domainkit 0.2.2 → 0.3.0

package/dist/auth-BR-19zj-.mjs

@@ -1,738 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { E as decode$2, c as Opaque, h as decode$3, y as Error } from "./dns-record-BLeqo56C.mjs";
-import { f as Value, g as Method, h as Error$1, p as make$1, r as Evidence, u as codec } from "./authorization-OeaSR47S.mjs";
-import { t as candidates } from "./zones-DKHTpX9C.mjs";
-import { Clock, Crypto, Effect, Schema } from "effect";
-import * as oauth from "oauth4webapi";
-//#region src/auth/authorization-code.ts
-const start = Effect.fn("AuthorizationCode.start")(function* (input) {
-	const crypto = yield* Crypto.Crypto;
-	const codeVerifier = base64Url(yield* randomBytes(crypto, 32));
-	const challenge = base64Url(yield* digest(crypto, codeVerifier));
-	const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);
-	authorizationUrl.search = new URLSearchParams({
-		client_id: input.client.clientId,
-		code_challenge: challenge,
-		code_challenge_method: "S256",
-		redirect_uri: input.redirectUri,
-		response_type: "code",
-		scope: input.method.scopes.join(" "),
-		state: input.state
-	}).toString();
-	return {
-		authorizationUrl,
-		payload: make$1(JSON.stringify({
-			codeVerifier,
-			redirectUri: input.redirectUri,
-			state: input.state
-		}))
-	};
-});
-const complete = Effect.fn("AuthorizationCode.complete")(function* (input) {
-	const payload = yield* decodePayload(input.payload);
-	if (input.callbackUrl.searchParams.get("state") !== payload.state) return yield* failure$2("Authorization callback state does not match its continuation");
-	const server = input.method.authorizationServer;
-	const client = { client_id: input.client.clientId };
-	const authentication = yield* clientAuthentication(input.method, input.client);
-	return yield* Effect.tryPromise({
-		try: async (signal) => {
-			const callback = oauth.validateAuthResponse(server, client, input.callbackUrl, payload.state);
-			const response = await oauth.authorizationCodeGrantRequest(server, client, authentication, callback, payload.redirectUri, payload.codeVerifier, requestOptions(input.fetch, signal));
-			return oauth.processAuthorizationCodeResponse(server, client, response);
-		},
-		catch: (cause) => new Error$1({
-			category: "provider",
-			message: cause instanceof globalThis.Error ? cause.name : "OAuth provider request failed",
-			operation: "AuthorizationCode.complete",
-			retry: "unknown"
-		})
-	});
-});
-const PayloadSchema = Schema.Struct({
-	codeVerifier: Schema.String,
-	redirectUri: Schema.String,
-	state: Schema.String
-});
-function decodePayload(payload) {
-	return Schema.decodeUnknownEffect(Schema.fromJsonString(PayloadSchema))(payload.expose()).pipe(Effect.mapError(() => new Error$1({
-		category: "authorization",
-		message: "OAuth continuation payload is invalid",
-		operation: "AuthorizationCode",
-		retry: "after-user-action"
-	})));
-}
-function clientAuthentication(method, client) {
-	switch (method.clientAuth) {
-		case "none": return Effect.succeed(oauth.None());
-		case "client_secret_basic": return client.clientSecret === void 0 ? failure$2("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));
-		case "client_secret_post": return client.clientSecret === void 0 ? failure$2("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretPost(client.clientSecret.expose()));
-	}
-}
-function requestOptions(fetchImplementation, signal) {
-	return fetchImplementation === void 0 ? { signal } : {
-		signal,
-		[oauth.customFetch]: (url, options) => fetchImplementation(url, {
-			...options,
-			body: options.body
-		})
-	};
-}
-const failure$2 = (message) => Effect.fail(new Error$1({
-	category: "authorization",
-	message,
-	operation: "AuthorizationCode",
-	retry: "after-user-action"
-}));
-function randomBytes(crypto, size) {
-	return crypto.randomBytes(size).pipe(Effect.mapError((cause) => new Error$1({
-		category: "validation",
-		message: cause.message,
-		operation: "AuthorizationCode.start",
-		retry: "safe"
-	})));
-}
-function digest(crypto, value) {
