domainkit 0.2.2 → 0.3.0

package/dist/zone-discovery-BPnH3sLU.d.mts

@@ -1,1397 +0,0 @@
-import { Context, Crypto, Data, Effect, Layer, Schema } from "effect";
-import * as oauth from "oauth4webapi";
-declare namespace invalid_input_d_exports {
-  export { Error$3 as Error };
-}
-declare const Error_base$3: Schema.Class<Error$3, Schema.TaggedStruct<"InvalidInputError", {
-  readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$3 extends Error_base$3 {}
-declare namespace domain_name_d_exports {
-  export { DomainName, Schema$5 as Schema, decode$5 as decode, parse$1 as parse };
-}
-declare const Type$1: Schema.brand<Schema.String, "DomainName">;
-/** A lower-case, fully qualified DNS name without a trailing dot. */
-type DomainName = typeof Type$1.Type;
-/** Decodes user and wire strings into canonical domain names. */
-declare const Schema$5: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-declare const decode$5: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$3, never>;
-declare function parse$1(input: unknown): DomainName;
-declare namespace dns_record_d_exports {
-  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$4 as Schema, Srv, Txt, Type, data, decode$4 as decode, equals, parse };
-}
-declare const Type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
-type Type = typeof Type.Type;
-declare const RequirementMetadata: Schema.Struct<{
-  readonly ownership: Schema.String;
-  readonly provenance: Schema.String;
-  readonly purpose: Schema.String;
-}>;
-interface RequirementMetadata extends Schema.Schema.Type<typeof RequirementMetadata> {}
-declare const Schema$4: Schema.TaggedUnion<{
-  readonly A: Schema.TaggedStruct<"A", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly AAAA: Schema.TaggedStruct<"AAAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly CAA: Schema.TaggedStruct<"CAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly flags: Schema.Int;
-    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
-    readonly value: Schema.String;
-  }>;
-  readonly CNAME: Schema.TaggedStruct<"CNAME", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly policy: Schema.Literal<"exclusive">;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly MX: Schema.TaggedStruct<"MX", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly priority: Schema.Int;
-  }>;
-  readonly NS: Schema.TaggedStruct<"NS", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly SRV: Schema.TaggedStruct<"SRV", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly port: Schema.Int;
-    readonly priority: Schema.Int;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly weight: Schema.Int;
-  }>;
-  readonly TXT: Schema.TaggedStruct<"TXT", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly value: Schema.String;
-  }>;
-}>;
-declare const A: Schema.TaggedStruct<"A", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly address: Schema.String;
-}>, Aaaa: Schema.TaggedStruct<"AAAA", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly address: Schema.String;
-}>, Caa: Schema.TaggedStruct<"CAA", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly flags: Schema.Int;
-  readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
-  readonly value: Schema.String;
-}>, Cname: Schema.TaggedStruct<"CNAME", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly policy: Schema.Literal<"exclusive">;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-}>, Mx: Schema.TaggedStruct<"MX", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly priority: Schema.Int;
-}>, Ns: Schema.TaggedStruct<"NS", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-}>, Srv: Schema.TaggedStruct<"SRV", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly port: Schema.Int;
-  readonly priority: Schema.Int;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly weight: Schema.Int;
-}>, Txt: Schema.TaggedStruct<"TXT", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly value: Schema.String;
-}>;
-type DnsRecord = typeof Schema$4.Type;
-type Encoded = typeof Schema$4.Encoded;
-/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
-declare const Opaque: Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
-  readonly name: Schema.String;
-  readonly providerRecordId: Schema.NullOr<Schema.String>;
-  readonly providerType: Schema.String;
-}>;
-interface Opaque extends Schema.Schema.Type<typeof Opaque> {}
-/** Any DNS record observed through a provider, including non-portable record types. */
-declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
