domainkit 0.1.1 → 0.2.0

package/dist/{resolver-BHPsADzE.d.mts → resolver-CJOR9mQ8.d.mts}

@@ -1,249 +1,9 @@
-import { H as Error$2, N as Type, R as DomainName, d as Value, o as OAuthMethod } from "./manifest-CP85ePFn.mjs";
-import { Context, Effect, Layer, Schema } from "effect";
-declare namespace authorization_d_exports$1 {
-  export { Capability, ProviderAuthorization, Schema$3 as Schema, decode$2 as decode, encode$2 as encode, validate$1 as validate };
-}
-declare const Capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
-type Capability = typeof Capability.Type;
-/** A provider credential authorization shared by one or more owner connections. */
-declare const Schema$3: Schema.Struct<{
-  readonly accountId: Schema.String;
-  readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-  readonly createdAt: Schema.DateFromString;
-  readonly expiresAt: Schema.NullOr<Schema.DateFromString>;
-  readonly id: Schema.String;
-  readonly kind: Schema.Literals<readonly ["oauth2", "token"]>;
-  readonly providerId: Schema.String;
-  readonly scopes: Schema.$Array<Schema.String>;
-  readonly subjectId: Schema.String;
-}>;
-interface ProviderAuthorization extends Schema.Schema.Type<typeof Schema$3> {}
-declare const decode$2: (input: unknown) => Effect.Effect<{
-  readonly accountId: string;
-  readonly capabilities: readonly ("dns:read" | "dns:write")[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly kind: "oauth2" | "token";
-  readonly providerId: string;
-  readonly scopes: readonly string[];
-  readonly subjectId: string;
-}, Error$2, never>;
-declare const validate$1: (input: unknown) => Effect.Effect<{
-  readonly accountId: string;
-  readonly capabilities: readonly ("dns:read" | "dns:write")[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly kind: "oauth2" | "token";
-  readonly providerId: string;
-  readonly scopes: readonly string[];
-  readonly subjectId: string;
-}, Error$2, never>;
-declare const encode$2: (input: {
-  readonly accountId: string;
-  readonly capabilities: readonly ("dns:read" | "dns:write")[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly kind: "oauth2" | "token";
-  readonly providerId: string;
-  readonly scopes: readonly string[];
-  readonly subjectId: string;
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly accountId: string;
-  readonly capabilities: readonly ("dns:read" | "dns:write")[];
-  readonly createdAt: string;
-  readonly expiresAt: string | null;
-  readonly id: string;
-  readonly kind: "oauth2" | "token";
-  readonly providerId: string;
-  readonly scopes: readonly string[];
-  readonly subjectId: string;
-};
-declare namespace connection_d_exports$1 {
-  export { AuthorizationError, Connection, Grant, OAuthContinuation, Schema$2 as Schema, StoredCredential, assertGrant, decode$1 as decode, encode$1 as encode, validate };
-}
-declare const Grant: Schema.TaggedUnion<{
-  readonly account: Schema.TaggedStruct<"account", {}>;
-  readonly domains: Schema.TaggedStruct<"domains", {
-    readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-  }>;
-}>;
-type Grant = typeof Grant.Type;
-/** An owner-scoped grant bound to one provider authorization. */
-declare const Schema$2: Schema.Struct<{
-  readonly authorizationId: Schema.String;
-  readonly createdAt: Schema.DateFromString;
-  readonly grant: Schema.TaggedUnion<{
-    readonly account: Schema.TaggedStruct<"account", {}>;
-    readonly domains: Schema.TaggedStruct<"domains", {
-      readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-    }>;
-  }>;
-  readonly id: Schema.String;
-  readonly ownerId: Schema.String;
-}>;
-interface Connection extends Schema.Schema.Type<typeof Schema$2> {}
-declare const decode$1: (input: unknown) => Effect.Effect<{
-  readonly authorizationId: string;
-  readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-}, Error$2, never>;
-declare const validate: (input: unknown) => Effect.Effect<{
-  readonly authorizationId: string;
-  readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-}, Error$2, never>;
-declare const encode$1: (input: {
-  readonly authorizationId: string;
