domainkit 0.2.2 → 0.3.0

package/dist/{resolver-Dc0hwV-J.d.mts → resolver-uqe1h5Vz.d.mts}

@@ -1,5 +1,1493 @@
-import { At as Type, Ft as DomainName, X as CryptoError, bt as DnsRecord, ft as Error$3, mt as Service$1, n as Service$2, t as Candidate, xt as Encoded, zt as Error$2 } from "./zone-discovery-BPnH3sLU.mjs";
 import { Cause, Context, Crypto, Data, Effect, Layer, Schema } from "effect";
+import * as oauth from "oauth4webapi";
+declare namespace invalid_input_d_exports {
+  export { Error$5 as Error };
+}
+declare const Error_base$5: Schema.Class<Error$5, Schema.TaggedStruct<"InvalidInputError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$5 extends Error_base$5 {}
+declare namespace domain_name_d_exports {
+  export { DomainName, Schema$6 as Schema, decode$6 as decode, parse$1 as parse };
+}
+declare const Type$1: Schema.brand<Schema.String, "DomainName">;
+/** A lower-case, fully qualified DNS name without a trailing dot. */
+type DomainName = typeof Type$1.Type;
+/** Decodes user and wire strings into canonical domain names. */
+declare const Schema$6: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+declare const decode$6: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$5, never>;
+declare function parse$1(input: unknown): DomainName;
+declare namespace secret_d_exports {
+  export { Value, make$1 as make };
+}
+/** A deliberately non-serializable credential value. */
+declare class Value {
+  #private;
+  private constructor();
+  static from(value: string): Value;
+  expose(): string;
+  toJSON(): string;
+  toString(): string;
+}
+declare const make$1: typeof Value.from;
+declare namespace dns_record_d_exports {
+  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$5 as Schema, Srv, Txt, Type, data, decode$5 as decode, equals, parse };
+}
+declare const Type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
+type Type = typeof Type.Type;
+declare const RequirementMetadata: Schema.Struct<{
+  readonly ownership: Schema.String;
+  readonly provenance: Schema.String;
+  readonly purpose: Schema.String;
+}>;
+interface RequirementMetadata extends Schema.Schema.Type<typeof RequirementMetadata> {}
+declare const Schema$5: Schema.TaggedUnion<{
+  readonly A: Schema.TaggedStruct<"A", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly AAAA: Schema.TaggedStruct<"AAAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly CAA: Schema.TaggedStruct<"CAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly flags: Schema.Int;
+    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+    readonly value: Schema.String;
+  }>;
+  readonly CNAME: Schema.TaggedStruct<"CNAME", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly policy: Schema.Literal<"exclusive">;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly MX: Schema.TaggedStruct<"MX", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly priority: Schema.Int;
+  }>;
+  readonly NS: Schema.TaggedStruct<"NS", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly SRV: Schema.TaggedStruct<"SRV", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly port: Schema.Int;
+    readonly priority: Schema.Int;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly weight: Schema.Int;
+  }>;
+  readonly TXT: Schema.TaggedStruct<"TXT", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly value: Schema.String;
+  }>;
+}>;
+declare const A: Schema.TaggedStruct<"A", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly address: Schema.String;
+}>, Aaaa: Schema.TaggedStruct<"AAAA", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly address: Schema.String;
+}>, Caa: Schema.TaggedStruct<"CAA", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly flags: Schema.Int;
+  readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+  readonly value: Schema.String;
+}>, Cname: Schema.TaggedStruct<"CNAME", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly policy: Schema.Literal<"exclusive">;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>, Mx: Schema.TaggedStruct<"MX", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly priority: Schema.Int;
+}>, Ns: Schema.TaggedStruct<"NS", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>, Srv: Schema.TaggedStruct<"SRV", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly port: Schema.Int;
+  readonly priority: Schema.Int;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly weight: Schema.Int;
+}>, Txt: Schema.TaggedStruct<"TXT", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly value: Schema.String;
+}>;
+type DnsRecord = typeof Schema$5.Type;
+type Encoded = typeof Schema$5.Encoded;
+/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
+declare const Opaque: Schema.Struct<{
+  readonly _tag: Schema.Literal<"Opaque">;
+  readonly name: Schema.String;
+  readonly providerRecordId: Schema.NullOr<Schema.String>;
+  readonly providerType: Schema.String;
+}>;
+interface Opaque extends Schema.Schema.Type<typeof Opaque> {}
+/** Any DNS record observed through a provider, including non-portable record types. */
+declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
+  readonly A: Schema.TaggedStruct<"A", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly AAAA: Schema.TaggedStruct<"AAAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly CAA: Schema.TaggedStruct<"CAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly flags: Schema.Int;
+    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+    readonly value: Schema.String;
+  }>;
+  readonly CNAME: Schema.TaggedStruct<"CNAME", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly policy: Schema.Literal<"exclusive">;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly MX: Schema.TaggedStruct<"MX", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly priority: Schema.Int;
+  }>;
+  readonly NS: Schema.TaggedStruct<"NS", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly SRV: Schema.TaggedStruct<"SRV", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly port: Schema.Int;
+    readonly priority: Schema.Int;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly weight: Schema.Int;
+  }>;
