domainkit 0.20.1 → 0.21.0

package/dist/Vercel.mjs

@@ -4,7 +4,7 @@ import { Unauthenticated } from "./Reason.mjs";
 import { fail } from "./internal/error.mjs";
 import { make, resolveAmong, tokenAuth } from "./Provider.mjs";
 import { rejectedToken } from "./internal/http.mjs";
-import { resolve } from "./internal/config.mjs";
+import { endpoint, nonempty, resolve, secret } from "./internal/config.mjs";
 import { dns, exchangeCode, teams, user, zones } from "./internal/vercel/client.mjs";
 import { Effect, Redacted, Schema } from "effect";
 //#region src/Vercel.ts
@@ -24,11 +24,11 @@ const TokenFields = Schema.Struct({
 const capabilities = ["dns:read", "dns:write"];
 const provider = (options = {}) => {
 	const fetch = options.fetch ?? globalThis.fetch;
-	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
+	const baseUrl = options.baseUrl ?? "https://api.vercel.com";
 	const client = (token) => ({
 		token,
 		fetch,
-		baseUrl
+		baseUrl: baseUrl.replace(/\/$/, "")
 	});
 	const targetOf = (domain, label) => ({
 		zone: domain.name,
@@ -38,18 +38,28 @@ const provider = (options = {}) => {
 	});
 	const integration = options.integration === void 0 ? void 0 : integrationAuth(options.integration);
 	function integrationAuth(settings) {
-		const installOrigin = (settings.installOrigin ?? "https://vercel.com").replace(/\/$/, "");
+		const installOrigin = settings.installOrigin ?? "https://vercel.com";
+		const credentials = () => Effect.gen(function* () {
+			yield* endpoint(settings.installOrigin ?? "https://vercel.com", "integration.installOrigin");
+			yield* endpoint(options.baseUrl ?? "https://api.vercel.com", "baseUrl");
+			yield* nonempty(settings.slug, "integration.slug");
+			return {
+				clientId: yield* resolve(settings.clientId, "integration.clientId").pipe(Effect.flatMap((v) => nonempty(v, "integration.clientId"))),
+				clientSecret: yield* resolve(settings.clientSecret, "integration.clientSecret").pipe(Effect.flatMap((v) => secret(v, "integration.clientSecret")))
+			};
+		});
 		return {
 			label: "Install the Vercel integration",
-			start: (input) => {
-				const authorizationUrl = new URL(`${installOrigin}/integrations/${encodeURIComponent(settings.slug)}/new`);
+			registration: { clientAuth: "client_secret_post" },
+			start: (input) => Effect.gen(function* () {
+				yield* credentials();
+				const authorizationUrl = new URL(`${installOrigin.replace(/\/$/, "")}/integrations/${encodeURIComponent(settings.slug)}/new`);
 				authorizationUrl.searchParams.set("source", "external");
 				authorizationUrl.searchParams.set("state", input.state);
-				return Effect.succeed({ authorizationUrl: authorizationUrl.toString() });
-			},
+				return { authorizationUrl: authorizationUrl.toString() };
+			}),
 			complete: (input) => Effect.gen(function* () {
-				const clientId = yield* resolve(settings.clientId, "integration.clientId");
-				const clientSecret = yield* resolve(settings.clientSecret, "integration.clientSecret");
+				const { clientId, clientSecret } = yield* credentials();
 				const token = yield* exchangeCode({
 					options: client(""),
 					clientId,

