domainkit 0.5.0 → 0.7.0

package/dist/{resolver-BGBLnPjJ.d.mts → resolver-DRrLm_hB.d.mts}

@@ -1,1108 +1,5 @@
+import { Nt as Error$3, ct as Service$2, ht as Encoded, kt as DomainName, mt as DnsRecord, ot as Error$2, st as Interface$2, v as CryptoError, wt as Type } from "./connect-10vHuShV.mjs";
 import { Cause, Context, Crypto, Data, Effect, Layer, Schema } from "effect";
-import * as oauth from "oauth4webapi";
-declare namespace invalid_input_d_exports {
-  export { Error$5 as Error };
-}
-declare const Error_base$5: Schema.Class<Error$5, Schema.TaggedStruct<"InvalidInputError", {
-  readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$5 extends Error_base$5 {}
-declare namespace domain_name_d_exports {
-  export { DomainName, Schema$5 as Schema, decode$5 as decode, parse$1 as parse };
-}
-declare const Type$1: Schema.brand<Schema.String, "DomainName">;
-/** A lower-case, fully qualified DNS name without a trailing dot. */
-type DomainName = typeof Type$1.Type;
-/** Decodes user and wire strings into canonical domain names. */
-declare const Schema$5: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-declare const decode$5: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$5, never>;
-declare function parse$1(input: unknown): DomainName;
-declare namespace dns_record_d_exports {
-  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$4 as Schema, Srv, Txt, Type, data, decode$4 as decode, equals, parse };
-}
-declare const Type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
-type Type = typeof Type.Type;
-declare const RequirementMetadata: Schema.Struct<{
-  readonly ownership: Schema.String;
-  readonly provenance: Schema.String;
-  readonly purpose: Schema.String;
-}>;
-interface RequirementMetadata extends Schema.Schema.Type<typeof RequirementMetadata> {}
-declare const Schema$4: Schema.TaggedUnion<{
-  readonly A: Schema.TaggedStruct<"A", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly AAAA: Schema.TaggedStruct<"AAAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly CAA: Schema.TaggedStruct<"CAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly flags: Schema.Int;
-    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
-    readonly value: Schema.String;
-  }>;
-  readonly CNAME: Schema.TaggedStruct<"CNAME", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly policy: Schema.Literal<"exclusive">;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly MX: Schema.TaggedStruct<"MX", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly priority: Schema.Int;
-  }>;
-  readonly NS: Schema.TaggedStruct<"NS", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly SRV: Schema.TaggedStruct<"SRV", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly port: Schema.Int;
-    readonly priority: Schema.Int;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly weight: Schema.Int;
-  }>;
-  readonly TXT: Schema.TaggedStruct<"TXT", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly value: Schema.String;
-  }>;
-}>;
-declare const A: Schema.TaggedStruct<"A", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly address: Schema.String;
-}>, Aaaa: Schema.TaggedStruct<"AAAA", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly address: Schema.String;
-}>, Caa: Schema.TaggedStruct<"CAA", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly flags: Schema.Int;
-  readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
-  readonly value: Schema.String;
-}>, Cname: Schema.TaggedStruct<"CNAME", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly policy: Schema.Literal<"exclusive">;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-}>, Mx: Schema.TaggedStruct<"MX", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly priority: Schema.Int;
-}>, Ns: Schema.TaggedStruct<"NS", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-}>, Srv: Schema.TaggedStruct<"SRV", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly port: Schema.Int;
-  readonly priority: Schema.Int;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly weight: Schema.Int;
-}>, Txt: Schema.TaggedStruct<"TXT", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
-  }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly value: Schema.String;
-}>;
-type DnsRecord = typeof Schema$4.Type;
-type Encoded = typeof Schema$4.Encoded;
-/** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
-declare const Opaque: Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
-  readonly name: Schema.String;
-  readonly providerRecordId: Schema.NullOr<Schema.String>;
-  readonly providerType: Schema.String;
-}>;
-interface Opaque extends Schema.Schema.Type<typeof Opaque> {}
-/** Any DNS record observed through a provider, including non-portable record types. */
-declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
-  readonly A: Schema.TaggedStruct<"A", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly AAAA: Schema.TaggedStruct<"AAAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly address: Schema.String;
-  }>;
-  readonly CAA: Schema.TaggedStruct<"CAA", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly flags: Schema.Int;
-    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
-    readonly value: Schema.String;
-  }>;
-  readonly CNAME: Schema.TaggedStruct<"CNAME", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly policy: Schema.Literal<"exclusive">;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly MX: Schema.TaggedStruct<"MX", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly priority: Schema.Int;
-  }>;
-  readonly NS: Schema.TaggedStruct<"NS", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-  readonly SRV: Schema.TaggedStruct<"SRV", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly port: Schema.Int;
-    readonly priority: Schema.Int;
-    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly weight: Schema.Int;
-  }>;
-  readonly TXT: Schema.TaggedStruct<"TXT", {
-    readonly metadata: Schema.Struct<{
-      readonly ownership: Schema.String;
-      readonly provenance: Schema.String;
-      readonly purpose: Schema.String;
-    }>;
-    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-    readonly ttl: Schema.NullOr<Schema.Int>;
-    readonly value: Schema.String;
-  }>;
-}>, Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
-  readonly name: Schema.String;
-  readonly providerRecordId: Schema.NullOr<Schema.String>;
-  readonly providerType: Schema.String;
-}>]>;
-type Observed = typeof Observed.Type;
-declare const decode$4: (input: unknown) => Effect.Effect<{
-  readonly _tag: "A";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly address: string;
-} | {
-  readonly _tag: "AAAA";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly address: string;
-} | {
-  readonly _tag: "CAA";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly flags: number;
-  readonly tag: "iodef" | "issue" | "issuewild";
-  readonly value: string;
-} | {
-  readonly _tag: "CNAME";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly ttl: number | null;
-  readonly policy: "exclusive";
-  readonly target: string & import("effect/Brand").Brand<"DomainName">;
-} | {
-  readonly _tag: "MX";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
-  readonly priority: number;
-} | {
-  readonly _tag: "NS";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly target: string & import("effect/Brand").Brand<"DomainName">;
-} | {
-  readonly _tag: "SRV";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly port: number;
-  readonly priority: number;
-  readonly target: string & import("effect/Brand").Brand<"DomainName">;
-  readonly weight: number;
-} | {
-  readonly _tag: "TXT";
-  readonly metadata: {
-    readonly ownership: string;
-    readonly provenance: string;
-    readonly purpose: string;
-  };
-  readonly name: string & import("effect/Brand").Brand<"DomainName">;
-  readonly policy: "append" | "exclusive";
-  readonly ttl: number | null;
-  readonly value: string;
-}, Error$5, never>;
-declare function parse(input: unknown): DnsRecord;
-declare function data(record: DnsRecord): Readonly<Record<string, number | string>>;
-declare function equals(left: DnsRecord, right: DnsRecord): boolean;
-declare namespace provider_d_exports {
