domainkit 0.6.0 → 0.8.0

package/dist/{connect-Db830jad.d.mts → connect-D-X8T9W8.d.mts}

@@ -8,17 +8,17 @@ declare const Error_base$3: Schema.Class<Error$3, Schema.TaggedStruct<"InvalidIn
 }>, import("effect/Cause").YieldableError>;
 declare class Error$3 extends Error_base$3 {}
 declare namespace domain_name_d_exports {
-  export { DomainName, Schema$4 as Schema, decode$5 as decode, parse$1 as parse };
+  export { DomainName, Schema$3 as Schema, decode$5 as decode, parse$1 as parse };
 }
 declare const Type$1: Schema.brand<Schema.String, "DomainName">;
 /** A lower-case, fully qualified DNS name without a trailing dot. */
 type DomainName = typeof Type$1.Type;
 /** Decodes user and wire strings into canonical domain names. */
-declare const Schema$4: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+declare const Schema$3: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
 declare const decode$5: (input: unknown) => Effect.Effect<string & import("effect/Brand").Brand<"DomainName">, Error$3, never>;
 declare function parse$1(input: unknown): DomainName;
 declare namespace dns_record_d_exports {
-  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, Schema$3 as Schema, Srv, Txt, Type, data, decode$4 as decode, equals, parse };
+  export { A, Aaaa, Caa, Cname, DnsRecord, Encoded, Mx, Ns, Observed, Opaque, RequirementMetadata, RecordSchema as Schema, Srv, Txt, Type, data, decode$4 as decode, equals, parse };
 }
 declare const Type: Schema.Literals<readonly ["A", "AAAA", "CNAME", "TXT", "MX", "CAA", "NS", "SRV"]>;
 type Type = typeof Type.Type;
@@ -28,7 +28,7 @@ declare const RequirementMetadata: Schema.Struct<{
   readonly purpose: Schema.String;
 }>;
 interface RequirementMetadata extends Schema.Schema.Type<typeof RequirementMetadata> {}
-declare const Schema$3: Schema.TaggedUnion<{
+declare const RecordSchema: Schema.TaggedUnion<{
   readonly A: Schema.TaggedStruct<"A", {
     readonly metadata: Schema.Struct<{
       readonly ownership: Schema.String;
@@ -124,103 +124,249 @@ declare const Schema$3: Schema.TaggedUnion<{
     readonly value: Schema.String;
   }>;
 }>;
-declare const A: Schema.TaggedStruct<"A", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+/** Constructs an A record requirement from trusted application data. */
+declare function A(input: Parameters<typeof RecordSchema.cases.A.make>[0]): {
+  readonly _tag: "A";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+};
+declare namespace A {
+  const Schema: Schema.TaggedStruct<"A", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly address: Schema.String;
-}>, Aaaa: Schema.TaggedStruct<"AAAA", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+}
+/** Constructs an AAAA record requirement from trusted application data. */
+declare function Aaaa(input: Parameters<typeof RecordSchema.cases.AAAA.make>[0]): {
+  readonly _tag: "AAAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly address: string;
+};
+declare namespace Aaaa {
+  const Schema: Schema.TaggedStruct<"AAAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly address: Schema.String;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly address: Schema.String;
-}>, Caa: Schema.TaggedStruct<"CAA", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+}
+/** Constructs a CAA record requirement from trusted application data. */
+declare function Caa(input: Parameters<typeof RecordSchema.cases.CAA.make>[0]): {
+  readonly _tag: "CAA";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly flags: number;
+  readonly tag: "iodef" | "issue" | "issuewild";
+  readonly value: string;
+};
+declare namespace Caa {
+  const Schema: Schema.TaggedStruct<"CAA", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly flags: Schema.Int;
+    readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
+    readonly value: Schema.String;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly flags: Schema.Int;
