domainkit 0.20.0 → 0.21.0

package/dist/types/Connect.d.ts

@@ -233,6 +233,113 @@ export declare const Started: {
         readonly candidates: ReadonlyArray<Provider.Target>;
     }, "_tag">;
 };
+/** A verified completion result. Errors stay on the server; do not serialize them to a browser. */
+export type Completion = Data.TaggedEnum<{
+    Connected: {
+        readonly started: Exclude<Started, {
+            readonly _tag: "Redirect";
+        }>;
+    };
+    Cancelled: {
+        readonly error: Errors.DomainKitError;
+    };
+    Failed: {
+        readonly error: Errors.DomainKitError;
+        readonly recovery: "restart" | "inspect";
+    };
+}>;
+export declare const Completion: {
+    readonly $is: <Tag extends "Cancelled" | "Connected" | "Failed">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "Cancelled";
+        readonly error: Errors.DomainKitError;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "Connected";
+        readonly started: Exclude<Started, {
+            readonly _tag: "Redirect";
+        }>;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "Failed";
+        readonly error: Errors.DomainKitError;
+        readonly recovery: "restart" | "inspect";
+    }, {
+        readonly _tag: Tag;
+    }>;
+    readonly $match: {
+        <Cases extends { readonly [Tag in "Cancelled" | "Connected" | "Failed"]: (args: Extract<{
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(cases: Cases): (value: {
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }) => import("effect/Unify").Unify<ReturnType<Cases["Cancelled" | "Connected" | "Failed"]>>;
+        <Cases extends { readonly [Tag in "Cancelled" | "Connected" | "Failed"]: (args: Extract<{
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(value: {
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Cancelled" | "Connected" | "Failed"]>>;
+    };
+    readonly Cancelled: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Cancelled";
+        readonly error: Errors.DomainKitError;
+    }, "_tag">;
+    readonly Connected: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Connected";
+        readonly started: Exclude<Started, {
+            readonly _tag: "Redirect";
+        }>;
+    }, "_tag">;
+    readonly Failed: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Failed";
+        readonly error: Errors.DomainKitError;
+        readonly recovery: "restart" | "inspect";
+    }, "_tag">;
+};
 /** `attach` either attached the domain or needs the caller to pick a zone. */
 export type Selection = Data.TaggedEnum<{
     SelectionRequired: {
@@ -477,6 +584,16 @@ export interface Interface {
         readonly continuationId: string;
         readonly callbackUrl: string;
     }) => Fx<Started>;
+    /**
+     * Classify only after live owner/actor verification inside the completion lock. Optional
+     * `provider` binds the flow to a mounted route. Invalid flows fail without an outcome.
+     * Cancellation and failure leave the continuation retryable; persistence is not atomic.
+     */
+    readonly completeOutcome: (input: {
+        readonly continuationId: string;
+        readonly callbackUrl: string;
+        readonly provider?: string;
+    }) => Fx<Completion>;
     readonly attach: (input: {
         readonly connectionId: string;
         readonly domain: string;
@@ -586,6 +703,23 @@ export declare const complete: (input: {
     readonly connection: Storage.Connection;
     readonly candidates: ReadonlyArray<Provider.Target>;
 }, Errors.DomainKitError, Principal.Service | Service>;
+export declare const completeOutcome: (input: {
+    readonly continuationId: string;
+    readonly callbackUrl: string;
+    readonly provider?: string;
+}) => Effect.Effect<{
+    readonly _tag: "Cancelled";
+    readonly error: Errors.DomainKitError;
+} | {
+    readonly _tag: "Connected";
+    readonly started: Exclude<Started, {
+        readonly _tag: "Redirect";
+    }>;
+} | {
+    readonly _tag: "Failed";
+    readonly error: Errors.DomainKitError;
+    readonly recovery: "restart" | "inspect";
+}, Errors.DomainKitError, Principal.Service | Service>;
 export declare const attach: (input: {
     readonly connectionId: string;
     readonly domain: string;