-	return crypto.digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new Error$1({
-		category: "validation",
-		message: cause.message,
-		operation: "AuthorizationCode.start",
-		retry: "safe"
-	})));
-}
-function base64Url(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-//#endregion
-//#region src/providers/cloudflare/protocol.ts
-const ErrorDetail = Schema.Struct({
-	code: Schema.Number,
-	message: Schema.String
-});
-const ResultInfo = Schema.Struct({
-	count: Schema.optionalKey(Schema.Number),
-	page: Schema.optionalKey(Schema.Number),
-	per_page: Schema.optionalKey(Schema.Number),
-	total_count: Schema.optionalKey(Schema.Number),
-	total_pages: Schema.optionalKey(Schema.Number)
-});
-const Message = Schema.Struct({
-	code: Schema.optionalKey(Schema.Number),
-	message: Schema.String
-});
-const BaseEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail),
-	messages: Schema.Array(Message),
-	success: Schema.Boolean
-});
-const Account = Schema.Struct({
-	id: Schema.String,
-	name: Schema.String
-});
-const Zone = Schema.Struct({
-	account: Account,
-	id: Schema.String,
-	name: Schema.String,
-	name_servers: Schema.Array(Schema.String),
-	status: Schema.optionalKey(Schema.String)
-});
-const Record = Schema.Struct({
-	content: Schema.optionalKey(Schema.String),
-	data: Schema.optionalKey(Schema.Unknown),
-	id: Schema.String,
-	name: Schema.String,
-	priority: Schema.optionalKey(Schema.Number),
-	proxied: Schema.optionalKey(Schema.Boolean),
-	ttl: Schema.Number,
-	type: Schema.String
-});
-const Token = Schema.Struct({
-	expires_on: Schema.optionalKey(Schema.String),
-	id: Schema.String,
-	not_before: Schema.optionalKey(Schema.String),
-	status: Schema.Literals([
-		"active",
-		"disabled",
-		"expired"
-	])
-});
-const ZoneListEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail),
-	messages: Schema.Array(Message),
-	result: Schema.Array(Zone),
-	result_info: Schema.optionalKey(ResultInfo),
-	success: Schema.Boolean
-});
-const RecordListEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail),
-	messages: Schema.Array(Message),
-	result: Schema.Array(Record),
-	result_info: Schema.optionalKey(ResultInfo),
-	success: Schema.Boolean
-});
-const RecordEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail),
-	messages: Schema.Array(Message),
-	result: Record,
-	success: Schema.Boolean
-});
-const TokenEnvelope = Schema.Struct({
-	errors: Schema.Array(ErrorDetail),
-	messages: Schema.Array(Message),
-	result: Token,
-	success: Schema.Boolean
-});
-//#endregion
-//#region src/providers/cloudflare/records.ts
-const Data$1 = Schema.Struct({
-	flags: Schema.optionalKey(Schema.Number),
-	port: Schema.optionalKey(Schema.Number),
-	priority: Schema.optionalKey(Schema.Number),
-	tag: Schema.optionalKey(Schema.String),
-	target: Schema.optionalKey(Schema.String),
-	value: Schema.optionalKey(Schema.String),
-	weight: Schema.optionalKey(Schema.Number)
-});
-const decode$1 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(function* () {
-	const name = yield* decode$2(record.name).pipe(Effect.match({
-		onFailure: () => null,
-		onSuccess: (value) => value
-	}));
-	if (name === null) return yield* decodeOpaque(record);
-	const common = {
-		metadata: {
-			ownership: "provider",
-			provenance: record.proxied === true ? "cloudflare:proxied" : "cloudflare",
-			purpose: "existing DNS record"
-		},
-		name,
-		policy: record.type === "CNAME" ? "exclusive" : "append",
-		ttl: record.ttl === 1 ? null : record.ttl
-	};
-	const content = () => record.content === void 0 ? Effect.fail(failure$1("decodeRecord", `Cloudflare ${record.type} record has no content`)) : Effect.succeed(record.content);
-	switch (record.type) {
-		case "A":
-		case "AAAA": return yield* decode$3({
-			...common,
-			_tag: record.type,
-			address: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message)));
-		case "CNAME":
-		case "NS": return yield* decode$3({
-			...common,
-			_tag: record.type,
-			target: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message)));
