domainkit 0.3.1 → 0.5.0

package/dist/{resolver-uqe1h5Vz.d.mts → resolver-BGBLnPjJ.d.mts}

@@ -8,30 +8,17 @@ declare const Error_base$5: Schema.Class<Error$5, Schema.TaggedStruct<"InvalidIn
 }>, import("effect/Cause").YieldableError>;
 declare class Error$5 extends Error_base$5 {}
 declare namespace domain_name_d_exports {
-  export { DomainName, Schema$6 as Schema, decode$6 as decode, parse$1 as parse };
+  export { DomainName, Schema$5 as Schema, decode$5 as decode, parse$1 as parse };
 }
 declare const Type$1: Schema.brand<Schema.String, "DomainName">;
 /** A lower-case, fully qualified DNS name without a trailing dot. */
 type DomainName = typeof Type$1.Type;
 /** Decodes user and wire strings into canonical domain names. */
-declare const Schema$6: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-declare const decode$6: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$5, never>;
+declare const Schema$5: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+declare const decode$5: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$5, never>;
 declare function parse$1(input: unknown): DomainName;
-declare namespace secret_d_exports {
-  export { Value, make$1 as make };
-}
-/** A deliberately non-serializable credential value. */
-declare class Value {
-  #private;
-  private constructor();
-  static from(value: string): Value;
-  expose(): string;
-  toJSON(): string;
-  toString(): string;
-}
-declare const make$1: typeof Value.from;
 declare namespace dns_record_d_exports {
-  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$5 as Schema, Srv, Txt, Type, data, decode$5 as decode, equals, parse };
+  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$4 as Schema, Srv, Txt, Type, data, decode$4 as decode, equals, parse };
 }
 declare const Type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
 type Type = typeof Type.Type;
@@ -41,7 +28,7 @@ declare const RequirementMetadata: Schema.Struct<{
   readonly purpose: Schema.String;
 }>;
 interface RequirementMetadata extends Schema.Schema.Type<typeof RequirementMetadata> {}
-declare const Schema$5: Schema.TaggedUnion<{
+declare const Schema$4: Schema.TaggedUnion<{
   readonly A: Schema.TaggedStruct<"A", {
     readonly metadata: Schema.Struct<{
       readonly ownership: Schema.String;
@@ -224,8 +211,8 @@ declare const A: Schema.TaggedStruct<"A", {
   readonly ttl: Schema.NullOr<Schema.Int>;
   readonly value: Schema.String;
 }>;
-type DnsRecord = typeof Schema$5.Type;
-type Encoded = typeof Schema$5.Encoded;
+type DnsRecord = typeof Schema$4.Type;
+type Encoded = typeof Schema$4.Encoded;
 /** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
 declare const Opaque: Schema.Struct<{
   readonly _tag: Schema.Literal<"Opaque">;
@@ -337,7 +324,7 @@ declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
   readonly providerType: Schema.String;
 }>]>;
 type Observed = typeof Observed.Type;
-declare const decode$5: (input: unknown) => Effect.Effect<{
+declare const decode$4: (input: unknown) => Effect.Effect<{
   readonly _tag: "A";
   readonly metadata: {
     readonly ownership: string;
@@ -475,8 +462,21 @@ interface AsyncInterface$1 {
 declare const fromAsync: (provider: AsyncInterface$1) => Interface$3;
 declare const layerFromAsync$1: (provider: AsyncInterface$1) => Layer.Layer<Service$3>;
 declare const toAsync$1: (provider: Interface$3) => AsyncInterface$1;
+declare namespace secret_d_exports {
+  export { Value, make$1 as make };
+}
+/** A deliberately non-serializable credential value. */
+declare class Value {
+  #private;
+  private constructor();
+  static from(value: string): Value;
+  expose(): string;
+  toJSON(): string;
+  toString(): string;
+}
+declare const make$1: typeof Value.from;
 declare namespace manifest_d_exports {
-  export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method$1 as Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$4 as Schema, TokenValidation, decode$4 as decode };
+  export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method$1 as Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$3 as Schema, TokenValidation, decode$3 as decode };
 }
 declare const Method$1: Schema.TaggedUnion<{
   readonly integration: Schema.TaggedStruct<"integration", {
@@ -500,7 +500,7 @@ declare const Method$1: Schema.TaggedUnion<{
     readonly instructionsUrl: Schema.String;
   }>;
 }>;
-declare const Schema$4: Schema.Struct<{
+declare const Schema$3: Schema.Struct<{
   readonly methods: Schema.$Array<Schema.TaggedUnion<{
     readonly integration: Schema.TaggedStruct<"integration", {
       readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
@@ -525,7 +525,7 @@ declare const Schema$4: Schema.Struct<{
   }>>;
   readonly providerId: Schema.String;
 }>;
-interface Manifest extends Schema.Schema.Type<typeof Schema$4> {}
+interface Manifest extends Schema.Schema.Type<typeof Schema$3> {}
 type OAuthMethod = Extract<Manifest["methods"][number], {
   readonly _tag: "oauth2";
 }>;
