domainkit 0.4.0 → 0.6.0

package/dist/connect-Db830jad.d.mts

@@ -0,0 +1,1387 @@
+import { Context, Crypto, Data, Effect, Layer, Schema } from "effect";
+import * as oauth from "oauth4webapi";
+declare namespace invalid_input_d_exports {
+  export { Error$3 as Error };
+}
+declare const Error_base$3: Schema.Class<Error$3, Schema.TaggedStruct<"InvalidInputError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$3 extends Error_base$3 {}
+declare namespace domain_name_d_exports {
+  export { DomainName, Schema$4 as Schema, decode$5 as decode, parse$1 as parse };
+}
+declare const Type$1: Schema.brand<Schema.String, "DomainName">;
+/** A lower-case, fully qualified DNS name without a trailing dot. */
+type DomainName = typeof Type$1.Type;
+/** Decodes user and wire strings into canonical domain names. */
+declare const Schema$4: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+declare const decode$5: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$3, never>;
+declare function parse$1(input: unknown): DomainName;
+declare namespace dns_record_d_exports {
+  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$3 as Schema, Srv, Txt, Type, data, decode$4 as decode, equals, parse };
+}
+declare const Type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
+type Type = typeof Type.Type;
+declare const RequirementMetadata: Schema.Struct<{
+  readonly ownership: Schema.String;
+  readonly provenance: Schema.String;
+  readonly purpose: Schema.String;
+}>;
+interface RequirementMetadata extends Schema.Schema.Type<typeof RequirementMetadata> {}
+declare const Schema$3: Schema.TaggedUnion<{
+  readonly A: Schema.TaggedStruct<"A", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly AAAA: Schema.TaggedStruct<"AAAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly CAA: Schema.TaggedStruct<"CAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly flags: Schema.Int;
+    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+    readonly value: Schema.String;
+  }>;
+  readonly CNAME: Schema.TaggedStruct<"CNAME", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly policy: Schema.Literal<"exclusive">;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly MX: Schema.TaggedStruct<"MX", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly priority: Schema.Int;
+  }>;
+  readonly NS: Schema.TaggedStruct<"NS", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly SRV: Schema.TaggedStruct<"SRV", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly port: Schema.Int;
+    readonly priority: Schema.Int;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly weight: Schema.Int;
+  }>;
+  readonly TXT: Schema.TaggedStruct<"TXT", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly value: Schema.String;
+  }>;
+}>;
+declare const A: Schema.TaggedStruct<"A", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly address: Schema.String;
+}>, Aaaa: Schema.TaggedStruct<"AAAA", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly address: Schema.String;
+}>, Caa: Schema.TaggedStruct<"CAA", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly flags: Schema.Int;
+  readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+  readonly value: Schema.String;
+}>, Cname: Schema.TaggedStruct<"CNAME", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly policy: Schema.Literal<"exclusive">;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>, Mx: Schema.TaggedStruct<"MX", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly priority: Schema.Int;
+}>, Ns: Schema.TaggedStruct<"NS", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>, Srv: Schema.TaggedStruct<"SRV", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly port: Schema.Int;
+  readonly priority: Schema.Int;
+  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly weight: Schema.Int;
+}>, Txt: Schema.TaggedStruct<"TXT", {
+  readonly metadata: Schema.Struct<{
+    readonly ownership: Schema.String;
+    readonly provenance: Schema.String;
+    readonly purpose: Schema.String;
+  }>;
+  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+  readonly ttl: Schema.NullOr<Schema.Int>;
+  readonly value: Schema.String;
+}>;
+type DnsRecord = typeof Schema$3.Type;
+type Encoded = typeof Schema$3.Encoded;
+/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
+declare const Opaque: Schema.Struct<{
+  readonly _tag: Schema.Literal<"Opaque">;
+  readonly name: Schema.String;
+  readonly providerRecordId: Schema.NullOr<Schema.String>;
+  readonly providerType: Schema.String;
+}>;
+interface Opaque extends Schema.Schema.Type<typeof Opaque> {}
+/** Any DNS record observed through a provider, including non-portable record types. */
+declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
+  readonly A: Schema.TaggedStruct<"A", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly AAAA: Schema.TaggedStruct<"AAAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
+  }>;
+  readonly CAA: Schema.TaggedStruct<"CAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly flags: Schema.Int;
+    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+    readonly value: Schema.String;
+  }>;
+  readonly CNAME: Schema.TaggedStruct<"CNAME", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly policy: Schema.Literal<"exclusive">;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly MX: Schema.TaggedStruct<"MX", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly priority: Schema.Int;