-		case "TXT": return yield* decode$3({
-			...common,
-			_tag: "TXT",
-			value: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message)));
-		case "MX": return yield* decode$3({
-			...common,
-			_tag: "MX",
-			exchange: yield* content(),
-			priority: record.priority
-		}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message)));
-		case "CAA": {
-			const data = yield* decodeData(record);
-			return yield* decode$3({
-				...common,
-				_tag: "CAA",
-				...data
-			}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message)));
-		}
-		case "SRV": {
-			const data = yield* decodeData(record);
-			return yield* decode$3({
-				...common,
-				_tag: "SRV",
-				...data
-			}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message)));
-		}
-		default: return yield* decodeOpaque(record);
-	}
-}));
-const decodeOpaque = Effect.fn("CloudflareRecords.decodeOpaque")((record) => Schema.decodeUnknownEffect(Opaque)({
-	_tag: "Opaque",
-	name: record.name,
-	providerRecordId: record.id,
-	providerType: record.type
-}).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message))));
-function encode(record) {
-	const common = {
-		name: record.name,
-		proxied: false,
-		ttl: record.ttl ?? 1,
-		type: record._tag
-	};
-	switch (record._tag) {
-		case "A":
-		case "AAAA": return {
-			...common,
-			content: record.address
-		};
-		case "CNAME":
-		case "NS": return {
-			...common,
-			content: record.target
-		};
-		case "TXT": return {
-			...common,
-			content: record.value
-		};
-		case "MX": return {
-			...common,
-			content: record.exchange,
-			priority: record.priority
-		};
-		case "CAA": return {
-			...common,
-			data: {
-				flags: record.flags,
-				tag: record.tag,
-				value: record.value
-			}
-		};
-		case "SRV": return {
-			...common,
-			data: {
-				port: record.port,
-				priority: record.priority,
-				target: record.target,
-				weight: record.weight
-			}
-		};
-	}
-}
-const decodeData = Effect.fn("CloudflareRecords.decodeData")((record) => Schema.decodeUnknownEffect(Data$1)(record.data).pipe(Effect.mapError((cause) => failure$1("decodeRecord", cause.message))));
-function failure$1(operation, message, fields = {}) {
-	return new Error({
-		message,
-		operation,
-		providerId: "cloudflare",
-		reason: fields.reason ?? "response"
-	});
-}
-//#endregion
-//#region src/providers/cloudflare/client.ts
-var client_exports = /* @__PURE__ */ __exportAll({
-	discoverAuthorizationAccount: () => discoverAuthorizationAccount,
-	discovery: () => discovery,
-	make: () => make,
-	validateDomainToken: () => validateDomainToken
-});
-/** Exposes Cloudflare zone lookup as the optional provider discovery capability. */
-function discovery(client) {
-	return {
-		listZones: (name) => client.listZones({ name }).pipe(Effect.map((zones) => zones.map((zone) => ({
-			...zone,
-			status: zone.status === "active" || zone.status === "pending" ? zone.status : "unknown"
-		})))),
-		provider: client
-	};
-}
-const makeTransport = (options) => {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "");
-	const request = Effect.fn("CloudflareClient.request")((path, operation, init) => Effect.gen(function* () {
-		const response = yield* Effect.tryPromise({
-			try: () => fetch(`${baseUrl}${path}`, {
-				...init,
-				headers: {
-					Accept: "application/json",
-					Authorization: `Bearer ${options.token.expose()}`,
-					...init?.body === void 0 ? {} : { "Content-Type": "application/json" },
-					...init?.headers
-				}
-			}),
-			catch: () => failure(operation, "Cloudflare request failed", { reason: "transport" })
-		});
-		return {
-			body: yield* Effect.tryPromise({
-				try: () => response.json(),
-				catch: () => {
-					const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-					return failure(operation, response.ok ? "Cloudflare returned a non-JSON response" : `Cloudflare request failed with HTTP ${response.status}`, {
-						reason: response.ok ? "response" : reason(response.status),
-						...retryAfterMs === void 0 ? {} : { retryAfterMs },
