domainkit 0.10.0 → 0.12.0

package/dist/Cloudflare.mjs

@@ -30,12 +30,26 @@ const TokenFields = Schema.Struct({
 	token: Schema.RedactedFromValue(Schema.String),
 	accountId: Schema.optionalKey(Schema.String)
 });
-const server = {
-	authorization_endpoint: "https://dash.cloudflare.com/oauth2/auth",
-	issuer: "https://dash.cloudflare.com",
-	revocation_endpoint: "https://dash.cloudflare.com/oauth2/revoke",
-	token_endpoint: "https://dash.cloudflare.com/oauth2/token"
+const defaultIssuer = "https://dash.cloudflare.com";
+/**
+* The three OAuth endpoints Cloudflare serves under one origin. Consent is the browser's, exchange
+* and revocation are the server's, so a stage whose server reaches the same emulator by another
+* name gives two origins and keeps the paths.
+*/
+const endpointsOf = (origins) => {
+	const browser = origins.browser.replace(/\/$/, "");
+	const server = origins.server.replace(/\/$/, "");
+	return {
+		authorization_endpoint: `${browser}/oauth2/auth`,
+		issuer: browser,
+		revocation_endpoint: `${server}/oauth2/revoke`,
+		token_endpoint: `${server}/oauth2/token`
+	};
 };
+const server = endpointsOf({
+	browser: defaultIssuer,
+	server: defaultIssuer
+});
 const defaultScopes = [
 	"zone:read",
 	"dns_records:edit",
@@ -96,11 +110,17 @@ const provider = (options = {}) => {
 	const oauth = options.oauth === void 0 ? void 0 : oauthAuth(options.oauth);
 	function oauthAuth(settings) {
 		const scopes = settings.scopes ?? defaultScopes;
+		const browser = settings.issuer ?? defaultIssuer;
+		const endpoints = endpointsOf({
+			browser,
+			server: settings.serverOrigin ?? browser
+		});
+		const insecure = settings.allowPlaintext === void 0 ? {} : { allowPlaintext: settings.allowPlaintext };
 		return {
 			label: "Sign in with Cloudflare",
 			scopes,
 			start: (input) => oauthClient(settings).pipe(Effect.map(({ clientId }) => ({ authorizationUrl: authorizationUrl({
-				server,
+				server: endpoints,
 				clientId,
 				scopes,
 				state: input.state,
@@ -109,23 +129,25 @@ const provider = (options = {}) => {
 			}) }))),
 			complete: (input) => oauthClient(settings).pipe(Effect.flatMap((oauthClientValue) => exchangeCode({
 				provider: provider$1,
-				server,
+				server: endpoints,
 				client: oauthClientValue,
 				code: input.code,
 				state: input.params.state ?? "",
 				callbackUrl: input.callbackUrl,
 				codeVerifier: input.codeVerifier,
-				fetch
+				fetch,
+				...insecure
 			})), Effect.flatMap(issued)),
 			refresh: (credential) => Effect.gen(function* () {
 				const { refreshToken } = parseSecret(credential.secret);
 				if (refreshToken === null) return yield* fail(new Unauthenticated({ message: "Cloudflare credential has no refresh token" }));
 				const tokens = yield* refresh({
 					provider: provider$1,
-					server,
+					server: endpoints,
 					client: yield* oauthClient(settings),
 					refreshToken,
-					fetch
+					fetch,
+					...insecure
 				});
 				return {
 					secret: packSecret(tokens),
@@ -137,10 +159,11 @@ const provider = (options = {}) => {
 				const { accessToken } = parseSecret(credential.secret);
 				yield* revoke({
 					provider: provider$1,
-					server,
+					server: endpoints,
 					client: yield* oauthClient(settings),
 					token: accessToken,
-					fetch
+					fetch,
+					...insecure
 				});
 			})
 		};

package/dist/Cloudflare.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Cloudflare.mjs","names":["Client.listZones","OAuth.authorizationUrl","OAuth.exchangeCode","Client.provider","Errors.fail","Reason.Unauthenticated","OAuth.refresh","OAuth.revoke","Provider.make","Provider.tokenAuth","Client.verifyToken","Client.tokenExpiry","DomainName.decode","Provider.resolveAmong","Reason.Unsupported","Client.dns"],"sources":["../src/Cloudflare.ts"],"sourcesContent":["/** Cloudflare: personal API tokens and OAuth. */\nimport { type Config, Effect, Redacted, Schema } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport * as Client from \"./internal/cloudflare/client.ts\";\nimport type * as Protocol from \"./internal/cloudflare/protocol.ts\";\nimport { resolve } from \"./internal/config.ts\";\nimport type { Fetch } from \"./internal/http.ts\";\nimport * as OAuth from \"./internal/oauth.ts\";\nimport * as Provider from \"./Provider.ts\";\n\n/**\n * Authorization context: `accountId` is `null` when the credential spans several accounts or\n * none yet. Target context: the zone's account and zone id.\n */\nexport const AccountContext = Schema.Struct({\n  accountId: Schema.NullOr(Schema.String),\n  /** How the token was verified: user tokens span accounts, account tokens are pinned. */\n  tokenKind: Schema.optionalKey(Schema.Literals([\"user\", \"account\"])),\n  zoneId: Schema.optionalKey(Schema.String),\n});\n\n/** Token-method input: the API token, and the account id for account-owned tokens. */\nexport const TokenFields = Schema.Struct({\n  token: Schema.RedactedFromValue(Schema.String),\n  accountId: Schema.optionalKey(Schema.String),\n});\nexport type AccountContext = typeof AccountContext.Type;\n\nexport interface Options {\n  /** Omit to offer tokens only. */\n  readonly oauth?: {\n    readonly clientId: string | Config.Config<string>;\n    readonly clientSecret: Redacted.Redacted<string> | Config.Config<Redacted.Redacted<string>>;\n    /** Scope ids assigned to the OAuth client. Default: `zone:read`, `dns_records:edit`, `offline_access`. */\n    readonly scopes?: ReadonlyArray<string>;\n    /** Default `client_secret_basic`. */\n    readonly clientAuth?: OAuth.ClientAuth;\n  };\n  readonly fetch?: Fetch;\n  readonly baseUrl?: string;\n}\n\nexport const server: OAuth.Server = {\n  authorization_endpoint: \"https://dash.cloudflare.com/oauth2/auth\",\n  issuer: \"https://dash.cloudflare.com\",\n  revocation_endpoint: \"https://dash.cloudflare.com/oauth2/revoke\",\n  token_endpoint: \"https://dash.cloudflare.com/oauth2/token\",\n};\n\nconst defaultScopes = [\"zone:read\", \"dns_records:edit\", \"offline_access\"];\nconst capabilities = [\"dns:read\", \"dns:write\"] as const;\n\n/** OAuth credentials pack both tokens into `secret`; token credentials are the token itself. */\nconst Secret = Schema.fromJsonString(\n  Schema.Struct({ accessToken: Schema.String, refreshToken: Schema.NullOr(Schema.String) }),\n);\n\nconst parseSecret = (secret: Redacted.Redacted<string>) => {\n  const raw = Redacted.value(secret);\n  const parsed = raw.startsWith(\"{\") ? Schema.decodeUnknownOption(Secret)(raw) : undefined;\n  return parsed !