-  export { AsyncInterface$1 as AsyncInterface, CreateResult$1 as CreateResult, Error$4 as Error, ErrorReason, Interface$3 as Interface, Service$3 as Service, fromAsync, layerFromAsync$1 as layerFromAsync, toAsync$1 as toAsync };
-}
-interface CreateResult$1 {
-  readonly providerRecordId: string | null;
-}
-declare const ErrorReason: Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>;
-type ErrorReason = typeof ErrorReason.Type;
-declare const Error_base$4: Schema.Class<Error$4, Schema.TaggedStruct<"ProviderError", {
-  readonly cause: Schema.optionalKey<Schema.Unknown>;
-  readonly code: Schema.optionalKey<Schema.Union<readonly [Schema.Number, Schema.String]>>;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly providerId: Schema.String;
-  readonly reason: Schema.optionalKey<Schema.Literals<readonly ["authentication", "authorization", "conflict", "not_found", "rate_limit", "request", "response", "transport", "unsupported"]>>;
-  readonly retryAfterMs: Schema.optionalKey<Schema.Number>;
-  readonly status: Schema.optionalKey<Schema.Number>;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$4 extends Error_base$4 {}
-/** The provider capability used by DNS planning, application, and verification. */
-interface Interface$3 {
-  readonly id: string;
-  readonly createRecord: (zone: DomainName, record: DnsRecord) => Effect.Effect<CreateResult$1, Error$4>;
-  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<void, Error$4>;
-  readonly getRecord: (zone: DomainName, providerRecordId: string) => Effect.Effect<Observed | null, Error$4>;
-  readonly listRecords: (zone: DomainName) => Effect.Effect<ReadonlyArray<Observed>, Error$4>;
-}
-declare const Service_base$3: Context.ServiceClass<Service$3, "@domainkit/DnsProvider", Interface$3>;
-declare class Service$3 extends Service_base$3 {}
-/** Minimal Promise-shaped provider contract for hosts that do not use Effect directly. */
-interface AsyncInterface$1 {
-  readonly id: string;
-  readonly createRecord: (zone: DomainName, record: DnsRecord) => Promise<CreateResult$1>;
-  readonly deleteRecord: (zone: DomainName, providerRecordId: string) => Promise<void>;
-  readonly getRecord: (zone: DomainName, providerRecordId: string) => Promise<Observed | null>;
-  readonly listRecords: (zone: DomainName) => Promise<ReadonlyArray<Observed>>;
-}
-declare const fromAsync: (provider: AsyncInterface$1) => Interface$3;
-declare const layerFromAsync$1: (provider: AsyncInterface$1) => Layer.Layer<Service$3>;
-declare const toAsync$1: (provider: Interface$3) => AsyncInterface$1;
-declare namespace secret_d_exports {
-  export { Value, make$1 as make };
-}
-/** A deliberately non-serializable credential value. */
-declare class Value {
-  #private;
-  private constructor();
-  static from(value: string): Value;
-  expose(): string;
-  toJSON(): string;
-  toString(): string;
-}
-declare const make$1: typeof Value.from;
-declare namespace manifest_d_exports {
-  export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method$1 as Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$3 as Schema, TokenValidation, decode$3 as decode };
-}
-declare const Method$1: Schema.TaggedUnion<{
-  readonly integration: Schema.TaggedStruct<"integration", {
-    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-    readonly installUrl: Schema.String;
-    readonly tokenEndpoint: Schema.String;
-  }>;
-  readonly oauth2: Schema.TaggedStruct<"oauth2", {
-    readonly authorizationServer: Schema.Struct<{
-      readonly authorization_endpoint: Schema.String;
-      readonly issuer: Schema.String;
-      readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
-      readonly token_endpoint: Schema.String;
-    }>;
-    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-    readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
-    readonly scopes: Schema.$Array<Schema.String>;
-  }>;
-  readonly token: Schema.TaggedStruct<"token", {
-    readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-    readonly instructionsUrl: Schema.String;
-  }>;
-}>;
-declare const Schema$3: Schema.Struct<{
-  readonly methods: Schema.$Array<Schema.TaggedUnion<{
-    readonly integration: Schema.TaggedStruct<"integration", {
-      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-      readonly installUrl: Schema.String;
-      readonly tokenEndpoint: Schema.String;
-    }>;
-    readonly oauth2: Schema.TaggedStruct<"oauth2", {
-      readonly authorizationServer: Schema.Struct<{
-        readonly authorization_endpoint: Schema.String;
-        readonly issuer: Schema.String;
-        readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
-        readonly token_endpoint: Schema.String;
-      }>;
-      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-      readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
-      readonly scopes: Schema.$Array<Schema.String>;
-    }>;
-    readonly token: Schema.TaggedStruct<"token", {
-      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-      readonly instructionsUrl: Schema.String;
-    }>;
-  }>>;
-  readonly providerId: Schema.String;
-}>;
-interface Manifest extends Schema.Schema.Type<typeof Schema$3> {}
-type OAuthMethod = Extract<Manifest["methods"][number], {
-  readonly _tag: "oauth2";
-}>;
-/** A provider-owned installation flow that returns a credential from a one-time code. */
-type IntegrationMethod = Extract<Manifest["methods"][number], {
-  readonly _tag: "integration";
-}>;
-declare const decode$3: (input: unknown) => Effect.Effect<{
-  readonly methods: readonly ({
-    readonly _tag: "integration";
-    readonly capabilities: readonly ("dns:read" | "dns:write")[];
-    readonly installUrl: string;
-    readonly tokenEndpoint: string;
-  } | {
-    readonly _tag: "oauth2";
-    readonly authorizationServer: {
-      readonly authorization_endpoint: string;
-      readonly issuer: string;
-      readonly revocation_endpoint?: string;
-      readonly token_endpoint: string;
-    };
-    readonly capabilities: readonly ("dns:read" | "dns:write")[];
-    readonly clientAuth: "client_secret_basic" | "client_secret_post" | "none";
-    readonly scopes: readonly string[];
-  } | {
-    readonly _tag: "token";
-    readonly capabilities: readonly ("dns:read" | "dns:write")[];
-    readonly instructionsUrl: string;
-  })[];
-  readonly providerId: string;
-}, Error$5, never>;
-interface OAuthClientConfiguration {
-  readonly clientId: string;
-  readonly clientSecret?: Value;
-}
-interface TokenValidation {
-  readonly accountId: string;
-  readonly capabilities: ReadonlyArray<"dns:read" | "dns:write">;
-  readonly expiresAt: Date | null;
-  readonly scopes: ReadonlyArray<string>;
-}
-interface OAuthSubjectResolver {
-  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Effect.Effect<{
-    readonly accountId: string;
-    readonly expiresAt: Date | null;
-  }, Error$4>;
-}
-interface AsyncOAuthSubjectResolver {
-  (tokens: oauth.TokenEndpointResponse, accessToken: Value): Promise<{
-    readonly accountId: string;
-    readonly expiresAt: Date | null;
-  }>;
-}
-//#endregion
-//#region src/auth/authorization.d.ts
-declare const Capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
-type Capability = typeof Capability.Type;
-declare const CapabilityEvidence: Schema.Struct<{
-  readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
-  readonly evidence: Schema.TaggedUnion<{
-    readonly Declared: Schema.TaggedStruct<"Declared", {}>;
-    readonly Exercised: Schema.TaggedStruct<"Exercised", {
-      readonly observedAt: Schema.DateFromString;
-    }>;
-    readonly Introspected: Schema.TaggedStruct<"Introspected", {
-      readonly observedAt: Schema.DateFromString;
-    }>;
-  }>;
-}>;
-interface CapabilityEvidence extends Schema.Schema.Type<typeof CapabilityEvidence> {}
-/** A provider credential authorization shared by one or more organization connections. */
-declare const Schema$2: Schema.Struct<{
-  readonly authorizedById: Schema.String;
-  readonly capabilityEvidence: Schema.$Array<Schema.Struct<{
-    readonly capability: Schema.Literals<readonly ["dns:read", "dns:write"]>;
-    readonly evidence: Schema.TaggedUnion<{
-      readonly Declared: Schema.TaggedStruct<"Declared", {}>;
-      readonly Exercised: Schema.TaggedStruct<"Exercised", {
-        readonly observedAt: Schema.DateFromString;
-      }>;
-      readonly Introspected: Schema.TaggedStruct<"Introspected", {
