record.ts\";\nexport * as DomainName from \"./domain/domain-name.ts\";\nexport * as InvalidInput from \"./invalid-input.ts\";\nexport * as ConnectionAuthorization from \"./plan/connection-authorization.ts\";\nexport * as Digest from \"./plan/canonical-json.ts\";\nexport * as Deletion from \"./plan/deletion.ts\";\nexport * as Provisioning from \"./plan/plan.ts\";\nexport * as DnsPlan from \"./plan/types.ts\";\nexport * as DnsProvider from \"./provider/provider.ts\";\nexport * as Cloudflare from \"./providers/cloudflare/index.ts\";\nexport * as Vercel from \"./providers/vercel/index.ts\";\nexport * as ConnectionStore from \"./stores/connection.ts\";\nexport * as ProviderAuthorizationStore from \"./stores/authorization.ts\";\nexport * as CredentialStore from \"./stores/credential.ts\";\nexport * as OAuthStateStore from \"./stores/oauth-state.ts\";\nexport * as ReceiptStore from \"./stores/receipt.ts\";\nexport * as Storage from \"./stores/error.ts\";\nexport * as CloudflareDnsOverHttps from \"./verification/cloudflare-doh.ts\";\nexport * as DnsData from \"./verification/dns-data.ts\";\nexport * as DnsOverHttps from \"./verification/doh.ts\";\nexport * as DnsResolver from \"./verification/resolver.ts\";\nexport * as Verification from \"./verification/verify.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AEGA,MAAa,UAAUA"}
+{"version":3,"file":"effect.mjs","names":["packageJson.version"],"sources":["../src/providers/cloudflare/index.ts","../src/auth/connection-api.ts","../src/providers/vercel/index.ts","../src/effect.ts"],"sourcesContent":["export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","export {\n  assertGrant,\n  authorizationError,\n  AuthorizationError,\n  decode,\n  encode,\n  Grant,\n  Schema,\n  validate,\n} from \"./connection.ts\";\nexport type { Connection, StoredCredential } from \"./connection.ts\";\nexport { complete, Error, Method, start, StartResult } from \"./connect.ts\";\nexport type {\n  Authentication,\n  AuthenticationFailure,\n  BaseInput,\n  CompleteInput,\n  Continuation,\n  ContinuationStore,\n  Failure,\n  InteractiveFlow,\n  InteractiveStart,\n  Method as ConnectionMethod,\n  Requirements,\n  StartResult as ConnectionStartResult,\n} from \"./connect.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { discovery, make } from \"./client.ts\";\nexport type {\n  Account,\n  AccountContext,\n  Fetch,\n  Interface,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"./client.ts\";\n","import packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Connection from \"./auth/connection-api.ts\";\nexport * as AuthorizationLifecycle from \"./auth/lifecycle-repository.ts\";\nexport * as Diagnostic from \"./auth/diagnostic.ts\";\nexport * as ProviderAuth from \"./auth/manifest.ts\";\nexport * as ProviderAuthorization from \"./auth/authorization.ts\";\nexport * as ProviderContext from \"./auth/provider-context.ts\";\nexport * as Secret from \"./auth/secret.ts\";\nexport * as ProviderDiscovery from \"./discovery/selection.ts\";\nexport * as ZoneDiscovery from \"./discovery/zone-discovery.ts\";\nexport * as Zones from \"./discovery/zones.ts\";\nexport * as DnsRecord from \"./domain/dns-record.ts\";\nexport * as DomainName from \"./domain/domain-name.ts\";\nexport * as InvalidInput from \"./invalid-input.ts\";\nexport * as DnsProvider from \"./provider/provider.ts\";\nexport * as ConnectionAuthorization from \"./plan/connection-authorization.ts\";\nexport * as Digest from \"./plan/canonical-json.ts\";\nexport * as Deletion from \"./plan/deletion.ts\";\nexport * as Provisioning from \"./plan/plan.ts\";\nexport * as DnsPlan from \"./plan/types.ts\";\nexport * as Cloudflare from \"./providers/cloudflare/index.ts\";\nexport * as Vercel from \"./providers/vercel/index.ts\";\nexport * as CloudflareDnsOverHttps from \"./verification/cloudflare-doh.ts\";\nexport * as DnsData from \"./verification/dns-data.ts\";\nexport * as DnsOverHttps from \"./verification/doh.ts\";\nexport * as GoogleDnsOverHttps from \"./verification/google-doh.ts\";\nexport * as DnsResolverPool from \"./verification/resolver-pool.ts\";\nexport * as DnsResolver from \"./verification/resolver.ts\";\nexport * as Verification from \"./verification/verify.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AGGA,MAAa,UAAUA"}

