domainkit 0.3.1 → 0.5.0

package/dist/{verify-BoWy70ew.mjs → verify-B2fPyjde.mjs}

@@ -1,176 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { I as Error$3, L as Service$3, Y as Opaque, gt as decode$8, ht as Schema$4, i as toAsync$3, it as equals, n as Service$2, nt as decode$9, pt as Service$1, t as Error$4, tt as data, ut as candidates, vt as parse$1, x as authorize$1, yt as Error$2 } from "./resolver-CvK7JoJM.mjs";
+import { At as Error$2, Dt as decode$7, Et as Schema$3, I as Error$3, L as Service$3, R as fromAsync$1, V as toAsync$4, Y as Opaque, bt as assertAttachment, i as toAsync$5, it as equals, kt as parse$1, mt as AuthorizationError, n as Service$2, nt as decode$8, pt as Service$1, t as Error$4, tt as data, ut as candidates, wt as project, x as authorize$1, xt as authorizationError } from "./resolver-tZU6gEVq.mjs";
 import { Clock, Context, Crypto, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
 import * as oauth from "oauth4webapi";
 import * as DnsPacket from "@leichtgewicht/dns-packet";
 //#region package.json
-var version = "0.3.1";
-//#endregion
-//#region src/auth/provider-context.ts
-var provider_context_exports = /* @__PURE__ */ __exportAll({
-	Envelope: () => Envelope,
-	codec: () => codec,
-	decode: () => decode$7,
-	encode: () => encode$4
-});
-/** A provider-owned, versioned, non-secret context value persisted by the host. */
-const Envelope = Schema.Struct({
-	value: Schema.Json,
-	version: Schema.String
-});
-/** Build an adapter-owned context codec from a schema and stable version identifier. */
-function codec(version, schema) {
-	return {
-		decode: Effect.fn("ProviderContext.decode")((envelope) => envelope.version !== version ? Effect.fail(new Error$2({ message: `Unsupported provider context version: ${envelope.version}` })) : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })))),
-		encode: Effect.fn("ProviderContext.encode")((value) => Schema.encodeEffect(schema)(value).pipe(Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)), Effect.map((encoded) => ({
-			value: encoded,
-			version
-		})), Effect.mapError((cause) => new Error$2({ message: cause.message })))),
-		version
-	};
-}
-const decode$7 = Effect.fn("ProviderContext.Envelope.decode")((input) => Schema.decodeUnknownEffect(Envelope)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const encode$4 = Schema.encodeSync(Envelope);
-//#endregion
-//#region src/auth/authorization.ts
-var authorization_exports = /* @__PURE__ */ __exportAll({
-	Capability: () => Capability,
-	CapabilityEvidence: () => CapabilityEvidence,
-	Evidence: () => Evidence$1,
-	EvidenceSchema: () => EvidenceSchema,
-	Revocation: () => Revocation,
-	Schema: () => Schema$3,
-	decode: () => decode$6,
-	encode: () => encode$3,
-	evidenceFor: () => evidenceFor$1,
-	validate: () => validate$1
-});
-const Capability = Schema.Literals(["dns:read", "dns:write"]);
-const Evidence$1 = Data.taggedEnum();
-const EvidenceSchema = Schema.TaggedUnion({
-	Declared: {},
-	Exercised: { observedAt: Schema.DateFromString },
-	Introspected: { observedAt: Schema.DateFromString }
-});
-const CapabilityEvidence = Schema.Struct({
-	capability: Capability,
-	evidence: EvidenceSchema
-});
-const Revocation = Schema.TaggedUnion({
-	Active: {},
-	Pending: { requestedAt: Schema.DateFromString }
-});
-/** A provider credential authorization shared by one or more owner connections. */
-const Schema$3 = Schema.Struct({
-	authorizedById: Schema.String,
-	capabilityEvidence: Schema.Array(CapabilityEvidence),
-	createdAt: Schema.DateFromString,
-	expiresAt: Schema.NullOr(Schema.DateFromString),
-	id: Schema.String,
-	method: Schema.Literals([
-		"integration",
-		"oauth2",
-		"token"
-	]),
-	providerAccountId: Schema.String,
-	providerContext: Envelope,
-	providerId: Schema.String,
-	requiredCapabilities: Schema.Array(Capability),
-	revocation: Revocation,
-	scopes: Schema.Array(Schema.String)
-});
-const decode$6 = Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$3)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const validate$1 = Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$3))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const encode$3 = Schema.encodeSync(Schema$3);
-function evidenceFor$1(authorization, capability) {
-	return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;
-}
-//#endregion
-//#region src/auth/connection.ts
-const Grant = Schema.TaggedUnion({
-	account: { excludedDomains: Schema.Array(Schema$4) },
-	domains: { domains: Schema.Array(Schema$4) }
-});
-/** Returns whether a grant includes one parsed domain. */
-const coversDomain = (grant, domain) => grant._tag === "account" ? !grant.excludedDomains.includes(domain) : grant.domains.includes(domain);
-/** Expands a grant to include the requested domains. */
-const includeDomains = (current, requested) => {
-	if (current === void 0) return requested;
-	if (current._tag === "account" && requested._tag === "account") return {
-		_tag: "account",
-		excludedDomains: current.excludedDomains.filter((domain) => requested.excludedDomains.includes(domain))
-	};
-	if (current._tag === "account" && requested._tag === "domains") return {
-		_tag: "account",
-		excludedDomains: current.excludedDomains.filter((domain) => !requested.domains.includes(domain))
-	};
-	if (requested._tag === "account") {
-		const includedDomains = current._tag === "domains" ? current.domains : [];
-		return {
-			_tag: "account",
-			excludedDomains: requested.excludedDomains.filter((domain) => !includedDomains.includes(domain))
-		};
-	}
-	if (current._tag === "account") return current;
-	return {
-		_tag: "domains",
-		domains: [.../* @__PURE__ */ new Set([...current.domains, ...requested.domains])]
-	};
-};
-/** Contracts a grant so it no longer includes one parsed domain. */
-const removeDomain$1 = (grant, domain) => grant._tag === "account" ? {
-	_tag: "account",
-	excludedDomains: [.../* @__PURE__ */ new Set([...grant.excludedDomains, domain])]
-} : {
-	_tag: "domains",
-	domains: grant.domains.filter((candidate) => candidate !== domain)
-};
-/** An owner-scoped grant bound to one provider authorization. */
-const Schema$2 = Schema.Struct({
-	authorizationId: Schema.String,
-	createdAt: Schema.DateFromString,
-	grant: Grant,
-	id: Schema.String,
-	ownerId: Schema.String
-});
-const decode$5 = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const validate = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$2))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const encode$2 = Schema.encodeSync(Schema$2);
-var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", {
-	category: Schema.Literal("authorization"),
-	message: Schema.String,
-	operation: Schema.String,
-	retry: Schema.Literals([
-		"never",
-		"after-user-action",
-		"safe",
-		"unknown"
-	])
-}) {};
-const authorizationError = (message, operation) => new AuthorizationError({
-	category: "authorization",
-	message,
-	operation,
-	retry: "after-user-action"
-});
-function assertGrant(connection, authorization, request) {
-	if (connection.authorizationId !== authorization.id || authorization.providerId !== request.providerId || authorization.revocation._tag !== "Active") throw authorizationError("Connection does not grant this provider account", "Connection.assertGrant");
-	if (authorization.expiresAt !== null) {
-		if (Number.isNaN(authorization.expiresAt.getTime())) throw authorizationError("Connection expiration is invalid", "Connection.assertGrant");
-		if (authorization.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw authorizationError("Connection has expired", "Connection.assertGrant");
-	}
-	if (!authorization.requiredCapabilities.includes(request.capability)) throw authorizationError(`Connection lacks the ${request.capability} capability`, "Connection.assertGrant");
-	if (evidenceFor$1(authorization, request.capability) === void 0) throw authorizationError(`Connection has no evidence for the ${request.capability} capability`, "Connection.assertGrant");
-	let domain;
-	try {
-		domain = parse$1(request.domain);
-	} catch (cause) {
-		if (cause instanceof Error$2) throw cause;
-		throw new Error$2({ message: cause instanceof Error ? cause.message : String(cause) });
-	}
-	if (!coversDomain(connection.grant, domain)) throw authorizationError("Connection does not grant this domain", "Connection.assertGrant");
-	return domain;
-}
+var version = "0.5.0";
 //#endregion
 //#region src/auth/connect.ts
 const Method$1 = Data.taggedEnum();
@@ -190,57 +24,84 @@ var Error$1 = class extends Schema.TaggedError()("ConnectionError", {
 		"unknown"
 	])
 }) {};
-const RemoveDomainResult = Data.taggedEnum();
-const persist = Effect.fn("Connection.persist")(function* (input) {
+const missingCapability = (authentication, requiredCapabilities) => requiredCapabilities.find((capability) => !authentication.capabilityEvidence.some((item) => item.capability === capability));
+const freshId = Effect.fn("Connection.freshId")(function* () {
+	return yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
+		category: "validation",
+		message: cause.message,
+		operation: "Connection.connect",
+		retry: "safe"
+	})));
+});
+/** Persist one authenticated provider connection, optionally reusing a proven authorization. */
+const connect = Effect.fn("Connection.connect")(function* (input) {
 	const repository = yield* Service$1;
-	const crypto = yield* Crypto.Crypto;
 	const now = new Date(yield* Clock.currentTimeMillis);
-	const missingCapability = input.requiredCapabilities.find((capability) => !input.authentication.capabilityEvidence.some((item) => item.capability === capability));