-        readonly observedAt: Schema.DateFromString;
-      }>;
-    }>;
-  }>>;
-  readonly createdAt: Schema.DateFromString;
-  readonly expiresAt: Schema.NullOr<Schema.DateFromString>;
-  readonly id: Schema.String;
-  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
-  readonly providerContext: Schema.Struct<{
-    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly version: Schema.String;
-  }>;
-  readonly providerId: Schema.String;
-  readonly requiredCapabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
-  readonly revocation: Schema.TaggedUnion<{
-    readonly Active: Schema.TaggedStruct<"Active", {}>;
-    readonly Pending: Schema.TaggedStruct<"Pending", {
-      readonly requestedAt: Schema.DateFromString;
-    }>;
-  }>;
-  readonly scopes: Schema.$Array<Schema.String>;
-}>;
-interface ProviderAuthorization extends Schema.Schema.Type<typeof Schema$2> {}
-//#endregion
-//#region src/auth/connection.d.ts
-/** A provider account and authoritative zone selected for one domain attachment. */
-declare const ProviderTargetEvidence: Schema.Struct<{
-  /** The account display name observed during discovery, when the provider exposes one. */
-  readonly accountName: Schema.optionalKey<Schema.String>;
-  /** Nameserver and provider-state evidence observed during discovery. */
-  readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-  readonly status: Schema.String;
-  /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
-  readonly zoneType: Schema.String;
-}>;
-interface ProviderTargetEvidence extends Schema.Schema.Type<typeof ProviderTargetEvidence> {}
-declare const ProviderTarget: Schema.Struct<{
-  readonly accountId: Schema.String;
-  readonly accountKind: Schema.NullOr<Schema.Literals<readonly ["account", "personal", "team"]>>;
-  readonly evidence: Schema.optionalKey<Schema.Struct<{
-    /** The account display name observed during discovery, when the provider exposes one. */
-    readonly accountName: Schema.optionalKey<Schema.String>;
-    /** Nameserver and provider-state evidence observed during discovery. */
-    readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-    readonly status: Schema.String;
-    /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
-    readonly zoneType: Schema.String;
-  }>>;
-  readonly zoneId: Schema.String;
-  readonly zoneName: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-}>;
-interface ProviderTarget extends Schema.Schema.Type<typeof ProviderTarget> {}
-/** The lifecycle state visible to a host for an organization connection. */
-declare const ConnectionStatus: Schema.Literals<readonly ["active", "expired", "revocation-pending"]>;
-type ConnectionStatus = typeof ConnectionStatus.Type;
-/** An organization-scoped provider connection. */
-declare const ProviderConnection: Schema.Struct<{
-  readonly createdAt: Schema.DateFromString;
-  readonly id: Schema.String;
-  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
-  readonly ownerId: Schema.String;
-  readonly providerId: Schema.String;
-  readonly status: Schema.Literals<readonly ["active", "expired", "revocation-pending"]>;
-}>;
-interface ProviderConnection extends Schema.Schema.Type<typeof ProviderConnection> {}
-/** An exact provider target attached to one organization domain. */
-declare const DomainAttachment: Schema.Struct<{
-  readonly connectionId: Schema.String;
-  readonly createdAt: Schema.DateFromString;
-  readonly domain: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly id: Schema.String;
-  readonly target: Schema.Struct<{
-    readonly accountId: Schema.String;
-    readonly accountKind: Schema.NullOr<Schema.Literals<readonly ["account", "personal", "team"]>>;
-    readonly evidence: Schema.optionalKey<Schema.Struct<{
-      /** The account display name observed during discovery, when the provider exposes one. */
-      readonly accountName: Schema.optionalKey<Schema.String>;
-      /** Nameserver and provider-state evidence observed during discovery. */
-      readonly nameservers: Schema.$Array<Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>>;
-      readonly status: Schema.String;
-      /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */
-      readonly zoneType: Schema.String;
-    }>>;
-    readonly zoneId: Schema.String;
-    readonly zoneName: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  }>;
-}>;
-interface DomainAttachment extends Schema.Schema.Type<typeof DomainAttachment> {}
-/** Internal connection row; the authorization id is intentionally not part of the public shape. */
-declare const StoredConnection: Schema.Struct<{
-  readonly authorizationId: Schema.String;
-  readonly createdAt: Schema.DateFromString;
-  readonly id: Schema.String;
-  readonly method: Schema.Literals<readonly ["integration", "oauth2", "token"]>;
-  readonly ownerId: Schema.String;
-  readonly providerId: Schema.String;
-}>;
-interface StoredConnection extends Schema.Schema.Type<typeof StoredConnection> {}
-/** Internal credential material retained by the host's persistence implementation. */
-interface StoredCredential {
-  readonly accessToken: Value;
-  readonly refreshToken: Value | null;
-  readonly tokenType: string;
-}
-declare const AuthorizationError_base$1: Schema.Class<AuthorizationError$1, Schema.TaggedStruct<"AuthorizationError", {
-  readonly category: Schema.Literal<"authorization">;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
-}>, import("effect/Cause").YieldableError>;
-declare class AuthorizationError$1 extends AuthorizationError_base$1 {}
-declare const authorizationError: (message: string, operation: string) => AuthorizationError$1;
-/** Decode a public connection snapshot returned by a host. */
-declare const decode$2: (input: unknown) => Effect.Effect<{
-  readonly createdAt: Date;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly ownerId: string;
-  readonly providerId: string;
-  readonly status: "active" | "expired" | "revocation-pending";
-}, Error$5, never>;
-declare const validate$2: (input: unknown) => Effect.Effect<{
-  readonly createdAt: Date;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly ownerId: string;
-  readonly providerId: string;
-  readonly status: "active" | "expired" | "revocation-pending";
-}, Error$5, never>;
-declare const encode$2: (input: {
-  readonly createdAt: Date;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly ownerId: string;
-  readonly providerId: string;
-  readonly status: "active" | "expired" | "revocation-pending";
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly createdAt: string;
-  readonly id: string;
-  readonly method: "integration" | "oauth2" | "token";
-  readonly ownerId: string;
-  readonly providerId: string;
-  readonly status: "active" | "expired" | "revocation-pending";
-};
-//#endregion
-//#region src/auth/lifecycle-repository.d.ts
-/** Private aggregate owned by the managed-DNS persistence capability. */
-interface Aggregate {
-  readonly authorization: ProviderAuthorization;
-  readonly connections: ReadonlyArray<StoredConnection>;
-  readonly attachments: ReadonlyArray<DomainAttachment>;
-  readonly credential: StoredCredential;
-}
-interface ConnectInput {
-  readonly authorization: ProviderAuthorization;
-  readonly connection: StoredConnection;
-  readonly credential: StoredCredential;
-  /** The authorization id observed before building a reuse update, if any. */
-  readonly expectedAuthorizationId?: string;
-  /** The owner connection id observed before building a reuse update, if any. */
-  readonly expectedConnectionId?: string;
-}
-interface AttachmentResult {
-  readonly attachment: DomainAttachment;
-  readonly connection: ProviderConnection;
-}
-interface DetachResult {
-  readonly attachment: DomainAttachment;
-  readonly connection: ProviderConnection;
-  readonly remainingAttachments: number;
-}
-interface DisconnectResult {
-  readonly connection: ProviderConnection;
-  readonly remainingConnections: number;
-  readonly revokedAuthorization: boolean;
-}
-declare const Error_base$3: Schema.Class<Error$3, Schema.TaggedStruct<"ManagedDnsLifecycleError", {
-  readonly category: Schema.Literal<"storage">;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$3 extends Error_base$3 {}
-/**
- * Persistence capability for the managed-DNS model.
