domainkit 0.6.0 → 0.7.0

package/README.md

@@ -1,11 +1,10 @@
 # DomainKit
 
-Domain setup infrastructure for TypeScript SaaS applications.
+Add custom domains to a TypeScript SaaS application.
 
-DomainKit turns DNS requirements into reviewable plans, requires explicit digest-bound
-authorization before writes, records applied changes in receipts, and uses those receipts to plan
-safe cleanup. It supports Cloudflare and Vercel without making either provider's API your product
-architecture.
+DomainKit turns DNS requirements into plans you can review, requires approval for the exact plan
+before a write, records applied changes in receipts, and uses those receipts to plan cleanup. It
+supports Cloudflare and Vercel without making either provider's API your product architecture.
 
 ## Install
 
@@ -52,21 +51,21 @@ and incompatible state becomes a conflict. DomainKit never silently overwrites D
 
 ## Public entry points
 
-- `domainkit` — canonical Effect services, schemas, plans, providers, and verification;
-- `domainkit/promise` — Promise adapters for foreign-runtime boundaries;
-- `domainkit/server` — Effect-first provider connection routes with an async Web handler factory;
-- `domainkit/testing` — in-memory services and provider conformance helpers.
+- `domainkit` — Effect services, schemas, plans, providers, and verification;
+- `domainkit/promise` — Promise API for apps that use async/await;
+- `domainkit/server` — provider connection routes and an async Web handler factory;
+- `domainkit/testing` — in-memory services and provider tests.
 
-Provider credentials, OAuth state, durable connections, plans, receipts, authorization, and audit
-history remain owned by your application. DomainKit supplies the domain model and operations, not a
-hosted control plane. Cloudflare's provider namespace includes credential refresh, while the host
-owns refresh locking, encrypted rotation, retry policy, and reconnect UX.
+Your app owns provider credentials, OAuth state, saved connections, plans, receipts, authorization,
+and audit history. DomainKit supplies the domain model and operations, not a hosted control plane.
+Cloudflare's provider namespace includes credential refresh; the host owns refresh locking,
+encrypted rotation, retry policy, and reconnect UX.
 
 ## Learn more
 
 - [Executable quickstart](https://github.com/AryaLabsHQ/domainkit/blob/main/packages/domainkit/examples/effect/quickstart.ts)
 - [Architecture decisions](https://github.com/AryaLabsHQ/domainkit/tree/main/docs/adr)
-- [Provider behavior](https://github.com/AryaLabsHQ/domainkit/blob/main/docs/providers.md)
+- [Provider behavior](https://domain-kit.dev/docs/reference/providers)
 - [Examples](https://github.com/AryaLabsHQ/domainkit/tree/main/packages/domainkit/examples)
 - [Issues](https://github.com/AryaLabsHQ/domainkit/issues)
 

package/dist/{canonical-json-9x7gHIoS.mjs → canonical-json-CQYKsZw7.mjs}

@@ -199,10 +199,16 @@ const CapabilityEvidence = Schema.Struct({
 	capability: Capability,
 	evidence: EvidenceSchema
 });
-const Revocation = Schema.TaggedUnion({
+const RevocationSchema = Schema.TaggedUnion({
 	Active: {},
 	Pending: { requestedAt: Schema.DateFromString }
 });
+/** Revocation state schema and callable constructors for trusted lifecycle values. */
+const Revocation = {
+	Schema: RevocationSchema,
+	Active: () => RevocationSchema.cases.Active.make({}),
+	Pending: (input) => RevocationSchema.cases.Pending.make(input)
+};
 /** A provider credential authorization shared by one or more organization connections. */
 const Schema$1 = Schema.Struct({
 	authorizedById: Schema.String,
@@ -217,7 +223,7 @@ const Schema$1 = Schema.Struct({
 	providerContext: Envelope,
 	providerId: Schema.String,
 	requiredCapabilities: Schema.Array(Capability),
-	revocation: Revocation,
+	revocation: Revocation.Schema,
 	scopes: Schema.Array(Schema.String)
 });
 const decode = Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$2({ message: cause.message }))));
@@ -299,6 +305,6 @@ const webCryptoLayer = Layer.succeed(Crypto.Crypto, Crypto.make({
 	})
 }));
 //#endregion
-export { invalid_input_exports as A, project as C, domain_name_exports as D, decode$3 as E, parse as O, encode$2 as S, Schema$2 as T, ProviderTargetEvidence as _, AggregateSchema as a, authorizationError as b, Evidence as c, provider_context_exports as d, AuthorizationError as f, ProviderTarget as g, ProviderConnection as h, webCryptoLayer as i, Error$2 as k, authorization_exports as l, DomainAttachment as m, sha256Encoded as n, Error$1 as o, ConnectionStatus as p, stringify as r, Service as s, canonical_json_exports as t, codec as u, StoredConnection as v, validate$1 as w, decode$2 as x, assertAttachment as y };
+export { Error$2 as A, encode$2 as C, decode$3 as D, Schema$2 as E, domain_name_exports as O, decode$2 as S, validate$1 as T, ProviderTarget as _, AggregateSchema as a, assertAttachment as b, Evidence as c, codec as d, provider_context_exports as f, ProviderConnection as g, DomainAttachment as h, webCryptoLayer as i, invalid_input_exports as j, parse as k, Revocation as l, ConnectionStatus as m, sha256Encoded as n, Error$1 as o, AuthorizationError as p, stringify as r, Service as s, canonical_json_exports as t, authorization_exports as u, ProviderTargetEvidence as v, project as w, authorizationError as x, StoredConnection as y };
 
-//# sourceMappingURL=canonical-json-9x7gHIoS.mjs.map
+//# sourceMappingURL=canonical-json-CQYKsZw7.mjs.map