@@ -533,7 +533,7 @@ type OAuthMethod = Extract<Manifest["methods"][number], {
 type IntegrationMethod = Extract<Manifest["methods"][number], {
   readonly _tag: "integration";
 }>;
-declare const decode$4: (input: unknown) => Effect.Effect<{
+declare const decode$3: (input: unknown) => Effect.Effect<{
   readonly methods: readonly ({
     readonly _tag: "integration";
     readonly capabilities: readonly ("dns:read" | "dns:write")[];
@@ -579,97 +579,10 @@ interface AsyncOAuthSubjectResolver {
     readonly expiresAt: Date | null;
   }>;
 }
-declare namespace authorization_d_exports {
-  export { Capability, CapabilityEvidence, Evidence, EvidenceSchema, ProviderAuthorization, Revocation, Schema$3 as Schema, decode$3 as decode, encode$3 as encode, evidenceFor, validate$3 as validate };
-}
+//#endregion
+//#region src/auth/authorization.d.ts
 declare const Capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
 type Capability = typeof Capability.Type;
-type Evidence = Data.TaggedEnum<{
-  Declared: {};
-  Exercised: {
-    readonly observedAt: Date;
-  };
-  Introspected: {
-    readonly observedAt: Date;
-  };
-}>;
-declare const Evidence: {
-  readonly $is: <Tag extends "Declared" | "Exercised" | "Introspected">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "Declared";
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Exercised";
-    readonly observedAt: Date;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Introspected";
-    readonly observedAt: Date;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
-    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
-  };
-  readonly Declared: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Declared";
-  }, "_tag">;
-  readonly Exercised: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Exercised";
-    readonly observedAt: Date;
-  }, "_tag">;
-  readonly Introspected: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Introspected";
-    readonly observedAt: Date;
-  }, "_tag">;
-};
-declare const EvidenceSchema: Schema.TaggedUnion<{
-  readonly Declared: Schema.TaggedStruct<"Declared", {}>;
-  readonly Exercised: Schema.TaggedStruct<"Exercised", {
-    readonly observedAt: Schema.DateFromString;
-  }>;
-  readonly Introspected: Schema.TaggedStruct<"Introspected", {
-    readonly observedAt: Schema.DateFromString;
-  }>;
-}>;
 declare const CapabilityEvidence: Schema.Struct<{
   readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
   readonly evidence: Schema.TaggedUnion<{
@@ -683,15 +596,8 @@ declare const CapabilityEvidence: Schema.Struct<{
   }>;
 }>;
 interface CapabilityEvidence extends Schema.Schema.Type<typeof CapabilityEvidence> {}
-declare const Revocation: Schema.TaggedUnion<{
-  readonly Active: Schema.TaggedStruct<"Active", {}>;
-  readonly Pending: Schema.TaggedStruct<"Pending", {
-    readonly requestedAt: Schema.DateFromString;
-  }>;
-}>;
-type Revocation = typeof Revocation.Type;
-/** A provider credential authorization shared by one or more owner connections. */
-declare const Schema$3: Schema.Struct<{
+/** A provider credential authorization shared by one or more organization connections. */
+declare const Schema$2: Schema.Struct<{
   readonly authorizedById: Schema.String;
   readonly capabilityEvidence: Schema.$Array<Schema.Struct<{
     readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
@@ -709,7 +615,6 @@ declare const Schema$3: Schema.Struct<{
   readonly expiresAt: Schema.NullOr<Schema.DateFromString>;
   readonly id: Schema.String;
   readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
-  readonly providerAccountId: Schema.String;
   readonly providerContext: Schema.Struct<{
     readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
     readonly version: Schema.String;
@@ -724,317 +629,222 @@ declare const Schema$3: Schema.Struct<{
   }>;
   readonly scopes: Schema.$Array<Schema.String>;
 }>;
-interface ProviderAuthorization extends Schema.Schema.Type<typeof Schema$3> {}
-declare const decode$3: (input: unknown) => Effect.Effect<{
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    };
-  }[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: Date;
-  };
-  readonly scopes: readonly string[];
-}, Error$5, never>;
-declare const validate$3: (input: unknown) => Effect.Effect<{
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    };
-  }[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: Date;
-  };
-  readonly scopes: readonly string[];
-}, Error$5, never>;
-declare const encode$3: (input: {
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: Date;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: Date;
-    };
-  }[];
-  readonly createdAt: Date;
-  readonly expiresAt: Date | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: Date;
-  };
-  readonly scopes: readonly string[];
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly authorizedById: string;
-  readonly capabilityEvidence: readonly {
-    readonly capability: "dns:read" | "dns:write";
