domainkit 0.5.0 → 0.7.0

package/dist/{verify-B2fPyjde.mjs → verify-DDnK8U7C.mjs}

@@ -1,192 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { At as Error$2, Dt as decode$7, Et as Schema$3, I as Error$3, L as Service$3, R as fromAsync$1, V as toAsync$4, Y as Opaque, bt as assertAttachment, i as toAsync$5, it as equals, kt as parse$1, mt as AuthorizationError, n as Service$2, nt as decode$8, pt as Service$1, t as Error$4, tt as data, ut as candidates, wt as project, x as authorize$1, xt as authorizationError } from "./resolver-tZU6gEVq.mjs";
+import { A as Error$1, D as decode$5, E as Schema$2, b as assertAttachment, c as Evidence$1, d as codec, k as parse$1, p as AuthorizationError, s as Service$1, x as authorizationError } from "./canonical-json-CQYKsZw7.mjs";
+import { n as Method$1, t as Error$2 } from "./connect-oI8hcMxc.mjs";
+import { C as authorize$1, I as Error$3, L as Service$3, R as fromAsync$1, V as toAsync$4, Y as Opaque, i as Service$2, it as equals, n as Error$4, nt as decode$6, o as toAsync$5, r as Resolution$1, tt as data, ut as candidates } from "./resolver-DPJs8h0a.mjs";
 import { Clock, Context, Crypto, Data, Effect, Layer, Option, Schema, SchemaIssue, SchemaTransformation } from "effect";
 import * as oauth from "oauth4webapi";
 import * as DnsPacket from "@leichtgewicht/dns-packet";
 //#region package.json
-var version = "0.5.0";
-//#endregion
-//#region src/auth/connect.ts
-const Method$1 = Data.taggedEnum();
-const StartResult = Data.taggedEnum();
-var Error$1 = class extends Schema.TaggedError()("ConnectionError", {
-	category: Schema.Literals([
-		"authorization",
-		"provider",
-		"validation"
-	]),
-	message: Schema.String,
-	operation: Schema.String,
-	retry: Schema.Literals([
-		"never",
-		"after-user-action",
-		"safe",
-		"unknown"
-	])
-}) {};
-const missingCapability = (authentication, requiredCapabilities) => requiredCapabilities.find((capability) => !authentication.capabilityEvidence.some((item) => item.capability === capability));
-const freshId = Effect.fn("Connection.freshId")(function* () {
-	return yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
-		category: "validation",
-		message: cause.message,
-		operation: "Connection.connect",
-		retry: "safe"
-	})));
-});
-/** Persist one authenticated provider connection, optionally reusing a proven authorization. */
-const connect = Effect.fn("Connection.connect")(function* (input) {
-	const repository = yield* Service$1;
-	const now = new Date(yield* Clock.currentTimeMillis);
-	const missing = missingCapability(input.authentication, input.requiredCapabilities);
-	if (missing !== void 0) return yield* new Error$1({
-		category: "authorization",
-		message: `Provider authorization lacks evidence for ${missing}`,
-		operation: "Connection.connect",
-		retry: "after-user-action"
-	});
-	const existing = input.authorizationId === void 0 ? null : yield* repository.get(input.authorizationId);
-	if (input.authorizationId !== void 0 && existing === null) return yield* new Error$1({
-		category: "authorization",
-		message: "Provider authorization does not exist",
-		operation: "Connection.connect",
-		retry: "after-user-action"
-	});
-	if (existing?.authorization.revocation._tag === "Pending") return yield* new Error$1({
-		category: "authorization",
-		message: "Provider authorization is awaiting revocation recovery",
-		operation: "Connection.connect",
-		retry: "after-user-action"
-	});
-	if (existing !== null && (existing.authorization.providerId !== input.providerId || existing.authorization.method !== input.method)) return yield* new Error$1({
-		category: "authorization",
-		message: "Provider proof does not match the existing authorization",
-		operation: "Connection.connect",
-		retry: "never"
-	});
-	const authorizationId = existing?.authorization.id ?? (yield* freshId());
-	const authorization = existing === null ? {
-		authorizedById: input.authorizedById,
-		capabilityEvidence: [...input.authentication.capabilityEvidence],
-		createdAt: now,
-		expiresAt: input.authentication.expiresAt,
-		id: authorizationId,
-		method: input.method,
-		providerContext: input.authentication.providerContext,
-		providerId: input.providerId,
-		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: { _tag: "Active" },
-		scopes: [...input.authentication.scopes]
-	} : {
-		...existing.authorization,
-		capabilityEvidence: mergeEvidence(existing.authorization.capabilityEvidence, input.authentication.capabilityEvidence),
-		expiresAt: input.authentication.expiresAt,
-		method: input.method,
-		providerContext: input.authentication.providerContext,
-		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: { _tag: "Active" },
-		scopes: [...input.authentication.scopes]
-	};
-	const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);
-	const connection = {
-		authorizationId,
-		createdAt: existingConnection?.createdAt ?? now,
-		id: existingConnection?.id ?? (yield* freshId()),
-		method: input.method,
-		ownerId: input.ownerId,
-		providerId: input.providerId
-	};
-	return yield* repository.connect({
-		authorization,
-		connection,
-		credential: input.authentication.credential,
-		...existing === null ? {} : { expectedAuthorizationId: existing.authorization.id },
-		...existingConnection === null ? {} : { expectedConnectionId: existingConnection.id }
-	});
-});
-const start$1 = Effect.fn("Connection.start")(function* (input) {
-	if (input.method._tag === "Interactive") {