+  }>;
+  readonly NS: Schema.TaggedStruct<"NS", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+  readonly SRV: Schema.TaggedStruct<"SRV", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly port: Schema.Int;
+    readonly priority: Schema.Int;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly weight: Schema.Int;
+  }>;
+  readonly TXT: Schema.TaggedStruct<"TXT", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly value: Schema.String;
+  }>;
+}>, Schema.Struct<{
+  readonly _tag: Schema.Literal<"Opaque">;
+  readonly name: Schema.String;
+  readonly providerRecordId: Schema.NullOr<Schema.String>;
+  readonly providerType: Schema.String;
+}>]>;
+type Observed = typeof Observed.Type;
+declare const decode$4: (input: unknown) => Effect.Effect<{
+  readonly _tag: "A";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+} | {
+  readonly _tag: "AAAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+} | {
+  readonly _tag: "CAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly flags: number;
+  readonly tag: "iodef" | "issue" | "issuewild";
+  readonly value: string;
+} | {
+  readonly _tag: "CNAME";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly ttl: number | null;
+  readonly policy: "exclusive";
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+} | {
+  readonly _tag: "MX";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+  readonly priority: number;
+} | {
+  readonly _tag: "NS";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+} | {
+  readonly _tag: "SRV";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly port: number;
+  readonly priority: number;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+  readonly weight: number;
+} | {
+  readonly _tag: "TXT";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly value: string;
+}, Error$3, never>;
+declare function parse(input: unknown): DnsRecord;
+declare function data(record: DnsRecord): Readonly<Record<string, number | string>>;
+declare function equals(left: DnsRecord, right: DnsRecord): boolean;
+declare namespace provider_d_exports {
+  export { AsyncInterface, CreateResult, Error$2 as Error, ErrorReason, Interface$1 as Interface, Service$1 as Service, fromAsync, layerFromAsync, toAsync };
+}
+interface CreateResult {
+  readonly providerRecordId: string | null;
+}
+declare const ErrorReason: Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>;
+type ErrorReason = typeof ErrorReason.Type;
+declare const Error_base$2: Schema.Class<Error$2, Schema.TaggedStruct<"ProviderError", {
+  readonly cause: Schema.optionalKey<Schema.Unknown>;
+  readonly code: Schema.optionalKey<Schema.Union<readonly [Schema.Number, Schema.String]>>;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly providerId: Schema.String;
+  readonly reason: Schema.optionalKey<Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>>;
+  readonly retryAfterMs: Schema.optionalKey<Schema.Number>;
+  readonly status: Schema.optionalKey<Schema.Number>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$2 extends Error_base$2 {}
+/** The provider capability used by DNS planning, application, and verification. */
+interface Interface$1 {
+  readonly id: string;
+  readonly createRecord: (zone: DomainName, record: DnsRecord) => Effect.Effect<CreateResult, Error$2>;
+  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<void, Error$2>;
+  readonly getRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<Observed | null, Error$2>;
+  readonly listRecords: (zone: DomainName) => Effect.Effect<ReadonlyArray<Observed>, Error$2>;
+}
+declare const Service_base$1: Context.ServiceClass<Service$1, "@domainkit/DnsProvider", Interface$1>;
+declare class Service$1 extends Service_base$1 {}
+/** Minimal Promise-shaped provider contract for hosts that do not use Effect directly. */
+interface AsyncInterface {
+  readonly id: string;
+  readonly createRecord: (zone: DomainName, record: DnsRecord) => Promise<CreateResult>;
+  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Promise<void>;
+  readonly getRecord: (zone: DomainName, providerRecordId: string) => Promise<Observed | null>;
+  readonly listRecords: (zone: DomainName) => Promise<ReadonlyArray<Observed>>;
+}
+declare const fromAsync: (provider: AsyncInterface) => Interface$1;
+declare const layerFromAsync: (provider: AsyncInterface) => Layer.Layer<Service$1>;
+declare const toAsync: (provider: Interface$1) => AsyncInterface;
+declare namespace secret_d_exports {
+  export { Value, make };
+}
+/** A deliberately non-serializable credential value. */
+declare class Value {
+  #private;
+  private constructor();
+  static from(value: string): Value;
+  expose(): string;
+  toJSON(): string;
+  toString(): string;
+}
+declare const make: typeof Value.from;
+declare namespace manifest_d_exports {
+  export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method$1 as Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$2 as Schema, TokenValidation, decode$3 as decode };
+}
+declare const Method$1: Schema.TaggedUnion<{
+  readonly integration: Schema.TaggedStruct<"integration", {
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly installUrl: Schema.String;