package/dist/canonical-json-CQYKsZw7.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json-CQYKsZw7.mjs","names":["Error","S","Schema","decode","InvalidInputError","S","DomainName.Schema","decode","InvalidInputError","validate","encode","DomainName.parse","InvalidInputError","decode","encode","S","Schema","ProviderContext.Envelope","InvalidInputError","ProviderAuthorization.Schema","Connection.StoredConnection","Connection.DomainAttachment","Error"],"sources":["../src/invalid-input.ts","../src/domain/domain-name.ts","../src/auth/connection.ts","../src/auth/provider-context.ts","../src/auth/authorization.ts","../src/auth/lifecycle-repository.ts","../src/plan/canonical-json.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport class Error extends Schema.TaggedError<Error>()(\"InvalidInputError\", {\n  message: Schema.String,\n}) {}\n","import { Effect, Schema as S, SchemaIssue, SchemaTransformation } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\nconst labelPattern = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;\n\nconst Type = S.String.check(\n  S.makeFilter<string>(\n    (value) =>\n      value.length <= 253 &&\n      value.includes(\".\") &&\n      value.split(\".\").every((label) => labelPattern.test(label))\n        ? undefined\n        : \"Expected a fully qualified DNS name\",\n    { identifier: \"DomainName\" },\n  ),\n).pipe(S.brand(\"DomainName\"));\n\n/** A lower-case, fully qualified DNS name without a trailing dot. */\nexport type DomainName = typeof Type.Type;\n\n/** Decodes user and wire strings into canonical domain names. */\nexport const Schema = S.String.pipe(\n  S.decodeTo(\n    Type,\n    SchemaTransformation.transformOrFail({\n      decode: (input, options) =>\n        Effect.try({\n          try: () => normalize(input),\n          catch: (cause) =>\n            new SchemaIssue.InvalidValue(\n              { message: cause instanceof Error ? cause.message : String(cause) },\n              input,\n              options,\n            ),\n        }),\n      encode: (domain) => Effect.succeed(domain),\n    }),\n  ),\n);\n\nexport const decode = Effect.fn(\"DomainName.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport function parse(input: unknown): DomainName {\n  try {\n    return S.decodeUnknownSync(Schema)(input);\n  } catch (cause) {\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n}\n\nfunction normalize(input: string): string {\n  const labels = input\n    .trim()\n    .replace(/\\.+$/, \"\")\n    .split(\".\")\n    .map((label) => {\n      if (label.includes(\"_\") || [...label].every((character) => character.charCodeAt(0) <= 127)) {\n        return label.toLowerCase();\n      }\n      const hostname = new URL(`http://${label}.example`).hostname;\n      const normalized = hostname.split(\".\")[0];\n      if (normalized === undefined) throw new Error(\"Domain label could not be normalized\");\n      return normalized.toLowerCase();\n    });\n  return labels.join(\".\");\n}\n","import { Effect, Schema as S } from \"effect\";\n\nimport * as DomainName from \"../domain/domain-name.ts\";\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type { OAuthMethod } from \"./manifest.ts\";\nimport type * as ProviderAuthorization from \"./authorization.ts\";\nimport type { Value as Secret } from \"./secret.ts\";\n\n/** A provider account and authoritative zone selected for one domain attachment. */\nexport const ProviderTargetEvidence = S.Struct({\n  /** The account display name observed during discovery, when the provider exposes one. */\n  accountName: S.optionalKey(S.String),\n  /** Nameserver and provider-state evidence observed during discovery. */\n  nameservers: S.Array(DomainName.Schema),\n  status: S.String,\n  /** Provider-specific authoritative-zone type, such as Cloudflare's `full` or Vercel's `external`. */\n  zoneType: S.String,\n});\nexport interface ProviderTargetEvidence extends S.Schema.Type<typeof ProviderTargetEvidence> {}\n\nexport const ProviderTarget = S.Struct({\n  accountId: S.String,\n  accountKind: S.NullOr(S.Literals([\"account\", \"personal\", \"team\"])),\n  evidence: S.optionalKey(ProviderTargetEvidence),\n  zoneId: S.String,\n  zoneName: DomainName.Schema,\n});\nexport interface ProviderTarget extends S.Schema.Type<typeof ProviderTarget> {}\n\n/** The lifecycle state visible to a host for an organization connection. */\nexport const ConnectionStatus = S.Literals([\"active\", \"expired\", \"revocation-pending\"]);\nexport type ConnectionStatus = typeof ConnectionStatus.Type;\n\n/** An organization-scoped provider connection. */\nexport const ProviderConnection = S.Struct({\n  createdAt: S.DateFromString,\n  id: S.String,\n  method: S.Literals([\"integration\", \"oauth2\", \"token\"]),\n  ownerId: S.String,\n  providerId: S.String,\n  status: ConnectionStatus,\n});\nexport interface ProviderConnection extends S.Schema.Type<typeof ProviderConnection> {}\n\n/** An exact provider target attached to one organization domain. */\nexport const DomainAttachment = S.Struct({\n  connectionId: S.String,\n  createdAt: S.DateFromString,\n  domain: DomainName.Schema,\n  id: S.String,\n  target: ProviderTarget,\n});\nexport interface DomainAttachment extends S.Schema.Type<typeof DomainAttachment> {}\n\n/** Internal connection row; the authorization id is intentionally not part of the public shape. */\nexport const StoredConnection = S.Struct({\n  authorizationId: S.String,\n  createdAt: S.DateFromString,\n  id: S.String,\n  method: S.Literals([\"integration\", \"oauth2\", \"token\"]),\n  ownerId: S.String,\n  providerId: S.String,\n});\nexport interface StoredConnection extends S.Schema.Type<typeof StoredConnection> {}\n\n/** Internal credential material retained by the host's persistence implementation. */\nexport interface StoredCredential {\n  readonly accessToken: Secret;\n  readonly expiresAt: Date | null;\n  readonly refreshToken: Secret | null;\n  readonly tokenType: string;\n}\n\n/** The provider context carried through an interactive connection continuation. */\nexport interface OAuthContinuation {\n  readonly clientId: string;\n  readonly codeVerifier: Secret;\n  readonly expiresAt: Date;\n  readonly authorizationId?: string;\n  readonly method: OAuthMethod;\n  readonly ownerId: string;\n  readonly redirectUri: string;\n  readonly stateHash: string;\n  readonly authorizedById: string;\n}\n\nexport class AuthorizationError extends S.TaggedError<AuthorizationError>()(\"AuthorizationError\", {\n  category: S.Literal(\"authorization\"),\n  message: S.String,\n  operation: S.String,\n  retry: S.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport const authorizationError = (message: string, operation: string): AuthorizationError =>\n  new AuthorizationError({\n    category: \"authorization\",\n    message,\n    operation,\n    retry: \"after-user-action\",\n  });\n\n/** Decode a public connection snapshot returned by a host. */\nexport const decode = Effect.fn(\"ProviderConnection.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(ProviderConnection)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"ProviderConnection.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(ProviderConnection))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(ProviderConnection);\n\n/** Derive a public connection projection from its private authorization state. */\nexport function project(\n  connection: StoredConnection,\n  authorization: ProviderAuthorization.ProviderAuthorization,\n  credential: StoredCredential,\n  now = new Date(),\n): ProviderConnection {\n  const status: ConnectionStatus =\n    authorization.revocation._tag === \"Pending\"\n      ? \"revocation-pending\"\n      : credential.refreshToken === null &&\n          credential.expiresAt !== null &&\n          (Number.isNaN(credential.expiresAt.valueOf()) || credential.expiresAt <= now)\n        ? \"expired\"\n        : \"active\";\n  return {\n    createdAt: connection.createdAt,\n    id: connection.id,\n    method: connection.method,\n    ownerId: connection.ownerId,\n    providerId: connection.providerId,\n    status,\n  };\n}\n\n/** Assert that an exact attachment is usable for one DNS operation. */\nexport function assertAttachment(input: {\n  readonly attachment: DomainAttachment;\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly capability: ProviderAuthorization.Capability;\n  readonly connection: StoredConnection | ProviderConnection;\n  readonly credential?: StoredCredential;\n  readonly domain: string;\n  readonly now?: Date;\n  readonly providerId: string;\n}): DomainName.DomainName {\n  const credentialStatus =\n    \"status\" in input.connection\n      ? input.connection.status\n      : input.credential === undefined\n        ? null\n        : project(input.connection, input.authorization, input.credential, input.now).status;\n  if (\n    input.connection.providerId !== input.providerId ||\n    input.authorization.providerId !== input.providerId ||\n    input.authorization.revocation._tag !== \"Active\" ||\n    input.attachment.connectionId !== input.connection.id ||\n    credentialStatus !== \"active\"\n  ) {\n    throw authorizationError(\n      \"Domain attachment is not active for this provider\",\n      \"Connection.assertAttachment\",\n    );\n  }\n  if (!input.authorization.requiredCapabilities.includes(input.capability)) {\n    throw authorizationError(\n      `Provider authorization lacks the ${input.capability} capability`,\n      \"Connection.assertAttachment\",\n    );\n  }\n  if (\n    !input.authorization.capabilityEvidence.some((item) => item.capability === input.capability)\n  ) {\n    throw authorizationError(\n      `Provider authorization has no evidence for the ${input.capability} capability`,\n      \"Connection.assertAttachment\",\n    );\n  }\n  let domain: DomainName.DomainName;\n  try {\n    domain = DomainName.parse(input.domain);\n  } catch (cause) {\n    if (cause instanceof InvalidInputError) throw cause;\n    throw new InvalidInputError({\n      message: cause instanceof Error ? cause.message : String(cause),\n    });\n  }\n  if (input.attachment.domain !== domain && !domain.endsWith(`.${input.attachment.domain}`)) {\n    throw authorizationError(\n      \"Domain attachment does not match the requested domain\",\n      \"Connection.assertAttachment\",\n    );\n  }\n  return domain;\n}\n","import { Effect, Schema } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\n\n/** A provider-owned, versioned, non-secret context value persisted by the host. */\nexport const Envelope = Schema.Struct({\n  value: Schema.Json,\n  version: Schema.String,\n});\nexport interface Envelope extends Schema.Schema.Type<typeof Envelope> {}\n\nexport interface Codec<A> {\n  readonly decode: (envelope: Envelope) => Effect.Effect<A, InvalidInputError>;\n  readonly encode: (value: A) => Effect.Effect<Envelope, InvalidInputError>;\n  readonly version: string;\n}\n\n/** Build an adapter-owned context codec from a schema and stable version identifier. */\nexport function codec<A, I>(version: string, schema: Schema.Codec<A, I>): Codec<A> {\n  return {\n    decode: Effect.fn(\"ProviderContext.decode\")((envelope) =>\n      envelope.version !== version\n        ? Effect.fail(\n            new InvalidInputError({\n              message: `Unsupported provider context version: ${envelope.version}`,\n            }),\n          )\n        : Schema.decodeUnknownEffect(schema)(envelope.value).pipe(\n            Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n          ),\n    ),\n    encode: Effect.fn(\"ProviderContext.encode\")((value) =>\n      Schema.encodeEffect(schema)(value).pipe(\n        Effect.flatMap((encoded) => Schema.decodeUnknownEffect(Schema.Json)(encoded)),\n        Effect.map((encoded) => ({ value: encoded, version })),\n        Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n      ),\n    ),\n    version,\n  };\n}\n\nexport const decode = Effect.fn(\"ProviderContext.Envelope.decode\")((input: unknown) =>\n  Schema.decodeUnknownEffect(Envelope)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = Schema.encodeSync(Envelope);\n","import { Data, Effect, Schema as S } from \"effect\";\n\nimport { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport * as ProviderContext from \"./provider-context.ts\";\n\nexport const Capability = S.Literals([\"dns:read\", \"dns:write\"]);\nexport type Capability = typeof Capability.Type;\n\nexport type Evidence = Data.TaggedEnum<{\n  Declared: {};\n  Exercised: { readonly observedAt: Date };\n  Introspected: { readonly observedAt: Date };\n}>;\nexport const Evidence = Data.taggedEnum<Evidence>();\n\nexport const EvidenceSchema = S.TaggedUnion({\n  Declared: {},\n  Exercised: { observedAt: S.DateFromString },\n  Introspected: { observedAt: S.DateFromString },\n});\n\nexport const CapabilityEvidence = S.Struct({\n  capability: Capability,\n  evidence: EvidenceSchema,\n});\nexport interface CapabilityEvidence extends S.Schema.Type<typeof CapabilityEvidence> {}\n\nconst RevocationSchema = S.TaggedUnion({\n  Active: {},\n  Pending: { requestedAt: S.DateFromString },\n});\n/** Revocation state schema and callable constructors for trusted lifecycle values. */\nexport const Revocation = {\n  Schema: RevocationSchema,\n  Active: () => RevocationSchema.cases.Active.make({}),\n  Pending: (input: Parameters<typeof RevocationSchema.cases.Pending.make>[0]) =>\n    RevocationSchema.cases.Pending.make(input),\n};\nexport type Revocation = typeof RevocationSchema.Type;\n\n/** A provider credential authorization shared by one or more organization connections. */\nexport const Schema = S.Struct({\n  authorizedById: S.String,\n  capabilityEvidence: S.Array(CapabilityEvidence),\n  createdAt: S.DateFromString,\n  id: S.String,\n  method: S.Literals([\"integration\", \"oauth2\", \"token\"]),\n  providerContext: ProviderContext.Envelope,\n  providerId: S.String,\n  requiredCapabilities: S.Array(Capability),\n  revocation: Revocation.Schema,\n  scopes: S.Array(S.String),\n});\nexport interface ProviderAuthorization extends S.Schema.Type<typeof Schema> {}\n\nexport const decode = Effect.fn(\"ProviderAuthorization.decode\")((input: unknown) =>\n  S.decodeUnknownEffect(Schema)(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const validate = Effect.fn(\"ProviderAuthorization.validate\")((input: unknown) =>\n  S.decodeUnknownEffect(S.toType(Schema))(input).pipe(\n    Effect.mapError((cause) => new InvalidInputError({ message: cause.message })),\n  ),\n);\n\nexport const encode = S.encodeSync(Schema);\n\nexport function evidenceFor(\n  authorization: ProviderAuthorization,\n  capability: Capability,\n): Evidence | undefined {\n  return authorization.capabilityEvidence.find((item) => item.capability === capability)?.evidence;\n}\n","import { Context, Effect, Schema } from \"effect\";\n\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport * as Connection from \"./connection.ts\";\n\n/** Private aggregate owned by the managed-DNS persistence capability. */\nexport interface Aggregate {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connections: ReadonlyArray<Connection.StoredConnection>;\n  readonly attachments: ReadonlyArray<Connection.DomainAttachment>;\n  readonly credential: Connection.StoredCredential;\n}\n\n/** Serializable durable state. Credential material is deliberately sealed separately. */\nexport const AggregateSchema = Schema.Struct({\n  authorization: ProviderAuthorization.Schema,\n  connections: Schema.Array(Connection.StoredConnection),\n  attachments: Schema.Array(Connection.DomainAttachment),\n});\n\nexport interface ConnectInput {\n  readonly authorization: ProviderAuthorization.ProviderAuthorization;\n  readonly connection: Connection.StoredConnection;\n  readonly credential: Connection.StoredCredential;\n  /** The authorization id observed before building a reuse update, if any. */\n  readonly expectedAuthorizationId?: string;\n  /** The owner connection id observed before building a reuse update, if any. */\n  readonly expectedConnectionId?: string;\n}\n\nexport interface AttachmentResult {\n  readonly attachment: Connection.DomainAttachment;\n  readonly connection: Connection.ProviderConnection;\n}\n\nexport interface DetachResult {\n  readonly attachment: Connection.DomainAttachment;\n  readonly connection: Connection.ProviderConnection;\n  readonly remainingAttachments: number;\n}\n\nexport interface DisconnectResult {\n  readonly connection: Connection.ProviderConnection;\n  readonly remainingConnections: number;\n  readonly revokedAuthorization: boolean;\n}\n\nexport class Error extends Schema.TaggedError<Error>()(\"ManagedDnsLifecycleError\", {\n  category: Schema.Literal(\"storage\"),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\n/**\n * Persistence capability for the managed-DNS model.\n *\n * Implementations own the atomic aggregate containing one provider credential authorization,\n * organization connections, and exact domain attachments. Provider authorization is deliberately\n * an implementation detail of the capability; public callers operate on the projections returned\n * by the connection and attachment methods.\n */\nexport interface Interface {\n  readonly attach: (input: {\n    readonly attachment: Connection.DomainAttachment;\n    readonly connectionId: string;\n    readonly ownerId: string;\n  }) => Effect.Effect<AttachmentResult, Error>;\n  readonly connect: (input: ConnectInput) => Effect.Effect<Aggregate, Error>;\n  readonly detach: (input: {\n    readonly attachmentId: string;\n    readonly ownerId: string;\n  }) => Effect.Effect<DetachResult, Error>;\n  readonly disconnect: <E>(input: {\n    readonly connectionId: string;\n    readonly ownerId: string;\n    readonly revoke: (\n      authorization: ProviderAuthorization.ProviderAuthorization,\n    ) => Effect.Effect<void, E>;\n  }) => Effect.Effect<DisconnectResult, Error | E>;\n  readonly findConnection: (\n    ownerId: string,\n    authorizationId: string,\n  ) => Effect.Effect<Connection.StoredConnection | null, Error>;\n  readonly get: (authorizationId: string) => Effect.Effect<Aggregate | null, Error>;\n  readonly getAttachment: (\n    attachmentId: string,\n  ) => Effect.Effect<Connection.DomainAttachment | null, Error>;\n  readonly getByConnectionId: (connectionId: string) => Effect.Effect<Aggregate | null, Error>;\n  readonly listAttachments: (\n    connectionId: string,\n    ownerId: string,\n  ) => Effect.Effect<ReadonlyArray<Connection.DomainAttachment>, Error>;\n  readonly promoteEvidence: (\n    authorizationId: string,\n    evidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  ) => Effect.Effect<Aggregate, Error>;\n  readonly recover: <E>(input: {\n    readonly authorizationId: string;\n    readonly revoke: (\n      authorization: ProviderAuthorization.ProviderAuthorization,\n    ) => Effect.Effect<void, E>;\n  }) => Effect.Effect<DisconnectResult, Error | E>;\n  readonly rotate: (\n    authorizationId: string,\n    credential: Connection.StoredCredential,\n  ) => Effect.Effect<Aggregate, Error>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\n  \"@domainkit/ManagedDnsConnections\",\n) {}\n","import { Crypto, Effect, Layer, PlatformError, Schema } from \"effect\";\n\nexport class CryptoError extends Schema.TaggedError<CryptoError>()(\"CryptoError\", {\n  message: Schema.String,\n}) {}\n\nexport type Json =\n  | null\n  | boolean\n  | number\n  | string\n  | ReadonlyArray<Json>\n  | { readonly [key: string]: Json };\n\n/** Deterministic JSON serialization for already schema-encoded protocol values. */\nexport function stringify(value: Json): string {\n  if (value === null || typeof value !== \"object\") {\n    const encoded = JSON.stringify(value);\n    if (encoded === undefined) throw new TypeError(\"Value is not representable as JSON\");\n    return encoded;\n  }\n  if (isJsonArray(value)) return `[${value.map(stringify).join(\",\")}]`;\n  return `{${Object.entries(value)\n    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n    .map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`)\n    .join(\",\")}}`;\n}\n\nfunction isJsonArray(value: Json): value is ReadonlyArray<Json> {\n  return Array.isArray(value);\n}\n\nexport const sha256Text = Effect.fn(\"Digest.sha256Text\")(function* (value: string) {\n  const cryptoService = yield* Crypto.Crypto;\n  const digest = yield* cryptoService\n    .digest(\"SHA-256\", new TextEncoder().encode(value))\n    .pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));\n  return [...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n});\n\nexport const sha256Json = Effect.fn(\"Digest.sha256Json\")((value: Json) =>\n  Effect.try({\n    try: () => stringify(value),\n    catch: (cause) =>\n      new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) }),\n  }).pipe(Effect.flatMap(sha256Text)),\n);\n\nfunction sha256EncodedProgram<S extends Schema.Constraint>(\n  schema: S,\n  value: S[\"Type\"],\n): Effect.Effect<string, CryptoError, Crypto.Crypto | S[\"EncodingServices\"]> {\n  return Schema.encodeEffect(schema)(value).pipe(\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)),\n    Effect.mapError((cause) => new CryptoError({ message: cause.message })),\n    Effect.flatMap(sha256Json),\n  );\n}\n\nexport const sha256Encoded = Effect.fn(\"Digest.sha256Encoded\")(sha256EncodedProgram);\n\n/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */\nexport const webCryptoLayer: Layer.Layer<Crypto.Crypto> = Layer.succeed(\n  Crypto.Crypto,\n  Crypto.make({\n    randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: async () => {\n          const bytes = new Uint8Array(data.byteLength);\n          bytes.set(data);\n          return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));\n        },\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"WebCrypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }),\n  }),\n);\n"],"mappings":";;;;AAEA,IAAaA,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,qBAAqB,EAC1E,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;;;;;;;ACAJ,MAAM,eAAe;AAErB,MAAM,OAAOC,OAAE,OAAO,MACpBA,OAAE,YACC,UACC,MAAM,UAAU,OAChB,MAAM,SAAS,GAAG,KAClB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,UAAU,aAAa,KAAK,KAAK,CAAC,IACtD,KAAA,IACA,uCACN,EAAE,YAAY,aAAa,CAC7B,CACF,CAAC,CAAC,KAAKA,OAAE,MAAM,YAAY,CAAC;;AAM5B,MAAaC,WAASD,OAAE,OAAO,KAC7BA,OAAE,SACA,MACA,qBAAqB,gBAAgB;CACnC,SAAS,OAAO,YACd,OAAO,IAAI;EACT,WAAW,UAAU,KAAK;EAC1B,QAAQ,UACN,IAAI,YAAY,aACd,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAClE,OACA,OACF;CACJ,CAAC;CACH,SAAS,WAAW,OAAO,QAAQ,MAAM;AAC3C,CAAC,CACH,CACF;AAEA,MAAaE,WAAS,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACpDF,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,SAAgB,MAAM,OAA4B;CAChD,IAAI;EACF,OAAOH,OAAE,kBAAkBC,QAAM,CAAC,CAAC,KAAK;CAC1C,SAAS,OAAO;EACd,MAAM,IAAIE,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;AACF;AAEA,SAAS,UAAU,OAAuB;CAcxC,OAbe,MACZ,KAAK,CAAC,CACN,QAAQ,QAAQ,EAAE,CAAC,CACnB,MAAM,GAAG,CAAC,CACV,KAAK,UAAU;EACd,IAAI,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,cAAc,UAAU,WAAW,CAAC,KAAK,GAAG,GACvF,OAAO,MAAM,YAAY;EAG3B,MAAM,aADW,IAAI,IAAI,UAAU,MAAM,SAAS,CAAC,CAAC,SACxB,MAAM,GAAG,CAAC,CAAC;EACvC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,OAAO,WAAW,YAAY;CAChC,CACU,CAAC,CAAC,KAAK,GAAG;AACxB;;;;AC/DA,MAAa,yBAAyBC,OAAE,OAAO;;CAE7C,aAAaA,OAAE,YAAYA,OAAE,MAAM;;CAEnC,aAAaA,OAAE,MAAMC,QAAiB;CACtC,QAAQD,OAAE;;CAEV,UAAUA,OAAE;AACd,CAAC;AAGD,MAAa,iBAAiBA,OAAE,OAAO;CACrC,WAAWA,OAAE;CACb,aAAaA,OAAE,OAAOA,OAAE,SAAS;EAAC;EAAW;EAAY;CAAM,CAAC,CAAC;CACjE,UAAUA,OAAE,YAAY,sBAAsB;CAC9C,QAAQA,OAAE;CACV,UAAUC;AACZ,CAAC;;AAID,MAAa,mBAAmBD,OAAE,SAAS;CAAC;CAAU;CAAW;AAAoB,CAAC;;AAItF,MAAa,qBAAqBA,OAAE,OAAO;CACzC,WAAWA,OAAE;CACb,IAAIA,OAAE;CACN,QAAQA,OAAE,SAAS;EAAC;EAAe;EAAU;CAAO,CAAC;CACrD,SAASA,OAAE;CACX,YAAYA,OAAE;CACd,QAAQ;AACV,CAAC;;AAID,MAAa,mBAAmBA,OAAE,OAAO;CACvC,cAAcA,OAAE;CAChB,WAAWA,OAAE;CACb,QAAQC;CACR,IAAID,OAAE;CACN,QAAQ;AACV,CAAC;;AAID,MAAa,mBAAmBA,OAAE,OAAO;CACvC,iBAAiBA,OAAE;CACnB,WAAWA,OAAE;CACb,IAAIA,OAAE;CACN,QAAQA,OAAE,SAAS;EAAC;EAAe;EAAU;CAAO,CAAC;CACrD,SAASA,OAAE;CACX,YAAYA,OAAE;AAChB,CAAC;AAwBD,IAAa,qBAAb,cAAwCA,OAAE,YAAgC,CAAC,CAAC,sBAAsB;CAChG,UAAUA,OAAE,QAAQ,eAAe;CACnC,SAASA,OAAE;CACX,WAAWA,OAAE;CACb,OAAOA,OAAE,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AACrE,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,sBAAsB,SAAiB,cAClD,IAAI,mBAAmB;CACrB,UAAU;CACV;CACA;CACA,OAAO;AACT,CAAC;;AAGH,MAAaE,WAAS,OAAO,GAAG,2BAA2B,CAAC,EAAE,UAC5DF,OAAE,oBAAoB,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,KAC/C,OAAO,UAAU,UAAU,IAAIG,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaC,aAAW,OAAO,GAAG,6BAA6B,CAAC,EAAE,UAChEJ,OAAE,oBAAoBA,OAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACzD,OAAO,UAAU,UAAU,IAAIG,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAASL,OAAE,WAAW,kBAAkB;;AAGrD,SAAgB,QACd,YACA,eACA,YACA,sBAAM,IAAI,KAAK,GACK;CACpB,MAAM,SACJ,cAAc,WAAW,SAAS,YAC9B,uBACA,WAAW,iBAAiB,QAC1B,WAAW,cAAc,SACxB,OAAO,MAAM,WAAW,UAAU,QAAQ,CAAC,KAAK,WAAW,aAAa,OACzE,YACA;CACR,OAAO;EACL,WAAW,WAAW;EACtB,IAAI,WAAW;EACf,QAAQ,WAAW;EACnB,SAAS,WAAW;EACpB,YAAY,WAAW;EACvB;CACF;AACF;;AAGA,SAAgB,iBAAiB,OASP;CACxB,MAAM,mBACJ,YAAY,MAAM,aACd,MAAM,WAAW,SACjB,MAAM,eAAe,KAAA,IACnB,OACA,QAAQ,MAAM,YAAY,MAAM,eAAe,MAAM,YAAY,MAAM,GAAG,CAAC,CAAC;CACpF,IACE,MAAM,WAAW,eAAe,MAAM,cACtC,MAAM,cAAc,eAAe,MAAM,cACzC,MAAM,cAAc,WAAW,SAAS,YACxC,MAAM,WAAW,iBAAiB,MAAM,WAAW,MACnD,qBAAqB,UAErB,MAAM,mBACJ,qDACA,6BACF;CAEF,IAAI,CAAC,MAAM,cAAc,qBAAqB,SAAS,MAAM,UAAU,GACrE,MAAM,mBACJ,oCAAoC,MAAM,WAAW,cACrD,6BACF;CAEF,IACE,CAAC,MAAM,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,MAAM,UAAU,GAE3F,MAAM,mBACJ,kDAAkD,MAAM,WAAW,cACnE,6BACF;CAEF,IAAI;CACJ,IAAI;EACF,SAASM,MAAiB,MAAM,MAAM;CACxC,SAAS,OAAO;EACd,IAAI,iBAAiBH,SAAmB,MAAM;EAC9C,MAAM,IAAIA,QAAkB,EAC1B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC;CACH;CACA,IAAI,MAAM,WAAW,WAAW,UAAU,CAAC,OAAO,SAAS,IAAI,MAAM,WAAW,QAAQ,GACtF,MAAM,mBACJ,yDACA,6BACF;CAEF,OAAO;AACT;;;;;;;;;;ACnMA,MAAa,WAAW,OAAO,OAAO;CACpC,OAAO,OAAO;CACd,SAAS,OAAO;AAClB,CAAC;;AAUD,SAAgB,MAAY,SAAiB,QAAsC;CACjF,OAAO;EACL,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,aAC3C,SAAS,YAAY,UACjB,OAAO,KACL,IAAII,QAAkB,EACpB,SAAS,yCAAyC,SAAS,UAC7D,CAAC,CACH,IACA,OAAO,oBAAoB,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KACjD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACN;EACA,QAAQ,OAAO,GAAG,wBAAwB,CAAC,EAAE,UAC3C,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACjC,OAAO,SAAS,YAAY,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,GAC5E,OAAO,KAAK,aAAa;GAAE,OAAO;GAAS;EAAQ,EAAE,GACrD,OAAO,UAAU,UAAU,IAAIA,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;EACA;CACF;AACF;AAEA,MAAaC,WAAS,OAAO,GAAG,iCAAiC,CAAC,EAAE,UAClE,OAAO,oBAAoB,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU,UAAU,IAAID,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAaE,WAAS,OAAO,WAAW,QAAQ;;;;;;;;;;;;;;;AC3ChD,MAAa,aAAaC,OAAE,SAAS,CAAC,YAAY,WAAW,CAAC;AAQ9D,MAAa,WAAW,KAAK,WAAqB;AAElD,MAAa,iBAAiBA,OAAE,YAAY;CAC1C,UAAU,CAAC;CACX,WAAW,EAAE,YAAYA,OAAE,eAAe;CAC1C,cAAc,EAAE,YAAYA,OAAE,eAAe;AAC/C,CAAC;AAED,MAAa,qBAAqBA,OAAE,OAAO;CACzC,YAAY;CACZ,UAAU;AACZ,CAAC;AAGD,MAAM,mBAAmBA,OAAE,YAAY;CACrC,QAAQ,CAAC;CACT,SAAS,EAAE,aAAaA,OAAE,eAAe;AAC3C,CAAC;;AAED,MAAa,aAAa;CACxB,QAAQ;CACR,cAAc,iBAAiB,MAAM,OAAO,KAAK,CAAC,CAAC;CACnD,UAAU,UACR,iBAAiB,MAAM,QAAQ,KAAK,KAAK;AAC7C;;AAIA,MAAaC,WAASD,OAAE,OAAO;CAC7B,gBAAgBA,OAAE;CAClB,oBAAoBA,OAAE,MAAM,kBAAkB;CAC9C,WAAWA,OAAE;CACb,IAAIA,OAAE;CACN,QAAQA,OAAE,SAAS;EAAC;EAAe;EAAU;CAAO,CAAC;CACrD,iBAAiBE;CACjB,YAAYF,OAAE;CACd,sBAAsBA,OAAE,MAAM,UAAU;CACxC,YAAY,WAAW;CACvB,QAAQA,OAAE,MAAMA,OAAE,MAAM;AAC1B,CAAC;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,EAAE,UAC/DA,OAAE,oBAAoBC,QAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACnC,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,WAAW,OAAO,GAAG,gCAAgC,CAAC,EAAE,UACnEH,OAAE,oBAAoBA,OAAE,OAAOC,QAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,UAAU,UAAU,IAAIE,QAAkB,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAC9E,CACF;AAEA,MAAa,SAASH,OAAE,WAAWC,QAAM;AAEzC,SAAgB,YACd,eACA,YACsB;CACtB,OAAO,cAAc,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CAAC,EAAE;AAC1F;;;;AC5DA,MAAa,kBAAkB,OAAO,OAAO;CAC3C,eAAeG;CACf,aAAa,OAAO,MAAMC,gBAA2B;CACrD,aAAa,OAAO,MAAMC,gBAA2B;AACvD,CAAC;AA6BD,IAAaC,UAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,4BAA4B;CACjF,UAAU,OAAO,QAAQ,SAAS;CAClC,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAyDJ,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAChE,kCACF,CAAC,CAAC,CAAC;;;;;;;;;;;AC7GH,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe,EAChF,SAAS,OAAO,OAClB,CAAC,CAAC,CAAC,CAAC;;AAWJ,SAAgB,UAAU,OAAqB;CAC7C,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,MAAM,UAAU,KAAK,UAAU,KAAK;EACpC,IAAI,YAAY,KAAA,GAAW,MAAM,IAAI,UAAU,oCAAoC;EACnF,OAAO;CACT;CACA,IAAI,YAAY,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,EAAE;CAClE,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,CAAC,CACrE,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,UAAU,KAAK,GAAG,CAAC,CACnE,KAAK,GAAG,EAAE;AACf;AAEA,SAAS,YAAY,OAA2C;CAC9D,OAAO,MAAM,QAAQ,KAAK;AAC5B;AAEA,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAe;CAKjF,OAAO,CAAC,GAAG,QAHW,OADO,OAAO,OAAA,CAEjC,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAClD,KAAK,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,CAC9D,CAAC,CAAC,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC9E,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,EAAE,UACxD,OAAO,IAAI;CACT,WAAW,UAAU,KAAK;CAC1B,QAAQ,UACN,IAAI,YAAY,EAAE,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,UAAU,CAAC,CACpC;AAEA,SAAS,qBACP,QACA,OAC2E;CAC3E,OAAO,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,OAAO,oBAAoB,OAAO,IAAI,CAAC,GACtD,OAAO,UAAU,UAAU,IAAI,YAAY,EAAE,SAAS,MAAM,QAAQ,CAAC,CAAC,GACtE,OAAO,QAAQ,UAAU,CAC3B;AACF;AAEA,MAAa,gBAAgB,OAAO,GAAG,sBAAsB,CAAC,CAAC,oBAAoB;;AAGnF,MAAa,iBAA6C,MAAM,QAC9D,OAAO,QACP,OAAO,KAAK;CACV,cAAc,SAAS,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAClE,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,KAAK,YAAY;GACf,MAAM,QAAQ,IAAI,WAAW,KAAK,UAAU;GAC5C,MAAM,IAAI,IAAI;GACd,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,MAAM,MAAM,CAAC;EAC3E;EACA,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC;AACL,CAAC,CACH"}