-  readonly A: Schema.TaggedStruct<"A", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly AAAA: Schema.TaggedStruct<"AAAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly CAA: Schema.TaggedStruct<"CAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly flags: Schema.Int;
-    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
-    readonly value: Schema.String;
-  }>;
-  readonly CNAME: Schema.TaggedStruct<"CNAME", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly policy: Schema.Literal<"exclusive">;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly MX: Schema.TaggedStruct<"MX", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly priority: Schema.Int;
-  }>;
-  readonly NS: Schema.TaggedStruct<"NS", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly SRV: Schema.TaggedStruct<"SRV", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly port: Schema.Int;
-    readonly priority: Schema.Int;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly weight: Schema.Int;
-  }>;
-  readonly TXT: Schema.TaggedStruct<"TXT", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly value: Schema.String;
-  }>;
-}>, Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
-  readonly name: Schema.String;
-  readonly providerRecordId: Schema.NullOr<Schema.String>;
-  readonly providerType: Schema.String;
-}>]>;
-type Observed = typeof Observed.Type;
-declare const decode$4: (input: unknown) => Effect.Effect<{
-  readonly _tag: "A";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly address: string;
-} | {
-  readonly _tag: "AAAA";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly address: string;
-} | {
-  readonly _tag: "CAA";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly flags: number;
-  readonly tag: "iodef" | "issue" | "issuewild";
-  readonly value: string;
-} | {
-  readonly _tag: "CNAME";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly ttl: number | null;
-  readonly policy: "exclusive";
-  readonly target: string & import("effect/Brand").Brand<"DomainName">;
-} | {
-  readonly _tag: "MX";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
-  readonly priority: number;
-} | {
-  readonly _tag: "NS";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly target: string & import("effect/Brand").Brand<"DomainName">;
-} | {
-  readonly _tag: "SRV";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly port: number;
-  readonly priority: number;
-  readonly target: string & import("effect/Brand").Brand<"DomainName">;
-  readonly weight: number;
-} | {
-  readonly _tag: "TXT";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly value: string;
-}, Error$3, never>;
-declare function parse(input: unknown): DnsRecord;
-declare function data(record: DnsRecord): Readonly<Record<string, number | string>>;
-declare function equals(left: DnsRecord, right: DnsRecord): boolean;
-declare namespace provider_d_exports {
-  export { AsyncInterface, CreateResult, Error$2 as Error, ErrorReason, Interface$2 as Interface, Service$2 as Service, fromAsync, layerFromAsync, toAsync };
-}
-interface CreateResult {
-  readonly providerRecordId: string | null;
-}
-declare const ErrorReason: Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>;
-type ErrorReason = typeof ErrorReason.Type;
-declare const Error_base$2: Schema.Class<Error$2, Schema.TaggedStruct<"ProviderError", {
-  readonly cause: Schema.optionalKey<Schema.Unknown>;
-  readonly code: Schema.optionalKey<Schema.Union<readonly [Schema.Number, Schema.String]>>;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly providerId: Schema.String;
-  readonly reason: Schema.optionalKey<Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>>;
-  readonly retryAfterMs: Schema.optionalKey<Schema.Number>;
-  readonly status: Schema.optionalKey<Schema.Number>;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$2 extends Error_base$2 {}
-/** The provider capability used by DNS planning, application, and verification. */
-interface Interface$2 {
-  readonly id: string;
-  readonly createRecord: (zone: DomainName, record: DnsRecord) => Effect.Effect<CreateResult, Error$2>;
-  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<void, Error$2>;
-  readonly getRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<Observed | null, Error$2>;
-  readonly listRecords: (zone: DomainName) => Effect.Effect<ReadonlyArray<Observed>, Error$2>;
-}
-declare const Service_base$2: Context.ServiceClass<Service$2, "@domainkit/DnsProvider", Interface$2>;
-declare class Service$2 extends Service_base$2 {}
-/** Minimal Promise-shaped provider contract for hosts that do not use Effect directly. */
-interface AsyncInterface {
-  readonly id: string;