+    readonly tokenEndpoint: Schema.String;
+  }>;
+  readonly oauth2: Schema.TaggedStruct<"oauth2", {
+    readonly authorizationServer: Schema.Struct<{
+      readonly authorization_endpoint: Schema.String;
+      readonly issuer: Schema.String;
+      readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
+      readonly token_endpoint: Schema.String;
+    }>;
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+    readonly scopes: Schema.$Array<Schema.String>;
+  }>;
+  readonly token: Schema.TaggedStruct<"token", {
+    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly instructionsUrl: Schema.String;
+  }>;
+}>;
+declare const Schema$2: Schema.Struct<{
+  readonly methods: Schema.$Array<Schema.TaggedUnion<{
+    readonly integration: Schema.TaggedStruct<"integration", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly installUrl: Schema.String;
+      readonly tokenEndpoint: Schema.String;
+    }>;
+    readonly oauth2: Schema.TaggedStruct<"oauth2", {
+      readonly authorizationServer: Schema.Struct<{
+        readonly authorization_endpoint: Schema.String;
+        readonly issuer: Schema.String;
+        readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
+        readonly token_endpoint: Schema.String;
+      }>;
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+      readonly scopes: Schema.$Array<Schema.String>;
+    }>;
+    readonly token: Schema.TaggedStruct<"token", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly instructionsUrl: Schema.String;
+    }>;
+  }>>;
+  readonly providerId: Schema.String;
+}>;
+interface Manifest extends Schema.Schema.Type<typeof Schema$2> {}
+type OAuthMethod = Extract<Manifest["methods"][number], {
+  readonly _tag: "oauth2";
+}>;
+/** A provider-owned installation flow that returns a credential from a one-time code. */
+type IntegrationMethod = Extract<Manifest["methods"][number], {
+  readonly _tag: "integration";
+}>;
+declare const decode$3: (input: unknown) => Effect.Effect<{
+  readonly methods: readonly ({
+    readonly _tag: "integration";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly installUrl: string;
+    readonly tokenEndpoint: string;
+  } | {
+    readonly _tag: "oauth2";
+    readonly authorizationServer: {
+      readonly authorization_endpoint: string;
+      readonly issuer: string;
+      readonly revocation_endpoint?: string;
+      readonly token_endpoint: string;
+    };
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly clientAuth: "client_secret_basic" | "client_secret_post" | "none";
+    readonly scopes: readonly string[];
+  } | {
+    readonly _tag: "token";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly instructionsUrl: string;
+  })[];
+  readonly providerId: string;
+}, Error$3, never>;
+interface OAuthClientConfiguration {
+  readonly clientId: string;
+  readonly clientSecret?: Value;
+}
+interface TokenValidation {
+  readonly accountId: string;
+  readonly capabilities: ReadonlyArray<"dns:read" | "dns:write">;
+  readonly expiresAt: Date | null;
+  readonly scopes: ReadonlyArray<string>;
+}
+interface OAuthSubjectResolver {
+  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Effect.Effect<{
+    readonly accountId: string;
+    readonly expiresAt: Date | null;
+  }, Error$2>;
+}
+interface AsyncOAuthSubjectResolver {
+  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Promise<{
+    readonly accountId: string;
+    readonly expiresAt: Date | null;
+  }>;
+}
+declare namespace authorization_d_exports {
+  export { Capability, CapabilityEvidence, Evidence, EvidenceSchema, ProviderAuthorization, Revocation, Schema$1 as Schema, decode$2 as decode, encode$2 as encode, evidenceFor, validate$1 as validate };
+}
+declare const Capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
+type Capability = typeof Capability.Type;
+type Evidence = Data.TaggedEnum<{
+  Declared: {};
+  Exercised: {
+    readonly observedAt: Date;
+  };
+  Introspected: {
+    readonly observedAt: Date;
+  };
+}>;
+declare const Evidence: {
+  readonly $is: <Tag extends "Declared" | "Exercised" | "Introspected">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "Declared";
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Exercised";
+    readonly observedAt: Date;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Introspected";
+    readonly observedAt: Date;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
+    <Cases extends { readonly [Tag in "Declared" | "Exercised" | "Introspected"]: (args: Extract<{
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Declared" | "Exercised" | "Introspected"]>>;
+  };
+  readonly Declared: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Declared";
+  }, "_tag">;
+  readonly Exercised: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Exercised";
+    readonly observedAt: Date;
+  }, "_tag">;
+  readonly Introspected: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Introspected";
+    readonly observedAt: Date;
+  }, "_tag">;
+};
+declare const EvidenceSchema: Schema.TaggedUnion<{
+  readonly Declared: Schema.TaggedStruct<"Declared", {}>;
+  readonly Exercised: Schema.TaggedStruct<"Exercised", {
+    readonly observedAt: Schema.DateFromString;
+  }>;
+  readonly Introspected: Schema.TaggedStruct<"Introspected", {