package/dist/{connect-Db830jad.d.mts → connect-10vHuShV.d.mts}

@@ -214,8 +214,7 @@ declare const A: Schema.TaggedStruct<"A", {
 type DnsRecord = typeof Schema$3.Type;
 type Encoded = typeof Schema$3.Encoded;
 /** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
-declare const Opaque: Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
+declare const Opaque: Schema.TaggedStruct<"Opaque", {
   readonly name: Schema.String;
   readonly providerRecordId: Schema.NullOr<Schema.String>;
   readonly providerType: Schema.String;
@@ -317,8 +316,7 @@ declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
     readonly ttl: Schema.NullOr<Schema.Int>;
     readonly value: Schema.String;
   }>;
-}>, Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
+}>, Schema.TaggedStruct<"Opaque", {
   readonly name: Schema.String;
   readonly providerRecordId: Schema.NullOr<Schema.String>;
   readonly providerType: Schema.String;
@@ -683,13 +681,29 @@ declare const CapabilityEvidence: Schema.Struct<{
   }>;
 }>;
 interface CapabilityEvidence extends Schema.Schema.Type<typeof CapabilityEvidence> {}
-declare const Revocation: Schema.TaggedUnion<{
+declare const RevocationSchema: Schema.TaggedUnion<{
   readonly Active: Schema.TaggedStruct<"Active", {}>;
   readonly Pending: Schema.TaggedStruct<"Pending", {
     readonly requestedAt: Schema.DateFromString;
   }>;
 }>;
-type Revocation = typeof Revocation.Type;
+/** Revocation state schema and callable constructors for trusted lifecycle values. */
+declare const Revocation: {
+  Schema: Schema.TaggedUnion<{
+    readonly Active: Schema.TaggedStruct<"Active", {}>;
+    readonly Pending: Schema.TaggedStruct<"Pending", {
+      readonly requestedAt: Schema.DateFromString;
+    }>;
+  }>;
+  Active: () => {
+    readonly _tag: "Active";
+  };
+  Pending: (input: Parameters<typeof RevocationSchema.cases.Pending.make>[0]) => {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+};
+type Revocation = typeof RevocationSchema.Type;
 /** A provider credential authorization shared by one or more organization connections. */
 declare const Schema$1: Schema.Struct<{
   readonly authorizedById: Schema.String;
@@ -1384,4 +1398,4 @@ declare const complete: (input: CompleteInput) => Effect.Effect<ProviderConnecti
 type Failure = AuthenticationFailure | Error$1 | CryptoError;
 //#endregion
 export { Schema$2 as $, ConnectionStatus as A, Schema$4 as At, project as B, ConnectInput as C, Txt as Ct, Interface as D, equals as Dt, Error$1 as E, dns_record_d_exports as Et, StoredConnection as F, authorization_d_exports as G, Capability as H, StoredCredential as I, Manifest as J, AsyncOAuthSubjectResolver as K, authorizationError as L, ProviderConnection as M, parse$1 as Mt, ProviderTarget as N, Error$3 as Nt, Service as O, parse as Ot, ProviderTargetEvidence as P, invalid_input_d_exports as Pt, OAuthSubjectResolver as Q, decode$1 as R, AttachmentResult as S, Srv as St, DisconnectResult as T, data as Tt, CapabilityEvidence as U, validate as V, ProviderAuthorization as W, OAuthClientConfiguration as X, Method$1 as Y, OAuthMethod as Z, provider_context_d_exports as _, Ns as _t, Continuation as a, CreateResult as at, Aggregate as b, RequirementMetadata as bt, Failure as c, Service$1 as ct, Method as d, Aaaa as dt, TokenValidation as et, StartResult as f, Caa as ft, Envelope as g, Mx as gt, Codec as h, Encoded as ht, CompleteInput as i, AsyncInterface as it, DomainAttachment as j, domain_name_d_exports as jt, AuthorizationError as k, DomainName as kt, InteractiveFlow as l, provider_d_exports as lt, start as m, DnsRecord as mt, AuthenticationFailure as n, Value as nt, ContinuationStore as o, Error$2 as ot, complete as p, Cname as pt, IntegrationMethod as q, BaseInput as r, secret_d_exports as rt, Error as s, Interface$1 as st, Authentication as t, manifest_d_exports as tt, InteractiveStart as u, A as ut, CryptoError as v, Observed as vt, DetachResult as w, Type as wt, AggregateSchema as x, Schema$3 as xt, canonical_json_d_exports as y, Opaque as yt, encode$1 as z };
-//# sourceMappingURL=connect-Db830jad.d.mts.map
+//# sourceMappingURL=connect-10vHuShV.d.mts.map

package/dist/{connect-ks3cpqBD.mjs → connect-oI8hcMxc.mjs}

@@ -1,4 +1,4 @@
-import { C as project, s as Service } from "./canonical-json-9x7gHIoS.mjs";
+import { l as Revocation, s as Service, w as project } from "./canonical-json-CQYKsZw7.mjs";
 import { Clock, Crypto, Data, Effect, Schema } from "effect";
 //#region src/auth/connect.ts
 const Method = Data.taggedEnum();
@@ -67,7 +67,7 @@ const connect = Effect.fn("Connection.connect")(function* (input) {
 		providerContext: input.authentication.providerContext,
 		providerId: input.providerId,
 		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: { _tag: "Active" },
+		revocation: Revocation.Active(),
 		scopes: [...input.authentication.scopes]
 	} : {
 		...existing.authorization,
@@ -75,7 +75,7 @@ const connect = Effect.fn("Connection.connect")(function* (input) {
 		method: input.method,
 		providerContext: input.authentication.providerContext,
 		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: { _tag: "Active" },
+		revocation: Revocation.Active(),
 		scopes: [...input.authentication.scopes]
 	};
 	const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);
@@ -182,4 +182,4 @@ function mergeEvidence(current, incoming) {
 //#endregion
 export { start as a, complete as i, Method as n, StartResult as r, Error as t };
 
-//# sourceMappingURL=connect-ks3cpqBD.mjs.map
+//# sourceMappingURL=connect-oI8hcMxc.mjs.map

package/dist/connect-oI8hcMxc.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-oI8hcMxc.mjs","names":["Repository.Service","Connection.project"],"sources":["../src/auth/connect.ts"],"sourcesContent":["import { Clock, Crypto, Data, Effect, Schema } from \"effect\";\n\nimport { CryptoError } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport * as Connection from \"./connection.ts\";\nimport * as Repository from \"./lifecycle-repository.ts\";\nimport type * as ProviderContext from \"./provider-context.ts\";\nimport type * as Secret from \"./secret.ts\";\n\nexport interface Authentication {\n  readonly capabilityEvidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>;\n  readonly credential: Connection.StoredCredential;\n  /** Provider-specific subject identity used only during authentication; targets are selected later. */\n  readonly providerAccountId: string;\n  readonly providerContext: ProviderContext.Envelope;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport type AuthenticationFailure = Error | InvalidInputError | DnsProvider.Error;\n\nexport interface InteractiveStart {\n  readonly authorizationUrl: URL;\n  readonly payload: Secret.Value;\n}\n\nexport interface Continuation extends BaseInput {\n  readonly expiresAt: Date;\n  readonly id: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;\n  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (\n    payload: Secret.Value,\n    callbackUrl: URL,\n  ) => Effect.Effect<Authentication, AuthenticationFailure>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (\n    continuationId: string,\n  ) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (\n      token: Secret.Value,\n    ) => Effect.Effect<Authentication, AuthenticationFailure>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport type StartResult = Data.TaggedEnum<{\n  Connected: { readonly connection: Connection.ProviderConnection };\n  Redirect: { readonly authorizationUrl: URL; readonly continuationId: string };\n}>;\nexport const StartResult = Data.taggedEnum<StartResult>();\n\nexport class Error extends Schema.TaggedError<Error>()(\"ConnectionError\", {\n  category: Schema.Literals([\"authorization\", \"provider\", \"validation\"]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\n/** Inputs shared by token and interactive connection flows. */\nexport interface BaseInput {\n  readonly authorizedById: string;\n  /** Existing authorization may be supplied only after the host completed fresh provider proof. */\n  readonly authorizationId?: string;\n  readonly ownerId: string;\n}\n\nexport interface CompleteInput {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n}\n\nexport interface ConnectInput extends BaseInput {\n  readonly authentication: Authentication;\n  readonly method: \"integration\" | \"oauth2\" | \"token\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nconst missingCapability = (\n  authentication: Authentication,\n  requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>,\n): ProviderAuthorization.Capability | undefined =>\n  requiredCapabilities.find(\n    (capability) =>\n      !authentication.capabilityEvidence.some((item) => item.capability === capability),\n  );\n\nconst freshId = Effect.fn(\"Connection.freshId\")(function* () {\n  const crypto = yield* Crypto.Crypto;\n  return yield* crypto.randomUUIDv4.pipe(\n    Effect.mapError(\n      (cause) =>\n        new Error({\n          category: \"validation\",\n          message: cause.message,\n          operation: \"Connection.connect\",\n          retry: \"safe\",\n        }),\n    ),\n  );\n});\n\n/** Persist one authenticated provider connection, optionally reusing a proven authorization. */\nexport const connect = Effect.fn(\"Connection.connect\")(function* (input: ConnectInput) {\n  const repository = yield* Repository.Service;\n  const now = new Date(yield* Clock.currentTimeMillis);\n  const missing = missingCapability(input.authentication, input.requiredCapabilities);\n  if (missing !== undefined) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: `Provider authorization lacks evidence for ${missing}`,\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n\n  const existing =\n    input.authorizationId === undefined ? null : yield* repository.get(input.authorizationId);\n  if (input.authorizationId !== undefined && existing === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization does not exist\",\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (existing?.authorization.revocation._tag === \"Pending\") {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization is awaiting revocation recovery\",\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    existing !== null &&\n    (existing.authorization.providerId !== input.providerId ||\n      existing.authorization.method !== input.method)\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider proof does not match the existing authorization\",\n      operation: \"Connection.connect\",\n      retry: \"never\",\n    });\n  }\n\n  const authorizationId = existing?.authorization.id ?? (yield* freshId());\n  const authorization: ProviderAuthorization.ProviderAuthorization =\n    existing === null\n      ? {\n          authorizedById: input.authorizedById,\n          capabilityEvidence: [...input.authentication.capabilityEvidence],\n          createdAt: now,\n          id: authorizationId,\n          method: input.method,\n          providerContext: input.authentication.providerContext,\n          providerId: input.providerId,\n          requiredCapabilities: [...input.requiredCapabilities],\n          revocation: ProviderAuthorization.Revocation.Active(),\n          scopes: [...input.authentication.scopes],\n        }\n      : {\n          ...existing.authorization,\n          capabilityEvidence: mergeEvidence(\n            existing.authorization.capabilityEvidence,\n            input.authentication.capabilityEvidence,\n          ),\n          method: input.method,\n          providerContext: input.authentication.providerContext,\n          requiredCapabilities: [...input.requiredCapabilities],\n          revocation: ProviderAuthorization.Revocation.Active(),\n          scopes: [...input.authentication.scopes],\n        };\n  const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);\n  const connection: Connection.StoredConnection = {\n    authorizationId,\n    createdAt: existingConnection?.createdAt ?? now,\n    id: existingConnection?.id ?? (yield* freshId()),\n    method: input.method,\n    ownerId: input.ownerId,\n    providerId: input.providerId,\n  };\n  return yield* repository.connect({\n    authorization,\n    connection,\n    credential: input.authentication.credential,\n    ...(existing === null ? {} : { expectedAuthorizationId: existing.authorization.id }),\n    ...(existingConnection === null ? {} : { expectedConnectionId: existingConnection.id }),\n  });\n});\n\nexport const start = Effect.fn(\"Connection.start\")(function* (\n  input: BaseInput & { readonly method: Method },\n) {\n  if (input.method._tag === \"Interactive\") {\n    const crypto = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const continuationId = yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.start\",\n            retry: \"safe\",\n          }),\n      ),\n    );\n    const started = yield* input.method.flow.start(continuationId);\n    yield* input.method.continuations.put({\n      authorizedById: input.authorizedById,\n      ...(input.authorizationId === undefined ? {} : { authorizationId: input.authorizationId }),\n      expiresAt: new Date(now + (input.method.ttlMs ?? 10 * 60_000)),\n      id: continuationId,\n      method: input.method.flow.method,\n      ownerId: input.ownerId,\n      payload: started.payload,\n      providerId: input.method.flow.providerId,\n      requiredCapabilities: [...input.method.flow.requiredCapabilities],\n    });\n    return StartResult.Redirect({\n      authorizationUrl: started.authorizationUrl,\n      continuationId,\n    });\n  }\n  const authentication = yield* input.method.authenticate(input.method.token);\n  const aggregate = yield* connect({\n    authentication,\n    authorizedById: input.authorizedById,\n    ...(input.authorizationId === undefined ? {} : { authorizationId: input.authorizationId }),\n    method: \"token\",\n    ownerId: input.ownerId,\n    providerId: input.method.providerId,\n    requiredCapabilities: input.method.requiredCapabilities,\n  });\n  const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === input.ownerId);\n  if (storedConnection === undefined) {\n    return yield* new Error({\n      category: \"validation\",\n      message: \"Connected provider authorization returned no organization connection\",\n      operation: \"Connection.start\",\n      retry: \"safe\",\n    });\n  }\n  return StartResult.Connected({\n    connection: Connection.project(storedConnection, aggregate.authorization, aggregate.credential),\n  });\n});\n\nexport const complete = Effect.fn(\"Connection.complete\")(function* (input: CompleteInput) {\n  const continuation = yield* input.continuations.consume(\n    input.continuationId,\n    new Date(yield* Clock.currentTimeMillis),\n  );\n  if (continuation === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation is expired, unknown, or already consumed\",\n      operation: \"Connection.complete\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    continuation.providerId !== input.flow.providerId ||\n    continuation.method !== input.flow.method\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation does not match the provider flow\",\n      operation: \"Connection.complete\",\n      retry: \"never\",\n    });\n  }\n  const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);\n  const aggregate = yield* connect({\n    authentication,\n    authorizedById: continuation.authorizedById,\n    ...(continuation.authorizationId === undefined\n      ? {}\n      : { authorizationId: continuation.authorizationId }),\n    method: continuation.method,\n    ownerId: continuation.ownerId,\n    providerId: continuation.providerId,\n    requiredCapabilities: continuation.requiredCapabilities,\n  });\n  const storedConnection = aggregate.connections.find(\n    ({ ownerId }) => ownerId === continuation.ownerId,\n  );\n  if (storedConnection === undefined) {\n    return yield* new Error({\n      category: \"validation\",\n      message: \"Connected provider authorization returned no organization connection\",\n      operation: \"Connection.complete\",\n      retry: \"safe\",\n    });\n  }\n  return Connection.project(storedConnection, aggregate.authorization, aggregate.credential);\n});\n\nfunction mergeEvidence(\n  current: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  incoming: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n): ReadonlyArray<ProviderAuthorization.CapabilityEvidence> {\n  const byCapability = new Map(current.map((item) => [item.capability, item]));\n  for (const item of incoming) byCapability.set(item.capability, item);\n  return [...byCapability.values()];\n}\n\nexport type Requirements = Repository.Service | Crypto.Crypto;\nexport type Failure = AuthenticationFailure | Repository.Error | CryptoError;\n"],"mappings":";;;AAqEA,MAAa,SAAS,KAAK,WAAmB;AAM9C,MAAa,cAAc,KAAK,WAAwB;AAExD,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,mBAAmB;CACxE,UAAU,OAAO,SAAS;EAAC;EAAiB;EAAY;CAAY,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAwBJ,MAAM,qBACJ,gBACA,yBAEA,qBAAqB,MAClB,eACC,CAAC,eAAe,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CACpF;AAEF,MAAM,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,aAAa;CAE3D,OAAO,QAAO,OADQ,OAAO,OAAA,CACR,aAAa,KAChC,OAAO,UACJ,UACC,IAAI,MAAM;EACR,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF,CAAC;;AAGD,MAAa,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,OAAqB;CACrF,MAAM,aAAa,OAAOA;CAC1B,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,MAAM,UAAU,kBAAkB,MAAM,gBAAgB,MAAM,oBAAoB;CAClF,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS,6CAA6C;EACtD,WAAW;EACX,OAAO;CACT,CAAC;CAGH,MAAM,WACJ,MAAM,oBAAoB,KAAA,IAAY,OAAO,OAAO,WAAW,IAAI,MAAM,eAAe;CAC1F,IAAI,MAAM,oBAAoB,KAAA,KAAa,aAAa,MACtD,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,SACZ,SAAS,cAAc,eAAe,MAAM,cAC3C,SAAS,cAAc,WAAW,MAAM,SAE1C,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAGH,MAAM,kBAAkB,UAAU,cAAc,OAAO,OAAO,QAAQ;CACtE,MAAM,gBACJ,aAAa,OACT;EACE,gBAAgB,MAAM;EACtB,oBAAoB,CAAC,GAAG,MAAM,eAAe,kBAAkB;EAC/D,WAAW;EACX,IAAI;EACJ,QAAQ,MAAM;EACd,iBAAiB,MAAM,eAAe;EACtC,YAAY,MAAM;EAClB,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;EACpD,YAAA,WAA6C,OAAO;EACpD,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;CACzC,IACA;EACE,GAAG,SAAS;EACZ,oBAAoB,cAClB,SAAS,cAAc,oBACvB,MAAM,eAAe,kBACvB;EACA,QAAQ,MAAM;EACd,iBAAiB,MAAM,eAAe;EACtC,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;EACpD,YAAA,WAA6C,OAAO;EACpD,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;CACzC;CACN,MAAM,qBAAqB,OAAO,WAAW,eAAe,MAAM,SAAS,eAAe;CAC1F,MAAM,aAA0C;EAC9C;EACA,WAAW,oBAAoB,aAAa;EAC5C,IAAI,oBAAoB,OAAO,OAAO,QAAQ;EAC9C,QAAQ,MAAM;EACd,SAAS,MAAM;EACf,YAAY,MAAM;CACpB;CACA,OAAO,OAAO,WAAW,QAAQ;EAC/B;EACA;EACA,YAAY,MAAM,eAAe;EACjC,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,yBAAyB,SAAS,cAAc,GAAG;EAClF,GAAI,uBAAuB,OAAO,CAAC,IAAI,EAAE,sBAAsB,mBAAmB,GAAG;CACvF,CAAC;AACH,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WACjD,OACA;CACA,IAAI,MAAM,OAAO,SAAS,eAAe;EACvC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,iBAAiB,OAAO,OAAO,aAAa,KAChD,OAAO,UACJ,UACC,IAAI,MAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACA,MAAM,UAAU,OAAO,MAAM,OAAO,KAAK,MAAM,cAAc;EAC7D,OAAO,MAAM,OAAO,cAAc,IAAI;GACpC,gBAAgB,MAAM;GACtB,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;GACxF,WAAW,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS,IAAY;GAC7D,IAAI;GACJ,QAAQ,MAAM,OAAO,KAAK;GAC1B,SAAS,MAAM;GACf,SAAS,QAAQ;GACjB,YAAY,MAAM,OAAO,KAAK;GAC9B,sBAAsB,CAAC,GAAG,MAAM,OAAO,KAAK,oBAAoB;EAClE,CAAC;EACD,OAAO,YAAY,SAAS;GAC1B,kBAAkB,QAAQ;GAC1B;EACF,CAAC;CACH;CACA,MAAM,iBAAiB,OAAO,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK;CAC1E,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,MAAM;EACtB,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;EACxF,QAAQ;EACR,SAAS,MAAM;EACf,YAAY,MAAM,OAAO;EACzB,sBAAsB,MAAM,OAAO;CACrC,CAAC;CACD,MAAM,mBAAmB,UAAU,YAAY,MAAM,EAAE,cAAc,YAAY,MAAM,OAAO;CAC9F,IAAI,qBAAqB,KAAA,GACvB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAO,YAAY,UAAU,EAC3B,YAAYC,QAAmB,kBAAkB,UAAU,eAAe,UAAU,UAAU,EAChG,CAAC;AACH,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAsB;CACxF,MAAM,eAAe,OAAO,MAAM,cAAc,QAC9C,MAAM,gBACN,IAAI,KAAK,OAAO,MAAM,iBAAiB,CACzC;CACA,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,eAAe,MAAM,KAAK,cACvC,aAAa,WAAW,MAAM,KAAK,QAEnC,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,iBAAiB,OAAO,MAAM,KAAK,SAAS,aAAa,SAAS,MAAM,WAAW;CACzF,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,aAAa;EAC7B,GAAI,aAAa,oBAAoB,KAAA,IACjC,CAAC,IACD,EAAE,iBAAiB,aAAa,gBAAgB;EACpD,QAAQ,aAAa;EACrB,SAAS,aAAa;EACtB,YAAY,aAAa;EACzB,sBAAsB,aAAa;CACrC,CAAC;CACD,MAAM,mBAAmB,UAAU,YAAY,MAC5C,EAAE,cAAc,YAAY,aAAa,OAC5C;CACA,IAAI,qBAAqB,KAAA,GACvB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAOA,QAAmB,kBAAkB,UAAU,eAAe,UAAU,UAAU;AAC3F,CAAC;AAED,SAAS,cACP,SACA,UACyD;CACzD,MAAM,eAAe,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;CAC3E,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;CACnE,OAAO,CAAC,GAAG,aAAa,OAAO,CAAC;AAClC"}