-  readonly tag: Schema.Literals<readonly ["issue", "issuewild", "iodef"]>;
-  readonly value: Schema.String;
-}>, Cname: Schema.TaggedStruct<"CNAME", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+}
+/** Constructs a CNAME record requirement from trusted application data. */
+declare function Cname(input: Parameters<typeof RecordSchema.cases.CNAME.make>[0]): {
+  readonly _tag: "CNAME";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly ttl: number | null;
+  readonly policy: "exclusive";
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+};
+declare namespace Cname {
+  const Schema: Schema.TaggedStruct<"CNAME", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly policy: Schema.Literal<"exclusive">;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly policy: Schema.Literal<"exclusive">;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-}>, Mx: Schema.TaggedStruct<"MX", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+}
+/** Constructs an MX record requirement from trusted application data. */
+declare function Mx(input: Parameters<typeof RecordSchema.cases.MX.make>[0]): {
+  readonly _tag: "MX";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly exchange: string & import("effect/Brand").Brand<"DomainName">;
+  readonly priority: number;
+};
+declare namespace Mx {
+  const Schema: Schema.TaggedStruct<"MX", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly priority: Schema.Int;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly exchange: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly priority: Schema.Int;
-}>, Ns: Schema.TaggedStruct<"NS", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+}
+/** Constructs an NS record requirement from trusted application data. */
+declare function Ns(input: Parameters<typeof RecordSchema.cases.NS.make>[0]): {
+  readonly _tag: "NS";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+};
+declare namespace Ns {
+  const Schema: Schema.TaggedStruct<"NS", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-}>, Srv: Schema.TaggedStruct<"SRV", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+}
+/** Constructs an SRV record requirement from trusted application data. */
+declare function Srv(input: Parameters<typeof RecordSchema.cases.SRV.make>[0]): {
+  readonly _tag: "SRV";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly port: number;
+  readonly priority: number;
+  readonly target: string & import("effect/Brand").Brand<"DomainName">;
+  readonly weight: number;
+};
+declare namespace Srv {
+  const Schema: Schema.TaggedStruct<"SRV", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly port: Schema.Int;
+    readonly priority: Schema.Int;
+    readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly weight: Schema.Int;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly port: Schema.Int;
-  readonly priority: Schema.Int;
-  readonly target: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly weight: Schema.Int;
-}>, Txt: Schema.TaggedStruct<"TXT", {
-  readonly metadata: Schema.Struct<{
-    readonly ownership: Schema.String;
-    readonly provenance: Schema.String;
-    readonly purpose: Schema.String;
+}
+/** Constructs a TXT record requirement from trusted application data. */
+declare function Txt(input: Parameters<typeof RecordSchema.cases.TXT.make>[0]): {
+  readonly _tag: "TXT";
+  readonly metadata: {
+    readonly ownership: string;
+    readonly provenance: string;
+    readonly purpose: string;
+  };
+  readonly name: string & import("effect/Brand").Brand<"DomainName">;
+  readonly policy: "append" | "exclusive";
+  readonly ttl: number | null;
+  readonly value: string;
+};
+declare namespace Txt {
+  const Schema: Schema.TaggedStruct<"TXT", {
+    readonly metadata: Schema.Struct<{
+      readonly ownership: Schema.String;
+      readonly provenance: Schema.String;