== undefined && parsed._tag === \"Some\"\n    ? parsed.value\n    : { accessToken: raw, refreshToken: null };\n};\n\nconst packSecret = (tokens: OAuth.Tokens) =>\n  Redacted.make(\n    Schema.encodeSync(Secret)({\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n    }),\n  );\n\nexport const provider = (options: Options = {}): Provider.Definition<AccountContext> => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.cloudflare.com/client/v4\").replace(/\\/$/, \"\");\n  const client = (token: string): Client.Options => ({ token, fetch, baseUrl });\n\n  const discoverAccount = (token: string) =>\n    Client.listZones(client(token)).pipe(\n      Effect.map((zones) => {\n        const accounts = new Set(zones.map((zone) => zone.account.id));\n        const [only] = accounts;\n        return accounts.size === 1 && only !== undefined ? only : null;\n      }),\n    );\n\n  const targetOf = (zone: Protocol.Zone): Provider.Target => ({\n    zone: zone.name,\n    context: { accountId: zone.account.id, zoneId: zone.id } satisfies AccountContext,\n    label: `${zone.name} (${zone.account.name})`,\n    nameservers: zone.name_servers ?? [],\n  });\n\n  const oauthClient = (oauth: NonNullable<Options[\"oauth\"]>) =>\n    Effect.gen(function* () {\n      const clientId = yield* resolve(oauth.clientId, \"oauth.clientId\");\n      const clientSecret = yield* resolve(oauth.clientSecret, \"oauth.clientSecret\");\n      return {\n        clientId,\n        clientSecret,\n        clientAuth: oauth.clientAuth ?? \"client_secret_basic\",\n      } satisfies OAuth.Client;\n    });\n\n  const issued = (\n    tokens: OAuth.Tokens,\n  ): Effect.Effect<Provider.IssuedCredential, Errors.DomainKitError> =>\n    discoverAccount(tokens.accessToken).pipe(\n      Effect.map((accountId) => ({\n        secret: packSecret(tokens),\n        context: { accountId } satisfies AccountContext,\n        expiresAt: tokens.expiresAt,\n      })),\n    );\n\n  const oauth = options.oauth === undefined ? undefined : oauthAuth(options.oauth);\n\n  function oauthAuth(settings: NonNullable<Options[\"oauth\"]>): Provider.OAuthAuth {\n    const scopes = settings.scopes ?? defaultScopes;\n    return {\n      label: \"Sign in with Cloudflare\",\n      scopes,\n      start: (input) =>\n        oauthClient(settings).pipe(\n          Effect.map(({ clientId }) => ({\n            authorizationUrl: OAuth.authorizationUrl({\n              server,\n              clientId,\n              scopes,\n              state: input.state,\n              callbackUrl: input.callbackUrl,\n              codeChallenge: input.codeChallenge,\n            }),\n          })),\n        ),\n      complete: (input) =>\n        oauthClient(settings).pipe(\n          Effect.flatMap((oauthClientValue) =>\n            OAuth.exchangeCode({\n              provider: Client.provider,\n              server,\n              client: oauthClientValue,\n              code: input.code,\n              state: input.params.state ?? \"\",\n              callbackUrl: input.callbackUrl,\n              codeVerifier: input.codeVerifier,\n              fetch,\n            }),\n          ),\n          Effect.flatMap(issued),\n        ),\n      refresh: (credential) =>\n        Effect.gen(function* () {\n          const { refreshToken } = parseSecret(credential.secret);\n          if (refreshToken === null) {\n            return yield* Errors.fail(\n              new Reason.Unauthenticated({\n                message: \"Cloudflare credential has no refresh token\",\n              }),\n            );\n          }\n          const tokens = yield* OAuth.refresh({\n            provider: Client.provider,\n            server,\n            client: yield* oauthClient(settings),\n            refreshToken,\n            fetch,\n          });\n          return {\n            secret: packSecret(tokens),\n            context: credential.context,\n            expiresAt: tokens.expiresAt,\n          };\n        }),\n      revoke: (credential) =>\n        Effect.gen(function* () {\n          const { accessToken } = parseSecret(credential.secret);\n          yield* OAuth.revoke({\n            provider: Client.provider,\n            server,\n            client: yield* oauthClient(settings),\n            token: accessToken,\n            fetch,\n          });\n        }),\n    };\n  }\n\n  return Provider.make<AccountContext>({\n    id: \"cloudflare\",\n    name: \"Cloudflare\",\n    nameservers: [\"ns.cloudflare.com\"],\n    context: AccountContext,\n    contextVersion: \"cloudflare.v1\",\n    auth: {\n      token: Provider.tokenAuth({\n        label: \"API token\",\n        docsUrl: \"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\",\n        requiredCapabilities: capabilities,\n        fields: TokenFields,\n        authenticate: ({ token, accountId }) =>\n          Effect.gen(function* () {\n            const raw = Redacted.value(token);\n            if (accountId !== undefined) {\n              const expiresAt = yield* Client.verifyToken(\n                client(raw),\n                `/accounts/${encodeURIComponent(accountId)}/tokens/verify`,\n              );\n              return {\n                secret: token,\n                context: { accountId, tokenKind: \"account\" } satisfies AccountContext,\n                expiresAt,\n              };\n            }\n            const discovered = yield* discoverAccount(raw);\n            const verified = yield* Client.tokenExpiry(client(raw), discovered);\n            return {\n              secret: token,\n              context: { accountId: discovered, tokenKind: verified.kind } satisfies AccountContext,\n              expiresAt: verified.expiresAt,\n            };\n          }),\n      }),\n      ...