package/dist/Vercel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Vercel.mjs","names":["Client.exchangeCode","Errors.fail","Reason.Unauthenticated","Provider.make","Provider.tokenAuth","Client.user","Client.zones","teams","Client.teams","DomainName.decode","Provider.resolveAmong","Client.dns"],"sources":["../src/Vercel.ts"],"sourcesContent":["/** Vercel: personal tokens and marketplace integrations. */\nimport { type Config, Effect, Redacted, Schema } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport { resolve } from \"./internal/config.ts\";\nimport { type Fetch, rejectedToken } from \"./internal/http.ts\";\nimport * as Client from \"./internal/vercel/client.ts\";\nimport type * as Protocol from \"./internal/vercel/protocol.ts\";\nimport * as Provider from \"./Provider.ts\";\n\n/** `teamId` is `null` for a personal account; targets carry the team that owns the zone. */\nexport const TeamContext = Schema.Struct({ teamId: Schema.NullOr(Schema.String) });\nexport type TeamContext = typeof TeamContext.Type;\n\n/** Token-method input: the access token, and a team id to scope the connection to one team. */\nexport const TokenFields = Schema.Struct({\n  token: Schema.RedactedFromValue(Schema.String),\n  teamId: Schema.optionalKey(Schema.String),\n});\n\nexport interface Options {\n  /** Omit to offer tokens only. */\n  readonly integration?: {\n    readonly clientId: string | Config.Config<string>;\n    readonly clientSecret: Redacted.Redacted<string> | Config.Config<Redacted.Redacted<string>>;\n    readonly slug: string;\n    /**\n     * Origin of the install page, which Vercel serves at `/integrations/{slug}/new` beneath it.\n     * Default `https://vercel.com`; a stage points it at an emulator that mounts the same path.\n     * It stays separate from `baseUrl` because in production these are different hosts:\n     * `vercel.com` for the browser install, `api.vercel.com` for the code exchange and the REST API.\n     */\n    readonly installOrigin?: string;\n  };\n  readonly fetch?: Fetch;\n  readonly baseUrl?: string;\n}\n\nconst capabilities = [\"dns:read\", \"dns:write\"] as const;\n\nexport const provider = (options: Options = {}): Provider.Definition<TeamContext> => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = (options.baseUrl ?? \"https://api.vercel.com\").replace(/\\/$/, \"\");\n  const client = (token: string): Client.Options => ({ token, fetch, baseUrl });\n\n  const targetOf = (domain: Protocol.Domain, label: string): Provider.Target => ({\n    zone: domain.name,\n    context: { teamId: domain.teamId } satisfies TeamContext,\n    label: `${domain.name} (${label})`,\n    nameservers: domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers,\n  });\n\n  const integration =\n    options.integration === undefined ? undefined : integrationAuth(options.integration);\n\n  function integrationAuth(\n    settings: NonNullable<Options[\"integration\"]>,\n  ): Provider.IntegrationAuth {\n    const installOrigin = (settings.installOrigin ?? \"https://vercel.com\").replace(/\\/$/, \"\");\n    return {\n      label: \"Install the Vercel integration\",\n      start: (input) => {\n        const authorizationUrl = new URL(\n          `${installOrigin}/integrations/${encodeURIComponent(settings.slug)}/new`,\n        );\n        authorizationUrl.searchParams.set(\"source\", \"external\");\n        authorizationUrl.searchParams.set(\"state\", input.state);\n        return Effect.succeed({ authorizationUrl: authorizationUrl.toString() });\n      },\n      complete: (input) =>\n        Effect.gen(function* () {\n          const clientId = yield* resolve(settings.clientId, \"integration.clientId\");\n          const clientSecret = yield* resolve(settings.clientSecret, \"integration.clientSecret\");\n          const token = yield* Client.exchangeCode({\n            options: client(\"\"),\n            clientId,\n            clientSecret: Redacted.value(clientSecret),\n            code: input.code,\n            callbackUrl: input.callbackUrl,\n          });\n          const callbackTeam = input.params.teamId;\n          if (callbackTeam !== undefined && callbackTeam !== token.team_id) {\n            return yield* Errors.fail(\n              new Reason.Unauthenticated({\n                message: \"Vercel integration callback team does not match the installed team\",\n              }),\n            );\n          }\n          return {\n            secret: Redacted.make(token.access_token),\n            context: { teamId: token.team_id } satisfies TeamContext,\n            expiresAt: null,\n          };\n        }),\n    };\n  }\n\n  return Provider.make<TeamContext>({\n    id: \"vercel\",\n    name: \"Vercel\",\n    nameservers: [\"vercel-dns.com\"],\n    context: TeamContext,\n    contextVersion: \"vercel.v1\",\n    auth: {\n      token: Provider.tokenAuth({\n        label: \"Access token\",\n        docsUrl: \"https://vercel.com/account/settings/tokens\",\n        requiredCapabilities: capabilities,\n        fields: TokenFields,\n        authenticate: ({ token, teamId }) =>\n          Client.user(client(Redacted.value(token))).pipe(\n            Effect.map(() => ({\n              secret: token,\n              context: { teamId: teamId ?? null } satisfies TeamContext,\n              expiresAt: null,\n            })),\n            rejectedToken,\n          ),\n      }),\n      ...(integration === undefined ? {} : { integration }),\n    },\n    session: (credential) => {\n      const clientOptions = client(Redacted.value(credential.secret));\n      const context = Schema.decodeUnknownOption(TeamContext)(credential.context);\n      const teamId = context._tag === \"Some\" ? context.value.teamId : null;\n      const listTargets = (): Effect.Effect<\n        ReadonlyArray<Provider.Target>,\n        Errors.DomainKitError\n      > =>\n        teamId !== null\n          ? Client.zones(clientOptions, teamId).pipe(\n              Effect.map((domains) => domains.map((domain) => targetOf(domain, teamId))),\n            )\n          : Effect.gen(function* () {\n              const personal = yield* Client.zones(clientOptions, null);\n              const teams = yield* Client.teams(clientOptions).pipe(\n                Effect.catchIf(\n                  (error) => error.reason._tag !== \"ProviderUnavailable\",\n                  () => Effect.succeed([]),\n                ),\n              );\n              const perTeam = yield* Effect.forEach(teams, (team) =>\n                Client.zones(clientOptions, team.id).pipe(\n                  Effect.map((domains) =>\n                    domains.map((domain) => targetOf(domain, team.name ?? team.slug)),\n                  ),\n                ),\n              );\n              return [...personal.map((domain) => targetOf(domain, \"personal\")), ...perTeam.flat()];\n            });\n      return {\n        capabilities: () => Effect.succeed(capabilities),\n        listTargets,\n        resolveTarget: (domain) =>\n          Effect.gen(function* () {\n            const name = yield* DomainName.decode(domain);\n            const targets = yield* listTargets();\n            return Provider.resolveAmong(name, targets);\n          }),\n        dns: (target) => {\n          const scope = Schema.decodeUnknownOption(TeamContext)(target.context);\n          return Client.dns(clientOptions, scope._tag === \"Some\" ? scope.value.teamId : teamId);\n        },\n      };\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAaA,MAAa,cAAc,OAAO,OAAO,EAAE,QAAQ,OAAO,OAAO,OAAO,MAAM,EAAE,CAAC;;AAIjF,MAAa,cAAc,OAAO,OAAO;CACvC,OAAO,OAAO,kBAAkB,OAAO,MAAM;CAC7C,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC;AAoBD,MAAM,eAAe,CAAC,YAAY,WAAW;AAE7C,MAAa,YAAY,UAAmB,CAAC,MAAwC;CACnF,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,WAAW,QAAQ,WAAW,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAC/E,MAAM,UAAU,WAAmC;EAAE;EAAO;EAAO;CAAQ;CAE3E,MAAM,YAAY,QAAyB,WAAoC;EAC7E,MAAM,OAAO;EACb,SAAS,EAAE,QAAQ,OAAO,OAAO;EACjC,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM;EAChC,aAAa,OAAO,YAAY,SAAS,IAAI,OAAO,cAAc,OAAO;CAC3E;CAEA,MAAM,cACJ,QAAQ,gBAAgB,KAAA,IAAY,KAAA,IAAY,gBAAgB,QAAQ,WAAW;CAErF,SAAS,gBACP,UAC0B;EAC1B,MAAM,iBAAiB,SAAS,iBAAiB,qBAAA,CAAsB,QAAQ,OAAO,EAAE;EACxF,OAAO;GACL,OAAO;GACP,QAAQ,UAAU;IAChB,MAAM,mBAAmB,IAAI,IAC3B,GAAG,cAAc,gBAAgB,mBAAmB,SAAS,IAAI,EAAE,KACrE;IACA,iBAAiB,aAAa,IAAI,UAAU,UAAU;IACtD,iBAAiB,aAAa,IAAI,SAAS,MAAM,KAAK;IACtD,OAAO,OAAO,QAAQ,EAAE,kBAAkB,iBAAiB,SAAS,EAAE,CAAC;GACzE;GACA,WAAW,UACT,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,QAAQ,SAAS,UAAU,sBAAsB;IACzE,MAAM,eAAe,OAAO,QAAQ,SAAS,cAAc,0BAA0B;IACrF,MAAM,QAAQ,OAAOA,aAAoB;KACvC,SAAS,OAAO,EAAE;KAClB;KACA,cAAc,SAAS,MAAM,YAAY;KACzC,MAAM,MAAM;KACZ,aAAa,MAAM;IACrB,CAAC;IACD,MAAM,eAAe,MAAM,OAAO;IAClC,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,SACvD,OAAO,OAAOC,KACZ,IAAIC,gBAAuB,EACzB,SAAS,qEACX,CAAC,CACH;IAEF,OAAO;KACL,QAAQ,SAAS,KAAK,MAAM,YAAY;KACxC,SAAS,EAAE,QAAQ,MAAM,QAAQ;KACjC,WAAW;IACb;GACF,CAAC;EACL;CACF;CAEA,OAAOC,KAA2B;EAChC,IAAI;EACJ,MAAM;EACN,aAAa,CAAC,gBAAgB;EAC9B,SAAS;EACT,gBAAgB;EAChB,MAAM;GACJ,OAAOC,UAAmB;IACxB,OAAO;IACP,SAAS;IACT,sBAAsB;IACtB,QAAQ;IACR,eAAe,EAAE,OAAO,aACtBC,KAAY,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KACzC,OAAO,WAAW;KAChB,QAAQ;KACR,SAAS,EAAE,QAAQ,UAAU,KAAK;KAClC,WAAW;IACb,EAAE,GACF,aACF;GACJ,CAAC;GACD,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD;EACA,UAAU,eAAe;GACvB,MAAM,gBAAgB,OAAO,SAAS,MAAM,WAAW,MAAM,CAAC;GAC9D,MAAM,UAAU,OAAO,oBAAoB,WAAW,CAAC,CAAC,WAAW,OAAO;GAC1E,MAAM,SAAS,QAAQ,SAAS,SAAS,QAAQ,MAAM,SAAS;GAChE,MAAM,oBAIJ,WAAW,OACPC,MAAa,eAAe,MAAM,CAAC,CAAC,KAClC,OAAO,KAAK,YAAY,QAAQ,KAAK,WAAW,SAAS,QAAQ,MAAM,CAAC,CAAC,CAC3E,IACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAOA,MAAa,eAAe,IAAI;IACxD,MAAMC,UAAQ,OAAOC,MAAa,aAAa,CAAC,CAAC,KAC/C,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,6BAC3B,OAAO,QAAQ,CAAC,CAAC,CACzB,CACF;IACA,MAAM,UAAU,OAAO,OAAO,QAAQD,UAAQ,SAC5CD,MAAa,eAAe,KAAK,EAAE,CAAC,CAAC,KACnC,OAAO,KAAK,YACV,QAAQ,KAAK,WAAW,SAAS,QAAQ,KAAK,QAAQ,KAAK,IAAI,CAAC,CAClE,CACF,CACF;IACA,OAAO,CAAC,GAAG,SAAS,KAAK,WAAW,SAAS,QAAQ,UAAU,CAAC,GAAG,GAAG,QAAQ,KAAK,CAAC;GACtF,CAAC;GACP,OAAO;IACL,oBAAoB,OAAO,QAAQ,YAAY;IAC/C;IACA,gBAAgB,WACd,OAAO,IAAI,aAAa;KACtB,MAAM,OAAO,OAAOG,OAAkB,MAAM;KAC5C,MAAM,UAAU,OAAO,YAAY;KACnC,OAAOC,aAAsB,MAAM,OAAO;IAC5C,CAAC;IACH,MAAM,WAAW;KACf,MAAM,QAAQ,OAAO,oBAAoB,WAAW,CAAC,CAAC,OAAO,OAAO;KACpE,OAAOC,IAAW,eAAe,MAAM,SAAS,SAAS,MAAM,MAAM,SAAS,MAAM;IACtF;GACF;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"Vercel.mjs","names":["Configuration.endpoint","Configuration.nonempty","Configuration.resolve","Configuration.secret","Client.exchangeCode","Errors.fail","Reason.Unauthenticated","Provider.make","Provider.tokenAuth","Client.user","Client.zones","teams","Client.teams","DomainName.decode","Provider.resolveAmong","Client.dns"],"sources":["../src/Vercel.ts"],"sourcesContent":["/** Vercel: personal tokens and marketplace integrations. */\nimport { type Config, Effect, Redacted, Schema } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport * as Configuration from \"./internal/config.ts\";\nimport { type Fetch, rejectedToken } from \"./internal/http.ts\";\nimport * as Client from \"./internal/vercel/client.ts\";\nimport type * as Protocol from \"./internal/vercel/protocol.ts\";\nimport * as Provider from \"./Provider.ts\";\n\n/** `teamId` is `null` for a personal account; targets carry the team that owns the zone. */\nexport const TeamContext = Schema.Struct({ teamId: Schema.NullOr(Schema.String) });\nexport type TeamContext = typeof TeamContext.Type;\n\n/** Token-method input: the access token, and a team id to scope the connection to one team. */\nexport const TokenFields = Schema.Struct({\n  token: Schema.RedactedFromValue(Schema.String),\n  teamId: Schema.optionalKey(Schema.String),\n});\n\nexport interface Options {\n  /** Omit to offer tokens only. */\n  readonly integration?: {\n    readonly clientId: string | Config.Config<string>;\n    readonly clientSecret: Redacted.Redacted<string> | Config.Config<Redacted.Redacted<string>>;\n    readonly slug: string;\n    /**\n     * Origin of the install page, which Vercel serves at `/integrations/{slug}/new` beneath it.