-  readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly authorizationId: string;
-  readonly createdAt: string;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly string[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-};
-interface OAuthContinuation {
-  readonly clientId: string;
-  readonly codeVerifier: Value;
-  readonly expiresAt: Date;
-  readonly grant: Grant;
-  readonly method: OAuthMethod;
-  readonly ownerId: string;
-  readonly redirectUri: string;
-  readonly stateHash: string;
-  readonly subjectId: string;
-}
-interface StoredCredential {
-  readonly accessToken: Value;
-  readonly refreshToken: Value | null;
-  readonly tokenType: string;
-}
-declare const AuthorizationError_base: Schema.Class<AuthorizationError, Schema.TaggedStruct<"AuthorizationError", {
-  readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-declare class AuthorizationError extends AuthorizationError_base {}
-declare function assertGrant(connection: Connection, authorization: ProviderAuthorization, request: {
-  readonly capability: Capability;
-  readonly domain: string;
-  readonly now?: Date;
-  readonly providerId: string;
-}): DomainName;
-declare namespace error_d_exports {
-  export { Error$1 as Error, fromCause };
-}
-declare const Error_base$1: Schema.Class<Error$1, Schema.TaggedStruct<"StorageError", {
-  readonly cause: Schema.optionalKey<Schema.Unknown>;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$1 extends Error_base$1 {}
-declare function fromCause(operation: string, cause: unknown): Error$1;
-declare namespace connection_d_exports {
-  export { AsyncInterface$5 as AsyncInterface, Interface$5 as Interface, Service$5 as Service, layerFromAsync$5 as layerFromAsync, toAsync$5 as toAsync };
-}
-interface Interface$5 {
-  readonly delete: (connectionId: string) => Effect.Effect<void, Error$1>;
-  readonly find: (ownerId: string, authorizationId: string) => Effect.Effect<Connection | null, Error$1>;
-  readonly get: (connectionId: string) => Effect.Effect<Connection | null, Error$1>;
-  readonly listByAuthorizationId: (authorizationId: string) => Effect.Effect<ReadonlyArray<Connection>, Error$1>;
-  readonly put: (connection: Connection) => Effect.Effect<void, Error$1>;
-}
-declare const Service_base$5: Context.ServiceClass<Service$5, "@domainkit/ConnectionStore", Interface$5>;
-declare class Service$5 extends Service_base$5 {}
-interface AsyncInterface$5 {
-  readonly delete: (connectionId: string) => Promise<void>;
-  readonly find: (ownerId: string, authorizationId: string) => Promise<Connection | null>;
-  readonly get: (connectionId: string) => Promise<Connection | null>;
-  readonly listByAuthorizationId: (authorizationId: string) => Promise<ReadonlyArray<Connection>>;
-  readonly put: (connection: Connection) => Promise<void>;
-}
-declare const toAsync$5: (store: Interface$5) => AsyncInterface$5;
-declare const layerFromAsync$5: (store: AsyncInterface$5) => Layer.Layer<Service$5>;
-declare namespace credential_d_exports {
-  export { AsyncInterface$4 as AsyncInterface, Interface$4 as Interface, Service$4 as Service, layerFromAsync$4 as layerFromAsync, toAsync$4 as toAsync };
-}
-interface Interface$4 {
-  readonly delete: (authorizationId: string) => Effect.Effect<void, Error$1>;
-  readonly get: (authorizationId: string) => Effect.Effect<StoredCredential | null, Error$1>;
-  readonly put: (authorizationId: string, credential: StoredCredential) => Effect.Effect<void, Error$1>;
-}
-declare const Service_base$4: Context.ServiceClass<Service$4, "@domainkit/CredentialStore", Interface$4>;
-declare class Service$4 extends Service_base$4 {}
-interface AsyncInterface$4 {
-  readonly delete: (authorizationId: string) => Promise<void>;
-  readonly get: (authorizationId: string) => Promise<StoredCredential | null>;
-  readonly put: (authorizationId: string, credential: StoredCredential) => Promise<void>;
-}
-declare const toAsync$4: (store: Interface$4) => AsyncInterface$4;
-declare const layerFromAsync$4: (store: AsyncInterface$4) => Layer.Layer<Service$4>;
-declare namespace authorization_d_exports {