package/dist/{connection-DuYDgWir.d.mts → connection-C0xsU41C.d.mts}

@@ -1,4 +1,4 @@
-import { A as ConnectionStatus, C as ConnectInput, D as Interface, E as Error, F as StoredConnection, H as Capability, I as StoredCredential, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, S as AttachmentResult, T as DisconnectResult, U as CapabilityEvidence, V as validate, W as ProviderAuthorization, a as Continuation, b as Aggregate, c as Failure, d as Method$1, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow$1, n as AuthenticationFailure, nt as Value, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-Db830jad.mjs";
+import { A as ConnectionStatus, C as ConnectInput, D as Interface, E as Error, F as StoredConnection, H as Capability, I as StoredCredential, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, S as AttachmentResult, T as DisconnectResult, U as CapabilityEvidence, V as validate, W as ProviderAuthorization, a as Continuation, b as Aggregate, c as Failure, d as Method$1, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow$1, n as AuthenticationFailure, nt as Value, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-10vHuShV.mjs";
 import { Data, Layer } from "effect";
 declare namespace managed_dns_connections_d_exports {
   export { AsyncInterface, AttachmentResult, DetachResult, DisconnectResult, Error, from, layerFromAsync, toAsync };
@@ -183,4 +183,4 @@ declare function disconnect(input: {
 }): Promise<DisconnectResult>;
 //#endregion
 export { managed_dns_connections_d_exports as a, AsyncInterface as i, Method as n, connection_d_exports as r, InteractiveFlow as t };
-//# sourceMappingURL=connection-DuYDgWir.d.mts.map
+//# sourceMappingURL=connection-C0xsU41C.d.mts.map

package/dist/{connection-api-B__0M3PA.d.mts → connection-api-DW7xUJdj.d.mts}

@@ -1,4 +1,4 @@
-import { A as ConnectionStatus, B as project, E as Error, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, R as decode, S as AttachmentResult, T as DisconnectResult, V as validate, W as ProviderAuthorization, a as Continuation, c as Failure, d as Method, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow, m as start, n as AuthenticationFailure, o as ContinuationStore, p as complete, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-Db830jad.mjs";
+import { A as ConnectionStatus, B as project, E as Error, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, R as decode, S as AttachmentResult, T as DisconnectResult, V as validate, W as ProviderAuthorization, a as Continuation, c as Failure, d as Method, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow, m as start, n as AuthenticationFailure, o as ContinuationStore, p as complete, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-10vHuShV.mjs";
 import { Effect } from "effect";
 //#region src/auth/connection-lifecycle.d.ts
 /** Attach one exact provider target to one organization domain. */
@@ -23,4 +23,4 @@ declare namespace connection_api_d_exports {
 }
 //#endregion
 export { connection_api_d_exports as t };
-//# sourceMappingURL=connection-api-B__0M3PA.d.mts.map
+//# sourceMappingURL=connection-api-DW7xUJdj.d.mts.map

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { C as ConnectInput$1, D as Interface$1, E as Error$1, Et as dns_record_d_exports, F as StoredConnection, G as authorization_d_exports, I as StoredCredential, M as ProviderConnection, N as ProviderTarget, Nt as Error$2, O as Service$1, P as ProviderTargetEvidence, Pt as invalid_input_d_exports, S as AttachmentResult, T as DisconnectResult, W as ProviderAuthorization, _ as provider_context_d_exports, b as Aggregate, j as DomainAttachment, jt as domain_name_d_exports, k as AuthorizationError, lt as provider_d_exports, mt as DnsRecord$1, rt as secret_d_exports, tt as manifest_d_exports, v as CryptoError, w as DetachResult$1, wt as Type, x as AggregateSchema, y as canonical_json_d_exports } from "./connect-Db830jad.mjs";
-import { t as connection_api_d_exports } from "./connection-api-B__0M3PA.mjs";
-import { M as index_d_exports, a as verify_d_exports, d as google_doh_d_exports, et as session_d_exports, g as index_d_exports$1, h as doh_d_exports, l as resolver_pool_d_exports, nt as selection_d_exports, p as cloudflare_doh_d_exports, rt as diagnostic_d_exports, tt as zones_d_exports } from "./verify-yAy-r9no.mjs";
-import { B as types_d_exports, N as DnsPlan, U as zone_discovery_d_exports, b as AuthorizeError, k as plan_d_exports, l as resolver_d_exports, v as deletion_d_exports } from "./resolver-DUAIlm2I.mjs";
+import { C as ConnectInput$1, D as Interface$1, E as Error$1, Et as dns_record_d_exports, F as StoredConnection, G as authorization_d_exports, I as StoredCredential, M as ProviderConnection, N as ProviderTarget, Nt as Error$2, O as Service$1, P as ProviderTargetEvidence, Pt as invalid_input_d_exports, S as AttachmentResult, T as DisconnectResult, W as ProviderAuthorization, _ as provider_context_d_exports, b as Aggregate, j as DomainAttachment, jt as domain_name_d_exports, k as AuthorizationError, lt as provider_d_exports, mt as DnsRecord$1, rt as secret_d_exports, tt as manifest_d_exports, v as CryptoError, w as DetachResult$1, wt as Type, x as AggregateSchema, y as canonical_json_d_exports } from "./connect-10vHuShV.mjs";
+import { t as connection_api_d_exports } from "./connection-api-DW7xUJdj.mjs";
+import { M as index_d_exports, a as verify_d_exports, d as google_doh_d_exports, et as session_d_exports, g as index_d_exports$1, h as doh_d_exports, l as resolver_pool_d_exports, nt as selection_d_exports, p as cloudflare_doh_d_exports, rt as diagnostic_d_exports, tt as zones_d_exports } from "./verify-C3V_GtzL.mjs";
+import { B as types_d_exports, N as DnsPlan, U as zone_discovery_d_exports, b as AuthorizeError, k as plan_d_exports, l as resolver_d_exports, v as deletion_d_exports } from "./resolver-DRrLm_hB.mjs";
 import { Context, Crypto, Data, Effect, Layer, Schema } from "effect";
 declare namespace lifecycle_api_d_exports {
   export { Aggregate, AggregateSchema, AttachmentResult, authorization_d_exports as Authorization, ConnectInput$1 as ConnectInput, DetachResult$1 as DetachResult, DisconnectResult, Error$1 as Error, Interface$1 as Interface, Service$1 as Service, StoredConnection, StoredCredential };

package/dist/index.mjs

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { $ as manifest_exports, A as discovery$1, H as client_exports, J as selection_exports, K as connection_authorization_exports, M as auth_exports, U as discovery, W as make, Y as secret_exports, b as dns_data_exports, et as diagnostic_exports, g as cloudflare_doh_exports, j as make$1, k as client_exports$1, m as google_doh_exports, p as resolver_pool_exports, q as session_exports, s as verify_exports, tt as version, v as doh_exports, x as auth_exports$1 } from "./verify-DAtUAEeg.mjs";
-import { A as invalid_input_exports, C as project, D as domain_name_exports, S as encode, _ as ProviderTargetEvidence, a as AggregateSchema, b as authorizationError, d as provider_context_exports, f as AuthorizationError, g as ProviderTarget, h as ProviderConnection, l as authorization_exports, m as DomainAttachment, o as Error, p as ConnectionStatus, s as Service$1, t as canonical_json_exports, v as StoredConnection, w as validate, x as decode } from "./canonical-json-9x7gHIoS.mjs";
-import { a as start, i as complete, n as Method$1, r as StartResult, t as Error$1 } from "./connect-ks3cpqBD.mjs";
-import { C as plan_exports, N as types_exports, R as provider_exports, lt as zones_exports, m as deletion_exports, r as resolver_exports, st as zone_discovery_exports, tt as dns_record_exports } from "./resolver-DxJPsq6l.mjs";
+import { A as client_exports$1, G as make, J as session_exports, M as make$1, N as auth_exports, U as client_exports, W as discovery, X as secret_exports, Y as selection_exports, b as dns_data_exports, et as manifest_exports, g as cloudflare_doh_exports, j as discovery$1, k as AccountContext, m as google_doh_exports, nt as version, p as resolver_pool_exports, q as connection_authorization_exports, s as verify_exports, tt as diagnostic_exports, v as doh_exports, x as auth_exports$1 } from "./verify-DDnK8U7C.mjs";
+import { C as encode, O as domain_name_exports, S as decode, T as validate, _ as ProviderTarget, a as AggregateSchema, f as provider_context_exports, g as ProviderConnection, h as DomainAttachment, j as invalid_input_exports, m as ConnectionStatus, o as Error, p as AuthorizationError, s as Service$1, t as canonical_json_exports, u as authorization_exports, v as ProviderTargetEvidence, w as project, x as authorizationError, y as StoredConnection } from "./canonical-json-CQYKsZw7.mjs";
+import { a as start, i as complete, n as Method$1, r as StartResult, t as Error$1 } from "./connect-oI8hcMxc.mjs";
+import { B as provider_exports, F as types_exports, T as plan_exports, a as resolver_exports, dt as zones_exports, g as deletion_exports, lt as zone_discovery_exports, rt as dns_record_exports } from "./resolver-DPJs8h0a.mjs";
 import { Context, Data, Effect, Layer, Schema } from "effect";
 //#region src/auth/connection-lifecycle.ts
 /** Attach one exact provider target to one organization domain. */
@@ -66,6 +66,7 @@ var cloudflare_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 //#region src/providers/vercel/index.ts
 var vercel_exports = /* @__PURE__ */ __exportAll({
+	AccountContext: () => AccountContext,
 	Auth: () => auth_exports$1,
 	Client: () => client_exports$1,
 	discovery: () => discovery$1,