- *
- * Implementations own the atomic aggregate containing one provider credential authorization,
- * organization connections, and exact domain attachments. Provider authorization is deliberately
- * an implementation detail of the capability; public callers operate on the projections returned
- * by the connection and attachment methods.
- */
-interface Interface$2 {
-  readonly attach: (input: {
-    readonly attachment: DomainAttachment;
-    readonly connectionId: string;
-    readonly ownerId: string;
-  }) => Effect.Effect<AttachmentResult, Error$3>;
-  readonly connect: (input: ConnectInput) => Effect.Effect<Aggregate, Error$3>;
-  readonly detach: (input: {
-    readonly attachmentId: string;
-    readonly ownerId: string;
-  }) => Effect.Effect<DetachResult, Error$3>;
-  readonly disconnect: <E>(input: {
-    readonly connectionId: string;
-    readonly ownerId: string;
-    readonly revoke: (authorization: ProviderAuthorization) => Effect.Effect<void, E>;
-  }) => Effect.Effect<DisconnectResult, Error$3 | E>;
-  readonly findConnection: (ownerId: string, authorizationId: string) => Effect.Effect<StoredConnection | null, Error$3>;
-  readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error$3>;
-  readonly getAttachment: (attachmentId: string) => Effect.Effect<DomainAttachment | null, Error$3>;
-  readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error$3>;
-  readonly listAttachments: (connectionId: string, ownerId: string) => Effect.Effect<ReadonlyArray<DomainAttachment>, Error$3>;
-  readonly promoteEvidence: (authorizationId: string, evidence: ReadonlyArray<CapabilityEvidence>) => Effect.Effect<Aggregate, Error$3>;
-  readonly recover: <E>(input: {
-    readonly authorizationId: string;
-    readonly revoke: (authorization: ProviderAuthorization) => Effect.Effect<void, E>;
-  }) => Effect.Effect<DisconnectResult, Error$3 | E>;
-  readonly rotate: (authorizationId: string, credential: StoredCredential, expiresAt: Date | null) => Effect.Effect<Aggregate, Error$3>;
-}
-declare const Service_base$2: Context.ServiceClass<Service$2, "@domainkit/ManagedDnsConnections", Interface$2>;
-declare class Service$2 extends Service_base$2 {}
-declare namespace canonical_json_d_exports {
-  export { CryptoError, Json, sha256Encoded, sha256Json, sha256Text, stringify, webCryptoLayer };
-}
-declare const CryptoError_base: Schema.Class<CryptoError, Schema.TaggedStruct<"CryptoError", {
-  readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-declare class CryptoError extends CryptoError_base {}
-type Json = null | boolean | number | string | ReadonlyArray<Json> | {
-  readonly [key: string]: Json;
-};
-/** Deterministic JSON serialization for already schema-encoded protocol values. */
-declare function stringify(value: Json): string;
-declare const sha256Text: (value: string) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
-declare const sha256Json: (value: Json) => Effect.Effect<string, CryptoError, Crypto.Crypto>;
-declare const sha256Encoded: <S extends Schema.Constraint>(schema: S, value: S["Type"]) => Effect.Effect<string, CryptoError, Crypto.Crypto | S["EncodingServices"]>;
-/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
-declare const webCryptoLayer: Layer.Layer<Crypto.Crypto>;
-declare namespace provider_context_d_exports {
-  export { Codec, Envelope, codec, decode$1 as decode, encode$1 as encode };
-}
-/** A provider-owned, versioned, non-secret context value persisted by the host. */
-declare const Envelope: Schema.Struct<{
-  readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-  readonly version: Schema.String;
-}>;
-interface Envelope extends Schema.Schema.Type<typeof Envelope> {}
-interface Codec<A> {
-  readonly decode: (envelope: Envelope) => Effect.Effect<A, Error$5>;
-  readonly encode: (value: A) => Effect.Effect<Envelope, Error$5>;
-  readonly version: string;
-}
-/** Build an adapter-owned context codec from a schema and stable version identifier. */
-declare function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A>;
-declare const decode$1: (input: unknown) => Effect.Effect<{
-  readonly value: Schema.Json;
-  readonly version: string;
-}, Error$5, never>;
-declare const encode$1: (input: {
-  readonly value: Schema.Json;
-  readonly version: string;
-}, options?: import("effect/SchemaAST").ParseOptions) => {
-  readonly value: Schema.Json;
-  readonly version: string;
-};
-//#endregion
-//#region src/auth/connect.d.ts
-interface Authentication {
-  readonly capabilityEvidence: ReadonlyArray<CapabilityEvidence>;
-  readonly credential: StoredCredential;
-  readonly expiresAt: Date | null;
-  /** Provider-specific subject identity used only during authentication; targets are selected later. */
-  readonly providerAccountId: string;
-  readonly providerContext: Envelope;
-  readonly scopes: ReadonlyArray<string>;
-}
-type AuthenticationFailure = Error$2 | Error$5 | Error$4;
-interface InteractiveStart {
-  readonly authorizationUrl: URL;
-  readonly payload: Value;
-}
-interface Continuation extends BaseInput {
-  readonly expiresAt: Date;
-  readonly id: string;
-  readonly method: "integration" | "oauth2";
-  readonly payload: Value;
-  readonly providerId: string;
-  readonly requiredCapabilities: ReadonlyArray<Capability>;
-}
-interface ContinuationStore {
-  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error$2>;
-  readonly put: (continuation: Continuation) => Effect.Effect<void, Error$2>;
-}
-interface InteractiveFlow {
-  readonly complete: (payload: Value, callbackUrl: URL) => Effect.Effect<Authentication, AuthenticationFailure>;
-  readonly method: "integration" | "oauth2";
-  readonly providerId: string;
-  readonly requiredCapabilities: ReadonlyArray<Capability>;
-  readonly start: (continuationId: string) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;
-}
-type Method = Data.TaggedEnum<{
-  Interactive: {
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  };
-  Token: {
-    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  };
-}>;
-declare const Method: {
-  readonly $is: <Tag extends "Interactive" | "Token">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "Interactive";
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Token";
-    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
-    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
-  };
-  readonly Interactive: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Interactive";
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  }, "_tag">;
-  readonly Token: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Token";
-    readonly authenticate: (token: Value) => Effect.Effect<Authentication, AuthenticationFailure>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  }, "_tag">;
-};
-type StartResult = Data.TaggedEnum<{
-  Connected: {
-    readonly connection: ProviderConnection;
-  };
-  Redirect: {
-    readonly authorizationUrl: URL;
-    readonly continuationId: string;
-  };
-}>;
-declare const StartResult: {
-  readonly $is: <Tag extends "Connected" | "Redirect">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "Connected";
-    readonly connection: ProviderConnection;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Redirect";
-    readonly authorizationUrl: URL;
-    readonly continuationId: string;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
-      readonly _tag: "Connected";
-      readonly connection: ProviderConnection;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "Connected";
-      readonly connection: ProviderConnection;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
-    <Cases extends { readonly [Tag in "Connected" | "Redirect"]: (args: Extract<{
-      readonly _tag: "Connected";