-  export { AsyncInterface$3 as AsyncInterface, Interface$3 as Interface, Service$3 as Service, layerFromAsync$3 as layerFromAsync, toAsync$3 as toAsync };
-}
-interface Interface$3 {
-  readonly delete: (authorizationId: string) => Effect.Effect<void, Error$1>;
-  readonly findByProviderAccount: (providerId: string, accountId: string) => Effect.Effect<ProviderAuthorization | null, Error$1>;
-  readonly get: (authorizationId: string) => Effect.Effect<ProviderAuthorization | null, Error$1>;
-  readonly put: (authorization: ProviderAuthorization) => Effect.Effect<void, Error$1>;
-}
-declare const Service_base$3: Context.ServiceClass<Service$3, "@domainkit/ProviderAuthorizationStore", Interface$3>;
-declare class Service$3 extends Service_base$3 {}
-interface AsyncInterface$3 {
-  readonly delete: (authorizationId: string) => Promise<void>;
-  readonly findByProviderAccount: (providerId: string, accountId: string) => Promise<ProviderAuthorization | null>;
-  readonly get: (authorizationId: string) => Promise<ProviderAuthorization | null>;
-  readonly put: (authorization: ProviderAuthorization) => Promise<void>;
-}
-declare const toAsync$3: (store: Interface$3) => AsyncInterface$3;
-declare const layerFromAsync$3: (store: AsyncInterface$3) => Layer.Layer<Service$3>;
-declare namespace oauth_state_d_exports {
-  export { AsyncInterface$2 as AsyncInterface, Interface$2 as Interface, Service$2 as Service, layerFromAsync$2 as layerFromAsync, toAsync$2 as toAsync };
-}
-interface Interface$2 {
-  readonly consume: (stateHash: string, now: Date) => Effect.Effect<OAuthContinuation | null, Error$1>;
-  readonly put: (continuation: OAuthContinuation) => Effect.Effect<void, Error$1>;
-}
-declare const Service_base$2: Context.ServiceClass<Service$2, "@domainkit/OAuthStateStore", Interface$2>;
-declare class Service$2 extends Service_base$2 {}
-interface AsyncInterface$2 {
-  readonly consume: (stateHash: string, now: Date) => Promise<OAuthContinuation | null>;
-  readonly put: (continuation: OAuthContinuation) => Promise<void>;
-}
-declare const toAsync$2: (store: Interface$2) => AsyncInterface$2;
-declare const layerFromAsync$2: (store: AsyncInterface$2) => Layer.Layer<Service$2>;
+import { J as CryptoError, Lt as Error$2, Nt as DomainName, Ot as Type, ft as Service$1, n as Service$2, t as Candidate, ut as Error$3, vt as DnsRecord, yt as Encoded } from "./zone-discovery-BA5I24vu.mjs";
+import { Cause, Context, Crypto, Data, Effect, Layer, Schema } from "effect";
 declare namespace types_d_exports {
-  export { ApplyReceipt, Authorization, DnsPlan, Operation, PlanAuthorization, Receipt, Schema$1 as Schema, decode, decodeReceipt, encode, encodeReceipt };
+  export { ApplyReceipt, Authorization$1 as Authorization, DnsPlan, Operation$1 as Operation, PlanAuthorization, Receipt$1 as Receipt, Schema$1 as Schema, decode, decodeReceipt, encode, encodeReceipt };
 }
-declare const Operation: Schema.TaggedUnion<{
+declare const Operation$1: Schema.TaggedUnion<{
   readonly conflict: Schema.TaggedStruct<"conflict", {
     readonly existing: Schema.$Array<Schema.Union<readonly [Schema.TaggedUnion<{
       readonly A: Schema.TaggedStruct<"A", {
@@ -645,7 +405,7 @@ declare const Operation: Schema.TaggedUnion<{
     readonly ttlDrift: Schema.Boolean;
   }>;
 }>;
-type Operation = typeof Operation.Type;
+type Operation$1 = typeof Operation$1.Type;
 declare const Schema$1: Schema.Struct<{
   readonly digest: Schema.String;
   readonly operations: Schema.$Array<Schema.TaggedUnion<{
@@ -1055,14 +815,14 @@ declare const Schema$1: Schema.Struct<{
   readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
 }>;
 interface DnsPlan extends Schema.Schema.Type<typeof Schema$1> {}
-declare const Authorization: Schema.Struct<{
+declare const Authorization$1: Schema.Struct<{
   readonly allowPartial: Schema.Boolean;
   readonly operationIds: Schema.$Array<Schema.String>;
   readonly planDigest: Schema.String;
   readonly version: Schema.Literal<"domainkit.plan-authorization.v1">;
 }>;
-interface PlanAuthorization extends Schema.Schema.Type<typeof Authorization> {}
-declare const Receipt: Schema.Struct<{