\n     * Default `https://vercel.com`; a stage points it at an emulator that mounts the same path.\n     * It stays separate from `baseUrl` because in production these are different hosts:\n     * `vercel.com` for the browser install, `api.vercel.com` for the code exchange and the REST API.\n     */\n    readonly installOrigin?: string;\n  };\n  readonly fetch?: Fetch;\n  readonly baseUrl?: string;\n}\n\nconst capabilities = [\"dns:read\", \"dns:write\"] as const;\n\nexport const provider = (options: Options = {}): Provider.Definition<TeamContext> => {\n  const fetch = options.fetch ?? globalThis.fetch;\n  const baseUrl = options.baseUrl ?? \"https://api.vercel.com\";\n  const client = (token: string): Client.Options => ({\n    token,\n    fetch,\n    baseUrl: baseUrl.replace(/\\/$/, \"\"),\n  });\n\n  const targetOf = (domain: Protocol.Domain, label: string): Provider.Target => ({\n    zone: domain.name,\n    context: { teamId: domain.teamId } satisfies TeamContext,\n    label: `${domain.name} (${label})`,\n    nameservers: domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers,\n  });\n\n  const integration =\n    options.integration === undefined ? undefined : integrationAuth(options.integration);\n\n  function integrationAuth(\n    settings: NonNullable<Options[\"integration\"]>,\n  ): Provider.IntegrationAuth {\n    const installOrigin = settings.installOrigin ?? \"https://vercel.com\";\n    const credentials = () =>\n      Effect.gen(function* () {\n        yield* Configuration.endpoint(\n          settings.installOrigin ?? \"https://vercel.com\",\n          \"integration.installOrigin\",\n        );\n        yield* Configuration.endpoint(options.baseUrl ?? \"https://api.vercel.com\", \"baseUrl\");\n        yield* Configuration.nonempty(settings.slug, \"integration.slug\");\n        const clientId = yield* Configuration.resolve(\n          settings.clientId,\n          \"integration.clientId\",\n        ).pipe(Effect.flatMap((v) => Configuration.nonempty(v, \"integration.clientId\")));\n        const clientSecret = yield* Configuration.resolve(\n          settings.clientSecret,\n          \"integration.clientSecret\",\n        ).pipe(Effect.flatMap((v) => Configuration.secret(v, \"integration.clientSecret\")));\n        return { clientId, clientSecret };\n      });\n    return {\n      label: \"Install the Vercel integration\",\n      registration: { clientAuth: \"client_secret_post\" },\n      start: (input) =>\n        Effect.gen(function* () {\n          yield* credentials();\n          const authorizationUrl = new URL(\n            `${installOrigin.replace(/\\/$/, \"\")}/integrations/${encodeURIComponent(settings.slug)}/new`,\n          );\n          authorizationUrl.searchParams.set(\"source\", \"external\");\n          authorizationUrl.searchParams.set(\"state\", input.state);\n          return { authorizationUrl: authorizationUrl.toString() };\n        }),\n      complete: (input) =>\n        Effect.gen(function* () {\n          const { clientId, clientSecret } = yield* credentials();\n          const token = yield* Client.exchangeCode({\n            options: client(\"\"),\n            clientId,\n            clientSecret: Redacted.value(clientSecret),\n            code: input.code,\n            callbackUrl: input.callbackUrl,\n          });\n          const callbackTeam = input.params.teamId;\n          if (callbackTeam !== undefined && callbackTeam !== token.team_id) {\n            return yield* Errors.fail(\n              new Reason.Unauthenticated({\n                message: \"Vercel integration callback team does not match the installed team\",\n              }),\n            );\n          }\n          return {\n            secret: Redacted.make(token.access_token),\n            context: { teamId: token.team_id } satisfies TeamContext,\n            expiresAt: null,\n          };\n        }),\n    };\n  }\n\n  return Provider.make<TeamContext>({\n    id: \"vercel\",\n    name: \"Vercel\",\n    nameservers: [\"vercel-dns.com\"],\n    context: TeamContext,\n    contextVersion: \"vercel.v1\",\n    auth: {\n      token: Provider.tokenAuth({\n        label: \"Access token\",\n        docsUrl: \"https://vercel.com/account/settings/tokens\",\n        requiredCapabilities: capabilities,\n        fields: TokenFields,\n        authenticate: ({ token, teamId }) =>\n          Client.user(client(Redacted.value(token))).pipe(\n            Effect.map(() => ({\n              secret: token,\n              context: { teamId: teamId ?? null } satisfies TeamContext,\n              expiresAt: null,\n            })),\n            rejectedToken,\n          ),\n      }),\n      ...(integration === undefined ? {} : { integration }),\n    },\n    session: (credential) => {\n      const clientOptions = client(Redacted.value(credential.secret));\n      const context = Schema.decodeUnknownOption(TeamContext)(credential.context);\n      const teamId = context._tag === \"Some\" ? context.value.teamId : null;\n      const listTargets = (): Effect.Effect<\n        ReadonlyArray<Provider.Target>,\n        Errors.DomainKitError\n      > =>\n        teamId !== null\n          ? Client.zones(clientOptions, teamId).pipe(\n              Effect.map((domains) => domains.map((domain) => targetOf(domain, teamId))),\n            )\n          : Effect.gen(function* () {\n              const personal = yield* Client.zones(clientOptions, null);\n              const teams = yield* Client.teams(clientOptions).pipe(\n                Effect.catchIf(\n                  (error) => error.reason._tag !== \"ProviderUnavailable\",\n                  () => Effect.succeed([]),\n                ),\n              );\n              const perTeam = yield* Effect.forEach(teams, (team) =>\n                Client.zones(clientOptions, team.id).pipe(\n                  Effect.map((domains) =>\n                    domains.map((domain) => targetOf(domain, team.name ?? team.slug)),\n                  ),\n                ),\n              );\n              return [...personal.map((domain) => targetOf(domain, \"personal\")), ...perTeam.flat()];\n            });\n      return {\n        capabilities: () => Effect.succeed(capabilities),\n        listTargets,\n        resolveTarget: (domain) =>\n          Effect.gen(function* () {\n            const name = yield* DomainName.decode(domain);\n            const targets = yield* listTargets();\n            return Provider.resolveAmong(name, targets);\n          }),\n        dns: (target) => {\n          const scope = Schema.decodeUnknownOption(TeamContext)(target.context);\n          return Client.dns(clientOptions, scope._tag === \"Some\" ? scope.value.teamId : teamId);\n        },\n      };\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAaA,MAAa,cAAc,OAAO,OAAO,EAAE,QAAQ,OAAO,OAAO,OAAO,MAAM,EAAE,CAAC;;AAIjF,MAAa,cAAc,OAAO,OAAO;CACvC,OAAO,OAAO,kBAAkB,OAAO,MAAM;CAC7C,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC;AAoBD,MAAM,eAAe,CAAC,YAAY,WAAW;AAE7C,MAAa,YAAY,UAAmB,CAAC,MAAwC;CACnF,MAAM,QAAQ,QAAQ,SAAS,WAAW;CAC1C,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,UAAU,WAAmC;EACjD;EACA;EACA,SAAS,QAAQ,QAAQ,OAAO,EAAE;CACpC;CAEA,MAAM,YAAY,QAAyB,WAAoC;EAC7E,MAAM,OAAO;EACb,SAAS,EAAE,QAAQ,OAAO,OAAO;EACjC,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM;EAChC,aAAa,OAAO,YAAY,SAAS,IAAI,OAAO,cAAc,OAAO;CAC3E;CAEA,MAAM,cACJ,QAAQ,gBAAgB,KAAA,IAAY,KAAA,IAAY,gBAAgB,QAAQ,WAAW;CAErF,SAAS,gBACP,UAC0B;EAC1B,MAAM,gBAAgB,SAAS,iBAAiB;EAChD,MAAM,oBACJ,OAAO,IAAI,aAAa;GACtB,OAAOA,SACL,SAAS,iBAAiB,sBAC1B,2BACF;GACA,OAAOA,SAAuB,QAAQ,WAAW,0BAA0B,SAAS;GACpF,OAAOC,SAAuB,SAAS,MAAM,kBAAkB;GAS/D,OAAO;IAAE,UAAA,OAReC,QACtB,SAAS,UACT,sBACF,CAAC,CAAC,KAAK,OAAO,SAAS,MAAMD,SAAuB,GAAG,sBAAsB,CAAC,CAAC;IAK5D,cAAA,OAJSC,QAC1B,SAAS,cACT,0BACF,CAAC,CAAC,KAAK,OAAO,SAAS,MAAMC,OAAqB,GAAG,0BAA0B,CAAC,CAAC;GACjD;EAClC,CAAC;EACH,OAAO;GACL,OAAO;GACP,cAAc,EAAE,YAAY,qBAAqB;GACjD,QAAQ,UACN,OAAO,IAAI,aAAa;IACtB,OAAO,YAAY;IACnB,MAAM,mBAAmB,IAAI,IAC3B,GAAG,cAAc,QAAQ,OAAO,EAAE,EAAE,gBAAgB,mBAAmB,SAAS,IAAI,EAAE,KACxF;IACA,iBAAiB,aAAa,IAAI,UAAU,UAAU;IACtD,iBAAiB,aAAa,IAAI,SAAS,MAAM,KAAK;IACtD,OAAO,EAAE,kBAAkB,iBAAiB,SAAS,EAAE;GACzD,CAAC;GACH,WAAW,UACT,OAAO,IAAI,aAAa;IACtB,MAAM,EAAE,UAAU,iBAAiB,OAAO,YAAY;IACtD,MAAM,QAAQ,OAAOC,aAAoB;KACvC,SAAS,OAAO,EAAE;KAClB;KACA,cAAc,SAAS,MAAM,YAAY;KACzC,MAAM,MAAM;KACZ,aAAa,MAAM;IACrB,CAAC;IACD,MAAM,eAAe,MAAM,OAAO;IAClC,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,SACvD,OAAO,OAAOC,KACZ,IAAIC,gBAAuB,EACzB,SAAS,qEACX,CAAC,CACH;IAEF,OAAO;KACL,QAAQ,SAAS,KAAK,MAAM,YAAY;KACxC,SAAS,EAAE,QAAQ,MAAM,QAAQ;KACjC,WAAW;IACb;GACF,CAAC;EACL;CACF;CAEA,OAAOC,KAA2B;EAChC,IAAI;EACJ,MAAM;EACN,aAAa,CAAC,gBAAgB;EAC9B,SAAS;EACT,gBAAgB;EAChB,MAAM;GACJ,OAAOC,UAAmB;IACxB,OAAO;IACP,SAAS;IACT,sBAAsB;IACtB,QAAQ;IACR,eAAe,EAAE,OAAO,aACtBC,KAAY,OAAO,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KACzC,OAAO,WAAW;KAChB,QAAQ;KACR,SAAS,EAAE,QAAQ,UAAU,KAAK;KAClC,WAAW;IACb,EAAE,GACF,aACF;GACJ,CAAC;GACD,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD;EACA,UAAU,eAAe;GACvB,MAAM,gBAAgB,OAAO,SAAS,MAAM,WAAW,MAAM,CAAC;GAC9D,MAAM,UAAU,OAAO,oBAAoB,WAAW,CAAC,CAAC,WAAW,OAAO;GAC1E,MAAM,SAAS,QAAQ,SAAS,SAAS,QAAQ,MAAM,SAAS;GAChE,MAAM,oBAIJ,WAAW,OACPC,MAAa,eAAe,MAAM,CAAC,CAAC,KAClC,OAAO,KAAK,YAAY,QAAQ,KAAK,WAAW,SAAS,QAAQ,MAAM,CAAC,CAAC,CAC3E,IACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAOA,MAAa,eAAe,IAAI;IACxD,MAAMC,UAAQ,OAAOC,MAAa,aAAa,CAAC,CAAC,KAC/C,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,6BAC3B,OAAO,QAAQ,CAAC,CAAC,CACzB,CACF;IACA,MAAM,UAAU,OAAO,OAAO,QAAQD,UAAQ,SAC5CD,MAAa,eAAe,KAAK,EAAE,CAAC,CAAC,KACnC,OAAO,KAAK,YACV,QAAQ,KAAK,WAAW,SAAS,QAAQ,KAAK,QAAQ,KAAK,IAAI,CAAC,CAClE,CACF,CACF;IACA,OAAO,CAAC,GAAG,SAAS,KAAK,WAAW,SAAS,QAAQ,UAAU,CAAC,GAAG,GAAG,QAAQ,KAAK,CAAC;GACtF,CAAC;GACP,OAAO;IACL,oBAAoB,OAAO,QAAQ,YAAY;IAC/C;IACA,gBAAgB,WACd,OAAO,IAAI,aAAa;KACtB,MAAM,OAAO,OAAOG,OAAkB,MAAM;KAC5C,MAAM,UAAU,OAAO,YAAY;KACnC,OAAOC,aAAsB,MAAM,OAAO;IAC5C,CAAC;IACH,MAAM,WAAW;KACf,MAAM,QAAQ,OAAO,oBAAoB,WAAW,CAAC,CAAC,OAAO,OAAO;KACpE,OAAOC,IAAW,eAAe,MAAM,SAAS,SAAS,MAAM,MAAM,SAAS,MAAM;IACtF;GACF;EACF;CACF,CAAC;AACH"}