-    readonly evidence: {
-      readonly _tag: "Declared";
-    } | {
-      readonly _tag: "Exercised";
-      readonly observedAt: string;
-    } | {
-      readonly _tag: "Introspected";
-      readonly observedAt: string;
-    };
-  }[];
-  readonly createdAt: string;
-  readonly expiresAt: string | null;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly providerAccountId: string;
-  readonly providerContext: {
-    readonly value: Schema.Json;
-    readonly version: string;
-  };
-  readonly providerId: string;
-  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
-  readonly revocation: {
-    readonly _tag: "Active";
-  } | {
-    readonly _tag: "Pending";
-    readonly requestedAt: string;
-  };
-  readonly scopes: readonly string[];
-};
-declare function evidenceFor(authorization: ProviderAuthorization, capability: Capability): Evidence | undefined;
+interface ProviderAuthorization extends Schema.Schema.Type<typeof Schema$2> {}
 //#endregion
 //#region src/auth/connection.d.ts
-declare const Grant: Schema.TaggedUnion<{
-  readonly account: Schema.TaggedStruct<"account", {
-    readonly excludedDomains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-  }>;
-  readonly domains: Schema.TaggedStruct<"domains", {
-    readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+/** A provider account and authoritative zone selected for one domain attachment. */
+declare const ProviderTargetEvidence: Schema.Struct<{
+  /** The account display name observed during discovery, when the provider exposes one. */
+  readonly accountName: Schema.optionalKey<Schema.String>;
+  /** Nameserver and provider-state evidence observed during discovery. */
+  readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+  readonly status: Schema.String;
+  /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
+  readonly zoneType: Schema.String;
+}>;
+interface ProviderTargetEvidence extends Schema.Schema.Type<typeof ProviderTargetEvidence> {}
+declare const ProviderTarget: Schema.Struct<{
+  readonly accountId: Schema.String;
+  readonly accountKind: Schema.NullOr<Schema.Literals<readonly ["account", "personal", "team"]>>;
+  readonly evidence: Schema.optionalKey<Schema.Struct<{
+    /** The account display name observed during discovery, when the provider exposes one. */
+    readonly accountName: Schema.optionalKey<Schema.String>;
+    /** Nameserver and provider-state evidence observed during discovery. */
+    readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+    readonly status: Schema.String;
+    /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
+    readonly zoneType: Schema.String;
+  }>>;
+  readonly zoneId: Schema.String;
+  readonly zoneName: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>;
+interface ProviderTarget extends Schema.Schema.Type<typeof ProviderTarget> {}
+/** The lifecycle state visible to a host for an organization connection. */
+declare const ConnectionStatus: Schema.Literals<readonly ["active", "expired", "revocation-pending"]>;
+type ConnectionStatus = typeof ConnectionStatus.Type;
+/** An organization-scoped provider connection. */
+declare const ProviderConnection: Schema.Struct<{
+  readonly createdAt: Schema.DateFromString;
+  readonly id: Schema.String;
+  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
+  readonly ownerId: Schema.String;
+  readonly providerId: Schema.String;
+  readonly status: Schema.Literals<readonly ["active", "expired", "revocation-pending"]>;
+}>;
+interface ProviderConnection extends Schema.Schema.Type<typeof ProviderConnection> {}
+/** An exact provider target attached to one organization domain. */
+declare const DomainAttachment: Schema.Struct<{
+  readonly connectionId: Schema.String;
+  readonly createdAt: Schema.DateFromString;
+  readonly domain: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly id: Schema.String;
+  readonly target: Schema.Struct<{
+    readonly accountId: Schema.String;
+    readonly accountKind: Schema.NullOr<Schema.Literals<readonly ["account", "personal", "team"]>>;
+    readonly evidence: Schema.optionalKey<Schema.Struct<{
+      /** The account display name observed during discovery, when the provider exposes one. */
+      readonly accountName: Schema.optionalKey<Schema.String>;
+      /** Nameserver and provider-state evidence observed during discovery. */
+      readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+      readonly status: Schema.String;
+      /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
+      readonly zoneType: Schema.String;
+    }>>;
+    readonly zoneId: Schema.String;
+    readonly zoneName: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
   }>;
 }>;
-type Grant = typeof Grant.Type;
-/** Returns whether a grant includes one parsed domain. */
-declare const coversDomain: (grant: Grant, domain: DomainName) => boolean;
-/** Expands a grant to include the requested domains. */
-declare const includeDomains: (current: Grant | undefined, requested: Grant) => Grant;