package/dist/types/Provider.d.ts

@@ -189,6 +189,11 @@ export interface CallbackInput {
     readonly params: Readonly<Record<string, string>>;
 }
 export interface OAuthAuth {
+    /** Optional setup requirements; absence makes offline registration settings unsupported. */
+    readonly registration?: {
+        readonly clientAuth: "none" | "client_secret_basic" | "client_secret_post";
+        readonly pkce: "S256";
+    };
     readonly label: string;
     readonly scopes: ReadonlyArray<string>;
     readonly start: (input: {
@@ -206,6 +211,10 @@ export interface OAuthAuth {
 }
 /** Marketplace-style installs (Vercel integrations) that redirect but are not OAuth. */
 export interface IntegrationAuth {
+    /** Authentication used by the integration code exchange, without credentials. */
+    readonly registration?: {
+        readonly clientAuth: "client_secret_post";
+    };
     readonly label: string;
     readonly start: (input: {
         readonly state: string;

package/dist/types/Server.d.ts

@@ -24,6 +24,7 @@ import * as DnsRecord from "./DnsRecord.ts";
 import * as Errors from "./internal/error.ts";
 import * as Plan from "./Plan.ts";
 import * as Principal from "./Principal.ts";
+import type * as Provider from "./Provider.ts";
 import * as Providers from "./Providers.ts";
 import * as Provision from "./Provision.ts";
 import * as Reason from "./Reason.ts";
@@ -11393,6 +11394,23 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
 export type Group = typeof group;
 /** Every route in the group, by name; what `Identity.authorize` is asked about. */
 export type EndpointName = HttpApiGroup.Endpoints<Group>["identifier"];
+/** Browser-safe summaries of an authenticated live callback. Connected is not DNS readiness. */
+export declare const CallbackOutcome: Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"Connected">;
+    readonly provider: Schema.String;
+    readonly connectionId: Schema.String;
+    readonly returnTo: Schema.String;
+}>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Cancelled">;
+    readonly provider: Schema.String;
+    readonly returnTo: Schema.String;
+}>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Failed">;
+    readonly provider: Schema.String;
+    readonly returnTo: Schema.String;
+    readonly recovery: Schema.Literals<readonly ["restart", "inspect"]>;
+}>]>;
+export type CallbackOutcome = typeof CallbackOutcome.Type;
 export interface Options {
     /**
      * Where the callback route is reachable from the provider, without the `/callback/:provider`
@@ -11401,7 +11419,34 @@ export interface Options {
     readonly callbackBaseUrl?: string;
     /** Where interactive flows return when the callback carries no `returnTo`. */
     readonly defaultReturnTo?: string;
+    /**
+     * Opt in to a same-origin destination, or return undefined to keep default behavior. Invoked
+     * only for a verified live flow; no request, state, code, secrets, or storage rows reach this
+     * policy. Close over acquired host services; its Effect requires no environment.
+     * A policy failure after Connected cannot undo persistence: inspect before restarting.
+     */
+    readonly callback?: (outcome: CallbackOutcome) => Effect.Effect<string | undefined, Errors.DomainKitError>;
 }
+/** Offline registration requirements, not proof of provider console or grant readiness. */
+export declare const RegistrationSettings: Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"OAuth">;
+    readonly provider: Schema.String;
+    readonly callbackUrl: Schema.String;
+    readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+    readonly pkce: Schema.Literal<"S256">;
+    readonly scopes: Schema.$Array<Schema.String>;
+}>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Integration">;
+    readonly provider: Schema.String;
+    readonly callbackUrl: Schema.String;
+    readonly clientAuth: Schema.Literal<"client_secret_post">;
+}>]>;
+export type RegistrationSettings = typeof RegistrationSettings.Type;
+/** Derive only public setup values; no credentials, identity, storage, or network are needed. */
+export declare const registrationSettings: (input: {
+    readonly providers: ReadonlyArray<Provider.Definition>;
+    readonly callbackBaseUrl: string;
+}) => Effect.Effect<ReadonlyArray<RegistrationSettings>, Errors.DomainKitError>;
 /** Everything the handlers need: the lifecycle services, Storage, and the host's `Identity`. */
 export type Services = Provision.Service | Cleanup.Service | Connect.Service | Verify.Service | Providers.Service | Storage.Service | Identity;
 /**