package/dist/entry/client.mjs

@@ -1,2 +1 @@
-import { Transport_exports } from "../Transport.mjs";
-export { Transport_exports as Transport };
+export { Transport_exports as Transport } from "../Transport.mjs";

package/dist/entry/server.mjs

@@ -1,2 +1 @@
-import { Server_exports } from "../Server.mjs";
-export { Server_exports as Server };
+export { Server_exports as Server } from "../Server.mjs";

package/dist/internal/callback.mjs

@@ -0,0 +1,13 @@
+import { InvalidInput } from "../Reason.mjs";
+import { fail } from "./error.mjs";
+//#region src/internal/callback.ts
+/** A leaked flow id must reveal neither existence nor ownership, including read races. */
+const refuse = fail(new InvalidInput({
+	message: "This callback does not match a connection you started",
+	field: "state"
+}));
+const missing = (error) => error.reason._tag === "NotFound" || error.reason._tag === "Expired";
+//#endregion
+export { missing, refuse };
+
+//# sourceMappingURL=callback.mjs.map

package/dist/internal/callback.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.mjs","names":["Errors.fail","Reason.InvalidInput"],"sources":["../../src/internal/callback.ts"],"sourcesContent":["import * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\n/** A leaked flow id must reveal neither existence nor ownership, including read races. */\nexport const refuse = Errors.fail(\n  new Reason.InvalidInput({\n    message: \"This callback does not match a connection you started\",\n    field: \"state\",\n  }),\n);\nexport const missing = (error: Errors.DomainKitError): boolean =>\n  error.reason._tag === \"NotFound\" || error.reason._tag === \"Expired\";\n"],"mappings":";;;;AAIA,MAAa,SAASA,KACpB,IAAIC,aAAoB;CACtB,SAAS;CACT,OAAO;AACT,CAAC,CACH;AACA,MAAa,WAAW,UACtB,MAAM,OAAO,SAAS,cAAc,MAAM,OAAO,SAAS"}

package/dist/internal/config.mjs

@@ -1,13 +1,27 @@
 import { InvalidInput } from "../Reason.mjs";
-import { DomainKitError } from "./error.mjs";
-import { Config, Effect } from "effect";
+import { DomainKitError, fail } from "./error.mjs";
+import { Config, Effect, Redacted } from "effect";
 //#region src/internal/config.ts
 /** Accept a literal or a `Config`; config failures surface as `InvalidInput` on `field`. */
-const resolve = (value, field) => Config.isConfig(value) ? value.pipe(Effect.mapError((cause) => new DomainKitError({ reason: new InvalidInput({
-	message: cause.message,
+const resolve = (value, field) => Config.isConfig(value) ? value.pipe(Effect.mapError(() => new DomainKitError({ reason: new InvalidInput({
+	message: `Could not resolve ${field}`,
 	field
 }) }))) : Effect.succeed(value);
+/** Configuration diagnostics name the field, never the rejected value. */
+const requireValue = (value, valid, field, message) => Effect.suspend(() => valid(value) ? Effect.succeed(value) : fail(new InvalidInput({
+	field,
+	message
+})));
+const nonempty = (value, field) => requireValue(value, (v) => typeof v === "string" && v.trim().length > 0, field, `${field} must be a nonempty string`);
+const secret = (value, field) => requireValue(value, (v) => Redacted.isRedacted(v) && typeof Redacted.value(v) === "string" && Redacted.value(v).trim().length > 0, field, `${field} must be a nonempty Redacted string`);
+/** Paths and split emulator origins are supported; URL suffixes must remain paths. */
+const endpoint = (value, field) => requireValue(value, (v) => {
+	if (typeof v !== "string" || v !== v.trim() || [...v].some((character) => character.charCodeAt(0) < 32)) return false;
+	const url = URL.parse(v);
+	return url !== null && (url.protocol === "https:" || url.protocol === "http:") && url.username === "" && url.password === "" && !url.href.includes("?") && !url.href.includes("#");
+}, field, `${field} must be an HTTP(S) URL without surrounding whitespace, control characters, credentials, query, or fragment`);
+const scopes = (value, field) => requireValue(value, (v) => Array.isArray(v) && v.every((scope) => typeof scope === "string" && /^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope)), field, `${field} must contain valid OAuth scope tokens`);
 //#endregion
-export { resolve };
+export { endpoint, nonempty, requireValue, resolve, scopes, secret };
 
 //# sourceMappingURL=config.mjs.map

package/dist/internal/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":["Errors.DomainKitError","Reason.InvalidInput"],"sources":["../../src/internal/config.ts"],"sourcesContent":["import { Config, Effect } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\n/** Accept a literal or a `Config`; config failures surface as `InvalidInput` on `field`. */\nexport const resolve = <A>(\n  value: A | Config.Config<A>,\n  field: string,\n): Effect.Effect<A, Errors.DomainKitError> =>\n  Config.isConfig(value)\n    ? value.pipe(\n        Effect.mapError(\n          (cause) =>\n            new Errors.DomainKitError({\n              reason: new Reason.InvalidInput({ message: cause.message, field }),\n            }),\n        ),\n      )\n    : Effect.succeed(value);\n"],"mappings":";;;;;AAMA,MAAa,WACX,OACA,UAEA,OAAO,SAAS,KAAK,IACjB,MAAM,KACJ,OAAO,UACJ,UACC,IAAIA,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAAE,SAAS,MAAM;CAAS;AAAM,CAAC,EACnE,CAAC,CACL,CACF,IACA,OAAO,QAAQ,KAAK"}
+{"version":3,"file":"config.mjs","names":["Errors.DomainKitError","Reason.InvalidInput","Errors.fail"],"sources":["../../src/internal/config.ts"],"sourcesContent":["import { Config, Effect, Redacted } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\n\n/** Accept a literal or a `Config`; config failures surface as `InvalidInput` on `field`. */\nexport const resolve = <A>(\n  value: A | Config.Config<A>,\n  field: string,\n): Effect.Effect<A, Errors.DomainKitError> =>\n  Config.isConfig(value)\n    ? value.pipe(\n        Effect.mapError(\n          () =>\n            new Errors.DomainKitError({\n              reason: new Reason.InvalidInput({ message: `Could not resolve ${field}`, field }),\n            }),\n        ),\n      )\n    : Effect.succeed(value);\n\n/** Configuration diagnostics name the field, never the rejected value. */\nexport const requireValue = <A>(\n  value: A,\n  valid: (value: A) => boolean,\n  field: string,\n  message: string,\n): Effect.Effect<A, Errors.DomainKitError> =>\n  Effect.suspend(() =>\n    valid(value) ? Effect.succeed(value) : Errors.fail(new Reason.InvalidInput({ field, message })),\n  );\n\nexport const nonempty = (value: string, field: string) =>\n  requireValue(\n    value,\n    (v) => typeof v === \"string\" && v.trim().length > 0,\n    field,\n    `${field} must be a nonempty string`,\n  );\n\nexport const secret = (value: Redacted.Redacted<string>, field: string) =>\n  requireValue(\n    value,\n    (v) =>\n      Redacted.isRedacted(v) &&\n      typeof Redacted.value(v) === \"string\" &&\n      Redacted.value(v).trim().length > 0,\n    field,\n    `${field} must be a nonempty Redacted string`,\n  );\n\n/** Paths and split emulator origins are supported; URL suffixes must remain paths. */\nexport const endpoint = (value: string, field: string) =>\n  requireValue(\n    value,\n    (v) => {\n      if (\n        typeof v !== \"string\" ||\n        v !== v.trim() ||\n        [...v].some((character) => character.charCodeAt(0) < 0x20)\n      )\n        return false;\n      const url = URL.parse(v);\n      return (\n        url !== null &&\n        (url.protocol === \"https:\" || url.protocol === \"http:\") &&\n        url.username === \"\" &&\n        url.password === \"\" &&\n        !url.href.includes(\"?\") &&\n        !url.href.includes(\"#\")\n      );\n    },\n    field,\n    `${field} must be an HTTP(S) URL without surrounding whitespace, control characters, credentials, query, or fragment`,\n  );\n\nexport const scopes = (value: ReadonlyArray<string>, field: string) =>\n  requireValue(\n    value,\n    (v) =>\n      Array.isArray(v) &&\n      v.every((scope) => typeof scope === \"string\" && /^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/.test(scope)),\n    field,\n    `${field} must contain valid OAuth scope tokens`,\n  );\n"],"mappings":";;;;;AAMA,MAAa,WACX,OACA,UAEA,OAAO,SAAS,KAAK,IACjB,MAAM,KACJ,OAAO,eAEH,IAAIA,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAAE,SAAS,qBAAqB;CAAS;AAAM,CAAC,EAClF,CAAC,CACL,CACF,IACA,OAAO,QAAQ,KAAK;;AAG1B,MAAa,gBACX,OACA,OACA,OACA,YAEA,OAAO,cACL,MAAM,KAAK,IAAI,OAAO,QAAQ,KAAK,IAAIC,KAAY,IAAID,aAAoB;CAAE;CAAO;AAAQ,CAAC,CAAC,CAChG;AAEF,MAAa,YAAY,OAAe,UACtC,aACE,QACC,MAAM,OAAO,MAAM,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS,GAClD,OACA,GAAG,MAAM,2BACX;AAEF,MAAa,UAAU,OAAkC,UACvD,aACE,QACC,MACC,SAAS,WAAW,CAAC,KACrB,OAAO,SAAS,MAAM,CAAC,MAAM,YAC7B,SAAS,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,GACpC,OACA,GAAG,MAAM,oCACX;;AAGF,MAAa,YAAY,OAAe,UACtC,aACE,QACC,MAAM;CACL,IACE,OAAO,MAAM,YACb,MAAM,EAAE,KAAK,KACb,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,cAAc,UAAU,WAAW,CAAC,IAAI,EAAI,GAEzD,OAAO;CACT,MAAM,MAAM,IAAI,MAAM,CAAC;CACvB,OACE,QAAQ,SACP,IAAI,aAAa,YAAY,IAAI,aAAa,YAC/C,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,CAAC,IAAI,KAAK,SAAS,GAAG,KACtB,CAAC,IAAI,KAAK,SAAS,GAAG;AAE1B,GACA,OACA,GAAG,MAAM,4GACX;AAEF,MAAa,UAAU,OAA8B,UACnD,aACE,QACC,MACC,MAAM,QAAQ,CAAC,KACf,EAAE,OAAO,UAAU,OAAO,UAAU,YAAY,8BAA8B,KAAK,KAAK,CAAC,GAC3F,OACA,GAAG,MAAM,uCACX"}