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["Lifecycle.Service","Connection.DomainAttachment","Connection.ProviderConnection","Connection.ProviderTarget","packageJson.version"],"sources":["../src/auth/connection-lifecycle.ts","../src/auth/connection-api.ts","../src/auth/lifecycle-api.ts","../src/providers/cloudflare/index.ts","../src/providers/vercel/index.ts","../src/transport.ts","../src/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Connection from \"./connection.ts\";\nimport * as Lifecycle from \"./lifecycle-repository.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\n\n/** Attach one exact provider target to one organization domain. */\nexport const attach = Effect.fn(\"ManagedDnsConnections.attach\")(function* (input: {\n  readonly attachment: Connection.DomainAttachment;\n  readonly connectionId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.attach(input);\n});\n\n/** Remove one domain attachment while retaining the organization connection. */\nexport const detach = Effect.fn(\"ManagedDnsConnections.detach\")(function* (input: {\n  readonly attachmentId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.detach(input);\n});\n\n/** Disconnect one organization connection, revoking the shared authorization only when final. */\nexport function disconnect<E>(input: {\n  readonly connectionId: string;\n  readonly ownerId: string;\n  readonly revokeAuthorization: (\n    authorization: ProviderAuthorization.ProviderAuthorization,\n  ) => Effect.Effect<void, E>;\n}): Effect.Effect<Lifecycle.DisconnectResult, Lifecycle.Error | E, Lifecycle.Service> {\n  return Effect.gen(function* () {\n    const service = yield* Lifecycle.Service;\n    return yield* service.disconnect({\n      connectionId: input.connectionId,\n      ownerId: input.ownerId,\n      revoke: input.revokeAuthorization,\n    });\n  });\n}\n","export {\n  AuthorizationError,\n  authorizationError,\n  ConnectionStatus,\n  decode,\n  DomainAttachment,\n  encode,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n  project,\n  validate,\n} from \"./connection.ts\";\nexport { attach, detach, disconnect } from \"./connection-lifecycle.ts\";\nexport type { AttachmentResult, DetachResult, DisconnectResult } from \"./lifecycle-repository.ts\";\nexport { complete, Error, Method, start, StartResult } from \"./connect.ts\";\nexport type {\n  Authentication,\n  AuthenticationFailure,\n  BaseInput,\n  CompleteInput,\n  Continuation,\n  ContinuationStore,\n  Failure,\n  InteractiveFlow,\n  InteractiveStart,\n  Method as ConnectionMethod,\n  StartResult as ConnectionStartResult,\n} from \"./connect.ts\";\n","/** Public surface for the cohesive managed-DNS persistence capability. */\nexport { AggregateSchema, Error, Service } from \"./lifecycle-repository.ts\";\nexport * as Authorization from \"./authorization.ts\";\nexport { StoredConnection } from \"./connection.ts\";\nexport type { StoredCredential } from \"./connection.ts\";\nexport type {\n  Aggregate,\n  AttachmentResult,\n  ConnectInput,\n  DetachResult,\n  DisconnectResult,\n  Interface,\n} from \"./lifecycle-repository.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { discovery, make } from \"./client.ts\";\nexport type {\n  Account,\n  AccountContext,\n  Fetch,\n  Interface,\n  ListZonesInput,\n  Options,\n  Zone,\n} from \"./client.ts\";\n","import { Context, Data, Effect, Layer, Schema } from \"effect\";\n\nimport * as Connection from \"./auth/connection.ts\";\nimport type * as DomainDnsRecord from \"./domain/dns-record.ts\";\n\nexport {\n  DomainAttachment,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n} from \"./auth/connection.ts\";\n\n/** A user-presentable failure at the application transport boundary. */\nexport class Failure extends Schema.TaggedError<Failure>()(\"Failure\", {\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport const AuthenticationParameter = Schema.Struct({\n  description: Schema.optionalKey(Schema.String),\n  key: Schema.String,\n  label: Schema.String,\n  placeholder: Schema.optionalKey(Schema.String),\n  required: Schema.optionalKey(Schema.Boolean),\n});\nexport type AuthenticationParameter = typeof AuthenticationParameter.Type;\n\nexport const AuthenticationMethod = Schema.TaggedUnion({\n  Integration: { label: Schema.String },\n  OAuth: { label: Schema.String },\n  Token: {\n    label: Schema.String,\n    parameters: Schema.optionalKey(Schema.Array(AuthenticationParameter)),\n    placeholder: Schema.optionalKey(Schema.String),\n  },\n});\nexport type AuthenticationMethod = typeof AuthenticationMethod.Type;\n\n/** The authentication choice supplied to a connection request. */\nexport type Method = Data.TaggedEnum<{\n  Integration: {};\n  OAuth: {};\n  Token: {\n    readonly parameters?: Readonly<Record<string, string>>;\n    readonly token: string;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport const Provider = Schema.Struct({\n  authentication: Schema.Array(AuthenticationMethod),\n  id: Schema.String,\n  name: Schema.String,\n});\nexport type Provider = typeof Provider.Type;\n\nexport const Connected = Schema.TaggedStruct(\"Connected\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  provider: Provider,\n});\nexport type Connected = typeof Connected.Type;\n\nexport const ReusableConnection = Schema.Struct({\n  connection: Connection.ProviderConnection,\n  targets: Schema.Array(Connection.ProviderTarget),\n});\nexport type ReusableConnection = typeof ReusableConnection.Type;\n\nexport const Disconnected = Schema.TaggedStruct(\"Disconnected\", {\n  domain: Schema.String,\n  provider: Provider,\n  reusableConnections: Schema.Array(ReusableConnection),\n});\nexport type Disconnected = typeof Disconnected.Type;\n\nexport const Unsupported = Schema.TaggedStruct(\"Unsupported\", { domain: Schema.String });\nexport type Unsupported = typeof Unsupported.Type;\n\nexport const ConnectionSnapshot = Schema.Union([Connected, Disconnected, Unsupported]).pipe(\n  Schema.toTaggedUnion(\"_tag\"),\n);\nexport type ConnectionSnapshot = typeof ConnectionSnapshot.Type;\n\nexport const Redirect = Schema.TaggedStruct(\"Redirect\", { authorizationUrl: Schema.String });\nexport type Redirect = typeof Redirect.Type;\n\nexport const ConnectionResult = Schema.Union([Connected, Redirect]).pipe(\n  Schema.toTaggedUnion(\"_tag\"),\n);\nexport type ConnectionResult = typeof ConnectionResult.Type;\n\nexport const DetachResult = Schema.TaggedStruct(\"Detached\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  remainingAttachments: Schema.Int,\n});\nexport type DetachResult = typeof DetachResult.Type;\n\n/** A presentation projection of a DNS requirement. */\nexport const DnsRecord = Schema.Struct({\n  id: Schema.String,\n  name: Schema.String,\n  priority: Schema.optionalKey(Schema.Int),\n  type: Schema.String,\n  value: Schema.String,\n});\nexport type DnsRecord = typeof DnsRecord.Type;\n\n/** Projects DomainKit's operational record into its application transport representation. */\nexport const fromDnsRecord = (id: string, record: DomainDnsRecord.DnsRecord): DnsRecord => {\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { id, name: record.name, type: record._tag, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { id, name: record.name, type: record._tag, value: record.target };\n    case \"TXT\":\n      return { id, name: record.name, type: record._tag, value: record.value };\n    case \"MX\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: record.exchange,\n      };\n    case \"CAA\":\n      return {\n        id,\n        name: record.name,\n        type: record._tag,\n        value: `${record.flags} ${record.tag} ${record.value}`,\n      };\n    case \"SRV\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: `${record.weight} ${record.port} ${record.target}`,\n      };\n  }\n};\n\nexport const PlanOperation = Schema.TaggedUnion({\n  Conflict: { id: Schema.String, reason: Schema.String, record: DnsRecord },\n  Create: { id: Schema.String, record: DnsRecord },\n  Noop: { id: Schema.String, record: DnsRecord },\n});\nexport type PlanOperation = typeof PlanOperation.Type;\n\nexport const ProvisioningPlan = Schema.TaggedStruct(\"Plan\", {\n  digest: Schema.String,\n  expiresAt: Schema.String,\n  operations: Schema.Array(PlanOperation),\n});\nexport type ProvisioningPlan = typeof ProvisioningPlan.Type;\n\nexport const OperationResult = Schema.TaggedUnion({\n  Applied: { operationId: Schema.String },\n  Failed: { message: Schema.String, operationId: Schema.String },\n  Unchanged: { operationId: Schema.String },\n});\nexport type OperationResult = typeof OperationResult.Type;\n\nconst ApplyOutcomeFields = {\n  operationId: Schema.String,\n  receiptId: Schema.String,\n  results: Schema.Array(OperationResult),\n};\nexport const ApplyResult = Schema.TaggedUnion({\n  Applied: ApplyOutcomeFields,\n  Partial: ApplyOutcomeFields,\n  Stale: { message: Schema.String },\n});\nexport type ApplyResult = typeof ApplyResult.Type;\n\nexport const ObservationEvidence = Schema.TaggedUnion({\n  Found: { recordId: Schema.String },\n  Mismatch: { message: Schema.String, recordId: Schema.String },\n  Missing: { recordId: Schema.String },\n  Unavailable: { message: Schema.String, recordId: Schema.String },\n});\nexport type ObservationEvidence = typeof ObservationEvidence.Type;\n\nexport const Observation = Schema.TaggedStruct(\"Observation\", {\n  provider: Schema.Array(ObservationEvidence),\n  publicDns: Schema.Array(ObservationEvidence),\n});\nexport type Observation = typeof Observation.Type;\n\nexport const CleanupOperation = Schema.TaggedUnion({\n  AlreadyAbsent: { id: Schema.String, record: DnsRecord },\n  Blocked: { id: Schema.String, reason: Schema.String, record: DnsRecord },\n  Delete: { id: Schema.String, record: DnsRecord },\n});\nexport type CleanupOperation = typeof CleanupOperation.Type;\n\nexport const CleanupPlan = Schema.TaggedStruct(\"CleanupPlan\", {\n  digest: Schema.String,\n  expiresAt: Schema.String,\n  operations: Schema.Array(CleanupOperation),\n});\nexport type CleanupPlan = typeof CleanupPlan.Type;\n\nconst CleanupOutcomeFields = {\n  operationId: Schema.String,\n  results: Schema.Array(OperationResult),\n};\nexport const CleanupResult = Schema.TaggedUnion({\n  Cleaned: CleanupOutcomeFields,\n  Partial: CleanupOutcomeFields,\n  Stale: { message: Schema.String },\n});\nexport type CleanupResult = typeof CleanupResult.Type;\n\nexport interface ConnectInput {\n  readonly domain: string;\n  readonly method: Method;\n  readonly providerId: string;\n}\n\nexport interface InspectInput {\n  readonly domain: string;\n}\n\nexport interface AttachInput {\n  readonly connectionId: string;\n  readonly domain: string;\n  readonly target: Connection.ProviderTarget;\n}\n\nexport interface DetachInput {\n  readonly attachmentId: string;\n  readonly preserveDns: true;\n}\n\nexport interface ProvisioningPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n}\n\nexport interface ProvisioningApplyInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly planDigest: string;\n}\n\nexport interface ObserveInput {\n  readonly attachmentId?: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n  readonly sources: {\n    readonly provider: boolean;\n    readonly publicDns: boolean;\n  };\n}\n\nexport interface CleanupPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly receiptId: string;\n}\n\nexport interface CleanupApplyInput extends CleanupPlanInput {\n  readonly planDigest: string;\n}\n\n/** Application-facing DNS connection and provisioning capability. */\nexport interface Interface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Effect.Effect<CleanupResult, Failure>;\n    readonly plan: (input: CleanupPlanInput) => Effect.Effect<CleanupPlan, Failure>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Effect.Effect<Connected, Failure>;\n    readonly connect: (input: ConnectInput) => Effect.Effect<ConnectionResult, Failure>;\n    readonly inspect: (input: InspectInput) => Effect.Effect<ConnectionSnapshot, Failure>;\n    readonly detach: (input: DetachInput) => Effect.Effect<DetachResult, Failure>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Effect.Effect<ApplyResult, Failure>;\n    readonly plan: (input: ProvisioningPlanInput) => Effect.Effect<ProvisioningPlan, Failure>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Effect.Effect<Observation, Failure>;\n  };\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Transport\") {}\n\n/** Promise-shaped host seam for foreign runtimes and framework actions. */\nexport interface AsyncInterface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Promise<CleanupResult>;\n    readonly plan: (input: CleanupPlanInput) => Promise<CleanupPlan>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Promise<Connected>;\n    readonly connect: (input: ConnectInput) => Promise<ConnectionResult>;\n    readonly inspect: (input: InspectInput) => Promise<ConnectionSnapshot>;\n    readonly detach: (input: DetachInput) => Promise<DetachResult>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Promise<ApplyResult>;\n    readonly plan: (input: ProvisioningPlanInput) => Promise<ProvisioningPlan>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Promise<Observation>;\n  };\n}\n\nexport interface AsyncOptions {\n  readonly onError?: (operation: string, cause: unknown) => Failure;\n}\n\n/** Converts a Promise-shaped host implementation into the canonical Effect service. */\nexport const fromAsync = (transport: AsyncInterface, options: AsyncOptions = {}): Interface => {\n  const attempt = <A>(operation: string, evaluate: () => Promise<A>) =>\n    Effect.tryPromise({\n      try: evaluate,\n      catch: (cause) =>\n        options.onError?.(operation, cause) ??