(oauth === undefined ? {} : { oauth }),\n    },\n    session: (credential) => {\n      const { accessToken } = parseSecret(credential.secret);\n      const clientOptions = client(accessToken);\n      const context = Schema.decodeUnknownOption(AccountContext)(credential.context);\n      const accountId =\n        context._tag === \"Some\" ? (context.value.accountId ?? undefined) : undefined;\n      const listTargets = () =>\n        Client.listZones(clientOptions, accountId).pipe(Effect.map((zones) => zones.map(targetOf)));\n      return {\n        capabilities: () => Effect.succeed(capabilities),\n        listTargets,\n        resolveTarget: (domain) =>\n          Effect.gen(function* () {\n            const name = yield* DomainName.decode(domain);\n            const targets = yield* listTargets();\n            return Provider.resolveAmong(name, targets);\n          }),\n        dns: (target) => {\n          const zone = Schema.decodeUnknownOption(AccountContext)(target.context);\n          const zoneId = zone._tag === \"Some\" ? zone.value.zoneId : undefined;\n          if (zoneId === undefined) {\n            const failure = Errors.fail(\n              new Reason.Unsupported({\n                provider: \"cloudflare\",\n                operation: \"dns\",\n                message: \"Cloudflare target has no zone id; only zone targets host records\",\n              }),\n            );\n            return {\n              list: () => failure,\n              create: () => failure,\n              get: () => failure,\n              delete: () => failure,\n            };\n          }\n          return Client.dns(clientOptions, zoneId);\n        },\n      };\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,iBAAiB,OAAO,OAAO;CAC1C,WAAW,OAAO,OAAO,OAAO,MAAM;;CAEtC,WAAW,OAAO,YAAY,OAAO,SAAS,CAAC,QAAQ,SAAS,CAAC,CAAC;CAClE,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC;;AAGD,MAAa,cAAc,OAAO,OAAO;CACvC,OAAO,OAAO,kBAAkB,OAAO,MAAM;CAC7C,WAAW,OAAO,YAAY,OAAO,MAAM;AAC7C,CAAC;AAiBD,MAAa,SAAuB;CAClC,wBAAwB;CACxB,QAAQ;CACR,qBAAqB;CACrB,gBAAgB;AAClB;AAEA,MAAM,gBAAgB;CAAC;CAAa;CAAoB;AAAgB;AACxE,MAAM,eAAe,CAAC,YAAY,WAAW;;AAG7C,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;CAAE,aAAa,OAAO;CAAQ,cAAc,OAAO,OAAO,OAAO,MAAM;AAAE,CAAC,CAC1F;AAEA,MAAM,eAAe,WAAsC;CACzD,MAAM,MAAM,SAAS,MAAM,MAAM;CACjC,MAAM,SAAS,IAAI,WAAW,GAAG,IAAI,OAAO,oBAAoB,MAAM,CAAC,CAAC,GAAG,IAAI,KAAA;CAC/E,OAAO,WAAW,KAAA,KAAa,OAAO,SAAS,SAC3C,OAAO,QACP;EAAE,aAAa;EAAK,cAAc;CAAK;AAC7C;AAEA,MAAM,cAAc,WAClB,SAAS,KACP,OAAO,WAAW,MAAM,CAAC,CAAC;CACxB,aAAa,OAAO;CACpB,cAAc,OAAO;AACvB,CAAC,CACH;AAEF,MAAa,YAAY,UAAmB,CAAC,MAA2C;CACtF,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,uCAAA,CAAwC,QAAQ,OAAO,EAAE;CAC7F,MAAM,UAAU,WAAmC;EAAE;EAAO;EAAO;CAAQ;CAE3E,MAAM,mBAAmB,UACvBA,UAAiB,OAAO,KAAK,CAAC,CAAC,CAAC,KAC9B,OAAO,KAAK,UAAU;EACpB,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;EAC7D,MAAM,CAAC,QAAQ;EACf,OAAO,SAAS,SAAS,KAAK,SAAS,KAAA,IAAY,OAAO;CAC5D,CAAC,CACH;CAEF,MAAM,YAAY,UAA0C;EAC1D,MAAM,KAAK;EACX,SAAS;GAAE,WAAW,KAAK,QAAQ;GAAI,QAAQ,KAAK;EAAG;EACvD,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK;EAC1C,aAAa,KAAK,gBAAgB,CAAC;CACrC;CAEA,MAAM,eAAe,UACnB,OAAO,IAAI,aAAa;EAGtB,OAAO;GACL,UAAA,OAHsB,QAAQ,MAAM,UAAU,gBAAgB;GAI9D,cAAA,OAH0B,QAAQ,MAAM,cAAc,oBAAoB;GAI1E,YAAY,MAAM,cAAc;EAClC;CACF,CAAC;CAEH,MAAM,UACJ,WAEA,gBAAgB,OAAO,WAAW,CAAC,CAAC,KAClC,OAAO,KAAK,eAAe;EACzB,QAAQ,WAAW,MAAM;EACzB,SAAS,EAAE,UAAU;EACrB,WAAW,OAAO;CACpB,EAAE,CACJ;CAEF,MAAM,QAAQ,QAAQ,UAAU,KAAA,IAAY,KAAA,IAAY,UAAU,QAAQ,KAAK;CAE/E,SAAS,UAAU,UAA6D;EAC9E,MAAM,SAAS,SAAS,UAAU;EAClC,OAAO;GACL,OAAO;GACP;GACA,QAAQ,UACN,YAAY,QAAQ,CAAC,CAAC,KACpB,OAAO,KAAK,EAAE,gBAAgB,EAC5B,kBAAkBC,iBAAuB;IACvC;IACA;IACA;IACA,OAAO,MAAM;IACb,aAAa,MAAM;IACnB,eAAe,MAAM;GACvB,CAAC,EACH,EAAE,CACJ;GACF,WAAW,UACT,YAAY,QAAQ,CAAC,CAAC,KACpB,OAAO,SAAS,qBACdC,aAAmB;IACjB,UAAUC;IACV;IACA,QAAQ;IACR,MAAM,MAAM;IACZ,OAAO,MAAM,OAAO,SAAS;IAC7B,aAAa,MAAM;IACnB,cAAc,MAAM;IACpB;GACF,CAAC,CACH,GACA,OAAO,QAAQ,MAAM,CACvB;GACF,UAAU,eACR,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,iBAAiB,YAAY,WAAW,MAAM;IACtD,IAAI,iBAAiB,MACnB,OAAO,OAAOC,KACZ,IAAIC,gBAAuB,EACzB,SAAS,6CACX,CAAC,CACH;IAEF,MAAM,SAAS,OAAOC,QAAc;KAClC,UAAUH;KACV;KACA,QAAQ,OAAO,YAAY,QAAQ;KACnC;KACA;IACF,CAAC;IACD,OAAO;KACL,QAAQ,WAAW,MAAM;KACzB,SAAS,WAAW;KACpB,WAAW,OAAO;IACpB;GACF,CAAC;GACH,SAAS,eACP,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,gBAAgB,YAAY,WAAW,MAAM;IACrD,OAAOI,OAAa;KAClB,UAAUJ;KACV;KACA,QAAQ,OAAO,YAAY,QAAQ;KACnC,OAAO;KACP;IACF,CAAC;GACH,CAAC;EACL;CACF;CAEA,OAAOK,KAA8B;EACnC,IAAI;EACJ,MAAM;EACN,aAAa,CAAC,mBAAmB;EACjC,SAAS;EACT,gBAAgB;EAChB,MAAM;GACJ,OAAOC,UAAmB;IACxB,OAAO;IACP,SAAS;IACT,sBAAsB;IACtB,QAAQ;IACR,eAAe,EAAE,OAAO,gBACtB,OAAO,IAAI,aAAa;KACtB,MAAM,MAAM,SAAS,MAAM,KAAK;KAChC,IAAI,cAAc,KAAA,GAAW;MAC3B,MAAM,YAAY,OAAOC,YACvB,OAAO,GAAG,GACV,aAAa,mBAAmB,SAAS,EAAE,eAC7C;MACA,OAAO;OACL,QAAQ;OACR,SAAS;QAAE;QAAW,WAAW;OAAU;OAC3C;MACF;KACF;KACA,MAAM,aAAa,OAAO,gBAAgB,GAAG;KAC7C,MAAM,WAAW,OAAOC,YAAmB,OAAO,GAAG,GAAG,UAAU;KAClE,OAAO;MACL,QAAQ;MACR,SAAS;OAAE,WAAW;OAAY,WAAW,SAAS;MAAK;MAC3D,WAAW,SAAS;KACtB;IACF,CAAC;GACL,CAAC;GACD,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACzC;EACA,UAAU,eAAe;GACvB,MAAM,EAAE,gBAAgB,YAAY,WAAW,MAAM;GACrD,MAAM,gBAAgB,OAAO,WAAW;GACxC,MAAM,UAAU,OAAO,oBAAoB,cAAc,CAAC,CAAC,WAAW,OAAO;GAC7E,MAAM,YACJ,QAAQ,SAAS,SAAU,QAAQ,MAAM,aAAa,KAAA,IAAa,KAAA;GACrE,MAAM,oBACJX,UAAiB,eAAe,SAAS,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,IAAI,QAAQ,CAAC,CAAC;GAC5F,OAAO;IACL,oBAAoB,OAAO,QAAQ,YAAY;IAC/C;IACA,gBAAgB,WACd,OAAO,IAAI,aAAa;KACtB,MAAM,OAAO,OAAOY,OAAkB,MAAM;KAC5C,MAAM,UAAU,OAAO,YAAY;KACnC,OAAOC,aAAsB,MAAM,OAAO;IAC5C,CAAC;IACH,MAAM,WAAW;KACf,MAAM,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,OAAO,OAAO;KACtE,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,MAAM,SAAS,KAAA;KAC1D,IAAI,WAAW,KAAA,GAAW;MACxB,MAAM,UAAUT,KACd,IAAIU,YAAmB;OACrB,UAAU;OACV,WAAW;OACX,SAAS;MACX,CAAC,CACH;MACA,OAAO;OACL,YAAY;OACZ,cAAc;OACd,WAAW;OACX,cAAc;MAChB;KACF;KACA,OAAOC,IAAW,eAAe,MAAM;IACzC;GACF;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"Cloudflare.mjs","names":["Client.listZones","OAuth.authorizationUrl","OAuth.exchangeCode","Client.provider","Errors.fail","Reason.Unauthenticated","OAuth.refresh","OAuth.revoke","Provider.make","Provider.tokenAuth","Client.verifyToken","Client.tokenExpiry","DomainName.decode","Provider.resolveAmong","Reason.Unsupported","Client.dns"],"sources":["../src/Cloudflare.ts"],"sourcesContent":["/** Cloudflare: personal API tokens and OAuth. */\nimport { type Config, Effect, Redacted, Schema } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport * as Client from \"./internal/cloudflare/client.ts\";\nimport type * as Protocol from \"./internal/cloudflare/protocol.ts\";\nimport { resolve } from \"./internal/config.ts\";\nimport type { Fetch } from \"./internal/http.ts\";\nimport * as OAuth from \"./internal/oauth.ts\";\nimport * as Provider from \"./Provider.ts\";\n\n/**\n * Authorization context: `accountId` is `null` when the credential spans several accounts or\n * none yet. Target context: the zone's account and zone id.\n */\nexport const AccountContext = Schema.Struct({\n  accountId: Schema.NullOr(Schema.String),\n  /** How the token was verified: user tokens span accounts, account tokens are pinned. */\n  tokenKind: Schema.optionalKey(Schema.Literals([\"user\", \"account\"])),\n  zoneId: Schema.optionalKey(Schema.String),\n});\n\n/** Token-method input: the API token, and the account id for account-owned tokens. */\nexport const TokenFields = Schema.Struct({\n  token: Schema.RedactedFromValue(Schema.String),\n  accountId: Schema.optionalKey(Schema.String),\n});\nexport type AccountContext = typeof AccountContext.Type;\n\nexport interface Options {\n  /** Omit to offer tokens only. */\n  readonly oauth?: {\n    readonly clientId: string | Config.Config<string>;\n    readonly clientSecret: Redacted.Redacted<string> | Config.Config<Redacted.Redacted<string>>;\n    /** Scope ids assigned to the OAuth client. Default: `zone:read`, `dns_records:edit`, `offline_access`. */\n    readonly scopes?: ReadonlyArray<string>;\n    /** Default `client_secret_basic`. */\n    readonly clientAuth?: OAuth.ClientAuth;\n    /**\n     * Origin for consent, token exchange, and revocation, which Cloudflare serves at\n     * `/oauth2/auth`, `/oauth2/token`, and `/oauth2/revoke` beneath it. Default\n     * `https://dash.cloudflare.com`; a stage points it at an emulator that mounts the same three\n     * paths. It stays separate from `baseUrl` because in production these are different hosts:\n     * `dash.cloudflare.com` for OAuth, `api.cloudflare.com/client/v4` for the REST API.\n     */\n    readonly issuer?: string;\n    /**\n     * Where the server reaches the OAuth endpoints when that differs from where the browser does,\n     * for example an API in a container reaching an emulator through `host.docker.internal`.\n     * Defaults to `issuer`.\n     */\n    readonly serverOrigin?: string;\n    /**\n     * Permit `http:` for these endpoints when they are not loopback, such as an emulator reached\n     * through `host.docker.internal`. Development only: the client secret, the code, and the tokens\n     * cross the network in the clear, and a name resolves wherever the machine has been told to.\n     * Loopback needs no flag.\n     */\n    readonly allowPlaintext?: boolean;\n  };\n  readonly fetch?: Fetch;\n  readonly baseUrl?: string;\n}\n\nconst defaultIssuer = \"https://dash.cloudflare.com\";\n\n/**\n * The three OAuth endpoints Cloudflare serves under one origin. Consent is the browser's, exchange\n * and revocation are the server's, so a stage whose server reaches the same emulator by another\n * name gives two origins and keeps the paths.\n */\nconst endpointsOf = (origins: {\n  readonly browser: string;\n  readonly server: string;\n}): OAuth.Server => {\n  const browser = origins.browser.replace(/\\/$/, \"\");\n  const server = origins.server.replace(/\\/$/, \"\");\n  return {\n    authorization_endpoint: `${browser}/oauth2/auth`,\n    issuer: browser,\n    revocation_endpoint: `${server}/oauth2/revoke`,\n    token_endpoint: `${server}/oauth2/token`,\n  };\n};\n\nexport const server: OAuth.Server = endpointsOf({\n  browser: defaultIssuer,\n  server: defaultIssuer,\n});\n\nconst defaultScopes = [\"zone:read\", \"dns_records:edit\", \"offline_access\"];\nconst capabilities = [\"dns:read\", \"dns:write\"] as const;\n\n/** OAuth credentials pack both tokens into `secret`; token credentials are the token itself. */\nconst Secret = Schema.fromJsonString(\n  Schema.Struct({ accessToken: Schema.String, refreshToken: Schema.NullOr(Schema.String) }),\n);\n\nconst parseSecret = (secret: Redacted.Redacted<string>) => {\n  const raw = Redacted.value(secret);\n  const parsed = raw.startsWith(\"{\") ? Schema.decodeUnknownOption(Secret)(raw) : undefined;\n  return parsed !== undefined && parsed._tag === \"Some\"\n    ? parsed.value\n    : { accessToken: raw, refreshToken: null };\n};\n\nconst packSecret = (tokens: OAuth.Tokens) =>\n  Redacted.make(\n    Schema.encodeSync(Secret)({\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n    }),\n  );\n\nexport const provider = (options: Options = {}): Provider.Definition<AccountContext> => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.cloudflare.com/client/v4\").replace(/\\/$/, \"\");\n  const client = (token: string): Client.Options => ({ token, fetch, baseUrl });\n\n  const discoverAccount = (token: string) =>\n    Client.listZones(client(token)).pipe(\n      Effect.map((zones) => {\n        const accounts = new Set(zones.map((zone) => zone.account.id));\n        const [only] = accounts;\n        return accounts.size === 1 && only !