+    readonly observedAt: Schema.DateFromString;
+  }>;
+}>;
+declare const CapabilityEvidence: Schema.Struct<{
+  readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
+  readonly evidence: Schema.TaggedUnion<{
+    readonly Declared: Schema.TaggedStruct<"Declared", {}>;
+    readonly Exercised: Schema.TaggedStruct<"Exercised", {
+      readonly observedAt: Schema.DateFromString;
+    }>;
+    readonly Introspected: Schema.TaggedStruct<"Introspected", {
+      readonly observedAt: Schema.DateFromString;
+    }>;
+  }>;
+}>;
+interface CapabilityEvidence extends Schema.Schema.Type<typeof CapabilityEvidence> {}
+declare const Revocation: Schema.TaggedUnion<{
+  readonly Active: Schema.TaggedStruct<"Active", {}>;
+  readonly Pending: Schema.TaggedStruct<"Pending", {
+    readonly requestedAt: Schema.DateFromString;
+  }>;
+}>;
+type Revocation = typeof Revocation.Type;
+/** A provider credential authorization shared by one or more organization connections. */
+declare const Schema$1: Schema.Struct<{
+  readonly authorizedById: Schema.String;
+  readonly capabilityEvidence: Schema.$Array<Schema.Struct<{
+    readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
+    readonly evidence: Schema.TaggedUnion<{
+      readonly Declared: Schema.TaggedStruct<"Declared", {}>;
+      readonly Exercised: Schema.TaggedStruct<"Exercised", {
+        readonly observedAt: Schema.DateFromString;
+      }>;
+      readonly Introspected: Schema.TaggedStruct<"Introspected", {
+        readonly observedAt: Schema.DateFromString;
+      }>;
+    }>;
+  }>>;
+  readonly createdAt: Schema.DateFromString;
+  readonly id: Schema.String;
+  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
+  readonly providerContext: Schema.Struct<{
+    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    readonly version: Schema.String;
+  }>;
+  readonly providerId: Schema.String;
+  readonly requiredCapabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+  readonly revocation: Schema.TaggedUnion<{
+    readonly Active: Schema.TaggedStruct<"Active", {}>;
+    readonly Pending: Schema.TaggedStruct<"Pending", {
+      readonly requestedAt: Schema.DateFromString;
+    }>;
+  }>;
+  readonly scopes: Schema.$Array<Schema.String>;
+}>;
+interface ProviderAuthorization extends Schema.Schema.Type<typeof Schema$1> {}
+declare const decode$2: (input: unknown) => Effect.Effect<{
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  readonly createdAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+  readonly scopes: readonly string[];
+}, Error$3, never>;
+declare const validate$1: (input: unknown) => Effect.Effect<{
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  readonly createdAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+  readonly scopes: readonly string[];
+}, Error$3, never>;
+declare const encode$2: (input: {
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: Date;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: Date;
+    };
+  }[];
+  readonly createdAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+  readonly scopes: readonly string[];
+}, options?: import("effect/SchemaAST").ParseOptions) => {
+  readonly authorizedById: string;
+  readonly capabilityEvidence: readonly {
+    readonly capability: "dns:read" | "dns:write";
+    readonly evidence: {
+      readonly _tag: "Declared";
+    } | {
+      readonly _tag: "Exercised";
+      readonly observedAt: string;
+    } | {
+      readonly _tag: "Introspected";
+      readonly observedAt: string;
+    };
+  }[];
+  readonly createdAt: string;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly providerContext: {
+    readonly value: Schema.Json;
+    readonly version: string;
+  };
+  readonly providerId: string;
+  readonly requiredCapabilities: readonly ("dns:read" | "dns:write")[];
+  readonly revocation: {
+    readonly _tag: "Active";
+  } | {
+    readonly _tag: "Pending";
+    readonly requestedAt: string;
+  };
+  readonly scopes: readonly string[];
+};
+declare function evidenceFor(authorization: ProviderAuthorization, capability: Capability): Evidence | undefined;
+//#endregion
+//#region src/auth/connection.d.ts
+/** A provider account and authoritative zone selected for one domain attachment. */
+declare const ProviderTargetEvidence: Schema.Struct<{
+  /** The account display name observed during discovery, when the provider exposes one. */
+  readonly accountName: Schema.optionalKey<Schema.String>;
+  /** Nameserver and provider-state evidence observed during discovery. */
+  readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+  readonly status: Schema.String;
+  /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
+  readonly zoneType: Schema.String;
+}>;
+interface ProviderTargetEvidence extends Schema.Schema.Type<typeof ProviderTargetEvidence> {}
+declare const ProviderTarget: Schema.Struct<{
+  readonly accountId: Schema.String;
+  readonly accountKind: Schema.NullOr<Schema.Literals<readonly ["account", "personal", "team"]>>;
+  readonly evidence: Schema.optionalKey<Schema.Struct<{
+    /** The account display name observed during discovery, when the provider exposes one. */
+    readonly accountName: Schema.optionalKey<Schema.String>;
+    /** Nameserver and provider-state evidence observed during discovery. */