-/** Contracts a grant so it no longer includes one parsed domain. */
-declare const removeDomain$1: (grant: Grant, domain: DomainName) => Grant;
-/** An owner-scoped grant bound to one provider authorization. */
-declare const Schema$2: Schema.Struct<{
+interface DomainAttachment extends Schema.Schema.Type<typeof DomainAttachment> {}
+/** Internal connection row; the authorization id is intentionally not part of the public shape. */
+declare const StoredConnection: Schema.Struct<{
   readonly authorizationId: Schema.String;
   readonly createdAt: Schema.DateFromString;
-  readonly grant: Schema.TaggedUnion<{
-    readonly account: Schema.TaggedStruct<"account", {
-      readonly excludedDomains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-    }>;
-    readonly domains: Schema.TaggedStruct<"domains", {
-      readonly domains: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-    }>;
-  }>;
   readonly id: Schema.String;
+  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
   readonly ownerId: Schema.String;
+  readonly providerId: Schema.String;
 }>;
-interface Connection extends Schema.Schema.Type<typeof Schema$2> {}
+interface StoredConnection extends Schema.Schema.Type<typeof StoredConnection> {}
+/** Internal credential material retained by the host's persistence implementation. */
+interface StoredCredential {
+  readonly accessToken: Value;
+  readonly refreshToken: Value | null;
+  readonly tokenType: string;
+}
+declare const AuthorizationError_base$1: Schema.Class<AuthorizationError$1, Schema.TaggedStruct<"AuthorizationError", {
+  readonly category: Schema.Literal<"authorization">;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class AuthorizationError$1 extends AuthorizationError_base$1 {}
+declare const authorizationError: (message: string, operation: string) => AuthorizationError$1;
+/** Decode a public connection snapshot returned by a host. */
 declare const decode$2: (input: unknown) => Effect.Effect<{
-  readonly authorizationId: string;
   readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-    readonly excludedDomains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
   readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
   readonly ownerId: string;
+  readonly providerId: string;
+  readonly status: "active" | "expired" | "revocation-pending";
 }, Error$5, never>;
 declare const validate$2: (input: unknown) => Effect.Effect<{
-  readonly authorizationId: string;
   readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-    readonly excludedDomains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
   readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
   readonly ownerId: string;
+  readonly providerId: string;
+  readonly status: "active" | "expired" | "revocation-pending";
 }, Error$5, never>;
 declare const encode$2: (input: {
-  readonly authorizationId: string;
   readonly createdAt: Date;
-  readonly grant: {
-    readonly _tag: "account";
-    readonly excludedDomains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly (string & import("effect/Brand").Brand<"DomainName">)[];
-  };
   readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
   readonly ownerId: string;
+  readonly providerId: string;
+  readonly status: "active" | "expired" | "revocation-pending";
 }, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly authorizationId: string;
   readonly createdAt: string;
-  readonly grant: {
-    readonly _tag: "account";
-    readonly excludedDomains: readonly string[];
-  } | {
-    readonly _tag: "domains";
-    readonly domains: readonly string[];
-  };
   readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
   readonly ownerId: string;
-};
-interface OAuthContinuation {
-  readonly clientId: string;
-  readonly codeVerifier: Value;
-  readonly expiresAt: Date;
-  readonly grant: Grant;
-  readonly method: OAuthMethod;
-  readonly ownerId: string;
-  readonly redirectUri: string;
-  readonly stateHash: string;
-  readonly authorizedById: string;
-}
-interface StoredCredential {
-  readonly accessToken: Value;
-  readonly refreshToken: Value | null;
-  readonly tokenType: string;
-}
-declare const AuthorizationError_base$1: Schema.Class<AuthorizationError$1, Schema.TaggedStruct<"AuthorizationError", {
-  readonly category: Schema.Literal<"authorization">;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
-}>, import("effect/Cause").YieldableError>;
-declare class AuthorizationError$1 extends AuthorizationError_base$1 {}
-declare const authorizationError: (message: string, operation: string) => AuthorizationError$1;
-declare function assertGrant(connection: Connection, authorization: ProviderAuthorization, request: {
-  readonly capability: Capability;
-  readonly domain: string;
-  readonly now?: Date;
   readonly providerId: string;
-}): DomainName;
-declare namespace canonical_json_d_exports {
-  export { CryptoError, Json, sha256Encoded, sha256Json, sha256Text, stringify, webCryptoLayer };