-	if (missingCapability !== void 0) return yield* new Error$1({
+	const missing = missingCapability(input.authentication, input.requiredCapabilities);
+	if (missing !== void 0) return yield* new Error$1({
 		category: "authorization",
-		message: `Provider authorization lacks evidence for ${missingCapability}`,
-		operation: "Connection.persist",
+		message: `Provider authorization lacks evidence for ${missing}`,
+		operation: "Connection.connect",
 		retry: "after-user-action"
 	});
-	const existing = yield* repository.findByProviderAccount(input.providerId, input.authentication.providerAccountId);
-	const authorizationId = existing?.authorization.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
-		category: "validation",
-		message: cause.message,
-		operation: "Connection.persist",
-		retry: "safe"
-	}))));
-	const existingBinding = existing?.bindings.find((binding) => binding.ownerId === input.ownerId);
-	const binding = {
-		authorizationId,
-		createdAt: existingBinding?.createdAt ?? now,
-		grant: includeDomains(existingBinding?.grant, input.grant),
-		id: existingBinding?.id ?? (yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
-			category: "validation",
-			message: cause.message,
-			operation: "Connection.persist",
-			retry: "safe"
-		})))),
-		ownerId: input.ownerId
+	const existing = input.authorizationId === void 0 ? null : yield* repository.get(input.authorizationId);
+	if (input.authorizationId !== void 0 && existing === null) return yield* new Error$1({
+		category: "authorization",
+		message: "Provider authorization does not exist",
+		operation: "Connection.connect",
+		retry: "after-user-action"
+	});
+	if (existing?.authorization.revocation._tag === "Pending") return yield* new Error$1({
+		category: "authorization",
+		message: "Provider authorization is awaiting revocation recovery",
+		operation: "Connection.connect",
+		retry: "after-user-action"
+	});
+	if (existing !== null && (existing.authorization.providerId !== input.providerId || existing.authorization.method !== input.method)) return yield* new Error$1({
+		category: "authorization",
+		message: "Provider proof does not match the existing authorization",
+		operation: "Connection.connect",
+		retry: "never"
+	});
+	const authorizationId = existing?.authorization.id ?? (yield* freshId());
+	const authorization = existing === null ? {
+		authorizedById: input.authorizedById,
+		capabilityEvidence: [...input.authentication.capabilityEvidence],
+		createdAt: now,
+		expiresAt: input.authentication.expiresAt,
+		id: authorizationId,
+		method: input.method,
+		providerContext: input.authentication.providerContext,
+		providerId: input.providerId,
+		requiredCapabilities: [...input.requiredCapabilities],
+		revocation: { _tag: "Active" },
+		scopes: [...input.authentication.scopes]
+	} : {
+		...existing.authorization,
+		capabilityEvidence: mergeEvidence(existing.authorization.capabilityEvidence, input.authentication.capabilityEvidence),
+		expiresAt: input.authentication.expiresAt,
+		method: input.method,
+		providerContext: input.authentication.providerContext,
+		requiredCapabilities: [...input.requiredCapabilities],
+		revocation: { _tag: "Active" },
+		scopes: [...input.authentication.scopes]
 	};
-	const aggregate = {
-		authorization: {
-			authorizedById: input.authorizedById,
-			capabilityEvidence: [...input.authentication.capabilityEvidence],
-			createdAt: existing?.authorization.createdAt ?? now,
-			expiresAt: input.authentication.expiresAt,
-			id: authorizationId,
-			method: input.method,
-			providerAccountId: input.authentication.providerAccountId,
-			providerContext: input.authentication.providerContext,
-			providerId: input.providerId,
-			requiredCapabilities: [...input.requiredCapabilities],
-			revocation: { _tag: "Active" },
-			scopes: [...input.authentication.scopes]
-		},
-		bindings: [...existing?.bindings.filter((candidate) => candidate.id !== binding.id) ?? [], binding],
-		credential: input.authentication.credential
+	const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);
+	const connection = {
+		authorizationId,
+		createdAt: existingConnection?.createdAt ?? now,
+		id: existingConnection?.id ?? (yield* freshId()),
+		method: input.method,
+		ownerId: input.ownerId,
+		providerId: input.providerId
 	};
-	return yield* repository.connect(aggregate);
+	return yield* repository.connect({
+		authorization,
+		connection,
+		credential: input.authentication.credential,
+		...existing === null ? {} : { expectedAuthorizationId: existing.authorization.id },
+		...existingConnection === null ? {} : { expectedConnectionId: existingConnection.id }
+	});
 });
 const start$1 = Effect.fn("Connection.start")(function* (input) {
 	if (input.method._tag === "Interactive") {
@@ -255,8 +116,8 @@ const start$1 = Effect.fn("Connection.start")(function* (input) {
 		const started = yield* input.method.flow.start(continuationId);
 		yield* input.method.continuations.put({
 			authorizedById: input.authorizedById,
+			...input.authorizationId === void 0 ? {} : { authorizationId: input.authorizationId },
 			expiresAt: new Date(now + (input.method.ttlMs ?? 6e5)),
-			grant: input.grant,
 			id: continuationId,
 			method: input.method.flow.method,
 			ownerId: input.ownerId,
@@ -270,16 +131,23 @@ const start$1 = Effect.fn("Connection.start")(function* (input) {
 		});
 	}
 	const authentication = yield* input.method.authenticate(input.method.token);
-	const aggregate = yield* persist({
+	const aggregate = yield* connect({
 		authentication,
 		authorizedById: input.authorizedById,
-		grant: input.grant,
+		...input.authorizationId === void 0 ? {} : { authorizationId: input.authorizationId },
 		method: "token",
 		ownerId: input.ownerId,
 		providerId: input.method.providerId,
 		requiredCapabilities: input.method.requiredCapabilities
 	});
-	return StartResult.Connected({ aggregate });
+	const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === input.ownerId);
+	if (storedConnection === void 0) return yield* new Error$1({
+		category: "validation",
+		message: "Connected provider authorization returned no organization connection",
+		operation: "Connection.start",
+		retry: "safe"
+	});
+	return StartResult.Connected({ connection: project(storedConnection, aggregate.authorization) });
 });
 const complete$1 = Effect.fn("Connection.complete")(function* (input) {
 	const continuation = yield* input.continuations.consume(input.continuationId, new Date(yield* Clock.currentTimeMillis));
@@ -296,77 +164,29 @@ const complete$1 = Effect.fn("Connection.complete")(function* (input) {
 		retry: "never"
 	});
 	const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);
-	return yield* persist({
+	const aggregate = yield* connect({
 		authentication,
 		authorizedById: continuation.authorizedById,
-		grant: continuation.grant,
+		...continuation.authorizationId === void 0 ? {} : { authorizationId: continuation.authorizationId },
 		method: continuation.method,
 		ownerId: continuation.ownerId,
 		providerId: continuation.providerId,
 		requiredCapabilities: continuation.requiredCapabilities
 	});
-});
-/** Extends one owner binding without repeating provider authentication. */
-const extend = Effect.fn("Connection.extend")(function* (input) {
-	const repository = yield* Service$1;
-	const aggregate = yield* repository.getByConnectionId(input.connectionId);
-	const binding = aggregate?.bindings.find(({ id }) => id === input.connectionId);
-	if (aggregate === null || binding === void 0 || binding.ownerId !== input.ownerId) return yield* new Error$1({
-		category: "authorization",
-		message: "Connection does not belong to this owner",
-		operation: "Connection.extend",
-		retry: "never"
-	});
-	if (aggregate.authorization.revocation._tag !== "Active") return yield* new Error$1({
-		category: "authorization",
-		message: "Provider authorization is awaiting revocation",
-		operation: "Connection.extend",
-		retry: "after-user-action"
-	});
-	const now = new Date(yield* Clock.currentTimeMillis);
-	if (aggregate.authorization.expiresAt !== null && (Number.isNaN(aggregate.authorization.expiresAt.getTime()) || aggregate.authorization.expiresAt <= now)) return yield* new Error$1({
-		category: "authorization",
-		message: "Provider authorization has expired",
-		operation: "Connection.extend",
-		retry: "after-user-action"
-	});
-	return yield* repository.bind(aggregate.authorization.id, {
-		...binding,
-		grant: includeDomains(binding.grant, input.grant)
-	});
-});
-/** Removes one domain from an owner binding without revoking provider authorization. */
-const removeDomain = Effect.fn("Connection.removeDomain")(function* (input) {
-	const repository = yield* Service$1;
-	const aggregate = yield* repository.getByConnectionId(input.connectionId);
-	const binding = aggregate?.bindings.find(({ id }) => id === input.connectionId);
-	if (aggregate === null || binding === void 0 || binding.ownerId !== input.ownerId) return yield* new Error$1({
-		category: "authorization",
-		message: "Connection does not belong to this owner",
-		operation: "Connection.removeDomain",
-		retry: "never"
-	});
-	const domain = yield* decode$8(input.domain).pipe(Effect.mapError((cause) => new Error$1({
+	const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === continuation.ownerId);
+	if (storedConnection === void 0) return yield* new Error$1({
 		category: "validation",
-		message: cause.message,
-		operation: "Connection.removeDomain",
-		retry: "never"