+      readonly purpose: Schema.String;
+    }>;
+    readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
+    readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
+    readonly ttl: Schema.NullOr<Schema.Int>;
+    readonly value: Schema.String;
   }>;
-  readonly name: Schema.decodeTo<Schema.brand<Schema.String, "DomainName">, Schema.String, never, never>;
-  readonly policy: Schema.Literals<readonly ["exclusive", "append"]>;
-  readonly ttl: Schema.NullOr<Schema.Int>;
-  readonly value: Schema.String;
-}>;
-type DnsRecord = typeof Schema$3.Type;
-type Encoded = typeof Schema$3.Encoded;
+}
+type DnsRecord = typeof RecordSchema.Type;
+type Encoded = typeof RecordSchema.Encoded;
 /** Provider state that DomainKit cannot create but must retain for safe reconciliation. */
-declare const Opaque: Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
+declare const OpaqueSchema: Schema.TaggedStruct<"Opaque", {
   readonly name: Schema.String;
   readonly providerRecordId: Schema.NullOr<Schema.String>;
   readonly providerType: Schema.String;
 }>;
-interface Opaque extends Schema.Schema.Type<typeof Opaque> {}
+/** Constructs an opaque provider record from trusted adapter data. */
+declare function Opaque(input: Parameters<typeof OpaqueSchema.make>[0]): {
+  readonly _tag: "Opaque";
+  readonly name: string;
+  readonly providerRecordId: string | null;
+  readonly providerType: string;
+};
+declare namespace Opaque {
+  const Schema: Schema.TaggedStruct<"Opaque", {
+    readonly name: Schema.String;
+    readonly providerRecordId: Schema.NullOr<Schema.String>;
+    readonly providerType: Schema.String;
+  }>;
+}
+interface Opaque extends Schema.Schema.Type<typeof OpaqueSchema> {}
 /** Any DNS record observed through a provider, including non-portable record types. */
 declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
   readonly A: Schema.TaggedStruct<"A", {
@@ -317,8 +463,7 @@ declare const Observed: Schema.Union<readonly [Schema.TaggedUnion<{
     readonly ttl: Schema.NullOr<Schema.Int>;
     readonly value: Schema.String;
   }>;
-}>, Schema.Struct<{
-  readonly _tag: Schema.Literal<"Opaque">;
+}>, Schema.TaggedStruct<"Opaque", {
   readonly name: Schema.String;
   readonly providerRecordId: Schema.NullOr<Schema.String>;
   readonly providerType: Schema.String;
@@ -478,7 +623,7 @@ declare const make: typeof Value.from;
 declare namespace manifest_d_exports {
   export { AsyncOAuthSubjectResolver, IntegrationMethod, Manifest, Method$1 as Method, OAuthClientConfiguration, OAuthMethod, OAuthSubjectResolver, Schema$2 as Schema, TokenValidation, decode$3 as decode };
 }
-declare const Method$1: Schema.TaggedUnion<{
+declare const MethodSchema: Schema.TaggedUnion<{
   readonly integration: Schema.TaggedStruct<"integration", {
     readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
     readonly installUrl: Schema.String;
@@ -500,6 +645,55 @@ declare const Method$1: Schema.TaggedUnion<{
     readonly instructionsUrl: Schema.String;
   }>;
 }>;
+/** Provider authentication method schema and constructors for trusted manifests. */
+declare const Method$1: {
+  Schema: Schema.TaggedUnion<{
+    readonly integration: Schema.TaggedStruct<"integration", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly installUrl: Schema.String;
+      readonly tokenEndpoint: Schema.String;
+    }>;
+    readonly oauth2: Schema.TaggedStruct<"oauth2", {
+      readonly authorizationServer: Schema.Struct<{
+        readonly authorization_endpoint: Schema.String;
+        readonly issuer: Schema.String;
+        readonly revocation_endpoint: Schema.optionalKey<Schema.String>;
+        readonly token_endpoint: Schema.String;
+      }>;
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly clientAuth: Schema.Literals<readonly ["none", "client_secret_basic", "client_secret_post"]>;
+      readonly scopes: Schema.$Array<Schema.String>;