-}
-declare const CryptoError_base: Schema.Class<CryptoError, Schema.TaggedStruct<"CryptoError", {
-  readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-declare class CryptoError extends CryptoError_base {}
-type Json = null | boolean | number | string | ReadonlyArray<Json> | {
-  readonly [key: string]: Json;
+  readonly status: "active" | "expired" | "revocation-pending";
 };
-/** Deterministic JSON serialization for already schema-encoded protocol values. */
-declare function stringify(value: Json): string;
-declare const sha256Text: (value: string) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
-declare const sha256Json: (value: Json) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
-declare const sha256Encoded: <S extends Schema.Constraint>(schema: S, value: S["Type"]) => Effect.Effect<string, CryptoError, Crypto.Crypto | S["EncodingServices"]>;
-/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
-declare const webCryptoLayer: Layer.Layer<Crypto.Crypto>;
-declare namespace lifecycle_repository_d_exports {
-  export { Aggregate, BindingModification, DetachResult, Error$3 as Error, Interface$2 as Interface, Service$2 as Service };
-}
+//#endregion
+//#region src/auth/lifecycle-repository.d.ts
+/** Private aggregate owned by the managed-DNS persistence capability. */
 interface Aggregate {
   readonly authorization: ProviderAuthorization;
-  readonly bindings: ReadonlyArray<Connection>;
+  readonly connections: ReadonlyArray<StoredConnection>;
+  readonly attachments: ReadonlyArray<DomainAttachment>;
+  readonly credential: StoredCredential;
+}
+interface ConnectInput {
+  readonly authorization: ProviderAuthorization;
+  readonly connection: StoredConnection;
   readonly credential: StoredCredential;
+  /** The authorization id observed before building a reuse update, if any. */
+  readonly expectedAuthorizationId?: string;
+  /** The owner connection id observed before building a reuse update, if any. */
+  readonly expectedConnectionId?: string;
+}
+interface AttachmentResult {
+  readonly attachment: DomainAttachment;
+  readonly connection: ProviderConnection;
 }
 interface DetachResult {
-  readonly authorizationId: string;
-  readonly remainingBindings: number;
-  readonly revokedAuthorization: boolean;
+  readonly attachment: DomainAttachment;
+  readonly connection: ProviderConnection;
+  readonly remainingAttachments: number;
 }
-interface BindingModification<A> {
-  readonly aggregate: Aggregate;
-  readonly value: A;
+interface DisconnectResult {
+  readonly connection: ProviderConnection;
+  readonly remainingConnections: number;
+  readonly revokedAuthorization: boolean;
 }
-declare const Error_base$3: Schema.Class<Error$3, Schema.TaggedStruct<"LifecycleRepositoryError", {
+declare const Error_base$3: Schema.Class<Error$3, Schema.TaggedStruct<"ManagedDnsLifecycleError", {
   readonly category: Schema.Literal<"storage">;
   readonly message: Schema.String;
   readonly operation: Schema.String;
   readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
 }>, import("effect/Cause").YieldableError>;
 declare class Error$3 extends Error_base$3 {}
+/**
+ * Persistence capability for the managed-DNS model.
+ *
+ * Implementations own the atomic aggregate containing one provider credential authorization,
+ * organization connections, and exact domain attachments. Provider authorization is deliberately
+ * an implementation detail of the capability; public callers operate on the projections returned
+ * by the connection and attachment methods.
+ */
 interface Interface$2 {
-  readonly bind: (authorizationId: string, binding: Connection) => Effect.Effect<Aggregate, Error$3>;
-  readonly connect: (aggregate: Aggregate) => Effect.Effect<Aggregate, Error$3>;
-  readonly detach: <E>(input: {
+  readonly attach: (input: {
+    readonly attachment: DomainAttachment;
     readonly connectionId: string;
-    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;
-  }) => Effect.Effect<DetachResult, Error$3 | E>;
-  readonly findByProviderAccount: (providerId: string, providerAccountId: string) => Effect.Effect<Aggregate | null, Error$3>;
+    readonly ownerId: string;
+  }) => Effect.Effect<AttachmentResult, Error$3>;
+  readonly connect: (input: ConnectInput) => Effect.Effect<Aggregate, Error$3>;
+  readonly detach: (input: {
+    readonly attachmentId: string;
+    readonly ownerId: string;
+  }) => Effect.Effect<DetachResult, Error$3>;
+  readonly disconnect: <E>(input: {
+    readonly connectionId: string;
+    readonly ownerId: string;
+    readonly revoke: (authorization: ProviderAuthorization) => Effect.Effect<void, E>;
+  }) => Effect.Effect<DisconnectResult, Error$3 | E>;
+  readonly findConnection: (ownerId: string, authorizationId: string) => Effect.Effect<StoredConnection | null, Error$3>;
   readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error$3>;
+  readonly getAttachment: (attachmentId: string) => Effect.Effect<DomainAttachment | null, Error$3>;
   readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error$3>;
-  readonly modifyBinding: <A>(connectionId: string, modify: (binding: Connection) => {
-    readonly binding: Connection;
-    readonly value: A;
-  }) => Effect.Effect<BindingModification<A>, Error$3>;
+  readonly listAttachments: (connectionId: string, ownerId: string) => Effect.Effect<ReadonlyArray<DomainAttachment>, Error$3>;
   readonly promoteEvidence: (authorizationId: string, evidence: ReadonlyArray<CapabilityEvidence>) => Effect.Effect<Aggregate, Error$3>;
   readonly recover: <E>(input: {
     readonly authorizationId: string;
-    readonly revoke: (aggregate: Aggregate) => Effect.Effect<void, E>;
-  }) => Effect.Effect<DetachResult, Error$3 | E>;
+    readonly revoke: (authorization: ProviderAuthorization) => Effect.Effect<void, E>;
+  }) => Effect.Effect<DisconnectResult, Error$3 | E>;
   readonly rotate: (authorizationId: string, credential: StoredCredential, expiresAt: Date | null) => Effect.Effect<Aggregate, Error$3>;
 }
-declare const Service_base$2: Context.ServiceClass<Service$2, "@domainkit/AuthorizationLifecycleRepository", Interface$2>;
+declare const Service_base$2: Context.ServiceClass<Service$2, "@domainkit/ManagedDnsConnections", Interface$2>;
 declare class Service$2 extends Service_base$2 {}
+declare namespace canonical_json_d_exports {
+  export { CryptoError, Json, sha256Encoded, sha256Json, sha256Text, stringify, webCryptoLayer };
+}
+declare const CryptoError_base: Schema.Class<CryptoError, Schema.TaggedStruct<"CryptoError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class CryptoError extends CryptoError_base {}
+type Json = null | boolean | number | string | ReadonlyArray<Json> | {
+  readonly [key: string]: Json;
+};
+/** Deterministic JSON serialization for already schema-encoded protocol values. */
+declare function stringify(value: Json): string;
+declare const sha256Text: (value: string) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
+declare const sha256Json: (value: Json) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
+declare const sha256Encoded: <S extends Schema.Constraint>(schema: S, value: S["Type"]) => Effect.Effect<string, CryptoError, Crypto.Crypto | S["EncodingServices"]>;
+/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
+declare const webCryptoLayer: Layer.Layer<Crypto.Crypto>;
 declare namespace provider_context_d_exports {
   export { Codec, Envelope, codec, decode$1 as decode, encode$1 as encode };
 }
@@ -1068,6 +878,7 @@ interface Authentication {
   readonly capabilityEvidence: ReadonlyArray<CapabilityEvidence>;
   readonly credential: StoredCredential;
   readonly expiresAt: Date | null;
+  /** Provider-specific subject identity used only during authentication; targets are selected later. */
   readonly providerAccountId: string;
   readonly providerContext: Envelope;
   readonly scopes: ReadonlyArray<string>;
@@ -1194,7 +1005,7 @@ declare const Method: {
 };
 type StartResult = Data.TaggedEnum<{
   Connected: {
-    readonly aggregate: Aggregate;
+    readonly connection: ProviderConnection;
   };
   Redirect: {
     readonly authorizationUrl: URL;
@@ -1204,7 +1015,7 @@ type StartResult = Data.TaggedEnum<{
 declare const StartResult: {
   readonly $is: <Tag extends "Connected" | "Redirect">(tag: Tag) => (u: unknown) => u is Extract<{
     readonly _tag: "Connected";
-    readonly aggregate: Aggregate;
+    readonly connection: ProviderConnection;
   }, {
     readonly _tag: Tag;
   }> | Extract<{
@@ -1217,7 +1028,7 @@ declare const StartResult: {
   readonly $match: {
     <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
       readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
+      readonly connection: ProviderConnection;
     } | {
       readonly _tag: "Redirect";
       readonly authorizationUrl: URL;
@@ -1226,7 +1037,7 @@ declare const StartResult: {
       readonly _tag: Tag;
     }>) => any; }>(cases: Cases): (value: {
       readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
+      readonly connection: ProviderConnection;
     } | {
       readonly _tag: "Redirect";
       readonly authorizationUrl: URL;
@@ -1234,7 +1045,7 @@ declare const StartResult: {
     }) => import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
     <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
       readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
+      readonly connection: ProviderConnection;
     } | {
       readonly _tag: "Redirect";
       readonly authorizationUrl: URL;
@@ -1243,7 +1054,7 @@ declare const StartResult: {
       readonly _tag: Tag;
     }>) => any; }>(value: {
       readonly _tag: "Connected";
-      readonly aggregate: Aggregate;
+      readonly connection: ProviderConnection;
     } | {
       readonly _tag: "Redirect";
       readonly authorizationUrl: URL;
@@ -1252,7 +1063,7 @@ declare const StartResult: {
   };
   readonly Connected: Data.TaggedEnum.ConstructorFrom<{