+  readonly TXT: Schema.TaggedStruct<"TXT", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly value: Schema.String;
+  }>;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"Opaque">;
+  readonly name: Schema.String;
+  readonly providerRecordId: Schema.NullOr<Schema.String>;
+  readonly providerType: Schema.String;
+}>]>;
+type Observed = typeof Observed.Type;
+declare const decode$5: (input: unknown) => Effect.Effect<{
+  readonly _tag: "A";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+} | {
+  readonly _tag: "AAAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+} | {
+  readonly _tag: "CAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly flags: number;
+  readonly tag: "iodef" | "issue" | "issuewild";
+  readonly value: string;
+} | {
+  readonly _tag: "CNAME";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly ttl: number | null;
+  readonly policy: "exclusive";
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+} | {
+  readonly _tag: "MX";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+  readonly priority: number;
+} | {
+  readonly _tag: "NS";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+} | {
+  readonly _tag: "SRV";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly port: number;
+  readonly priority: number;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+  readonly weight: number;
+} | {
+  readonly _tag: "TXT";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly value: string;
+}, Error$5, never>;
+declare function parse(input: unknown): DnsRecord;
+declare function data(record: DnsRecord): Readonly<Record<string, number | string>>;
+declare function equals(left: DnsRecord, right: DnsRecord): boolean;
+declare namespace provider_d_exports {
+  export { AsyncInterface$1 as AsyncInterface, CreateResult$1 as CreateResult, Error$4 as Error, ErrorReason, Interface$3 as Interface, Service$3 as Service, fromAsync, layerFromAsync$1 as layerFromAsync, toAsync$1 as toAsync };
+}
+interface CreateResult$1 {
+  readonly providerRecordId: string | null;
+}
+declare const ErrorReason: Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>;
+type ErrorReason = typeof ErrorReason.Type;
+declare const Error_base$4: Schema.Class<Error$4, Schema.TaggedStruct<"ProviderError", {
+  readonly cause: Schema.optionalKey<Schema.Unknown>;
+  readonly code: Schema.optionalKey<Schema.Union<readonly [Schema.Number, Schema.String]>>;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly providerId: Schema.String;
+  readonly reason: Schema.optionalKey<Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>>;
+  readonly retryAfterMs: Schema.optionalKey<Schema.Number>;
+  readonly status: Schema.optionalKey<Schema.Number>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$4 extends Error_base$4 {}
+/** The provider capability used by DNS planning, application, and verification. */
+interface Interface$3 {
+  readonly id: string;
+  readonly createRecord: (zone: DomainName, record: DnsRecord) => Effect.Effect<CreateResult$1, Error$4>;
+  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<void, Error$4>;
+  readonly getRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<Observed | null, Error$4>;
+  readonly listRecords: (zone: DomainName) => Effect.Effect<ReadonlyArray<Observed>, Error$4>;
+}
+declare const Service_base$3: Context.ServiceClass<Service$3, "@domainkit/DnsProvider", Interface$3>;
+declare class Service$3 extends Service_base$3 {}
+/** Minimal Promise-shaped provider contract for hosts that do not use Effect directly. */
+interface AsyncInterface$1 {
+  readonly id: string;
+  readonly createRecord: (zone: DomainName, record: DnsRecord) => Promise<CreateResult$1>;
+  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Promise<void>;
+  readonly getRecord: (zone: DomainName, providerRecordId: string) => Promise<Observed | null>;
+  readonly listRecords: (zone: DomainName) => Promise<ReadonlyArray<Observed>>;
+}
+declare const fromAsync: (provider: AsyncInterface$1) => Interface$3;
+declare const layerFromAsync$1: (provider: AsyncInterface$1) => Layer.Layer<Service$3>;
+declare const toAsync$1: (provider: Interface$3) => AsyncInterface$1;
+declare namespace manifest_d_exports {
+  export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method$1 as Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$4 as Schema, TokenValidation, decode$4 as decode };
+}
+declare const Method$1: Schema.TaggedUnion<{
+  readonly integration: Schema.TaggedStruct<"integration", {
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly installUrl: Schema.String;
+    readonly tokenEndpoint: Schema.String;
+  }>;
+  readonly oauth2: Schema.TaggedStruct<"oauth2", {
+    readonly authorizationServer: Schema.Struct<{
+      readonly authorization_endpoint: Schema.String;
+      readonly issuer: Schema.String;
+      readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
+      readonly token_endpoint: Schema.String;
+    }>;
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+    readonly scopes: Schema.$Array<Schema.String>;
+  }>;
+  readonly token: Schema.TaggedStruct<"token", {
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly instructionsUrl: Schema.String;
+  }>;
+}>;
+declare const Schema$4: Schema.Struct<{
+  readonly methods: Schema.$Array<Schema.TaggedUnion<{
+    readonly integration: Schema.TaggedStruct<"integration", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly installUrl: Schema.String;
+      readonly tokenEndpoint: Schema.String;
+    }>;
+    readonly oauth2: Schema.TaggedStruct<"oauth2", {
+      readonly authorizationServer: Schema.Struct<{
+        readonly authorization_endpoint: Schema.String;
+        readonly issuer: Schema.String;
+        readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
+        readonly token_endpoint: Schema.String;
+      }>;
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+      readonly scopes: Schema.$Array<Schema.String>;
+    }>;
+    readonly token: Schema.TaggedStruct<"token", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly instructionsUrl: Schema.String;
+    }>;
+  }>>;
+  readonly providerId: Schema.String;
+}>;
+interface Manifest extends Schema.Schema.Type<typeof Schema$4> {}
