domainkit 0.2.2 → 0.3.1

package/dist/auth-g-waCHcz.mjs

@@ -1,671 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { E as decode$2, c as Opaque, h as decode$3, y as Error } from "./dns-record-BLeqo56C.mjs";
-import { g as Method, h as Error$1, p as make$1, r as Evidence, u as codec } from "./authorization-OeaSR47S.mjs";
-import { Clock, Effect, Schema } from "effect";
-//#region src/providers/vercel/protocol.ts
-const Pagination = Schema.Struct({
-	count: Schema.Number,
-	next: Schema.NullOr(Schema.Number),
-	prev: Schema.NullOr(Schema.Number)
-});
-const ErrorDetail = Schema.Struct({
-	code: Schema.String,
-	message: Schema.String,
-	limit: Schema.optionalKey(Schema.Struct({
-		remaining: Schema.Number,
-		reset: Schema.optionalKey(Schema.Number),
-		resetMs: Schema.optionalKey(Schema.Number),
-		total: Schema.Number
-	}))
-});
-const ErrorEnvelope = Schema.Struct({ error: ErrorDetail });
-const User = Schema.Struct({
-	id: Schema.String,
-	name: Schema.NullOr(Schema.String),
-	username: Schema.String
-});
-const UserEnvelope = Schema.Struct({ user: User });
-const Team = Schema.Struct({
-	id: Schema.String,
-	name: Schema.NullOr(Schema.String),
-	slug: Schema.String
-});
-const TeamListEnvelope = Schema.Struct({
-	pagination: Pagination,
-	teams: Schema.Array(Team)
-});
-const Domain = Schema.Struct({
-	id: Schema.String,
-	intendedNameservers: Schema.Array(Schema.String),
-	name: Schema.String,
-	nameservers: Schema.Array(Schema.String),
-	serviceType: Schema.Literals([
-		"zeit.world",
-		"external",
-		"na"
-	]),
-	teamId: Schema.NullOr(Schema.String),
-	userId: Schema.String,
-	verified: Schema.Boolean,
-	zone: Schema.optionalKey(Schema.Boolean)
-});
-const DomainConfig = Schema.Struct({
-	misconfigured: Schema.Boolean,
-	serviceType: Schema.Literals([
-		"zeit.world",
-		"external",
-		"na"
-	])
-});
-const DomainEnvelope = Schema.Struct({ domain: Domain });
-const DomainListEnvelope = Schema.Struct({
-	domains: Schema.Array(Domain),
-	pagination: Pagination
-});
-const Record = Schema.Struct({
-	id: Schema.String,
-	mxPriority: Schema.optionalKey(Schema.Number),
-	name: Schema.String,
-	priority: Schema.optionalKey(Schema.Number),
-	ttl: Schema.optionalKey(Schema.Number),
-	type: Schema.String,
-	value: Schema.String
-});
-const RecordListEnvelope = Schema.Struct({
-	pagination: Schema.optionalKey(Pagination),
-	records: Schema.Array(Record)
-});
-const CreateRecordEnvelope = Schema.Struct({
-	uid: Schema.String,
-	updated: Schema.optionalKey(Schema.Number)
-});
-const IntegrationToken = Schema.Struct({
-	access_token: Schema.String,
-	installation_id: Schema.optionalKey(Schema.String),
-	team_id: Schema.NullOr(Schema.String),
-	token_type: Schema.optionalKey(Schema.String),
-	user_id: Schema.String
-});
-//#endregion
-//#region src/providers/vercel/records.ts
-const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(function* () {
-	const absolute = absoluteNameCandidate(zone, record.name);
-	const name = yield* decode$2(absolute).pipe(Effect.match({
-		onFailure: () => null,
-		onSuccess: (value) => value
-	}));
-	if (name === null) return yield* decodeOpaque(record, absolute);
-	const common = {
-		metadata: {
-			ownership: "provider",
-			provenance: "vercel",
-			purpose: "existing DNS record"
-		},
-		name,
-		policy: record.type === "CNAME" ? "exclusive" : "append",
-		ttl: record.ttl ?? 60
-	};
-	const fromRecord = (input) => decode$3(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
-	switch (record.type) {
-		case "A":
-		case "AAAA": return yield* fromRecord({
-			...common,
-			_tag: record.type,
-			address: record.value
-		});
-		case "CNAME":
-		case "NS": return yield* fromRecord({
-			...common,
-			_tag: record.type,
-			target: record.value
-		});
-		case "TXT": return yield* fromRecord({
-			...common,
-			_tag: "TXT",
-			value: record.value
-		});
-		case "MX": return yield* fromRecord({
-			...common,
-			_tag: "MX",
-			exchange: record.value,
-			priority: record.mxPriority ?? record.priority
-		});
-		case "CAA": {
-			const match = record.value.match(/^(\d{1,3})\s+(issue|issuewild|iodef)\s+(?:"((?:\\.|[^"])*)"|(\S.*))$/);
-			if (match === null) return yield* Effect.fail(failure$2("decodeRecord", "Vercel CAA record has an invalid value"));