+interface PlanAuthorization extends Schema.Schema.Type<typeof Authorization$1> {}
+declare const Receipt$1: Schema.Struct<{
   readonly appliedAt: Schema.DateFromString;
   readonly operations: Schema.$Array<Schema.Struct<{
     readonly operationId: Schema.String;
@@ -1074,7 +834,7 @@ declare const Receipt: Schema.Struct<{
   readonly version: Schema.Literal<"domainkit.apply-receipt.v1">;
   readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
 }>;
-interface ApplyReceipt extends Schema.Schema.Type<typeof Receipt> {}
+interface ApplyReceipt extends Schema.Schema.Type<typeof Receipt$1> {}
 declare const decode: (input: unknown) => Effect.Effect<{
   readonly digest: string;
   readonly operations: readonly ({
@@ -2318,21 +2078,618 @@ declare const encodeReceipt: (input: {
   readonly version: "domainkit.apply-receipt.v1";
   readonly zone: string;
 };
-declare namespace receipt_d_exports {
-  export { AsyncInterface$1 as AsyncInterface, Interface$1 as Interface, Service$1 as Service, layerFromAsync$1 as layerFromAsync, toAsync$1 as toAsync };
+declare namespace plan_d_exports {
+  export { ApplyError$1 as ApplyError, ApplyInput, AuthorizationError, AuthorizeError, ConflictError, CreateError$1 as CreateError, CreateInput$1 as CreateInput, CreateResult, DiscoverCreateInput, ExactCreateInput, PartialApplyError, ResolvedCreateResult, StaleError, Target, apply$1 as apply, authorize$1 as authorize, create$1 as create, renderManualInstructions, validate$1 as validate };
 }
-interface Interface$1 {
-  readonly get: (planDigest: string) => Effect.Effect<ApplyReceipt | null, Error$1>;
-  readonly put: (receipt: ApplyReceipt) => Effect.Effect<void, Error$1>;
+declare const ConflictError_base: Schema.Class<ConflictError, Schema.TaggedStruct<"PlanConflictError", {
+  readonly operationIds: Schema.$Array<Schema.String>;
+}>, Cause.YieldableError>;
+declare class ConflictError extends ConflictError_base {}
+declare const AuthorizationError_base: Schema.Class<AuthorizationError, Schema.TaggedStruct<"AuthorizationError", {
+  readonly message: Schema.String;
+}>, Cause.YieldableError>;
+declare class AuthorizationError extends AuthorizationError_base {}
+declare const StaleError_base: Schema.Class<StaleError, Schema.TaggedStruct<"StalePlanError", {
+  readonly approvedPlanDigest: Schema.String;
+  readonly currentPlanDigest: Schema.String;
+}>, Cause.YieldableError>;
+declare class StaleError extends StaleError_base {}
+declare const PartialApplyError_base: Schema.Class<PartialApplyError, Schema.TaggedStruct<"PartialApplyError", {
+  readonly causeTag: Schema.Literals<readonly ["CryptoError", "InvalidInputError", "Interrupted", "ProviderError", "StalePlanError"]>;
+  readonly failedOperationId: Schema.String;
+  readonly message: Schema.String;
+  readonly receipt: Schema.Struct<{
+    readonly appliedAt: Schema.DateFromString;
+    readonly operations: Schema.$Array<Schema.Struct<{
+      readonly operationId: Schema.String;
+      readonly providerRecordId: Schema.NullOr<Schema.String>;
+    }>>;
+    readonly planDigest: Schema.String;
+    readonly providerId: Schema.String;
+    readonly status: Schema.Literals<readonly ["complete", "partial"]>;
+    readonly version: Schema.Literal<"domainkit.apply-receipt.v1">;
+    readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+}>, Cause.YieldableError>;
+declare class PartialApplyError extends PartialApplyError_base {}
+type Target = Data.TaggedEnum<{
+  DiscoverFromDomain: {
+    readonly domain: string;
+  };
+  ExactZone: {
+    readonly zone: string;
+  };
+}>;
+declare const Target: {
+  readonly $is: <Tag extends "DiscoverFromDomain" | "ExactZone">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "DiscoverFromDomain";
+    readonly domain: string;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "ExactZone";
+    readonly zone: string;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "DiscoverFromDomain" | "ExactZone"]: (args: Extract<{
+      readonly _tag: "DiscoverFromDomain";
+      readonly domain: string;
+    } | {
+      readonly _tag: "ExactZone";
+      readonly zone: string;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "DiscoverFromDomain";