-      readonly connection: ProviderConnection;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "Connected";
-      readonly connection: ProviderConnection;
-    } | {
-      readonly _tag: "Redirect";
-      readonly authorizationUrl: URL;
-      readonly continuationId: string;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Connected" | "Redirect"]>>;
-  };
-  readonly Connected: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Connected";
-    readonly connection: ProviderConnection;
-  }, "_tag">;
-  readonly Redirect: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Redirect";
-    readonly authorizationUrl: URL;
-    readonly continuationId: string;
-  }, "_tag">;
-};
-declare const Error_base$2: Schema.Class<Error$2, Schema.TaggedStruct<"ConnectionError", {
-  readonly category: Schema.Literals<readonly ["authorization", "provider", "validation"]>;
-  readonly message: Schema.String;
-  readonly operation: Schema.String;
-  readonly retry: Schema.Literals<readonly ["never", "after-user-action", "safe", "unknown"]>;
-}>, import("effect/Cause").YieldableError>;
-declare class Error$2 extends Error_base$2 {}
-/** Inputs shared by token and interactive connection flows. */
-interface BaseInput {
-  readonly authorizedById: string;
-  /** Existing authorization may be supplied only after the host completed fresh provider proof. */
-  readonly authorizationId?: string;
-  readonly ownerId: string;
-}
-interface CompleteInput {
-  readonly callbackUrl: URL;
-  readonly continuationId: string;
-  readonly continuations: ContinuationStore;
-  readonly flow: InteractiveFlow;
-}
-declare const start: (input: BaseInput & {
-  readonly method: Method;
-}) => Effect.Effect<{
-  readonly _tag: "Connected";
-  readonly connection: ProviderConnection;
-} | {
-  readonly _tag: "Redirect";
-  readonly authorizationUrl: URL;
-  readonly continuationId: string;
-}, Error$3 | AuthenticationFailure, Crypto.Crypto | Service$2>;
-declare const complete: (input: CompleteInput) => Effect.Effect<ProviderConnection, Error$3 | AuthenticationFailure, Crypto.Crypto | Service$2>;
-type Failure = AuthenticationFailure | Error$3 | CryptoError;
 declare namespace zone_discovery_d_exports {
   export { Candidate, Interface$1 as Interface, Outcome, Service$1 as Service, Source, make };
 }
@@ -1117,8 +14,8 @@ declare const Candidate: Schema.Struct<{
 }>;
 interface Candidate extends Schema.Schema.Type<typeof Candidate> {}
 interface Source {
-  readonly listZones: (name: DomainName) => Effect.Effect<ReadonlyArray<Omit<Candidate, "providerId">>, Error$4>;
-  readonly provider: Interface$3;
+  readonly listZones: (name: DomainName) => Effect.Effect<ReadonlyArray<Omit<Candidate, "providerId">>, Error$2>;
+  readonly provider: Interface$2;
 }
 type Outcome = Data.TaggedEnum<{
   NotFound: {
@@ -1126,7 +23,7 @@ type Outcome = Data.TaggedEnum<{
   };
   Resolved: {
     readonly candidate: Candidate;
-    readonly provider: Interface$3;
+    readonly provider: Interface$2;
   };
   SelectionRequired: {
     readonly candidates: ReadonlyArray<Candidate>;
@@ -1141,7 +38,7 @@ declare const Outcome: {
   }> | Extract<{
     readonly _tag: "Resolved";
     readonly candidate: Candidate;
-    readonly provider: Interface$3;
+    readonly provider: Interface$2;
   }, {
     readonly _tag: Tag;
   }> | Extract<{
@@ -1157,7 +54,7 @@ declare const Outcome: {
     } | {
       readonly _tag: "Resolved";
       readonly candidate: Candidate;
-      readonly provider: Interface$3;
+      readonly provider: Interface$2;
     } | {
       readonly _tag: "SelectionRequired";
       readonly candidates: ReadonlyArray<Candidate>;
@@ -1169,7 +66,7 @@ declare const Outcome: {
     } | {
       readonly _tag: "Resolved";
       readonly candidate: Candidate;
-      readonly provider: Interface$3;
+      readonly provider: Interface$2;
     } | {
       readonly _tag: "SelectionRequired";
       readonly candidates: ReadonlyArray<Candidate>;
@@ -1180,7 +77,7 @@ declare const Outcome: {
     } | {
       readonly _tag: "Resolved";
       readonly candidate: Candidate;
-      readonly provider: Interface$3;
+      readonly provider: Interface$2;
     } | {
       readonly _tag: "SelectionRequired";
       readonly candidates: ReadonlyArray<Candidate>;
@@ -1192,7 +89,7 @@ declare const Outcome: {
     } | {
       readonly _tag: "Resolved";
       readonly candidate: Candidate;
-      readonly provider: Interface$3;
+      readonly provider: Interface$2;
     } | {
       readonly _tag: "SelectionRequired";
       readonly candidates: ReadonlyArray<Candidate>;
@@ -1205,7 +102,7 @@ declare const Outcome: {
   readonly Resolved: Data.TaggedEnum.ConstructorFrom<{
     readonly _tag: "Resolved";
     readonly candidate: Candidate;
-    readonly provider: Interface$3;
+    readonly provider: Interface$2;
   }, "_tag">;
   readonly SelectionRequired: Data.TaggedEnum.ConstructorFrom<{
     readonly _tag: "SelectionRequired";
@@ -1213,7 +110,7 @@ declare const Outcome: {
   }, "_tag">;
 };
 interface Interface$1 {
-  readonly discover: (domain: DomainName) => Effect.Effect<Outcome, Error$4>;
+  readonly discover: (domain: DomainName) => Effect.Effect<Outcome, Error$2>;
 }
 declare const Service_base$1: Context.ServiceClass<Service$1, "@domainkit/ZoneDiscovery", Interface$1>;
 declare class Service$1 extends Service_base$1 {}
@@ -1222,7 +119,7 @@ declare function make(sources: ReadonlyArray<Source>): Interface$1;
 declare namespace types_d_exports {
   export { ApplyReceipt, Authorization$1 as Authorization, DnsPlan, Operation$1 as Operation, PlanAuthorization, Receipt$1 as Receipt, Schema$1 as Schema, decode, decodeReceipt, encode, encodeReceipt };
 }
-declare const Operation$1: Schema.TaggedUnion<{
+declare const OperationSchema: Schema.TaggedUnion<{
   readonly conflict: Schema.TaggedStruct<"conflict", {
     readonly existing: Schema.$Array<Schema.Union<readonly [Schema.TaggedUnion<{
       readonly A: Schema.TaggedStruct<"A", {
@@ -1319,8 +216,7 @@ declare const Operation$1: Schema.TaggedUnion<{
         readonly ttl: Schema.NullOr<Schema.Int>;
         readonly value: Schema.String;
       }>;
-    }>, Schema.Struct<{
-      readonly _tag: Schema.Literal<"Opaque">;
+    }>, Schema.TaggedStruct<"Opaque", {
       readonly name: Schema.String;
       readonly providerRecordId: Schema.NullOr<Schema.String>;
       readonly providerType: Schema.String;
@@ -1624,7 +520,810 @@ declare const Operation$1: Schema.TaggedUnion<{
     readonly ttlDrift: Schema.Boolean;
   }>;
 }>;
-type Operation$1 = typeof Operation$1.Type;
+/** DNS plan operation schema and callable constructors for trusted plan values. */
+declare const Operation$1: {
+  Schema: Schema.TaggedUnion<{
+    readonly conflict: Schema.TaggedStruct<"conflict", {
+      readonly existing: Schema.$Array<Schema.Union<readonly [Schema.TaggedUnion<{
+        readonly A: Schema.TaggedStruct<"A", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly AAAA: Schema.TaggedStruct<"AAAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly CAA: Schema.TaggedStruct<"CAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly flags: Schema.Int;
+          readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+          readonly value: Schema.String;
+        }>;
+        readonly CNAME: Schema.TaggedStruct<"CNAME", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly policy: Schema.Literal<"exclusive">;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly MX: Schema.TaggedStruct<"MX", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly priority: Schema.Int;
+        }>;
+        readonly NS: Schema.TaggedStruct<"NS", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly SRV: Schema.TaggedStruct<"SRV", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly port: Schema.Int;
