domainkit 0.14.1 → 0.16.0

package/dist/types/Server.d.ts

@@ -279,6 +279,8 @@ export declare const Zones: Schema.Struct<{
     readonly connections: Schema.$Array<Schema.Struct<{
         readonly connectionId: Schema.String;
         readonly provider: Schema.String;
+        /** What the provider called the account at connect time; `null` when it named none. */
+        readonly label: Schema.NullOr<Schema.String>;
         readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
     }>>;
     /** Every provider a customer could connect, so a picker offers one without a second call. */
@@ -336,6 +338,83 @@ export declare const Attempt: Schema.Struct<{
     }>>;
 }>;
 export type Attempt = typeof Attempt.Type;
+/** What a batch's create and resume routes take: one domain and its requirements per item. */
+export declare const BatchPayload: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly domain: Schema.String;
+        readonly requirements: Schema.$Array<Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>>;
+    }>>;
+}>;
+export type BatchPayload = typeof BatchPayload.Type;
+/** The digest the principal read, which the batch's current plans must still produce. */
+export declare const BatchApprovePayload: Schema.Struct<{
+    readonly digest: Schema.brand<Schema.String, "@domainkit/Digest">;
+}>;
+export type BatchApprovePayload = typeof BatchApprovePayload.Type;
+/** One domain's place in a batch, with whatever its attempt holds. */
+export declare const BatchItem: Schema.Struct<{
+    readonly attachmentId: Schema.String;
+    readonly position: Schema.Number;
+    /** Null while the item has no plan; `planFailure` then says why. */
+    readonly plan: Schema.NullOr<typeof Plan.Model>;
+    readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+    readonly approval: Schema.NullOr<typeof Approval.Model>;
+    readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly failure: Schema.NullOr<Schema.String>;
+    readonly planFailure: Schema.NullOr<Schema.String>;
+}>;
+export type BatchItem = typeof BatchItem.Type;
+/** Many domains planned together, as every batch route returns them. */
+export declare const Batch: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    /** What `POST /batches/:batchId/approvals` takes; null while any item is unplanned. */
+    readonly digest: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/Digest">>;
+    readonly approval: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attachmentId: Schema.String;
+        readonly position: Schema.Number;
+        /** Null while the item has no plan; `planFailure` then says why. */
+        readonly plan: Schema.NullOr<typeof Plan.Model>;
+        readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+        readonly approval: Schema.NullOr<typeof Approval.Model>;
+        readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+        readonly rejection: Schema.NullOr<Schema.Struct<{
+            readonly actorId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly at: Schema.DateTimeUtcFromString;
+        }>>;
+        readonly failure: Schema.NullOr<Schema.String>;
+        readonly planFailure: Schema.NullOr<Schema.String>;
+    }>>;
+}>;
+export type Batch = typeof Batch.Type;
+/** A batch without its plans, as the unfinished index returns them. */
+export declare const BatchSummary: Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    readonly itemCount: Schema.Number;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+}>;
+export type BatchSummary = typeof BatchSummary.Type;
 /** `Verify.Readiness` on the wire; timestamps encode as ISO strings. */
 export declare const Readiness: Schema.Struct<{
     readonly domain: Schema.String;
@@ -370,7 +449,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -515,6 +594,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -559,7 +643,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -574,7 +658,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -719,6 +803,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -763,13 +852,43 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"approve", "POST", "/plans/:planId/approvals", Schema.toCodecStringTree<Schema.Struct<{
-    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    /** A subset of the plan's writes; omit to approve every write. */
-    readonly operationIds: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "@domainkit/OperationId">>>;
-}>>, never, Schema.toCodecJson<typeof Approval.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"applyBatch", "POST", "/batches/:batchId/apply", Schema.toCodecStringTree<Schema.Struct<{
+    batchId: Schema.brand<Schema.String, "@domainkit/BatchId">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    /** What `POST /batches/:batchId/approvals` takes; null while any item is unplanned. */
+    readonly digest: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/Digest">>;
+    readonly approval: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attachmentId: Schema.String;
+        readonly position: Schema.Number;
+        /** Null while the item has no plan; `planFailure` then says why. */
+        readonly plan: Schema.NullOr<typeof Plan.Model>;
+        readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+        readonly approval: Schema.NullOr<typeof Approval.Model>;
+        readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+        readonly rejection: Schema.NullOr<Schema.Struct<{
+            readonly actorId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly at: Schema.DateTimeUtcFromString;
+        }>>;
+        readonly failure: Schema.NullOr<Schema.String>;