+      readonly domain: string;
+    } | {
+      readonly _tag: "ExactZone";
+      readonly zone: string;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["DiscoverFromDomain" | "ExactZone"]>>;
+    <Cases extends { readonly [Tag in "DiscoverFromDomain" | "ExactZone"]: (args: Extract<{
+      readonly _tag: "DiscoverFromDomain";
+      readonly domain: string;
+    } | {
+      readonly _tag: "ExactZone";
+      readonly zone: string;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "DiscoverFromDomain";
+      readonly domain: string;
+    } | {
+      readonly _tag: "ExactZone";
+      readonly zone: string;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["DiscoverFromDomain" | "ExactZone"]>>;
+  };
+  readonly DiscoverFromDomain: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "DiscoverFromDomain";
+    readonly domain: string;
+  }, "_tag">;
+  readonly ExactZone: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "ExactZone";
+    readonly zone: string;
+  }, "_tag">;
+};
+type CreateResult = Data.TaggedEnum<{
+  NotFound: {
+    readonly domain: DomainName;
+  };
+  Resolved: {
+    readonly candidate: Candidate | null;
+    readonly plan: DnsPlan;
+  };
+  SelectionRequired: {
+    readonly candidates: ReadonlyArray<Candidate>;
+  };
+}>;
+declare const CreateResult: {
+  readonly $is: <Tag extends "NotFound" | "Resolved" | "SelectionRequired">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "NotFound";
+    readonly domain: DomainName;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Resolved";
+    readonly candidate: Candidate | null;
+    readonly plan: DnsPlan;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "SelectionRequired";
+    readonly candidates: ReadonlyArray<Candidate>;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate | null;
+      readonly plan: DnsPlan;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate | null;
+      readonly plan: DnsPlan;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
+    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate | null;
+      readonly plan: DnsPlan;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate | null;
+      readonly plan: DnsPlan;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
+  };
+  readonly NotFound: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "NotFound";
+    readonly domain: DomainName;
+  }, "_tag">;
+  readonly Resolved: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Resolved";
+    readonly candidate: Candidate | null;
+    readonly plan: DnsPlan;
+  }, "_tag">;
+  readonly SelectionRequired: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "SelectionRequired";
+    readonly candidates: ReadonlyArray<Candidate>;
+  }, "_tag">;
+};
+type ResolvedCreateResult = Extract<CreateResult, {
+  readonly _tag: "Resolved";
+}>;
+interface CreateInput$1 {
+  readonly requirements: ReadonlyArray<Encoded | DnsRecord>;
+  readonly target: Target;
 }
-declare const Service_base$1: Context.ServiceClass<Service$1, "@domainkit/ReceiptStore", Interface$1>;
-declare class Service$1 extends Service_base$1 {}
-interface AsyncInterface$1 {
-  readonly get: (planDigest: string) => Promise<ApplyReceipt | null>;
-  readonly put: (receipt: ApplyReceipt) => Promise<void>;
+type ExactCreateInput = Omit<CreateInput$1, "target"> & {
+  readonly target: Extract<Target, {
+    readonly _tag: "ExactZone";
+  }>;
+};
+type DiscoverCreateInput = Omit<CreateInput$1, "target"> & {
+  readonly target: Extract<Target, {
+    readonly _tag: "DiscoverFromDomain";
+  }>;
+};
+interface ApplyInput {
+  readonly authorization: PlanAuthorization;
+  readonly plan: DnsPlan;
+}
+type CreateError$1 = Error$2 | Error$3 | CryptoError;
+type AuthorizeError = AuthorizationError | CryptoError;
+type ApplyError$1 = Error$2 | Error$3 | CryptoError | AuthorizationError | ConflictError | StaleError | PartialApplyError;
+/** Builds a deterministic DNS plan through an exact or discoverable authoritative-zone target. */
+declare function create$1(input: ExactCreateInput): Effect.Effect<ResolvedCreateResult, CreateError$1, Crypto.Crypto | Service$1>;