+    readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+    readonly status: Schema.String;
+    /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
+    readonly zoneType: Schema.String;
+  }>>;
+  readonly zoneId: Schema.String;
+  readonly zoneName: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+}>;
+interface ProviderTarget extends Schema.Schema.Type<typeof ProviderTarget> {}
+/** The lifecycle state visible to a host for an organization connection. */
+declare const ConnectionStatus: Schema.Literals<readonly ["active", "expired", "revocation-pending"]>;
+type ConnectionStatus = typeof ConnectionStatus.Type;
+/** An organization-scoped provider connection. */
+declare const ProviderConnection: Schema.Struct<{
+  readonly createdAt: Schema.DateFromString;
+  readonly id: Schema.String;
+  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
+  readonly ownerId: Schema.String;
+  readonly providerId: Schema.String;
+  readonly status: Schema.Literals<readonly ["active", "expired", "revocation-pending"]>;
+}>;
+interface ProviderConnection extends Schema.Schema.Type<typeof ProviderConnection> {}
+/** An exact provider target attached to one organization domain. */
+declare const DomainAttachment: Schema.Struct<{
+  readonly connectionId: Schema.String;
+  readonly createdAt: Schema.DateFromString;
+  readonly domain: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  readonly id: Schema.String;
+  readonly target: Schema.Struct<{
+    readonly accountId: Schema.String;
+    readonly accountKind: Schema.NullOr<Schema.Literals<readonly ["account", "personal", "team"]>>;
+    readonly evidence: Schema.optionalKey<Schema.Struct<{
+      /** The account display name observed during discovery, when the provider exposes one. */
+      readonly accountName: Schema.optionalKey<Schema.String>;
+      /** Nameserver and provider-state evidence observed during discovery. */
+      readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+      readonly status: Schema.String;
+      /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
+      readonly zoneType: Schema.String;
+    }>>;
+    readonly zoneId: Schema.String;
+    readonly zoneName: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+  }>;
+}>;
+interface DomainAttachment extends Schema.Schema.Type<typeof DomainAttachment> {}
+/** Internal connection row; the authorization id is intentionally not part of the public shape. */
+declare const StoredConnection: Schema.Struct<{
+  readonly authorizationId: Schema.String;
+  readonly createdAt: Schema.DateFromString;
+  readonly id: Schema.String;
+  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
+  readonly ownerId: Schema.String;
+  readonly providerId: Schema.String;
+}>;
+interface StoredConnection extends Schema.Schema.Type<typeof StoredConnection> {}
+/** Internal credential material retained by the host's persistence implementation. */
+interface StoredCredential {
+  readonly accessToken: Value;
+  readonly expiresAt: Date | null;
+  readonly refreshToken: Value | null;
+  readonly tokenType: string;
+}
+declare const AuthorizationError_base: Schema.Class<AuthorizationError, Schema.TaggedStruct<"AuthorizationError", {
+  readonly category: Schema.Literal<"authorization">;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class AuthorizationError extends AuthorizationError_base {}
+declare const authorizationError: (message: string, operation: string) => AuthorizationError;
+/** Decode a public connection snapshot returned by a host. */
+declare const decode$1: (input: unknown) => Effect.Effect<{
+  readonly createdAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly ownerId: string;
+  readonly providerId: string;
+  readonly status: "active" | "expired" | "revocation-pending";
+}, Error$3, never>;
+declare const validate: (input: unknown) => Effect.Effect<{
+  readonly createdAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly ownerId: string;
+  readonly providerId: string;
+  readonly status: "active" | "expired" | "revocation-pending";
+}, Error$3, never>;
+declare const encode$1: (input: {
+  readonly createdAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly ownerId: string;
+  readonly providerId: string;
+  readonly status: "active" | "expired" | "revocation-pending";
+}, options?: import("effect/SchemaAST").ParseOptions) => {
+  readonly createdAt: string;
+  readonly id: string;
+  readonly method: "integration" | "oauth2" | "token";
+  readonly ownerId: string;
+  readonly providerId: string;
+  readonly status: "active" | "expired" | "revocation-pending";
+};
+/** Derive a public connection projection from its private authorization state. */
+declare function project(connection: StoredConnection, authorization: ProviderAuthorization, credential: StoredCredential, now?: Date): ProviderConnection;
+//#endregion
+//#region src/auth/lifecycle-repository.d.ts
+/** Private aggregate owned by the managed-DNS persistence capability. */
+interface Aggregate {
+  readonly authorization: ProviderAuthorization;
+  readonly connections: ReadonlyArray<StoredConnection>;
+  readonly attachments: ReadonlyArray<DomainAttachment>;
+  readonly credential: StoredCredential;
+}
+/** Serializable durable state. Credential material is deliberately sealed separately. */