-		const crypto = yield* Crypto.Crypto;
-		const now = yield* Clock.currentTimeMillis;
-		const continuationId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error$1({
-			category: "validation",
-			message: cause.message,
-			operation: "Connection.start",
-			retry: "safe"
-		})));
-		const started = yield* input.method.flow.start(continuationId);
-		yield* input.method.continuations.put({
-			authorizedById: input.authorizedById,
-			...input.authorizationId === void 0 ? {} : { authorizationId: input.authorizationId },
-			expiresAt: new Date(now + (input.method.ttlMs ?? 6e5)),
-			id: continuationId,
-			method: input.method.flow.method,
-			ownerId: input.ownerId,
-			payload: started.payload,
-			providerId: input.method.flow.providerId,
-			requiredCapabilities: [...input.method.flow.requiredCapabilities]
-		});
-		return StartResult.Redirect({
-			authorizationUrl: started.authorizationUrl,
-			continuationId
-		});
-	}
-	const authentication = yield* input.method.authenticate(input.method.token);
-	const aggregate = yield* connect({
-		authentication,
-		authorizedById: input.authorizedById,
-		...input.authorizationId === void 0 ? {} : { authorizationId: input.authorizationId },
-		method: "token",
-		ownerId: input.ownerId,
-		providerId: input.method.providerId,
-		requiredCapabilities: input.method.requiredCapabilities
-	});
-	const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === input.ownerId);
-	if (storedConnection === void 0) return yield* new Error$1({
-		category: "validation",
-		message: "Connected provider authorization returned no organization connection",
-		operation: "Connection.start",
-		retry: "safe"
-	});
-	return StartResult.Connected({ connection: project(storedConnection, aggregate.authorization) });
-});
-const complete$1 = Effect.fn("Connection.complete")(function* (input) {
-	const continuation = yield* input.continuations.consume(input.continuationId, new Date(yield* Clock.currentTimeMillis));
-	if (continuation === null) return yield* new Error$1({
-		category: "authorization",
-		message: "Connection continuation is expired, unknown, or already consumed",
-		operation: "Connection.complete",
-		retry: "after-user-action"
-	});
-	if (continuation.providerId !== input.flow.providerId || continuation.method !== input.flow.method) return yield* new Error$1({
-		category: "authorization",
-		message: "Connection continuation does not match the provider flow",
-		operation: "Connection.complete",
-		retry: "never"
-	});
-	const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);
-	const aggregate = yield* connect({
-		authentication,
-		authorizedById: continuation.authorizedById,
-		...continuation.authorizationId === void 0 ? {} : { authorizationId: continuation.authorizationId },
-		method: continuation.method,
-		ownerId: continuation.ownerId,
-		providerId: continuation.providerId,
-		requiredCapabilities: continuation.requiredCapabilities
-	});
-	const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === continuation.ownerId);
-	if (storedConnection === void 0) return yield* new Error$1({
-		category: "validation",
-		message: "Connected provider authorization returned no organization connection",
-		operation: "Connection.complete",
-		retry: "safe"
-	});
-	return project(storedConnection, aggregate.authorization);
-});
-function mergeEvidence(current, incoming) {
-	const byCapability = new Map(current.map((item) => [item.capability, item]));
-	for (const item of incoming) byCapability.set(item.capability, item);
-	return [...byCapability.values()];
-}
+var version = "0.7.0";
 //#endregion
 //#region src/auth/diagnostic.ts
 var diagnostic_exports = /* @__PURE__ */ __exportAll({
@@ -227,8 +47,8 @@ function from(error) {
 //#region src/auth/manifest.ts
 var manifest_exports = /* @__PURE__ */ __exportAll({
 	Method: () => Method,
-	Schema: () => Schema$2,
-	decode: () => decode$6
+	Schema: () => Schema$1,
+	decode: () => decode$4
 });
 const Method = Schema.TaggedUnion({
 	integration: {
@@ -256,37 +76,11 @@ const Method = Schema.TaggedUnion({
 		instructionsUrl: Schema.String
 	}
 });
-const Schema$2 = Schema.Struct({
+const Schema$1 = Schema.Struct({
 	methods: Schema.Array(Method),
 	providerId: Schema.String
 });
-const decode$6 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-//#endregion
-//#region src/auth/provider-context.ts
-var provider_context_exports = /* @__PURE__ */ __exportAll({
-	Envelope: () => Envelope,
-	codec: () => codec,
-	decode: () => decode$5,
-	encode: () => encode$3
-});
-/** A provider-owned, versioned, non-secret context value persisted by the host. */
-const Envelope = Schema.Struct({
-	value: Schema.Json,
-	version: Schema.String
-});
-/** Build an adapter-owned context codec from a schema and stable version identifier. */
-function codec(version, schema) {
-	return {
-		decode: Effect.fn("ProviderContext.decode")((envelope) => envelope.version !== version ? Effect.fail(new Error$2({ message: `Unsupported provider context version: ${envelope.version}` })) : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })))),
-		encode: Effect.fn("ProviderContext.encode")((value) => Schema.encodeEffect(schema)(value).pipe(Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)), Effect.map((encoded) => ({
-			value: encoded,
-			version
-		})), Effect.mapError((cause) => new Error$2({ message: cause.message })))),
-		version
-	};
-}