+        readonly planFailure: Schema.NullOr<Schema.String>;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -783,7 +902,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -928,6 +1047,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -972,7 +1096,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -987,7 +1111,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -1132,6 +1256,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -1176,14 +1305,13 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"attach", "POST", "/connections/:connectionId/attachments", Schema.toCodecStringTree<Schema.Struct<{
-    connectionId: Schema.String;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"approve", "POST", "/plans/:planId/approvals", Schema.toCodecStringTree<Schema.Struct<{
+    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly domain: Schema.String;
-    /** Which candidate zone to attach when `SelectionRequired` came back. */
-    readonly zone: Schema.optionalKey<Schema.String>;
-}>>, never, Schema.toCodecJson<Schema.Union<readonly [typeof Connected, typeof Redirect, typeof SelectionRequired]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    /** A subset of the plan's writes; omit to approve every write. */
+    readonly operationIds: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "@domainkit/OperationId">>>;
+}>>, never, Schema.toCodecJson<typeof Approval.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -1197,7 +1325,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -1342,6 +1470,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -1386,7 +1519,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -1401,7 +1534,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -1546,6 +1679,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -1590,15 +1728,45 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"callback", "GET", "/callback/:provider", Schema.toCodecStringTree<Schema.Struct<{
-    provider: Schema.String;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-    state: Schema.String;
-    code: Schema.optionalKey<Schema.String>;
-}>>, never, never, HttpApiSchema.WithHeaders<Schema.toCodecJson<Schema.Void>, Schema.toCodecStringTree<Schema.Struct<{
-    location: Schema.String;
-}>>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"approveBatch", "POST", "/batches/:batchId/approvals", Schema.toCodecStringTree<Schema.Struct<{
+    batchId: Schema.brand<Schema.String, "@domainkit/BatchId">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly digest: Schema.brand<Schema.String, "@domainkit/Digest">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    /** What `POST /batches/:batchId/approvals` takes; null while any item is unplanned. */
+    readonly digest: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/Digest">>;
+    readonly approval: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attachmentId: Schema.String;
+        readonly position: Schema.Number;
+        /** Null while the item has no plan; `planFailure` then says why. */
+        readonly plan: Schema.NullOr<typeof Plan.Model>;
+        readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+        readonly approval: Schema.NullOr<typeof Approval.Model>;
+        readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+        readonly rejection: Schema.NullOr<Schema.Struct<{
+            readonly actorId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly at: Schema.DateTimeUtcFromString;
+        }>>;
+        readonly failure: Schema.NullOr<Schema.String>;
+        readonly planFailure: Schema.NullOr<Schema.String>;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -1612,7 +1780,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -1757,6 +1925,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -1801,7 +1974,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -1816,7 +1989,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -1961,6 +2134,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -2005,10 +2183,14 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"cleanupPlan", "POST", "/receipts/:receiptId/cleanup-plans", Schema.toCodecStringTree<Schema.Struct<{
-    receiptId: Schema.brand<Schema.String, "@domainkit/ReceiptId">;
-}>>, never, never, never, Schema.toCodecJson<typeof Plan.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"attach", "POST", "/connections/:connectionId/attachments", Schema.toCodecStringTree<Schema.Struct<{
+    connectionId: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly domain: Schema.String;
+    /** Which candidate zone to attach when `SelectionRequired` came back. */
+    readonly zone: Schema.optionalKey<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [typeof Connected, typeof Redirect, typeof SelectionRequired]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -2022,7 +2204,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -2167,6 +2349,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -2211,7 +2398,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -2226,7 +2413,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -2371,6 +2558,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -2415,12 +2607,43 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"createPlan", "POST", "/domains/:domain/plans", Schema.toCodecStringTree<Schema.Struct<{
-    domain: Schema.String;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly requirements: Schema.$Array<Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>>;
-}>>, never, Schema.toCodecJson<typeof Plan.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"batch", "GET", "/batches/:batchId", Schema.toCodecStringTree<Schema.Struct<{