-	})));
-	const updated = yield* repository.modifyBinding(input.connectionId, (current) => {
-		if (!coversDomain(current.grant, domain)) return {
-			binding: current,
-			value: false
-		};
-		return {
-			binding: {
-				...current,
-				grant: removeDomain$1(current.grant, domain)
-			},
-			value: true
-		};
+		message: "Connected provider authorization returned no organization connection",
+		operation: "Connection.complete",
+		retry: "safe"
 	});
-	return updated.value ? RemoveDomainResult.Removed({ aggregate: updated.aggregate }) : RemoveDomainResult.AlreadyRemoved({ aggregate: updated.aggregate });
+	return project(storedConnection, aggregate.authorization);
 });
+function mergeEvidence(current, incoming) {
+	const byCapability = new Map(current.map((item) => [item.capability, item]));
+	for (const item of incoming) byCapability.set(item.capability, item);
+	return [...byCapability.values()];
+}
 //#endregion
 //#region src/auth/diagnostic.ts
 var diagnostic_exports = /* @__PURE__ */ __exportAll({
@@ -407,8 +227,8 @@ function from(error) {
 //#region src/auth/manifest.ts
 var manifest_exports = /* @__PURE__ */ __exportAll({
 	Method: () => Method,
-	Schema: () => Schema$1,
-	decode: () => decode$4
+	Schema: () => Schema$2,
+	decode: () => decode$6
 });
 const Method = Schema.TaggedUnion({
 	integration: {
@@ -436,11 +256,37 @@ const Method = Schema.TaggedUnion({
 		instructionsUrl: Schema.String
 	}
 });
-const Schema$1 = Schema.Struct({
+const Schema$2 = Schema.Struct({
 	methods: Schema.Array(Method),
 	providerId: Schema.String
 });
-const decode$4 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const decode$6 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+//#endregion
+//#region src/auth/provider-context.ts
+var provider_context_exports = /* @__PURE__ */ __exportAll({
+	Envelope: () => Envelope,
+	codec: () => codec,
+	decode: () => decode$5,
+	encode: () => encode$3
+});
+/** A provider-owned, versioned, non-secret context value persisted by the host. */
+const Envelope = Schema.Struct({
+	value: Schema.Json,
+	version: Schema.String
+});
+/** Build an adapter-owned context codec from a schema and stable version identifier. */
+function codec(version, schema) {
+	return {
+		decode: Effect.fn("ProviderContext.decode")((envelope) => envelope.version !== version ? Effect.fail(new Error$2({ message: `Unsupported provider context version: ${envelope.version}` })) : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })))),
+		encode: Effect.fn("ProviderContext.encode")((value) => Schema.encodeEffect(schema)(value).pipe(Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)), Effect.map((encoded) => ({
+			value: encoded,
+			version
+		})), Effect.mapError((cause) => new Error$2({ message: cause.message })))),
+		version
+	};
+}
+const decode$5 = Effect.fn("ProviderContext.Envelope.decode")((input) => Schema.decodeUnknownEffect(Envelope)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+const encode$3 = Schema.encodeSync(Envelope);
 //#endregion
 //#region src/auth/secret.ts
 var secret_exports = /* @__PURE__ */ __exportAll({
@@ -471,26 +317,26 @@ const make$6 = Value.from;
 //#endregion
 //#region src/discovery/selection.ts
 var selection_exports = /* @__PURE__ */ __exportAll({
-	Evidence: () => Evidence,
+	Evidence: () => Evidence$1,
 	Selection: () => Selection,
 	select: () => select
 });
-const Evidence = Schema.Struct({
+const Evidence$1 = Schema.Struct({
 	accountId: Schema.String,
 	connectionId: Schema.String,
 	decisiveNameserverMatch: Schema.Boolean,
-	matchedNameservers: Schema.Array(Schema$4),
+	matchedNameservers: Schema.Array(Schema$3),
 	providerId: Schema.String,
-	zone: Schema$4
+	zone: Schema$3
 });
 const Selection = Schema.TaggedUnion({
 	selected: {
-		candidate: Evidence,
-		evidence: Schema.Array(Evidence),
+		candidate: Evidence$1,
+		evidence: Schema.Array(Evidence$1),
 		reason: Schema.Literals(["explicit", "unique-nameserver-match"])
 	},
 	manual: {
-		evidence: Schema.Array(Evidence),
+		evidence: Schema.Array(Evidence$1),
 		reason: Schema.Literals(["ambiguous", "unsupported"])
 	}
 });
@@ -499,13 +345,16 @@ function select(input) {
 	const zoneCandidates = new Set(candidates(domain));
 	const authoritative = nameserverSet(input.authoritativeNameservers);
 	const eligible = input.connectedZones.filter((connected) => {
-		if (!zoneCandidates.has(parse$1(connected.zone))) return false;
+		if (!zoneCandidates.has(connected.attachment.target.zoneName)) return false;
 		try {
-			assertGrant(connected.connection, connected.authorization, {
+			assertAttachment({
+				attachment: connected.attachment,
 				capability: "dns:read",
+				connection: connected.connection,
 				domain,
 				...input.now === void 0 ? {} : { now: input.now },
-				providerId: connected.providerId
+				providerId: connected.connection.providerId,
+				authorization: connected.authorization
 			});
 			return true;
 		} catch {
@@ -515,8 +364,8 @@ function select(input) {
 	const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));
 	if (input.explicit !== void 0) {
 		const explicitZone = parse$1(input.explicit.zone);
-		const index = eligible.findIndex((connected) => connected.providerId === input.explicit?.providerId && connected.authorization.providerAccountId === input.explicit.accountId && parse$1(connected.zone) === explicitZone);
-		if (index < 0) throw authorizationError("Explicit provider zone is not connected or granted", "ProviderDiscovery.select");
+		const index = eligible.findIndex((connected) => connected.connection.providerId === input.explicit?.providerId && connected.attachment.target.accountId === input.explicit.accountId && connected.attachment.target.zoneName === explicitZone);
+		if (index < 0) throw authorizationError("Explicit provider zone is not connected for this domain", "ProviderDiscovery.select");
 		const candidate = evidence[index];
 		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
 		return {
@@ -543,32 +392,78 @@ function evidenceFor(connected, authoritative) {
 	const configured = new Set(nameserverSet(connected.nameservers));
 	const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));
 	return {
-		accountId: connected.authorization.providerAccountId,
+		accountId: connected.attachment.target.accountId,
 		connectionId: connected.connection.id,
 		decisiveNameserverMatch: authoritative.length > 0 && matchedNameservers.length === authoritative.length,
 		matchedNameservers,
-		providerId: connected.providerId,
-		zone: parse$1(connected.zone)
+		providerId: connected.connection.providerId,
+		zone: connected.attachment.target.zoneName
 	};
 }
 function nameserverSet(nameservers) {
 	return [...new Set(nameservers.map(parse$1))].sort();
 }
 //#endregion
+//#region src/provider/session.ts
+var session_exports = /* @__PURE__ */ __exportAll({
+	Resolution: () => Resolution,
+	fromAsync: () => fromAsync,
+	toAsync: () => toAsync$3
+});
+const Resolution = Data.taggedEnum();
+/** Adapts a Promise-shaped session to the Effect-native session boundary. */
+const fromAsync = (session) => ({
+	providerId: session.providerId,
+	listTargets: (input) => Effect.tryPromise({
+		try: () => session.listTargets(input),
+		catch: (cause) => sessionFailure(session.providerId, "listTargets", cause)
+	}),
+	resolveTarget: (domain) => Effect.tryPromise({
+		try: () => session.resolveTarget(domain),
+		catch: (cause) => sessionFailure(session.providerId, "resolveTarget", cause)
+	}),
+	forTarget: (target) => Effect.tryPromise({
+		try: () => session.forTarget(target),
+		catch: (cause) => sessionFailure(session.providerId, "forTarget", cause)
+	}).pipe(Effect.map(fromAsync$1))
+});
+/** Adapts an Effect-native session to the Promise facade. */
+const toAsync$3 = (session) => ({
+	providerId: session.providerId,
+	listTargets: (input) => Effect.runPromise(session.listTargets(input)),
+	resolveTarget: (domain) => Effect.runPromise(session.resolveTarget(domain)),
+	forTarget: (target) => Effect.runPromise(session.forTarget(target)).then(toAsync$4)
+});
+function sessionFailure(providerId, operation, cause) {
+	return cause instanceof Error$3 ? cause : new Error$3({
+		message: cause instanceof globalThis.Error ? cause.message : String(cause),
+		operation: `ProviderSession.${operation}`,
+		providerId,
+		reason: "transport"
+	});
+}
+//#endregion
 //#region src/plan/connection-authorization.ts
 var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize });
 const authorize = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
+	const aggregate = yield* (yield* Service$1).getByConnectionId(input.connection.id);
+	const storedConnection = aggregate?.connections.find(({ id }) => id === input.connection.id);
+	const storedAttachment = aggregate?.attachments.find(({ id }) => id === input.attachment.id);
+	if (aggregate === null || storedConnection === void 0 || storedAttachment === void 0 || storedConnection.ownerId !== input.connection.ownerId || storedConnection.providerId !== input.connection.providerId || storedConnection.method !== aggregate.authorization.method || storedConnection.authorizationId !== input.authorization.id || storedAttachment.connectionId !== storedConnection.id) return yield* authorizationError("Domain attachment is not owned by the active provider connection", "ConnectionAuthorization.authorize");
 	const domain = yield* Effect.try({
-		try: () => assertGrant(input.connection, input.authorization, {
+		try: () => assertAttachment({
+			attachment: storedAttachment,
 			capability: "dns:write",