     readonly _tag: "Connected";
-    readonly aggregate: Aggregate;
+    readonly connection: ProviderConnection;
   }, "_tag">;
   readonly Redirect: Data.TaggedEnum.ConstructorFrom<{
     readonly _tag: "Redirect";
@@ -1267,9 +1078,11 @@ declare const Error_base$2: Schema.Class<Error$2, Schema.TaggedStruct<"Connectio
   readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
 }>, import("effect/Cause").YieldableError>;
 declare class Error$2 extends Error_base$2 {}
+/** Inputs shared by token and interactive connection flows. */
 interface BaseInput {
   readonly authorizedById: string;
-  readonly grant: Grant;
+  /** Existing authorization may be supplied only after the host completed fresh provider proof. */
+  readonly authorizationId?: string;
   readonly ownerId: string;
 }
 interface CompleteInput {
@@ -1278,99 +1091,17 @@ interface CompleteInput {
   readonly continuations: ContinuationStore;
   readonly flow: InteractiveFlow;
 }
-interface ExtendInput {
-  readonly connectionId: string;
-  readonly grant: Grant;
-  readonly ownerId: string;
-}
-interface RemoveDomainInput {
-  readonly connectionId: string;
-  readonly domain: string;
-  readonly ownerId: string;
-}
-type RemoveDomainResult = Data.TaggedEnum<{
-  AlreadyRemoved: {
-    readonly aggregate: Aggregate;
-  };
-  Removed: {
-    readonly aggregate: Aggregate;
-  };
-}>;
-declare const RemoveDomainResult: {
-  readonly $is: <Tag extends "AlreadyRemoved" | "Removed">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "AlreadyRemoved";
-    readonly aggregate: Aggregate;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Removed";
-    readonly aggregate: Aggregate;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "AlreadyRemoved" | "Removed"]: (args: Extract<{
-      readonly _tag: "AlreadyRemoved";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Removed";
-      readonly aggregate: Aggregate;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "AlreadyRemoved";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Removed";
-      readonly aggregate: Aggregate;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["AlreadyRemoved" | "Removed"]>>;
-    <Cases extends { readonly [Tag in "AlreadyRemoved" | "Removed"]: (args: Extract<{
-      readonly _tag: "AlreadyRemoved";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Removed";
-      readonly aggregate: Aggregate;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "AlreadyRemoved";
-      readonly aggregate: Aggregate;
-    } | {
-      readonly _tag: "Removed";
-      readonly aggregate: Aggregate;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["AlreadyRemoved" | "Removed"]>>;
-  };
-  readonly AlreadyRemoved: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "AlreadyRemoved";
-    readonly aggregate: Aggregate;
-  }, "_tag">;
-  readonly Removed: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Removed";
-    readonly aggregate: Aggregate;
-  }, "_tag">;
-};
 declare const start: (input: BaseInput & {
   readonly method: Method;
 }) => Effect.Effect<{
   readonly _tag: "Connected";
-  readonly aggregate: Aggregate;
+  readonly connection: ProviderConnection;
 } | {
   readonly _tag: "Redirect";
   readonly authorizationUrl: URL;
   readonly continuationId: string;
 }, Error$3 | AuthenticationFailure, Crypto.Crypto | Service$2>;
-declare const complete: (input: CompleteInput) => Effect.Effect<Aggregate, Error$3 | AuthenticationFailure, Crypto.Crypto | Service$2>;
-/** Extends one owner binding without repeating provider authentication. */
-declare const extend: (input: ExtendInput) => Effect.Effect<Aggregate, Error$3 | Error$2, Service$2>;
-/** Removes one domain from an owner binding without revoking provider authorization. */
-declare const removeDomain: (input: RemoveDomainInput) => Effect.Effect<{
-  readonly _tag: "AlreadyRemoved";
-  readonly aggregate: Aggregate;
-} | {
-  readonly _tag: "Removed";
-  readonly aggregate: Aggregate;
-}, Error$3 | Error$2, Service$2>;
-type Requirements$1 = Service$2 | Crypto.Crypto;
+declare const complete: (input: CompleteInput) => Effect.Effect<ProviderConnection, Error$3 | AuthenticationFailure, Crypto.Crypto | Service$2>;
 type Failure = AuthenticationFailure | Error$3 | CryptoError;
 declare namespace zone_discovery_d_exports {
   export { Candidate, Interface$1 as Interface, Outcome, Service$1 as Service, Source, make };
@@ -4228,5 +3959,5 @@ interface AsyncInterface {
 declare const layerFromAsync: (resolver: AsyncInterface) => Layer.Layer<Service>;
 declare const toAsync: (resolver: Interface) => AsyncInterface;
 //#endregion