+type OAuthMethod = Extract<Manifest["methods"][number], {
+  readonly _tag: "oauth2";
+}>;
+/** A provider-owned installation flow that returns a credential from a one-time code. */
+type IntegrationMethod = Extract<Manifest["methods"][number], {
+  readonly _tag: "integration";
+}>;
+declare const decode$4: (input: unknown) => Effect.Effect<{
+  readonly methods: readonly ({
+    readonly _tag: "integration";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly installUrl: string;
+    readonly tokenEndpoint: string;
+  } | {
+    readonly _tag: "oauth2";
+    readonly authorizationServer: {
+      readonly authorization_endpoint: string;
+      readonly issuer: string;
+      readonly revocation_endpoint?: string;
+      readonly token_endpoint: string;
+    };
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly clientAuth: "client_secret_basic" | "client_secret_post" | "none";
+    readonly scopes: readonly string[];
+  } | {
+    readonly _tag: "token";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly instructionsUrl: string;
+  })[];
+  readonly providerId: string;
+}, Error$5, never>;
+interface OAuthClientConfiguration {
+  readonly clientId: string;
+  readonly clientSecret?: Value;
+}
+interface TokenValidation {
+  readonly accountId: string;
+  readonly capabilities: ReadonlyArray<"dns:read" | "dns:write">;
+  readonly expiresAt: Date | null;
+  readonly scopes: ReadonlyArray<string>;
+}
+interface OAuthSubjectResolver {
+  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Effect.Effect<{
+    readonly accountId: string;
+    readonly expiresAt: Date | null;
+  }, Error$4>;
+}
+interface AsyncOAuthSubjectResolver {
+  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Promise<{
+    readonly accountId: string;
+    readonly expiresAt: Date | null;
+  }>;
+}
+declare namespace authorization_d_exports {
+  export { Capability, CapabilityEvidence, Evidence, EvidenceSchema, ProviderAuthorization, Revocation, Schema$3 as Schema, decode$3 as decode, encode$3 as encode, evidenceFor, validate$3 as validate };
+}
+declare const Capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
+type Capability = typeof Capability.Type;
+type Evidence = Data.TaggedEnum<{
+  Declared: {};
+  Exercised: {
+    readonly observedAt: Date;
+  };
+  Introspected: {
+    readonly observedAt: Date;
+  };
+}>;
+declare const Evidence: {
+  readonly $is: <Tag extends "Declared" | "Exercised" | "Introspected">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "Declared";
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Exercised";
+    readonly observedAt: Date;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Introspected";
+    readonly observedAt: Date;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
+    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
+  };
+  readonly Declared: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Declared";
+  }, "_tag">;
+  readonly Exercised: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Exercised";
+    readonly observedAt: Date;
+  }, "_tag">;
+  readonly Introspected: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Introspected";
+    readonly observedAt: Date;
+  }, "_tag">;
+};
+declare const EvidenceSchema: Schema.TaggedUnion<{
+  readonly Declared: Schema.TaggedStruct<"Declared", {}>;
+  readonly Exercised: Schema.TaggedStruct<"Exercised", {
+    readonly observedAt: Schema.DateFromString;
+  }>;
+  readonly Introspected: Schema.TaggedStruct<"Introspected", {
+    readonly observedAt: Schema.DateFromString;
+  }>;
+}>;
+declare const CapabilityEvidence: Schema.Struct<{
+  readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
+  readonly evidence: Schema.TaggedUnion<{
+    readonly Declared: Schema.TaggedStruct<"Declared", {}>;
+    readonly Exercised: Schema.TaggedStruct<"Exercised", {
+      readonly observedAt: Schema.DateFromString;
+    }>;
+    readonly Introspected: Schema.TaggedStruct<"Introspected", {
+      readonly observedAt: Schema.DateFromString;
+    }>;
+  }>;
+}>;
+interface CapabilityEvidence extends Schema.Schema.Type<typeof CapabilityEvidence> {}
+declare const Revocation: Schema.TaggedUnion<{
+  readonly Active: Schema.TaggedStruct<"Active", {}>;
+  readonly Pending: Schema.TaggedStruct<"Pending", {
+    readonly requestedAt: Schema.DateFromString;
+  }>;
+}>;
+type Revocation = typeof Revocation.Type;
+/** A provider credential authorization shared by one or more owner connections. */
+declare const Schema$3: Schema.Struct<{
+  readonly authorizedById: Schema.String;
+  readonly capabilityEvidence: Schema.$Array<Schema.Struct<{
+    readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
+    readonly evidence: Schema.TaggedUnion<{
+      readonly Declared: Schema.TaggedStruct<"Declared", {}>;
+      readonly Exercised: Schema.TaggedStruct<"Exercised", {
+        readonly observedAt: Schema.DateFromString;
+      }>;
+      readonly Introspected: Schema.TaggedStruct<"Introspected", {
+        readonly observedAt: Schema.DateFromString;
+      }>;
+    }>;
+  }>>;
+  readonly createdAt: Schema.DateFromString;
+  readonly expiresAt: Schema.NullOr<Schema.DateFromString>;
+  readonly id: Schema.String;
+  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
+  readonly providerAccountId: Schema.String;
+  readonly providerContext: Schema.Struct<{
+    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    readonly version: Schema.String;
+  }>;
+  readonly providerId: Schema.String;
+  readonly requiredCapabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+  readonly revocation: Schema.TaggedUnion<{
+    readonly Active: Schema.TaggedStruct<"Active", {}>;
+    readonly Pending: Schema.TaggedStruct<"Pending", {
+      readonly requestedAt: Schema.DateFromString;
+    }>;
+  }>;
+  readonly scopes: Schema.$Array<Schema.String>;
+}>;
+interface ProviderAuthorization extends Schema.Schema.Type<typeof Schema$3> {}
+declare const decode$3: (input: unknown) => Effect.Effect<{
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  readonly createdAt: Date;
+  readonly expiresAt: Date | null;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerAccountId: string;