== undefined ? only : null;\n      }),\n    );\n\n  const targetOf = (zone: Protocol.Zone): Provider.Target => ({\n    zone: zone.name,\n    context: { accountId: zone.account.id, zoneId: zone.id } satisfies AccountContext,\n    label: `${zone.name} (${zone.account.name})`,\n    nameservers: zone.name_servers ?? [],\n  });\n\n  const oauthClient = (oauth: NonNullable<Options[\"oauth\"]>) =>\n    Effect.gen(function* () {\n      const clientId = yield* resolve(oauth.clientId, \"oauth.clientId\");\n      const clientSecret = yield* resolve(oauth.clientSecret, \"oauth.clientSecret\");\n      return {\n        clientId,\n        clientSecret,\n        clientAuth: oauth.clientAuth ?? \"client_secret_basic\",\n      } satisfies OAuth.Client;\n    });\n\n  const issued = (\n    tokens: OAuth.Tokens,\n  ): Effect.Effect<Provider.IssuedCredential, Errors.DomainKitError> =>\n    discoverAccount(tokens.accessToken).pipe(\n      Effect.map((accountId) => ({\n        secret: packSecret(tokens),\n        context: { accountId } satisfies AccountContext,\n        expiresAt: tokens.expiresAt,\n      })),\n    );\n\n  const oauth = options.oauth === undefined ? undefined : oauthAuth(options.oauth);\n\n  function oauthAuth(settings: NonNullable<Options[\"oauth\"]>): Provider.OAuthAuth {\n    const scopes = settings.scopes ?? defaultScopes;\n    const browser = settings.issuer ?? defaultIssuer;\n    const endpoints = endpointsOf({ browser, server: settings.serverOrigin ?? browser });\n    const insecure =\n      settings.allowPlaintext === undefined ? {} : { allowPlaintext: settings.allowPlaintext };\n    return {\n      label: \"Sign in with Cloudflare\",\n      scopes,\n      start: (input) =>\n        oauthClient(settings).pipe(\n          Effect.map(({ clientId }) => ({\n            authorizationUrl: OAuth.authorizationUrl({\n              server: endpoints,\n              clientId,\n              scopes,\n              state: input.state,\n              callbackUrl: input.callbackUrl,\n              codeChallenge: input.codeChallenge,\n            }),\n          })),\n        ),\n      complete: (input) =>\n        oauthClient(settings).pipe(\n          Effect.flatMap((oauthClientValue) =>\n            OAuth.exchangeCode({\n              provider: Client.provider,\n              server: endpoints,\n              client: oauthClientValue,\n              code: input.code,\n              state: input.params.state ?? \"\",\n              callbackUrl: input.callbackUrl,\n              codeVerifier: input.codeVerifier,\n              fetch,\n              ...insecure,\n            }),\n          ),\n          Effect.flatMap(issued),\n        ),\n      refresh: (credential) =>\n        Effect.gen(function* () {\n          const { refreshToken } = parseSecret(credential.secret);\n          if (refreshToken === null) {\n            return yield* Errors.fail(\n              new Reason.Unauthenticated({\n                message: \"Cloudflare credential has no refresh token\",\n              }),\n            );\n          }\n          const tokens = yield* OAuth.refresh({\n            provider: Client.provider,\n            server: endpoints,\n            client: yield* oauthClient(settings),\n            refreshToken,\n            fetch,\n            ...insecure,\n          });\n          return {\n            secret: packSecret(tokens),\n            context: credential.context,\n            expiresAt: tokens.expiresAt,\n          };\n        }),\n      revoke: (credential) =>\n        Effect.gen(function* () {\n          const { accessToken } = parseSecret(credential.secret);\n          yield* OAuth.revoke({\n            provider: Client.provider,\n            server: endpoints,\n            client: yield* oauthClient(settings),\n            token: accessToken,\n            fetch,\n            ...insecure,\n          });\n        }),\n    };\n  }\n\n  return Provider.make<AccountContext>({\n    id: \"cloudflare\",\n    name: \"Cloudflare\",\n    nameservers: [\"ns.cloudflare.com\"],\n    context: AccountContext,\n    contextVersion: \"cloudflare.v1\",\n    auth: {\n      token: Provider.tokenAuth({\n        label: \"API token\",\n        docsUrl: \"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\",\n        requiredCapabilities: capabilities,\n        fields: TokenFields,\n        authenticate: ({ token, accountId }) =>\n          Effect.gen(function* () {\n            const raw = Redacted.value(token);\n            if (accountId !== undefined) {\n              const expiresAt = yield* Client.verifyToken(\n                client(raw),\n                `/accounts/${encodeURIComponent(accountId)}/tokens/verify`,\n              );\n              return {\n                secret: token,\n                context: { accountId, tokenKind: \"account\" } satisfies AccountContext,\n                expiresAt,\n              };\n            }\n            const discovered = yield* discoverAccount(raw);\n            const verified = yield* Client.tokenExpiry(client(raw), discovered);\n            return {\n              secret: token,\n              context: { accountId: discovered, tokenKind: verified.kind } satisfies AccountContext,\n              expiresAt: verified.expiresAt,\n            };\n          }),\n      }),\n      ...(oauth === undefined ? {} : { oauth }),\n    },\n    session: (credential) => {\n      const { accessToken } = parseSecret(credential.secret);\n      const clientOptions = client(accessToken);\n      const context = Schema.decodeUnknownOption(AccountContext)(credential.context);\n      const accountId =\n        context._tag === \"Some\" ? (context.value.accountId ?? undefined) : undefined;\n      const listTargets = () =>\n        Client.listZones(clientOptions, accountId).pipe(Effect.map((zones) => zones.map(targetOf)));\n      return {\n        capabilities: () => Effect.succeed(capabilities),\n        listTargets,\n        resolveTarget: (domain) =>\n          Effect.gen(function* () {\n            const name = yield* DomainName.decode(domain);\n            const targets = yield* listTargets();\n            return Provider.resolveAmong(name, targets);\n          }),\n        dns: (target) => {\n          const zone = Schema.decodeUnknownOption(AccountContext)(target.context);\n          const zoneId = zone._tag === \"Some\" ? zone.value.zoneId : undefined;\n          if (zoneId === undefined) {\n            const failure = Errors.fail(\n              new Reason.Unsupported({\n                provider: \"cloudflare\",\n                operation: \"dns\",\n                message: \"Cloudflare target has no zone id; only zone targets host records\",\n              }),\n            );\n            return {\n              list: () => failure,\n              create: () => failure,\n              get: () => failure,\n              delete: () => failure,\n            };\n          }\n          return Client.dns(clientOptions, zoneId);\n        },\n      };\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,iBAAiB,OAAO,OAAO;CAC1C,WAAW,OAAO,OAAO,OAAO,MAAM;;CAEtC,WAAW,OAAO,YAAY,OAAO,SAAS,CAAC,QAAQ,SAAS,CAAC,CAAC;CAClE,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC;;AAGD,MAAa,cAAc,OAAO,OAAO;CACvC,OAAO,OAAO,kBAAkB,OAAO,MAAM;CAC7C,WAAW,OAAO,YAAY,OAAO,MAAM;AAC7C,CAAC;AAsCD,MAAM,gBAAgB;;;;;;AAOtB,MAAM,eAAe,YAGD;CAClB,MAAM,UAAU,QAAQ,QAAQ,QAAQ,OAAO,EAAE;CACjD,MAAM,SAAS,QAAQ,OAAO,QAAQ,OAAO,EAAE;CAC/C,OAAO;EACL,wBAAwB,GAAG,QAAQ;EACnC,QAAQ;EACR,qBAAqB,GAAG,OAAO;EAC/B,gBAAgB,GAAG,OAAO;CAC5B;AACF;AAEA,MAAa,SAAuB,YAAY;CAC9C,SAAS;CACT,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB;CAAC;CAAa;CAAoB;AAAgB;AACxE,MAAM,eAAe,CAAC,YAAY,WAAW;;AAG7C,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;CAAE,aAAa,OAAO;CAAQ,cAAc,OAAO,OAAO,OAAO,MAAM;AAAE,CAAC,CAC1F;AAEA,MAAM,eAAe,WAAsC;CACzD,MAAM,MAAM,SAAS,MAAM,MAAM;CACjC,MAAM,SAAS,IAAI,WAAW,GAAG,IAAI,OAAO,oBAAoB,MAAM,CAAC,CAAC,GAAG,IAAI,KAAA;CAC/E,OAAO,WAAW,KAAA,KAAa,OAAO,SAAS,SAC3C,OAAO,QACP;EAAE,aAAa;EAAK,cAAc;CAAK;AAC7C;AAEA,MAAM,cAAc,WAClB,SAAS,KACP,OAAO,WAAW,MAAM,CAAC,CAAC;CACxB,aAAa,OAAO;CACpB,cAAc,OAAO;AACvB,CAAC,CACH;AAEF,MAAa,YAAY,UAAmB,CAAC,MAA2C;CACtF,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,uCAAA,CAAwC,QAAQ,OAAO,EAAE;CAC7F,MAAM,UAAU,WAAmC;EAAE;EAAO;EAAO;CAAQ;CAE3E,MAAM,mBAAmB,UACvBA,UAAiB,OAAO,KAAK,CAAC,CAAC,CAAC,KAC9B,OAAO,KAAK,UAAU;EACpB,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;EAC7D,MAAM,CAAC,QAAQ;EACf,OAAO,SAAS,SAAS,KAAK,SAAS,KAAA,IAAY,OAAO;CAC5D,CAAC,CACH;CAEF,MAAM,YAAY,UAA0C;EAC1D,MAAM,KAAK;EACX,SAAS;GAAE,WAAW,KAAK,QAAQ;GAAI,QAAQ,KAAK;EAAG;EACvD,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,QAAQ,KAAK;EAC1C,aAAa,KAAK,gBAAgB,CAAC;CACrC;CAEA,MAAM,eAAe,UACnB,OAAO,IAAI,aAAa;EAGtB,OAAO;GACL,UAAA,OAHsB,QAAQ,MAAM,UAAU,gBAAgB;GAI9D,cAAA,OAH0B,QAAQ,MAAM,cAAc,oBAAoB;GAI1E,YAAY,MAAM,cAAc;EAClC;CACF,CAAC;CAEH,MAAM,UACJ,WAEA,gBAAgB,OAAO,WAAW,CAAC,CAAC,KAClC,OAAO,KAAK,eAAe;EACzB,QAAQ,WAAW,MAAM;EACzB,SAAS,EAAE,UAAU;EACrB,WAAW,OAAO;CACpB,EAAE,CACJ;CAEF,MAAM,QAAQ,QAAQ,UAAU,KAAA,IAAY,KAAA,IAAY,UAAU,QAAQ,KAAK;CAE/E,SAAS,UAAU,UAA6D;EAC9E,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,UAAU,SAAS,UAAU;EACnC,MAAM,YAAY,YAAY;GAAE;GAAS,QAAQ,SAAS,gBAAgB;EAAQ,CAAC;EACnF,MAAM,WACJ,SAAS,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,eAAe;EACzF,OAAO;GACL,OAAO;GACP;GACA,QAAQ,UACN,YAAY,QAAQ,CAAC,CAAC,KACpB,OAAO,KAAK,EAAE,gBAAgB,EAC5B,kBAAkBC,iBAAuB;IACvC,QAAQ;IACR;IACA;IACA,OAAO,MAAM;IACb,aAAa,MAAM;IACnB,eAAe,MAAM;GACvB,CAAC,EACH,EAAE,CACJ;GACF,WAAW,UACT,YAAY,QAAQ,CAAC,CAAC,KACpB,OAAO,SAAS,qBACdC,aAAmB;IACjB,UAAUC;IACV,QAAQ;IACR,QAAQ;IACR,MAAM,MAAM;IACZ,OAAO,MAAM,OAAO,SAAS;IAC7B,aAAa,MAAM;IACnB,cAAc,MAAM;IACpB;IACA,GAAG;GACL,CAAC,CACH,GACA,OAAO,QAAQ,MAAM,CACvB;GACF,UAAU,eACR,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,iBAAiB,YAAY,WAAW,MAAM;IACtD,IAAI,iBAAiB,MACnB,OAAO,OAAOC,KACZ,IAAIC,gBAAuB,EACzB,SAAS,6CACX,CAAC,CACH;IAEF,MAAM,SAAS,OAAOC,QAAc;KAClC,UAAUH;KACV,QAAQ;KACR,QAAQ,OAAO,YAAY,QAAQ;KACnC;KACA;KACA,GAAG;IACL,CAAC;IACD,OAAO;KACL,QAAQ,WAAW,MAAM;KACzB,SAAS,WAAW;KACpB,WAAW,OAAO;IACpB;GACF,CAAC;GACH,SAAS,eACP,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,gBAAgB,YAAY,WAAW,MAAM;IACrD,OAAOI,OAAa;KAClB,UAAUJ;KACV,QAAQ;KACR,QAAQ,OAAO,YAAY,QAAQ;KACnC,OAAO;KACP;KACA,GAAG;IACL,CAAC;GACH,CAAC;EACL;CACF;CAEA,OAAOK,KAA8B;EACnC,IAAI;EACJ,MAAM;EACN,aAAa,CAAC,mBAAmB;EACjC,SAAS;EACT,gBAAgB;EAChB,MAAM;GACJ,OAAOC,UAAmB;IACxB,OAAO;IACP,SAAS;IACT,sBAAsB;IACtB,QAAQ;IACR,eAAe,EAAE,OAAO,gBACtB,OAAO,IAAI,aAAa;KACtB,MAAM,MAAM,SAAS,MAAM,KAAK;KAChC,IAAI,cAAc,KAAA,GAAW;MAC3B,MAAM,YAAY,OAAOC,YACvB,OAAO,GAAG,GACV,aAAa,mBAAmB,SAAS,EAAE,eAC7C;MACA,OAAO;OACL,QAAQ;OACR,SAAS;QAAE;QAAW,WAAW;OAAU;OAC3C;MACF;KACF;KACA,MAAM,aAAa,OAAO,gBAAgB,GAAG;KAC7C,MAAM,WAAW,OAAOC,YAAmB,OAAO,GAAG,GAAG,UAAU;KAClE,OAAO;MACL,QAAQ;MACR,SAAS;OAAE,WAAW;OAAY,WAAW,SAAS;MAAK;MAC3D,WAAW,SAAS;KACtB;IACF,CAAC;GACL,CAAC;GACD,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACzC;EACA,UAAU,eAAe;GACvB,MAAM,EAAE,gBAAgB,YAAY,WAAW,MAAM;GACrD,MAAM,gBAAgB,OAAO,WAAW;GACxC,MAAM,UAAU,OAAO,oBAAoB,cAAc,CAAC,CAAC,WAAW,OAAO;GAC7E,MAAM,YACJ,QAAQ,SAAS,SAAU,QAAQ,MAAM,aAAa,KAAA,IAAa,KAAA;GACrE,MAAM,oBACJX,UAAiB,eAAe,SAAS,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,IAAI,QAAQ,CAAC,CAAC;GAC5F,OAAO;IACL,oBAAoB,OAAO,QAAQ,YAAY;IAC/C;IACA,gBAAgB,WACd,OAAO,IAAI,aAAa;KACtB,MAAM,OAAO,OAAOY,OAAkB,MAAM;KAC5C,MAAM,UAAU,OAAO,YAAY;KACnC,OAAOC,aAAsB,MAAM,OAAO;IAC5C,CAAC;IACH,MAAM,WAAW;KACf,MAAM,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,OAAO,OAAO;KACtE,MAAM,SAAS,KAAK,SAAS,SAAS,KAAK,MAAM,SAAS,KAAA;KAC1D,IAAI,WAAW,KAAA,GAAW;MACxB,MAAM,UAAUT,KACd,IAAIU,YAAmB;OACrB,UAAU;OACV,WAAW;OACX,SAAS;MACX,CAAC,CACH;MACA,OAAO;OACL,YAAY;OACZ,cAAc;OACd,WAAW;OACX,cAAc;MAChB;KACF;KACA,OAAOC,IAAW,eAAe,MAAM;IACzC;GACF;EACF;CACF,CAAC;AACH"}

package/dist/Connect.mjs

@@ -33,9 +33,11 @@ var Connect_exports = /* @__PURE__ */ __exportAll({
 	inspect: () => inspect,
 	layer: () => layer,
 	make: () => make,
+	reconnect: () => reconnect,
 	refresh: () => refresh,
 	session: () => session,
-	start: () => start
+	start: () => start,
+	zones: () => zones
 });
 const MethodEnum = Data.taggedEnum();
 /** `token` accepts a lone string (`{ token }`) or a record; every value is wrapped in `Redacted`. */
@@ -59,7 +61,9 @@ const Payload = Schema.Struct({