+    batchId: Schema.brand<Schema.String, "@domainkit/BatchId">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    /** What `POST /batches/:batchId/approvals` takes; null while any item is unplanned. */
+    readonly digest: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/Digest">>;
+    readonly approval: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attachmentId: Schema.String;
+        readonly position: Schema.Number;
+        /** Null while the item has no plan; `planFailure` then says why. */
+        readonly plan: Schema.NullOr<typeof Plan.Model>;
+        readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+        readonly approval: Schema.NullOr<typeof Approval.Model>;
+        readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+        readonly rejection: Schema.NullOr<Schema.Struct<{
+            readonly actorId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly at: Schema.DateTimeUtcFromString;
+        }>>;
+        readonly failure: Schema.NullOr<Schema.String>;
+        readonly planFailure: Schema.NullOr<Schema.String>;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -2434,7 +2657,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -2579,6 +2802,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -2623,7 +2851,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -2638,7 +2866,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -2783,6 +3011,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -2827,10 +3060,17 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"detach", "DELETE", "/attachments/:attachmentId", Schema.toCodecStringTree<Schema.Struct<{
-    attachmentId: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.Void>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"batches", "GET", "/batches", never, Schema.toCodecStringTree<Schema.Struct<{
+    unfinished: Schema.Literal<"true">;
+}>>, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    readonly itemCount: Schema.Number;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+}>>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -2844,7 +3084,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -2989,6 +3229,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -3033,7 +3278,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -3048,7 +3293,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -3193,6 +3438,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -3237,10 +3487,15 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"disconnect", "DELETE", "/connections/:connectionId", Schema.toCodecStringTree<Schema.Struct<{
-    connectionId: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.Void>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"callback", "GET", "/callback/:provider", Schema.toCodecStringTree<Schema.Struct<{
+    provider: Schema.String;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+    state: Schema.String;
+    code: Schema.optionalKey<Schema.String>;
+}>>, never, never, HttpApiSchema.WithHeaders<Schema.toCodecJson<Schema.Void>, Schema.toCodecStringTree<Schema.Struct<{
+    location: Schema.String;
+}>>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -3254,7 +3509,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -3399,6 +3654,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -3443,7 +3703,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -3458,7 +3718,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -3603,6 +3863,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -3647,10 +3912,10 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"discover", "GET", "/domains/:domain/discovery", Schema.toCodecStringTree<Schema.Struct<{
-    domain: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.Union<readonly [typeof DiscoveryResolved, typeof DiscoverySelectionRequired, typeof DiscoveryNotFound]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"cleanupPlan", "POST", "/receipts/:receiptId/cleanup-plans", Schema.toCodecStringTree<Schema.Struct<{
+    receiptId: Schema.brand<Schema.String, "@domainkit/ReceiptId">;
+}>>, never, never, never, Schema.toCodecJson<typeof Plan.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -3664,7 +3929,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -3809,6 +4074,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -3853,7 +4123,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -3868,7 +4138,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -4013,6 +4283,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -4057,40 +4332,46 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"inspect", "GET", "/domains/:domain", Schema.toCodecStringTree<Schema.Struct<{
-    domain: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly domain: Schema.String;
-    readonly attachment: Schema.NullOr<Schema.Struct<{
-        readonly id: Schema.String;
-        readonly label: Schema.String;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"createBatch", "POST", "/batches", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly domain: Schema.String;
+        readonly requirements: Schema.$Array<Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>>;
     }>>;
-    readonly connectionId: Schema.NullOr<Schema.String>;
-    readonly provider: Schema.NullOr<Schema.String>;
-    readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
-    readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
-    readonly lastReceiptId: Schema.NullOr<Schema.String>;
-    /** How many domains the connection serves, including this one; `0` without a connection. */
-    readonly connectionDomains: Schema.Number;
-    readonly reusable: Schema.$Array<Schema.Struct<{
-        readonly connectionId: Schema.String;