+declare function create$1(input: DiscoverCreateInput): Effect.Effect<CreateResult, CreateError$1, Crypto.Crypto | Service$2>;
+/** Authorizes all or a selected subset of create operations in a digest-bound plan. */
+declare const authorize$1: (plan: DnsPlan, operationIds?: readonly string[] | undefined, options?: {
+  readonly allowPartial?: boolean;
+} | undefined) => Effect.Effect<{
+  allowPartial: boolean;
+  operationIds: string[];
+  planDigest: string;
+  version: "domainkit.plan-authorization.v1";
+}, AuthorizeError, Crypto.Crypto>;
+/** Applies approved creates sequentially after full and per-operation revalidation. */
+declare const apply$1: (input: ApplyInput) => Effect.Effect<ApplyReceipt, AuthorizationError | ConflictError | CryptoError | Error$2 | Error$3 | PartialApplyError | StaleError, Crypto.Crypto | Service$1>;
+declare function renderManualInstructions(plan: DnsPlan): ReadonlyArray<string>;
+declare function validate$1(plan: DnsPlan): Effect.Effect<void, AuthorizeError, Crypto.Crypto>;
+declare namespace deletion_d_exports {
+  export { ApplyError, Authorization, CreateError, CreateInput, Error$1 as Error, Operation, PartialError, Plan, Receipt, Requirements, apply, authorize, create, validate };
 }
-declare const toAsync$1: (store: Interface$1) => AsyncInterface$1;
-declare const layerFromAsync$1: (store: AsyncInterface$1) => Layer.Layer<Service$1>;
+declare const Operation: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly providerRecordId: Schema.String;
+  readonly record: Schema.TaggedUnion<{
+    readonly A: Schema.TaggedStruct<"A", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly address: Schema.String;
+    }>;
+    readonly AAAA: Schema.TaggedStruct<"AAAA", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly address: Schema.String;
+    }>;
+    readonly CAA: Schema.TaggedStruct<"CAA", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly flags: Schema.Int;
+      readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+      readonly value: Schema.String;
+    }>;
+    readonly CNAME: Schema.TaggedStruct<"CNAME", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly policy: Schema.Literal<"exclusive">;
+      readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    }>;
+    readonly MX: Schema.TaggedStruct<"MX", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly priority: Schema.Int;
+    }>;
+    readonly NS: Schema.TaggedStruct<"NS", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    }>;
+    readonly SRV: Schema.TaggedStruct<"SRV", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly port: Schema.Int;
+      readonly priority: Schema.Int;
+      readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly weight: Schema.Int;
+    }>;
+    readonly TXT: Schema.TaggedStruct<"TXT", {
+      readonly metadata: Schema.Struct<{
+        readonly ownership: Schema.String;
+        readonly provenance: Schema.String;
+        readonly purpose: Schema.String;
+      }>;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+      readonly ttl: Schema.NullOr<Schema.Int>;
+      readonly value: Schema.String;
+    }>;
+  }>;
+}>;
+interface Operation extends Schema.Schema.Type<typeof Operation> {}
+declare const Plan: Schema.Struct<{
+  readonly createdAt: Schema.DateFromString;
+  readonly expiresAt: Schema.DateFromString;
+  readonly operations: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly providerRecordId: Schema.String;
+    readonly record: Schema.TaggedUnion<{
+      readonly A: Schema.TaggedStruct<"A", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly address: Schema.String;
+      }>;
+      readonly AAAA: Schema.TaggedStruct<"AAAA", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly address: Schema.String;
+      }>;
+      readonly CAA: Schema.TaggedStruct<"CAA", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly flags: Schema.Int;
+        readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+        readonly value: Schema.String;
+      }>;
+      readonly CNAME: Schema.TaggedStruct<"CNAME", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly policy: Schema.Literal<"exclusive">;