-  readonly createRecord: (zone: DomainName, record: DnsRecord) => Promise<CreateResult>;
-  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Promise<void>;
-  readonly getRecord: (zone: DomainName, providerRecordId: string) => Promise<Observed | null>;
-  readonly listRecords: (zone: DomainName) => Promise<ReadonlyArray<Observed>>;
-}
-declare const fromAsync: (provider: AsyncInterface) => Interface$2;
-declare const layerFromAsync: (provider: AsyncInterface) => Layer.Layer<Service$2>;
-declare const toAsync: (provider: Interface$2) => AsyncInterface;
-declare namespace secret_d_exports {
-  export { Value, make$1 as make };
-}
-/** A deliberately non-serializable credential value. */
-declare class Value {
-  #private;
-  private constructor();
-  static from(value: string): Value;
-  expose(): string;
-  toJSON(): string;
-  toString(): string;
-}
-declare const make$1: typeof Value.from;
-declare namespace manifest_d_exports {
-  export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method$1 as Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$3 as Schema, TokenValidation, decode$3 as decode };
-}
-declare const Method$1: Schema.TaggedUnion<{
-  readonly integration: Schema.TaggedStruct<"integration", {
-    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-    readonly installUrl: Schema.String;
-    readonly tokenEndpoint: Schema.String;
-  }>;
-  readonly oauth2: Schema.TaggedStruct<"oauth2", {
-    readonly authorizationServer: Schema.Struct<{
-      readonly authorization_endpoint: Schema.String;
-      readonly issuer: Schema.String;
-      readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
-      readonly token_endpoint: Schema.String;
-    }>;
-    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-    readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
-    readonly scopes: Schema.$Array<Schema.String>;
-  }>;
-  readonly token: Schema.TaggedStruct<"token", {
-    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-    readonly instructionsUrl: Schema.String;
-  }>;
-}>;
-declare const Schema$3: Schema.Struct<{
-  readonly methods: Schema.$Array<Schema.TaggedUnion<{
-    readonly integration: Schema.TaggedStruct<"integration", {
-      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-      readonly installUrl: Schema.String;
-      readonly tokenEndpoint: Schema.String;
-    }>;
-    readonly oauth2: Schema.TaggedStruct<"oauth2", {
-      readonly authorizationServer: Schema.Struct<{
-        readonly authorization_endpoint: Schema.String;
-        readonly issuer: Schema.String;
-        readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
-        readonly token_endpoint: Schema.String;
-      }>;
-      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-      readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
-      readonly scopes: Schema.$Array<Schema.String>;
-    }>;
-    readonly token: Schema.TaggedStruct<"token", {
-      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-      readonly instructionsUrl: Schema.String;
-    }>;
-  }>>;
-  readonly providerId: Schema.String;
-}>;
-interface Manifest extends Schema.Schema.Type<typeof Schema$3> {}
-type OAuthMethod = Extract<Manifest["methods"][number], {
-  readonly _tag: "oauth2";
-}>;
-/** A provider-owned installation flow that returns a credential from a one-time code. */
-type IntegrationMethod = Extract<Manifest["methods"][number], {
-  readonly _tag: "integration";
-}>;
-declare const decode$3: (input: unknown) => Effect.Effect<{
-  readonly methods: readonly ({
-    readonly _tag: "integration";
-    readonly capabilities: readonly ("dns:read" | "dns:write")[];
-    readonly installUrl: string;
-    readonly tokenEndpoint: string;
-  } | {
-    readonly _tag: "oauth2";
-    readonly authorizationServer: {
-      readonly authorization_endpoint: string;
-      readonly issuer: string;
-      readonly revocation_endpoint?: string;
-      readonly token_endpoint: string;
-    };
-    readonly capabilities: readonly ("dns:read" | "dns:write")[];
-    readonly clientAuth: "client_secret_basic" | "client_secret_post" | "none";
-    readonly scopes: readonly string[];
-  } | {
-    readonly _tag: "token";
-    readonly capabilities: readonly ("dns:read" | "dns:write")[];
-    readonly instructionsUrl: string;
-  })[];
-  readonly providerId: string;
-}, Error$3, never>;
-interface OAuthClientConfiguration {
-  readonly clientId: string;
-  readonly clientSecret?: Value;
-}
-interface TokenValidation {
-  readonly accountId: string;
-  readonly capabilities: ReadonlyArray<"dns:read" | "dns:write">;