-        readonly provider: Schema.String;
-        readonly method: Schema.Literals<readonly ["token", "oauth", "integration"]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+    "idempotency-key": Schema.String;
+}>>, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    /** What `POST /batches/:batchId/approvals` takes; null while any item is unplanned. */
+    readonly digest: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/Digest">>;
+    readonly approval: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly at: Schema.DateTimeUtcFromString;
     }>>;
-    readonly providers: Schema.$Array<Schema.Struct<{
-        readonly id: Schema.String;
-        readonly name: Schema.String;
-        readonly methods: Schema.$Array<Schema.Struct<{
-            readonly kind: Schema.Literals<readonly ["token", "oauth", "integration"]>;
-            readonly label: Schema.String;
-            readonly docsUrl: Schema.NullOr<Schema.String>;
-            readonly fields: Schema.NullOr<Schema.$Array<Schema.Struct<{
-                readonly name: Schema.String;
-                readonly required: Schema.Boolean;
-                readonly secret: Schema.Boolean;
-            }>>>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attachmentId: Schema.String;
+        readonly position: Schema.Number;
+        /** Null while the item has no plan; `planFailure` then says why. */
+        readonly plan: Schema.NullOr<typeof Plan.Model>;
+        readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+        readonly approval: Schema.NullOr<typeof Approval.Model>;
+        readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+        readonly rejection: Schema.NullOr<Schema.Struct<{
+            readonly actorId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly at: Schema.DateTimeUtcFromString;
         }>>;
+        readonly failure: Schema.NullOr<Schema.String>;
+        readonly planFailure: Schema.NullOr<Schema.String>;
     }>>;
 }>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
@@ -4106,7 +4387,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -4251,6 +4532,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -4295,7 +4581,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -4310,7 +4596,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -4455,6 +4741,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -4499,28 +4790,12 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"observe", "POST", "/domains/:domain/observations", Schema.toCodecStringTree<Schema.Struct<{
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"createPlan", "POST", "/domains/:domain/plans", Schema.toCodecStringTree<Schema.Struct<{
     domain: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
-    /** Records to observe instead of the attachment's receipt; required for an unattached domain. */
-    readonly requirements: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>>>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly domain: Schema.String;
-    readonly attachmentId: Schema.NullOr<Schema.String>;
-    readonly overall: Schema.Literals<readonly ["ready", "pending", "failed"]>;
-    readonly requirements: Schema.$Array<Schema.Struct<{
-        /** `Verify.requirementKey(record)`, so a client pairs rows by content, not by position. */
-        readonly key: Schema.String;
-        readonly operationId: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/OperationId">>;
-        readonly record: Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>;
-        readonly status: Schema.Literals<readonly ["satisfied", "missing", "mismatch", "unknown"]>;
-        readonly evidence: Schema.$Array<Schema.Union<readonly [typeof Verify.ProviderEvidence, typeof Verify.PublicDnsEvidence, typeof Verify.HostEvidence]>>;
-    }>>;
-    readonly host: Schema.$Array<typeof Verify.HostEvidence>;
-    readonly checkedAt: Schema.DateTimeUtcFromString;
-    readonly nextCheckAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
-}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly requirements: Schema.$Array<Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>>;
+}>>, never, Schema.toCodecJson<typeof Plan.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -4534,7 +4809,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -4679,6 +4954,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -4723,7 +5003,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -4738,7 +5018,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -4883,6 +5163,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -4927,20 +5212,10 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"plan", "GET", "/plans/:planId", Schema.toCodecStringTree<Schema.Struct<{
-    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
-}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly plan: typeof Plan.Model;
-    readonly status: Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>;
-    readonly approval: Schema.NullOr<typeof Approval.Model>;
-    readonly receipt: Schema.NullOr<typeof Receipt.Model>;
-    readonly rejection: Schema.NullOr<Schema.Struct<{
-        readonly actorId: Schema.String;
-        readonly reason: Schema.NullOr<Schema.String>;
-        readonly at: Schema.DateTimeUtcFromString;
-    }>>;
-}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"detach", "DELETE", "/attachments/:attachmentId", Schema.toCodecStringTree<Schema.Struct<{