-			return yield* fromRecord({
-				...common,
-				_tag: "CAA",
-				flags: Number(match[1]),
-				tag: match[2],
-				value: unescapeQuoted(match[3] ?? match[4] ?? "")
-			});
-		}
-		case "SRV": {
-			const parts = record.value.trim().split(/\s+/);
-			const [priority, weight, port, target] = parts.length === 4 ? parts : [
-				String(record.priority ?? ""),
-				parts[0],
-				parts[1],
-				parts[2]
-			];
-			return yield* fromRecord({
-				...common,
-				_tag: "SRV",
-				port: Number(port),
-				priority: Number(priority),
-				target,
-				weight: Number(weight)
-			});
-		}
-		default: return yield* decodeOpaque(record, name);
-	}
-}));
-const decodeOpaque = Effect.fn("VercelRecords.decodeOpaque")((record, name) => Schema.decodeUnknownEffect(Opaque)({
-	_tag: "Opaque",
-	name,
-	providerRecordId: record.id,
-	providerType: record.type
-}).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message))));
-function encode(zone, record) {
-	const common = {
-		name: relativeName(zone, record.name),
-		...record.ttl === null ? {} : { ttl: record.ttl },
-		type: record._tag
-	};
-	switch (record._tag) {
-		case "A":
-		case "AAAA": return {
-			...common,
-			value: record.address
-		};
-		case "CNAME":
-		case "NS": return {
-			...common,
-			value: record.target
-		};
-		case "TXT": return {
-			...common,
-			value: record.value
-		};
-		case "MX": return {
-			...common,
-			mxPriority: record.priority,
-			value: record.exchange
-		};
-		case "CAA": return {
-			...common,
-			value: `${record.flags} ${record.tag} "${escapeQuoted(record.value)}"`
-		};
-		case "SRV": return {
-			...common,
-			srv: {
-				port: record.port,
-				priority: record.priority,
-				target: record.target,
-				weight: record.weight
-			}
-		};
-	}
-}
-function absoluteNameCandidate(zone, name) {
-	return name === "" || name === "@" ? zone : name === zone || name.endsWith(`.${zone}`) ? name : `${name}.${zone}`;
-}
-function relativeName(zone, name) {
-	if (name === zone) return "";
-	const suffix = `.${zone}`;
-	if (!name.endsWith(suffix)) throw failure$2("encodeRecord", `DNS record ${name} is outside Vercel zone ${zone}`, { reason: "request" });
-	return name.slice(0, -suffix.length);
-}
-function escapeQuoted(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
-}
-function unescapeQuoted(value) {
-	return value.replace(/\\([\\"])/g, "$1");
-}
-function failure$2(operation, message, fields = {}) {
-	return new Error({
-		message,
-		operation,
-		providerId: "vercel",
-		reason: fields.reason ?? "response"
-	});
-}
-//#endregion
-//#region src/providers/vercel/client.ts
-var client_exports = /* @__PURE__ */ __exportAll({
-	discovery: () => discovery,
-	make: () => make
-});
-/** Exposes Vercel zone lookup as the optional provider discovery capability. */
-function discovery(client) {
-	return {
-		listZones: (name) => client.listZones({ name }),
-		provider: client
-	};
-}
-/** Creates an Effect-native Vercel client without owning the credential lifecycle. */
-function make(options) {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
-	const withContext = (path, values = {}) => {
-		const url = new URL(`${baseUrl}${path}`);
-		for (const [key, value] of Object.entries(values)) url.searchParams.set(key, value);
-		if (options.context._tag === "team") url.searchParams.set("teamId", options.context.teamId);
-		return url;
-	};
-	const request = Effect.fn("VercelClient.request")((url, operation, init) => Effect.gen(function* () {
-		const response = yield* Effect.tryPromise({
-			try: () => fetch(url, {
-				...init,
-				headers: {
-					Accept: "application/json",
-					Authorization: `Bearer ${options.token.expose()}`,
-					...init?.body === void 0 ? {} : { "Content-Type": "application/json" },
-					...init?.headers
-				}
-			}),
-			catch: () => failure$1(operation, "Vercel request failed", { reason: "transport" })
-		});
-		const body = yield* Effect.tryPromise({
-			try: () => response.json(),
-			catch: () => failure$1(operation, response.ok ? "Vercel returned a non-JSON response" : `Vercel request failed with HTTP ${response.status}`, {
-				reason: response.ok ? "response" : reason(response.status),
-				...rateLimit(response),