+declare const AggregateSchema: Schema.Struct<{
+  readonly authorization: Schema.Struct<{
+    readonly authorizedById: Schema.String;
+    readonly capabilityEvidence: Schema.$Array<Schema.Struct<{
+      readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
+      readonly evidence: Schema.TaggedUnion<{
+        readonly Declared: Schema.TaggedStruct<"Declared", {}>;
+        readonly Exercised: Schema.TaggedStruct<"Exercised", {
+          readonly observedAt: Schema.DateFromString;
+        }>;
+        readonly Introspected: Schema.TaggedStruct<"Introspected", {
+          readonly observedAt: Schema.DateFromString;
+        }>;
+      }>;
+    }>>;
+    readonly createdAt: Schema.DateFromString;
+    readonly id: Schema.String;
+    readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
+    readonly providerContext: Schema.Struct<{
+      readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+      readonly version: Schema.String;
+    }>;
+    readonly providerId: Schema.String;
+    readonly requiredCapabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+    readonly revocation: Schema.TaggedUnion<{
+      readonly Active: Schema.TaggedStruct<"Active", {}>;
+      readonly Pending: Schema.TaggedStruct<"Pending", {
+        readonly requestedAt: Schema.DateFromString;
+      }>;
+    }>;
+    readonly scopes: Schema.$Array<Schema.String>;
+  }>;
+  readonly connections: Schema.$Array<Schema.Struct<{
+    readonly authorizationId: Schema.String;
+    readonly createdAt: Schema.DateFromString;
+    readonly id: Schema.String;
+    readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
+    readonly ownerId: Schema.String;
+    readonly providerId: Schema.String;
+  }>>;
+  readonly attachments: Schema.$Array<Schema.Struct<{
+    readonly connectionId: Schema.String;
+    readonly createdAt: Schema.DateFromString;
+    readonly domain: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly id: Schema.String;
+    readonly target: Schema.Struct<{
+      readonly accountId: Schema.String;
+      readonly accountKind: Schema.NullOr<Schema.Literals<readonly ["account", "personal", "team"]>>;
+      readonly evidence: Schema.optionalKey<Schema.Struct<{
+        readonly accountName: Schema.optionalKey<Schema.String>;
+        readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
+        readonly status: Schema.String;
+        readonly zoneType: Schema.String;
+      }>>;
+      readonly zoneId: Schema.String;
+      readonly zoneName: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    }>;
+  }>>;
+}>;
+interface ConnectInput {
+  readonly authorization: ProviderAuthorization;
+  readonly connection: StoredConnection;
+  readonly credential: StoredCredential;
+  /** The authorization id observed before building a reuse update, if any. */
+  readonly expectedAuthorizationId?: string;
+  /** The owner connection id observed before building a reuse update, if any. */
+  readonly expectedConnectionId?: string;
+}
+interface AttachmentResult {
+  readonly attachment: DomainAttachment;
+  readonly connection: ProviderConnection;
+}
+interface DetachResult {
+  readonly attachment: DomainAttachment;
+  readonly connection: ProviderConnection;
+  readonly remainingAttachments: number;
+}
+interface DisconnectResult {
+  readonly connection: ProviderConnection;
+  readonly remainingConnections: number;
+  readonly revokedAuthorization: boolean;
+}
+declare const Error_base$1: Schema.Class<Error$1, Schema.TaggedStruct<"ManagedDnsLifecycleError", {
+  readonly category: Schema.Literal<"storage">;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error$1 extends Error_base$1 {}
+/**
+ * Persistence capability for the managed-DNS model.
+ *
+ * Implementations own the atomic aggregate containing one provider credential authorization,
+ * organization connections, and exact domain attachments. Provider authorization is deliberately
+ * an implementation detail of the capability; public callers operate on the projections returned
+ * by the connection and attachment methods.
+ */
+interface Interface {
+  readonly attach: (input: {
+    readonly attachment: DomainAttachment;
+    readonly connectionId: string;
+    readonly ownerId: string;
+  }) => Effect.Effect<AttachmentResult, Error$1>;
+  readonly connect: (input: ConnectInput) => Effect.Effect<Aggregate, Error$1>;
+  readonly detach: (input: {
+    readonly attachmentId: string;
+    readonly ownerId: string;
+  }) => Effect.Effect<DetachResult, Error$1>;
+  readonly disconnect: <E>(input: {
+    readonly connectionId: string;
+    readonly ownerId: string;
+    readonly revoke: (authorization: ProviderAuthorization) => Effect.Effect<void, E>;
+  }) => Effect.Effect<DisconnectResult, Error$1 | E>;
+  readonly findConnection: (ownerId: string, authorizationId: string) => Effect.Effect<StoredConnection | null, Error$1>;
+  readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error$1>;
+  readonly getAttachment: (attachmentId: string) => Effect.Effect<DomainAttachment | null, Error$1>;
+  readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error$1>;
+  readonly listAttachments: (connectionId: string, ownerId: string) => Effect.Effect<ReadonlyArray<DomainAttachment>, Error$1>;