+    attachmentId: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.Void>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -4954,7 +5229,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -5099,6 +5374,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -5143,7 +5423,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -5158,7 +5438,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -5303,6 +5583,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -5347,25 +5632,10 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"readiness", "GET", "/domains/:domain/readiness", Schema.toCodecStringTree<Schema.Struct<{
-    domain: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.NullOr<Schema.Struct<{
-    readonly domain: Schema.String;
-    readonly attachmentId: Schema.NullOr<Schema.String>;
-    readonly overall: Schema.Literals<readonly ["ready", "pending", "failed"]>;
-    readonly requirements: Schema.$Array<Schema.Struct<{
-        /** `Verify.requirementKey(record)`, so a client pairs rows by content, not by position. */
-        readonly key: Schema.String;
-        readonly operationId: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/OperationId">>;
-        readonly record: Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>;
-        readonly status: Schema.Literals<readonly ["satisfied", "missing", "mismatch", "unknown"]>;
-        readonly evidence: Schema.$Array<Schema.Union<readonly [typeof Verify.ProviderEvidence, typeof Verify.PublicDnsEvidence, typeof Verify.HostEvidence]>>;
-    }>>;
-    readonly host: Schema.$Array<typeof Verify.HostEvidence>;
-    readonly checkedAt: Schema.DateTimeUtcFromString;
-    readonly nextCheckAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
-}>>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"disconnect", "DELETE", "/connections/:connectionId", Schema.toCodecStringTree<Schema.Struct<{
+    connectionId: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.Void>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -5379,7 +5649,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -5524,6 +5794,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -5568,7 +5843,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -5583,7 +5858,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -5728,6 +6003,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -5772,10 +6052,10 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"receipt", "GET", "/receipts/:receiptId", Schema.toCodecStringTree<Schema.Struct<{
-    receiptId: Schema.brand<Schema.String, "@domainkit/ReceiptId">;
-}>>, never, never, never, Schema.toCodecJson<typeof Receipt.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"discover", "GET", "/domains/:domain/discovery", Schema.toCodecStringTree<Schema.Struct<{
+    domain: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.Union<readonly [typeof DiscoveryResolved, typeof DiscoverySelectionRequired, typeof DiscoveryNotFound]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -5789,7 +6069,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -5934,6 +6214,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -5978,7 +6263,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -5993,7 +6278,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -6138,6 +6423,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -6182,12 +6472,3078 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"reconnect", "POST", "/connections/:connectionId/reconnections", Schema.toCodecStringTree<Schema.Struct<{
-    connectionId: Schema.String;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"inspect", "GET", "/domains/:domain", Schema.toCodecStringTree<Schema.Struct<{
+    domain: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly domain: Schema.String;
+    readonly attachment: Schema.NullOr<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly label: Schema.String;
+    }>>;
+    readonly connectionId: Schema.NullOr<Schema.String>;
+    readonly provider: Schema.NullOr<Schema.String>;
+    readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
+    readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
+    readonly lastReceiptId: Schema.NullOr<Schema.String>;
+    /** How many domains the connection serves, including this one; `0` without a connection. */
+    readonly connectionDomains: Schema.Number;
+    readonly reusable: Schema.$Array<Schema.Struct<{
+        readonly connectionId: Schema.String;
+        readonly provider: Schema.String;
+        readonly method: Schema.Literals<readonly ["token", "oauth", "integration"]>;
+    }>>;
+    readonly providers: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly methods: Schema.$Array<Schema.Struct<{
+            readonly kind: Schema.Literals<readonly ["token", "oauth", "integration"]>;
+            readonly label: Schema.String;
+            readonly docsUrl: Schema.NullOr<Schema.String>;
+            readonly fields: Schema.NullOr<Schema.$Array<Schema.Struct<{
+                readonly name: Schema.String;
+                readonly required: Schema.Boolean;
+                readonly secret: Schema.Boolean;
+            }>>>;
+        }>>;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"observe", "POST", "/domains/:domain/observations", Schema.toCodecStringTree<Schema.Struct<{
+    domain: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    /** Records to observe instead of the attachment's receipt; required for an unattached domain. */
+    readonly requirements: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>>>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly domain: Schema.String;
+    readonly attachmentId: Schema.NullOr<Schema.String>;
+    readonly overall: Schema.Literals<readonly ["ready", "pending", "failed"]>;
+    readonly requirements: Schema.$Array<Schema.Struct<{
+        /** `Verify.requirementKey(record)`, so a client pairs rows by content, not by position. */