+        readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      }>;
+      readonly MX: Schema.TaggedStruct<"MX", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly priority: Schema.Int;
+      }>;
+      readonly NS: Schema.TaggedStruct<"NS", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      }>;
+      readonly SRV: Schema.TaggedStruct<"SRV", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly port: Schema.Int;
+        readonly priority: Schema.Int;
+        readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly weight: Schema.Int;
+      }>;
+      readonly TXT: Schema.TaggedStruct<"TXT", {
+        readonly metadata: Schema.Struct<{
+          readonly ownership: Schema.String;
+          readonly provenance: Schema.String;
+          readonly purpose: Schema.String;
+        }>;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+        readonly ttl: Schema.NullOr<Schema.Int>;
+        readonly value: Schema.String;
+      }>;
+    }>;
+  }>>;
+  readonly providerId: Schema.String;
+  readonly sourcePlanDigest: Schema.String;
+  readonly version: Schema.Literal<"domainkit.deletion-plan.v1">;
+  readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly digest: Schema.String;
+}>;
+interface Plan extends Schema.Schema.Type<typeof Plan> {}
+declare const Authorization: Schema.Struct<{
+  readonly operationIds: Schema.$Array<Schema.String>;
+  readonly planDigest: Schema.String;
+  readonly version: Schema.Literal<"domainkit.deletion-authorization.v1">;
+}>;
+interface Authorization extends Schema.Schema.Type<typeof Authorization> {}
+declare const Receipt: Schema.Struct<{
+  readonly deletedAt: Schema.DateFromString;
+  readonly operations: Schema.$Array<Schema.Struct<{
+    readonly operationId: Schema.String;
+    readonly providerRecordId: Schema.String;
+  }>>;
+  readonly planDigest: Schema.String;
+  readonly providerId: Schema.String;
+  readonly status: Schema.Literals<readonly ["complete", "partial"]>;
+  readonly version: Schema.Literal<"domainkit.deletion-receipt.v1">;
+  readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>;
+interface Receipt extends Schema.Schema.Type<typeof Receipt> {}
+declare const Error_base$1: Schema.Class<Error$1, Schema.TaggedStruct<"UnsafeDeletionError", {
+  readonly message: Schema.String;
+  readonly operationId: Schema.optionalKey<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$1 extends Error_base$1 {}
+declare const PartialError_base: Schema.Class<PartialError, Schema.TaggedStruct<"PartialDeletionError", {
+  readonly failedOperationId: Schema.String;
+  readonly message: Schema.String;
+  readonly receipt: Schema.Struct<{
+    readonly deletedAt: Schema.DateFromString;
+    readonly operations: Schema.$Array<Schema.Struct<{
+      readonly operationId: Schema.String;
+      readonly providerRecordId: Schema.String;
+    }>>;
+    readonly planDigest: Schema.String;
+    readonly providerId: Schema.String;
+    readonly status: Schema.Literals<readonly ["complete", "partial"]>;
+    readonly version: Schema.Literal<"domainkit.deletion-receipt.v1">;
+    readonly zone: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+}>, import("effect/Cause").YieldableError>;
+declare class PartialError extends PartialError_base {}
+interface CreateInput {
+  readonly plan: DnsPlan;
+  readonly receipt: ApplyReceipt;
+  readonly ttlMs?: number;
+}
+/** Build a fresh deletion plan only from records proven by a prior create receipt. */
+declare const create: (input: CreateInput) => Effect.Effect<{
+  createdAt: Date;
+  expiresAt: Date;
+  operations: readonly {
+    readonly id: string;
+    readonly providerRecordId: string;
+    readonly record: {
+      readonly _tag: "A";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "AAAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "CAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly flags: number;
+      readonly tag: "iodef" | "issue" | "issuewild";
+      readonly value: string;
+    } | {
+      readonly _tag: "CNAME";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number | null;