\n        (cause instanceof Failure\n          ? cause\n          : new Failure({\n              message: cause instanceof globalThis.Error ? cause.message : String(cause),\n              operation,\n              retry: \"unknown\",\n            })),\n    });\n  return Service.of({\n    cleanup: {\n      apply: (input) => attempt(\"cleanup.apply\", () => transport.cleanup.apply(input)),\n      plan: (input) => attempt(\"cleanup.plan\", () => transport.cleanup.plan(input)),\n    },\n    connection: {\n      attach: (input) => attempt(\"connection.attach\", () => transport.connection.attach(input)),\n      connect: (input) => attempt(\"connection.connect\", () => transport.connection.connect(input)),\n      inspect: (input) => attempt(\"connection.inspect\", () => transport.connection.inspect(input)),\n      detach: (input) => attempt(\"connection.detach\", () => transport.connection.detach(input)),\n    },\n    provisioning: {\n      apply: (input) => attempt(\"provisioning.apply\", () => transport.provisioning.apply(input)),\n      plan: (input) => attempt(\"provisioning.plan\", () => transport.provisioning.plan(input)),\n    },\n    verification: {\n      observe: (input) =>\n        attempt(\"verification.observe\", () => transport.verification.observe(input)),\n    },\n  });\n};\n\nexport const layerFromAsync = (\n  transport: AsyncInterface,\n  options?: AsyncOptions,\n): Layer.Layer<Service> => Layer.succeed(Service, fromAsync(transport, options));\n\n/** Converts an environment-free Effect service into its Promise-shaped host seam. */\nexport const toAsync = (transport: Interface): AsyncInterface => ({\n  cleanup: {\n    apply: (input) => Effect.runPromise(transport.cleanup.apply(input)),\n    plan: (input) => Effect.runPromise(transport.cleanup.plan(input)),\n  },\n  connection: {\n    attach: (input) => Effect.runPromise(transport.connection.attach(input)),\n    connect: (input) => Effect.runPromise(transport.connection.connect(input)),\n    inspect: (input) => Effect.runPromise(transport.connection.inspect(input)),\n    detach: (input) => Effect.runPromise(transport.connection.detach(input)),\n  },\n  provisioning: {\n    apply: (input) => Effect.runPromise(transport.provisioning.apply(input)),\n    plan: (input) => Effect.runPromise(transport.provisioning.plan(input)),\n  },\n  verification: {\n    observe: (input) => Effect.runPromise(transport.verification.observe(input)),\n  },\n});\n","import packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Connection from \"./auth/connection-api.ts\";\nexport * as ManagedDnsConnections from \"./auth/lifecycle-api.ts\";\nexport * as Diagnostic from \"./auth/diagnostic.ts\";\nexport * as ProviderAuth from \"./auth/manifest.ts\";\nexport * as ProviderContext from \"./auth/provider-context.ts\";\nexport * as Secret from \"./auth/secret.ts\";\nexport * as ProviderDiscovery from \"./discovery/selection.ts\";\nexport * as ZoneDiscovery from \"./discovery/zone-discovery.ts\";\nexport * as Zones from \"./discovery/zones.ts\";\nexport * as DnsRecord from \"./domain/dns-record.ts\";\nexport * as DomainName from \"./domain/domain-name.ts\";\nexport * as InvalidInput from \"./invalid-input.ts\";\nexport * as DnsProvider from \"./provider/provider.ts\";\nexport * as ProviderSession from \"./provider/session.ts\";\nexport * as ConnectionAuthorization from \"./plan/connection-authorization.ts\";\nexport * as Digest from \"./plan/canonical-json.ts\";\nexport * as Deletion from \"./plan/deletion.ts\";\nexport * as Provisioning from \"./plan/plan.ts\";\nexport * as DnsPlan from \"./plan/types.ts\";\nexport * as Cloudflare from \"./providers/cloudflare/index.ts\";\nexport * as Vercel from \"./providers/vercel/index.ts\";\nexport * as Transport from \"./transport.ts\";\nexport * as CloudflareDnsOverHttps from \"./verification/cloudflare-doh.ts\";\nexport * as DnsData from \"./verification/dns-data.ts\";\nexport * as DnsOverHttps from \"./verification/doh.ts\";\nexport * as GoogleDnsOverHttps from \"./verification/google-doh.ts\";\nexport * as DnsResolverPool from \"./verification/resolver-pool.ts\";\nexport * as DnsResolver from \"./verification/resolver.ts\";\nexport * as Verification from \"./verification/verify.ts\";\n"],"mappings":";;;;;;;;AAOA,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAIxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAGxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,SAAgB,WAAc,OAMwD;CACpF,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,QAAO,OADSA,UAAAA,CACD,WAAW;GAC/B,cAAc,MAAM;GACpB,SAAS,MAAM;GACf,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AK5BA,IAAa,UAAb,cAA6B,OAAO,YAAqB,CAAC,CAAC,WAAW;CACpE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,0BAA0B,OAAO,OAAO;CACnD,aAAa,OAAO,YAAY,OAAO,MAAM;CAC7C,KAAK,OAAO;CACZ,OAAO,OAAO;CACd,aAAa,OAAO,YAAY,OAAO,MAAM;CAC7C,UAAU,OAAO,YAAY,OAAO,OAAO;AAC7C,CAAC;AAGD,MAAa,uBAAuB,OAAO,YAAY;CACrD,aAAa,EAAE,OAAO,OAAO,OAAO;CACpC,OAAO,EAAE,OAAO,OAAO,OAAO;CAC9B,OAAO;EACL,OAAO,OAAO;EACd,YAAY,OAAO,YAAY,OAAO,MAAM,uBAAuB,CAAC;EACpE,aAAa,OAAO,YAAY,OAAO,MAAM;CAC/C;AACF,CAAC;AAYD,MAAa,SAAS,KAAK,WAAmB;AAE9C,MAAa,WAAW,OAAO,OAAO;CACpC,gBAAgB,OAAO,MAAM,oBAAoB;CACjD,IAAI,OAAO;CACX,MAAM,OAAO;AACf,CAAC;AAGD,MAAa,YAAY,OAAO,aAAa,aAAa;CACxD,YAAYC;CACZ,YAAYC;CACZ,UAAU;AACZ,CAAC;AAGD,MAAa,qBAAqB,OAAO,OAAO;CAC9C,YAAYA;CACZ,SAAS,OAAO,MAAMC,cAAyB;AACjD,CAAC;AAGD,MAAa,eAAe,OAAO,aAAa,gBAAgB;CAC9D,QAAQ,OAAO;CACf,UAAU;CACV,qBAAqB,OAAO,MAAM,kBAAkB;AACtD,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe,EAAE,QAAQ,OAAO,OAAO,CAAC;AAGvF,MAAa,qBAAqB,OAAO,MAAM;CAAC;CAAW;CAAc;AAAW,CAAC,CAAC,CAAC,KACrF,OAAO,cAAc,MAAM,CAC7B;AAGA,MAAa,WAAW,OAAO,aAAa,YAAY,EAAE,kBAAkB,OAAO,OAAO,CAAC;AAG3F,MAAa,mBAAmB,OAAO,MAAM,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,KAClE,OAAO,cAAc,MAAM,CAC7B;AAGA,MAAa,eAAe,OAAO,aAAa,YAAY;CAC1D,YAAYF;CACZ,YAAYC;CACZ,sBAAsB,OAAO;AAC/B,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,IAAI,OAAO;CACX,MAAM,OAAO;CACb,UAAU,OAAO,YAAY,OAAO,GAAG;CACvC,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC;;AAID,MAAa,iBAAiB,IAAY,WAAiD;CACzF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAQ;EAC3E,KAAK;EACL,KAAK,MACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAO;EAC1E,KAAK,OACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAM;EACzE,KAAK,MACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,GAAG,OAAO;EACjD;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,GAAG,OAAO,KAAK,GAAG,OAAO;EACnD;CACJ;AACF;AAEA,MAAa,gBAAgB,OAAO,YAAY;CAC9C,UAAU;EAAE,IAAI,OAAO;EAAQ,QAAQ,OAAO;EAAQ,QAAQ;CAAU;CACxE,QAAQ;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;CAC/C,MAAM;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;AAC/C,CAAC;AAGD,MAAa,mBAAmB,OAAO,aAAa,QAAQ;CAC1D,QAAQ,OAAO;CACf,WAAW,OAAO;CAClB,YAAY,OAAO,MAAM,aAAa;AACxC,CAAC;AAGD,MAAa,kBAAkB,OAAO,YAAY;CAChD,SAAS,EAAE,aAAa,OAAO,OAAO;CACtC,QAAQ;EAAE,SAAS,OAAO;EAAQ,aAAa,OAAO;CAAO;CAC7D,WAAW,EAAE,aAAa,OAAO,OAAO;AAC1C,CAAC;AAGD,MAAM,qBAAqB;CACzB,aAAa,OAAO;CACpB,WAAW,OAAO;CAClB,SAAS,OAAO,MAAM,eAAe;AACvC;AACA,MAAa,cAAc,OAAO,YAAY;CAC5C,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAAS,OAAO,OAAO;AAClC,CAAC;AAGD,MAAa,sBAAsB,OAAO,YAAY;CACpD,OAAO,EAAE,UAAU,OAAO,OAAO;CACjC,UAAU;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAO;CAC5D,SAAS,EAAE,UAAU,OAAO,OAAO;CACnC,aAAa;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAO;AACjE,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe;CAC5D,UAAU,OAAO,MAAM,mBAAmB;CAC1C,WAAW,OAAO,MAAM,mBAAmB;AAC7C,CAAC;AAGD,MAAa,mBAAmB,OAAO,YAAY;CACjD,eAAe;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;CACtD,SAAS;EAAE,IAAI,OAAO;EAAQ,QAAQ,OAAO;EAAQ,QAAQ;CAAU;CACvE,QAAQ;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;AACjD,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe;CAC5D,QAAQ,OAAO;CACf,WAAW,OAAO;CAClB,YAAY,OAAO,MAAM,gBAAgB;AAC3C,CAAC;AAGD,MAAM,uBAAuB;CAC3B,aAAa,OAAO;CACpB,SAAS,OAAO,MAAM,eAAe;AACvC;AACA,MAAa,gBAAgB,OAAO,YAAY;CAC9C,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAAS,OAAO,OAAO;AAClC,CAAC;AA6ED,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;;AA4B5F,MAAa,aAAa,WAA2B,UAAwB,CAAC,MAAiB;CAC7F,MAAM,WAAc,WAAmB,aACrC,OAAO,WAAW;EAChB,KAAK;EACL,QAAQ,UACN,QAAQ,UAAU,WAAW,KAAK,MACjC,iBAAiB,UACd,QACA,IAAI,QAAQ;GACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;GACzE;GACA,OAAO;EACT,CAAC;CACT,CAAC;CACH,OAAO,QAAQ,GAAG;EAChB,SAAS;GACP,QAAQ,UAAU,QAAQ,uBAAuB,UAAU,QAAQ,MAAM,KAAK,CAAC;GAC/E,OAAO,UAAU,QAAQ,sBAAsB,UAAU,QAAQ,KAAK,KAAK,CAAC;EAC9E;EACA,YAAY;GACV,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;GACxF,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;EAC1F;EACA,cAAc;GACZ,QAAQ,UAAU,QAAQ,4BAA4B,UAAU,aAAa,MAAM,KAAK,CAAC;GACzF,OAAO,UAAU,QAAQ,2BAA2B,UAAU,aAAa,KAAK,KAAK,CAAC;EACxF;EACA,cAAc,EACZ,UAAU,UACR,QAAQ,8BAA8B,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC/E;CACF,CAAC;AACH;AAEA,MAAa,kBACX,WACA,YACyB,MAAM,QAAQ,SAAS,UAAU,WAAW,OAAO,CAAC;;AAG/E,MAAa,WAAW,eAA0C;CAChE,SAAS;EACP,QAAQ,UAAU,OAAO,WAAW,UAAU,QAAQ,MAAM,KAAK,CAAC;EAClE,OAAO,UAAU,OAAO,WAAW,UAAU,QAAQ,KAAK,KAAK,CAAC;CAClE;CACA,YAAY;EACV,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;EACvE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;CACzE;CACA,cAAc;EACZ,QAAQ,UAAU,OAAO,WAAW,UAAU,aAAa,MAAM,KAAK,CAAC;EACvE,OAAO,UAAU,OAAO,WAAW,UAAU,aAAa,KAAK,KAAK,CAAC;CACvE;CACA,cAAc,EACZ,UAAU,UAAU,OAAO,WAAW,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC7E;AACF;;;;AC1XA,MAAa,UAAUE"}
+{"version":3,"file":"index.mjs","names":["Lifecycle.Service","Connection.DomainAttachment","Connection.ProviderConnection","Connection.ProviderTarget","packageJson.version"],"sources":["../src/auth/connection-lifecycle.ts","../src/auth/connection-api.ts","../src/auth/lifecycle-api.ts","../src/providers/cloudflare/index.ts","../src/providers/vercel/index.ts","../src/transport.ts","../src/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport * as Connection from \"./connection.ts\";\nimport * as Lifecycle from \"./lifecycle-repository.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\n\n/** Attach one exact provider target to one organization domain. */\nexport const attach = Effect.fn(\"ManagedDnsConnections.attach\")(function* (input: {\n  readonly attachment: Connection.DomainAttachment;\n  readonly connectionId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.attach(input);\n});\n\n/** Remove one domain attachment while retaining the organization connection. */\nexport const detach = Effect.fn(\"ManagedDnsConnections.detach\")(function* (input: {\n  readonly attachmentId: string;\n  readonly ownerId: string;\n}) {\n  const service = yield* Lifecycle.Service;\n  return yield* service.detach(input);\n});\n\n/** Disconnect one organization connection, revoking the shared authorization only when final. */\nexport function disconnect<E>(input: {\n  readonly connectionId: string;\n  readonly ownerId: string;\n  readonly revokeAuthorization: (\n    authorization: ProviderAuthorization.ProviderAuthorization,\n  ) => Effect.Effect<void, E>;\n}): Effect.Effect<Lifecycle.DisconnectResult, Lifecycle.Error | E, Lifecycle.Service> {\n  return Effect.gen(function* () {\n    const service = yield* Lifecycle.Service;\n    return yield* service.disconnect({\n      connectionId: input.connectionId,\n      ownerId: input.ownerId,\n      revoke: input.revokeAuthorization,\n    });\n  });\n}\n","export {\n  AuthorizationError,\n  authorizationError,\n  ConnectionStatus,\n  decode,\n  DomainAttachment,\n  encode,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n  project,\n  validate,\n} from \"./connection.ts\";\nexport { attach, detach, disconnect } from \"./connection-lifecycle.ts\";\nexport type { AttachmentResult, DetachResult, DisconnectResult } from \"./lifecycle-repository.ts\";\nexport { complete, Error, Method, start, StartResult } from \"./connect.ts\";\nexport type {\n  Authentication,\n  AuthenticationFailure,\n  BaseInput,\n  CompleteInput,\n  Continuation,\n  ContinuationStore,\n  Failure,\n  InteractiveFlow,\n  InteractiveStart,\n  Method as ConnectionMethod,\n  StartResult as ConnectionStartResult,\n} from \"./connect.ts\";\n","/** Public surface for the cohesive managed-DNS persistence capability. */\nexport { AggregateSchema, Error, Service } from \"./lifecycle-repository.ts\";\nexport * as Authorization from \"./authorization.ts\";\nexport { StoredConnection } from \"./connection.ts\";\nexport type { StoredCredential } from \"./connection.ts\";\nexport type {\n  Aggregate,\n  AttachmentResult,\n  ConnectInput,\n  DetachResult,\n  DisconnectResult,\n  Interface,\n} from \"./lifecycle-repository.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","export * as Auth from \"./auth.ts\";\nexport * as Client from \"./client.ts\";\n\nexport { AccountContext, discovery, make } from \"./client.ts\";\nexport type { Account, Fetch, Interface, ListZonesInput, Options, Zone } from \"./client.ts\";\n","import { Context, Data, Effect, Layer, Schema } from \"effect\";\n\nimport * as Connection from \"./auth/connection.ts\";\nimport type * as DomainDnsRecord from \"./domain/dns-record.ts\";\n\nexport {\n  DomainAttachment,\n  ProviderConnection,\n  ProviderTarget,\n  ProviderTargetEvidence,\n} from \"./auth/connection.ts\";\n\n/** A user-presentable failure at the application transport boundary. */\nexport class Failure extends Schema.TaggedError<Failure>()(\"Failure\", {\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\nexport const AuthenticationParameter = Schema.Struct({\n  description: Schema.optionalKey(Schema.String),\n  key: Schema.String,\n  label: Schema.String,\n  placeholder: Schema.optionalKey(Schema.String),\n  required: Schema.optionalKey(Schema.Boolean),\n});\nexport type AuthenticationParameter = typeof AuthenticationParameter.Type;\n\nexport const AuthenticationMethod = Schema.TaggedUnion({\n  Integration: { label: Schema.String },\n  OAuth: { label: Schema.String },\n  Token: {\n    label: Schema.String,\n    parameters: Schema.optionalKey(Schema.Array(AuthenticationParameter)),\n    placeholder: Schema.optionalKey(Schema.String),\n  },\n});\nexport type AuthenticationMethod = typeof AuthenticationMethod.Type;\n\n/** The authentication choice supplied to a connection request. */\nexport type Method = Data.TaggedEnum<{\n  Integration: {};\n  OAuth: {};\n  Token: {\n    readonly parameters?: Readonly<Record<string, string>>;\n    readonly token: string;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport const Provider = Schema.Struct({\n  authentication: Schema.Array(AuthenticationMethod),\n  id: Schema.String,\n  name: Schema.String,\n});\nexport type Provider = typeof Provider.Type;\n\nexport const Connected = Schema.TaggedStruct(\"Connected\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  provider: Provider,\n});\nexport type Connected = typeof Connected.Type;\n\nexport const ReusableConnection = Schema.Struct({\n  connection: Connection.ProviderConnection,\n  targets: Schema.Array(Connection.ProviderTarget),\n});\nexport type ReusableConnection = typeof ReusableConnection.Type;\n\nexport const Disconnected = Schema.TaggedStruct(\"Disconnected\", {\n  domain: Schema.String,\n  provider: Provider,\n  reusableConnections: Schema.Array(ReusableConnection),\n});\nexport type Disconnected = typeof Disconnected.Type;\n\nexport const Unsupported = Schema.TaggedStruct(\"Unsupported\", { domain: Schema.String });\nexport type Unsupported = typeof Unsupported.Type;\n\nexport const ConnectionSnapshot = Schema.Union([Connected, Disconnected, Unsupported]).pipe(\n  Schema.toTaggedUnion(\"_tag\"),\n);\nexport type ConnectionSnapshot = typeof ConnectionSnapshot.Type;\n\nexport const Redirect = Schema.TaggedStruct(\"Redirect\", { authorizationUrl: Schema.String });\nexport type Redirect = typeof Redirect.Type;\n\nexport const ConnectionResult = Schema.Union([Connected, Redirect]).pipe(\n  Schema.toTaggedUnion(\"_tag\"),\n);\nexport type ConnectionResult = typeof ConnectionResult.Type;\n\nexport const DetachResult = Schema.TaggedStruct(\"Detached\", {\n  attachment: Connection.DomainAttachment,\n  connection: Connection.ProviderConnection,\n  remainingAttachments: Schema.Int,\n});\nexport type DetachResult = typeof DetachResult.Type;\n\n/** A presentation projection of a DNS requirement. */\nexport const DnsRecord = Schema.Struct({\n  id: Schema.String,\n  name: Schema.String,\n  priority: Schema.optionalKey(Schema.Int),\n  type: Schema.String,\n  value: Schema.String,\n});\nexport type DnsRecord = typeof DnsRecord.Type;\n\n/** Projects DomainKit's operational record into its application transport representation. */\nexport const fromDnsRecord = (id: string, record: DomainDnsRecord.DnsRecord): DnsRecord => {\n  switch (record._tag) {\n    case \"A\":\n    case \"AAAA\":\n      return { id, name: record.name, type: record._tag, value: record.address };\n    case \"CNAME\":\n    case \"NS\":\n      return { id, name: record.name, type: record._tag, value: record.target };\n    case \"TXT\":\n      return { id, name: record.name, type: record._tag, value: record.value };\n    case \"MX\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: record.exchange,\n      };\n    case \"CAA\":\n      return {\n        id,\n        name: record.name,\n        type: record._tag,\n        value: `${record.flags} ${record.tag} ${record.value}`,\n      };\n    case \"SRV\":\n      return {\n        id,\n        name: record.name,\n        priority: record.priority,\n        type: record._tag,\n        value: `${record.weight} ${record.port} ${record.target}`,\n      };\n  }\n};\n\nexport const PlanOperation = Schema.TaggedUnion({\n  Conflict: { id: Schema.String, reason: Schema.String, record: DnsRecord },\n  Create: { id: Schema.String, record: DnsRecord },\n  Noop: { id: Schema.String, record: DnsRecord },\n});\nexport type PlanOperation = typeof PlanOperation.Type;\n\nexport const ProvisioningPlan = Schema.TaggedStruct(\"Plan\", {\n  digest: Schema.String,\n  expiresAt: Schema.String,\n  operations: Schema.Array(PlanOperation),\n});\nexport type ProvisioningPlan = typeof ProvisioningPlan.Type;\n\nexport const OperationResult = Schema.TaggedUnion({\n  Applied: { operationId: Schema.String },\n  Failed: { message: Schema.String, operationId: Schema.String },\n  Unchanged: { operationId: Schema.String },\n});\nexport type OperationResult = typeof OperationResult.Type;\n\nconst ApplyOutcomeFields = {\n  operationId: Schema.String,\n  receiptId: Schema.String,\n  results: Schema.Array(OperationResult),\n};\nexport const ApplyResult = Schema.TaggedUnion({\n  Applied: ApplyOutcomeFields,\n  Partial: ApplyOutcomeFields,\n  Stale: { message: Schema.String },\n});\nexport type ApplyResult = typeof ApplyResult.Type;\n\nexport const ObservationEvidence = Schema.TaggedUnion({\n  Found: { recordId: Schema.String },\n  Mismatch: { message: Schema.String, recordId: Schema.String },\n  Missing: { recordId: Schema.String },\n  Unavailable: { message: Schema.String, recordId: Schema.String },\n});\nexport type ObservationEvidence = typeof ObservationEvidence.Type;\n\nexport const Observation = Schema.TaggedStruct(\"Observation\", {\n  provider: Schema.Array(ObservationEvidence),\n  publicDns: Schema.Array(ObservationEvidence),\n});\nexport type Observation = typeof Observation.Type;\n\nexport const CleanupOperation = Schema.TaggedUnion({\n  AlreadyAbsent: { id: Schema.String, record: DnsRecord },\n  Blocked: { id: Schema.String, reason: Schema.String, record: DnsRecord },\n  Delete: { id: Schema.String, record: DnsRecord },\n});\nexport type CleanupOperation = typeof CleanupOperation.Type;\n\nexport const CleanupPlan = Schema.TaggedStruct(\"CleanupPlan\", {\n  digest: Schema.String,\n  expiresAt: Schema.String,\n  operations: Schema.Array(CleanupOperation),\n});\nexport type CleanupPlan = typeof CleanupPlan.Type;\n\nconst CleanupOutcomeFields = {\n  operationId: Schema.String,\n  results: Schema.Array(OperationResult),\n};\nexport const CleanupResult = Schema.TaggedUnion({\n  Cleaned: CleanupOutcomeFields,\n  Partial: CleanupOutcomeFields,\n  Stale: { message: Schema.String },\n});\nexport type CleanupResult = typeof CleanupResult.Type;\n\nexport interface ConnectInput {\n  readonly domain: string;\n  readonly method: Method;\n  readonly providerId: string;\n}\n\nexport interface InspectInput {\n  readonly domain: string;\n}\n\nexport interface AttachInput {\n  readonly connectionId: string;\n  readonly domain: string;\n  readonly target: Connection.ProviderTarget;\n}\n\nexport interface DetachInput {\n  readonly attachmentId: string;\n  readonly preserveDns: true;\n}\n\nexport interface ProvisioningPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n}\n\nexport interface ProvisioningApplyInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly planDigest: string;\n}\n\nexport interface ObserveInput {\n  readonly attachmentId?: string;\n  readonly domain: string;\n  readonly records: ReadonlyArray<DnsRecord>;\n  readonly sources: {\n    readonly provider: boolean;\n    readonly publicDns: boolean;\n  };\n}\n\nexport interface CleanupPlanInput {\n  readonly attachmentId: string;\n  readonly domain: string;\n  readonly receiptId: string;\n}\n\nexport interface CleanupApplyInput extends CleanupPlanInput {\n  readonly planDigest: string;\n}\n\n/** Application-facing DNS connection and provisioning capability. */\nexport interface Interface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Effect.Effect<CleanupResult, Failure>;\n    readonly plan: (input: CleanupPlanInput) => Effect.Effect<CleanupPlan, Failure>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Effect.Effect<Connected, Failure>;\n    readonly connect: (input: ConnectInput) => Effect.Effect<ConnectionResult, Failure>;\n    readonly inspect: (input: InspectInput) => Effect.Effect<ConnectionSnapshot, Failure>;\n    readonly detach: (input: DetachInput) => Effect.Effect<DetachResult, Failure>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Effect.Effect<ApplyResult, Failure>;\n    readonly plan: (input: ProvisioningPlanInput) => Effect.Effect<ProvisioningPlan, Failure>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Effect.Effect<Observation, Failure>;\n  };\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Transport\") {}\n\n/** Promise-shaped host seam for foreign runtimes and framework actions. */\nexport interface AsyncInterface {\n  readonly cleanup: {\n    readonly apply: (input: CleanupApplyInput) => Promise<CleanupResult>;\n    readonly plan: (input: CleanupPlanInput) => Promise<CleanupPlan>;\n  };\n  readonly connection: {\n    readonly attach: (input: AttachInput) => Promise<Connected>;\n    readonly connect: (input: ConnectInput) => Promise<ConnectionResult>;\n    readonly inspect: (input: InspectInput) => Promise<ConnectionSnapshot>;\n    readonly detach: (input: DetachInput) => Promise<DetachResult>;\n  };\n  readonly provisioning: {\n    readonly apply: (input: ProvisioningApplyInput) => Promise<ApplyResult>;\n    readonly plan: (input: ProvisioningPlanInput) => Promise<ProvisioningPlan>;\n  };\n  readonly verification: {\n    readonly observe: (input: ObserveInput) => Promise<Observation>;\n  };\n}\n\nexport interface AsyncOptions {\n  readonly onError?: (operation: string, cause: unknown) => Failure;\n}\n\n/** Converts a Promise-shaped host implementation into the canonical Effect service. */\nexport const fromAsync = (transport: AsyncInterface, options: AsyncOptions = {}): Interface => {\n  const attempt = <A>(operation: string, evaluate: () => Promise<A>) =>\n    Effect.tryPromise({\n      try: evaluate,\n      catch: (cause) =>\n        options.onError?.(operation, cause) ??\n        (cause instanceof Failure\n          ? cause\n          : new Failure({\n              message: cause instanceof globalThis.Error ? cause.message : String(cause),\n              operation,\n              retry: \"unknown\",\n            })),\n    });\n  return Service.of({\n    cleanup: {\n      apply: (input) => attempt(\"cleanup.apply\", () => transport.cleanup.apply(input)),\n      plan: (input) => attempt(\"cleanup.plan\", () => transport.cleanup.plan(input)),\n    },\n    connection: {\n      attach: (input) => attempt(\"connection.attach\", () => transport.connection.attach(input)),\n      connect: (input) => attempt(\"connection.connect\", () => transport.connection.connect(input)),\n      inspect: (input) => attempt(\"connection.inspect\", () => transport.connection.inspect(input)),\n      detach: (input) => attempt(\"connection.detach\", () => transport.connection.detach(input)),\n    },\n    provisioning: {\n      apply: (input) => attempt(\"provisioning.apply\", () => transport.provisioning.apply(input)),\n      plan: (input) => attempt(\"provisioning.plan\", () => transport.provisioning.plan(input)),\n    },\n    verification: {\n      observe: (input) =>\n        attempt(\"verification.observe\", () => transport.verification.observe(input)),\n    },\n  });\n};\n\nexport const layerFromAsync = (\n  transport: AsyncInterface,\n  options?: AsyncOptions,\n): Layer.Layer<Service> => Layer.succeed(Service, fromAsync(transport, options));\n\n/** Converts an environment-free Effect service into its Promise-shaped host seam. */\nexport const toAsync = (transport: Interface): AsyncInterface => ({\n  cleanup: {\n    apply: (input) => Effect.runPromise(transport.cleanup.apply(input)),\n    plan: (input) => Effect.runPromise(transport.cleanup.plan(input)),\n  },\n  connection: {\n    attach: (input) => Effect.runPromise(transport.connection.attach(input)),\n    connect: (input) => Effect.runPromise(transport.connection.connect(input)),\n    inspect: (input) => Effect.runPromise(transport.connection.inspect(input)),\n    detach: (input) => Effect.runPromise(transport.connection.detach(input)),\n  },\n  provisioning: {\n    apply: (input) => Effect.runPromise(transport.provisioning.apply(input)),\n    plan: (input) => Effect.runPromise(transport.provisioning.plan(input)),\n  },\n  verification: {\n    observe: (input) => Effect.runPromise(transport.verification.observe(input)),\n  },\n});\n","import packageJson from \"../package.json\" with { type: \"json\" };\n\n/** The current package version from the package manifest. */\nexport const VERSION = packageJson.version;\n\nexport * as Connection from \"./auth/connection-api.ts\";\nexport * as ManagedDnsConnections from \"./auth/lifecycle-api.ts\";\nexport * as Diagnostic from \"./auth/diagnostic.ts\";\nexport * as ProviderAuth from \"./auth/manifest.ts\";\nexport * as ProviderContext from \"./auth/provider-context.ts\";\nexport * as Secret from \"./auth/secret.ts\";\nexport * as ProviderDiscovery from \"./discovery/selection.ts\";\nexport * as ZoneDiscovery from \"./discovery/zone-discovery.ts\";\nexport * as Zones from \"./discovery/zones.ts\";\nexport * as DnsRecord from \"./domain/dns-record.ts\";\nexport * as DomainName from \"./domain/domain-name.ts\";\nexport * as InvalidInput from \"./invalid-input.ts\";\nexport * as DnsProvider from \"./provider/provider.ts\";\nexport * as ProviderSession from \"./provider/session.ts\";\nexport * as ConnectionAuthorization from \"./plan/connection-authorization.ts\";\nexport * as Digest from \"./plan/canonical-json.ts\";\nexport * as Deletion from \"./plan/deletion.ts\";\nexport * as Provisioning from \"./plan/plan.ts\";\nexport * as DnsPlan from \"./plan/types.ts\";\nexport * as Cloudflare from \"./providers/cloudflare/index.ts\";\nexport * as Vercel from \"./providers/vercel/index.ts\";\nexport * as Transport from \"./transport.ts\";\nexport * as CloudflareDnsOverHttps from \"./verification/cloudflare-doh.ts\";\nexport * as DnsData from \"./verification/dns-data.ts\";\nexport * as DnsOverHttps from \"./verification/doh.ts\";\nexport * as GoogleDnsOverHttps from \"./verification/google-doh.ts\";\nexport * as DnsResolverPool from \"./verification/resolver-pool.ts\";\nexport * as DnsResolver from \"./verification/resolver.ts\";\nexport * as Verification from \"./verification/verify.ts\";\n"],"mappings":";;;;;;;;AAOA,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAIxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,MAAa,SAAS,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAGxE;CAED,OAAO,QAAO,OADSA,UAAAA,CACD,OAAO,KAAK;AACpC,CAAC;;AAGD,SAAgB,WAAc,OAMwD;CACpF,OAAO,OAAO,IAAI,aAAa;EAE7B,OAAO,QAAO,OADSA,UAAAA,CACD,WAAW;GAC/B,cAAc,MAAM;GACpB,SAAS,MAAM;GACf,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AK5BA,IAAa,UAAb,cAA6B,OAAO,YAAqB,CAAC,CAAC,WAAW;CACpE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,0BAA0B,OAAO,OAAO;CACnD,aAAa,OAAO,YAAY,OAAO,MAAM;CAC7C,KAAK,OAAO;CACZ,OAAO,OAAO;CACd,aAAa,OAAO,YAAY,OAAO,MAAM;CAC7C,UAAU,OAAO,YAAY,OAAO,OAAO;AAC7C,CAAC;AAGD,MAAa,uBAAuB,OAAO,YAAY;CACrD,aAAa,EAAE,OAAO,OAAO,OAAO;CACpC,OAAO,EAAE,OAAO,OAAO,OAAO;CAC9B,OAAO;EACL,OAAO,OAAO;EACd,YAAY,OAAO,YAAY,OAAO,MAAM,uBAAuB,CAAC;EACpE,aAAa,OAAO,YAAY,OAAO,MAAM;CAC/C;AACF,CAAC;AAYD,MAAa,SAAS,KAAK,WAAmB;AAE9C,MAAa,WAAW,OAAO,OAAO;CACpC,gBAAgB,OAAO,MAAM,oBAAoB;CACjD,IAAI,OAAO;CACX,MAAM,OAAO;AACf,CAAC;AAGD,MAAa,YAAY,OAAO,aAAa,aAAa;CACxD,YAAYC;CACZ,YAAYC;CACZ,UAAU;AACZ,CAAC;AAGD,MAAa,qBAAqB,OAAO,OAAO;CAC9C,YAAYA;CACZ,SAAS,OAAO,MAAMC,cAAyB;AACjD,CAAC;AAGD,MAAa,eAAe,OAAO,aAAa,gBAAgB;CAC9D,QAAQ,OAAO;CACf,UAAU;CACV,qBAAqB,OAAO,MAAM,kBAAkB;AACtD,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe,EAAE,QAAQ,OAAO,OAAO,CAAC;AAGvF,MAAa,qBAAqB,OAAO,MAAM;CAAC;CAAW;CAAc;AAAW,CAAC,CAAC,CAAC,KACrF,OAAO,cAAc,MAAM,CAC7B;AAGA,MAAa,WAAW,OAAO,aAAa,YAAY,EAAE,kBAAkB,OAAO,OAAO,CAAC;AAG3F,MAAa,mBAAmB,OAAO,MAAM,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,KAClE,OAAO,cAAc,MAAM,CAC7B;AAGA,MAAa,eAAe,OAAO,aAAa,YAAY;CAC1D,YAAYF;CACZ,YAAYC;CACZ,sBAAsB,OAAO;AAC/B,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,IAAI,OAAO;CACX,MAAM,OAAO;CACb,UAAU,OAAO,YAAY,OAAO,GAAG;CACvC,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC;;AAID,MAAa,iBAAiB,IAAY,WAAiD;CACzF,QAAQ,OAAO,MAAf;EACE,KAAK;EACL,KAAK,QACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAQ;EAC3E,KAAK;EACL,KAAK,MACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAO;EAC1E,KAAK,OACH,OAAO;GAAE;GAAI,MAAM,OAAO;GAAM,MAAM,OAAO;GAAM,OAAO,OAAO;EAAM;EACzE,KAAK,MACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,GAAG,OAAO;EACjD;EACF,KAAK,OACH,OAAO;GACL;GACA,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,OAAO,GAAG,OAAO,OAAO,GAAG,OAAO,KAAK,GAAG,OAAO;EACnD;CACJ;AACF;AAEA,MAAa,gBAAgB,OAAO,YAAY;CAC9C,UAAU;EAAE,IAAI,OAAO;EAAQ,QAAQ,OAAO;EAAQ,QAAQ;CAAU;CACxE,QAAQ;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;CAC/C,MAAM;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;AAC/C,CAAC;AAGD,MAAa,mBAAmB,OAAO,aAAa,QAAQ;CAC1D,QAAQ,OAAO;CACf,WAAW,OAAO;CAClB,YAAY,OAAO,MAAM,aAAa;AACxC,CAAC;AAGD,MAAa,kBAAkB,OAAO,YAAY;CAChD,SAAS,EAAE,aAAa,OAAO,OAAO;CACtC,QAAQ;EAAE,SAAS,OAAO;EAAQ,aAAa,OAAO;CAAO;CAC7D,WAAW,EAAE,aAAa,OAAO,OAAO;AAC1C,CAAC;AAGD,MAAM,qBAAqB;CACzB,aAAa,OAAO;CACpB,WAAW,OAAO;CAClB,SAAS,OAAO,MAAM,eAAe;AACvC;AACA,MAAa,cAAc,OAAO,YAAY;CAC5C,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAAS,OAAO,OAAO;AAClC,CAAC;AAGD,MAAa,sBAAsB,OAAO,YAAY;CACpD,OAAO,EAAE,UAAU,OAAO,OAAO;CACjC,UAAU;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAO;CAC5D,SAAS,EAAE,UAAU,OAAO,OAAO;CACnC,aAAa;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAO;AACjE,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe;CAC5D,UAAU,OAAO,MAAM,mBAAmB;CAC1C,WAAW,OAAO,MAAM,mBAAmB;AAC7C,CAAC;AAGD,MAAa,mBAAmB,OAAO,YAAY;CACjD,eAAe;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;CACtD,SAAS;EAAE,IAAI,OAAO;EAAQ,QAAQ,OAAO;EAAQ,QAAQ;CAAU;CACvE,QAAQ;EAAE,IAAI,OAAO;EAAQ,QAAQ;CAAU;AACjD,CAAC;AAGD,MAAa,cAAc,OAAO,aAAa,eAAe;CAC5D,QAAQ,OAAO;CACf,WAAW,OAAO;CAClB,YAAY,OAAO,MAAM,gBAAgB;AAC3C,CAAC;AAGD,MAAM,uBAAuB;CAC3B,aAAa,OAAO;CACpB,SAAS,OAAO,MAAM,eAAe;AACvC;AACA,MAAa,gBAAgB,OAAO,YAAY;CAC9C,SAAS;CACT,SAAS;CACT,OAAO,EAAE,SAAS,OAAO,OAAO;AAClC,CAAC;AA6ED,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;;AA4B5F,MAAa,aAAa,WAA2B,UAAwB,CAAC,MAAiB;CAC7F,MAAM,WAAc,WAAmB,aACrC,OAAO,WAAW;EAChB,KAAK;EACL,QAAQ,UACN,QAAQ,UAAU,WAAW,KAAK,MACjC,iBAAiB,UACd,QACA,IAAI,QAAQ;GACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;GACzE;GACA,OAAO;EACT,CAAC;CACT,CAAC;CACH,OAAO,QAAQ,GAAG;EAChB,SAAS;GACP,QAAQ,UAAU,QAAQ,uBAAuB,UAAU,QAAQ,MAAM,KAAK,CAAC;GAC/E,OAAO,UAAU,QAAQ,sBAAsB,UAAU,QAAQ,KAAK,KAAK,CAAC;EAC9E;EACA,YAAY;GACV,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;GACxF,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,UAAU,UAAU,QAAQ,4BAA4B,UAAU,WAAW,QAAQ,KAAK,CAAC;GAC3F,SAAS,UAAU,QAAQ,2BAA2B,UAAU,WAAW,OAAO,KAAK,CAAC;EAC1F;EACA,cAAc;GACZ,QAAQ,UAAU,QAAQ,4BAA4B,UAAU,aAAa,MAAM,KAAK,CAAC;GACzF,OAAO,UAAU,QAAQ,2BAA2B,UAAU,aAAa,KAAK,KAAK,CAAC;EACxF;EACA,cAAc,EACZ,UAAU,UACR,QAAQ,8BAA8B,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC/E;CACF,CAAC;AACH;AAEA,MAAa,kBACX,WACA,YACyB,MAAM,QAAQ,SAAS,UAAU,WAAW,OAAO,CAAC;;AAG/E,MAAa,WAAW,eAA0C;CAChE,SAAS;EACP,QAAQ,UAAU,OAAO,WAAW,UAAU,QAAQ,MAAM,KAAK,CAAC;EAClE,OAAO,UAAU,OAAO,WAAW,UAAU,QAAQ,KAAK,KAAK,CAAC;CAClE;CACA,YAAY;EACV,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;EACvE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,UAAU,UAAU,OAAO,WAAW,UAAU,WAAW,QAAQ,KAAK,CAAC;EACzE,SAAS,UAAU,OAAO,WAAW,UAAU,WAAW,OAAO,KAAK,CAAC;CACzE;CACA,cAAc;EACZ,QAAQ,UAAU,OAAO,WAAW,UAAU,aAAa,MAAM,KAAK,CAAC;EACvE,OAAO,UAAU,OAAO,WAAW,UAAU,aAAa,KAAK,KAAK,CAAC;CACvE;CACA,cAAc,EACZ,UAAU,UAAU,OAAO,WAAW,UAAU,aAAa,QAAQ,KAAK,CAAC,EAC7E;AACF;;;;AC1XA,MAAa,UAAUE"}