+        readonly key: Schema.String;
+        readonly operationId: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/OperationId">>;
+        readonly record: Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>;
+        readonly status: Schema.Literals<readonly ["satisfied", "missing", "mismatch", "unknown"]>;
+        readonly evidence: Schema.$Array<Schema.Union<readonly [typeof Verify.ProviderEvidence, typeof Verify.PublicDnsEvidence, typeof Verify.HostEvidence]>>;
+    }>>;
+    readonly host: Schema.$Array<typeof Verify.HostEvidence>;
+    readonly checkedAt: Schema.DateTimeUtcFromString;
+    readonly nextCheckAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"plan", "GET", "/plans/:planId", Schema.toCodecStringTree<Schema.Struct<{
+    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly plan: typeof Plan.Model;
+    readonly status: Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>;
+    readonly approval: Schema.NullOr<typeof Approval.Model>;
+    readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"planBatch", "POST", "/batches/:batchId/plans", Schema.toCodecStringTree<Schema.Struct<{
+    batchId: Schema.brand<Schema.String, "@domainkit/BatchId">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly domain: Schema.String;
+        readonly requirements: Schema.$Array<Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>>;
+    }>>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    /** What `POST /batches/:batchId/approvals` takes; null while any item is unplanned. */
+    readonly digest: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/Digest">>;
+    readonly approval: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attachmentId: Schema.String;
+        readonly position: Schema.Number;
+        /** Null while the item has no plan; `planFailure` then says why. */
+        readonly plan: Schema.NullOr<typeof Plan.Model>;
+        readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+        readonly approval: Schema.NullOr<typeof Approval.Model>;
+        readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+        readonly rejection: Schema.NullOr<Schema.Struct<{
+            readonly actorId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly at: Schema.DateTimeUtcFromString;
+        }>>;
+        readonly failure: Schema.NullOr<Schema.String>;
+        readonly planFailure: Schema.NullOr<Schema.String>;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"readiness", "GET", "/domains/:domain/readiness", Schema.toCodecStringTree<Schema.Struct<{
+    domain: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.NullOr<Schema.Struct<{
+    readonly domain: Schema.String;
+    readonly attachmentId: Schema.NullOr<Schema.String>;
+    readonly overall: Schema.Literals<readonly ["ready", "pending", "failed"]>;
+    readonly requirements: Schema.$Array<Schema.Struct<{
+        /** `Verify.requirementKey(record)`, so a client pairs rows by content, not by position. */
+        readonly key: Schema.String;
+        readonly operationId: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/OperationId">>;
+        readonly record: Schema.Union<readonly [typeof DnsRecord.A, typeof DnsRecord.AAAA, typeof DnsRecord.CNAME, typeof DnsRecord.TXT, typeof DnsRecord.MX, typeof DnsRecord.CAA, typeof DnsRecord.NS, typeof DnsRecord.SRV]>;
+        readonly status: Schema.Literals<readonly ["satisfied", "missing", "mismatch", "unknown"]>;
+        readonly evidence: Schema.$Array<Schema.Union<readonly [typeof Verify.ProviderEvidence, typeof Verify.PublicDnsEvidence, typeof Verify.HostEvidence]>>;
+    }>>;
+    readonly host: Schema.$Array<typeof Verify.HostEvidence>;
+    readonly checkedAt: Schema.DateTimeUtcFromString;
+    readonly nextCheckAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+}>>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"receipt", "GET", "/receipts/:receiptId", Schema.toCodecStringTree<Schema.Struct<{
+    receiptId: Schema.brand<Schema.String, "@domainkit/ReceiptId">;
+}>>, never, never, never, Schema.toCodecJson<typeof Receipt.Model>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"reconnect", "POST", "/connections/:connectionId/reconnections", Schema.toCodecStringTree<Schema.Struct<{
+    connectionId: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [typeof Connected, typeof Redirect, typeof SelectionRequired]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string;
+        readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}, readonly [Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>], {
+    readonly _tag: "DomainKitError";
+    readonly reason: {
+        readonly _tag: "InvalidInput";
+        readonly message: string;
+        readonly field?: string;
+    } | {
+        readonly _tag: "Unauthenticated";
+        readonly message: string;
+    } | {
+        readonly _tag: "Forbidden";
+        readonly message: string;
+    } | {
+        readonly _tag: "NotFound";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly id: string;
+    } | {
+        readonly _tag: "Conflict";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly operations: readonly {
+            readonly _tag: "Conflict";
+            readonly id: string & import("effect/Brand").Brand<"@domainkit/OperationId">;
+            readonly record: {
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            };
+            readonly existing: readonly ({
+                readonly _tag: "A";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "AAAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly address: string;
+            } | {