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+  readonly scopes: readonly string[];
+}, Error$5, never>;
+declare const validate$3: (input: unknown) => Effect.Effect<{
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  readonly createdAt: Date;
+  readonly expiresAt: Date | null;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerAccountId: string;
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+  readonly scopes: readonly string[];
+}, Error$5, never>;
+declare const encode$3: (input: {
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  readonly createdAt: Date;
+  readonly expiresAt: Date | null;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerAccountId: string;
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+  readonly scopes: readonly string[];
+}, options?: import("effect/SchemaAST").ParseOptions) => {
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: string;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: string;
+    };
+  }[];
+  readonly createdAt: string;
+  readonly expiresAt: string | null;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerAccountId: string;
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: string;
+  };
+  readonly scopes: readonly string[];
+};
+declare function evidenceFor(authorization: ProviderAuthorization, capability: Capability): Evidence | undefined;
+//#endregion
+//#region src/auth/connection.d.ts
+declare const Grant: Schema.TaggedUnion<{
+  readonly account: Schema.TaggedStruct<"account", {
+    readonly excludedDomains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+  }>;
+  readonly domains: Schema.TaggedStruct<"domains", {
+    readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+  }>;
+}>;
+type Grant = typeof Grant.Type;
+/** Returns whether a grant includes one parsed domain. */
+declare const coversDomain: (grant: Grant, domain: DomainName) => boolean;
+/** Expands a grant to include the requested domains. */
+declare const includeDomains: (current: Grant | undefined, requested: Grant) => Grant;
+/** Contracts a grant so it no longer includes one parsed domain. */
+declare const removeDomain$1: (grant: Grant, domain: DomainName) => Grant;
+/** An owner-scoped grant bound to one provider authorization. */
+declare const Schema$2: Schema.Struct<{
+  readonly authorizationId: Schema.String;
+  readonly createdAt: Schema.DateFromString;
+  readonly grant: Schema.TaggedUnion<{
+    readonly account: Schema.TaggedStruct<"account", {
+      readonly excludedDomains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+    }>;
+    readonly domains: Schema.TaggedStruct<"domains", {
+      readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+    }>;
+  }>;
+  readonly id: Schema.String;
+  readonly ownerId: Schema.String;
+}>;
+interface Connection extends Schema.Schema.Type<typeof Schema$2> {}
+declare const decode$2: (input: unknown) => Effect.Effect<{
+  readonly authorizationId: string;
+  readonly createdAt: Date;
+  readonly grant: {
+    readonly _tag: "account";
+    readonly excludedDomains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
+  } | {
+    readonly _tag: "domains";
+    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
+  };
+  readonly id: string;
+  readonly ownerId: string;
+}, Error$5, never>;
+declare const validate$2: (input: unknown) => Effect.Effect<{
+  readonly authorizationId: string;
+  readonly createdAt: Date;
+  readonly grant: {
+    readonly _tag: "account";
+    readonly excludedDomains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
+  } | {
+    readonly _tag: "domains";
+    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
+  };
+  readonly id: string;
+  readonly ownerId: string;
+}, Error$5, never>;
+declare const encode$2: (input: {
+  readonly authorizationId: string;
+  readonly createdAt: Date;
+  readonly grant: {
+    readonly _tag: "account";
+    readonly excludedDomains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
+  } | {
+    readonly _tag: "domains";
+    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
+  };
+  readonly id: string;
+  readonly ownerId: string;
+}, options?: import("effect/SchemaAST").ParseOptions) => {
+  readonly authorizationId: string;
+  readonly createdAt: string;
+  readonly grant: {
+    readonly _tag: "account";
+    readonly excludedDomains: readonly string[];
+  } | {
+    readonly _tag: "domains";
+    readonly domains: readonly string[];
+  };
+  readonly id: string;
+  readonly ownerId: string;
+};
+interface OAuthContinuation {
+  readonly clientId: string;
+  readonly codeVerifier: Value;
+  readonly expiresAt: Date;
+  readonly grant: Grant;
+  readonly method: OAuthMethod;
+  readonly ownerId: string;
+  readonly redirectUri: string;
+  readonly stateHash: string;
+  readonly authorizedById: string;
+}
+interface StoredCredential {
+  readonly accessToken: Value;
+  readonly refreshToken: Value | null;
+  readonly tokenType: string;
+}
+declare const AuthorizationError_base$1: Schema.Class<AuthorizationError$1, Schema.TaggedStruct<"AuthorizationError", {
+  readonly category: Schema.Literal<"authorization">;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class AuthorizationError$1 extends AuthorizationError_base$1 {}
+declare const authorizationError: (message: string, operation: string) => AuthorizationError$1;
+declare function assertGrant(connection: Connection, authorization: ProviderAuthorization, request: {
+  readonly capability: Capability;
+  readonly domain: string;
+  readonly now?: Date;
+  readonly providerId: string;
+}): DomainName;
+declare namespace canonical_json_d_exports {
+  export { CryptoError, Json, sha256Encoded, sha256Json, sha256Text, stringify, webCryptoLayer };
+}
+declare const CryptoError_base: Schema.Class<CryptoError, Schema.TaggedStruct<"CryptoError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class CryptoError extends CryptoError_base {}
+type Json = null | boolean | number | string | ReadonlyArray<Json> | {
+  readonly [key: string]: Json;
+};
+/** Deterministic JSON serialization for already schema-encoded protocol values. */