 	method: Schema.Literals(["oauth", "integration"]),
 	codeVerifier: Schema.NullOr(Schema.String),
 	callbackUrl: Schema.String,
-	domain: Schema.NullOr(Schema.String)
+	domain: Schema.NullOr(Schema.String),
+	/** Set when the flow is re-crediting a connection rather than making one. */
+	connectionId: Schema.NullOr(Schema.String)
 });
 const Target = Schema.Struct({
 	zone: Schema.String,
@@ -167,6 +171,32 @@ const make = Effect.gen(function* () {
 			session
 		};
 	});
+	/**
+	* Put a fresh credential behind an authorization the owner already has. The row keeps its id, so
+	* every connection over it, and every domain on those connections, stays exactly where it is.
+	*/
+	const replaceWith = (input) => Effect.gen(function* () {
+		const principal = yield* Service$2;
+		const held = yield* input.definition.session(input.issued).capabilities();
+		const missing = input.requiredCapabilities.filter((capability) => !held.includes(capability));
+		if (missing.length > 0) return yield* fail(new Forbidden({ message: `${input.definition.name} credential lacks ${missing.join(", ")}` }));
+		const authorization = new Authorization({
+			id: input.authorizationId,
+			ownerId: principal.ownerId,
+			provider: input.definition.id,
+			method: input.method,
+			capabilities: held,
+			context: yield* encodeContext(input.definition, input.issued.context),
+			revocation: "active",
+			createdBy: principal.actorId,
+			createdAt: yield* DateTime.now
+		});
+		yield* storage.authorizations.upsert({
+			authorization,
+			credential: yield* seal(input.issued),
+			expectedId: input.authorizationId
+		});
+	});
 	const attachWith = (input) => Effect.gen(function* () {
 		const domain = yield* decode(input.domain);
 		const existing = yield* storage.attachments.byDomain(domain);
@@ -185,6 +215,7 @@ const make = Effect.gen(function* () {
 				connectionId: input.connection.id,
 				domain,
 				zone: resolution.target.zone,
+				label: resolution.target.label,
 				target: {
 					...resolution.target,
 					context: yield* encodeContext(input.definition, resolution.target.context)
@@ -251,6 +282,35 @@ const make = Effect.gen(function* () {
 		const [host] = hosts;
 		return hosts.length === 1 && host !== void 0 ? { provider: host.id } : null;
 	};
+	const zones = (options = {}) => Effect.gen(function* () {
+		const reachable = [];
+		const connections = [];
+		const filter = options.provider === void 0 ? void 0 : { provider: options.provider };
+		for (const connection of yield* storage.connections.list(filter)) {
+			const authorization = yield* storage.authorizations.get(connection.authorizationId);
+			const targets = yield* sessionFor(connection).pipe(Effect.flatMap((session) => session.listTargets()), Effect.map(Option.some), Effect.catchIf((error) => error.reason._tag === "Reconnect" || error.reason._tag === "Unauthenticated" || error.reason._tag === "Forbidden", () => Effect.succeed(Option.none())));
+			connections.push({
+				connectionId: connection.id,
+				provider: authorization.provider,
+				status: Option.isNone(targets) ? "reconnect" : "connected"
+			});
+			if (Option.isNone(targets)) continue;
+			for (const target of targets.value) reachable.push({
+				connectionId: connection.id,
+				provider: authorization.provider,
+				target
+			});
+		}
+		return {
+			zones: reachable.sort((left, right) => left.target.zone.localeCompare(right.target.zone) || left.connectionId.localeCompare(right.connectionId)),
+			connections,
+			providers: providers.list().map((definition) => ({
+				id: definition.id,
+				name: definition.name,
+				methods: describeMethods(definition)
+			}))
+		};
+	});
 	const inspect = (input) => Effect.gen(function* () {
 		const domain = yield* decode(input);
 		const policy = yield* Policy;
@@ -258,6 +318,7 @@ const make = Effect.gen(function* () {
 		const connection = attachment === null ? null : yield* storage.connections.get(attachment.connectionId);
 		const authorization = connection === null ? null : yield* storage.authorizations.get(connection.authorizationId);
 		const latest = attachment === null ? Option.none() : yield* storage.attempts.latest(attachment.id, "provisioning");
+		const attached = connection === null ? [] : yield* storage.attachments.list(connection.id);
 		const reusable = [];
 		for (const candidate of yield* storage.connections.list()) {
 			if (candidate.id === connection?.id) continue;
@@ -285,6 +346,7 @@ const make = Effect.gen(function* () {
 				revocation: authorization.revocation
 			},
 			lastReceiptId: Option.isSome(latest) ? latest.value.receipt?.id ?? null : null,
+			connectionDomains: attached.length,
 			reusable,
 			providers: providers.list().map((definition) => ({
 				id: definition.id,
@@ -295,8 +357,6 @@ const make = Effect.gen(function* () {
 	});
 	const start = (input) => Effect.gen(function* () {
 		yield* recover;
-		const principal = yield* Service$2;
-		const policy = yield* Policy;
 		const definition = yield* providers.get(input.provider);
 		if (input.domain !== void 0) yield* decode(input.domain);
 		switch (input.method._tag) {
@@ -319,39 +379,83 @@ const make = Effect.gen(function* () {
 				return started(connection, attached);
 			}
 			case "OAuth":
-			case "Integration": {
-				const interactive = input.method._tag === "OAuth" ? definition.auth.oauth : definition.auth.integration;
-				if (interactive === void 0) return yield* invalid(`${definition.name} does not offer ${input.method._tag.toLowerCase()} connections`, "method");
-				if (input.callbackUrl === void 0) return yield* invalid("Interactive connections need a callbackUrl", "callbackUrl");
-				const continuationId = yield* fresh("cont");
-				const pkce$1 = input.method._tag === "OAuth" ? yield* pkce() : null;
-				const redirect = input.method._tag === "OAuth" ? yield* interactive.start({
-					state: continuationId,
-					callbackUrl: input.callbackUrl,
-					codeChallenge: pkce$1?.codeChallenge ?? ""
-				}) : yield* interactive.start({
-					state: continuationId,