+  readonly promoteEvidence: (authorizationId: string, evidence: ReadonlyArray<CapabilityEvidence>) => Effect.Effect<Aggregate, Error$1>;
+  readonly recover: <E>(input: {
+    readonly authorizationId: string;
+    readonly revoke: (authorization: ProviderAuthorization) => Effect.Effect<void, E>;
+  }) => Effect.Effect<DisconnectResult, Error$1 | E>;
+  readonly rotate: (authorizationId: string, credential: StoredCredential) => Effect.Effect<Aggregate, Error$1>;
+}
+declare const Service_base: Context.ServiceClass<Service, "@domainkit/ManagedDnsConnections", Interface>;
+declare class Service extends Service_base {}
+declare namespace canonical_json_d_exports {
+  export { CryptoError, Json, sha256Encoded, sha256Json, sha256Text, stringify, webCryptoLayer };
+}
+declare const CryptoError_base: Schema.Class<CryptoError, Schema.TaggedStruct<"CryptoError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class CryptoError extends CryptoError_base {}
+type Json = null | boolean | number | string | ReadonlyArray<Json> | {
+  readonly [key: string]: Json;
+};
+/** Deterministic JSON serialization for already schema-encoded protocol values. */
+declare function stringify(value: Json): string;
+declare const sha256Text: (value: string) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
+declare const sha256Json: (value: Json) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
+declare const sha256Encoded: <S extends Schema.Constraint>(schema: S, value: S["Type"]) => Effect.Effect<string, CryptoError, Crypto.Crypto | S["EncodingServices"]>;
+/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
+declare const webCryptoLayer: Layer.Layer<Crypto.Crypto>;
+declare namespace provider_context_d_exports {
+  export { Codec, Envelope, codec, decode, encode };
+}
+/** A provider-owned, versioned, non-secret context value persisted by the host. */
+declare const Envelope: Schema.Struct<{
+  readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  readonly version: Schema.String;
+}>;
+interface Envelope extends Schema.Schema.Type<typeof Envelope> {}
+interface Codec<A> {
+  readonly decode: (envelope: Envelope) => Effect.Effect<A, Error$3>;
+  readonly encode: (value: A) => Effect.Effect<Envelope, Error$3>;
+  readonly version: string;
+}
+/** Build an adapter-owned context codec from a schema and stable version identifier. */
+declare function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A>;
+declare const decode: (input: unknown) => Effect.Effect<{
+  readonly value: Schema.Json;
+  readonly version: string;
+}, Error$3, never>;
+declare const encode: (input: {
+  readonly value: Schema.Json;
+  readonly version: string;
+}, options?: import("effect/SchemaAST").ParseOptions) => {
+  readonly value: Schema.Json;
+  readonly version: string;
+};
+//#endregion
+//#region src/auth/connect.d.ts
+interface Authentication {
+  readonly capabilityEvidence: ReadonlyArray<CapabilityEvidence>;
+  readonly credential: StoredCredential;
+  /** Provider-specific subject identity used only during authentication; targets are selected later. */
+  readonly providerAccountId: string;
+  readonly providerContext: Envelope;
+  readonly scopes: ReadonlyArray<string>;
+}
+type AuthenticationFailure = Error | Error$3 | Error$2;
+interface InteractiveStart {
+  readonly authorizationUrl: URL;
+  readonly payload: Value;
+}
+interface Continuation extends BaseInput {
+  readonly expiresAt: Date;
+  readonly id: string;
+  readonly method: "integration" | "oauth2";
+  readonly payload: Value;
+  readonly providerId: string;
+  readonly requiredCapabilities: ReadonlyArray<Capability>;
+}
+interface ContinuationStore {
+  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;
+  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;
+}
+interface InteractiveFlow {
+  readonly complete: (payload: Value, callbackUrl: URL) => Effect.Effect<Authentication, AuthenticationFailure>;
+  readonly method: "integration" | "oauth2";
+  readonly providerId: string;
+  readonly requiredCapabilities: ReadonlyArray<Capability>;
+  readonly start: (continuationId: string) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;
+}
+type Method = Data.TaggedEnum<{
+  Interactive: {
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  };
+  Token: {
+    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  };
+}>;
+declare const Method: {
+  readonly $is: <Tag extends "Interactive" | "Token">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "Interactive";
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Token";
+    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
+    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "Interactive";
+      readonly continuations: ContinuationStore;
+      readonly flow: InteractiveFlow;
+      readonly ttlMs?: number;
+    } | {
+      readonly _tag: "Token";
+      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+      readonly providerId: string;
+      readonly requiredCapabilities: ReadonlyArray<Capability>;
+      readonly token: Value;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
+  };
+  readonly Interactive: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Interactive";
+    readonly continuations: ContinuationStore;
+    readonly flow: InteractiveFlow;
+    readonly ttlMs?: number;
+  }, "_tag">;