package/dist/internal/provider-async.mjs

@@ -60,6 +60,7 @@ const fromAsync = (definition) => {
 			}) },
 			...oauth === void 0 ? {} : { oauth: {
 				label: oauth.label,
+				...oauth.registration === void 0 ? {} : { registration: oauth.registration },
 				scopes: oauth.scopes,
 				start: (input) => call(() => oauth.start(input)),
 				complete: (input) => call(() => oauth.complete(input)).pipe(Effect.map(issued)),
@@ -68,6 +69,7 @@ const fromAsync = (definition) => {
 			} },
 			...integration === void 0 ? {} : { integration: {
 				label: integration.label,
+				...integration.registration === void 0 ? {} : { registration: integration.registration },
 				start: (input) => call(() => integration.start(input)),
 				complete: (input) => call(() => integration.complete(input)).pipe(Effect.map(issued)),
 				...integrationRefresh === void 0 ? {} : { refresh: (credential) => call(() => integrationRefresh(plain(credential))).pipe(Effect.map(issued)) },

package/dist/internal/provider-async.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider-async.mjs","names":["Errors.isDomainKitError","Errors.DomainKitError","Reason.ProviderUnavailable","Provider.make","Provider.tokenAuth"],"sources":["../../src/internal/provider-async.ts"],"sourcesContent":["import { DateTime, Effect, Redacted, type Schema } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\nimport type * as DnsRecord from \"../DnsRecord.ts\";\nimport * as Provider from \"../Provider.ts\";\nimport type { Capability } from \"../Storage.ts\";\n\n/** Plain-object credential for Promise-shaped providers; `secret` is the raw string. */\nexport interface AsyncCredential {\n  readonly secret: string;\n  readonly context: unknown;\n}\n\nexport interface AsyncIssuedCredential extends AsyncCredential {\n  readonly expiresAt: Date | null;\n}\n\nexport interface AsyncDns {\n  readonly list: (zone: string) => Promise<ReadonlyArray<Provider.ObservedRecord>>;\n  readonly create: (\n    zone: string,\n    record: DnsRecord.Model,\n  ) => Promise<{ readonly providerRecordId: string }>;\n  readonly get: (zone: string, providerRecordId: string) => Promise<DnsRecord.Observed | null>;\n  readonly delete: (zone: string, providerRecordId: string) => Promise<void>;\n}\n\nexport interface AsyncSession {\n  readonly listTargets: () => Promise<ReadonlyArray<Provider.Target>>;\n  readonly resolveTarget: (domain: string) => Promise<Provider.Resolution>;\n  readonly dns: (target: Provider.Target) => AsyncDns;\n  readonly capabilities: () => Promise<ReadonlyArray<Capability>>;\n}\n\nexport interface AsyncTokenAuth {\n  readonly label: string;\n  readonly docsUrl?: string;\n  readonly requiredCapabilities: ReadonlyArray<Capability>;\n  readonly fields: Schema.Struct<Provider.TokenFieldSchemas>;\n  /** Decoded field values with secrets unwrapped to strings. */\n  readonly authenticate: (\n    values: Readonly<Record<string, string | undefined>>,\n  ) => Promise<AsyncIssuedCredential>;\n}\n\nexport interface AsyncOAuthAuth {\n  readonly label: string;\n  readonly scopes: ReadonlyArray<string>;\n  readonly start: (input: {\n    readonly state: string;\n    readonly callbackUrl: string;\n    readonly codeChallenge: string;\n  }) => Promise<{ readonly authorizationUrl: string }>;\n  readonly complete: (\n    input: Provider.CallbackInput & { readonly codeVerifier: string },\n  ) => Promise<AsyncIssuedCredential>;\n  readonly refresh: (credential: AsyncCredential) => Promise<AsyncIssuedCredential>;\n  readonly revoke?: (credential: AsyncCredential) => Promise<void>;\n}\n\nexport interface AsyncIntegrationAuth {\n  readonly label: string;\n  readonly start: (input: {\n    readonly state: string;\n    readonly callbackUrl: string;\n  }) => Promise<{ readonly authorizationUrl: string }>;\n  readonly complete: (input: Provider.CallbackInput) => Promise<AsyncIssuedCredential>;\n  readonly refresh?: (credential: AsyncCredential) => Promise<AsyncIssuedCredential>;\n  readonly revoke?: (credential: AsyncCredential) => Promise<void>;\n}\n\n/** `Provider.Definition` with every operation returning a Promise. */\nexport interface AsyncDefinition<Context = unknown> {\n  readonly id: string;\n  readonly name: string;\n  readonly auth: {\n    readonly token?: AsyncTokenAuth;\n    readonly oauth?: AsyncOAuthAuth;\n    readonly integration?: AsyncIntegrationAuth;\n  };\n  readonly context: Schema.Codec<Context, unknown, never, never>;\n  readonly contextVersion: string;\n  readonly migrateContext?: (envelope: Provider.Envelope) => Promise<Context>;\n  readonly session: (credential: AsyncCredential) => AsyncSession;\n}\n\nconst failure = (provider: string) => (cause: unknown) =>\n  Errors.isDomainKitError(cause)\n    ? cause\n    : new Errors.DomainKitError({\n        reason: new Reason.ProviderUnavailable({\n          provider,\n          message: cause instanceof Error ? cause.message : `${provider} request failed`,\n        }),\n      });\n\nconst issued = (value: AsyncIssuedCredential): Provider.IssuedCredential => ({\n  secret: Redacted.make(value.secret),\n  context: value.context,\n  expiresAt: value.expiresAt === null ? null : DateTime.fromDateUnsafe(value.expiresAt),\n});\n\nconst plain = (credential: Provider.Credential): AsyncCredential => ({\n  secret: Redacted.value(credential.secret),\n  context: credential.context,\n});\n\n/** Adapt a Promise-shaped provider; rejections become `DomainKit.Error` (a thrown one passes through). */\nexport const fromAsync = <Context>(\n  definition: AsyncDefinition<Context>,\n): Provider.Definition<Context> => {\n  const call = <A>(run: () => Promise<A>): Provider.Fx<A> =>\n    Effect.tryPromise({ try: run, catch: failure(definition.id) });\n  const dns = (target: Provider.Target, inner: AsyncDns): Provider.Dns => ({\n    list: (zone) => call(() => inner.list(zone)),\n    create: (zone, record) => call(() => inner.create(zone, record)),\n    get: (zone, providerRecordId) => call(() => inner.get(zone, providerRecordId)),\n    delete: (zone, providerRecordId) => call(() => inner.delete(zone, providerRecordId)),\n  });\n  const session = (credential: Provider.Credential): Provider.Session => {\n    const inner = definition.session(plain(credential));\n    return {\n      listTargets: () => call(() => inner.listTargets()),\n      resolveTarget: (domain) => call(() => inner.resolveTarget(domain)),\n      capabilities: () => call(() => inner.capabilities()),\n      dns: (target) => dns(target, inner.dns(target)),\n    };\n  };\n  const token = definition.auth.token;\n  const oauth = definition.auth.oauth;\n  const integration = definition.auth.integration;\n  const migrate = definition.migrateContext;\n  const oauthRevoke = oauth?.revoke;\n  const integrationRefresh = integration?.refresh;\n  const integrationRevoke = integration?.revoke;\n  return Provider.make<Context>({\n    id: definition.id,\n    name: definition.name,\n    context: definition.context,\n    contextVersion: definition.contextVersion,\n    ...(migrate === undefined\n      ? {}\n      : {\n          migrateContext: (envelope: Provider.Envelope) => call(() => migrate(envelope)),\n        }),\n    auth: {\n      ...(token === undefined\n        ? {}\n        : {\n            token: Provider.tokenAuth({\n              label: token.label,\n              ...(token.docsUrl === undefined ? {} : { docsUrl: token.docsUrl }),\n              requiredCapabilities: token.requiredCapabilities,\n              fields: token.fields,\n              authenticate: (values) =>\n                call(() =>\n                  token.authenticate(\n                    Object.fromEntries(\n                      Object.entries(values as Record<string, unknown>).map(([name, value]) => [\n                        name,\n                        Redacted.isRedacted(value)\n                          ? String(Redacted.value(value))\n                          : value === undefined\n                            ? undefined\n                            : String(value),\n                      ]),\n                    ),\n                  ),\n                ).pipe(Effect.map(issued)),\n            }),\n          }),\n      ...