+          readonly priority: Schema.Int;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly weight: Schema.Int;
+        }>;
+        readonly TXT: Schema.TaggedStruct<"TXT", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly value: Schema.String;
+        }>;
+      }>, Schema.TaggedStruct<"Opaque", {
+        readonly name: Schema.String;
+        readonly providerRecordId: Schema.NullOr<Schema.String>;
+        readonly providerType: Schema.String;
+      }>]>>;
+      readonly id: Schema.String;
+      readonly reason: Schema.String;
+      readonly requirement: Schema.TaggedUnion<{
+        readonly A: Schema.TaggedStruct<"A", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly AAAA: Schema.TaggedStruct<"AAAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly CAA: Schema.TaggedStruct<"CAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly flags: Schema.Int;
+          readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+          readonly value: Schema.String;
+        }>;
+        readonly CNAME: Schema.TaggedStruct<"CNAME", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly policy: Schema.Literal<"exclusive">;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly MX: Schema.TaggedStruct<"MX", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly priority: Schema.Int;
+        }>;
+        readonly NS: Schema.TaggedStruct<"NS", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly SRV: Schema.TaggedStruct<"SRV", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly port: Schema.Int;
+          readonly priority: Schema.Int;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly weight: Schema.Int;
+        }>;
+        readonly TXT: Schema.TaggedStruct<"TXT", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly value: Schema.String;
+        }>;
+      }>;
+    }>;
+    readonly create: Schema.TaggedStruct<"create", {
+      readonly id: Schema.String;
+      readonly requirement: Schema.TaggedUnion<{
+        readonly A: Schema.TaggedStruct<"A", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly AAAA: Schema.TaggedStruct<"AAAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly CAA: Schema.TaggedStruct<"CAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly flags: Schema.Int;
+          readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+          readonly value: Schema.String;
+        }>;
+        readonly CNAME: Schema.TaggedStruct<"CNAME", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly policy: Schema.Literal<"exclusive">;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly MX: Schema.TaggedStruct<"MX", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly priority: Schema.Int;
+        }>;
+        readonly NS: Schema.TaggedStruct<"NS", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly SRV: Schema.TaggedStruct<"SRV", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly port: Schema.Int;
+          readonly priority: Schema.Int;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly weight: Schema.Int;
+        }>;
+        readonly TXT: Schema.TaggedStruct<"TXT", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly value: Schema.String;
+        }>;
+      }>;
+    }>;
+    readonly noop: Schema.TaggedStruct<"noop", {
+      readonly id: Schema.String;
+      readonly requirement: Schema.TaggedUnion<{
+        readonly A: Schema.TaggedStruct<"A", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly AAAA: Schema.TaggedStruct<"AAAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly address: Schema.String;
+        }>;
+        readonly CAA: Schema.TaggedStruct<"CAA", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly flags: Schema.Int;
+          readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+          readonly value: Schema.String;
+        }>;
+        readonly CNAME: Schema.TaggedStruct<"CNAME", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly policy: Schema.Literal<"exclusive">;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly MX: Schema.TaggedStruct<"MX", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly priority: Schema.Int;
+        }>;
+        readonly NS: Schema.TaggedStruct<"NS", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        }>;
+        readonly SRV: Schema.TaggedStruct<"SRV", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly port: Schema.Int;
+          readonly priority: Schema.Int;
+          readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly weight: Schema.Int;
+        }>;
+        readonly TXT: Schema.TaggedStruct<"TXT", {
+          readonly metadata: Schema.Struct<{
+            readonly ownership: Schema.String;
+            readonly provenance: Schema.String;
+            readonly purpose: Schema.String;
+          }>;
+          readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+          readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+          readonly ttl: Schema.NullOr<Schema.Int>;
+          readonly value: Schema.String;
+        }>;
+      }>;
+      readonly ttlDrift: Schema.Boolean;
+    }>;
+  }>;
+  conflict: (input: Parameters<typeof OperationSchema.cases.conflict.make>[0]) => {
+    readonly _tag: "conflict";
+    readonly existing: readonly ({
+      readonly _tag: "A";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "AAAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "CAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly flags: number;
+      readonly tag: "iodef" | "issue" | "issuewild";
+      readonly value: string;
+    } | {
+      readonly _tag: "CNAME";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number | null;
+      readonly policy: "exclusive";
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "MX";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+      readonly priority: number;
+    } | {
+      readonly _tag: "NS";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "SRV";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly port: number;
+      readonly priority: number;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+      readonly weight: number;
+    } | {
+      readonly _tag: "TXT";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly value: string;
+    } | {
+      readonly _tag: "Opaque";
+      readonly name: string;
+      readonly providerRecordId: string | null;
+      readonly providerType: string;
+    })[];
+    readonly id: string;
+    readonly reason: string;
+    readonly requirement: {
+      readonly _tag: "A";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "AAAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "CAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly flags: number;
+      readonly tag: "iodef" | "issue" | "issuewild";
+      readonly value: string;
+    } | {
+      readonly _tag: "CNAME";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number | null;
+      readonly policy: "exclusive";
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "MX";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+      readonly priority: number;
+    } | {
+      readonly _tag: "NS";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "SRV";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly port: number;
+      readonly priority: number;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+      readonly weight: number;
+    } | {
+      readonly _tag: "TXT";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly value: string;
+    };
+  };
+  create: (input: Parameters<typeof OperationSchema.cases.create.make>[0]) => {
+    readonly _tag: "create";
+    readonly id: string;
+    readonly requirement: {