+declare function stringify(value: Json): string;
+declare const sha256Text: (value: string) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
+declare const sha256Json: (value: Json) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
+declare const sha256Encoded: <S extends Schema.Constraint>(schema: S, value: S["Type"]) => Effect.Effect<string, CryptoError, Crypto.Crypto | S["EncodingServices"]>;
+/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
+declare const webCryptoLayer: Layer.Layer<Crypto.Crypto>;
+declare namespace lifecycle_repository_d_exports {
+  export { Aggregate, BindingModification, DetachResult, Error$3 as Error, Interface$2 as Interface, Service$2 as Service };
+}
+interface Aggregate {
+  readonly authorization: ProviderAuthorization;
+  readonly bindings: ReadonlyArray<Connection>;
+  readonly credential: StoredCredential;
+}
+interface DetachResult {
+  readonly authorizationId: string;
+  readonly remainingBindings: number;
+  readonly revokedAuthorization: boolean;
+}
+interface BindingModification<A> {
+  readonly aggregate: Aggregate;
+  readonly value: A;
+}
+declare const Error_base$3: Schema.Class<Error$3, Schema.TaggedStruct<"LifecycleRepositoryError", {
+  readonly category: Schema.Literal<"storage">;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$3 extends Error_base$3 {}
+interface Interface$2 {
+  readonly bind: (authorizationId: string, binding: Connection) => Effect.Effect<Aggregate, Error$3>;
+  readonly connect: (aggregate: Aggregate) => Effect.Effect<Aggregate, Error$3>;
+  readonly detach: <E>(input: {
+    readonly connectionId: string;
+    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;
+  }) => Effect.Effect<DetachResult, Error$3 | E>;
+  readonly findByProviderAccount: (providerId: string, providerAccountId: string) => Effect.Effect<Aggregate | null, Error$3>;
+  readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error$3>;
+  readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error$3>;
+  readonly modifyBinding: <A>(connectionId: string, modify: (binding: Connection) => {
+    readonly binding: Connection;
+    readonly value: A;
+  }) => Effect.Effect<BindingModification<A>, Error$3>;
+  readonly promoteEvidence: (authorizationId: string, evidence: ReadonlyArray<CapabilityEvidence>) => Effect.Effect<Aggregate, Error$3>;
+  readonly recover: <E>(input: {
+    readonly authorizationId: string;
+    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;
+  }) => Effect.Effect<DetachResult, Error$3 | E>;
+  readonly rotate: (authorizationId: string, credential: StoredCredential, expiresAt: Date | null) => Effect.Effect<Aggregate, Error$3>;
+}
+declare const Service_base$2: Context.ServiceClass<Service$2, "@domainkit/AuthorizationLifecycleRepository", Interface$2>;
+declare class Service$2 extends Service_base$2 {}
+declare namespace provider_context_d_exports {
+  export { Codec, Envelope, codec, decode$1 as decode, encode$1 as encode };
+}
+/** A provider-owned, versioned, non-secret context value persisted by the host. */
+declare const Envelope: Schema.Struct<{
+  readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  readonly version: Schema.String;
+}>;
+interface Envelope extends Schema.Schema.Type<typeof Envelope> {}
+interface Codec<A> {
+  readonly decode: (envelope: Envelope) => Effect.Effect<A, Error$5>;
+  readonly encode: (value: A) => Effect.Effect<Envelope, Error$5>;
+  readonly version: string;
+}
+/** Build an adapter-owned context codec from a schema and stable version identifier. */
+declare function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A>;
+declare const decode$1: (input: unknown) => Effect.Effect<{
+  readonly value: Schema.Json;
+  readonly version: string;
+}, Error$5, never>;
+declare const encode$1: (input: {
+  readonly value: Schema.Json;
+  readonly version: string;
+}, options?: import("effect/SchemaAST").ParseOptions) => {
+  readonly value: Schema.Json;
+  readonly version: string;
+};
+//#endregion
+//#region src/auth/connect.d.ts
+interface Authentication {
+  readonly capabilityEvidence: ReadonlyArray<CapabilityEvidence>;
+  readonly credential: StoredCredential;
+  readonly expiresAt: Date | null;
+  readonly providerAccountId: string;
+  readonly providerContext: Envelope;
+  readonly scopes: ReadonlyArray<string>;
+}
+type AuthenticationFailure = Error$2 | Error$5 | Error$4;
+interface InteractiveStart {
+  readonly authorizationUrl: URL;
+  readonly payload: Value;
+}
+interface Continuation extends BaseInput {
+  readonly expiresAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2";
+  readonly payload: Value;
+  readonly providerId: string;
+  readonly requiredCapabilities: ReadonlyArray<Capability>;
+}
+interface ContinuationStore {
+  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error$2>;
+  readonly put: (continuation: Continuation) => Effect.Effect<void, Error$2>;
+}
+interface InteractiveFlow {
+  readonly complete: (payload: Value, callbackUrl: URL) => Effect.Effect<Authentication, AuthenticationFailure>;
+  readonly method: "integration" | "oauth2";
+  readonly providerId: string;
+  readonly requiredCapabilities: ReadonlyArray<Capability>;
+  readonly start: (continuationId: string) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;
+}
+type Method = Data.TaggedEnum<{
+  Interactive: {
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  };
+  Token: {
+    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  };
+}>;
+declare const Method: {
+  readonly $is: <Tag extends "Interactive" | "Token">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "Interactive";
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Token";
+    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
+    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
+  };
+  readonly Interactive: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Interactive";
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  }, "_tag">;
+  readonly Token: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Token";
+    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  }, "_tag">;
+};
+type StartResult = Data.TaggedEnum<{