-  readonly expiresAt: Date | null;
-  readonly scopes: ReadonlyArray<string>;
-}
-interface OAuthSubjectResolver {
-  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Effect.Effect<{
-    readonly accountId: string;
-    readonly expiresAt: Date | null;
-  }, Error$2>;
-}
-interface AsyncOAuthSubjectResolver {
-  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Promise<{
-    readonly accountId: string;
-    readonly expiresAt: Date | null;
-  }>;
-}
-declare namespace canonical_json_d_exports {
-  export { CryptoError, Json, sha256Encoded, sha256Json, sha256Text, stringify, webCryptoLayer };
-}
-declare const CryptoError_base: Schema.Class<CryptoError, Schema.TaggedStruct<"CryptoError", {
-  readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-declare class CryptoError extends CryptoError_base {}
-type Json = null | boolean | number | string | ReadonlyArray<Json> | {
-  readonly [key: string]: Json;
-};
-/** Deterministic JSON serialization for already schema-encoded protocol values. */
-declare function stringify(value: Json): string;
-declare const sha256Text: (value: string) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
-declare const sha256Json: (value: Json) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
-declare const sha256Encoded: <S extends Schema.Constraint>(schema: S, value: S["Type"]) => Effect.Effect<string, CryptoError, Crypto.Crypto | S["EncodingServices"]>;
-/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
-declare const webCryptoLayer: Layer.Layer<Crypto.Crypto>;
-declare namespace authorization_d_exports {
-  export { Capability, CapabilityEvidence, Evidence, EvidenceSchema, ProviderAuthorization, Revocation, Schema$2 as Schema, decode$2 as decode, encode$2 as encode, evidenceFor, validate$1 as validate };
-}
-declare const Capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
-type Capability = typeof Capability.Type;
-type Evidence = Data.TaggedEnum<{
-  Declared: {};
-  Exercised: {
-    readonly observedAt: Date;
-  };
-  Introspected: {
-    readonly observedAt: Date;
-  };
-}>;
-declare const Evidence: {
-  readonly $is: <Tag extends "Declared" | "Exercised" | "Introspected">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "Declared";
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Exercised";
-    readonly observedAt: Date;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Introspected";
-    readonly observedAt: Date;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
-    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
-  };
-  readonly Declared: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Declared";
-  }, "_tag">;
-  readonly Exercised: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Exercised";
-    readonly observedAt: Date;
-  }, "_tag">;
-  readonly Introspected: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Introspected";
-    readonly observedAt: Date;
-  }, "_tag">;
-};
-declare const EvidenceSchema: Schema.TaggedUnion<{
-  readonly Declared: Schema.TaggedStruct<"Declared", {}>;
-  readonly Exercised: Schema.TaggedStruct<"Exercised", {
-    readonly observedAt: Schema.DateFromString;
-  }>;
-  readonly Introspected: Schema.TaggedStruct<"Introspected", {
-    readonly observedAt: Schema.DateFromString;
-  }>;
-}>;
-declare const CapabilityEvidence: Schema.Struct<{
-  readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
-  readonly evidence: Schema.TaggedUnion<{
-    readonly Declared: Schema.TaggedStruct<"Declared", {}>;
-    readonly Exercised: Schema.TaggedStruct<"Exercised", {
-      readonly observedAt: Schema.DateFromString;
-    }>;
-    readonly Introspected: Schema.TaggedStruct<"Introspected", {
-      readonly observedAt: Schema.DateFromString;
-    }>;
-  }>;
-}>;
-interface CapabilityEvidence extends Schema.Schema.Type<typeof CapabilityEvidence> {}
-declare const Revocation: Schema.TaggedUnion<{
-  readonly Active: Schema.TaggedStruct<"Active", {}>;
-  readonly Pending: Schema.TaggedStruct<"Pending", {
-    readonly requestedAt: Schema.DateFromString;
-  }>;
-}>;
-type Revocation = typeof Revocation.Type;
-/** A provider credential authorization shared by one or more owner connections. */
-declare const Schema$2: Schema.Struct<{
-  readonly authorizedById: Schema.String;
-  readonly capabilityEvidence: Schema.$Array<Schema.Struct<{
-    readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
-    readonly evidence: Schema.TaggedUnion<{
-      readonly Declared: Schema.TaggedStruct<"Declared", {}>;
-      readonly Exercised: Schema.TaggedStruct<"Exercised", {
-        readonly observedAt: Schema.DateFromString;