-export { InteractiveFlow as $, manifest_d_exports as $t, renderManualInstructions as A, parse$1 as An, coversDomain as At, types_d_exports as B, ProviderAuthorization as Bt, DiscoverCreateInput as C, equals as Cn, Connection as Ct, StaleError as D, DomainName as Dn, StoredCredential as Dt, ResolvedCreateResult as E, secret_d_exports as En, Schema$2 as Et, PlanAuthorization as F, validate$2 as Ft, AuthenticationFailure as G, IntegrationMethod as Gt, Source as H, authorization_d_exports as Ht, Receipt$1 as I, Capability as It, Continuation as J, OAuthClientConfiguration as Jt, BaseInput as K, Manifest as Kt, Schema$1 as L, CapabilityEvidence as Lt, Authorization$1 as M, invalid_input_d_exports as Mn, encode$2 as Mt, DnsPlan as N, includeDomains as Nt, Target as O, Schema$6 as On, assertGrant as Ot, Operation$1 as P, removeDomain$1 as Pt, Failure as Q, TokenValidation as Qt, encode as R, Evidence as Rt, CreateResult as S, dns_record_d_exports as Sn, AuthorizationError$1 as St, PartialApplyError as T, Value as Tn, OAuthContinuation as Tt, zone_discovery_d_exports as U, encode$3 as Ut, Candidate as V, Schema$3 as Vt, Authentication as W, AsyncOAuthSubjectResolver as Wt, Error$2 as X, OAuthSubjectResolver as Xt, ContinuationStore as Y, OAuthMethod as Yt, ExtendInput as Z, Schema$4 as Zt, Receipt as _, Schema$5 as _n, Interface$2 as _t, Interface as a, provider_d_exports as an, StartResult as at, AuthorizeError as b, Type as bn, CryptoError as bt, Service as c, Caa as cn, removeDomain as ct, Authorization as d, Encoded as dn, Envelope as dt, AsyncInterface$1 as en, InteractiveStart as et, CreateError as f, Mx as fn, provider_context_d_exports as ft, Plan as g, RequirementMetadata as gn, Error$3 as gt, PartialError as h, Opaque as hn, DetachResult as ht, Error as i, Service$3 as in, Requirements$1 as it, ApplyReceipt as j, Error$5 as jn, decode$2 as jt, plan_d_exports as k, domain_name_d_exports as kn, authorizationError as kt, resolver_d_exports as l, Cname as ln, start as lt, Operation as m, Observed as mn, BindingModification as mt, AsyncInterface as n, Error$4 as nn, RemoveDomainInput as nt, Query as o, A as on, complete as ot, Error$1 as p, Ns as pn, Aggregate as pt, CompleteInput as q, Method$1 as qt, AsyncResolution as r, Interface$3 as rn, RemoveDomainResult as rt, Resolution as s, Aaaa as sn, extend as st, Answer as t, CreateResult$1 as tn, Method as tt, ApplyError as u, DnsRecord as un, Codec as ut, deletion_d_exports as v, Srv as vn, Service$2 as vt, ExactCreateInput as w, parse as wn, Grant as wt, ConflictError as x, data as xn, canonical_json_d_exports as xt, AuthorizationError as y, Txt as yn, lifecycle_repository_d_exports as yt, encodeReceipt as z, EvidenceSchema as zt };
-//# sourceMappingURL=resolver-uqe1h5Vz.d.mts.map
+export { InteractiveStart as $, Cname as $t, renderManualInstructions as A, CapabilityEvidence as At, types_d_exports as B, TokenValidation as Bt, DiscoverCreateInput as C, StoredConnection as Ct, StaleError as D, encode$2 as Dt, ResolvedCreateResult as E, decode$2 as Et, PlanAuthorization as F, Method$1 as Ft, AuthenticationFailure as G, CreateResult$1 as Gt, Source as H, Value as Ht, Receipt$1 as I, OAuthClientConfiguration as It, Continuation as J, Service$3 as Jt, BaseInput as K, Error$4 as Kt, Schema$1 as L, OAuthMethod as Lt, Authorization$1 as M, AsyncOAuthSubjectResolver as Mt, DnsPlan as N, IntegrationMethod as Nt, Target as O, validate$2 as Ot, Operation$1 as P, Manifest as Pt, InteractiveFlow as Q, Caa as Qt, encode as R, OAuthSubjectResolver as Rt, CreateResult as S, ProviderTargetEvidence as St, PartialApplyError as T, authorizationError as Tt, zone_discovery_d_exports as U, secret_d_exports as Ut, Candidate as V, manifest_d_exports as Vt, Authentication as W, AsyncInterface$1 as Wt, Error$2 as X, A as Xt, ContinuationStore as Y, provider_d_exports as Yt, Failure as Z, Aaaa as Zt, Receipt as _, domain_name_d_exports as _n, AuthorizationError$1 as _t, Interface as a, Opaque as an, Envelope as at, AuthorizeError as b, invalid_input_d_exports as bn, ProviderConnection as bt, Service as c, Srv as cn, canonical_json_d_exports as ct, Authorization as d, data as dn, ConnectInput as dt, DnsRecord as en, Method as et, CreateError as f, dns_record_d_exports as fn, DetachResult as ft, Plan as g, Schema$5 as gn, Service$2 as gt, PartialError as h, DomainName as hn, Interface$2 as ht, Error as i, Observed as in, Codec as it, ApplyReceipt as j, ProviderAuthorization as jt, plan_d_exports as k, Capability as kt, resolver_d_exports as l, Txt as ln, Aggregate as lt, Operation as m, parse as mn, Error$3 as mt, AsyncInterface as n, Mx as nn, complete as nt, Query as o, RequirementMetadata as on, provider_context_d_exports as ot, Error$1 as p, equals as pn, DisconnectResult as pt, CompleteInput as q, Interface$3 as qt, AsyncResolution as r, Ns as rn, start as rt, Resolution as s, Schema$4 as sn, CryptoError as st, Answer as t, Encoded as tn, StartResult as tt, ApplyError as u, Type as un, AttachmentResult as ut, deletion_d_exports as v, parse$1 as vn, ConnectionStatus as vt, ExactCreateInput as w, StoredCredential as wt, ConflictError as x, ProviderTarget as xt, AuthorizationError as y, Error$5 as yn, DomainAttachment as yt, encodeReceipt as z, Schema$3 as zt };
+//# sourceMappingURL=resolver-BGBLnPjJ.d.mts.map