package/dist/types/Verify.d.ts

@@ -73,7 +73,11 @@ export interface Interface {
         readonly domain: string;
         readonly requirements?: ReadonlyArray<DnsRecord.Model>;
     }) => Fx<Readiness>;
-    /** Merge host evidence into stored readiness without re-observing DNS. */
+    /**
+     * Merge host evidence into stored readiness without re-observing DNS. Before the first `observe`
+     * the readiness has no requirements, so it is never `ready`: `failed` when a host signal failed,
+     * otherwise `pending` with `nextCheckAt` set for the first observation.
+     */
     readonly attachEvidence: (input: {
         readonly domain: string;
         readonly evidence: ReadonlyArray<HostEvidence>;

package/dist/types/internal/callback.d.ts

@@ -0,0 +1,4 @@
+import * as Errors from "./error.ts";
+/** A leaked flow id must reveal neither existence nor ownership, including read races. */
+export declare const refuse: import("effect/Effect").Effect<never, Errors.DomainKitError, never>;
+export declare const missing: (error: Errors.DomainKitError) => boolean;

package/dist/types/internal/config.d.ts

@@ -1,4 +1,11 @@
-import { Config, Effect } from "effect";
+import { Config, Effect, Redacted } from "effect";
 import * as Errors from "./error.ts";
 /** Accept a literal or a `Config`; config failures surface as `InvalidInput` on `field`. */
 export declare const resolve: <A>(value: A | Config.Config<A>, field: string) => Effect.Effect<A, Errors.DomainKitError>;
+/** Configuration diagnostics name the field, never the rejected value. */
+export declare const requireValue: <A>(value: A, valid: (value: A) => boolean, field: string, message: string) => Effect.Effect<A, Errors.DomainKitError>;
+export declare const nonempty: (value: string, field: string) => Effect.Effect<string, Errors.DomainKitError, never>;
+export declare const secret: (value: Redacted.Redacted<string>, field: string) => Effect.Effect<Redacted.Redacted<string>, Errors.DomainKitError, never>;
+/** Paths and split emulator origins are supported; URL suffixes must remain paths. */
+export declare const endpoint: (value: string, field: string) => Effect.Effect<string, Errors.DomainKitError, never>;
+export declare const scopes: (value: ReadonlyArray<string>, field: string) => Effect.Effect<readonly string[], Errors.DomainKitError, never>;

package/dist/types/internal/provider-async.d.ts

@@ -33,6 +33,7 @@ export interface AsyncTokenAuth {
     readonly authenticate: (values: Readonly<Record<string, string | undefined>>) => Promise<AsyncIssuedCredential>;
 }
 export interface AsyncOAuthAuth {
+    readonly registration?: Provider.OAuthAuth["registration"];
     readonly label: string;
     readonly scopes: ReadonlyArray<string>;
     readonly start: (input: {
@@ -49,6 +50,7 @@ export interface AsyncOAuthAuth {
     readonly revoke?: (credential: AsyncCredential) => Promise<void>;
 }
 export interface AsyncIntegrationAuth {
+    readonly registration?: Provider.IntegrationAuth["registration"];
     readonly label: string;
     readonly start: (input: {
         readonly state: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domainkit",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Build reviewable DNS plans for custom domains in TypeScript",
   "keywords": [
     "custom-domains",
@@ -11,7 +11,7 @@
     "effect",
     "typescript"
   ],
-  "homepage": "https://github.com/AryaLabsHQ/domainkit#readme",
+  "homepage": "https://domain-kit.dev",
   "bugs": {
     "url": "https://github.com/AryaLabsHQ/domainkit/issues"
   },
@@ -139,18 +139,18 @@
   },
   "dependencies": {
     "@leichtgewicht/dns-packet": "6.0.3",
-    "oauth4webapi": "^3.8.7",
-    "tldts": "^7.4.11"
+    "oauth4webapi": "^3.8.8",
+    "tldts": "^7.4.18"
   },
   "devDependencies": {
-    "@effect/vitest": "4.0.0",
-    "@types/bun": "1.4.0",
-    "effect": "4.0.0",
+    "@effect/vitest": "4.0.2",
+    "@types/bun": "1.4.2",
+    "effect": "4.0.2",
     "miniflare": "3.20250718.3",
-    "tsdown": "0.22.14",
+    "tsdown": "0.23.0",
     "typescript": "7.0.2",
-    "vite": "7.1.12",
-    "vitest": "5.0.1"
+    "vite": "8.3.4",
+    "vitest": "5.0.3"
   },
   "peerDependencies": {
     "effect": ">=4.0.0 <5.0.0"