package/dist/index-B1opsgls.d.mts

@@ -0,0 +1,159 @@
+import { Lt as Error$1, Nt as DomainName, Q as Manifest, b as Codec, dt as Interface$1, et as OAuthClientConfiguration, h as Method, it as TokenValidation, nt as OAuthSubjectResolver, ot as Value, p as InteractiveFlow, r as Source, tt as OAuthMethod, ut as Error, x as Envelope } from "./zone-discovery-BA5I24vu.mjs";
+import { Effect, Schema } from "effect";
+import * as oauth from "oauth4webapi";
+//#region src/providers/cloudflare/protocol.d.ts
+declare const Account$1: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly name: Schema.String;
+}>;
+interface Account$1 extends Schema.Schema.Type<typeof Account$1> {}
+declare namespace client_d_exports {
+  export { Account, Fetch, Interface, ListZonesInput, Options, Zone, discoverAuthorizationAccount, discovery, make, validateDomainToken };
+}
+type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+/** Configuration for an Effect-native Cloudflare authoritative-DNS client. */
+interface Options {
+  readonly accountId: string;
+  readonly baseUrl?: string;
+  /** Capabilities the host required when issuing or authorizing this credential. */
+  readonly capabilities: TokenValidation["capabilities"];
+  readonly fetch?: Fetch;
+  readonly token: Value;
+  readonly tokenKind?: "account" | "user";
+}
+interface ListZonesInput {
+  readonly accountId?: string;
+  readonly name?: DomainName;
+}
+type Account = Account$1;
+/** A portable Cloudflare authoritative zone with normalized nameserver evidence. */
+interface Zone {
+  readonly accountId: string;
+  readonly id: string;
+  readonly name: DomainName;
+  readonly nameservers: ReadonlyArray<DomainName>;
+  readonly status: string | null;
+}
+interface Interface extends Interface$1 {
+  readonly listAccounts: () => Effect.Effect<ReadonlyArray<Account>, Error>;
+  readonly listZones: (input?: ListZonesInput) => Effect.Effect<ReadonlyArray<Zone>, Error>;
+  readonly validateToken: () => Effect.Effect<TokenValidation, Error>;
+}
+/** Exposes Cloudflare zone lookup as the optional provider discovery capability. */
+declare function discovery(client: Interface): Source;
+interface CredentialOptions$1 {
+  readonly baseUrl?: string;
+  readonly fetch?: Fetch;
+  readonly token: Value;
+}
+interface DomainCredentialOptions extends CredentialOptions$1 {
+  readonly capabilities: TokenValidation["capabilities"];
+  readonly domain: DomainName;
+  readonly tokenKind?: "account" | "user";
+}
+declare const discoverAuthorizationAccount: (options: CredentialOptions$1 & {
+  readonly domain: DomainName;
+}) => Effect.Effect<{
+  readonly id: string;
+  readonly name: string;
+}, Error, never>;
+declare const validateDomainToken: (options: DomainCredentialOptions) => Effect.Effect<{
+  accountId: string;
+  capabilities: readonly ("dns:read" | "dns:write")[];
+  expiresAt: Date | null;
+  scopes: never[];
+}, Error, never>;
+/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
+declare function make(options: Options): Interface;
+declare namespace auth_d_exports {
+  export { Context$1 as Context, CredentialTarget, OAuthFlowOptions, OAuthMethodOptions, SubjectResolverOptions, TokenConnectionOptions, TokenValidatorOptions, contextCodec, manifest, oauthAuthentication, oauthFlow, oauthMethod, subjectResolver, tokenConnectionMethod, tokenMethod, tokenValidator };
+}
+declare const Context$1: Schema.Struct<{
+  readonly tokenKind: Schema.Literals<readonly ["account", "user"]>;
+}>;
+type Context$1 = typeof Context$1.Type;
+declare const contextCodec: Codec<{
+  readonly tokenKind: "account" | "user";
+}>;
+/** Describes Cloudflare's caller-created API-token authorization method. */
+declare function tokenMethod(capabilities: TokenValidation["capabilities"]): Extract<Manifest["methods"][number], {
+  readonly _tag: "token";
+}>;
+interface OAuthMethodOptions {
+  /** Scope IDs assigned to the OAuth client by Cloudflare. */
+  readonly scopes: ReadonlyArray<string>;
+  /** Capabilities represented by those assigned scope IDs. */
+  readonly capabilities: TokenValidation["capabilities"];
+  readonly clientAuth: OAuthMethod["clientAuth"];
+}
+/** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */
+declare function oauthMethod(options: OAuthMethodOptions): OAuthMethod;