-const decode$5 = Effect.fn("ProviderContext.Envelope.decode")((input) => Schema.decodeUnknownEffect(Envelope)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-const encode$3 = Schema.encodeSync(Envelope);
+const decode$4 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message }))));
 //#endregion
 //#region src/auth/secret.ts
 var secret_exports = /* @__PURE__ */ __exportAll({
@@ -317,26 +111,26 @@ const make$6 = Value.from;
 //#endregion
 //#region src/discovery/selection.ts
 var selection_exports = /* @__PURE__ */ __exportAll({
-	Evidence: () => Evidence$1,
+	Evidence: () => Evidence,
 	Selection: () => Selection,
 	select: () => select
 });
-const Evidence$1 = Schema.Struct({
+const Evidence = Schema.Struct({
 	accountId: Schema.String,
 	connectionId: Schema.String,
 	decisiveNameserverMatch: Schema.Boolean,
-	matchedNameservers: Schema.Array(Schema$3),
+	matchedNameservers: Schema.Array(Schema$2),
 	providerId: Schema.String,
-	zone: Schema$3
+	zone: Schema$2
 });
 const Selection = Schema.TaggedUnion({
 	selected: {
-		candidate: Evidence$1,
-		evidence: Schema.Array(Evidence$1),
+		candidate: Evidence,
+		evidence: Schema.Array(Evidence),
 		reason: Schema.Literals(["explicit", "unique-nameserver-match"])
 	},
 	manual: {
-		evidence: Schema.Array(Evidence$1),
+		evidence: Schema.Array(Evidence),
 		reason: Schema.Literals(["ambiguous", "unsupported"])
 	}
 });
@@ -456,10 +250,11 @@ const authorize = Effect.fn("ConnectionAuthorization.authorize")(function* (inpu
 			capability: "dns:write",
 			authorization: aggregate.authorization,
 			connection: storedConnection,
+			credential: aggregate.credential,
 			domain: input.domain,
 			providerId: input.plan.providerId
 		}),
-		catch: (cause) => cause instanceof AuthorizationError || cause instanceof Error$2 ? cause : authorizationError("Domain attachment is invalid", "ConnectionAuthorization.authorize")
+		catch: (cause) => cause instanceof AuthorizationError || cause instanceof Error$1 ? cause : authorizationError("Domain attachment is invalid", "ConnectionAuthorization.authorize")
 	});
 	const authorization = yield* authorize$1(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
 	const selected = new Set(authorization.operationIds);
@@ -496,14 +291,14 @@ const complete = Effect.fn("AuthorizationCode.complete")(function* (input) {
 	if (input.callbackUrl.searchParams.get("state") !== payload.state) return yield* failure$6("Authorization callback state does not match its continuation");
 	const server = input.method.authorizationServer;
 	const client = { client_id: input.client.clientId };
-	const authentication = yield* clientAuthentication(input.method, input.client);
+	const authentication = yield* clientAuthentication$1(input.method, input.client);
 	return yield* Effect.tryPromise({
 		try: async (signal) => {
 			const callback = oauth.validateAuthResponse(server, client, input.callbackUrl, payload.state);
 			const response = await oauth.authorizationCodeGrantRequest(server, client, authentication, callback, payload.redirectUri, payload.codeVerifier, requestOptions(input.fetch, signal));
 			return oauth.processAuthorizationCodeResponse(server, client, response);
 		},
-		catch: (cause) => new Error$1({
+		catch: (cause) => new Error$2({
 			category: "provider",
 			message: cause instanceof globalThis.Error ? cause.name : "OAuth provider request failed",
 			operation: "AuthorizationCode.complete",
@@ -517,14 +312,14 @@ const PayloadSchema = Schema.Struct({
 	state: Schema.String
 });
 function decodePayload(payload) {
-	return Schema.decodeUnknownEffect(Schema.fromJsonString(PayloadSchema))(payload.expose()).pipe(Effect.mapError(() => new Error$1({
+	return Schema.decodeUnknownEffect(Schema.fromJsonString(PayloadSchema))(payload.expose()).pipe(Effect.mapError(() => new Error$2({
 		category: "authorization",
 		message: "OAuth continuation payload is invalid",
 		operation: "AuthorizationCode",
 		retry: "after-user-action"
 	})));
 }
-function clientAuthentication(method, client) {
+function clientAuthentication$1(method, client) {
 	switch (method.clientAuth) {
 		case "none": return Effect.succeed(oauth.None());
 		case "client_secret_basic": return client.clientSecret === void 0 ? failure$6("OAuth client secret is required") : Effect.succeed(oauth.ClientSecretBasic(client.clientSecret.expose()));
@@ -540,14 +335,14 @@ function requestOptions(fetchImplementation, signal) {
 		})
 	};
 }
-const failure$6 = (message) => Effect.fail(new Error$1({
+const failure$6 = (message) => Effect.fail(new Error$2({
 	category: "authorization",
 	message,
 	operation: "AuthorizationCode",
 	retry: "after-user-action"
 }));
 function randomBytes(crypto, size) {
-	return crypto.randomBytes(size).pipe(Effect.mapError((cause) => new Error$1({
+	return crypto.randomBytes(size).pipe(Effect.mapError((cause) => new Error$2({
 		category: "validation",
 		message: cause.message,
 		operation: "AuthorizationCode.start",
@@ -555,7 +350,7 @@ function randomBytes(crypto, size) {
 	})));
 }
 function digest(crypto, value) {
-	return crypto.digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new Error$1({
+	return crypto.digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new Error$2({
 		category: "validation",
 		message: cause.message,
 		operation: "AuthorizationCode.start",
@@ -568,44 +363,6 @@ function base64Url(bytes) {
 	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }
 //#endregion