+  Connected: {
+    readonly aggregate: Aggregate;
+  };
+  Redirect: {
+    readonly authorizationUrl: URL;
+    readonly continuationId: string;
+  };
+}>;
+declare const StartResult: {
+  readonly $is: <Tag extends "Connected" | "Redirect">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "Connected";
+    readonly aggregate: Aggregate;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Redirect";
+    readonly authorizationUrl: URL;
+    readonly continuationId: string;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
+      readonly _tag: "Connected";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "Connected";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
+    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
+      readonly _tag: "Connected";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "Connected";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
+  };
+  readonly Connected: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Connected";
+    readonly aggregate: Aggregate;
+  }, "_tag">;
+  readonly Redirect: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Redirect";
+    readonly authorizationUrl: URL;
+    readonly continuationId: string;
+  }, "_tag">;
+};
+declare const Error_base$2: Schema.Class<Error$2, Schema.TaggedStruct<"ConnectionError", {
+  readonly category: Schema.Literals<readonly ["authorization", "provider", "validation"]>;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$2 extends Error_base$2 {}
+interface BaseInput {
+  readonly authorizedById: string;
+  readonly grant: Grant;
+  readonly ownerId: string;
+}
+interface CompleteInput {
+  readonly callbackUrl: URL;
+  readonly continuationId: string;
+  readonly continuations: ContinuationStore;
+  readonly flow: InteractiveFlow;
+}
+interface ExtendInput {
+  readonly connectionId: string;
+  readonly grant: Grant;
+  readonly ownerId: string;
+}
+interface RemoveDomainInput {
+  readonly connectionId: string;
+  readonly domain: string;
+  readonly ownerId: string;
+}
+type RemoveDomainResult = Data.TaggedEnum<{
+  AlreadyRemoved: {
+    readonly aggregate: Aggregate;
+  };
+  Removed: {
+    readonly aggregate: Aggregate;
+  };
+}>;
+declare const RemoveDomainResult: {
+  readonly $is: <Tag extends "AlreadyRemoved" | "Removed">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "AlreadyRemoved";
+    readonly aggregate: Aggregate;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Removed";
+    readonly aggregate: Aggregate;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "AlreadyRemoved" | "Removed"]: (args: Extract<{
+      readonly _tag: "AlreadyRemoved";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Removed";
+      readonly aggregate: Aggregate;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "AlreadyRemoved";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Removed";
+      readonly aggregate: Aggregate;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["AlreadyRemoved" | "Removed"]>>;
+    <Cases extends { readonly [Tag in "AlreadyRemoved" | "Removed"]: (args: Extract<{
+      readonly _tag: "AlreadyRemoved";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Removed";
+      readonly aggregate: Aggregate;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "AlreadyRemoved";
+      readonly aggregate: Aggregate;
+    } | {
+      readonly _tag: "Removed";
+      readonly aggregate: Aggregate;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["AlreadyRemoved" | "Removed"]>>;
+  };
+  readonly AlreadyRemoved: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "AlreadyRemoved";
+    readonly aggregate: Aggregate;
+  }, "_tag">;
+  readonly Removed: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Removed";
+    readonly aggregate: Aggregate;
+  }, "_tag">;
+};
+declare const start: (input: BaseInput & {
+  readonly method: Method;
+}) => Effect.Effect<{
+  readonly _tag: "Connected";
+  readonly aggregate: Aggregate;
+} | {
+  readonly _tag: "Redirect";
+  readonly authorizationUrl: URL;
+  readonly continuationId: string;
+}, Error$3 | AuthenticationFailure, Crypto.Crypto | Service$2>;
+declare const complete: (input: CompleteInput) => Effect.Effect<Aggregate, Error$3 | AuthenticationFailure, Crypto.Crypto | Service$2>;
+/** Extends one owner binding without repeating provider authentication. */
+declare const extend: (input: ExtendInput) => Effect.Effect<Aggregate, Error$3 | Error$2, Service$2>;
+/** Removes one domain from an owner binding without revoking provider authorization. */
+declare const removeDomain: (input: RemoveDomainInput) => Effect.Effect<{
+  readonly _tag: "AlreadyRemoved";
+  readonly aggregate: Aggregate;
+} | {
+  readonly _tag: "Removed";
+  readonly aggregate: Aggregate;
+}, Error$3 | Error$2, Service$2>;
+type Requirements$1 = Service$2 | Crypto.Crypto;
+type Failure = AuthenticationFailure | Error$3 | CryptoError;
+declare namespace zone_discovery_d_exports {
+  export { Candidate, Interface$1 as Interface, Outcome, Service$1 as Service, Source, make };
+}
+/** Display-safe identity and nameserver evidence for one provider-owned zone. */
+declare const Candidate: Schema.Struct<{
+  readonly accountId: Schema.String;
+  readonly id: Schema.String;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+  readonly providerId: Schema.String;
+  readonly status: Schema.Literals<readonly ["active", "pending", "unknown"]>;
+}>;
+interface Candidate extends Schema.Schema.Type<typeof Candidate> {}
+interface Source {
+  readonly listZones: (name: DomainName) => Effect.Effect<ReadonlyArray<Omit<Candidate, "providerId">>, Error$4>;
+  readonly provider: Interface$3;
+}
+type Outcome = Data.TaggedEnum<{
+  NotFound: {
+    readonly domain: DomainName;
+  };
+  Resolved: {
+    readonly candidate: Candidate;
+    readonly provider: Interface$3;
+  };
+  SelectionRequired: {
+    readonly candidates: ReadonlyArray<Candidate>;
+  };
+}>;
+declare const Outcome: {
+  readonly $is: <Tag extends "NotFound" | "Resolved" | "SelectionRequired">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "NotFound";
+    readonly domain: DomainName;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Resolved";