+      readonly _tag: "A";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "AAAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "CAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly flags: number;
+      readonly tag: "iodef" | "issue" | "issuewild";
+      readonly value: string;
+    } | {
+      readonly _tag: "CNAME";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number | null;
+      readonly policy: "exclusive";
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "MX";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+      readonly priority: number;
+    } | {
+      readonly _tag: "NS";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "SRV";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly port: number;
+      readonly priority: number;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+      readonly weight: number;
+    } | {
+      readonly _tag: "TXT";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly value: string;
+    };
+  };
+  noop: (input: Parameters<typeof OperationSchema.cases.noop.make>[0]) => {
+    readonly _tag: "noop";
+    readonly id: string;
+    readonly requirement: {
+      readonly _tag: "A";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "AAAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly address: string;
+    } | {
+      readonly _tag: "CAA";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly flags: number;
+      readonly tag: "iodef" | "issue" | "issuewild";
+      readonly value: string;
+    } | {
+      readonly _tag: "CNAME";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number | null;
+      readonly policy: "exclusive";
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "MX";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+      readonly priority: number;
+    } | {
+      readonly _tag: "NS";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+    } | {
+      readonly _tag: "SRV";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly port: number;
+      readonly priority: number;
+      readonly target: string & import("effect/Brand").Brand<"DomainName">;
+      readonly weight: number;
+    } | {
+      readonly _tag: "TXT";
+      readonly metadata: {
+        readonly ownership: string;
+        readonly provenance: string;
+        readonly purpose: string;
+      };
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly policy: "append" | "exclusive";
+      readonly ttl: number | null;
+      readonly value: string;
+    };
+    readonly ttlDrift: boolean;
+  };
+};
+type Operation$1 = typeof OperationSchema.Type;
 declare const Schema$1: Schema.Struct<{
   readonly digest: Schema.String;
   readonly operations: Schema.$Array<Schema.TaggedUnion<{
@@ -1724,8 +1423,7 @@ declare const Schema$1: Schema.Struct<{
           readonly ttl: Schema.NullOr<Schema.Int>;
           readonly value: Schema.String;
         }>;
-      }>, Schema.Struct<{
-        readonly _tag: Schema.Literal<"Opaque">;
+      }>, Schema.TaggedStruct<"Opaque", {
         readonly name: Schema.String;
         readonly providerRecordId: Schema.NullOr<Schema.String>;
         readonly providerType: Schema.String;
@@ -2456,7 +2154,7 @@ declare const decode: (input: unknown) => Effect.Effect<{
   readonly providerId: string;
   readonly version: "domainkit.dns-plan.v1";
   readonly zone: string & import("effect/Brand").Brand<"DomainName">;
-}, Error$5, never>;
+}, Error$3, never>;
 declare const encode: (input: {
   readonly digest: string;
   readonly operations: readonly ({
@@ -3273,7 +2971,7 @@ declare const decodeReceipt: (input: unknown) => Effect.Effect<{
   readonly status: "complete" | "partial";
   readonly version: "domainkit.apply-receipt.v1";
   readonly zone: string & import("effect/Brand").Brand<"DomainName">;
-}, Error$5, never>;
+}, Error$3, never>;
 declare const encodeReceipt: (input: {
   readonly appliedAt: Date;
   readonly operations: readonly {
@@ -3505,11 +3203,11 @@ interface ApplyInput {
   readonly authorization: PlanAuthorization;
   readonly plan: DnsPlan;
 }
-type CreateError$1 = Error$5 | Error$4 | CryptoError;
+type CreateError$1 = Error$3 | Error$2 | CryptoError;
 type AuthorizeError = AuthorizationError | CryptoError;
-type ApplyError$1 = Error$5 | Error$4 | CryptoError | AuthorizationError | ConflictError | StaleError | PartialApplyError;
+type ApplyError$1 = Error$3 | Error$2 | CryptoError | AuthorizationError | ConflictError | StaleError | PartialApplyError;
 /** Builds a deterministic DNS plan through an exact or discoverable authoritative-zone target. */
-declare function create$1(input: ExactCreateInput): Effect.Effect<ResolvedCreateResult, CreateError$1, Crypto.Crypto | Service$3>;
+declare function create$1(input: ExactCreateInput): Effect.Effect<ResolvedCreateResult, CreateError$1, Crypto.Crypto | Service$2>;
 declare function create$1(input: DiscoverCreateInput): Effect.Effect<CreateResult, CreateError$1, Crypto.Crypto | Service$1>;
 /** Authorizes all or a selected subset of create operations in a digest-bound plan. */
 declare const authorize$1: (plan: DnsPlan, operationIds?: readonly string[] | undefined, options?: {
@@ -3521,7 +3219,7 @@ declare const authorize$1: (plan: DnsPlan, operationIds?: readonly string[] | un
   version: "domainkit.plan-authorization.v1";
 }, AuthorizeError, Crypto.Crypto>;
 /** Applies approved creates sequentially after full and per-operation revalidation. */
-declare const apply$1: (input: ApplyInput) => Effect.Effect<ApplyReceipt, AuthorizationError | ConflictError | CryptoError | Error$5 | Error$4 | PartialApplyError | StaleError, Crypto.Crypto | Service$3>;
+declare const apply$1: (input: ApplyInput) => Effect.Effect<ApplyReceipt, AuthorizationError | ConflictError | CryptoError | Error$3 | Error$2 | PartialApplyError | StaleError, Crypto.Crypto | Service$2>;
 declare function renderManualInstructions(plan: DnsPlan): ReadonlyArray<string>;
 declare function validate$1(plan: DnsPlan): Effect.Effect<void, AuthorizeError, Crypto.Crypto>;
 declare namespace deletion_d_exports {
@@ -3892,7 +3590,7 @@ declare const create: (input: CreateInput) => Effect.Effect<{
   version: "domainkit.deletion-plan.v1";
   zone: string & import("effect/Brand").Brand<"DomainName">;
   digest: string;
-}, Error$4 | Error$1 | AuthorizeError, Crypto.Crypto | Service$3>;
+}, Error$2 | Error$1 | AuthorizeError, Crypto.Crypto | Service$2>;
 /** Produce a separate digest-bound consent artifact for destructive operations. */
 declare const authorize: (plan: Plan, operationIds?: readonly string[] | undefined) => Effect.Effect<{
   operationIds: string[];
@@ -3904,11 +3602,11 @@ declare const apply: (input: {
   readonly authorization: Authorization;
   readonly plan: Plan;
   readonly priorReceipt?: Receipt;
-}) => Effect.Effect<Receipt, CryptoError | Error$4 | Error$1 | PartialError, Crypto.Crypto | Service$3>;
+}) => Effect.Effect<Receipt, CryptoError | Error$2 | Error$1 | PartialError, Crypto.Crypto | Service$2>;
 declare function validate(plan: Plan): Effect.Effect<void, Error$1 | CryptoError, Crypto.Crypto>;
-type CreateError = Error$1 | Error$5 | AuthorizationError | Error$4 | CryptoError;
-type ApplyError = Error$1 | PartialError | Error$4 | CryptoError;
-type Requirements = Service$3 | Crypto.Crypto;
+type CreateError = Error$1 | Error$3 | AuthorizationError | Error$2 | CryptoError;
+type ApplyError = Error$1 | PartialError | Error$2 | CryptoError;
+type Requirements = Service$2 | Crypto.Crypto;
 declare namespace resolver_d_exports {
   export { Answer, AsyncInterface, AsyncResolution, Error, Interface, Query, Resolution, Service, layerFromAsync, toAsync };
 }
@@ -3924,7 +3622,7 @@ declare const Answer: Schema.Struct<{
   readonly type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