-//#region src/auth/authorization.ts
-const Capability = Schema.Literals(["dns:read", "dns:write"]);
-const Evidence = Data.taggedEnum();
-const EvidenceSchema = Schema.TaggedUnion({
-	Declared: {},
-	Exercised: { observedAt: Schema.DateFromString },
-	Introspected: { observedAt: Schema.DateFromString }
-});
-const CapabilityEvidence = Schema.Struct({
-	capability: Capability,
-	evidence: EvidenceSchema
-});
-const Revocation = Schema.TaggedUnion({
-	Active: {},
-	Pending: { requestedAt: Schema.DateFromString }
-});
-/** A provider credential authorization shared by one or more organization connections. */
-const Schema$1 = Schema.Struct({
-	authorizedById: Schema.String,
-	capabilityEvidence: Schema.Array(CapabilityEvidence),
-	createdAt: Schema.DateFromString,
-	expiresAt: Schema.NullOr(Schema.DateFromString),
-	id: Schema.String,
-	method: Schema.Literals([
-		"integration",
-		"oauth2",
-		"token"
-	]),
-	providerContext: Envelope,
-	providerId: Schema.String,
-	requiredCapabilities: Schema.Array(Capability),
-	revocation: Revocation,
-	scopes: Schema.Array(Schema.String)
-});
-Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$1))(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
-Schema.encodeSync(Schema$1);
-//#endregion
 //#region src/providers/cloudflare/protocol.ts
 const ErrorDetail$1 = Schema.Struct({
 	code: Schema.Number,
@@ -702,7 +459,7 @@ const Data$1 = Schema.Struct({
 	weight: Schema.optionalKey(Schema.Number)
 });
 const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(function* () {
-	const name = yield* decode$7(record.name).pipe(Effect.match({
+	const name = yield* decode$5(record.name).pipe(Effect.match({
 		onFailure: () => null,
 		onSuccess: (value) => value
 	}));
@@ -720,23 +477,23 @@ const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(fu
 	const content = () => record.content === void 0 ? Effect.fail(failure$5("decodeRecord", `Cloudflare ${record.type} record has no content`)) : Effect.succeed(record.content);
 	switch (record.type) {
 		case "A":
-		case "AAAA": return yield* decode$8({
+		case "AAAA": return yield* decode$6({
 			...common,
 			_tag: record.type,
 			address: yield* content()
 		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
 		case "CNAME":
-		case "NS": return yield* decode$8({
+		case "NS": return yield* decode$6({
 			...common,
 			_tag: record.type,
 			target: yield* content()
 		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		case "TXT": return yield* decode$8({
+		case "TXT": return yield* decode$6({
 			...common,
 			_tag: "TXT",
 			value: yield* content()
 		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
-		case "MX": return yield* decode$8({
+		case "MX": return yield* decode$6({
 			...common,
 			_tag: "MX",
 			exchange: yield* content(),
@@ -744,7 +501,7 @@ const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(fu
 		}).pipe(Effect.mapError((cause) => failure$5("decodeRecord", cause.message)));
 		case "CAA": {
 			const data = yield* decodeData(record);
-			return yield* decode$8({
+			return yield* decode$6({
 				...common,
 				_tag: "CAA",
 				...data
@@ -752,7 +509,7 @@ const decode$3 = Effect.fn("CloudflareRecords.decode")((record) => Effect.gen(fu
 		}
 		case "SRV": {
 			const data = yield* decodeData(record);
-			return yield* decode$8({
+			return yield* decode$6({
 				...common,
 				_tag: "SRV",
 				...data
@@ -1069,8 +826,8 @@ function makeClient$1(options) {
 	};
 }
 const targetFromZone = Effect.fn("CloudflareClient.targetFromZone")((zone) => Effect.gen(function* () {
-	const name = yield* decode$7(zone.name).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" }))));
+	const name = yield* decode$5(zone.name).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$4("listTargets", cause.message, { reason: "response" }))));
 	return {
 		accountId: zone.account.id,
 		accountKind: "account",
@@ -1085,8 +842,8 @@ const targetFromZone = Effect.fn("CloudflareClient.targetFromZone")((zone) => Ef
 	};
 }));
 const projectZone$1 = Effect.fn("CloudflareClient.projectZone")((zone) => Effect.gen(function* () {
-	const name = yield* decode$7(zone.name).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" }))));
+	const name = yield* decode$5(zone.name).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(zone.name_servers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$4("listZones", cause.message, { reason: "response" }))));
 	return {
 		accountId: zone.account.id,
 		id: zone.id,
@@ -1149,6 +906,7 @@ var auth_exports$1 = /* @__PURE__ */ __exportAll({
 	oauthAuthentication: () => oauthAuthentication,
 	oauthFlow: () => oauthFlow,
 	oauthMethod: () => oauthMethod,
+	refreshCredential: () => refreshCredential,
 	restore: () => restore$1,
 	subjectResolver: () => subjectResolver,
 	tokenConnectionMethod: () => tokenConnectionMethod$1,
@@ -1161,10 +919,11 @@ const authorizationServer = {
 	revocation_endpoint: "https://dash.cloudflare.com/oauth2/revoke",
 	token_endpoint: "https://dash.cloudflare.com/oauth2/token"
 };
-const contextCodec$1 = codec("cloudflare.v1", Schema.Struct({
+const Context$2 = Schema.Struct({
 	accountId: Schema.optionalKey(Schema.String),
 	tokenKind: Schema.Literals(["account", "user"])
-}));
+});
+const contextCodec$1 = codec("cloudflare.v1", Context$2);
 /** Describes Cloudflare's caller-created API-token authorization method. */
 function tokenMethod$1(capabilities) {
 	return {