+  readonly Token: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Token";
+    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
+    readonly providerId: string;
+    readonly requiredCapabilities: ReadonlyArray<Capability>;
+    readonly token: Value;
+  }, "_tag">;
+};
+type StartResult = Data.TaggedEnum<{
+  Connected: {
+    readonly connection: ProviderConnection;
+  };
+  Redirect: {
+    readonly authorizationUrl: URL;
+    readonly continuationId: string;
+  };
+}>;
+declare const StartResult: {
+  readonly $is: <Tag extends "Connected" | "Redirect">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly _tag: "Connected";
+    readonly connection: ProviderConnection;
+  }, {
+    readonly _tag: Tag;
+  }> | Extract<{
+    readonly _tag: "Redirect";
+    readonly authorizationUrl: URL;
+    readonly continuationId: string;
+  }, {
+    readonly _tag: Tag;
+  }>;
+  readonly $match: {
+    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
+      readonly _tag: "Connected";
+      readonly connection: ProviderConnection;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(cases: Cases): (value: {
+      readonly _tag: "Connected";
+      readonly connection: ProviderConnection;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }) => import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
+    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
+      readonly _tag: "Connected";
+      readonly connection: ProviderConnection;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }, {
+      readonly _tag: Tag;
+    }>) => any; }>(value: {
+      readonly _tag: "Connected";
+      readonly connection: ProviderConnection;
+    } | {
+      readonly _tag: "Redirect";
+      readonly authorizationUrl: URL;
+      readonly continuationId: string;
+    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
+  };
+  readonly Connected: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Connected";
+    readonly connection: ProviderConnection;
+  }, "_tag">;
+  readonly Redirect: Data.TaggedEnum.ConstructorFrom<{
+    readonly _tag: "Redirect";
+    readonly authorizationUrl: URL;
+    readonly continuationId: string;
+  }, "_tag">;
+};
+declare const Error_base: Schema.Class<Error, Schema.TaggedStruct<"ConnectionError", {
+  readonly category: Schema.Literals<readonly ["authorization", "provider", "validation"]>;
+  readonly message: Schema.String;
+  readonly operation: Schema.String;
+  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class Error extends Error_base {}
+/** Inputs shared by token and interactive connection flows. */
+interface BaseInput {
+  readonly authorizedById: string;
+  /** Existing authorization may be supplied only after the host completed fresh provider proof. */
+  readonly authorizationId?: string;
+  readonly ownerId: string;
+}
+interface CompleteInput {
+  readonly callbackUrl: URL;
+  readonly continuationId: string;
+  readonly continuations: ContinuationStore;
+  readonly flow: InteractiveFlow;
+}
+declare const start: (input: BaseInput & {
+  readonly method: Method;
+}) => Effect.Effect<{
+  readonly _tag: "Connected";
+  readonly connection: ProviderConnection;
+} | {
+  readonly _tag: "Redirect";
+  readonly authorizationUrl: URL;
+  readonly continuationId: string;
+}, Error$1 | AuthenticationFailure, Crypto.Crypto | Service>;
+declare const complete: (input: CompleteInput) => Effect.Effect<ProviderConnection, Error$1 | AuthenticationFailure, Crypto.Crypto | Service>;
+type Failure = AuthenticationFailure | Error$1 | CryptoError;
+//#endregion
+export { Schema$2 as $, ConnectionStatus as A, Schema$4 as At, project as B, ConnectInput as C, Txt as Ct, Interface as D, equals as Dt, Error$1 as E, dns_record_d_exports as Et, StoredConnection as F, authorization_d_exports as G, Capability as H, StoredCredential as I, Manifest as J, AsyncOAuthSubjectResolver as K, authorizationError as L, ProviderConnection as M, parse$1 as Mt, ProviderTarget as N, Error$3 as Nt, Service as O, parse as Ot, ProviderTargetEvidence as P, invalid_input_d_exports as Pt, OAuthSubjectResolver as Q, decode$1 as R, AttachmentResult as S, Srv as St, DisconnectResult as T, data as Tt, CapabilityEvidence as U, validate as V, ProviderAuthorization as W, OAuthClientConfiguration as X, Method$1 as Y, OAuthMethod as Z, provider_context_d_exports as _, Ns as _t, Continuation as a, CreateResult as at, Aggregate as b, RequirementMetadata as bt, Failure as c, Service$1 as ct, Method as d, Aaaa as dt, TokenValidation as et, StartResult as f, Caa as ft, Envelope as g, Mx as gt, Codec as h, Encoded as ht, CompleteInput as i, AsyncInterface as it, DomainAttachment as j, domain_name_d_exports as jt, AuthorizationError as k, DomainName as kt, InteractiveFlow as l, provider_d_exports as lt, start as m, DnsRecord as mt, AuthenticationFailure as n, Value as nt, ContinuationStore as o, Error$2 as ot, complete as p, Cname as pt, IntegrationMethod as q, BaseInput as r, secret_d_exports as rt, Error as s, Interface$1 as st, Authentication as t, manifest_d_exports as tt, InteractiveStart as u, A as ut, CryptoError as v, Observed as vt, DetachResult as w, Type as wt, AggregateSchema as x, Schema$3 as xt, canonical_json_d_exports as y, Opaque as yt, encode$1 as z };
+//# sourceMappingURL=connect-Db830jad.d.mts.map