+                readonly _tag: "CNAME";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "TXT";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "MX";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly exchange: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly priority: number;
+            } | {
+                readonly _tag: "CAA";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly flags: number;
+                readonly tag: string;
+                readonly value: string;
+            } | {
+                readonly _tag: "NS";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly nameserver: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+            } | {
+                readonly _tag: "SRV";
+                readonly name: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly ttl: number | null;
+                readonly policy: "append" | "exclusive";
+                readonly purpose?: string;
+                readonly target: string & import("effect/Brand").Brand<"@domainkit/DomainName">;
+                readonly port: number;
+                readonly priority: number;
+                readonly weight: number;
+            } | {
+                readonly _tag: "Opaque";
+                readonly name: string;
+                readonly type: string;
+                readonly raw: unknown;
+            })[];
+            readonly reason: "cname-collision" | "exclusive-name" | "missing" | "opaque" | "value-mismatch";
+        }[];
+    } | {
+        readonly _tag: "Stale";
+        readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
+        readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
+    } | {
+        readonly _tag: "Expired";
+        readonly entity: "approval" | "continuation" | "credential" | "plan";
+        readonly id: string;
+    } | {
+        readonly _tag: "Busy";
+        readonly key: string;
+    } | {
+        readonly _tag: "ProviderRejected";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderUnavailable";
+        readonly provider: string;
+        readonly retryAfterMs?: number;
+        readonly message: string;
+    } | {
+        readonly _tag: "ProviderConflict";
+        readonly provider: string;
+        readonly code?: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Unsupported";
+        readonly provider: string;
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "Reconnect";
+        readonly provider: string;
+        readonly connectionId: string;
+    } | {
+        readonly _tag: "StorageFailed";
+        readonly operation: string;
+        readonly message: string;
+    } | {
+        readonly _tag: "CryptoFailed";
+        readonly operation: "digest" | "open" | "seal";
+    } | {
+        readonly _tag: "ResolverFailed";
+        readonly resolver: string;
+        readonly message: string;
+    };
+}>, Schema.TaggedStruct<"DomainKitError", {
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"reject", "POST", "/plans/:planId/rejections", Schema.toCodecStringTree<Schema.Struct<{
+    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly method: Schema.Union<readonly [typeof Token, typeof OAuth, typeof Integration]>;
-}>>, never, Schema.toCodecJson<Schema.Union<readonly [typeof Connected, typeof Redirect, typeof SelectionRequired]>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
+    /** Why the customer declined, for the audit trail. */
+    readonly reason: Schema.optionalKey<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly plan: typeof Plan.Model;
+    readonly status: Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>;
+    readonly approval: Schema.NullOr<typeof Approval.Model>;
+    readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+    readonly rejection: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly reason: Schema.NullOr<Schema.String>;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
+}>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
         readonly _tag: "InvalidInput";
@@ -6201,7 +9557,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -6346,6 +9702,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -6390,7 +9751,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -6405,7 +9766,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -6550,6 +9911,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -6594,22 +9960,45 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
-}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"reject", "POST", "/plans/:planId/rejections", Schema.toCodecStringTree<Schema.Struct<{
-    planId: Schema.brand<Schema.String, "@domainkit/PlanId">;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+}>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"rejectBatch", "POST", "/batches/:batchId/rejections", Schema.toCodecStringTree<Schema.Struct<{
+    batchId: Schema.brand<Schema.String, "@domainkit/BatchId">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     /** Why the customer declined, for the audit trail. */
     readonly reason: Schema.optionalKey<Schema.String>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly plan: typeof Plan.Model;
-    readonly status: Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>;
-    readonly approval: Schema.NullOr<typeof Approval.Model>;
-    readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+    readonly id: Schema.brand<Schema.String, "@domainkit/BatchId">;
+    readonly status: Schema.Literals<readonly ["planning", "planned", "approved", "applying", "complete", "partial", "failed", "rejected"]>;
+    /** What `POST /batches/:batchId/approvals` takes; null while any item is unplanned. */
+    readonly digest: Schema.NullOr<Schema.brand<Schema.String, "@domainkit/Digest">>;