+			authorization: aggregate.authorization,
+			connection: storedConnection,
 			domain: input.domain,
 			providerId: input.plan.providerId
 		}),
-		catch: (cause) => cause instanceof AuthorizationError || cause instanceof Error$2 ? cause : authorizationError("Connection grant is invalid", "ConnectionAuthorization.authorize")
+		catch: (cause) => cause instanceof AuthorizationError || cause instanceof Error$2 ? cause : authorizationError("Domain attachment is invalid", "ConnectionAuthorization.authorize")
 	});
 	const authorization = yield* authorize$1(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
 	const selected = new Set(authorization.operationIds);
-	if (input.plan.operations.filter((operation) => operation._tag === "create" && selected.has(operation.id) && operation.requirement.name !== domain && !operation.requirement.name.endsWith(`.${domain}`)).length > 0) return yield* authorizationError(`Plan operations are outside the granted domain ${domain}`, "ConnectionAuthorization.authorize");
+	if (input.plan.operations.filter((operation) => operation._tag === "create" && selected.has(operation.id) && operation.requirement.name !== domain && !operation.requirement.name.endsWith(`.${domain}`)).length > 0) return yield* authorizationError(`Plan operations are outside the attached domain ${domain}`, "ConnectionAuthorization.authorize");
 	return authorization;
 });
 //#endregion
@@ -598,7 +493,7 @@ const start = Effect.fn("AuthorizationCode.start")(function* (input) {
 });
 const complete = Effect.fn("AuthorizationCode.complete")(function* (input) {
 	const payload = yield* decodePayload(input.payload);
-	if (input.callbackUrl.searchParams.get("state") !== payload.state) return yield* failure$5("Authorization callback state does not match its continuation");
+	if (input.callbackUrl.searchParams.get("state") !== payload.state) return yield* failure$6("Authorization callback state does not match its continuation");
 	const server = input.method.authorizationServer;
 	const client = { client_id: input.client.clientId };
 	const authentication = yield* clientAuthentication(input.method, input.client);
@@ -632,8 +527,8 @@ function decodePayload(payload) {
 function clientAuthentication(method, client) {
 	switch (method.clientAuth) {
 		case "none": return Effect.succeed(oauth.None());
-		case "client_secret_basic": return client.clientSecret === void 0 ? failure$5("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));
-		case "client_secret_post": return client.clientSecret === void 0 ? failure$5("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretPost(client.clientSecret.expose()));
+		case "client_secret_basic": return client.clientSecret === void 0 ? failure$6("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));
+		case "client_secret_post": return client.clientSecret === void 0 ? failure$6("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretPost(client.clientSecret.expose()));
 	}
 }
 function requestOptions(fetchImplementation, signal) {
@@ -645,7 +540,7 @@ function requestOptions(fetchImplementation, signal) {
 		})
 	};
 }
-const failure$5 = (message) => Effect.fail(new Error$1({
+const failure$6 = (message) => Effect.fail(new Error$1({
 	category: "authorization",
 	message,
 	operation: "AuthorizationCode",
@@ -673,6 +568,44 @@ function base64Url(bytes) {
 	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }
 //#endregion
+//#region src/auth/authorization.ts
+const Capability = Schema.Literals(["dns:read", "dns:write"]);
+const Evidence = Data.taggedEnum();
+const EvidenceSchema = Schema.TaggedUnion({
+	Declared: {},
+	Exercised: { observedAt: Schema.DateFromString },
+	Introspected: { observedAt: Schema.DateFromString }
+});
+const CapabilityEvidence = Schema.Struct({
+	capability: Capability,
+	evidence: EvidenceSchema
+});
+const Revocation = Schema.TaggedUnion({
+	Active: {},
+	Pending: { requestedAt: Schema.DateFromString }
+});
+/** A provider credential authorization shared by one or more organization connections. */
+const Schema$1 = Schema.Struct({
+	authorizedById: Schema.String,
+	capabilityEvidence: Schema.Array(CapabilityEvidence),
+	createdAt: Schema.DateFromString,
+	expiresAt: Schema.NullOr(Schema.DateFromString),
+	id: Schema.String,
+	method: Schema.Literals([
+		"integration",
+		"oauth2",
+		"token"
+	]),
+	providerContext: Envelope,
+	providerId: Schema.String,
+	requiredCapabilities: Schema.Array(Capability),
+	revocation: Revocation,
+	scopes: Schema.Array(Schema.String)
+});
+Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$1))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
+Schema.encodeSync(Schema$1);
+//#endregion
 //#region src/providers/cloudflare/protocol.ts
 const ErrorDetail$1 = Schema.Struct({
 	code: Schema.Number,
@@ -703,7 +636,13 @@ const Zone = Schema.Struct({
 	id: Schema.String,
 	name: Schema.String,
 	name_servers: Schema.Array(Schema.String),
-	status: Schema.optionalKey(Schema.String)
+	status: Schema.optionalKey(Schema.String),
+	type: Schema.optionalKey(Schema.Literals([
+		"full",
+		"partial",
+		"secondary",
+		"internal"
+	]))
 });
 const Record$1 = Schema.Struct({
 	content: Schema.optionalKey(Schema.String),
@@ -763,7 +702,7 @@ const Data$1 = Schema.Struct({
 	weight: Schema.optionalKey(Schema.Number)
 });
 const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(function* () {
-	const name = yield* decode$8(record.name).pipe(Effect.match({
+	const name = yield* decode$7(record.name).pipe(Effect.match({
 		onFailure: () => null,
 		onSuccess: (value) => value
 	}));
@@ -778,46 +717,46 @@ const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(fu
 		policy: record.type === "CNAME" ? "exclusive" : "append",
 		ttl: record.ttl === 1 ? null : record.ttl
 	};
-	const content = () => record.content === void 0 ? Effect.fail(failure$4("decodeRecord", `Cloudflare ${record.type} record has no content`)) : Effect.succeed(record.content);
+	const content = () => record.content === void 0 ? Effect.fail(failure$5("decodeRecord", `Cloudflare ${record.type} record has no content`)) : Effect.succeed(record.content);
 	switch (record.type) {
 		case "A":
-		case "AAAA": return yield* decode$9({
+		case "AAAA": return yield* decode$8({
 			...common,
 			_tag: record.type,
 			address: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
 		case "CNAME":
-		case "NS": return yield* decode$9({
+		case "NS": return yield* decode$8({
 			...common,
 			_tag: record.type,
 			target: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
-		case "TXT": return yield* decode$9({
+		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
+		case "TXT": return yield* decode$8({
 			...common,
 			_tag: "TXT",
 			value: yield* content()
-		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
-		case "MX": return yield* decode$9({
+		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
+		case "MX": return yield* decode$8({
 			...common,
 			_tag: "MX",
 			exchange: yield* content(),
 			priority: record.priority
-		}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
 		case "CAA": {
 			const data = yield* decodeData(record);
-			return yield* decode$9({
+			return yield* decode$8({
 				...common,
 				_tag: "CAA",
 				...data
-			}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+			}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
 		}
 		case "SRV": {
 			const data = yield* decodeData(record);
-			return yield* decode$9({
+			return yield* decode$8({
 				...common,
 				_tag: "SRV",
 				...data
-			}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message)));
+			}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
 		}
 		default: return yield* decodeOpaque$1(record);
 	}
@@ -827,7 +766,7 @@ const decodeOpaque$1 = Effect.fn("CloudflareRecords.decodeOpaque")((record) => S
 	name: record.name,
 	providerRecordId: record.id,
 	providerType: record.type
-}).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message))));
+}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message))));
 function encode$1(record) {
 	const common = {
 		name: record.name,
@@ -874,8 +813,8 @@ function encode$1(record) {
 		};
 	}
 }
-const decodeData = Effect.fn("CloudflareRecords.decodeData")((record) => Schema.decodeUnknownEffect(Data$1)(record.data).pipe(Effect.mapError((cause) => failure$4("decodeRecord", cause.message))));
-function failure$4(operation, message, fields = {}) {
+const decodeData = Effect.fn("CloudflareRecords.decodeData")((record) => Schema.decodeUnknownEffect(Data$1)(record.data).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message))));
+function failure$5(operation, message, fields = {}) {
 	return new Error$3({
 		message,
 		operation,
@@ -915,14 +854,14 @@ const makeTransport = (options) => {
 					...init?.headers
 				}
 			}),
-			catch: () => failure$3(operation, "Cloudflare request failed", { reason: "transport" })
+			catch: () => failure$4(operation, "Cloudflare request failed", { reason: "transport" })
 		});
 		return {
 			body: yield* Effect.tryPromise({
 				try: () => response.json(),
 				catch: () => {
 					const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-					return failure$3(operation, response.ok ? "Cloudflare returned a non-JSON response" : `Cloudflare request failed with HTTP ${response.status}`, {
+					return failure$4(operation, response.ok ? "Cloudflare returned a non-JSON response" : `Cloudflare request failed with HTTP ${response.status}`, {
 						reason: response.ok ? "response" : reason$1(response.status),
 						...retryAfterMs === void 0 ? {} : { retryAfterMs },