@@ -1242,14 +1001,14 @@ function tokenConnectionMethod$1(options) {
 			return {
 				capabilityEvidence: validated.capabilities.map((capability) => ({
 					capability,
-					evidence: Evidence.Introspected({ observedAt })
+					evidence: Evidence$1.Introspected({ observedAt })
 				})),
 				credential: {
 					accessToken: token,
+					expiresAt: validated.expiresAt,
 					refreshToken: null,
 					tokenType: "bearer"
 				},
-				expiresAt: validated.expiresAt,
 				providerAccountId: validated.accountId,
 				providerContext: yield* contextCodec$1.encode(options.tokenKind === "account" ? {
 					accountId: validated.accountId,
@@ -1270,14 +1029,14 @@ const oauthAuthentication = Effect.fn("CloudflareAuth.oauthAuthentication")(func
 	return {
 		capabilityEvidence: options.capabilities.map((capability) => ({
 			capability,
-			evidence: Evidence.Introspected({ observedAt })
+			evidence: Evidence$1.Introspected({ observedAt })
 		})),
 		credential: {
 			accessToken: options.accessToken,
+			expiresAt: resolved.expiresAt,
 			refreshToken: options.tokens.refresh_token === void 0 ? null : Value.from(options.tokens.refresh_token),
 			tokenType: options.tokens.token_type
 		},
-		expiresAt: resolved.expiresAt,
 		providerAccountId: resolved.accountId,
 		providerContext: yield* contextCodec$1.encode({ tokenKind: "user" }),
 		scopes: (options.tokens.scope ?? "").split(" ").filter(Boolean)
@@ -1291,7 +1050,7 @@ function restore$1(options) {
 		if (options.authorization.revocation._tag !== "Active") return yield* Effect.fail(failure$3("restore", "Cloudflare authorization is pending revocation", "authorization"));
 		const missingCapability = options.authorization.requiredCapabilities.find((capability) => !options.authorization.capabilityEvidence.some((item) => item.capability === capability));
 		if (missingCapability !== void 0) return yield* Effect.fail(failure$3("restore", `Cloudflare authorization lacks evidence for ${missingCapability}`, "authorization"));
-		if (options.authorization.expiresAt !== null && (Number.isNaN(options.authorization.expiresAt.valueOf()) || options.authorization.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure$3("restore", "Cloudflare authorization has expired", "authentication"));
+		if (options.credential.expiresAt !== null && (Number.isNaN(options.credential.expiresAt.valueOf()) || options.credential.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure$3("restore", "Cloudflare authorization has expired", "authentication"));
 		const context = yield* contextCodec$1.decode(options.authorization.providerContext).pipe(Effect.mapError((cause) => failure$3("restore", cause.message, "response")));
 		return make$5({
 			...context.accountId === void 0 ? {} : { accountId: context.accountId },
@@ -1303,6 +1062,47 @@ function restore$1(options) {
 		});
 	});
 }
+/** Exchanges a Cloudflare refresh token for a fresh provider credential. */
+const refreshCredential = Effect.fn("CloudflareAuth.refreshCredential")(function* (options) {
+	if (options.credential.refreshToken === null) return yield* new Error$2({
+		category: "authorization",
+		message: "Cloudflare credential has no refresh token",
+		operation: "CloudflareAuth.refreshCredential",
+		retry: "after-user-action"
+	});
+	const refreshToken = options.credential.refreshToken;
+	const client = { client_id: options.client.clientId };
+	const authentication = yield* Effect.try({
+		try: () => clientAuthentication(options.clientAuth, options.client),
+		catch: () => new Error$2({
+			category: "authorization",
+			message: "Cloudflare OAuth client authentication is invalid",
+			operation: "CloudflareAuth.refreshCredential",
+			retry: "never"
+		})
+	});
+	const fetch = options.fetch;
+	const tokens = yield* Effect.tryPromise({
+		try: async (signal) => {
+			const request = await oauth.refreshTokenGrantRequest(authorizationServer, client, authentication, refreshToken.expose(), fetch === void 0 ? { signal } : {
+				signal,
+				[oauth.customFetch]: (url, init) => fetch(url, {
+					...init,
+					body: init.body
+				})
+			});
+			return oauth.processRefreshTokenResponse(authorizationServer, client, request);
+		},
+		catch: (cause) => refreshFailure(cause)
+	});
+	const now = yield* Clock.currentTimeMillis;
+	return {
+		accessToken: Value.from(tokens.access_token),
+		expiresAt: typeof tokens.expires_in === "number" ? new Date(now + tokens.expires_in * 1e3) : null,
+		refreshToken: tokens.refresh_token === void 0 ? refreshToken : Value.from(tokens.refresh_token),
+		tokenType: tokens.token_type
+	};
+});
 /** Creates Cloudflare's OAuth implementation of the common interactive connection capability. */
 function oauthFlow(options) {
 	const method = oauthMethod({
@@ -1348,6 +1148,20 @@ function failure$3(operation, message, reason) {
 		reason
 	});
 }
+function clientAuthentication(method, client) {
+	if (method === "none") return oauth.None();
+	if (client.clientSecret === void 0) throw new Error("Client secret is required");
+	return method === "client_secret_basic" ? oauth.ClientSecretBasic(client.clientSecret.expose()) : oauth.ClientSecretPost(client.clientSecret.expose());
+}
+function refreshFailure(cause) {
+	if (cause instanceof oauth.ResponseBodyError && ["invalid_client", "invalid_grant"].includes(cause.error)) return new Error$2({
+		category: "authorization",
+		message: "Cloudflare authorization can no longer be refreshed",
+		operation: "CloudflareAuth.refreshCredential",