+    readonly candidate: Candidate;
+    readonly provider: Interface$3;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "SelectionRequired";
+    readonly candidates: ReadonlyArray<Candidate>;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate;
+      readonly provider: Interface$3;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate;
+      readonly provider: Interface$3;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
+    <Cases extends { readonly [Tag in "NotFound" | "Resolved" | "SelectionRequired"]: (args: Extract<{
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate;
+      readonly provider: Interface$3;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "NotFound";
+      readonly domain: DomainName;
+    } | {
+      readonly _tag: "Resolved";
+      readonly candidate: Candidate;
+      readonly provider: Interface$3;
+    } | {
+      readonly _tag: "SelectionRequired";
+      readonly candidates: ReadonlyArray<Candidate>;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["NotFound" | "Resolved" | "SelectionRequired"]>>;
+  };
+  readonly NotFound: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "NotFound";
+    readonly domain: DomainName;
+  }, "_tag">;
+  readonly Resolved: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Resolved";
+    readonly candidate: Candidate;
+    readonly provider: Interface$3;
+  }, "_tag">;
+  readonly SelectionRequired: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "SelectionRequired";
+    readonly candidates: ReadonlyArray<Candidate>;
+  }, "_tag">;
+};
+interface Interface$1 {
+  readonly discover: (domain: DomainName) => Effect.Effect<Outcome, Error$4>;
+}
+declare const Service_base$1: Context.ServiceClass<Service$1, "@domainkit/ZoneDiscovery", Interface$1>;
+declare class Service$1 extends Service_base$1 {}
+/** Compose provider-account discovery sources without expanding the record-provider contract. */
+declare function make(sources: ReadonlyArray<Source>): Interface$1;
 declare namespace types_d_exports {
   export { ApplyReceipt, Authorization$1 as Authorization, DnsPlan, Operation$1 as Operation, PlanAuthorization, Receipt$1 as Receipt, Schema$1 as Schema, decode, decodeReceipt, encode, encodeReceipt };
 }
@@ -840,11 +2328,6 @@ declare const decode: (input: unknown) => Effect.Effect<{
   readonly operations: readonly ({
     readonly _tag: "conflict";
     readonly existing: readonly ({
-      readonly _tag: "Opaque";
-      readonly name: string;
-      readonly providerRecordId: string | null;
-      readonly providerType: string;
-    } | {
       readonly _tag: "A";
       readonly metadata: {
         readonly ownership: string;
@@ -938,6 +2421,11 @@ declare const decode: (input: unknown) => Effect.Effect<{
       readonly policy: "append" | "exclusive";
       readonly ttl: number | null;
       readonly value: string;
+    } | {
+      readonly _tag: "Opaque";
+      readonly name: string;
+      readonly providerRecordId: string | null;
+      readonly providerType: string;
     })[];
     readonly id: string;
     readonly reason: string;
@@ -1237,17 +2725,12 @@ declare const decode: (input: unknown) => Effect.Effect<{
   readonly providerId: string;
   readonly version: "domainkit.dns-plan.v1";
   readonly zone: string & import("effect/Brand").Brand<"DomainName">;
-}, Error$2, never>;
+}, Error$5, never>;
 declare const encode: (input: {
   readonly digest: string;
   readonly operations: readonly ({
     readonly _tag: "conflict";
     readonly existing: readonly ({
-      readonly _tag: "Opaque";
-      readonly name: string;
-      readonly providerRecordId: string | null;
-      readonly providerType: string;
-    } | {
       readonly _tag: "A";
       readonly metadata: {
         readonly ownership: string;
@@ -1341,6 +2824,11 @@ declare const encode: (input: {
       readonly policy: "append" | "exclusive";
       readonly ttl: number | null;
       readonly value: string;
+    } | {
+      readonly _tag: "Opaque";
+      readonly name: string;
+      readonly providerRecordId: string | null;
+      readonly providerType: string;
     })[];
     readonly id: string;
     readonly reason: string;
@@ -2054,7 +3542,7 @@ declare const decodeReceipt: (input: unknown) => Effect.Effect<{
   readonly status: "complete" | "partial";
   readonly version: "domainkit.apply-receipt.v1";
   readonly zone: string & import("effect/Brand").Brand<"DomainName">;
-}, Error$2, never>;
+}, Error$5, never>;
 declare const encodeReceipt: (input: {
   readonly appliedAt: Date;
   readonly operations: readonly {
@@ -2286,12 +3774,12 @@ interface ApplyInput {
   readonly authorization: PlanAuthorization;
   readonly plan: DnsPlan;
 }
-type CreateError$1 = Error$2 | Error$3 | CryptoError;
+type CreateError$1 = Error$5 | Error$4 | CryptoError;
 type AuthorizeError = AuthorizationError | CryptoError;
-type ApplyError$1 = Error$2 | Error$3 | CryptoError | AuthorizationError | ConflictError | StaleError | PartialApplyError;
+type ApplyError$1 = Error$5 | Error$4 | CryptoError | AuthorizationError | ConflictError | StaleError | PartialApplyError;
 /** Builds a deterministic DNS plan through an exact or discoverable authoritative-zone target. */
-declare function create$1(input: ExactCreateInput): Effect.Effect<ResolvedCreateResult, CreateError$1, Crypto.Crypto | Service$1>;
-declare function create$1(input: DiscoverCreateInput): Effect.Effect<CreateResult, CreateError$1, Crypto.Crypto | Service$2>;
+declare function create$1(input: ExactCreateInput): Effect.Effect<ResolvedCreateResult, CreateError$1, Crypto.Crypto | Service$3>;
+declare function create$1(input: DiscoverCreateInput): Effect.Effect<CreateResult, CreateError$1, Crypto.Crypto | Service$1>;
 /** Authorizes all or a selected subset of create operations in a digest-bound plan. */
 declare const authorize$1: (plan: DnsPlan, operationIds?: readonly string[] | undefined, options?: {
   readonly allowPartial?: boolean;
@@ -2302,7 +3790,7 @@ declare const authorize$1: (plan: DnsPlan, operationIds?: readonly string[] | un
   version: "domainkit.plan-authorization.v1";