-      }>;
-      readonly Introspected: Schema.TaggedStruct<"Introspected", {
-        readonly observedAt: Schema.DateFromString;
-      }>;
-    }>;
-  }>>;
-  readonly createdAt: Schema.DateFromString;
-  readonly expiresAt: Schema.NullOr<Schema.DateFromString>;
-  readonly id: Schema.String;
-  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
-  readonly providerAccountId: Schema.String;
-  readonly providerContext: Schema.Struct<{
-    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly version: Schema.String;
-  }>;
-  readonly providerId: Schema.String;
-  readonly requiredCapabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-  readonly revocation: Schema.TaggedUnion<{
-    readonly Active: Schema.TaggedStruct<"Active", {}>;
-    readonly Pending: Schema.TaggedStruct<"Pending", {
-      readonly requestedAt: Schema.DateFromString;
-    }>;
-  }>;
-  readonly scopes: Schema.$Array<Schema.String>;
-}>;
-interface ProviderAuthorization extends Schema.Schema.Type<typeof Schema$2> {}
-declare const decode$2: (input: unknown) => Effect.Effect<{
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    };
-  }[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: Date;
-  };
-  readonly scopes: readonly string[];
-}, Error$3, never>;
-declare const validate$1: (input: unknown) => Effect.Effect<{
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    };
-  }[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: Date;
-  };
-  readonly scopes: readonly string[];
-}, Error$3, never>;
-declare const encode$2: (input: {
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    };
-  }[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: Date;
-  };
-  readonly scopes: readonly string[];
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: string;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: string;
-    };
-  }[];
-  readonly createdAt: string;
-  readonly expiresAt: string | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: string;
-  };
-  readonly scopes: readonly string[];
-};
-declare function evidenceFor(authorization: ProviderAuthorization, capability: Capability): Evidence | undefined;
-//#endregion
-//#region src/auth/connection.d.ts
-declare const Grant: Schema.TaggedUnion<{
-  readonly account: Schema.TaggedStruct<"account", {}>;
-  readonly domains: Schema.TaggedStruct<"domains", {
-    readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-  }>;
-}>;
-type Grant = typeof Grant.Type;
-/** An owner-scoped grant bound to one provider authorization. */
-declare const Schema$1: Schema.Struct<{
-  readonly authorizationId: Schema.String;
-  readonly createdAt: Schema.DateFromString;
-  readonly grant: Schema.TaggedUnion<{
-    readonly account: Schema.TaggedStruct<"account", {}>;
-    readonly domains: Schema.TaggedStruct<"domains", {
-      readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-    }>;
-  }>;
-  readonly id: Schema.String;
-  readonly ownerId: Schema.String;
-}>;
-interface Connection extends Schema.Schema.Type<typeof Schema$1> {}
-declare const decode$1: (input: unknown) => Effect.Effect<{
-  readonly authorizationId: string;
-  readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-}, Error$3, never>;
-declare const validate: (input: unknown) => Effect.Effect<{
-  readonly authorizationId: string;
-  readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-}, Error$3, never>;
-declare const encode$1: (input: {
-  readonly authorizationId: string;
-  readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly authorizationId: string;
-  readonly createdAt: string;
-  readonly grant: {
-    readonly _tag: "account";
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly string[];
-  };
-  readonly id: string;
-  readonly ownerId: string;
-};
-interface OAuthContinuation {
-  readonly clientId: string;
-  readonly codeVerifier: Value;
-  readonly expiresAt: Date;
-  readonly grant: Grant;
-  readonly method: OAuthMethod;
-  readonly ownerId: string;
-  readonly redirectUri: string;
-  readonly stateHash: string;
-  readonly authorizedById: string;
-}
-interface StoredCredential {
-  readonly accessToken: Value;
-  readonly refreshToken: Value | null;
-  readonly tokenType: string;
-}
-declare const AuthorizationError_base: Schema.Class<AuthorizationError, Schema.TaggedStruct<"AuthorizationError", {
-  readonly category: Schema.Literal<"authorization">;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
-}>, import("effect/Cause").YieldableError>;
-declare class AuthorizationError extends AuthorizationError_base {}