-				status: response.status
-			})
-		});
-		if (!response.ok) return yield* Effect.fail(apiFailure(body, operation, response));
-		return {
-			body,
-			response
-		};
-	}));
-	const allTeams = Effect.fn("VercelClient.allTeams")(() => Effect.gen(function* () {
-		const teams = [];
-		let until = null;
-		while (true) {
-			const url = new URL(`${baseUrl}/v2/teams`);
-			url.searchParams.set("limit", "100");
-			if (until !== null) url.searchParams.set("until", String(until));
-			const { body, response } = yield* request(url, "listAccounts");
-			const envelope = yield* decode(TeamListEnvelope, body, "listAccounts", response);
-			teams.push(...envelope.teams);
-			if (envelope.pagination.next === null) return teams;
-			until = envelope.pagination.next;
-		}
-	}));
-	const allDomains = Effect.fn("VercelClient.allDomains")(() => Effect.gen(function* () {
-		const domains = [];
-		let until = null;
-		while (true) {
-			const values = { limit: "100" };
-			if (until !== null) values.until = String(until);
-			const { body, response } = yield* request(withContext("/v5/domains", values), "listZones");
-			const envelope = yield* decode(DomainListEnvelope, body, "listZones", response);
-			domains.push(...envelope.domains);
-			if (envelope.pagination.next === null) return domains;
-			until = envelope.pagination.next;
-		}
-	}));
-	const discoverZone = Effect.fn("VercelClient.discoverZone")((name) => Effect.gen(function* () {
-		const configResult = yield* request(withContext(`/v6/domains/${encodeURIComponent(name)}/config`), "resolveZone");
-		const config = yield* decode(DomainConfig, configResult.body, "resolveZone", configResult.response);
-		const domainResult = yield* request(withContext(`/v5/domains/${encodeURIComponent(name)}`), "resolveZone");
-		const envelope = yield* decode(DomainEnvelope, domainResult.body, "resolveZone", domainResult.response);
-		if (!hasDnsStorage(envelope.domain, config.serviceType)) return null;
-		return envelope.domain;
-	}).pipe(Effect.catchTag("ProviderError", (cause) => cause.reason === "not_found" ? Effect.succeed(null) : Effect.fail(cause))));
-	const resolveZone = Effect.fn("VercelClient.resolveZone")((name) => Effect.gen(function* () {
-		const domain = yield* discoverZone(name);
-		if (domain === null) return yield* Effect.fail(failure$1("resolveZone", `Vercel zone ${name} is not configured for authoritative DNS in the selected account`, { reason: "not_found" }));
-		return yield* decode$2(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
-	}));
-	const listRecords = Effect.fn("VercelClient.listRecords")((zoneName) => Effect.gen(function* () {
-		const storageZone = yield* resolveZone(zoneName);
-		const records = [];
-		let until = null;
-		while (true) {
-			const values = { limit: "100" };
-			if (until !== null) values.until = String(until);
-			const { body, response } = yield* request(withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values), "listRecords");
-			const envelope = yield* decode(RecordListEnvelope, body, "listRecords", response);
-			records.push(...yield* Effect.forEach(envelope.records, (record) => decode$1(storageZone, record)));
-			const next = envelope.pagination?.next ?? null;
-			if (next === null) return records.filter((record) => record.name === zoneName || record.name.endsWith(`.${zoneName}`));
-			until = next;
-		}
-	}));
-	const createRecord = Effect.fn("VercelClient.createRecord")((zoneName, record) => Effect.gen(function* () {
-		const storageZone = yield* resolveZone(zoneName);
-		const body = yield* Effect.try({
-			try: () => encode(storageZone, record),
-			catch: (cause) => cause instanceof Error ? cause : failure$1("createRecord", "Vercel record could not be encoded", { reason: "request" })
-		});
-		const result = yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records`), "createRecord", {
-			body: JSON.stringify(body),
-			method: "POST"
-		});
-		return { providerRecordId: (yield* decode(CreateRecordEnvelope, result.body, "createRecord", result.response)).uid };
-	}));
-	const getRecord = Effect.fn("VercelClient.getRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-		const storageZone = yield* resolveZone(zoneName);
-		let until = null;
-		while (true) {