(oauth === undefined\n        ? {}\n        : {\n            oauth: {\n              label: oauth.label,\n              scopes: oauth.scopes,\n              start: (input) => call(() => oauth.start(input)),\n              complete: (input) => call(() => oauth.complete(input)).pipe(Effect.map(issued)),\n              refresh: (credential) =>\n                call(() => oauth.refresh(plain(credential))).pipe(Effect.map(issued)),\n              ...(oauthRevoke === undefined\n                ? {}\n                : {\n                    revoke: (credential: Provider.Credential) =>\n                      call(() => oauthRevoke(plain(credential))),\n                  }),\n            } satisfies Provider.OAuthAuth,\n          }),\n      ...(integration === undefined\n        ? {}\n        : {\n            integration: {\n              label: integration.label,\n              start: (input) => call(() => integration.start(input)),\n              complete: (input) => call(() => integration.complete(input)).pipe(Effect.map(issued)),\n              ...(integrationRefresh === undefined\n                ? {}\n                : {\n                    refresh: (credential: Provider.Credential) =>\n                      call(() => integrationRefresh(plain(credential))).pipe(Effect.map(issued)),\n                  }),\n              ...(integrationRevoke === undefined\n                ? {}\n                : {\n                    revoke: (credential: Provider.Credential) =>\n                      call(() => integrationRevoke(plain(credential))),\n                  }),\n            } satisfies Provider.IntegrationAuth,\n          }),\n    },\n    session,\n  });\n};\n"],"mappings":";;;;;AAuFA,MAAM,WAAW,cAAsB,UACrCA,iBAAwB,KAAK,IACzB,QACA,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,oBAA2B;CACrC;CACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,GAAG,SAAS;AAChE,CAAC,EACH,CAAC;AAEP,MAAM,UAAU,WAA6D;CAC3E,QAAQ,SAAS,KAAK,MAAM,MAAM;CAClC,SAAS,MAAM;CACf,WAAW,MAAM,cAAc,OAAO,OAAO,SAAS,eAAe,MAAM,SAAS;AACtF;AAEA,MAAM,SAAS,gBAAsD;CACnE,QAAQ,SAAS,MAAM,WAAW,MAAM;CACxC,SAAS,WAAW;AACtB;;AAGA,MAAa,aACX,eACiC;CACjC,MAAM,QAAW,QACf,OAAO,WAAW;EAAE,KAAK;EAAK,OAAO,QAAQ,WAAW,EAAE;CAAE,CAAC;CAC/D,MAAM,OAAO,QAAyB,WAAmC;EACvE,OAAO,SAAS,WAAW,MAAM,KAAK,IAAI,CAAC;EAC3C,SAAS,MAAM,WAAW,WAAW,MAAM,OAAO,MAAM,MAAM,CAAC;EAC/D,MAAM,MAAM,qBAAqB,WAAW,MAAM,IAAI,MAAM,gBAAgB,CAAC;EAC7E,SAAS,MAAM,qBAAqB,WAAW,MAAM,OAAO,MAAM,gBAAgB,CAAC;CACrF;CACA,MAAM,WAAW,eAAsD;EACrE,MAAM,QAAQ,WAAW,QAAQ,MAAM,UAAU,CAAC;EAClD,OAAO;GACL,mBAAmB,WAAW,MAAM,YAAY,CAAC;GACjD,gBAAgB,WAAW,WAAW,MAAM,cAAc,MAAM,CAAC;GACjE,oBAAoB,WAAW,MAAM,aAAa,CAAC;GACnD,MAAM,WAAW,IAAI,QAAQ,MAAM,IAAI,MAAM,CAAC;EAChD;CACF;CACA,MAAM,QAAQ,WAAW,KAAK;CAC9B,MAAM,QAAQ,WAAW,KAAK;CAC9B,MAAM,cAAc,WAAW,KAAK;CACpC,MAAM,UAAU,WAAW;CAC3B,MAAM,cAAc,OAAO;CAC3B,MAAM,qBAAqB,aAAa;CACxC,MAAM,oBAAoB,aAAa;CACvC,OAAOC,KAAuB;EAC5B,IAAI,WAAW;EACf,MAAM,WAAW;EACjB,SAAS,WAAW;EACpB,gBAAgB,WAAW;EAC3B,GAAI,YAAY,KAAA,IACZ,CAAC,IACD,EACE,iBAAiB,aAAgC,WAAW,QAAQ,QAAQ,CAAC,EAC/E;EACJ,MAAM;GACJ,GAAI,UAAU,KAAA,IACV,CAAC,IACD,EACE,OAAOC,UAAmB;IACxB,OAAO,MAAM;IACb,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;IAChE,sBAAsB,MAAM;IAC5B,QAAQ,MAAM;IACd,eAAe,WACb,WACE,MAAM,aACJ,OAAO,YACL,OAAO,QAAQ,MAAiC,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACvE,MACA,SAAS,WAAW,KAAK,IACrB,OAAO,SAAS,MAAM,KAAK,CAAC,IAC5B,UAAU,KAAA,IACR,KAAA,IACA,OAAO,KAAK,CACpB,CAAC,CACH,CACF,CACF,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;GAC7B,CAAC,EACH;GACJ,GAAI,UAAU,KAAA,IACV,CAAC,IACD,EACE,OAAO;IACL,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,QAAQ,UAAU,WAAW,MAAM,MAAM,KAAK,CAAC;IAC/C,WAAW,UAAU,WAAW,MAAM,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;IAC9E,UAAU,eACR,WAAW,MAAM,QAAQ,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;IACtE,GAAI,gBAAgB,KAAA,IAChB,CAAC,IACD,EACE,SAAS,eACP,WAAW,YAAY,MAAM,UAAU,CAAC,CAAC,EAC7C;GACN,EACF;GACJ,GAAI,gBAAgB,KAAA,IAChB,CAAC,IACD,EACE,aAAa;IACX,OAAO,YAAY;IACnB,QAAQ,UAAU,WAAW,YAAY,MAAM,KAAK,CAAC;IACrD,WAAW,UAAU,WAAW,YAAY,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;IACpF,GAAI,uBAAuB,KAAA,IACvB,CAAC,IACD,EACE,UAAU,eACR,WAAW,mBAAmB,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,EAC7E;IACJ,GAAI,sBAAsB,KAAA,IACtB,CAAC,IACD,EACE,SAAS,eACP,WAAW,kBAAkB,MAAM,UAAU,CAAC,CAAC,EACnD;GACN,EACF;EACN;EACA;CACF,CAAC;AACH"}
+{"version":3,"file":"provider-async.mjs","names":["Errors.isDomainKitError","Errors.DomainKitError","Reason.ProviderUnavailable","Provider.make","Provider.tokenAuth"],"sources":["../../src/internal/provider-async.ts"],"sourcesContent":["import { DateTime, Effect, Redacted, type Schema } from \"effect\";\n\nimport * as Errors from \"./error.ts\";\nimport * as Reason from \"../Reason.ts\";\nimport type * as DnsRecord from \"../DnsRecord.ts\";\nimport * as Provider from \"../Provider.ts\";\nimport type { Capability } from \"../Storage.ts\";\n\n/** Plain-object credential for Promise-shaped providers; `secret` is the raw string. */\nexport interface AsyncCredential {\n  readonly secret: string;\n  readonly context: unknown;\n}\n\nexport interface AsyncIssuedCredential extends AsyncCredential {\n  readonly expiresAt: Date | null;\n}\n\nexport interface AsyncDns {\n  readonly list: (zone: string) => Promise<ReadonlyArray<Provider.ObservedRecord>>;\n  readonly create: (\n    zone: string,\n    record: DnsRecord.Model,\n  ) => Promise<{ readonly providerRecordId: string }>;\n  readonly get: (zone: string, providerRecordId: string) => Promise<DnsRecord.Observed | null>;\n  readonly delete: (zone: string, providerRecordId: string) => Promise<void>;\n}\n\nexport interface AsyncSession {\n  readonly listTargets: () => Promise<ReadonlyArray<Provider.Target>>;\n  readonly resolveTarget: (domain: string) => Promise<Provider.Resolution>;\n  readonly dns: (target: Provider.Target) => AsyncDns;\n  readonly capabilities: () => Promise<ReadonlyArray<Capability>>;\n}\n\nexport interface AsyncTokenAuth {\n  readonly label: string;\n  readonly docsUrl?: string;\n  readonly requiredCapabilities: ReadonlyArray<Capability>;\n  readonly fields: Schema.Struct<Provider.TokenFieldSchemas>;\n  /** Decoded field values with secrets unwrapped to strings. */\n  readonly authenticate: (\n    values: Readonly<Record<string, string | undefined>>,\n  ) => Promise<AsyncIssuedCredential>;\n}\n\nexport interface AsyncOAuthAuth {\n  readonly registration?: Provider.OAuthAuth[\"registration\"];\n  readonly label: string;\n  readonly scopes: ReadonlyArray<string>;\n  readonly start: (input: {\n    readonly state: string;\n    readonly callbackUrl: string;\n    readonly codeChallenge: string;\n  }) => Promise<{ readonly authorizationUrl: string }>;\n  readonly complete: (\n    input: Provider.CallbackInput & { readonly codeVerifier: string },\n  ) => Promise<AsyncIssuedCredential>;\n  readonly refresh: (credential: AsyncCredential) => Promise<AsyncIssuedCredential>;\n  readonly revoke?: (credential: AsyncCredential) => Promise<void>;\n}\n\nexport interface AsyncIntegrationAuth {\n  readonly registration?: Provider.IntegrationAuth[\"registration\"];\n  readonly label: string;\n  readonly start: (input: {\n    readonly state: string;\n    readonly callbackUrl: string;\n  }) => Promise<{ readonly authorizationUrl: string }>;\n  readonly complete: (input: Provider.CallbackInput) => Promise<AsyncIssuedCredential>;\n  readonly refresh?: (credential: AsyncCredential) => Promise<AsyncIssuedCredential>;\n  readonly revoke?: (credential: AsyncCredential) => Promise<void>;\n}\n\n/** `Provider.Definition` with every operation returning a Promise. */\nexport interface AsyncDefinition<Context = unknown> {\n  readonly id: string;\n  readonly name: string;\n  readonly auth: {\n    readonly token?: AsyncTokenAuth;\n    readonly oauth?: AsyncOAuthAuth;\n    readonly integration?: AsyncIntegrationAuth;\n  };\n  readonly context: Schema.Codec<Context, unknown, never, never>;\n  readonly contextVersion: string;\n  readonly migrateContext?: (envelope: Provider.Envelope) => Promise<Context>;\n  readonly session: (credential: AsyncCredential) => AsyncSession;\n}\n\nconst failure = (provider: string) => (cause: unknown) =>\n  