 }, AuthorizeError, Crypto.Crypto>;
 /** Applies approved creates sequentially after full and per-operation revalidation. */
-declare const apply$1: (input: ApplyInput) => Effect.Effect<ApplyReceipt, AuthorizationError | ConflictError | CryptoError | Error$2 | Error$3 | PartialApplyError | StaleError, Crypto.Crypto | Service$1>;
+declare const apply$1: (input: ApplyInput) => Effect.Effect<ApplyReceipt, AuthorizationError | ConflictError | CryptoError | Error$5 | Error$4 | PartialApplyError | StaleError, Crypto.Crypto | Service$3>;
 declare function renderManualInstructions(plan: DnsPlan): ReadonlyArray<string>;
 declare function validate$1(plan: DnsPlan): Effect.Effect<void, AuthorizeError, Crypto.Crypto>;
 declare namespace deletion_d_exports {
@@ -2673,7 +4161,7 @@ declare const create: (input: CreateInput) => Effect.Effect<{
   version: "domainkit.deletion-plan.v1";
   zone: string & import("effect/Brand").Brand<"DomainName">;
   digest: string;
-}, Error$3 | Error$1 | AuthorizeError, Crypto.Crypto | Service$1>;
+}, Error$4 | Error$1 | AuthorizeError, Crypto.Crypto | Service$3>;
 /** Produce a separate digest-bound consent artifact for destructive operations. */
 declare const authorize: (plan: Plan, operationIds?: readonly string[] | undefined) => Effect.Effect<{
   operationIds: string[];
@@ -2685,11 +4173,11 @@ declare const apply: (input: {
   readonly authorization: Authorization;
   readonly plan: Plan;
   readonly priorReceipt?: Receipt;
-}) => Effect.Effect<Receipt, CryptoError | Error$3 | Error$1 | PartialError, Crypto.Crypto | Service$1>;
+}) => Effect.Effect<Receipt, CryptoError | Error$4 | Error$1 | PartialError, Crypto.Crypto | Service$3>;
 declare function validate(plan: Plan): Effect.Effect<void, Error$1 | CryptoError, Crypto.Crypto>;
-type CreateError = Error$1 | Error$2 | AuthorizationError | Error$3 | CryptoError;
-type ApplyError = Error$1 | PartialError | Error$3 | CryptoError;
-type Requirements = Service$1 | Crypto.Crypto;
+type CreateError = Error$1 | Error$5 | AuthorizationError | Error$4 | CryptoError;
+type ApplyError = Error$1 | PartialError | Error$4 | CryptoError;
+type Requirements = Service$3 | Crypto.Crypto;
 declare namespace resolver_d_exports {
   export { Answer, AsyncInterface, AsyncResolution, Error, Interface, Query, Resolution, Service, layerFromAsync, toAsync };
 }
@@ -2740,5 +4228,5 @@ interface AsyncInterface {
 declare const layerFromAsync: (resolver: AsyncInterface) => Layer.Layer<Service>;
 declare const toAsync: (resolver: Interface) => AsyncInterface;
 //#endregion
-export { renderManualInstructions as A, types_d_exports as B, DiscoverCreateInput as C, StaleError as D, ResolvedCreateResult as E, PlanAuthorization as F, Receipt$1 as I, Schema$1 as L, Authorization$1 as M, DnsPlan as N, Target as O, Operation$1 as P, encode as R, CreateResult as S, PartialApplyError as T, Receipt as _, Interface as a, AuthorizeError as b, Service as c, Authorization as d, CreateError as f, Plan as g, PartialError as h, Error as i, ApplyReceipt as j, plan_d_exports as k, resolver_d_exports as l, Operation as m, AsyncInterface as n, Query as o, Error$1 as p, AsyncResolution as r, Resolution as s, Answer as t, ApplyError as u, deletion_d_exports as v, ExactCreateInput as w, ConflictError as x, AuthorizationError as y, encodeReceipt as z };
-//# sourceMappingURL=resolver-Dc0hwV-J.d.mts.map
+export { InteractiveFlow as $, manifest_d_exports as $t, renderManualInstructions as A, parse$1 as An, coversDomain as At, types_d_exports as B, ProviderAuthorization as Bt, DiscoverCreateInput as C, equals as Cn, Connection as Ct, StaleError as D, DomainName as Dn, StoredCredential as Dt, ResolvedCreateResult as E, secret_d_exports as En, Schema$2 as Et, PlanAuthorization as F, validate$2 as Ft, AuthenticationFailure as G, IntegrationMethod as Gt, Source as H, authorization_d_exports as Ht, Receipt$1 as I, Capability as It, Continuation as J, OAuthClientConfiguration as Jt, BaseInput as K, Manifest as Kt, Schema$1 as L, CapabilityEvidence as Lt, Authorization$1 as M, invalid_input_d_exports as Mn, encode$2 as Mt, DnsPlan as N, includeDomains as Nt, Target as O, Schema$6 as On, assertGrant as Ot, Operation$1 as P, removeDomain$1 as Pt, Failure as Q, TokenValidation as Qt, encode as R, Evidence as Rt, CreateResult as S, dns_record_d_exports as Sn, AuthorizationError$1 as St, PartialApplyError as T, Value as Tn, OAuthContinuation as Tt, zone_discovery_d_exports as U, encode$3 as Ut, Candidate as V, Schema$3 as Vt, Authentication as W, AsyncOAuthSubjectResolver as Wt, Error$2 as X, OAuthSubjectResolver as Xt, ContinuationStore as Y, OAuthMethod as Yt, ExtendInput as Z, Schema$4 as Zt, Receipt as _, Schema$5 as _n, Interface$2 as _t, Interface as a, provider_d_exports as an, StartResult as at, AuthorizeError as b, Type as bn, CryptoError as bt, Service as c, Caa as cn, removeDomain as ct, Authorization as d, Encoded as dn, Envelope as dt, AsyncInterface$1 as en, InteractiveStart as et, CreateError as f, Mx as fn, provider_context_d_exports as ft, Plan as g, RequirementMetadata as gn, Error$3 as gt, PartialError as h, Opaque as hn, DetachResult as ht, Error as i, Service$3 as in, Requirements$1 as it, ApplyReceipt as j, Error$5 as jn, decode$2 as jt, plan_d_exports as k, domain_name_d_exports as kn, authorizationError as kt, resolver_d_exports as l, Cname as ln, start as lt, Operation as m, Observed as mn, BindingModification as mt, AsyncInterface as n, Error$4 as nn, RemoveDomainInput as nt, Query as o, A as on, complete as ot, Error$1 as p, Ns as pn, Aggregate as pt, CompleteInput as q, Method$1 as qt, AsyncResolution as r, Interface$3 as rn, RemoveDomainResult as rt, Resolution as s, Aaaa as sn, extend as st, Answer as t, CreateResult$1 as tn, Method as tt, ApplyError as u, DnsRecord as un, Codec as ut, deletion_d_exports as v, Srv as vn, Service$2 as vt, ExactCreateInput as w, parse as wn, Grant as wt, ConflictError as x, data as xn, canonical_json_d_exports as xt, AuthorizationError as y, Txt as yn, lifecycle_repository_d_exports as yt, encodeReceipt as z, EvidenceSchema as zt };
+//# sourceMappingURL=resolver-uqe1h5Vz.d.mts.map