-						status: response.status
-					});
-				}
-			}),
-			response
-		};
-	}));
-	const listZonesPage = Effect.fn("CloudflareClient.listZonesPage")((accountId, name, page) => Effect.gen(function* () {
-		const query = new URLSearchParams({
-			page: String(page),
-			per_page: "50"
-		});
-		query.set("type", "full,partial,secondary,internal");
-		if (accountId !== void 0) query.set("account.id", accountId);
-		if (name !== void 0) query.set("name", name);
-		const { body, response } = yield* request(`/zones?${query}`, "listZones");
-		yield* ensureSuccess(body, "listZones", response);
-		return yield* decode(ZoneListEnvelope, body, "listZones", response);
-	}));
-	return {
-		allZones: Effect.fn("CloudflareClient.allZones")((accountId, name) => Effect.gen(function* () {
-			const zones = [];
-			let page = 1;
-			while (true) {
-				const envelope = yield* listZonesPage(accountId, name, page);
-				zones.push(...envelope.result);
-				const totalPages = envelope.result_info?.total_pages;
-				if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 50) return zones;
-				page += 1;
-			}
-		})),
-		inspectToken: Effect.fn("CloudflareClient.inspectToken")((path) => Effect.gen(function* () {
-			const { body, response } = yield* request(path, "validateToken");
-			yield* ensureSuccess(body, "validateToken", response);
-			const envelope = yield* decode(TokenEnvelope, body, "validateToken", response);
-			if (envelope.result.status !== "active") return yield* Effect.fail(failure("validateToken", `Cloudflare token is ${envelope.result.status}`, {
-				reason: "authentication",
-				status: response.status
-			}));
-			const expiresAt = envelope.result.expires_on === void 0 ? null : new Date(envelope.result.expires_on);
-			if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) return yield* Effect.fail(failure("validateToken", "Cloudflare token expiry is not a valid timestamp", {
-				reason: "response",
-				status: response.status
-			}));
-			return expiresAt;
-		})),
-		request
-	};
-};
-const discoverAccount = Effect.fn("CloudflareClient.discoverAccount")((options) => Effect.gen(function* () {
-	const { allZones } = makeTransport(options);
-	for (const candidate of candidates(options.domain)) {
-		const matches = yield* allZones(void 0, candidate);
-		const match = matches[0];
-		if (matches.length === 0) continue;
-		if (matches.length === 1 && match !== void 0) return match.account;
-		return yield* Effect.fail(failure("discoverAccount", `Cloudflare returned multiple accessible zones named ${candidate}`, { reason: "conflict" }));
-	}
-	return yield* Effect.fail(failure("discoverAccount", `Cloudflare did not expose an accessible zone for ${options.domain}`, { reason: "not_found" }));
-}));
-const discoverAuthorizationAccount = discoverAccount;
-const validateDomainToken = Effect.fn("CloudflareClient.validateDomainToken")((options) => Effect.gen(function* () {
-	const transport = makeTransport(options);
-	const account = options.tokenKind === "account" ? yield* discoverAccount(options) : void 0;
-	const expiresAt = yield* transport.inspectToken(account === void 0 ? "/user/tokens/verify" : `/accounts/${encodeURIComponent(account.id)}/tokens/verify`);
-	return {
-		accountId: (account ?? (yield* discoverAccount(options))).id,
-		capabilities: options.capabilities,
-		expiresAt,
-		scopes: []
-	};
-}));
-/** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
-function make(options) {
-	const { allZones, inspectToken, request } = makeTransport(options);
-	const resolveZone = Effect.fn("CloudflareClient.resolveZone")((name) => Effect.gen(function* () {
-		const matches = yield* allZones(options.accountId, name);
-		const match = matches[0];
-		if (matches.length === 1 && match !== void 0) return match;
-		return yield* Effect.fail(failure("resolveZone", matches.length === 0 ? `Cloudflare zone ${name} was not found in account ${options.accountId}` : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`, { reason: matches.length === 0 ? "not_found" : "response" }));