Errors.isDomainKitError(cause)\n    ? cause\n    : new Errors.DomainKitError({\n        reason: new Reason.ProviderUnavailable({\n          provider,\n          message: cause instanceof Error ? cause.message : `${provider} request failed`,\n        }),\n      });\n\nconst issued = (value: AsyncIssuedCredential): Provider.IssuedCredential => ({\n  secret: Redacted.make(value.secret),\n  context: value.context,\n  expiresAt: value.expiresAt === null ? null : DateTime.fromDateUnsafe(value.expiresAt),\n});\n\nconst plain = (credential: Provider.Credential): AsyncCredential => ({\n  secret: Redacted.value(credential.secret),\n  context: credential.context,\n});\n\n/** Adapt a Promise-shaped provider; rejections become `DomainKit.Error` (a thrown one passes through). */\nexport const fromAsync = <Context>(\n  definition: AsyncDefinition<Context>,\n): Provider.Definition<Context> => {\n  const call = <A>(run: () => Promise<A>): Provider.Fx<A> =>\n    Effect.tryPromise({ try: run, catch: failure(definition.id) });\n  const dns = (target: Provider.Target, inner: AsyncDns): Provider.Dns => ({\n    list: (zone) => call(() => inner.list(zone)),\n    create: (zone, record) => call(() => inner.create(zone, record)),\n    get: (zone, providerRecordId) => call(() => inner.get(zone, providerRecordId)),\n    delete: (zone, providerRecordId) => call(() => inner.delete(zone, providerRecordId)),\n  });\n  const session = (credential: Provider.Credential): Provider.Session => {\n    const inner = definition.session(plain(credential));\n    return {\n      listTargets: () => call(() => inner.listTargets()),\n      resolveTarget: (domain) => call(() => inner.resolveTarget(domain)),\n      capabilities: () => call(() => inner.capabilities()),\n      dns: (target) => dns(target, inner.dns(target)),\n    };\n  };\n  const token = definition.auth.token;\n  const oauth = definition.auth.oauth;\n  const integration = definition.auth.integration;\n  const migrate = definition.migrateContext;\n  const oauthRevoke = oauth?.revoke;\n  const integrationRefresh = integration?.refresh;\n  const integrationRevoke = integration?.revoke;\n  return Provider.make<Context>({\n    id: definition.id,\n    name: definition.name,\n    context: definition.context,\n    contextVersion: definition.contextVersion,\n    ...(migrate === undefined\n      ? {}\n      : {\n          migrateContext: (envelope: Provider.Envelope) => call(() => migrate(envelope)),\n        }),\n    auth: {\n      ...(token === undefined\n        ? {}\n        : {\n            token: Provider.tokenAuth({\n              label: token.label,\n              ...(token.docsUrl === undefined ? {} : { docsUrl: token.docsUrl }),\n              requiredCapabilities: token.requiredCapabilities,\n              fields: token.fields,\n              authenticate: (values) =>\n                call(() =>\n                  token.authenticate(\n                    Object.fromEntries(\n                      Object.entries(values as Record<string, unknown>).map(([name, value]) => [\n                        name,\n                        Redacted.isRedacted(value)\n                          ? String(Redacted.value(value))\n                          : value === undefined\n                            ? undefined\n                            : String(value),\n                      ]),\n                    ),\n                  ),\n                ).pipe(Effect.map(issued)),\n            }),\n          }),\n      ...(oauth === undefined\n        ? {}\n        : {\n            oauth: {\n              label: oauth.label,\n              ...(oauth.registration === undefined ? {} : { registration: oauth.registration }),\n              scopes: oauth.scopes,\n              start: (input) => call(() => oauth.start(input)),\n              complete: (input) => call(() => oauth.complete(input)).pipe(Effect.map(issued)),\n              refresh: (credential) =>\n                call(() => oauth.refresh(plain(credential))).pipe(Effect.map(issued)),\n              ...(oauthRevoke === undefined\n                ? {}\n                : {\n                    revoke: (credential: Provider.Credential) =>\n                      call(() => oauthRevoke(plain(credential))),\n                  }),\n            } satisfies Provider.OAuthAuth,\n          }),\n      ...(integration === undefined\n        ? {}\n        : {\n            integration: {\n              label: integration.label,\n              ...(integration.registration === undefined\n                ? {}\n                : { registration: integration.registration }),\n              start: (input) => call(() => integration.start(input)),\n              complete: (input) => call(() => integration.complete(input)).pipe(Effect.map(issued)),\n              ...(integrationRefresh === undefined\n                ? {}\n                : {\n                    refresh: (credential: Provider.Credential) =>\n                      call(() => integrationRefresh(plain(credential))).pipe(Effect.map(issued)),\n                  }),\n              ...(integrationRevoke === undefined\n                ? {}\n                : {\n                    revoke: (credential: Provider.Credential) =>\n                      call(() => integrationRevoke(plain(credential))),\n                  }),\n            } satisfies Provider.IntegrationAuth,\n          }),\n    },\n    session,\n  });\n};\n"],"mappings":";;;;;AAyFA,MAAM,WAAW,cAAsB,UACrCA,iBAAwB,KAAK,IACzB,QACA,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,oBAA2B;CACrC;CACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,GAAG,SAAS;AAChE,CAAC,EACH,CAAC;AAEP,MAAM,UAAU,WAA6D;CAC3E,QAAQ,SAAS,KAAK,MAAM,MAAM;CAClC,SAAS,MAAM;CACf,WAAW,MAAM,cAAc,OAAO,OAAO,SAAS,eAAe,MAAM,SAAS;AACtF;AAEA,MAAM,SAAS,gBAAsD;CACnE,QAAQ,SAAS,MAAM,WAAW,MAAM;CACxC,SAAS,WAAW;AACtB;;AAGA,MAAa,aACX,eACiC;CACjC,MAAM,QAAW,QACf,OAAO,WAAW;EAAE,KAAK;EAAK,OAAO,QAAQ,WAAW,EAAE;CAAE,CAAC;CAC/D,MAAM,OAAO,QAAyB,WAAmC;EACvE,OAAO,SAAS,WAAW,MAAM,KAAK,IAAI,CAAC;EAC3C,SAAS,MAAM,WAAW,WAAW,MAAM,OAAO,MAAM,MAAM,CAAC;EAC/D,MAAM,MAAM,qBAAqB,WAAW,MAAM,IAAI,MAAM,gBAAgB,CAAC;EAC7E,SAAS,MAAM,qBAAqB,WAAW,MAAM,OAAO,MAAM,gBAAgB,CAAC;CACrF;CACA,MAAM,WAAW,eAAsD;EACrE,MAAM,QAAQ,WAAW,QAAQ,MAAM,UAAU,CAAC;EAClD,OAAO;GACL,mBAAmB,WAAW,MAAM,YAAY,CAAC;GACjD,gBAAgB,WAAW,WAAW,MAAM,cAAc,MAAM,CAAC;GACjE,oBAAoB,WAAW,MAAM,aAAa,CAAC;GACnD,MAAM,WAAW,IAAI,QAAQ,MAAM,IAAI,MAAM,CAAC;EAChD;CACF;CACA,MAAM,QAAQ,WAAW,KAAK;CAC9B,MAAM,QAAQ,WAAW,KAAK;CAC9B,MAAM,cAAc,WAAW,KAAK;CACpC,MAAM,UAAU,WAAW;CAC3B,MAAM,cAAc,OAAO;CAC3B,MAAM,qBAAqB,aAAa;CACxC,MAAM,oBAAoB,aAAa;CACvC,OAAOC,KAAuB;EAC5B,IAAI,WAAW;EACf,MAAM,WAAW;EACjB,SAAS,WAAW;EACpB,gBAAgB,WAAW;EAC3B,GAAI,YAAY,KAAA,IACZ,CAAC,IACD,EACE,iBAAiB,aAAgC,WAAW,QAAQ,QAAQ,CAAC,EAC/E;EACJ,MAAM;GACJ,GAAI,UAAU,KAAA,IACV,CAAC,IACD,EACE,OAAOC,UAAmB;IACxB,OAAO,MAAM;IACb,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;IAChE,sBAAsB,MAAM;IAC5B,QAAQ,MAAM;IACd,eAAe,WACb,WACE,MAAM,aACJ,OAAO,YACL,OAAO,QAAQ,MAAiC,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACvE,MACA,SAAS,WAAW,KAAK,IACrB,OAAO,SAAS,MAAM,KAAK,CAAC,IAC5B,UAAU,KAAA,IACR,KAAA,IACA,OAAO,KAAK,CACpB,CAAC,CACH,CACF,CACF,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;GAC7B,CAAC,EACH;GACJ,GAAI,UAAU,KAAA,IACV,CAAC,IACD,EACE,OAAO;IACL,OAAO,MAAM;IACb,GAAI,MAAM,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,MAAM,aAAa;IAC/E,QAAQ,MAAM;IACd,QAAQ,UAAU,WAAW,MAAM,MAAM,KAAK,CAAC;IAC/C,WAAW,UAAU,WAAW,MAAM,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;IAC9E,UAAU,eACR,WAAW,MAAM,QAAQ,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;IACtE,GAAI,gBAAgB,KAAA,IAChB,CAAC,IACD,EACE,SAAS,eACP,WAAW,YAAY,MAAM,UAAU,CAAC,CAAC,EAC7C;GACN,EACF;GACJ,GAAI,gBAAgB,KAAA,IAChB,CAAC,IACD,EACE,aAAa;IACX,OAAO,YAAY;IACnB,GAAI,YAAY,iBAAiB,KAAA,IAC7B,CAAC,IACD,EAAE,cAAc,YAAY,aAAa;IAC7C,QAAQ,UAAU,WAAW,YAAY,MAAM,KAAK,CAAC;IACrD,WAAW,UAAU,WAAW,YAAY,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC;IACpF,GAAI,uBAAuB,KAAA,IACvB,CAAC,IACD,EACE,UAAU,eACR,WAAW,mBAAmB,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,EAC7E;IACJ,GAAI,sBAAsB,KAAA,IACtB,CAAC,IACD,EACE,SAAS,eACP,WAAW,kBAAkB,MAAM,UAAU,CAAC,CAAC,EACnD;GACN,EACF;EACN;EACA;CACF,CAAC;AACH"}