 						status: response.status
@@ -960,12 +899,12 @@ const makeTransport = (options) => {
 			const { body, response } = yield* request(path, "validateToken");
 			yield* ensureSuccess(body, "validateToken", response);
 			const envelope = yield* decode$2(TokenEnvelope, body, "validateToken", response);
-			if (envelope.result.status !== "active") return yield* Effect.fail(failure$3("validateToken", `Cloudflare token is ${envelope.result.status}`, {
+			if (envelope.result.status !== "active") return yield* Effect.fail(failure$4("validateToken", `Cloudflare token is ${envelope.result.status}`, {
 				reason: "authentication",
 				status: response.status
 			}));
 			const expiresAt = envelope.result.expires_on === void 0 ? null : new Date(envelope.result.expires_on);
-			if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) return yield* Effect.fail(failure$3("validateToken", "Cloudflare token expiry is not a valid timestamp", {
+			if (expiresAt !== null && Number.isNaN(expiresAt.valueOf())) return yield* Effect.fail(failure$4("validateToken", "Cloudflare token expiry is not a valid timestamp", {
 				reason: "response",
 				status: response.status
 			}));
@@ -981,9 +920,9 @@ const discoverAccount = Effect.fn("CloudflareClient.discoverAccount")((options)
 		const match = matches[0];
 		if (matches.length === 0) continue;
 		if (matches.length === 1 && match !== void 0) return match.account;
-		return yield* Effect.fail(failure$3("discoverAccount", `Cloudflare returned multiple accessible zones named ${candidate}`, { reason: "conflict" }));
+		return yield* Effect.fail(failure$4("discoverAccount", `Cloudflare returned multiple accessible zones named ${candidate}`, { reason: "conflict" }));
 	}
-	return yield* Effect.fail(failure$3("discoverAccount", `Cloudflare did not expose an accessible zone for ${options.domain}`, { reason: "not_found" }));
+	return yield* Effect.fail(failure$4("discoverAccount", `Cloudflare did not expose an accessible zone for ${options.domain}`, { reason: "not_found" }));
 }));
 const discoverAuthorizationAccount = discoverAccount;
 const validateDomainToken = Effect.fn("CloudflareClient.validateDomainToken")((options) => Effect.gen(function* () {
@@ -999,12 +938,27 @@ const validateDomainToken = Effect.fn("CloudflareClient.validateDomainToken")((o
 }));
 /** Creates an Effect-native Cloudflare client without owning the credential lifecycle. */
 function make$5(options) {
+	return makeClient$1(options);
+}
+function makeClient$1(options) {
 	const { allZones, inspectToken, request } = makeTransport(options);
 	const resolveZone = Effect.fn("CloudflareClient.resolveZone")((name) => Effect.gen(function* () {
+		if (options.target !== void 0) {
+			if (name !== options.target.zoneName && !name.endsWith(`.${options.target.zoneName}`)) return yield* Effect.fail(failure$4("resolveZone", `Cloudflare target ${options.target.zoneName} does not cover ${name}`, { reason: "not_found" }));
+			return {
+				account: {
+					id: options.target.accountId,
+					name: options.target.accountId
+				},
+				id: options.target.zoneId,
+				name: options.target.zoneName,
+				name_servers: options.target.evidence?.nameservers ?? []
+			};
+		}
 		const matches = yield* allZones(options.accountId, name);
 		const match = matches[0];
 		if (matches.length === 1 && match !== void 0) return match;
-		return yield* Effect.fail(failure$3("resolveZone", matches.length === 0 ? `Cloudflare zone ${name} was not found in account ${options.accountId}` : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`, { reason: matches.length === 0 ? "not_found" : "response" }));
+		return yield* Effect.fail(failure$4("resolveZone", matches.length === 0 ? options.accountId === void 0 ? `Cloudflare zone ${name} was not found in the authorized accounts` : `Cloudflare zone ${name} was not found in account ${options.accountId}` : options.accountId === void 0 ? `Cloudflare returned multiple zones named ${name} across authorized accounts` : `Cloudflare returned multiple zones named ${name} in account ${options.accountId}`, { reason: matches.length === 0 ? "not_found" : "response" }));
 	}));
 	const listRecords = Effect.fn("CloudflareClient.listRecords")((zoneName) => Effect.gen(function* () {
 		const zone = yield* resolveZone(zoneName);
@@ -1041,28 +995,72 @@ function make$5(options) {
 		const envelope = yield* decode$2(RecordEnvelope, body, "getRecord", response);
 		return yield* decode$3(envelope.result);
 	}));
+	const deleteRecord = Effect.fn("CloudflareClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
+		const zone = yield* resolveZone(zoneName);
+		const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "deleteRecord", { method: "DELETE" });
+		yield* ensureSuccess(body, "deleteRecord", response);
+	}));
+	const listAccounts = Effect.fn("CloudflareClient.listAccounts")(() => allZones().pipe(Effect.map((zones) => {
+		const accounts = /* @__PURE__ */ new Map();
+		for (const zone of zones) accounts.set(zone.account.id, zone.account);
+		return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));
+	})));
+	const listZones = Effect.fn("CloudflareClient.listZones")((input = {}) => allZones(input.accountId ?? options.accountId, input.name).pipe(Effect.flatMap((zones) => Effect.forEach(zones, projectZone$1))));
+	const listTargets = Effect.fn("CloudflareClient.listTargets")((input = {}) => Effect.gen(function* () {
+		const names = input.domain === void 0 ? void 0 : new Set(candidates(input.domain).map((name) => String(name)));
+		const zones = yield* allZones(input.accountId ?? options.accountId);
+		return yield* Effect.forEach(zones.filter((zone) => zone.type !== "internal" && (names === void 0 || names.has(zone.name))), targetFromZone);
+	}));
 	return {
 		id: "cloudflare",
+		providerId: "cloudflare",
 		createRecord,
-		deleteRecord: Effect.fn("CloudflareClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-			const zone = yield* resolveZone(zoneName);
-			const { body, response } = yield* request(`/zones/${encodeURIComponent(zone.id)}/dns_records/${encodeURIComponent(providerRecordId)}`, "deleteRecord", { method: "DELETE" });
-			yield* ensureSuccess(body, "deleteRecord", response);
-		})),
+		deleteRecord,
 		getRecord,
-		listAccounts: Effect.fn("CloudflareClient.listAccounts")(() => allZones().pipe(Effect.map((zones) => {
-			const accounts = /* @__PURE__ */ new Map();
-			for (const zone of zones) accounts.set(zone.account.id, zone.account);
-			return [...accounts.values()].sort((left, right) => left.name.localeCompare(right.name));
-		}))),
+		listAccounts,
 		listRecords,
-		listZones: Effect.fn("CloudflareClient.listZones")((input = {}) => allZones(input.accountId ?? options.accountId, input.name).pipe(Effect.flatMap((zones) => Effect.forEach(zones, projectZone$1)))),
+		listZones,
+		listTargets,
+		resolveTarget: Effect.fn("CloudflareClient.resolveTarget")((domain) => Effect.gen(function* () {
+			const candidates$2 = yield* listTargets({ domain });
+			for (const zoneName of candidates(domain)) {
+				const matches = candidates$2.filter((target) => target.zoneName === zoneName);
+				if (matches.length === 1) {
+					const target = matches[0];
+					if (target !== void 0) return Resolution.Resolved({ target });
+				}
+				if (matches.length > 1) return Resolution.SelectionRequired({ candidates: matches });
+			}
+			return Resolution.NotFound({ domain });
+		})),
+		forTarget: Effect.fn("CloudflareClient.forTarget")((target) => Effect.gen(function* () {
+			if (target.accountKind !== null && target.accountKind !== "account") return yield* Effect.fail(failure$4("forTarget", "Cloudflare targets must use the account account kind", { reason: "request" }));
+			if (target.evidence?.zoneType === "internal") return yield* Effect.fail(failure$4("forTarget", "Cloudflare internal zones cannot host managed DNS records", { reason: "unsupported" }));
+			const selected = (yield* listTargets({
+				accountId: target.accountId,
+				domain: target.zoneName
+			})).find((candidate) => candidate.accountId === target.accountId && candidate.zoneId === target.zoneId && candidate.zoneName === target.zoneName);
+			if (selected === void 0) return yield* Effect.fail(failure$4("forTarget", `Cloudflare target ${target.zoneName} is not visible to this credential`, { reason: "authorization" }));
+			if (selected.evidence?.zoneType === "internal") return yield* Effect.fail(failure$4("forTarget", "Cloudflare internal zones cannot host managed DNS records", { reason: "unsupported" }));
+			const client = makeClient$1({
+				...options,
+				accountId: selected.accountId,
+				target: selected
+			});
+			return {
+				id: client.id,
+				createRecord: client.createRecord,
+				deleteRecord: client.deleteRecord,
+				getRecord: client.getRecord,
+				listRecords: client.listRecords
+			};
+		})),
 		validateToken: Effect.fn("CloudflareClient.validateToken")(() => Effect.gen(function* () {
-			const path = options.tokenKind === "account" ? `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify` : "/user/tokens/verify";
+			const path = options.tokenKind === "account" ? options.accountId === void 0 ? yield* Effect.fail(failure$4("validateToken", "Cloudflare account tokens require an account ID", { reason: "request" })) : `/accounts/${encodeURIComponent(options.accountId)}/tokens/verify` : "/user/tokens/verify";
 			const expiresAt = yield* inspectToken(path);
 			yield* allZones(options.accountId);
 			return {
-				accountId: options.accountId,