+    readonly approval: Schema.NullOr<Schema.Struct<{
+        readonly actorId: Schema.String;
+        readonly at: Schema.DateTimeUtcFromString;
+    }>>;
     readonly rejection: Schema.NullOr<Schema.Struct<{
         readonly actorId: Schema.String;
         readonly reason: Schema.NullOr<Schema.String>;
         readonly at: Schema.DateTimeUtcFromString;
     }>>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly updatedAt: Schema.DateTimeUtcFromString;
+    readonly completedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attachmentId: Schema.String;
+        readonly position: Schema.Number;
+        /** Null while the item has no plan; `planFailure` then says why. */
+        readonly plan: Schema.NullOr<typeof Plan.Model>;
+        readonly status: Schema.NullOr<Schema.Literals<readonly ["planned", "approved", "applying", "complete", "partial", "failed", "expired", "rejected"]>>;
+        readonly approval: Schema.NullOr<typeof Approval.Model>;
+        readonly receipt: Schema.NullOr<typeof Receipt.Model>;
+        readonly rejection: Schema.NullOr<Schema.Struct<{
+            readonly actorId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly at: Schema.DateTimeUtcFromString;
+        }>>;
+        readonly failure: Schema.NullOr<Schema.String>;
+        readonly planFailure: Schema.NullOr<Schema.String>;
+    }>>;
 }>>, Schema.toCodecJson<Schema.decodeTo<Schema.declareConstructor<Errors.DomainKitError, {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -6624,7 +10013,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -6769,6 +10158,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -6813,7 +10207,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -6828,7 +10222,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -6973,6 +10367,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -7017,7 +10416,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/connections", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly domain: Schema.optionalKey<Schema.String>;
     readonly provider: Schema.String;
@@ -7036,7 +10435,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -7181,6 +10580,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -7225,7 +10629,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -7240,7 +10644,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -7385,6 +10789,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -7429,7 +10838,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>, never, never>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"zones", "GET", "/zones", never, Schema.toCodecStringTree<Schema.Struct<{
     provider: Schema.optionalKey<Schema.String>;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -7443,6 +10852,8 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
     readonly connections: Schema.$Array<Schema.Struct<{
         readonly connectionId: Schema.String;
         readonly provider: Schema.String;
+        /** What the provider called the account at connect time; `null` when it named none. */
+        readonly label: Schema.NullOr<Schema.String>;
         readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
     }>>;
     /** Every provider a customer could connect, so a picker offers one without a second call. */
@@ -7474,7 +10885,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -7619,6 +11030,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string;
         readonly digest: string;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -7663,7 +11079,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }, readonly [Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>], {
     readonly _tag: "DomainKitError";
     readonly reason: {
@@ -7678,7 +11094,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     } | {
         readonly _tag: "NotFound";
-        readonly entity: "approval" | "attachment" | "authorization" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
+        readonly entity: "approval" | "attachment" | "authorization" | "batch" | "connection" | "continuation" | "plan" | "provider" | "receipt" | "record" | "zone";
         readonly id: string;
     } | {
         readonly _tag: "Conflict";
@@ -7823,6 +11239,11 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly _tag: "Stale";
         readonly planId: string & import("effect/Brand").Brand<"@domainkit/PlanId">;
         readonly digest: string & import("effect/Brand").Brand<"@domainkit/Digest">;
+    } | {
+        readonly _tag: "BatchStale";
+        readonly batchId: string;
+        readonly status: string;
+        readonly digest: string | null;
     } | {
         readonly _tag: "Expired";
         readonly entity: "approval" | "continuation" | "credential" | "plan";
@@ -7867,7 +11288,7 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
         readonly message: string;
     };
 }>, Schema.TaggedStruct<"DomainKitError", {
-    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
+    readonly reason: Schema.suspend<Schema.Union<readonly [typeof Reason.InvalidInput, typeof Reason.Unauthenticated, typeof Reason.Forbidden, typeof Reason.NotFound, typeof Reason.Conflict, typeof Reason.Stale, typeof Reason.BatchStale, typeof Reason.Expired, typeof Reason.Busy, typeof Reason.ProviderRejected, typeof Reason.ProviderUnavailable, typeof Reason.ProviderConflict, typeof Reason.Unsupported, typeof Reason.Reconnect, typeof Reason.StorageFailed, typeof Reason.CryptoFailed, typeof Reason.ResolverFailed]>>;
 }>, never, never>>, never, never>, false>;
 export type Group = typeof group;
 /** Every route in the group, by name; what `Identity.authorize` is asked about. */