+		retry: "after-user-action"
+	});
+	return failure$3("refreshCredential", cause instanceof Error ? cause.message : "Cloudflare token refresh failed", cause instanceof oauth.ResponseBodyError ? "response" : "transport");
+}
 //#endregion
 //#region src/providers/vercel/protocol.ts
 const Pagination = Schema.Struct({
@@ -1437,7 +1251,7 @@ const IntegrationToken = Schema.Struct({
 //#region src/providers/vercel/records.ts
 const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(function* () {
 	const absolute = absoluteNameCandidate(zone, record.name);
-	const name = yield* decode$7(absolute).pipe(Effect.match({
+	const name = yield* decode$5(absolute).pipe(Effect.match({
 		onFailure: () => null,
 		onSuccess: (value) => value
 	}));
@@ -1452,7 +1266,7 @@ const decode$1 = Effect.fn("VercelRecords.decode")((zone, record) => Effect.gen(
 		policy: record.type === "CNAME" ? "exclusive" : "append",
 		ttl: record.ttl ?? 60
 	};
-	const fromRecord = (input) => decode$8(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
+	const fromRecord = (input) => decode$6(input).pipe(Effect.mapError((cause) => failure$2("decodeRecord", cause.message)));
 	switch (record.type) {
 		case "A":
 		case "AAAA": return yield* fromRecord({
@@ -1581,9 +1395,18 @@ function failure$2(operation, message, fields = {}) {
 //#endregion
 //#region src/providers/vercel/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
+	AccountContext: () => AccountContext,
 	discovery: () => discovery,
 	make: () => make$4
 });
+/** Constructs the account scope used by Vercel API requests. */
+const AccountContext = {
+	personal: () => ({ _tag: "personal" }),
+	team: ({ teamId }) => ({
+		_tag: "team",
+		teamId
+	})
+};
 /** Exposes Vercel zone lookup as the optional provider discovery capability. */
 function discovery(client) {
 	return {
@@ -1673,7 +1496,7 @@ function makeClient(options) {
 		}
 		const domain = yield* discoverZone(name);
 		if (domain === null) return yield* Effect.fail(failure$1("resolveZone", `Vercel zone ${name} is not configured for authoritative DNS in the selected account`, { reason: "not_found" }));
-		return yield* decode$7(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
+		return yield* decode$5(domain.name).pipe(Effect.mapError((cause) => failure$1("resolveZone", `Vercel returned an invalid storage zone: ${cause.message}`)));
 	}));
 	const listRecords = Effect.fn("VercelClient.listRecords")((zoneName) => Effect.gen(function* () {
 		const storageZone = yield* resolveZone(zoneName);
@@ -1819,8 +1642,8 @@ function hasDnsStorage(domain, configuredServiceType = domain.serviceType) {
 	return configuredServiceType === "zeit.world" || domain.zone === true || domain.intendedNameservers.length > 0;
 }
 const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen(function* () {
-	const name = yield* decode$7(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
+	const name = yield* decode$5(domain.name).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(domain.intendedNameservers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$1("listZones", cause.message, { reason: "response" }))));
 	return {
 		accountId: domain.teamId ?? domain.userId,
 		id: domain.id,
@@ -1830,8 +1653,8 @@ const projectZone = Effect.fn("VercelClient.projectZone")((domain) => Effect.gen
 	};
 }));
 const targetFromDomain = Effect.fn("VercelClient.targetFromDomain")((domain) => Effect.gen(function* () {
-	const zoneName = yield* decode$7(domain.name).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" })));
-	const nameservers = yield* Effect.forEach(domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers, (nameserver) => decode$7(nameserver).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" }))));
+	const zoneName = yield* decode$5(domain.name).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" })));
+	const nameservers = yield* Effect.forEach(domain.nameservers.length > 0 ? domain.nameservers : domain.intendedNameservers, (nameserver) => decode$5(nameserver).pipe(Effect.mapError((cause) => failure$1("listTargets", cause.message, { reason: "response" }))));
 	return {
 		accountId: domain.teamId ?? domain.userId,
 		accountKind: domain.teamId === null ? "personal" : "team",
@@ -1895,13 +1718,14 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	tokenConnectionMethod: () => tokenConnectionMethod,
 	tokenMethod: () => tokenMethod
 });
-const contextCodec = codec("vercel.v1", Schema.TaggedUnion({
+const Context$1 = Schema.TaggedUnion({
 	personal: { installationId: Schema.NullOr(Schema.String) },
 	team: {
 		installationId: Schema.NullOr(Schema.String),
 		teamId: Schema.String
 	}
-}));
+});
+const contextCodec = codec("vercel.v1", Context$1);
 /** Describes Vercel's caller-created personal access-token method. */
 function tokenMethod(capabilities) {
 	return {
@@ -1958,10 +1782,7 @@ const exchangeCode = Effect.fn("VercelAuth.exchangeCode")((options) => Effect.ge
 	const token = yield* Schema.decodeUnknownEffect(IntegrationToken)(input).pipe(Effect.mapError((cause) => failure("exchangeCode", `Vercel token response did not match its API contract: ${cause.message}`, "response", response.status)));
 	return {
 		accessToken: make$6(token.access_token),
-		context: token.team_id === null ? { _tag: "personal" } : {
-			_tag: "team",
-			teamId: token.team_id
-		},
+		context: token.team_id === null ? AccountContext.personal() : AccountContext.team({ teamId: token.team_id }),