+				accountId: options.accountId ?? "",
 				capabilities: options.capabilities,
 				expiresAt,
 				scopes: []
@@ -1070,9 +1068,25 @@ function make$5(options) {
 		}))
 	};
 }
+const targetFromZone = Effect.fn("CloudflareClient.targetFromZone")((zone) => Effect.gen(function* () {
+	const name = yield* decode$7(zone.name).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" }))));
+	return {
+		accountId: zone.account.id,
+		accountKind: "account",
+		evidence: {
+			accountName: zone.account.name,
+			nameservers,
+			status: zone.status ?? "unknown",
+			zoneType: zone.type ?? "unknown"
+		},
+		zoneId: zone.id,
+		zoneName: name
+	};
+}));
 const projectZone$1 = Effect.fn("CloudflareClient.projectZone")((zone) => Effect.gen(function* () {
-	const name = yield* decode$8(zone.name).pipe(Effect.mapError((cause) => failure$3("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$8(nameserver).pipe(Effect.mapError((cause) => failure$3("listZones", cause.message, { reason: "response" }))));
+	const name = yield* decode$7(zone.name).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" }))));
 	return {
 		accountId: zone.account.id,
 		id: zone.id,
@@ -1082,20 +1096,20 @@ const projectZone$1 = Effect.fn("CloudflareClient.projectZone")((zone) => Effect
 	};
 }));
 function decode$2(schema, input, operation, response) {
-	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$3(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {
+	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$4(operation, `Cloudflare response did not match its API contract: ${cause.message}`, {
 		reason: "response",
 		status: response.status
 	})));
 }
 function ensureSuccess(input, operation, response) {
-	return Schema.decodeUnknownEffect(BaseEnvelope)(input).pipe(Effect.mapError(() => failure$3(operation, "Cloudflare response did not contain a valid API envelope", {
+	return Schema.decodeUnknownEffect(BaseEnvelope)(input).pipe(Effect.mapError(() => failure$4(operation, "Cloudflare response did not contain a valid API envelope", {
 		reason: "response",
 		status: response.status
 	})), Effect.flatMap((envelope) => {
 		if (response.ok && envelope.success) return Effect.void;
 		const detail = envelope.errors[0];
 		const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-		return Effect.fail(failure$3(operation, detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`, {
+		return Effect.fail(failure$4(operation, detail?.message ?? `Cloudflare request failed with HTTP ${response.status}`, {
 			...detail === void 0 ? {} : { code: detail.code },
 			reason: reason$1(response.status, detail?.code),
 			...retryAfterMs === void 0 ? {} : { retryAfterMs },
@@ -1119,7 +1133,7 @@ function retryAfter(value) {
 	const date = Date.parse(value);
 	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
 }
-function failure$3(operation, message, fields = {}) {
+function failure$4(operation, message, fields = {}) {
 	return new Error$3({
 		...fields,
 		message,
@@ -1135,6 +1149,7 @@ var auth_exports$1 = /* @__PURE__ */ __exportAll({
 	oauthAuthentication: () => oauthAuthentication,
 	oauthFlow: () => oauthFlow,
 	oauthMethod: () => oauthMethod,
+	restore: () => restore$1,
 	subjectResolver: () => subjectResolver,
 	tokenConnectionMethod: () => tokenConnectionMethod$1,
 	tokenMethod: () => tokenMethod$1,
@@ -1146,7 +1161,10 @@ const authorizationServer = {
 	revocation_endpoint: "https://dash.cloudflare.com/oauth2/revoke",
 	token_endpoint: "https://dash.cloudflare.com/oauth2/token"
 };
-const contextCodec$1 = codec("cloudflare.v1", Schema.Struct({ tokenKind: Schema.Literals(["account", "user"]) }));
+const contextCodec$1 = codec("cloudflare.v1", Schema.Struct({
+	accountId: Schema.optionalKey(Schema.String),
+	tokenKind: Schema.Literals(["account", "user"])
+}));
 /** Describes Cloudflare's caller-created API-token authorization method. */
 function tokenMethod$1(capabilities) {
 	return {
@@ -1172,7 +1190,7 @@ function manifest$1(options) {
 		providerId: "cloudflare"
 	};
 }
-/** Resolves the Cloudflare account selected by a completed OAuth grant. */
+/** Resolves the Cloudflare account selected by a completed OAuth authorization. */
 function subjectResolver(options) {
 	return (tokens, accessToken) => Effect.gen(function* () {
 		const accountId = options.accountId ?? (yield* discoverAuthorizationAccount({
@@ -1224,7 +1242,7 @@ function tokenConnectionMethod$1(options) {
 			return {
 				capabilityEvidence: validated.capabilities.map((capability) => ({
 					capability,
-					evidence: Evidence$1.Introspected({ observedAt })
+					evidence: Evidence.Introspected({ observedAt })
 				})),
 				credential: {
 					accessToken: token,
@@ -1233,7 +1251,10 @@ function tokenConnectionMethod$1(options) {
 				},
 				expiresAt: validated.expiresAt,
 				providerAccountId: validated.accountId,
-				providerContext: yield* contextCodec$1.encode({ tokenKind: options.tokenKind ?? "user" }),
+				providerContext: yield* contextCodec$1.encode(options.tokenKind === "account" ? {
+					accountId: validated.accountId,
+					tokenKind: "account"
+				} : { tokenKind: "user" }),
 				scopes: [...validated.scopes]
 			};
 		}),
@@ -1242,14 +1263,14 @@ function tokenConnectionMethod$1(options) {
 		token: options.token
 	});
 }
-/** Converts a completed Cloudflare OAuth grant into the canonical connection authentication. */
+/** Converts a completed Cloudflare OAuth authorization into canonical connection authentication. */
 const oauthAuthentication = Effect.fn("CloudflareAuth.oauthAuthentication")(function* (options) {
 	const resolved = yield* subjectResolver(options)(options.tokens, options.accessToken);
 	const observedAt = new Date(yield* Clock.currentTimeMillis);
 	return {
 		capabilityEvidence: options.capabilities.map((capability) => ({
 			capability,
-			evidence: Evidence$1.Introspected({ observedAt })
+			evidence: Evidence.Introspected({ observedAt })
 		})),
 		credential: {
 			accessToken: options.accessToken,
@@ -1262,6 +1283,26 @@ const oauthAuthentication = Effect.fn("CloudflareAuth.oauthAuthentication")(func
 		scopes: (options.tokens.scope ?? "").split(" ").filter(Boolean)
 	};
 });
+/** Restore a credential-scoped Cloudflare session from persisted authorization state. */
+function restore$1(options) {
+	return Effect.gen(function* () {
+		if (options.authorization.providerId !== "cloudflare") return yield* Effect.fail(failure$3("restore", "Provider authorization belongs to another provider", "authorization"));
+		if (options.authorization.method === "integration") return yield* Effect.fail(failure$3("restore", "Cloudflare does not support integration credentials", "unsupported"));
+		if (options.authorization.revocation._tag !== "Active") return yield* Effect.fail(failure$3("restore", "Cloudflare authorization is pending revocation", "authorization"));
+		const missingCapability = options.authorization.requiredCapabilities.find((capability) => !options.authorization.capabilityEvidence.some((item) => item.capability === capability));
+		if (missingCapability !== void 0) return yield* Effect.fail(failure$3("restore", `Cloudflare authorization lacks evidence for ${missingCapability}`, "authorization"));
+		if (options.authorization.expiresAt !== null && (Number.isNaN(options.authorization.expiresAt.valueOf()) || options.authorization.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure$3("restore", "Cloudflare authorization has expired", "authentication"));
+		const context = yield* contextCodec$1.decode(options.authorization.providerContext).pipe(Effect.mapError((cause) => failure$3("restore", cause.message, "response")));
+		return make$5({
+			...context.accountId === void 0 ? {} : { accountId: context.accountId },
+			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+			capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
+			token: options.credential.accessToken,
+			tokenKind: context.tokenKind
+		});
+	});
+}
 /** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */
 function oauthFlow(options) {
 	const method = oauthMethod({
@@ -1299,6 +1340,14 @@ function oauthFlow(options) {
 		})
 	};
 }
+function failure$3(operation, message, reason) {
+	return new Error$3({
+		message,
+		operation,
+		providerId: "cloudflare",
+		reason
+	});
+}
 //#endregion
 //#region src/providers/vercel/protocol.ts
 const Pagination = Schema.Struct({
@@ -1388,7 +1437,7 @@ const IntegrationToken = Schema.Struct({
 //#region src/providers/vercel/records.ts
 const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(function* () {
 	const absolute = absoluteNameCandidate(zone, record.name);
-	const name = yield* decode$8(absolute).pipe(Effect.match({
+	const name = yield* decode$7(absolute).pipe(Effect.match({
 		onFailure: () => null,
 		onSuccess: (value) => value
 	}));
@@ -1403,7 +1452,7 @@ const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(
 		policy: record.type === "CNAME" ? "exclusive" : "append",
 		ttl: record.ttl ?? 60
 	};
-	const fromRecord = (input) => decode$9(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
+	const fromRecord = (input) => decode$8(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
 	switch (record.type) {
 		case "A":
 		case "AAAA": return yield* fromRecord({
@@ -1544,6 +1593,9 @@ function discovery(client) {
 }
 /** Creates an Effect-native Vercel client without owning the credential lifecycle. */
 function make$4(options) {
+	return makeClient(options);
+}
+function makeClient(options) {
 	const fetch = options.fetch ?? globalThis.fetch;