-	}));
-	const listRecords = Effect.fn("CloudflareClient.listRecords")((zoneName) => Effect.gen(function* () {
-		const zone = yield* resolveZone(zoneName);
-		const records = [];
-		let page = 1;
-		while (true) {
-			const query = new URLSearchParams({
-				page: String(page),
-				per_page: "100"
-			});
-			const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records?${query}`, "listRecords");
-			yield* ensureSuccess(body, "listRecords", response);
-			const envelope = yield* decode(RecordListEnvelope, body, "listRecords", response);
-			records.push(...yield* Effect.forEach(envelope.result, decode$1));
-			const totalPages = envelope.result_info?.total_pages;
-			if (totalPages !== void 0 && page >= totalPages || totalPages === void 0 && envelope.result.length < 100) return records;
-			page += 1;
-		}
-	}));
-	const createRecord = Effect.fn("CloudflareClient.createRecord")((zoneName, record) => Effect.gen(function* () {
-		const zone = yield* resolveZone(zoneName);
-		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records`, "createRecord", {
-			body: JSON.stringify(encode(record)),
-			method: "POST"
-		});
-		yield* ensureSuccess(body, "createRecord", response);
-		return { providerRecordId: (yield* decode(RecordEnvelope, body, "createRecord", response)).result.id };
-	}));
-	const getRecord = Effect.fn("CloudflareClient.getRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-		const zone = yield* resolveZone(zoneName);
-		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "getRecord");
-		if (response.status === 404) return null;
-		yield* ensureSuccess(body, "getRecord", response);
-		const envelope = yield* decode(RecordEnvelope, body, "getRecord", response);
-		return yield* decode$1(envelope.result);
-	}));
-	return {
-		id: "cloudflare",
-		createRecord,
-		deleteRecord: Effect.fn("CloudflareClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-			const zone = yield* resolveZone(zoneName);
-			const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "deleteRecord", { method: "DELETE" });
-			yield* ensureSuccess(body, "deleteRecord", response);
-		})),
-		getRecord,
-		listAccounts: Effect.fn("CloudflareClient.listAccounts")(() => allZones().pipe(Effect.map((zones) => {
-			const accounts = /* @__PURE__ */ new Map();
-			for (const zone of zones) accounts.set(zone.account.id, zone.account);
-			return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));
-		}))),
-		listRecords,
-		listZones: Effect.fn("CloudflareClient.listZones")((input = {}) => allZones(input.accountId ?? options.accountId, input.name).pipe(Effect.flatMap((zones) => Effect.forEach(zones, projectZone)))),
-		validateToken: Effect.fn("CloudflareClient.validateToken")(() => Effect.gen(function* () {
-			const path = options.tokenKind === "account" ? `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify` : "/user/tokens/verify";
-			const expiresAt = yield* inspectToken(path);
-			yield* allZones(options.accountId);
-			return {
-				accountId: options.accountId,
-				capabilities: options.capabilities,
-				expiresAt,
-				scopes: []
-			};
-		}))
-	};
-}
-const projectZone = Effect.fn("CloudflareClient.projectZone")((zone) => Effect.gen(function* () {
-	const name = yield* decode$2(zone.name).pipe(Effect.mapError((cause) => failure("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$2(nameserver).pipe(Effect.mapError((cause) => failure("listZones", cause.message, { reason: "response" }))));
-	return {
-		accountId: zone.account.id,
-		id: zone.id,
-		name,
-		nameservers,
-		status: zone.status ?? null
-	};
-}));
-function decode(schema, input, operation, response) {
-	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {
-		reason: "response",
-		status: response.status
-	})));
-}
-function ensureSuccess(input, operation, response) {
-	return Schema.decodeUnknownEffect(BaseEnvelope)(input).pipe(Effect.mapError(() => failure(operation, "Cloudflare response did not contain a valid API envelope", {
-		reason: "response",