+/** Creates the Cloudflare token and OAuth authorization manifest. */
+declare function manifest(options: OAuthMethodOptions): Manifest;
+type CredentialOptions = Omit<Options, "accountId" | "token" | "tokenKind">;
+/** Selects an explicit Cloudflare account or discovers it from an authorized domain. */
+type CredentialTarget = {
+  readonly accountId: string;
+  readonly domain?: never;
+} | {
+  readonly accountId?: never;
+  readonly domain: DomainName;
+};
+type SubjectResolverOptions = CredentialOptions & CredentialTarget;
+/** Configuration for validating a Cloudflare token against an account or authorized domain. */
+type TokenValidatorOptions = CredentialOptions & ({
+  readonly accountId: string;
+  readonly domain?: never;
+  readonly tokenKind?: "account" | "user";
+} | {
+  readonly accountId?: never;
+  readonly domain: DomainName;
+  readonly tokenKind?: "account" | "user";
+});
+/** Resolves the Cloudflare account selected by a completed OAuth grant. */
+declare function subjectResolver(options: SubjectResolverOptions): OAuthSubjectResolver;
+/** Creates a host callback that validates a Cloudflare API token. */
+declare function tokenValidator(options: TokenValidatorOptions): (token: Value) => ReturnType<Interface["validateToken"]>;
+type TokenConnectionOptions = TokenValidatorOptions & {
+  readonly token: Value;
+};
+/** Creates a provider-independent token connection method backed by Cloudflare validation. */
+declare function tokenConnectionMethod(options: TokenConnectionOptions): Extract<Method, {
+  readonly _tag: "Token";
+}>;
+/** Converts a completed Cloudflare OAuth grant into the canonical connection authentication. */
+declare const oauthAuthentication: (options: SubjectResolverOptions & {
+  readonly accessToken: Value;
+  readonly tokens: oauth.TokenEndpointResponse;
+}) => Effect.Effect<{
+  capabilityEvidence: {
+    capability: "dns:read" | "dns:write";
+    evidence: {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  credential: {
+    accessToken: Value;
+    refreshToken: Value | null;
+    tokenType: Lowercase<string>;
+  };
+  expiresAt: Date | null;
+  providerAccountId: string;
+  providerContext: Envelope;
+  scopes: string[];
+}, Error$1 | Error, never>;
+type OAuthFlowOptions = SubjectResolverOptions & {
+  readonly client: OAuthClientConfiguration;
+  readonly clientAuth: OAuthMethod["clientAuth"];
+  readonly redirectUri: string;
+  readonly scopes: ReadonlyArray<string>;
+};
+/** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */
+declare function oauthFlow(options: OAuthFlowOptions): InteractiveFlow;
+declare namespace index_d_exports {
+  export { Account, auth_d_exports as Auth, client_d_exports as Client, Fetch, Interface, ListZonesInput, Options, Zone, discovery, make };
+}
+//#endregion
+export { Zone as _, SubjectResolverOptions as a, make as b, auth_d_exports as c, tokenMethod as d, Account as f, Options as g, ListZonesInput as h, OAuthMethodOptions as i, manifest as l, Interface as m, CredentialTarget as n, TokenConnectionOptions as o, Fetch as p, OAuthFlowOptions as r, TokenValidatorOptions as s, index_d_exports as t, oauthMethod as u, client_d_exports as v, discovery as y };
+//# sourceMappingURL=index-B1opsgls.d.mts.map

package/dist/{index-CEzk2gbZ.d.mts → index-Ewc__bQu.d.mts}

@@ -1,7 +1,7 @@
-import { R as DomainName, d as Value, g as Interface$1, h as Error, l as TokenValidation, n as IntegrationMethod, r as Manifest } from "./manifest-CP85ePFn.mjs";
-import { Effect } from "effect";
+import { B as Capability, Lt as Error$1, Nt as DomainName, Q as Manifest, Z as IntegrationMethod, b as Codec, dt as Interface$1, h as Method, it as TokenValidation, ot as Value, p as InteractiveFlow, r as Source, ut as Error, x as Envelope } from "./zone-discovery-BA5I24vu.mjs";
+import { Effect, Schema } from "effect";
 declare namespace client_d_exports {
-  export { Account, AccountContext, Fetch, Interface, ListZonesInput, Options, Zone, make };
+  export { Account, AccountContext, Fetch, Interface, ListZonesInput, Options, Zone, discovery, make };
 }
 type Fetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 /** Selects whether Vercel requests operate on a personal account or a team. */
@@ -42,11 +42,31 @@ interface Interface extends Interface$1 {