 	const baseUrl = (options.baseUrl ?? "https://api.vercel.com").replace(/\/$/, "");
 	const withContext = (path, values = {}) => {
@@ -1615,9 +1667,13 @@ function make$4(options) {
 		return envelope.domain;
 	}).pipe(Effect.catchTag("ProviderError", (cause) => cause.reason === "not_found" ? Effect.succeed(null) : Effect.fail(cause))));
 	const resolveZone = Effect.fn("VercelClient.resolveZone")((name) => Effect.gen(function* () {
+		if (options.target !== void 0) {
+			if (name !== options.target.zoneName && !name.endsWith(`.${options.target.zoneName}`)) return yield* Effect.fail(failure$1("resolveZone", `Vercel target ${options.target.zoneName} does not cover ${name}`, { reason: "not_found" }));
+			return options.target.zoneName;
+		}
 		const domain = yield* discoverZone(name);
 		if (domain === null) return yield* Effect.fail(failure$1("resolveZone", `Vercel zone ${name} is not configured for authoritative DNS in the selected account`, { reason: "not_found" }));
-		return yield* decode$8(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
+		return yield* decode$7(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
 	}));
 	const listRecords = Effect.fn("VercelClient.listRecords")((zoneName) => Effect.gen(function* () {
 		const storageZone = yield* resolveZone(zoneName);
@@ -1661,34 +1717,84 @@ function make$4(options) {
 			until = next;
 		}
 	}));
+	const deleteRecord = Effect.fn("VercelClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
+		const storageZone = yield* resolveZone(zoneName);
+		yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`), "deleteRecord", { method: "DELETE" });
+	}));
+	const listAccounts = Effect.fn("VercelClient.listAccounts")(() => Effect.gen(function* () {
+		const userResult = yield* request(new URL(`${baseUrl}/v2/user`), "listAccounts");
+		const { user } = yield* decode(UserEnvelope, userResult.body, "listAccounts", userResult.response);
+		const teams = yield* allTeams();
+		return [{
+			id: user.id,
+			name: user.name ?? user.username,
+			type: "personal"
+		}, ...teams.map((team) => ({
+			id: team.id,
+			name: team.name ?? team.slug,
+			type: "team"
+		}))];
+	}));
+	const listZones = Effect.fn("VercelClient.listZones")((input = {}) => Effect.gen(function* () {
+		const domains = (yield* allDomains()).filter((domain) => hasDnsStorage(domain) && (input.name === void 0 || domain.name === input.name));
+		if (domains.length > 0 || input.name === void 0) return yield* Effect.forEach(domains, projectZone);
+		const discovered = yield* discoverZone(input.name);
+		return discovered === null ? [] : [yield* projectZone(discovered)];
+	}));
+	const listTargets = Effect.fn("VercelClient.listTargets")((input = {}) => Effect.gen(function* () {
+		const names = input.domain === void 0 ? void 0 : new Set(candidates(input.domain).map((name) => String(name)));
+		const domains = (yield* allDomains()).filter((domain) => hasDnsStorage(domain) && (names === void 0 || names.has(domain.name)) && (input.accountId === void 0 || (domain.teamId ?? domain.userId) === input.accountId));
+		if (domains.length > 0 || input.domain === void 0) return yield* Effect.forEach(domains, targetFromDomain);
+		for (const name of candidates(input.domain)) {
+			const discovered = yield* discoverZone(name);
+			if (discovered !== null && (input.accountId === void 0 || (discovered.teamId ?? discovered.userId) === input.accountId)) return [yield* targetFromDomain(discovered)];
+		}
+		return [];
+	}));
 	return {
 		id: "vercel",
+		providerId: "vercel",
 		createRecord,
-		deleteRecord: Effect.fn("VercelClient.deleteRecord")((zoneName, providerRecordId) => Effect.gen(function* () {
-			const storageZone = yield* resolveZone(zoneName);
-			yield* request(withContext(`/v2/domains/${encodeURIComponent(storageZone)}/records/${encodeURIComponent(providerRecordId)}`), "deleteRecord", { method: "DELETE" });
-		})),
+		deleteRecord,
 		getRecord,
-		listAccounts: Effect.fn("VercelClient.listAccounts")(() => Effect.gen(function* () {
-			const userResult = yield* request(new URL(`${baseUrl}/v2/user`), "listAccounts");
-			const { user } = yield* decode(UserEnvelope, userResult.body, "listAccounts", userResult.response);
-			const teams = yield* allTeams();
-			return [{
-				id: user.id,
-				name: user.name ?? user.username,
-				type: "personal"
-			}, ...teams.map((team) => ({
-				id: team.id,
-				name: team.name ?? team.slug,
-				type: "team"
-			}))];
-		})),
+		listAccounts,
 		listRecords,
-		listZones: Effect.fn("VercelClient.listZones")((input = {}) => Effect.gen(function* () {
-			const domains = (yield* allDomains()).filter((domain) => hasDnsStorage(domain) && (input.name === void 0 || domain.name === input.name));
-			if (domains.length > 0 || input.name === void 0) return yield* Effect.forEach(domains, projectZone);
-			const discovered = yield* discoverZone(input.name);
-			return discovered === null ? [] : [yield* projectZone(discovered)];
+		listZones,
+		listTargets,
+		resolveTarget: Effect.fn("VercelClient.resolveTarget")((domain) => Effect.gen(function* () {
+			const candidates$1 = yield* listTargets({ domain });
+			for (const zoneName of candidates(domain)) {
+				const matches = candidates$1.filter((target) => target.zoneName === zoneName);
+				if (matches.length === 1) {
+					const target = matches[0];
+					if (target !== void 0) return Resolution.Resolved({ target });
+				}
+				if (matches.length > 1) return Resolution.SelectionRequired({ candidates: matches });
+			}
+			return Resolution.NotFound({ domain });
+		})),
+		forTarget: Effect.fn("VercelClient.forTarget")((target) => Effect.gen(function* () {
+			if (target.accountKind === "team") {
+				if (options.context._tag !== "team" || options.context.teamId !== target.accountId) return yield* Effect.fail(failure$1("forTarget", "Vercel team target is outside the selected installation", { reason: "authorization" }));
+			} else if (target.accountKind === "personal" && options.context._tag !== "personal") return yield* Effect.fail(failure$1("forTarget", "Vercel personal target is outside the selected installation", { reason: "authorization" }));
+			else if (target.accountKind === "account") return yield* Effect.fail(failure$1("forTarget", "Vercel does not support account-kind targets", { reason: "unsupported" }));
+			else if (target.accountKind === null) return yield* Effect.fail(failure$1("forTarget", "Vercel targets must identify a personal or team account", { reason: "request" }));
+			const selected = (yield* listTargets({
+				accountId: target.accountId,
+				domain: target.zoneName
+			})).find((candidate) => candidate.accountId === target.accountId && candidate.accountKind === target.accountKind && candidate.zoneId === target.zoneId && candidate.zoneName === target.zoneName);
+			if (selected === void 0) return yield* Effect.fail(failure$1("forTarget", `Vercel target ${target.zoneName} is not visible to this installation`, { reason: "authorization" }));
+			const client = makeClient({
+				...options,
+				target: selected
+			});
+			return {
+				id: client.id,
+				createRecord: client.createRecord,
+				deleteRecord: client.deleteRecord,
+				getRecord: client.getRecord,
+				listRecords: client.listRecords
+			};
 		})),
 		validateToken: Effect.fn("VercelClient.validateToken")(() => Effect.gen(function* () {
 			let accountId;
@@ -1713,8 +1819,8 @@ function hasDnsStorage(domain, configuredServiceType = domain.serviceType) {
 	return configuredServiceType === "zeit.world" || domain.zone === true || domain.intendedNameservers.length > 0;
 }
 const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen(function* () {
-	const name = yield* decode$8(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$8(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
+	const name = yield* decode$7(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
 	return {
 		accountId: domain.teamId ?? domain.userId,
 		id: domain.id,
@@ -1723,6 +1829,21 @@ const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen
 		status: domain.verified ? "active" : "pending"
 	};
 }));
+const targetFromDomain = Effect.fn("VercelClient.targetFromDomain")((domain) => Effect.gen(function* () {
+	const zoneName = yield* decode$7(domain.name).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" }))));
+	return {
+		accountId: domain.teamId ?? domain.userId,
+		accountKind: domain.teamId === null ? "personal" : "team",
+		evidence: {
+			nameservers,
+			status: domain.verified ? "active" : "pending",
+			zoneType: domain.serviceType
+		},
+		zoneId: domain.id,
+		zoneName
+	};
+}));
 function decode(schema, input, operation, response) {
 	return Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError((cause) => failure$1(operation, `Vercel response did not match its API contract: ${cause.message}`, {
 		reason: "response",
@@ -1770,6 +1891,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	integrationFlow: () => integrationFlow,
 	integrationMethod: () => integrationMethod,
 	manifest: () => manifest,
+	restore: () => restore,
 	tokenConnectionMethod: () => tokenConnectionMethod,
 	tokenMethod: () => tokenMethod
 });
@@ -1794,7 +1916,7 @@ function integrationMethod(options) {
 		_tag: "integration",
 		capabilities: [...options.capabilities],
 		installUrl: `https://vercel.com/integrations/${encodeURIComponent(options.slug)}/new`,
-		tokenEndpoint: "https://api.vercel.com/oauth/access_token"
+		tokenEndpoint: "https://api.vercel.com/v2/oauth/access_token"
 	};
 }
 /** Creates the Vercel token and integration authorization manifest. */