-		status: response.status
-	})), Effect.flatMap((envelope) => {
-		if (response.ok && envelope.success) return Effect.void;
-		const detail = envelope.errors[0];
-		const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-		return Effect.fail(failure(operation, detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`, {
-			...detail === void 0 ? {} : { code: detail.code },
-			reason: reason(response.status, detail?.code),
-			...retryAfterMs === void 0 ? {} : { retryAfterMs },
-			status: response.status
-		}));
-	}));
-}
-function reason(status, code) {
-	if (status === 401) return "authentication";
-	if (status === 403) return "authorization";
-	if (status === 404) return "not_found";
-	if (status === 409 || code === 81056 || code === 81057 || code === 81058) return "conflict";
-	if (status === 429) return "rate_limit";
-	if (status >= 500) return "response";
-	return "request";
-}
-function retryAfter(value) {
-	if (value === null) return void 0;
-	const seconds = Number(value);
-	if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
-	const date = Date.parse(value);
-	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
-}
-function failure(operation, message, fields = {}) {
-	return new Error({
-		...fields,
-		message,
-		operation,
-		providerId: "cloudflare"
-	});
-}
-//#endregion
-//#region src/providers/cloudflare/auth.ts
-var auth_exports = /* @__PURE__ */ __exportAll({
-	contextCodec: () => contextCodec,
-	manifest: () => manifest,
-	oauthAuthentication: () => oauthAuthentication,
-	oauthFlow: () => oauthFlow,
-	oauthMethod: () => oauthMethod,
-	subjectResolver: () => subjectResolver,
-	tokenConnectionMethod: () => tokenConnectionMethod,
-	tokenMethod: () => tokenMethod,
-	tokenValidator: () => tokenValidator
-});
-const authorizationServer = {
-	authorization_endpoint: "https://dash.cloudflare.com/oauth2/auth",
-	issuer: "https://dash.cloudflare.com",
-	revocation_endpoint: "https://dash.cloudflare.com/oauth2/revoke",
-	token_endpoint: "https://dash.cloudflare.com/oauth2/token"
-};
-const Context$1 = Schema.Struct({ tokenKind: Schema.Literals(["account", "user"]) });
-const contextCodec = codec("cloudflare.v1", Context$1);
-/** Describes Cloudflare's caller-created API-token authorization method. */
-function tokenMethod(capabilities) {
-	return {
-		_tag: "token",
-		capabilities: [...capabilities],
-		instructionsUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/"
-	};
-}
-/** Describes a registered Cloudflare OAuth client and its assigned scope IDs. */
-function oauthMethod(options) {
-	return {
-		_tag: "oauth2",
-		authorizationServer,
-		capabilities: [...options.capabilities],
-		clientAuth: options.clientAuth,
-		scopes: [...options.scopes]
-	};
-}
-/** Creates the Cloudflare token and OAuth authorization manifest. */
-function manifest(options) {
-	return {
-		methods: [tokenMethod(options.capabilities), oauthMethod(options)],
-		providerId: "cloudflare"
-	};
-}
-/** Resolves the Cloudflare account selected by a completed OAuth grant. */
-function subjectResolver(options) {
-	return (tokens, accessToken) => Effect.gen(function* () {
-		const accountId = options.accountId ?? (yield* discoverAuthorizationAccount({
-			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-			domain: options.domain,
-			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			token: accessToken
-		}).pipe(Effect.map((account) => account.id)));
-		if (options.accountId !== void 0) yield* make({
-			accountId: options.accountId,
-			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-			capabilities: options.capabilities,
-			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			token: accessToken,
-			tokenKind: "user"
-		}).listZones();
-		const now = yield* Clock.currentTimeMillis;
-		return {
-			accountId,
-			expiresAt: typeof tokens.expires_in === "number" ? new Date(now + tokens.expires_in * 1e3) : null
-		};
-	});
-}
-/** Creates a host callback that validates a Cloudflare API token. */
-function tokenValidator(options) {
