domainkit 0.11.0 → 0.12.1

package/dist/types/Server.d.ts

@@ -66,9 +66,18 @@ export declare const MethodDescriptor: Schema.Struct<{
 }>;
 export type MethodDescriptor = typeof MethodDescriptor.Type;
 /** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */
+/** The attachment a domain holds, with the zone label the provider gave when it was created. */
+export declare const Attachment: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly label: Schema.String;
+}>;
+export type Attachment = typeof Attachment.Type;
 export declare const Snapshot: Schema.Struct<{
     readonly domain: Schema.String;
-    readonly attachmentId: Schema.NullOr<Schema.String>;
+    readonly attachment: Schema.NullOr<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly label: Schema.String;
+    }>>;
     readonly connectionId: Schema.NullOr<Schema.String>;
     readonly provider: Schema.NullOr<Schema.String>;
     readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
@@ -119,12 +128,18 @@ export declare class Integration extends Integration_base {
 }
 export declare const Method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
 export type Method = typeof Method.Type;
+/** A start without a domain connects the account alone; the customer picks a zone afterwards. */
 export declare const StartPayload: Schema.Struct<{
-    readonly domain: Schema.String;
+    readonly domain: Schema.optionalKey<Schema.String>;
     readonly provider: Schema.String;
     readonly method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
 }>;
 export type StartPayload = typeof StartPayload.Type;
+/** How the customer proves the account again. The provider is the connection's own. */
+export declare const ReconnectPayload: Schema.Struct<{
+    readonly method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
+}>;
+export type ReconnectPayload = typeof ReconnectPayload.Type;
 declare const Candidate_base: Schema.Class<Candidate, Schema.Struct<{
     readonly zone: Schema.String;
     readonly label: Schema.String;
@@ -133,9 +148,15 @@ declare const Candidate_base: Schema.Class<Candidate, Schema.Struct<{
 export declare class Candidate extends Candidate_base {
 }
 declare const Connected_base: Schema.Class<Connected, Schema.TaggedStruct<"Connected", {
-    readonly snapshot: Schema.Struct<{
+    readonly connectionId: Schema.String;
+    readonly provider: Schema.String;
+    readonly label: Schema.String;
+    readonly snapshot: Schema.NullOr<Schema.Struct<{
         readonly domain: Schema.String;
-        readonly attachmentId: Schema.NullOr<Schema.String>;
+        readonly attachment: Schema.NullOr<Schema.Struct<{
+            readonly id: Schema.String;
+            readonly label: Schema.String;
+        }>>;
         readonly connectionId: Schema.NullOr<Schema.String>;
         readonly provider: Schema.NullOr<Schema.String>;
         readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
@@ -162,8 +183,13 @@ declare const Connected_base: Schema.Class<Connected, Schema.TaggedStruct<"Conne
                 }>>>;
             }>>;
         }>>;
-    }>;
+    }>>;
 }>, {}>;
+/**
+ * The connection the start produced. `label` names the account the way the customer will read it:
+ * the attached zone's label, or the provider's name when the start carried no domain. `snapshot`
+ * is the domain's state, and is null for a start that attached none.
+ */
 export declare class Connected extends Connected_base {
 }
 declare const Redirect_base: Schema.Class<Redirect, Schema.TaggedStruct<"Redirect", {
@@ -211,6 +237,49 @@ export declare class DiscoveryNotFound extends DiscoveryNotFound_base {
 }
 export declare const Discovery: Schema.Union<readonly [typeof DiscoveryResolved, typeof DiscoverySelectionRequired, typeof DiscoveryNotFound]>;
 export type Discovery = typeof Discovery.Type;
+/** One zone a connection reaches, named for a customer to pick from. */
+export declare const Zone: Schema.Struct<{
+    readonly connectionId: Schema.String;
+    readonly provider: Schema.String;
+    readonly zone: Schema.String;
+    readonly label: Schema.String;
+    readonly nameservers: Schema.optionalKey<Schema.$Array<Schema.String>>;
+}>;
+export type Zone = typeof Zone.Type;
+/**
+ * Every zone the principal's connections reach, and where each connection stands. A connection
+ * marked `reconnect` contributes no zones and needs the customer to authorize it again.