-					callbackUrl: input.callbackUrl
+			case "Integration": return yield* redirectFor({
+				definition,
+				method: input.method,
+				callbackUrl: input.callbackUrl,
+				domain: input.domain ?? null,
+				connectionId: null
+			});
+		}
+	});
+	/** The redirect an interactive method answers with, and the continuation that finishes it. */
+	const redirectFor = (input) => Effect.gen(function* () {
+		const principal = yield* Service$2;
+		const policy = yield* Policy;
+		const interactive = input.method._tag === "OAuth" ? input.definition.auth.oauth : input.definition.auth.integration;
+		if (interactive === void 0) return yield* invalid(`${input.definition.name} does not offer ${input.method._tag.toLowerCase()} connections`, "method");
+		if (input.callbackUrl === void 0) return yield* invalid("Interactive connections need a callbackUrl", "callbackUrl");
+		const callbackUrl = input.callbackUrl;
+		const continuationId = yield* fresh("cont");
+		const pkce$1 = input.method._tag === "OAuth" ? yield* pkce() : null;
+		const redirect = input.method._tag === "OAuth" ? yield* interactive.start({
+			state: continuationId,
+			callbackUrl,
+			codeChallenge: pkce$1?.codeChallenge ?? ""
+		}) : yield* interactive.start({
+			state: continuationId,
+			callbackUrl
+		});
+		yield* storage.continuations.put(new Continuation({
+			id: continuationId,
+			ownerId: principal.ownerId,
+			actorId: principal.actorId,
+			provider: input.definition.id,
+			payload: Schema.encodeSync(Payload)({
+				method: input.method._tag === "OAuth" ? "oauth" : "integration",
+				codeVerifier: pkce$1?.codeVerifier ?? null,
+				callbackUrl,
+				domain: input.domain,
+				connectionId: input.connectionId
+			}),
+			returnTo: input.method.returnTo ?? null,
+			expiresAt: DateTime.addDuration(yield* DateTime.now, Duration.millis(policy.continuationTtlMs))
+		}));
+		return Started.Redirect({
+			authorizationUrl: redirect.authorizationUrl,
+			continuationId
+		});
+	});
+	const reconnect = (input) => Effect.gen(function* () {
+		yield* recover;
+		const connection = yield* storage.connections.get(input.connectionId);
+		const existing = yield* storage.authorizations.get(connection.authorizationId);
+		const definition = yield* providers.get(existing.provider);
+		switch (input.method._tag) {
+			case "Token": {
+				const token = definition.auth.token;
+				if (token === void 0) return yield* invalid(`${definition.name} does not accept tokens`, "method");
+				const issued = yield* token.authenticate(input.method.values);
+				yield* replaceWith({
+					definition,
+					authorizationId: existing.id,
+					method: "token",
+					issued,
+					requiredCapabilities: token.requiredCapabilities
 				});
-				yield* storage.continuations.put(new Continuation({
-					id: continuationId,
-					ownerId: principal.ownerId,
-					actorId: principal.actorId,
-					provider: definition.id,
-					payload: Schema.encodeSync(Payload)({
-						method: input.method._tag === "OAuth" ? "oauth" : "integration",
-						codeVerifier: pkce$1?.codeVerifier ?? null,
-						callbackUrl: input.callbackUrl,
-						domain: input.domain ?? null
-					}),
-					returnTo: input.method.returnTo ?? null,
-					expiresAt: DateTime.addDuration(yield* DateTime.now, Duration.millis(policy.continuationTtlMs))
-				}));
-				return Started.Redirect({
-					authorizationUrl: redirect.authorizationUrl,
-					continuationId
+				return Started.Connected({
+					connection,
+					attachment: null
 				});
 			}
+			case "OAuth":
+			case "Integration": return yield* redirectFor({
+				definition,
+				method: input.method,
+				callbackUrl: input.callbackUrl,
+				domain: null,
+				connectionId: connection.id
+			});
 		}
 	});
 	const complete = (input) => Effect.gen(function* () {
@@ -390,6 +494,22 @@ const make = Effect.gen(function* () {
 					params
 				});
 			});
+			if (payload.connectionId !== null) {
+				const held = yield* storage.connections.get(payload.connectionId);
+				const existing = yield* storage.authorizations.get(held.authorizationId);
+				yield* replaceWith({
+					definition,
+					authorizationId: existing.id,
+					method: payload.method,
+					issued,
+					requiredCapabilities: []
+				});
+				yield* storage.continuations.consume(input.continuationId).pipe(Effect.ignore);
+				return Started.Connected({
+					connection: held,
+					attachment: null
+				});
+			}
 			const { connection, session } = yield* connectWith({
 				definition,
 				method: payload.method,
@@ -451,8 +571,10 @@ const make = Effect.gen(function* () {
 	});
 	return {
 		inspect,
+		zones,
 		discover,
 		start,
+		reconnect,
 		complete,
 		attach,
 		detach: (attachmentId) => storage.attachments.remove(attachmentId),
@@ -464,8 +586,10 @@ const make = Effect.gen(function* () {
 const layer = Layer.effect(Service)(make);
 const accessor = (pick) => (...args) => Effect.flatMap(Service, (service) => pick(service)(...args));
 const inspect = accessor((service) => service.inspect);
+const zones = accessor((service) => service.zones);
 const discover = accessor((service) => service.discover);
 const start = accessor((service) => service.start);
+const reconnect = accessor((service) => service.reconnect);
 const complete = accessor((service) => service.complete);
 const attach = accessor((service) => service.attach);
 const detach = accessor((service) => service.detach);
@@ -473,6 +597,6 @@ const disconnect = accessor((service) => service.disconnect);
 const refresh = accessor((service) => service.refresh);
 const session = accessor((service) => service.session);
 //#endregion
-export { Connect_exports, Discovery, Method, Policy, Selection, Service, Started, attach, complete, defaults, detach, disconnect, discover, inspect, layer, make, refresh, session, start };
+export { Connect_exports, Discovery, Method, Policy, Selection, Service, Started, attach, complete, defaults, detach, disconnect, discover, inspect, layer, make, reconnect, refresh, session, start, zones };
 
 //# sourceMappingURL=Connect.mjs.map