-declare const authorizationError: (message: string, operation: string) => AuthorizationError;
-declare function assertGrant(connection: Connection, authorization: ProviderAuthorization, request: {
-  readonly capability: Capability;
-  readonly domain: string;
-  readonly now?: Date;
-  readonly providerId: string;
-}): DomainName;
-declare namespace lifecycle_repository_d_exports {
-  export { Aggregate, DetachResult, Error$1 as Error, Interface$1 as Interface, Service$1 as Service };
-}
-interface Aggregate {
-  readonly authorization: ProviderAuthorization;
-  readonly bindings: ReadonlyArray<Connection>;
-  readonly credential: StoredCredential;
-}
-interface DetachResult {
-  readonly authorizationId: string;
-  readonly remainingBindings: number;
-  readonly revokedAuthorization: boolean;
-}
-declare const Error_base$1: Schema.Class<Error$1, Schema.TaggedStruct<"LifecycleRepositoryError", {
-  readonly category: Schema.Literal<"storage">;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$1 extends Error_base$1 {}
-interface Interface$1 {
-  readonly bind: (authorizationId: string, binding: Connection) => Effect.Effect<Aggregate, Error$1>;
-  readonly connect: (aggregate: Aggregate) => Effect.Effect<Aggregate, Error$1>;
-  readonly detach: <E>(input: {
-    readonly connectionId: string;
-    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;
-  }) => Effect.Effect<DetachResult, Error$1 | E>;
-  readonly findByProviderAccount: (providerId: string, providerAccountId: string) => Effect.Effect<Aggregate | null, Error$1>;
-  readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error$1>;
-  readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error$1>;
-  readonly promoteEvidence: (authorizationId: string, evidence: ReadonlyArray<CapabilityEvidence>) => Effect.Effect<Aggregate, Error$1>;
-  readonly recover: <E>(input: {
-    readonly authorizationId: string;
-    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;
-  }) => Effect.Effect<DetachResult, Error$1 | E>;
-  readonly rotate: (authorizationId: string, credential: StoredCredential, expiresAt: Date | null) => Effect.Effect<Aggregate, Error$1>;
-}
-declare const Service_base$1: Context.ServiceClass<Service$1, "@domainkit/AuthorizationLifecycleRepository", Interface$1>;
-declare class Service$1 extends Service_base$1 {}
-declare namespace provider_context_d_exports {
-  export { Codec, Envelope, codec, decode, encode };
-}
-/** A provider-owned, versioned, non-secret context value persisted by the host. */
-declare const Envelope: Schema.Struct<{
-  readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-  readonly version: Schema.String;
-}>;
-interface Envelope extends Schema.Schema.Type<typeof Envelope> {}
-interface Codec<A> {
-  readonly decode: (envelope: Envelope) => Effect.Effect<A, Error$3>;
-  readonly encode: (value: A) => Effect.Effect<Envelope, Error$3>;
-  readonly version: string;
-}
-/** Build an adapter-owned context codec from a schema and stable version identifier. */
-declare function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A>;
-declare const decode: (input: unknown) => Effect.Effect<{
-  readonly value: Schema.Json;
-  readonly version: string;
-}, Error$3, never>;
-declare const encode: (input: {
-  readonly value: Schema.Json;
-  readonly version: string;
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly value: Schema.Json;
-  readonly version: string;
-};
-//#endregion
-//#region src/auth/connect.d.ts
-interface Authentication {
-  readonly capabilityEvidence: ReadonlyArray<CapabilityEvidence>;
-  readonly credential: StoredCredential;
-  readonly expiresAt: Date | null;
-  readonly providerAccountId: string;
-  readonly providerContext: Envelope;
-  readonly scopes: ReadonlyArray<string>;
-}
-type AuthenticationFailure = Error | Error$3 | Error$2;
-interface InteractiveStart {
-  readonly authorizationUrl: URL;
-  readonly payload: Value;
-}
-interface Continuation extends BaseInput {
-  readonly expiresAt: Date;
-  readonly id: string;
-  readonly method: "integration" | "oauth2";
-  readonly payload: Value;
-  readonly providerId: string;
-  readonly requiredCapabilities: ReadonlyArray<Capability>;
-}
-interface ContinuationStore {
-  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;
-  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;
-}
-interface InteractiveFlow {
-  readonly complete: (payload: Value, callbackUrl: URL) => Effect.Effect<Authentication, AuthenticationFailure>;
-  readonly method: "integration" | "oauth2";
-  readonly providerId: string;
-  readonly requiredCapabilities: ReadonlyArray<Capability>;