-			const values = { limit: "100" };
-			if (until !== null) values.until = String(until);
-			const { body, response } = yield* request(withContext(`/v5/domains/${encodeURIComponent(storageZone)}/records`, values), "getRecord");
-			const envelope = yield* decode(RecordListEnvelope, body, "getRecord", response);
-			const record = envelope.records.find(({ id }) => id === providerRecordId);
-			if (record !== void 0) return yield* decode$1(storageZone, record);
-			const next = envelope.pagination?.next ?? null;
-			if (next === null) return null;
-			until = next;
-		}
-	}));
-	return {
-		id: "vercel",
-		createRecord,
-		deleteRecord: Effect.fn("VercelClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-			const storageZone = yield* resolveZone(zoneName);
-			yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`), "deleteRecord", { method: "DELETE" });
-		})),
-		getRecord,
-		listAccounts: Effect.fn("VercelClient.listAccounts")(() => Effect.gen(function* () {
-			const userResult = yield* request(new URL(`${baseUrl}/v2/user`), "listAccounts");
-			const { user } = yield* decode(UserEnvelope, userResult.body, "listAccounts", userResult.response);
-			const teams = yield* allTeams();
-			return [{
-				id: user.id,
-				name: user.name ?? user.username,
-				type: "personal"
-			}, ...teams.map((team) => ({
-				id: team.id,
-				name: team.name ?? team.slug,
-				type: "team"
-			}))];
-		})),
-		listRecords,
-		listZones: Effect.fn("VercelClient.listZones")((input = {}) => Effect.gen(function* () {
-			const domains = (yield* allDomains()).filter((domain) => hasDnsStorage(domain) && (input.name === void 0 || domain.name === input.name));
-			if (domains.length > 0 || input.name === void 0) return yield* Effect.forEach(domains, projectZone);
-			const discovered = yield* discoverZone(input.name);
-			return discovered === null ? [] : [yield* projectZone(discovered)];
-		})),
-		validateToken: Effect.fn("VercelClient.validateToken")(() => Effect.gen(function* () {
-			let accountId;
-			if (options.context._tag === "team") {
-				yield* allDomains();
-				accountId = options.context.teamId;
-			} else {
-				const result = yield* request(new URL(`${baseUrl}/v2/user`), "validateToken");
-				const { user } = yield* decode(UserEnvelope, result.body, "validateToken", result.response);
-				accountId = user.id;
-			}
-			return {
-				accountId,
-				capabilities: options.capabilities,
-				expiresAt: null,
-				scopes: []
-			};
-		}))
-	};
-}
-function hasDnsStorage(domain, configuredServiceType = domain.serviceType) {
-	return configuredServiceType === "zeit.world" || domain.zone === true || domain.intendedNameservers.length > 0;
-}
-const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen(function* () {
-	const name = yield* decode$2(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$2(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
-	return {
-		accountId: domain.teamId ?? domain.userId,
-		id: domain.id,
-		name,
-		nameservers,
-		status: domain.verified ? "active" : "pending"
-	};
-}));
-function decode(schema, input, operation, response) {
-	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$1(operation, `Vercel response did not match its API contract: ${cause.message}`, {
-		reason: "response",
-		status: response.status
-	})));
-}
-function apiFailure(input, operation, response) {
-	const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
-	return failure$1(operation, detail._tag === "Some" ? detail.value.error.message : `Vercel request failed with HTTP ${response.status}`, {
-		...detail._tag === "Some" ? { code: detail.value.error.code } : {},
-		reason: reason(response.status, detail._tag === "Some" ? detail.value.error.code : void 0),
-		...rateLimit(response, detail._tag === "Some" ? detail.value.error : void 0),
-		status: response.status
-	});
-}
-function reason(status, code) {
-	if (status === 401 || code === "invalid_token") return "authentication";
-	if (status === 403) return "authorization";
-	if (status === 404 || code === "not_found") return "not_found";
-	if (status === 409 || code === "conflict") return "conflict";
-	if (status === 429 || code === "rate_limited") return "rate_limit";