 		installationId: token.installation_id ?? options.configurationId ?? null,
 		userId: token.user_id
 	};
@@ -1979,14 +1800,14 @@ function tokenConnectionMethod(options) {
 			return {
 				capabilityEvidence: validated.capabilities.map((capability) => ({
 					capability,
-					evidence: Evidence.Introspected({ observedAt })
+					evidence: Evidence$1.Introspected({ observedAt })
 				})),
 				credential: {
 					accessToken: token,
+					expiresAt: validated.expiresAt,
 					refreshToken: null,
 					tokenType: "bearer"
 				},
-				expiresAt: validated.expiresAt,
 				providerAccountId: validated.accountId,
 				providerContext: yield* contextCodec.encode(options.context._tag === "team" ? {
 					_tag: "team",
@@ -2011,14 +1832,14 @@ const integrationAuthentication = Effect.fn("VercelAuth.integrationAuthenticatio
 	return {
 		capabilityEvidence: options.capabilities.map((capability) => ({
 			capability,
-			evidence: Evidence.Introspected({ observedAt })
+			evidence: Evidence$1.Introspected({ observedAt })
 		})),
 		credential: {
 			accessToken: exchanged.accessToken,
+			expiresAt: null,
 			refreshToken: null,
 			tokenType: "bearer"
 		},
-		expiresAt: null,
 		providerAccountId: exchanged.context._tag === "team" ? exchanged.context.teamId : exchanged.userId,
 		providerContext: yield* contextCodec.encode(exchanged.context._tag === "team" ? {
 			_tag: "team",
@@ -2038,16 +1859,13 @@ function restore(options) {
 		if (options.authorization.revocation._tag !== "Active") return yield* Effect.fail(failure("restore", "Vercel authorization is pending revocation", "authorization"));
 		const missingCapability = options.authorization.requiredCapabilities.find((capability) => !options.authorization.capabilityEvidence.some((item) => item.capability === capability));
 		if (missingCapability !== void 0) return yield* Effect.fail(failure("restore", `Vercel authorization lacks evidence for ${missingCapability}`, "authorization"));
-		if (options.authorization.expiresAt !== null && (Number.isNaN(options.authorization.expiresAt.valueOf()) || options.authorization.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure("restore", "Vercel authorization has expired", "authentication"));
+		if (options.credential.expiresAt !== null && (Number.isNaN(options.credential.expiresAt.valueOf()) || options.credential.expiresAt <= /* @__PURE__ */ new Date())) return yield* Effect.fail(failure("restore", "Vercel authorization has expired", "authentication"));
 		const context = yield* contextCodec.decode(options.authorization.providerContext).pipe(Effect.mapError((cause) => failure("restore", cause.message, "response")));
 		return make$4({
 			...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
 			capabilities: options.authorization.capabilityEvidence.map(({ capability }) => capability),
 			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			context: context._tag === "team" ? {
-				_tag: "team",
-				teamId: context.teamId
-			} : { _tag: "personal" },
+			context: context._tag === "team" ? AccountContext.team({ teamId: context.teamId }) : AccountContext.personal(),
 			token: options.credential.accessToken
 		});
 	});
@@ -2058,7 +1876,7 @@ function integrationFlow(options) {
 	const Payload = Schema.fromJsonString(Schema.Struct({ state: Schema.String }));
 	return {
 		complete: Effect.fn("VercelAuth.integrationFlow.complete")(function* (payload, callbackUrl) {
-			const continuation = yield* Schema.decodeUnknownEffect(Payload)(payload.expose()).pipe(Effect.mapError(() => new Error$1({
+			const continuation = yield* Schema.decodeUnknownEffect(Payload)(payload.expose()).pipe(Effect.mapError(() => new Error$2({
 				category: "authorization",
 				message: "Vercel Integration continuation payload is invalid",
 				operation: "VercelAuth.integrationFlow.complete",
@@ -2066,7 +1884,7 @@ function integrationFlow(options) {
 			})));
 			const code = callbackUrl.searchParams.get("code");
 			const configurationId = callbackUrl.searchParams.get("configurationId");
-			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null || configurationId === null) return yield* new Error$1({
+			if (callbackUrl.searchParams.get("state") !== continuation.state || code === null || configurationId === null) return yield* new Error$2({
 				category: "authorization",
 				message: "Vercel Integration callback does not match its continuation",
 				operation: "VercelAuth.integrationFlow.complete",
@@ -2084,13 +1902,13 @@ function integrationFlow(options) {
 			});
 			const callbackTeamId = callbackUrl.searchParams.get("teamId");
 			if (callbackTeamId !== null) {
-				const context = yield* contextCodec.decode(authentication.providerContext).pipe(Effect.mapError((cause) => new Error$1({
+				const context = yield* contextCodec.decode(authentication.providerContext).pipe(Effect.mapError((cause) => new Error$2({
 					category: "provider",
 					message: cause.message,
 					operation: "VercelAuth.integrationFlow.complete",
 					retry: "unknown"
 				})));
-				if (context._tag !== "team" || context.teamId !== callbackTeamId) return yield* new Error$1({
+				if (context._tag !== "team" || context.teamId !== callbackTeamId) return yield* new Error$2({
 					category: "authorization",
 					message: "Vercel Integration callback team does not match the exchanged installation",
 					operation: "VercelAuth.integrationFlow.complete",