package/dist/package.mjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.20.1";
+var version = "0.21.0";
 //#endregion
 export { version };
 

package/dist/types/Connect.d.ts

@@ -233,6 +233,113 @@ export declare const Started: {
         readonly candidates: ReadonlyArray<Provider.Target>;
     }, "_tag">;
 };
+/** A verified completion result. Errors stay on the server; do not serialize them to a browser. */
+export type Completion = Data.TaggedEnum<{
+    Connected: {
+        readonly started: Exclude<Started, {
+            readonly _tag: "Redirect";
+        }>;
+    };
+    Cancelled: {
+        readonly error: Errors.DomainKitError;
+    };
+    Failed: {
+        readonly error: Errors.DomainKitError;
+        readonly recovery: "restart" | "inspect";
+    };
+}>;
+export declare const Completion: {
+    readonly $is: <Tag extends "Cancelled" | "Connected" | "Failed">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "Cancelled";
+        readonly error: Errors.DomainKitError;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "Connected";
+        readonly started: Exclude<Started, {
+            readonly _tag: "Redirect";
+        }>;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "Failed";
+        readonly error: Errors.DomainKitError;
+        readonly recovery: "restart" | "inspect";
+    }, {
+        readonly _tag: Tag;
+    }>;
+    readonly $match: {
+        <Cases extends { readonly [Tag in "Cancelled" | "Connected" | "Failed"]: (args: Extract<{
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(cases: Cases): (value: {
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }) => import("effect/Unify").Unify<ReturnType<Cases["Cancelled" | "Connected" | "Failed"]>>;
+        <Cases extends { readonly [Tag in "Cancelled" | "Connected" | "Failed"]: (args: Extract<{
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(value: {
+            readonly _tag: "Cancelled";
+            readonly error: Errors.DomainKitError;
+        } | {
+            readonly _tag: "Connected";
+            readonly started: Exclude<Started, {
+                readonly _tag: "Redirect";
+            }>;
+        } | {
+            readonly _tag: "Failed";
+            readonly error: Errors.DomainKitError;
+            readonly recovery: "restart" | "inspect";
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Cancelled" | "Connected" | "Failed"]>>;
+    };
+    readonly Cancelled: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Cancelled";
+        readonly error: Errors.DomainKitError;
+    }, "_tag">;
+    readonly Connected: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Connected";
+        readonly started: Exclude<Started, {
+            readonly _tag: "Redirect";
+        }>;
+    }, "_tag">;
+    readonly Failed: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Failed";
+        readonly error: Errors.DomainKitError;
+        readonly recovery: "restart" | "inspect";
+    }, "_tag">;
+};
 /** `attach` either attached the domain or needs the caller to pick a zone. */
 export type Selection = Data.TaggedEnum<{
     SelectionRequired: {
@@ -477,6 +584,16 @@ export interface Interface {
         readonly continuationId: string;
         readonly callbackUrl: string;
     }) => Fx<Started>;
+    /**
+     * Classify only after live owner/actor verification inside the completion lock. Optional
+     * `provider` binds the flow to a mounted route. Invalid flows fail without an outcome.
+     * Cancellation and failure leave the continuation retryable; persistence is not atomic.
+     */
+    readonly completeOutcome: (input: {
+        readonly continuationId: string;
+        readonly callbackUrl: string;
+        readonly provider?: string;
+    }) => Fx<Completion>;
     readonly attach: (input: {
         readonly connectionId: string;
         readonly domain: string;
@@ -586,6 +703,23 @@ export declare const complete: (input: {
     readonly connection: Storage.Connection;
     readonly candidates: ReadonlyArray<Provider.Target>;
 }, Errors.DomainKitError, Principal.Service | Service>;
+export declare const completeOutcome: (input: {
+    readonly continuationId: string;
+    readonly callbackUrl: string;
+    readonly provider?: string;
+}) => Effect.Effect<{
+    readonly _tag: "Cancelled";
+    readonly error: Errors.DomainKitError;
+} | {
+    readonly _tag: "Connected";
+    readonly started: Exclude<Started, {
+        readonly _tag: "Redirect";
+    }>;
+} | {
+    readonly _tag: "Failed";
+    readonly error: Errors.DomainKitError;
+    readonly recovery: "restart" | "inspect";
+}, Errors.DomainKitError, Principal.Service | Service>;
 export declare const attach: (input: {
     readonly connectionId: string;
     readonly domain: string;

package/dist/types/Provider.d.ts

@@ -189,6 +189,11 @@ export interface CallbackInput {
     readonly params: Readonly<Record<string, string>>;
 }
 export interface OAuthAuth {
+    /** Optional setup requirements; absence makes offline registration settings unsupported. */
+    readonly registration?: {
+        readonly clientAuth: "none" | "client_secret_basic" | "client_secret_post";
+        readonly pkce: "S256";
+    };
     readonly label: string;
     readonly scopes: ReadonlyArray<string>;
     readonly start: (input: {
@@ -206,6 +211,10 @@ export interface OAuthAuth {
 }
 /** Marketplace-style installs (Vercel integrations) that redirect but are not OAuth. */
 export interface IntegrationAuth {
+    /** Authentication used by the integration code exchange, without credentials. */
+    readonly registration?: {
+        readonly clientAuth: "client_secret_post";
+    };
     readonly label: string;
     readonly start: (input: {
         readonly state: string;

package/dist/types/Server.d.ts

@@ -24,6 +24,7 @@ import * as DnsRecord from "./DnsRecord.ts";
 import * as Errors from "./internal/error.ts";
 import * as Plan from "./Plan.ts";
 import * as Principal from "./Principal.ts";
+import type * as Provider from "./Provider.ts";
 import * as Providers from "./Providers.ts";
 import * as Provision from "./Provision.ts";
 import * as Reason from "./Reason.ts";
@@ -11393,6 +11394,23 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
 export type Group = typeof group;
 /** Every route in the group, by name; what `Identity.authorize` is asked about. */
 export type EndpointName = HttpApiGroup.Endpoints<Group>["identifier"];
+/** Browser-safe summaries of an authenticated live callback. Connected is not DNS readiness. */
+export declare const CallbackOutcome: Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"Connected">;
+    readonly provider: Schema.String;
+    readonly connectionId: Schema.String;
+    readonly returnTo: Schema.String;
+}>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Cancelled">;
+    readonly provider: Schema.String;
+    readonly returnTo: Schema.String;
+}>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Failed">;
+    readonly provider: Schema.String;
+    readonly returnTo: Schema.String;
+    readonly recovery: Schema.Literals<readonly ["restart", "inspect"]>;
+}>]>;
+export type CallbackOutcome = typeof CallbackOutcome.Type;
 export interface Options {
     /**
      * Where the callback route is reachable from the provider, without the `/callback/:provider`
@@ -11401,7 +11419,34 @@ export interface Options {
     readonly callbackBaseUrl?: string;
     /** Where interactive flows return when the callback carries no `returnTo`. */
     readonly defaultReturnTo?: string;
+    /**
+     * Opt in to a same-origin destination, or return undefined to keep default behavior. Invoked
+     * only for a verified live flow; no request, state, code, secrets, or storage rows reach this
+     * policy. Close over acquired host services; its Effect requires no environment.
+     * A policy failure after Connected cannot undo persistence: inspect before restarting.
+     */
+    readonly callback?: (outcome: CallbackOutcome) => Effect.Effect<string | undefined, Errors.DomainKitError>;
 }
+/** Offline registration requirements, not proof of provider console or grant readiness. */
+export declare const RegistrationSettings: Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.Literal<"OAuth">;
+    readonly provider: Schema.String;
+    readonly callbackUrl: Schema.String;
+    readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+    readonly pkce: Schema.Literal<"S256">;
+    readonly scopes: Schema.$Array<Schema.String>;
+}>, Schema.Struct<{
+    readonly _tag: Schema.Literal<"Integration">;
+    readonly provider: Schema.String;
+    readonly callbackUrl: Schema.String;
+    readonly clientAuth: Schema.Literal<"client_secret_post">;
+}>]>;
+export type RegistrationSettings = typeof RegistrationSettings.Type;
+/** Derive only public setup values; no credentials, identity, storage, or network are needed. */
+export declare const registrationSettings: (input: {
+    readonly providers: ReadonlyArray<Provider.Definition>;
+    readonly callbackBaseUrl: string;
+}) => Effect.Effect<ReadonlyArray<RegistrationSettings>, Errors.DomainKitError>;
 /** Everything the handlers need: the lifecycle services, Storage, and the host's `Identity`. */
 export type Services = Provision.Service | Cleanup.Service | Connect.Service | Verify.Service | Providers.Service | Storage.Service | Identity;
 /**

package/dist/types/internal/callback.d.ts

@@ -0,0 +1,4 @@
+import * as Errors from "./error.ts";
+/** A leaked flow id must reveal neither existence nor ownership, including read races. */
+export declare const refuse: import("effect/Effect").Effect<never, Errors.DomainKitError, never>;
+export declare const missing: (error: Errors.DomainKitError) => boolean;

package/dist/types/internal/config.d.ts

@@ -1,4 +1,11 @@
-import { Config, Effect } from "effect";
+import { Config, Effect, Redacted } from "effect";
 import * as Errors from "./error.ts";
 /** Accept a literal or a `Config`; config failures surface as `InvalidInput` on `field`. */
 export declare const resolve: <A>(value: A | Config.Config<A>, field: string) => Effect.Effect<A, Errors.DomainKitError>;
+/** Configuration diagnostics name the field, never the rejected value. */
+export declare const requireValue: <A>(value: A, valid: (value: A) => boolean, field: string, message: string) => Effect.Effect<A, Errors.DomainKitError>;
+export declare const nonempty: (value: string, field: string) => Effect.Effect<string, Errors.DomainKitError, never>;
+export declare const secret: (value: Redacted.Redacted<string>, field: string) => Effect.Effect<Redacted.Redacted<string>, Errors.DomainKitError, never>;
+/** Paths and split emulator origins are supported; URL suffixes must remain paths. */
+export declare const endpoint: (value: string, field: string) => Effect.Effect<string, Errors.DomainKitError, never>;
+export declare const scopes: (value: ReadonlyArray<string>, field: string) => Effect.Effect<readonly string[], Errors.DomainKitError, never>;

package/dist/types/internal/provider-async.d.ts

@@ -33,6 +33,7 @@ export interface AsyncTokenAuth {
     readonly authenticate: (values: Readonly<Record<string, string | undefined>>) => Promise<AsyncIssuedCredential>;
 }
 export interface AsyncOAuthAuth {
+    readonly registration?: Provider.OAuthAuth["registration"];
     readonly label: string;
     readonly scopes: ReadonlyArray<string>;
     readonly start: (input: {
@@ -49,6 +50,7 @@ export interface AsyncOAuthAuth {
     readonly revoke?: (credential: AsyncCredential) => Promise<void>;
 }
 export interface AsyncIntegrationAuth {
+    readonly registration?: Provider.IntegrationAuth["registration"];
     readonly label: string;
     readonly start: (input: {
         readonly state: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domainkit",
-  "version": "0.20.1",
+  "version": "0.21.0",
   "description": "Build reviewable DNS plans for custom domains in TypeScript",
   "keywords": [
     "custom-domains",
@@ -139,18 +139,18 @@
   },
   "dependencies": {
     "@leichtgewicht/dns-packet": "6.0.3",
-    "oauth4webapi": "^3.8.7",
-    "tldts": "^7.4.11"
+    "oauth4webapi": "^3.8.8",
+    "tldts": "^7.4.18"
   },
   "devDependencies": {
-    "@effect/vitest": "4.0.0",
-    "@types/bun": "1.4.0",
-    "effect": "4.0.0",
+    "@effect/vitest": "4.0.2",
+    "@types/bun": "1.4.2",
+    "effect": "4.0.2",
     "miniflare": "3.20250718.3",
-    "tsdown": "0.22.14",
+    "tsdown": "0.23.0",
     "typescript": "7.0.2",
-    "vite": "7.1.12",
-    "vitest": "5.0.1"
+    "vite": "8.3.4",
+    "vitest": "5.0.3"
   },
   "peerDependencies": {
     "effect": ">=4.0.0 <5.0.0"