-	if (status >= 500) return "response";
-	return "request";
-}
-function rateLimit(response, detail) {
-	const resetMs = detail?.limit?.resetMs;
-	const header = response.headers.get("x-ratelimit-reset");
-	const reset = resetMs ?? (header === null ? void 0 : Number(header) * 1e3);
-	return reset === void 0 || !Number.isFinite(reset) ? {} : { retryAfterMs: Math.max(0, reset - Date.now()) };
-}
-function failure$1(operation, message, fields = {}) {
-	return new Error({
-		...fields,
-		message,
-		operation,
-		providerId: "vercel"
-	});
-}
-//#endregion
-//#region src/providers/vercel/auth.ts
-var auth_exports = /* @__PURE__ */ __exportAll({
-	contextCodec: () => contextCodec,
-	exchangeCode: () => exchangeCode,
-	integrationAuthentication: () => integrationAuthentication,
-	integrationFlow: () => integrationFlow,
-	integrationMethod: () => integrationMethod,
-	manifest: () => manifest,
-	tokenConnectionMethod: () => tokenConnectionMethod,
-	tokenMethod: () => tokenMethod
-});
-const Context$1 = Schema.TaggedUnion({
-	personal: { installationId: Schema.NullOr(Schema.String) },
-	team: {
-		installationId: Schema.NullOr(Schema.String),
-		teamId: Schema.String
-	}
-});
-const contextCodec = codec("vercel.v1", Context$1);
-/** Describes Vercel's caller-created personal access-token method. */
-function tokenMethod(capabilities) {
-	return {
-		_tag: "token",
-		capabilities: [...capabilities],
-		instructionsUrl: "https://vercel.com/account/settings/tokens"
-	};
-}
-/** Describes Vercel's provider-specific integration installation flow. */
-function integrationMethod(options) {
-	return {
-		_tag: "integration",
-		capabilities: [...options.capabilities],
-		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
-		tokenEndpoint: "https://api.vercel.com/oauth/access_token"
-	};
-}
-/** Creates the Vercel token and integration authorization manifest. */
-function manifest(options) {
-	return {
-		methods: [tokenMethod(options.capabilities), integrationMethod(options)],
-		providerId: "vercel"
-	};
-}
-/** Exchanges Vercel's one-time integration code and preserves its account context. */
-const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.gen(function* () {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
-	const body = new URLSearchParams({
-		client_id: options.clientId,
-		client_secret: options.clientSecret.expose(),
-		code: options.code.expose(),
-		redirect_uri: options.redirectUri
-	});
-	const response = yield* Effect.tryPromise({
-		try: () => fetch(`${baseUrl}/oauth/access_token`, {
-			body,
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			method: "POST"
-		}),
-		catch: () => failure("exchangeCode", "Vercel token exchange failed", "transport")
-	});
-	const input = yield* Effect.tryPromise({
-		try: () => response.json(),
-		catch: () => failure("exchangeCode", response.ok ? "Vercel returned a non-JSON token response" : `Vercel token exchange failed with HTTP ${response.status}`, response.ok ? "response" : response.status === 401 ? "authentication" : "request", response.status)
-	});
-	if (!response.ok) {
-		const detail = Schema.decodeUnknownOption(ErrorEnvelope)(input);
-		return yield* Effect.fail(failure("exchangeCode", detail._tag === "Some" ? detail.value.error.message : `Vercel token exchange failed with HTTP ${response.status}`, response.status === 401 ? "authentication" : "request", response.status, detail._tag === "Some" ? detail.value.error.code : void 0));
-	}
-	const token = yield* Schema.decodeUnknownEffect(IntegrationToken)(input).pipe(Effect.mapError((cause) => failure("exchangeCode", `Vercel token response did not match its API contract: ${cause.message}`, "response", response.status)));
-	return {
-		accessToken: make$1(token.access_token),
-		context: token.team_id === null ? { _tag: "personal" } : {
-			_tag: "team",
-			teamId: token.team_id
-		},
-		installationId: token.installation_id ?? null,
-		userId: token.user_id
-	};
-}));
-/** Creates a provider-independent token connection method backed by Vercel validation. */
-function tokenConnectionMethod(options) {
-	const requiredCapabilities = [...options.capabilities];
-	return Method.Token({
-		authenticate: Effect.fn("VercelAuth.authenticateToken")(function* (token) {