   readonly listZones: (input?: ListZonesInput) => Effect.Effect<ReadonlyArray<Zone>, Error>;
   readonly validateToken: () => Effect.Effect<TokenValidation, Error>;
 }
+/** Exposes Vercel zone lookup as the optional provider discovery capability. */
+declare function discovery(client: Interface): Source;
 /** Creates an Effect-native Vercel client without owning the credential lifecycle. */
 declare function make(options: Options): Interface;
 declare namespace auth_d_exports {
-  export { ExchangeCodeOptions, IntegrationCredential, IntegrationMethodOptions, exchangeCode, integrationMethod, manifest, tokenMethod };
+  export { Context$1 as Context, ExchangeCodeOptions, IntegrationCredential, IntegrationFlowOptions, IntegrationMethodOptions, TokenConnectionOptions, contextCodec, exchangeCode, integrationAuthentication, integrationFlow, integrationMethod, manifest, tokenConnectionMethod, tokenMethod };
 }
+declare const Context$1: Schema.TaggedUnion<{
+  readonly personal: Schema.TaggedStruct<"personal", {
+    readonly installationId: Schema.NullOr<Schema.String>;
+  }>;
+  readonly team: Schema.TaggedStruct<"team", {
+    readonly installationId: Schema.NullOr<Schema.String>;
+    readonly teamId: Schema.String;
+  }>;
+}>;
+type Context$1 = typeof Context$1.Type;
+declare const contextCodec: Codec<{
+  readonly _tag: "personal";
+  readonly installationId: string | null;
+} | {
+  readonly _tag: "team";
+  readonly installationId: string | null;
+  readonly teamId: string;
+}>;
 /** Describes Vercel's caller-created personal access-token method. */
 declare function tokenMethod(capabilities: TokenValidation["capabilities"]): Extract<Manifest["methods"][number], {
   readonly _tag: "token";
@@ -86,9 +106,40 @@ declare const exchangeCode: (options: ExchangeCodeOptions) => Effect.Effect<{
   installationId: string | null;
   userId: string;
 }, Error, never>;
+interface TokenConnectionOptions extends Omit<Options, "token"> {
+  readonly token: Value;
+}
+/** Creates a provider-independent token connection method backed by Vercel validation. */
+declare function tokenConnectionMethod(options: TokenConnectionOptions): Extract<Method, {
+  readonly _tag: "Token";
+}>;
+/** Converts a completed Vercel Integration exchange into canonical connection authentication. */
+declare const integrationAuthentication: (options: ExchangeCodeOptions & {
+  readonly capabilities: ReadonlyArray<Capability>;
+}) => Effect.Effect<{
+  capabilityEvidence: {
+    capability: "dns:read" | "dns:write";
+    evidence: {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  credential: {
+    accessToken: Value;
+    refreshToken: null;
+    tokenType: string;
+  };
+  expiresAt: null;
+  providerAccountId: string;
+  providerContext: Envelope;
+  scopes: never[];
+}, Error$1 | Error, never>;
+interface IntegrationFlowOptions extends Omit<ExchangeCodeOptions, "code">, IntegrationMethodOptions {}
+/** Creates Vercel Integration's implementation of the common interactive connection capability. */
+declare function integrationFlow(options: IntegrationFlowOptions): InteractiveFlow;
 declare namespace index_d_exports {
-  export { Account, AccountContext, auth_d_exports as Auth, client_d_exports as Client, Fetch, Interface, ListZonesInput, Options, Zone, make };
+  export { Account, AccountContext, auth_d_exports as Auth, client_d_exports as Client, Fetch, Interface, ListZonesInput, Options, Zone, discovery, make };
 }
 //#endregion
-export { make as _, auth_d_exports as a, tokenMethod as c, Fetch as d, Interface as f, client_d_exports as g, Zone as h, IntegrationMethodOptions as i, Account as l, Options as m, ExchangeCodeOptions as n, integrationMethod as o, ListZonesInput as p, IntegrationCredential as r, manifest as s, index_d_exports as t, AccountContext as u };
-//# sourceMappingURL=index-CEzk2gbZ.d.mts.map
+export { Zone as _, IntegrationMethodOptions as a, make as b, integrationMethod as c, Account as d, AccountContext as f, Options as g, ListZonesInput as h, IntegrationFlowOptions as i, manifest as l, Interface as m, ExchangeCodeOptions as n, TokenConnectionOptions as o, Fetch as p, IntegrationCredential as r, auth_d_exports as s, index_d_exports as t, tokenMethod as u, client_d_exports as v, discovery as y };
+//# sourceMappingURL=index-Ewc__bQu.d.mts.map