@@ -2167,7 +1985,7 @@ function parse(type, input) {
 	try {
 		return Schema.decodeUnknownSync(schema)(input);
 	} catch (cause) {
-		throw new Error$2({ message: cause instanceof Error ? cause.message : String(cause) });
+		throw new Error$1({ message: cause instanceof Error ? cause.message : String(cause) });
 	}
 }
 function tokenizedDomain(length, domainIndex) {
@@ -2224,18 +2042,15 @@ function decodeResolution(query, message) {
 	}).pipe(Effect.flatMap((packet) => validatePacket(query, packet)), Effect.flatMap(decodePacket));
 }
 function decodePacket(packet) {
-	if (packet.rcode === "NXDOMAIN") return Effect.succeed({ _tag: "nodata" });
+	if (packet.rcode === "NXDOMAIN") return Effect.succeed(Resolution$1.nodata());
 	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$4({
 		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
 		reason: "response"
 	}));
-	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed({ _tag: "nodata" });
+	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed(Resolution$1.nodata());
 	return Effect.forEach(packet.answers, decodeAnswer, { concurrency: "unbounded" }).pipe(Effect.map((answers) => {
 		const supportedAnswers = answers.filter((answer) => answer !== null);
-		return supportedAnswers.length === 0 ? { _tag: "nodata" } : {
-			_tag: "answer",
-			answers: supportedAnswers
-		};
+		return supportedAnswers.length === 0 ? Resolution$1.nodata() : Resolution$1.answer({ answers: supportedAnswers });
 	}));
 }
 function validatePacket(query, packet) {
@@ -2270,7 +2085,7 @@ function decodeAnswer(answer) {
 			})
 		});
 		if (decoded === void 0) return null;
-		const name = yield* decode$7(answer.name);
+		const name = yield* decode$5(answer.name);
 		const data = yield* Effect.try({
 			try: () => parse(decoded.type, decoded.data),
 			catch: (cause) => new Error$4({
@@ -2527,13 +2342,13 @@ function observeProvider(provider, zone, requirement) {
 }
 function observePublicDns(requirement, policy) {
 	return Effect.gen(function* () {
-		const validatedPolicy = yield* Schema.decodeUnknownEffect(Policy.Schema)(policy).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message })));
+		const validatedPolicy = yield* Schema.decodeUnknownEffect(Policy.Schema)(policy).pipe(Effect.mapError((cause) => new Error$1({ message: cause.message })));
 		const configuredPool = yield* Effect.serviceOption(Service);
 		const evidence = yield* Option.getOrElse(configuredPool, () => defaultMake()).observe({
 			name: requirement.name,
 			type: requirement._tag
 		});
-		if (validatedPolicy._tag === "Quorum" && validatedPolicy.minimum > evidence.length) return yield* new Error$2({ message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers` });
+		if (validatedPolicy._tag === "Quorum" && validatedPolicy.minimum > evidence.length) return yield* new Error$1({ message: `Quorum minimum ${validatedPolicy.minimum} exceeds the ${evidence.length} configured resolvers` });
 		return evaluatePublicDns(requirement, validatedPolicy, evidence);
 	});
 }
@@ -2576,6 +2391,6 @@ function recordValue(requirement) {
 	}
 }
 //#endregion
-export { manifest_exports as $, discovery as A, tokenValidator as B, integrationFlow as C, tokenConnectionMethod as D, restore as E, oauthMethod as F, connection_authorization_exports as G, discovery$1 as H, restore$1 as I, secret_exports as J, session_exports as K, subjectResolver as L, auth_exports$1 as M, manifest$1 as N, tokenMethod as O, oauthFlow as P, decode$6 as Q, tokenConnectionMethod$1 as R, exchangeCode as S, manifest as T, make$5 as U, client_exports$1 as V, authorize as W, Method as X, provider_context_exports as Y, Schema$2 as Z, toAsync$1 as _, Result as a, start$1 as at, dns_data_exports as b, Observation as c, defaultMake as d, diagnostic_exports as et, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, complete$1 as it, make$4 as j, client_exports as k, Policy as l, google_doh_exports as m, ProviderObservation as n, Method$1 as nt, observe as o, version as ot, resolver_pool_exports as p, selection_exports as q, PublicDns as r, StartResult as rt, verify_exports as s, Provider as t, Error$1 as tt, Service as u, doh_exports as v, integrationMethod as w, auth_exports as x, toAsync$2 as y, tokenMethod$1 as z };
+export { decode$4 as $, client_exports as A, tokenConnectionMethod$1 as B, integrationFlow as C, tokenConnectionMethod as D, restore as E, oauthFlow as F, make$5 as G, tokenValidator as H, oauthMethod as I, session_exports as J, authorize as K, refreshCredential as L, make$4 as M, auth_exports$1 as N, tokenMethod as O, manifest$1 as P, Schema$1 as Q, restore$1 as R, exchangeCode as S, manifest as T, client_exports$1 as U, tokenMethod$1 as V, discovery$1 as W, secret_exports as X, selection_exports as Y, Method as Z, toAsync$1 as _, Result as a, dns_data_exports as b, Observation as c, defaultMake as d, manifest_exports as et, make as f, cloudflare_doh_exports as g, toAsync as h, PublicDnsObservation as i, discovery as j, AccountContext as k, Policy as l, google_doh_exports as m, ProviderObservation as n, version as nt, observe as o, resolver_pool_exports as p, connection_authorization_exports as q, PublicDns as r, verify_exports as s, Provider as t, diagnostic_exports as tt, Service as u, doh_exports as v, integrationMethod as w, auth_exports as x, toAsync$2 as y, subjectResolver as z };
 
-//# sourceMappingURL=verify-B2fPyjde.mjs.map
+//# sourceMappingURL=verify-DDnK8U7C.mjs.map