-			const validated = yield* make({
-				...options,
-				token
-			}).validateToken();
-			const observedAt = new Date(yield* Clock.currentTimeMillis);
-			return {
-				capabilityEvidence: validated.capabilities.map((capability) => ({
-					capability,
-					evidence: Evidence.Introspected({ observedAt })
-				})),
-				credential: {
-					accessToken: token,
-					refreshToken: null,
-					tokenType: "bearer"
-				},
-				expiresAt: validated.expiresAt,
-				providerAccountId: validated.accountId,
-				providerContext: yield* contextCodec.encode(options.context._tag === "team" ? {
-					_tag: "team",
-					installationId: null,
-					teamId: options.context.teamId
-				} : {
-					_tag: "personal",
-					installationId: null
-				}),
-				scopes: [...validated.scopes]
-			};
-		}),
-		providerId: "vercel",
-		requiredCapabilities,
-		token: options.token
-	});
-}
-/** Converts a completed Vercel Integration exchange into canonical connection authentication. */
-const integrationAuthentication = Effect.fn("VercelAuth.integrationAuthentication")(function* (options) {
-	const exchanged = yield* exchangeCode(options);
-	const observedAt = new Date(yield* Clock.currentTimeMillis);
-	return {
-		capabilityEvidence: options.capabilities.map((capability) => ({
-			capability,
-			evidence: Evidence.Introspected({ observedAt })
-		})),
-		credential: {
-			accessToken: exchanged.accessToken,
-			refreshToken: null,
-			tokenType: "bearer"
-		},
-		expiresAt: null,
-		providerAccountId: exchanged.context._tag === "team" ? exchanged.context.teamId : exchanged.userId,
-		providerContext: yield* contextCodec.encode(exchanged.context._tag === "team" ? {
-			_tag: "team",
-			installationId: exchanged.installationId,
-			teamId: exchanged.context.teamId
-		} : {
-			_tag: "personal",
-			installationId: exchanged.installationId
-		}),
-		scopes: []
-	};
-});
-/** Creates Vercel Integration's implementation of the common interactive connection capability. */
-function integrationFlow(options) {
-	const method = integrationMethod(options);
-	const Payload = Schema.fromJsonString(Schema.Struct({ state: Schema.String }));
-	return {
-		complete: Effect.fn("VercelAuth.integrationFlow.complete")(function* (payload, callbackUrl) {
-			const continuation = yield* Schema.decodeUnknownEffect(Payload)(payload.expose()).pipe(Effect.mapError(() => new Error$1({
-				category: "authorization",
-				message: "Vercel Integration continuation payload is invalid",
-				operation: "VercelAuth.integrationFlow.complete",
-				retry: "after-user-action"
-			})));
-			const code = callbackUrl.searchParams.get("code");
-			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null) return yield* new Error$1({
-				category: "authorization",
-				message: "Vercel Integration callback does not match its continuation",
-				operation: "VercelAuth.integrationFlow.complete",
-				retry: "after-user-action"
-			});
-			return yield* integrationAuthentication({
-				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
-				capabilities: options.capabilities,
-				clientId: options.clientId,
-				clientSecret: options.clientSecret,
-				code: make$1(code),
-				...options.fetch === void 0 ? {} : { fetch: options.fetch },
-				redirectUri: options.redirectUri
-			});
-		}),
-		method: "integration",
-		providerId: "vercel",
-		requiredCapabilities: [...options.capabilities],
-		start: (continuationId) => {
-			const authorizationUrl = new URL(method.installUrl);
-			authorizationUrl.searchParams.set("source", "external");
-			authorizationUrl.searchParams.set("state", continuationId);
-			return Effect.succeed({
-				authorizationUrl,
-				payload: make$1(JSON.stringify({ state: continuationId }))
-			});
-		}
-	};
-}
-function failure(operation, message, reason, status, code) {
-	return new Error({
-		...code === void 0 ? {} : { code },
-		message,
-		operation,
-		providerId: "vercel",
-		reason,
-		...status === void 0 ? {} : { status }
-	});
-}
-//#endregion
-export { manifest as a, client_exports as c, integrationMethod as i, discovery as l, exchangeCode as n, tokenConnectionMethod as o, integrationFlow as r, tokenMethod as s, auth_exports as t, make as u };
-
-//# sourceMappingURL=auth-g-waCHcz.mjs.map