package/dist/{managed-dns-connections-CaXts84E.mjs → managed-dns-connections-C3A_GBaz.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { o as Error, s as Service } from "./canonical-json-9x7gHIoS.mjs";
+import { o as Error, s as Service } from "./canonical-json-CQYKsZw7.mjs";
 import { Effect, Layer } from "effect";
 //#region src/promise/managed-dns-connections.ts
 var managed_dns_connections_exports = /* @__PURE__ */ __exportAll({
@@ -96,4 +96,4 @@ const from = (repository) => repository;
 //#endregion
 export { managed_dns_connections_exports as n, layerFromAsync as t };
 
-//# sourceMappingURL=managed-dns-connections-CaXts84E.mjs.map
+//# sourceMappingURL=managed-dns-connections-C3A_GBaz.mjs.map

package/dist/{managed-dns-connections-CaXts84E.mjs.map → managed-dns-connections-C3A_GBaz.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"managed-dns-connections-CaXts84E.mjs","names":["Lifecycle.Error","Lifecycle.Service"],"sources":["../src/promise/managed-dns-connections.ts"],"sourcesContent":["import { Effect, Layer } from \"effect\";\n\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport type * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface AsyncInterface {\n  readonly attach: (input: {\n    readonly attachment: Connection.DomainAttachment;\n    readonly connectionId: string;\n    readonly ownerId: string;\n  }) => Promise<Lifecycle.AttachmentResult>;\n  readonly connect: (input: Lifecycle.ConnectInput) => Promise<Lifecycle.Aggregate>;\n  readonly detach: (input: {\n    readonly attachmentId: string;\n    readonly ownerId: string;\n  }) => Promise<Lifecycle.DetachResult>;\n  readonly disconnect: (input: {\n    readonly connectionId: string;\n    readonly ownerId: string;\n    readonly revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Promise<void>;\n  }) => Promise<Lifecycle.DisconnectResult>;\n  readonly findConnection: (\n    ownerId: string,\n    authorizationId: string,\n  ) => Promise<Connection.StoredConnection | null>;\n  readonly get: (authorizationId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly getAttachment: (attachmentId: string) => Promise<Connection.DomainAttachment | null>;\n  readonly getByConnectionId: (connectionId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly listAttachments: (\n    connectionId: string,\n    ownerId: string,\n  ) => Promise<ReadonlyArray<Connection.DomainAttachment>>;\n  readonly promoteEvidence: (\n    authorizationId: string,\n    evidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  ) => Promise<Lifecycle.Aggregate>;\n  readonly recover: (input: {\n    readonly authorizationId: string;\n    readonly revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Promise<void>;\n  }) => Promise<Lifecycle.DisconnectResult>;\n  readonly rotate: (\n    authorizationId: string,\n    credential: Connection.StoredCredential,\n  ) => Promise<Lifecycle.Aggregate>;\n}\n\nconst failure = (operation: string, cause: unknown): Lifecycle.Error =>\n  cause instanceof Lifecycle.Error\n    ? cause\n    : new Lifecycle.Error({\n        category: \"storage\",\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        retry: \"safe\",\n      });\n\nexport const layerFromAsync = (repository: AsyncInterface): Layer.Layer<Lifecycle.Service> =>\n  Layer.succeed(Lifecycle.Service, {\n    attach: (input) =>\n      Effect.tryPromise({\n        try: () => repository.attach(input),\n        catch: (cause) => failure(\"ManagedDnsConnections.attach\", cause),\n      }),\n    connect: (input) =>\n      Effect.tryPromise({\n        try: () => repository.connect(input),\n        catch: (cause) => failure(\"ManagedDnsConnections.connect\", cause),\n      }),\n    detach: (input) =>\n      Effect.tryPromise({\n        try: () => repository.detach(input),\n        catch: (cause) => failure(\"ManagedDnsConnections.detach\", cause),\n      }),\n    disconnect: ({ connectionId, ownerId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.disconnect({\n            connectionId,\n            ownerId,\n            revoke: (authorization) => Effect.runPromise(revoke(authorization)),\n          }),\n        catch: (cause) => failure(\"ManagedDnsConnections.disconnect\", cause),\n      }),\n    findConnection: (ownerId, authorizationId) =>\n      Effect.tryPromise({\n        try: () => repository.findConnection(ownerId, authorizationId),\n        catch: (cause) => failure(\"ManagedDnsConnections.findConnection\", cause),\n      }),\n    get: (authorizationId) =>\n      Effect.tryPromise({\n        try: () => repository.get(authorizationId),\n        catch: (cause) => failure(\"ManagedDnsConnections.get\", cause),\n      }),\n    getAttachment: (attachmentId) =>\n      Effect.tryPromise({\n        try: () => repository.getAttachment(attachmentId),\n        catch: (cause) => failure(\"ManagedDnsConnections.getAttachment\", cause),\n      }),\n    getByConnectionId: (connectionId) =>\n      Effect.tryPromise({\n        try: () => repository.getByConnectionId(connectionId),\n        catch: (cause) => failure(\"ManagedDnsConnections.getByConnectionId\", cause),\n      }),\n    listAttachments: (connectionId, ownerId) =>\n      Effect.tryPromise({\n        try: () => repository.listAttachments(connectionId, ownerId),\n        catch: (cause) => failure(\"ManagedDnsConnections.listAttachments\", cause),\n      }),\n    promoteEvidence: (authorizationId, evidence) =>\n      Effect.tryPromise({\n        try: () => repository.promoteEvidence(authorizationId, evidence),\n        catch: (cause) => failure(\"ManagedDnsConnections.promoteEvidence\", cause),\n      }),\n    recover: ({ authorizationId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.recover({\n            authorizationId,\n            revoke: (authorization) => Effect.runPromise(revoke(authorization)),\n          }),\n        catch: (cause) => failure(\"ManagedDnsConnections.recover\", cause),\n      }),\n    rotate: (authorizationId, credential) =>\n      Effect.tryPromise({\n        try: () => repository.rotate(authorizationId, credential),\n        catch: (cause) => failure(\"ManagedDnsConnections.rotate\", cause),\n      }),\n  });\n\nexport const toAsync = (service: Lifecycle.Interface): AsyncInterface => ({\n  attach: (input) => Effect.runPromise(service.attach(input)),\n  connect: (input) => Effect.runPromise(service.connect(input)),\n  detach: (input) => Effect.runPromise(service.detach(input)),\n  disconnect: ({ connectionId, ownerId, revoke }) =>\n    Effect.runPromise(\n      service.disconnect({\n        connectionId,\n        ownerId,\n        revoke: (authorization) => Effect.promise(() => revoke(authorization)),\n      }),\n    ),\n  findConnection: (ownerId, authorizationId) =>\n    Effect.runPromise(service.findConnection(ownerId, authorizationId)),\n  get: (authorizationId) => Effect.runPromise(service.get(authorizationId)),\n  getAttachment: (attachmentId) => Effect.runPromise(service.getAttachment(attachmentId)),\n  getByConnectionId: (connectionId) => Effect.runPromise(service.getByConnectionId(connectionId)),\n  listAttachments: (connectionId, ownerId) =>\n    Effect.runPromise(service.listAttachments(connectionId, ownerId)),\n  promoteEvidence: (authorizationId, evidence) =>\n    Effect.runPromise(service.promoteEvidence(authorizationId, evidence)),\n  recover: ({ authorizationId, revoke }) =>\n    Effect.runPromise(\n      service.recover({\n        authorizationId,\n        revoke: (authorization) => Effect.promise(() => revoke(authorization)),\n      }),\n    ),\n  rotate: (authorizationId, credential) =>\n    Effect.runPromise(service.rotate(authorizationId, credential)),\n});\n\nexport const from = (repository: AsyncInterface): AsyncInterface => repository;\n\nexport { Error } from \"../auth/lifecycle-repository.ts\";\nexport type {\n  AttachmentResult,\n  DetachResult,\n  DisconnectResult,\n} from \"../auth/lifecycle-repository.ts\";\n"],"mappings":";;;;;;;;;;AA+CA,MAAM,WAAW,WAAmB,UAClC,iBAAiBA,QACb,QACA,IAAIA,MAAgB;CAClB,UAAU;CACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;CACzE;CACA,OAAO;AACT,CAAC;AAEP,MAAa,kBAAkB,eAC7B,MAAM,QAAQC,SAAmB;CAC/B,SAAS,UACP,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,KAAK;EAClC,QAAQ,UAAU,QAAQ,gCAAgC,KAAK;CACjE,CAAC;CACH,UAAU,UACR,OAAO,WAAW;EAChB,WAAW,WAAW,QAAQ,KAAK;EACnC,QAAQ,UAAU,QAAQ,iCAAiC,KAAK;CAClE,CAAC;CACH,SAAS,UACP,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,KAAK;EAClC,QAAQ,UAAU,QAAQ,gCAAgC,KAAK;CACjE,CAAC;CACH,aAAa,EAAE,cAAc,SAAS,aACpC,OAAO,WAAW;EAChB,WACE,WAAW,WAAW;GACpB;GACA;GACA,SAAS,kBAAkB,OAAO,WAAW,OAAO,aAAa,CAAC;EACpE,CAAC;EACH,QAAQ,UAAU,QAAQ,oCAAoC,KAAK;CACrE,CAAC;CACH,iBAAiB,SAAS,oBACxB,OAAO,WAAW;EAChB,WAAW,WAAW,eAAe,SAAS,eAAe;EAC7D,QAAQ,UAAU,QAAQ,wCAAwC,KAAK;CACzE,CAAC;CACH,MAAM,oBACJ,OAAO,WAAW;EAChB,WAAW,WAAW,IAAI,eAAe;EACzC,QAAQ,UAAU,QAAQ,6BAA6B,KAAK;CAC9D,CAAC;CACH,gBAAgB,iBACd,OAAO,WAAW;EAChB,WAAW,WAAW,cAAc,YAAY;EAChD,QAAQ,UAAU,QAAQ,uCAAuC,KAAK;CACxE,CAAC;CACH,oBAAoB,iBAClB,OAAO,WAAW;EAChB,WAAW,WAAW,kBAAkB,YAAY;EACpD,QAAQ,UAAU,QAAQ,2CAA2C,KAAK;CAC5E,CAAC;CACH,kBAAkB,cAAc,YAC9B,OAAO,WAAW;EAChB,WAAW,WAAW,gBAAgB,cAAc,OAAO;EAC3D,QAAQ,UAAU,QAAQ,yCAAyC,KAAK;CAC1E,CAAC;CACH,kBAAkB,iBAAiB,aACjC,OAAO,WAAW;EAChB,WAAW,WAAW,gBAAgB,iBAAiB,QAAQ;EAC/D,QAAQ,UAAU,QAAQ,yCAAyC,KAAK;CAC1E,CAAC;CACH,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WAAW;EAChB,WACE,WAAW,QAAQ;GACjB;GACA,SAAS,kBAAkB,OAAO,WAAW,OAAO,aAAa,CAAC;EACpE,CAAC;EACH,QAAQ,UAAU,QAAQ,iCAAiC,KAAK;CAClE,CAAC;CACH,SAAS,iBAAiB,eACxB,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,iBAAiB,UAAU;EACxD,QAAQ,UAAU,QAAQ,gCAAgC,KAAK;CACjE,CAAC;AACL,CAAC;AAEH,MAAa,WAAW,aAAkD;CACxE,SAAS,UAAU,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;CAC1D,UAAU,UAAU,OAAO,WAAW,QAAQ,QAAQ,KAAK,CAAC;CAC5D,SAAS,UAAU,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;CAC1D,aAAa,EAAE,cAAc,SAAS,aACpC,OAAO,WACL,QAAQ,WAAW;EACjB;EACA;EACA,SAAS,kBAAkB,OAAO,cAAc,OAAO,aAAa,CAAC;CACvE,CAAC,CACH;CACF,iBAAiB,SAAS,oBACxB,OAAO,WAAW,QAAQ,eAAe,SAAS,eAAe,CAAC;CACpE,MAAM,oBAAoB,OAAO,WAAW,QAAQ,IAAI,eAAe,CAAC;CACxE,gBAAgB,iBAAiB,OAAO,WAAW,QAAQ,cAAc,YAAY,CAAC;CACtF,oBAAoB,iBAAiB,OAAO,WAAW,QAAQ,kBAAkB,YAAY,CAAC;CAC9F,kBAAkB,cAAc,YAC9B,OAAO,WAAW,QAAQ,gBAAgB,cAAc,OAAO,CAAC;CAClE,kBAAkB,iBAAiB,aACjC,OAAO,WAAW,QAAQ,gBAAgB,iBAAiB,QAAQ,CAAC;CACtE,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WACL,QAAQ,QAAQ;EACd;EACA,SAAS,kBAAkB,OAAO,cAAc,OAAO,aAAa,CAAC;CACvE,CAAC,CACH;CACF,SAAS,iBAAiB,eACxB,OAAO,WAAW,QAAQ,OAAO,iBAAiB,UAAU,CAAC;AACjE;AAEA,MAAa,QAAQ,eAA+C"}
+{"version":3,"file":"managed-dns-connections-C3A_GBaz.mjs","names":["Lifecycle.Error","Lifecycle.Service"],"sources":["../src/promise/managed-dns-connections.ts"],"sourcesContent":["import { Effect, Layer } from \"effect\";\n\nimport type * as ProviderAuthorization from \"../auth/authorization.ts\";\nimport type * as Connection from \"../auth/connection.ts\";\nimport * as Lifecycle from \"../auth/lifecycle-repository.ts\";\n\nexport interface AsyncInterface {\n  readonly attach: (input: {\n    readonly attachment: Connection.DomainAttachment;\n    readonly connectionId: string;\n    readonly ownerId: string;\n  }) => Promise<Lifecycle.AttachmentResult>;\n  readonly connect: (input: Lifecycle.ConnectInput) => Promise<Lifecycle.Aggregate>;\n  readonly detach: (input: {\n    readonly attachmentId: string;\n    readonly ownerId: string;\n  }) => Promise<Lifecycle.DetachResult>;\n  readonly disconnect: (input: {\n    readonly connectionId: string;\n    readonly ownerId: string;\n    readonly revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Promise<void>;\n  }) => Promise<Lifecycle.DisconnectResult>;\n  readonly findConnection: (\n    ownerId: string,\n    authorizationId: string,\n  ) => Promise<Connection.StoredConnection | null>;\n  readonly get: (authorizationId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly getAttachment: (attachmentId: string) => Promise<Connection.DomainAttachment | null>;\n  readonly getByConnectionId: (connectionId: string) => Promise<Lifecycle.Aggregate | null>;\n  readonly listAttachments: (\n    connectionId: string,\n    ownerId: string,\n  ) => Promise<ReadonlyArray<Connection.DomainAttachment>>;\n  readonly promoteEvidence: (\n    authorizationId: string,\n    evidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  ) => Promise<Lifecycle.Aggregate>;\n  readonly recover: (input: {\n    readonly authorizationId: string;\n    readonly revoke: (authorization: ProviderAuthorization.ProviderAuthorization) => Promise<void>;\n  }) => Promise<Lifecycle.DisconnectResult>;\n  readonly rotate: (\n    authorizationId: string,\n    credential: Connection.StoredCredential,\n  ) => Promise<Lifecycle.Aggregate>;\n}\n\nconst failure = (operation: string, cause: unknown): Lifecycle.Error =>\n  cause instanceof Lifecycle.Error\n    ? cause\n    : new Lifecycle.Error({\n        category: \"storage\",\n        message: cause instanceof globalThis.Error ? cause.message : String(cause),\n        operation,\n        retry: \"safe\",\n      });\n\nexport const layerFromAsync = (repository: AsyncInterface): Layer.Layer<Lifecycle.Service> =>\n  Layer.succeed(Lifecycle.Service, {\n    attach: (input) =>\n      Effect.tryPromise({\n        try: () => repository.attach(input),\n        catch: (cause) => failure(\"ManagedDnsConnections.attach\", cause),\n      }),\n    connect: (input) =>\n      Effect.tryPromise({\n        try: () => repository.connect(input),\n        catch: (cause) => failure(\"ManagedDnsConnections.connect\", cause),\n      }),\n    detach: (input) =>\n      Effect.tryPromise({\n        try: () => repository.detach(input),\n        catch: (cause) => failure(\"ManagedDnsConnections.detach\", cause),\n      }),\n    disconnect: ({ connectionId, ownerId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.disconnect({\n            connectionId,\n            ownerId,\n            revoke: (authorization) => Effect.runPromise(revoke(authorization)),\n          }),\n        catch: (cause) => failure(\"ManagedDnsConnections.disconnect\", cause),\n      }),\n    findConnection: (ownerId, authorizationId) =>\n      Effect.tryPromise({\n        try: () => repository.findConnection(ownerId, authorizationId),\n        catch: (cause) => failure(\"ManagedDnsConnections.findConnection\", cause),\n      }),\n    get: (authorizationId) =>\n      Effect.tryPromise({\n        try: () => repository.get(authorizationId),\n        catch: (cause) => failure(\"ManagedDnsConnections.get\", cause),\n      }),\n    getAttachment: (attachmentId) =>\n      Effect.tryPromise({\n        try: () => repository.getAttachment(attachmentId),\n        catch: (cause) => failure(\"ManagedDnsConnections.getAttachment\", cause),\n      }),\n    getByConnectionId: (connectionId) =>\n      Effect.tryPromise({\n        try: () => repository.getByConnectionId(connectionId),\n        catch: (cause) => failure(\"ManagedDnsConnections.getByConnectionId\", cause),\n      }),\n    listAttachments: (connectionId, ownerId) =>\n      Effect.tryPromise({\n        try: () => repository.listAttachments(connectionId, ownerId),\n        catch: (cause) => failure(\"ManagedDnsConnections.listAttachments\", cause),\n      }),\n    promoteEvidence: (authorizationId, evidence) =>\n      Effect.tryPromise({\n        try: () => repository.promoteEvidence(authorizationId, evidence),\n        catch: (cause) => failure(\"ManagedDnsConnections.promoteEvidence\", cause),\n      }),\n    recover: ({ authorizationId, revoke }) =>\n      Effect.tryPromise({\n        try: () =>\n          repository.recover({\n            authorizationId,\n            revoke: (authorization) => Effect.runPromise(revoke(authorization)),\n          }),\n        catch: (cause) => failure(\"ManagedDnsConnections.recover\", cause),\n      }),\n    rotate: (authorizationId, credential) =>\n      Effect.tryPromise({\n        try: () => repository.rotate(authorizationId, credential),\n        catch: (cause) => failure(\"ManagedDnsConnections.rotate\", cause),\n      }),\n  });\n\nexport const toAsync = (service: Lifecycle.Interface): AsyncInterface => ({\n  attach: (input) => Effect.runPromise(service.attach(input)),\n  connect: (input) => Effect.runPromise(service.connect(input)),\n  detach: (input) => Effect.runPromise(service.detach(input)),\n  disconnect: ({ connectionId, ownerId, revoke }) =>\n    Effect.runPromise(\n      service.disconnect({\n        connectionId,\n        ownerId,\n        revoke: (authorization) => Effect.promise(() => revoke(authorization)),\n      }),\n    ),\n  findConnection: (ownerId, authorizationId) =>\n    Effect.runPromise(service.findConnection(ownerId, authorizationId)),\n  get: (authorizationId) => Effect.runPromise(service.get(authorizationId)),\n  getAttachment: (attachmentId) => Effect.runPromise(service.getAttachment(attachmentId)),\n  getByConnectionId: (connectionId) => Effect.runPromise(service.getByConnectionId(connectionId)),\n  listAttachments: (connectionId, ownerId) =>\n    Effect.runPromise(service.listAttachments(connectionId, ownerId)),\n  promoteEvidence: (authorizationId, evidence) =>\n    Effect.runPromise(service.promoteEvidence(authorizationId, evidence)),\n  recover: ({ authorizationId, revoke }) =>\n    Effect.runPromise(\n      service.recover({\n        authorizationId,\n        revoke: (authorization) => Effect.promise(() => revoke(authorization)),\n      }),\n    ),\n  rotate: (authorizationId, credential) =>\n    Effect.runPromise(service.rotate(authorizationId, credential)),\n});\n\nexport const from = (repository: AsyncInterface): AsyncInterface => repository;\n\nexport { Error } from \"../auth/lifecycle-repository.ts\";\nexport type {\n  AttachmentResult,\n  DetachResult,\n  DisconnectResult,\n} from \"../auth/lifecycle-repository.ts\";\n"],"mappings":";;;;;;;;;;AA+CA,MAAM,WAAW,WAAmB,UAClC,iBAAiBA,QACb,QACA,IAAIA,MAAgB;CAClB,UAAU;CACV,SAAS,iBAAiB,WAAW,QAAQ,MAAM,UAAU,OAAO,KAAK;CACzE;CACA,OAAO;AACT,CAAC;AAEP,MAAa,kBAAkB,eAC7B,MAAM,QAAQC,SAAmB;CAC/B,SAAS,UACP,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,KAAK;EAClC,QAAQ,UAAU,QAAQ,gCAAgC,KAAK;CACjE,CAAC;CACH,UAAU,UACR,OAAO,WAAW;EAChB,WAAW,WAAW,QAAQ,KAAK;EACnC,QAAQ,UAAU,QAAQ,iCAAiC,KAAK;CAClE,CAAC;CACH,SAAS,UACP,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,KAAK;EAClC,QAAQ,UAAU,QAAQ,gCAAgC,KAAK;CACjE,CAAC;CACH,aAAa,EAAE,cAAc,SAAS,aACpC,OAAO,WAAW;EAChB,WACE,WAAW,WAAW;GACpB;GACA;GACA,SAAS,kBAAkB,OAAO,WAAW,OAAO,aAAa,CAAC;EACpE,CAAC;EACH,QAAQ,UAAU,QAAQ,oCAAoC,KAAK;CACrE,CAAC;CACH,iBAAiB,SAAS,oBACxB,OAAO,WAAW;EAChB,WAAW,WAAW,eAAe,SAAS,eAAe;EAC7D,QAAQ,UAAU,QAAQ,wCAAwC,KAAK;CACzE,CAAC;CACH,MAAM,oBACJ,OAAO,WAAW;EAChB,WAAW,WAAW,IAAI,eAAe;EACzC,QAAQ,UAAU,QAAQ,6BAA6B,KAAK;CAC9D,CAAC;CACH,gBAAgB,iBACd,OAAO,WAAW;EAChB,WAAW,WAAW,cAAc,YAAY;EAChD,QAAQ,UAAU,QAAQ,uCAAuC,KAAK;CACxE,CAAC;CACH,oBAAoB,iBAClB,OAAO,WAAW;EAChB,WAAW,WAAW,kBAAkB,YAAY;EACpD,QAAQ,UAAU,QAAQ,2CAA2C,KAAK;CAC5E,CAAC;CACH,kBAAkB,cAAc,YAC9B,OAAO,WAAW;EAChB,WAAW,WAAW,gBAAgB,cAAc,OAAO;EAC3D,QAAQ,UAAU,QAAQ,yCAAyC,KAAK;CAC1E,CAAC;CACH,kBAAkB,iBAAiB,aACjC,OAAO,WAAW;EAChB,WAAW,WAAW,gBAAgB,iBAAiB,QAAQ;EAC/D,QAAQ,UAAU,QAAQ,yCAAyC,KAAK;CAC1E,CAAC;CACH,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WAAW;EAChB,WACE,WAAW,QAAQ;GACjB;GACA,SAAS,kBAAkB,OAAO,WAAW,OAAO,aAAa,CAAC;EACpE,CAAC;EACH,QAAQ,UAAU,QAAQ,iCAAiC,KAAK;CAClE,CAAC;CACH,SAAS,iBAAiB,eACxB,OAAO,WAAW;EAChB,WAAW,WAAW,OAAO,iBAAiB,UAAU;EACxD,QAAQ,UAAU,QAAQ,gCAAgC,KAAK;CACjE,CAAC;AACL,CAAC;AAEH,MAAa,WAAW,aAAkD;CACxE,SAAS,UAAU,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;CAC1D,UAAU,UAAU,OAAO,WAAW,QAAQ,QAAQ,KAAK,CAAC;CAC5D,SAAS,UAAU,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;CAC1D,aAAa,EAAE,cAAc,SAAS,aACpC,OAAO,WACL,QAAQ,WAAW;EACjB;EACA;EACA,SAAS,kBAAkB,OAAO,cAAc,OAAO,aAAa,CAAC;CACvE,CAAC,CACH;CACF,iBAAiB,SAAS,oBACxB,OAAO,WAAW,QAAQ,eAAe,SAAS,eAAe,CAAC;CACpE,MAAM,oBAAoB,OAAO,WAAW,QAAQ,IAAI,eAAe,CAAC;CACxE,gBAAgB,iBAAiB,OAAO,WAAW,QAAQ,cAAc,YAAY,CAAC;CACtF,oBAAoB,iBAAiB,OAAO,WAAW,QAAQ,kBAAkB,YAAY,CAAC;CAC9F,kBAAkB,cAAc,YAC9B,OAAO,WAAW,QAAQ,gBAAgB,cAAc,OAAO,CAAC;CAClE,kBAAkB,iBAAiB,aACjC,OAAO,WAAW,QAAQ,gBAAgB,iBAAiB,QAAQ,CAAC;CACtE,UAAU,EAAE,iBAAiB,aAC3B,OAAO,WACL,QAAQ,QAAQ;EACd;EACA,SAAS,kBAAkB,OAAO,cAAc,OAAO,aAAa,CAAC;CACvE,CAAC,CACH;CACF,SAAS,iBAAiB,eACxB,OAAO,WAAW,QAAQ,OAAO,iBAAiB,UAAU,CAAC;AACjE;AAEA,MAAa,QAAQ,eAA+C"}