+ */
+export declare const Zones: Schema.Struct<{
+    readonly zones: Schema.$Array<Schema.Struct<{
+        readonly connectionId: Schema.String;
+        readonly provider: Schema.String;
+        readonly zone: Schema.String;
+        readonly label: Schema.String;
+        readonly nameservers: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>>;
+    readonly connections: Schema.$Array<Schema.Struct<{
+        readonly connectionId: Schema.String;
+        readonly provider: Schema.String;
+        readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
+    }>>;
+    /** Every provider a customer could connect, so a picker offers one without a second call. */
+    readonly providers: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly methods: Schema.$Array<Schema.Struct<{
+            readonly kind: Schema.Literals<readonly ["token", "oauth", "integration"]>;
+            readonly label: Schema.String;
+            readonly docsUrl: Schema.NullOr<Schema.String>;
+            readonly fields: Schema.NullOr<Schema.$Array<Schema.Struct<{
+                readonly name: Schema.String;
+                readonly required: Schema.Boolean;
+                readonly secret: Schema.Boolean;
+            }>>>;
+        }>>;
+    }>>;
+}>;
+export type Zones = typeof Zones.Type;
 export declare const AttachPayload: Schema.Struct<{
     readonly domain: Schema.String;
     /** Which candidate zone to attach when `SelectionRequired` came back. */
@@ -3973,7 +4042,10 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
     domain: Schema.String;
 }>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly domain: Schema.String;
-    readonly attachmentId: Schema.NullOr<Schema.String>;
+    readonly attachment: Schema.NullOr<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly label: Schema.String;
+    }>>;
     readonly connectionId: Schema.NullOr<Schema.String>;
     readonly provider: Schema.NullOr<Schema.String>;
     readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
@@ -5664,22 +5736,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
     readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"reject", "POST", "/plans/:planId/rejections", Schema.toCodecStringTree<Schema.Struct<{
-    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    /** Why the customer declined, for the audit trail. */
-    readonly reason: Schema.optionalKey<Schema.String>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"reconnect", "POST", "/connections/:connectionId/reconnections", Schema.toCodecStringTree<Schema.Struct<{
+    connectionId: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly plan: typeof Plan.Model;
-    readonly status: Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>;
-    readonly approval: Schema.NullOr<typeof Approval.Model>;
-    readonly receipt: Schema.NullOr<typeof Receipt.Model>;
-    readonly rejection: Schema.NullOr<Schema.Struct<{
-        readonly actorId: Schema.String;
-        readonly reason: Schema.NullOr<Schema.String>;
-        readonly at: Schema.DateTimeUtcFromString;
-    }>>;
-}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [typeof Connected, typeof Redirect, typeof SelectionRequired]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -6087,11 +6148,872 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
     readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/connections", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly domain: Schema.String;
-    readonly provider: Schema.String;
-    readonly method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
-}>>, never, Schema.toCodecJson<Schema.Union<readonly [typeof Connected, typeof Redirect, typeof SelectionRequired]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"reject", "POST", "/plans/:planId/rejections", Schema.toCodecStringTree<Schema.Struct<{
+    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    /** Why the customer declined, for the audit trail. */
+    readonly reason: Schema.optionalKey<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly plan: typeof Plan.Model;
+    readonly status: Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>;
+    readonly approval: Schema.NullOr<typeof Approval.Model>;
+    readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/connections", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly domain: Schema.optionalKey<Schema.String>;
+    readonly provider: Schema.String;
+    readonly method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [typeof Connected, typeof Redirect, typeof SelectionRequired]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"zones", "GET", "/zones", never, Schema.toCodecStringTree<Schema.Struct<{
+    provider: Schema.optionalKey<Schema.String>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly zones: Schema.$Array<Schema.Struct<{
+        readonly connectionId: Schema.String;
+        readonly provider: Schema.String;
+        readonly zone: Schema.String;
+        readonly label: Schema.String;
+        readonly nameservers: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>>;
+    readonly connections: Schema.$Array<Schema.Struct<{
+        readonly connectionId: Schema.String;
+        readonly provider: Schema.String;
+        readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
+    }>>;
+    /** Every provider a customer could connect, so a picker offers one without a second call. */
+    readonly providers: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly methods: Schema.$Array<Schema.Struct<{
+            readonly kind: Schema.Literals<readonly ["token", "oauth", "integration"]>;
+            readonly label: Schema.String;
+            readonly docsUrl: Schema.NullOr<Schema.String>;
+            readonly fields: Schema.NullOr<Schema.$Array<Schema.Struct<{
+                readonly name: Schema.String;
+                readonly required: Schema.Boolean;
+                readonly secret: Schema.Boolean;
+            }>>>;
+        }>>;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";