+      readonly policy: "exclusive";
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "MX";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+      readonly priority: number;
+    } | {
+      readonly _tag: "NS";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "SRV";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly port: number;
+      readonly priority: number;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+      readonly weight: number;
+    } | {
+      readonly _tag: "TXT";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly value: string;
+    };
+  }[];
+  providerId: string;
+  sourcePlanDigest: string;
+  version: "domainkit.deletion-plan.v1";
+  zone: string & import("effect/Brand").Brand<"DomainName">;
+  digest: string;
+}, Error$3 | Error$1 | AuthorizeError, Crypto.Crypto | Service$1>;
+/** Produce a separate digest-bound consent artifact for destructive operations. */
+declare const authorize: (plan: Plan, operationIds?: readonly string[] | undefined) => Effect.Effect<{
+  operationIds: string[];
+  planDigest: string;
+  version: "domainkit.deletion-authorization.v1";
+}, CryptoError | Error$1, Crypto.Crypto>;
+/** Re-read every approved record before the first delete, then delete by provider record ID. */
+declare const apply: (input: {
+  readonly authorization: Authorization;
+  readonly plan: Plan;
+  readonly priorReceipt?: Receipt;
+}) => Effect.Effect<Receipt, CryptoError | Error$3 | Error$1 | PartialError, Crypto.Crypto | Service$1>;
+declare function validate(plan: Plan): Effect.Effect<void, Error$1 | CryptoError, Crypto.Crypto>;
+type CreateError = Error$1 | Error$2 | AuthorizationError | Error$3 | CryptoError;
+type ApplyError = Error$1 | PartialError | Error$3 | CryptoError;
+type Requirements = Service$1 | Crypto.Crypto;
 declare namespace resolver_d_exports {
   export { Answer, AsyncInterface, AsyncResolution, Error, Interface, Query, Resolution, Service, layerFromAsync, toAsync };
 }
@@ -2383,5 +2740,5 @@ interface AsyncInterface {
 declare const layerFromAsync: (resolver: AsyncInterface) => Layer.Layer<Service>;
 declare const toAsync: (resolver: Interface) => AsyncInterface;
 //#endregion
-export { Schema$3 as $, Service$3 as A, Error$1 as B, types_d_exports as C, oauth_state_d_exports as D, Service$2 as E, credential_d_exports as F, OAuthContinuation as G, AuthorizationError as H, AsyncInterface$5 as I, assertGrant as J, Schema$2 as K, Interface$5 as L, AsyncInterface$4 as M, Interface$4 as N, AsyncInterface$3 as O, Service$4 as P, ProviderAuthorization as Q, Service$5 as R, encodeReceipt as S, Interface$2 as T, Connection as U, error_d_exports as V, Grant as W, encode$1 as X, connection_d_exports$1 as Y, Capability as Z, Operation as _, Interface as a, Schema$1 as b, Service as c, Interface$1 as d, authorization_d_exports$1 as et, Service$1 as f, DnsPlan as g, Authorization as h, Error as i, authorization_d_exports as j, Interface$3 as k, resolver_d_exports as l, ApplyReceipt as m, AsyncInterface as n, Query as o, receipt_d_exports as p, StoredCredential as q, AsyncResolution as r, Resolution as s, Answer as t, encode$2 as tt, AsyncInterface$1 as u, PlanAuthorization as v, AsyncInterface$2 as w, encode as x, Receipt as y, connection_d_exports as z };
-//# sourceMappingURL=resolver-BHPsADzE.d.mts.map
+export { renderManualInstructions as A, types_d_exports as B, DiscoverCreateInput as C, StaleError as D, ResolvedCreateResult as E, PlanAuthorization as F, Receipt$1 as I, Schema$1 as L, Authorization$1 as M, DnsPlan as N, Target as O, Operation$1 as P, encode as R, CreateResult as S, PartialApplyError as T, Receipt as _, Interface as a, AuthorizeError as b, Service as c, Authorization as d, CreateError as f, Plan as g, PartialError as h, Error as i, ApplyReceipt as j, plan_d_exports as k, resolver_d_exports as l, Operation as m, AsyncInterface as n, Query as o, Error$1 as p, AsyncResolution as r, Resolution as s, Answer as t, ApplyError as u, deletion_d_exports as v, ExactCreateInput as w, ConflictError as x, AuthorizationError as y, encodeReceipt as z };
+//# sourceMappingURL=resolver-CJOR9mQ8.d.mts.map