-  readonly start: (continuationId: string) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;
-}
-type Method = Data.TaggedEnum<{
-  Interactive: {
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  };
-  Token: {
-    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  };
-}>;
-declare const Method: {
-  readonly $is: <Tag extends "Interactive" | "Token">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "Interactive";
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Token";
-    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
-    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
-  };
-  readonly Interactive: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Interactive";
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  }, "_tag">;
-  readonly Token: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Token";
-    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  }, "_tag">;
-};
-type StartResult = Data.TaggedEnum<{
-  Connected: {
-    readonly aggregate: Aggregate;
-  };
-  Redirect: {
-    readonly authorizationUrl: URL;
-    readonly continuationId: string;
-  };
-}>;
-declare const StartResult: {
-  readonly $is: <Tag extends "Connected" | "Redirect">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "Connected";
-    readonly aggregate: Aggregate;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Redirect";
-    readonly authorizationUrl: URL;
-    readonly continuationId: string;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
-      readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
-    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
-      readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
-  };
-  readonly Connected: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Connected";
-    readonly aggregate: Aggregate;
-  }, "_tag">;
-  readonly Redirect: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Redirect";
-    readonly authorizationUrl: URL;
-    readonly continuationId: string;
-  }, "_tag">;
-};
-declare const Error_base: Schema.Class<Error, Schema.TaggedStruct<"ConnectionError", {
-  readonly category: Schema.Literals<readonly ["authorization", "provider", "validation"]>;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
-}>, import("effect/Cause").YieldableError>;
-declare class Error extends Error_base {}
-interface BaseInput {
-  readonly authorizedById: string;
-  readonly grant: Grant;
-  readonly ownerId: string;
-}
-interface CompleteInput {
-  readonly callbackUrl: URL;
-  readonly continuationId: string;
-  readonly continuations: ContinuationStore;
-  readonly flow: InteractiveFlow;
-}
-interface ExtendInput {
-  readonly connectionId: string;
-  readonly grant: Grant;
-  readonly ownerId: string;
-}
-declare const start: (input: BaseInput & {
-  readonly method: Method;
-}) => Effect.Effect<{
-  readonly _tag: "Connected";
-  readonly aggregate: Aggregate;
-} | {
-  readonly _tag: "Redirect";
-  readonly authorizationUrl: URL;
-  readonly continuationId: string;
-}, Error$1 | AuthenticationFailure, Crypto.Crypto | Service$1>;
-declare const complete: (input: CompleteInput) => Effect.Effect<Aggregate, Error$1 | AuthenticationFailure, Crypto.Crypto | Service$1>;
-/** Extends one owner binding without repeating provider authentication. */
-declare const extend: (input: ExtendInput) => Effect.Effect<Aggregate, Error$1 | Error, Service$1>;
-type Requirements = Service$1 | Crypto.Crypto;
-type Failure = AuthenticationFailure | Error$1 | CryptoError;
-declare namespace zone_discovery_d_exports {
-  export { Candidate, Interface, Outcome, Service, Source, make };
-}
-/** Display-safe identity and nameserver evidence for one provider-owned zone. */
-declare const Candidate: Schema.Struct<{
-  readonly accountId: Schema.String;
-  readonly id: Schema.String;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-  readonly providerId: Schema.String;
-  readonly status: Schema.Literals<readonly ["active", "pending", "unknown"]>;
-}>;
-interface Candidate extends Schema.Schema.Type<typeof Candidate> {}
-interface Source {
-  readonly listZones: (name: DomainName) => Effect.Effect<ReadonlyArray<Omit<Candidate, "providerId">>, Error$2>;
-  readonly provider: Interface$2;
-}
-type Outcome = Data.TaggedEnum<{
-  NotFound: {
-    readonly domain: DomainName;
-  };
-  Resolved: {
-    readonly candidate: Candidate;
-    readonly provider: Interface$2;
-  };
-  SelectionRequired: {
-    readonly candidates: ReadonlyArray<Candidate>;
-  };
-}>;
-declare const Outcome: {