@@ -1815,7 +1937,7 @@ const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.ge
 		redirect_uri: options.redirectUri
 	});
 	const response = yield* Effect.tryPromise({
-		try: () => fetch(`${baseUrl}/oauth/access_token`, {
+		try: () => fetch(`${baseUrl}/v2/oauth/access_token`, {
 			body,
 			headers: {
 				Accept: "application/json",
@@ -1840,7 +1962,7 @@ const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.ge
 			_tag: "team",
 			teamId: token.team_id
 		},
-		installationId: token.installation_id ?? null,
+		installationId: token.installation_id ?? options.configurationId ?? null,
 		userId: token.user_id
 	};
 }));
@@ -1857,7 +1979,7 @@ function tokenConnectionMethod(options) {
 			return {
 				capabilityEvidence: validated.capabilities.map((capability) => ({
 					capability,
-					evidence: Evidence$1.Introspected({ observedAt })
+					evidence: Evidence.Introspected({ observedAt })
 				})),
 				credential: {
 					accessToken: token,
@@ -1889,7 +2011,7 @@ const integrationAuthentication = Effect.fn("VercelAuth.integrationAuthenticatio
 	return {
 		capabilityEvidence: options.capabilities.map((capability) => ({
 			capability,
-			evidence: Evidence$1.Introspected({ observedAt })
+			evidence: Evidence.Introspected({ observedAt })
 		})),
 		credential: {
 			accessToken: exchanged.accessToken,
@@ -1909,6 +2031,27 @@ const integrationAuthentication = Effect.fn("VercelAuth.integrationAuthenticatio
 		scopes: []
 	};
 });
+/** Restore a credential-scoped Vercel session from persisted authorization state. */
+function restore(options) {
+	return Effect.gen(function* () {
+		if (options.authorization.providerId !== "vercel") return yield* Effect.fail(failure("restore", "Provider authorization belongs to another provider", "authorization"));
+		if (options.authorization.revocation._tag !== "Active") return yield* Effect.fail(failure("restore", "Vercel authorization is pending revocation", "authorization"));
+		const missingCapability = options.authorization.requiredCapabilities.find((capability) => !options.authorization.capabilityEvidence.some((item) => item.capability === capability));
+		if (missingCapability !== void 0) return yield* Effect.fail(failure("restore", `Vercel authorization lacks evidence for ${missingCapability}`, "authorization"));
+		if (options.authorization.expiresAt !== null && (Number.isNaN(options.authorization.expiresAt.valueOf()) || options.authorization.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure("restore", "Vercel authorization has expired", "authentication"));
+		const context = yield* contextCodec.decode(options.authorization.providerContext).pipe(Effect.mapError((cause) => failure("restore", cause.message, "response")));
+		return make$4({
+			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+			capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),
+			...options.fetch === void 0 ? {} : { fetch: options.fetch },
+			context: context._tag === "team" ? {
+				_tag: "team",
+				teamId: context.teamId
+			} : { _tag: "personal" },
+			token: options.credential.accessToken
+		});
+	});
+}
 /** Creates Vercel Integration's implementation of the common interactive connection capability. */
 function integrationFlow(options) {
 	const method = integrationMethod(options);
@@ -1922,21 +2065,39 @@ function integrationFlow(options) {
 				retry: "after-user-action"
 			})));
 			const code = callbackUrl.searchParams.get("code");
-			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null) return yield* new Error$1({
+			const configurationId = callbackUrl.searchParams.get("configurationId");
+			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null || configurationId === null) return yield* new Error$1({
 				category: "authorization",
 				message: "Vercel Integration callback does not match its continuation",
 				operation: "VercelAuth.integrationFlow.complete",
 				retry: "after-user-action"
 			});
-			return yield* integrationAuthentication({
+			const authentication = yield* integrationAuthentication({
 				...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
 				capabilities: options.capabilities,
 				clientId: options.clientId,
 				clientSecret: options.clientSecret,
 				code: make$6(code),
+				configurationId,
 				...options.fetch === void 0 ? {} : { fetch: options.fetch },
 				redirectUri: options.redirectUri
 			});
+			const callbackTeamId = callbackUrl.searchParams.get("teamId");
+			if (callbackTeamId !== null) {
+				const context = yield* contextCodec.decode(authentication.providerContext).pipe(Effect.mapError((cause) => new Error$1({
+					category: "provider",
+					message: cause.message,
+					operation: "VercelAuth.integrationFlow.complete",
+					retry: "unknown"
+				})));
+				if (context._tag !== "team" || context.teamId !== callbackTeamId) return yield* new Error$1({
+					category: "authorization",
+					message: "Vercel Integration callback team does not match the exchanged installation",
+					operation: "VercelAuth.integrationFlow.complete",
+					retry: "after-user-action"
+				});
+			}
+			return authentication;
 		}),
 		method: "integration",
 		providerId: "vercel",
@@ -2051,7 +2212,7 @@ function make$3(options) {
 	}).pipe(Effect.flatMap((message) => decodeResolution(query, message)))) };
 }
 const layer$2 = (options) => Layer.succeed(Service$2, make$3(options));
-const toAsync$2 = (options) => toAsync$3(make$3(options));
+const toAsync$2 = (options) => toAsync$5(make$3(options));
 function decodeResolution(query, message) {
 	return Effect.try({
 		try: () => DnsPacket.decode(message),
@@ -2109,7 +2270,7 @@ function decodeAnswer(answer) {
 			})
 		});
 		if (decoded === void 0) return null;
-		const name = yield* decode$8(answer.name);
+		const name = yield* decode$7(answer.name);
 		const data = yield* Effect.try({
 			try: () => parse(decoded.type, decoded.data),
 			catch: (cause) => new Error$4({
@@ -2249,7 +2410,7 @@ function make$2(options = {}) {
 	});
 }
 const layer$1 = (options = {}) => Layer.succeed(Service$2, make$2(options));
-const toAsync$1 = (options = {}) => toAsync$3(make$2(options));
+const toAsync$1 = (options = {}) => toAsync$5(make$2(options));
 //#endregion
 //#region src/verification/google-doh.ts
 var google_doh_exports = /* @__PURE__ */ __exportAll({
@@ -2265,7 +2426,7 @@ function make$1(options = {}) {
 	});
 }
 const layer = (options = {}) => Layer.succeed(Service$2, make$1(options));
-const toAsync = (options = {}) => toAsync$3(make$1(options));
+const toAsync = (options = {}) => toAsync$5(make$1(options));
 //#endregion
 //#region src/verification/resolver-pool.ts
 var resolver_pool_exports = /* @__PURE__ */ __exportAll({
@@ -2415,6 +2576,6 @@ function recordValue(requirement) {
 	}
 }
 //#endregion
-export { RemoveDomainResult as $, make$4 as A, discovery$1 as B, integrationFlow as C, encode$3 as Ct, tokenMethod as D, tokenConnectionMethod as E, subjectResolver as F, secret_exports as G, authorize as H, tokenConnectionMethod$1 as I, decode$4 as J, Method as K, tokenMethod$1 as L, manifest$1 as M, oauthFlow as N, client_exports as O, oauthMethod as P, Method$1 as Q, tokenValidator as R, exchangeCode as S, decode$6 as St, manifest as T, version as Tt, connection_authorization_exports as U, make$5 as V, selection_exports as W, diagnostic_exports as X, manifest_exports as Y, Error$1 as Z, toAsync$1 as _, CapabilityEvidence as _t, Result as a, AuthorizationError as at, dns_data_exports as b, Schema$3 as bt, Observation as c, assertGrant as ct, defaultMake as d, decode$5 as dt, StartResult as et, make as f, encode$2 as ft, cloudflare_doh_exports as g, Capability as gt, toAsync as h, validate as ht, PublicDnsObservation as i, start$1 as it, auth_exports$1 as j, discovery as k, Policy as l, authorizationError as lt, google_doh_exports as m, removeDomain$1 as mt, ProviderObservation as n, extend as nt, observe as o, Grant as ot, resolver_pool_exports as p, includeDomains as pt, Schema$1 as q, PublicDns as r, removeDomain as rt, verify_exports as s, Schema$2 as st, Provider as t, complete$1 as tt, Service as u, coversDomain as ut, doh_exports as v, Evidence$1 as vt, integrationMethod as w, provider_context_exports as wt, auth_exports as x, authorization_exports as xt, toAsync$2 as y, EvidenceSchema as yt, client_exports$1 as z };
+export { manifest_exports as $, discovery as A, tokenValidator as B, integrationFlow as C, tokenConnectionMethod as D, restore as E, oauthMethod as F, connection_authorization_exports as G, discovery$1 as H, restore$1 as I, secret_exports as J, session_exports as K, subjectResolver as L, auth_exports$1 as M, manifest$1 as N, tokenMethod as O, oauthFlow as P, decode$6 as Q, tokenConnectionMethod$1 as R, exchangeCode as S, manifest as T, make$5 as U, client_exports$1 as V, authorize as W, Method as X, provider_context_exports as Y, Schema$2 as Z, toAsync$1 as _, Result as a, start$1 as at, dns_data_exports as b, Observation as c, defaultMake as d, diagnostic_exports as et, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, complete$1 as it, make$4 as j, client_exports as k, Policy as l, google_doh_exports as m, ProviderObservation as n, Method$1 as nt, observe as o, version as ot, resolver_pool_exports as p, selection_exports as q, PublicDns as r, StartResult as rt, verify_exports as s, Provider as t, Error$1 as tt, Service as u, doh_exports as v, integrationMethod as w, auth_exports as x, toAsync$2 as y, tokenMethod$1 as z };
 
-//# sourceMappingURL=verify-BoWy70ew.mjs.map
+//# sourceMappingURL=verify-B2fPyjde.mjs.map