-	return (token) => options.accountId === void 0 ? validateDomainToken({
-		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-		capabilities: options.capabilities,
-		domain: options.domain,
-		...options.fetch === void 0 ? {} : { fetch: options.fetch },
-		token,
-		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
-	}) : make({
-		accountId: options.accountId,
-		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-		capabilities: options.capabilities,
-		...options.fetch === void 0 ? {} : { fetch: options.fetch },
-		token,
-		...options.tokenKind === void 0 ? {} : { tokenKind: options.tokenKind }
-	}).validateToken();
-}
-/** Creates a provider-independent token connection method backed by Cloudflare validation. */
-function tokenConnectionMethod(options) {
-	const requiredCapabilities = [...options.capabilities];
-	return Method.Token({
-		authenticate: Effect.fn("CloudflareAuth.authenticateToken")(function* (token) {
-			const validated = yield* tokenValidator(options)(token);
-			const observedAt = new Date(yield* Clock.currentTimeMillis);
-			return {
-				capabilityEvidence: validated.capabilities.map((capability) => ({
-					capability,
-					evidence: Evidence.Introspected({ observedAt })
-				})),
-				credential: {
-					accessToken: token,
-					refreshToken: null,
-					tokenType: "bearer"
-				},
-				expiresAt: validated.expiresAt,
-				providerAccountId: validated.accountId,
-				providerContext: yield* contextCodec.encode({ tokenKind: options.tokenKind ?? "user" }),
-				scopes: [...validated.scopes]
-			};
-		}),
-		providerId: "cloudflare",
-		requiredCapabilities,
-		token: options.token
-	});
-}
-/** Converts a completed Cloudflare OAuth grant into the canonical connection authentication. */
-const oauthAuthentication = Effect.fn("CloudflareAuth.oauthAuthentication")(function* (options) {
-	const resolved = yield* subjectResolver(options)(options.tokens, options.accessToken);
-	const observedAt = new Date(yield* Clock.currentTimeMillis);
-	return {
-		capabilityEvidence: options.capabilities.map((capability) => ({
-			capability,
-			evidence: Evidence.Introspected({ observedAt })
-		})),
-		credential: {
-			accessToken: options.accessToken,
-			refreshToken: options.tokens.refresh_token === void 0 ? null : Value.from(options.tokens.refresh_token),
-			tokenType: options.tokens.token_type
-		},
-		expiresAt: resolved.expiresAt,
-		providerAccountId: resolved.accountId,
-		providerContext: yield* contextCodec.encode({ tokenKind: "user" }),
-		scopes: (options.tokens.scope ?? "").split(" ").filter(Boolean)
-	};
-});
-/** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */
-function oauthFlow(options) {
-	const method = oauthMethod({
-		capabilities: options.capabilities,
-		clientAuth: options.clientAuth,
-		scopes: options.scopes
-	});
-	return {
-		complete: Effect.fn("CloudflareAuth.oauthFlow.complete")(function* (payload, callbackUrl) {
-			const tokens = yield* complete({
-				callbackUrl,
-				client: options.client,
-				...options.fetch === void 0 ? {} : { fetch: options.fetch },
-				method,
-				payload,
-				providerId: "cloudflare"
-			});
-			return yield* oauthAuthentication({
-				...options.accountId === void 0 ? { domain: options.domain } : { accountId: options.accountId },
-				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-				capabilities: options.capabilities,
-				...options.fetch === void 0 ? {} : { fetch: options.fetch },
-				accessToken: make$1(tokens.access_token),
-				tokens
-			});
-		}),
-		method: "oauth2",
-		providerId: "cloudflare",
-		requiredCapabilities: [...options.capabilities],
-		start: (continuationId) => start({
-			client: options.client,
-			method,
-			redirectUri: options.redirectUri,
-			state: continuationId
-		})
-	};
-}
-//#endregion
-export { subjectResolver as a, tokenValidator as c, make as d, oauthMethod as i, client_exports as l, manifest as n, tokenConnectionMethod as o, oauthFlow as r, tokenMethod as s, auth_exports as t, discovery as u };
-
-//# sourceMappingURL=auth-BR-19zj-.mjs.map