-  readonly $is: <Tag extends "NotFound" | "Resolved" | "SelectionRequired">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "NotFound";
-    readonly domain: DomainName;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Resolved";
-    readonly candidate: Candidate;
-    readonly provider: Interface$2;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "SelectionRequired";
-    readonly candidates: ReadonlyArray<Candidate>;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
-      readonly _tag: "NotFound";
-      readonly domain: DomainName;
-    } | {
-      readonly _tag: "Resolved";
-      readonly candidate: Candidate;
-      readonly provider: Interface$2;
-    } | {
-      readonly _tag: "SelectionRequired";
-      readonly candidates: ReadonlyArray<Candidate>;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "NotFound";
-      readonly domain: DomainName;
-    } | {
-      readonly _tag: "Resolved";
-      readonly candidate: Candidate;
-      readonly provider: Interface$2;
-    } | {
-      readonly _tag: "SelectionRequired";
-      readonly candidates: ReadonlyArray<Candidate>;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
-    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
-      readonly _tag: "NotFound";
-      readonly domain: DomainName;
-    } | {
-      readonly _tag: "Resolved";
-      readonly candidate: Candidate;
-      readonly provider: Interface$2;
-    } | {
-      readonly _tag: "SelectionRequired";
-      readonly candidates: ReadonlyArray<Candidate>;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "NotFound";
-      readonly domain: DomainName;
-    } | {
-      readonly _tag: "Resolved";
-      readonly candidate: Candidate;
-      readonly provider: Interface$2;
-    } | {
-      readonly _tag: "SelectionRequired";
-      readonly candidates: ReadonlyArray<Candidate>;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
-  };
-  readonly NotFound: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "NotFound";
-    readonly domain: DomainName;
-  }, "_tag">;
-  readonly Resolved: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Resolved";
-    readonly candidate: Candidate;
-    readonly provider: Interface$2;
-  }, "_tag">;
-  readonly SelectionRequired: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "SelectionRequired";
-    readonly candidates: ReadonlyArray<Candidate>;
-  }, "_tag">;
-};
-interface Interface {
-  readonly discover: (domain: DomainName) => Effect.Effect<Outcome, Error$2>;
-}
-declare const Service_base: Context.ServiceClass<Service, "@domainkit/ZoneDiscovery", Interface>;
-declare class Service extends Service_base {}
-/** Compose provider-account discovery sources without expanding the record-provider contract. */
-declare function make(sources: ReadonlyArray<Source>): Interface;
-//#endregion
-export { IntegrationMethod as $, lifecycle_repository_d_exports as A, Type as At, encode$1 as B, invalid_input_d_exports as Bt, Envelope as C, Ns as Ct, Error$1 as D, Schema$4 as Dt, DetachResult as E, RequirementMetadata as Et, Schema$1 as F, DomainName as Ft, EvidenceSchema as G, Capability as H, StoredCredential as I, Schema$5 as It, authorization_d_exports as J, ProviderAuthorization as K, assertGrant as L, domain_name_d_exports as Lt, Connection as M, dns_record_d_exports as Mt, Grant as N, equals as Nt, Interface$1 as O, Srv as Ot, OAuthContinuation as P, parse as Pt, AsyncOAuthSubjectResolver as Q, authorizationError as R, parse$1 as Rt, Codec as S, Mx as St, Aggregate as T, Opaque as Tt, CapabilityEvidence as U, validate as V, Evidence as W, CryptoError as X, encode$2 as Y, canonical_json_d_exports as Z, Requirements as _, Aaaa as _t, Authentication as a, Schema$3 as at, extend as b, DnsRecord as bt, CompleteInput as c, Value as ct, Error as d, CreateResult as dt, Manifest as et, ExtendInput as f, Error$2 as ft, Method as g, A as gt, InteractiveStart as h, provider_d_exports as ht, zone_discovery_d_exports as i, OAuthSubjectResolver as it, AuthorizationError as j, data as jt, Service$1 as k, Txt as kt, Continuation as l, secret_d_exports as lt, InteractiveFlow as m, Service$2 as mt, Service as n, OAuthClientConfiguration as nt, AuthenticationFailure as o, TokenValidation as ot, Failure as p, Interface$2 as pt, Schema$2 as q, Source as r, OAuthMethod as rt, BaseInput as s, manifest_d_exports as st, Candidate as t, Method$1 as tt, ContinuationStore as u, AsyncInterface as ut, StartResult as v, Caa as vt, provider_context_d_exports as w, Observed as wt, start as x, Encoded as xt, complete as y, Cname as yt, decode$1 as z, Error$3 as zt };
-//# sourceMappingURL=zone-discovery-BPnH3sLU.d.mts.map