 }>;
 interface Answer extends Schema.Schema.Type<typeof Answer> {}
-declare const Resolution: Schema.TaggedUnion<{
+declare const ResolutionSchema: Schema.TaggedUnion<{
   readonly answer: Schema.TaggedStruct<"answer", {
     readonly answers: Schema.$Array<Schema.Struct<{
       readonly data: Schema.String;
@@ -3935,7 +3633,33 @@ declare const Resolution: Schema.TaggedUnion<{
   }>;
   readonly nodata: Schema.TaggedStruct<"nodata", {}>;
 }>;
-type Resolution = typeof Resolution.Type;
+/** DNS answer schema and callable constructors for trusted resolver values. */
+declare const Resolution: {
+  Schema: Schema.TaggedUnion<{
+    readonly answer: Schema.TaggedStruct<"answer", {
+      readonly answers: Schema.$Array<Schema.Struct<{
+        readonly data: Schema.String;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly ttl: Schema.Int;
+        readonly type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
+      }>>;
+    }>;
+    readonly nodata: Schema.TaggedStruct<"nodata", {}>;
+  }>;
+  answer: (input: Parameters<typeof ResolutionSchema.cases.answer.make>[0]) => {
+    readonly _tag: "answer";
+    readonly answers: readonly {
+      readonly data: string;
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number;
+      readonly type: "A" | "AAAA" | "CAA" | "CNAME" | "MX" | "NS" | "SRV" | "TXT";
+    }[];
+  };
+  nodata: () => {
+    readonly _tag: "nodata";
+  };
+};
+type Resolution = typeof ResolutionSchema.Type;
 declare const Error_base: Schema.Class<Error, Schema.TaggedStruct<"ResolverError", {
   readonly cause: Schema.optionalKey<Schema.Unknown>;
   readonly message: Schema.String;
@@ -3947,17 +3671,64 @@ interface Interface {
 }
 declare const Service_base: Context.ServiceClass<Service, "@domainkit/DnsResolver", Interface>;
 declare class Service extends Service_base {}
-type AsyncResolution = Resolution | {
-  readonly _tag: "timeout";
-} | {
-  readonly _tag: "failure";
-  readonly message: string;
+declare const AsyncResolutionSchema: Schema.TaggedUnion<{
+  readonly answer: Schema.TaggedStruct<"answer", {
+    readonly answers: Schema.$Array<Schema.Struct<{
+      readonly data: Schema.String;
+      readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+      readonly ttl: Schema.Int;
+      readonly type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
+    }>>;
+  }>;
+  readonly failure: Schema.TaggedStruct<"failure", {
+    readonly message: Schema.String;
+  }>;
+  readonly nodata: Schema.TaggedStruct<"nodata", {}>;
+  readonly timeout: Schema.TaggedStruct<"timeout", {}>;
+}>;
+/** Promise bridge result schema and callable constructors, including typed failures. */
+declare const AsyncResolution: {
+  Schema: Schema.TaggedUnion<{
+    readonly answer: Schema.TaggedStruct<"answer", {
+      readonly answers: Schema.$Array<Schema.Struct<{
+        readonly data: Schema.String;
+        readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+        readonly ttl: Schema.Int;
+        readonly type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
+      }>>;
+    }>;
+    readonly failure: Schema.TaggedStruct<"failure", {
+      readonly message: Schema.String;
+    }>;
+    readonly nodata: Schema.TaggedStruct<"nodata", {}>;
+    readonly timeout: Schema.TaggedStruct<"timeout", {}>;
+  }>;
+  answer: (input: Parameters<typeof AsyncResolutionSchema.cases.answer.make>[0]) => {
+    readonly _tag: "answer";
+    readonly answers: readonly {
+      readonly data: string;
+      readonly name: string & import("effect/Brand").Brand<"DomainName">;
+      readonly ttl: number;
+      readonly type: "A" | "AAAA" | "CAA" | "CNAME" | "MX" | "NS" | "SRV" | "TXT";
+    }[];
+  };
+  failure: (input: Parameters<typeof AsyncResolutionSchema.cases.failure.make>[0]) => {
+    readonly _tag: "failure";
+    readonly message: string;
+  };
+  nodata: () => {
+    readonly _tag: "nodata";
+  };
+  timeout: () => {
+    readonly _tag: "timeout";
+  };
 };
+type AsyncResolution = typeof AsyncResolutionSchema.Type;
 interface AsyncInterface {
   readonly resolve: (query: Query) => Promise<AsyncResolution>;
 }
 declare const layerFromAsync: (resolver: AsyncInterface) => Layer.Layer<Service>;
 declare const toAsync: (resolver: Interface) => AsyncInterface;
 //#endregion
-export { InteractiveStart as $, Cname as $t, renderManualInstructions as A, CapabilityEvidence as At, types_d_exports as B, TokenValidation as Bt, DiscoverCreateInput as C, StoredConnection as Ct, StaleError as D, encode$2 as Dt, ResolvedCreateResult as E, decode$2 as Et, PlanAuthorization as F, Method$1 as Ft, AuthenticationFailure as G, CreateResult$1 as Gt, Source as H, Value as Ht, Receipt$1 as I, OAuthClientConfiguration as It, Continuation as J, Service$3 as Jt, BaseInput as K, Error$4 as Kt, Schema$1 as L, OAuthMethod as Lt, Authorization$1 as M, AsyncOAuthSubjectResolver as Mt, DnsPlan as N, IntegrationMethod as Nt, Target as O, validate$2 as Ot, Operation$1 as P, Manifest as Pt, InteractiveFlow as Q, Caa as Qt, encode as R, OAuthSubjectResolver as Rt, CreateResult as S, ProviderTargetEvidence as St, PartialApplyError as T, authorizationError as Tt, zone_discovery_d_exports as U, secret_d_exports as Ut, Candidate as V, manifest_d_exports as Vt, Authentication as W, AsyncInterface$1 as Wt, Error$2 as X, A as Xt, ContinuationStore as Y, provider_d_exports as Yt, Failure as Z, Aaaa as Zt, Receipt as _, domain_name_d_exports as _n, AuthorizationError$1 as _t, Interface as a, Opaque as an, Envelope as at, AuthorizeError as b, invalid_input_d_exports as bn, ProviderConnection as bt, Service as c, Srv as cn, canonical_json_d_exports as ct, Authorization as d, data as dn, ConnectInput as dt, DnsRecord as en, Method as et, CreateError as f, dns_record_d_exports as fn, DetachResult as ft, Plan as g, Schema$5 as gn, Service$2 as gt, PartialError as h, DomainName as hn, Interface$2 as ht, Error as i, Observed as in, Codec as it, ApplyReceipt as j, ProviderAuthorization as jt, plan_d_exports as k, Capability as kt, resolver_d_exports as l, Txt as ln, Aggregate as lt, Operation as m, parse as mn, Error$3 as mt, AsyncInterface as n, Mx as nn, complete as nt, Query as o, RequirementMetadata as on, provider_context_d_exports as ot, Error$1 as p, equals as pn, DisconnectResult as pt, CompleteInput as q, Interface$3 as qt, AsyncResolution as r, Ns as rn, start as rt, Resolution as s, Schema$4 as sn, CryptoError as st, Answer as t, Encoded as tn, StartResult as tt, ApplyError as u, Type as un, AttachmentResult as ut, deletion_d_exports as v, parse$1 as vn, ConnectionStatus as vt, ExactCreateInput as w, StoredCredential as wt, ConflictError as x, ProviderTarget as xt, AuthorizationError as y, Error$5 as yn, DomainAttachment as yt, encodeReceipt as z, Schema$3 as zt };
-//# sourceMappingURL=resolver-BGBLnPjJ.d.mts.map
+export { renderManualInstructions as A, types_d_exports as B, DiscoverCreateInput as C, StaleError as D, ResolvedCreateResult as E, PlanAuthorization as F, Source as H, Receipt$1 as I, Schema$1 as L, Authorization$1 as M, DnsPlan as N, Target as O, Operation$1 as P, encode as R, CreateResult as S, PartialApplyError as T, zone_discovery_d_exports as U, Candidate as V, Receipt as _, Interface as a, AuthorizeError as b, Service as c, Authorization as d, CreateError as f, Plan as g, PartialError as h, Error as i, ApplyReceipt as j, plan_d_exports as k, resolver_d_exports as l, Operation as m, AsyncInterface as n, Query as o, Error$1 as p, AsyncResolution as r, Resolution as s, Answer as t, ApplyError as u, deletion_d_exports as v, ExactCreateInput as w, ConflictError as x, AuthorizationError as y, encodeReceipt as z };
+//# sourceMappingURL=resolver-DRrLm_hB.d.mts.map