+    }>;
+    readonly token: Schema.TaggedStruct<"token", {
+      readonly capabilities: Schema.$Array<Schema.Literals<readonly ["dns:read", "dns:write"]>>;
+      readonly instructionsUrl: Schema.String;
+    }>;
+  }>;
+  integration: (input: Parameters<typeof MethodSchema.cases.integration.make>[0]) => {
+    readonly _tag: "integration";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly installUrl: string;
+    readonly tokenEndpoint: string;
+  };
+  oauth2: (input: Parameters<typeof MethodSchema.cases.oauth2.make>[0]) => {
+    readonly _tag: "oauth2";
+    readonly authorizationServer: {
+      readonly authorization_endpoint: string;
+      readonly issuer: string;
+      readonly revocation_endpoint?: string;
+      readonly token_endpoint: string;
+    };
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly clientAuth: "client_secret_basic" | "client_secret_post" | "none";
+    readonly scopes: readonly string[];
+  };
+  token: (input: Parameters<typeof MethodSchema.cases.token.make>[0]) => {
+    readonly _tag: "token";
+    readonly capabilities: readonly ("dns:read" | "dns:write")[];
+    readonly instructionsUrl: string;
+  };
+};
+type Method$1 = typeof MethodSchema.Type;
 declare const Schema$2: Schema.Struct<{
   readonly methods: Schema.$Array<Schema.TaggedUnion<{
     readonly integration: Schema.TaggedStruct<"integration", {
@@ -683,13 +877,29 @@ declare const CapabilityEvidence: Schema.Struct<{
   }>;
 }>;
 interface CapabilityEvidence extends Schema.Schema.Type<typeof CapabilityEvidence> {}
-declare const Revocation: Schema.TaggedUnion<{
+declare const RevocationSchema: Schema.TaggedUnion<{
   readonly Active: Schema.TaggedStruct<"Active", {}>;
   readonly Pending: Schema.TaggedStruct<"Pending", {
     readonly requestedAt: Schema.DateFromString;
   }>;
 }>;
-type Revocation = typeof Revocation.Type;
+/** Revocation state schema and callable constructors for trusted lifecycle values. */
+declare const Revocation: {
+  Schema: Schema.TaggedUnion<{
+    readonly Active: Schema.TaggedStruct<"Active", {}>;
+    readonly Pending: Schema.TaggedStruct<"Pending", {
+      readonly requestedAt: Schema.DateFromString;
+    }>;
+  }>;
+  Active: () => {
+    readonly _tag: "Active";
+  };
+  Pending: (input: Parameters<typeof RevocationSchema.cases.Pending.make>[0]) => {
+    readonly _tag: "Pending";
+    readonly requestedAt: Date;
+  };
+};
+type Revocation = typeof RevocationSchema.Type;
 /** A provider credential authorization shared by one or more organization connections. */
 declare const Schema$1: Schema.Struct<{
   readonly authorizedById: Schema.String;
@@ -1383,5 +1593,5 @@ declare const start: (input: BaseInput & {
 declare const complete: (input: CompleteInput) => Effect.Effect<ProviderConnection, Error$1 | AuthenticationFailure, Crypto.Crypto | Service>;
 type Failure = AuthenticationFailure | Error$1 | CryptoError;
 //#endregion
-export { Schema$2 as $, ConnectionStatus as A, Schema$4 as At, project as B, ConnectInput as C, Txt as Ct, Interface as D, equals as Dt, Error$1 as E, dns_record_d_exports as Et, StoredConnection as F, authorization_d_exports as G, Capability as H, StoredCredential as I, Manifest as J, AsyncOAuthSubjectResolver as K, authorizationError as L, ProviderConnection as M, parse$1 as Mt, ProviderTarget as N, Error$3 as Nt, Service as O, parse as Ot, ProviderTargetEvidence as P, invalid_input_d_exports as Pt, OAuthSubjectResolver as Q, decode$1 as R, AttachmentResult as S, Srv as St, DisconnectResult as T, data as Tt, CapabilityEvidence as U, validate as V, ProviderAuthorization as W, OAuthClientConfiguration as X, Method$1 as Y, OAuthMethod as Z, provider_context_d_exports as _, Ns as _t, Continuation as a, CreateResult as at, Aggregate as b, RequirementMetadata as bt, Failure as c, Service$1 as ct, Method as d, Aaaa as dt, TokenValidation as et, StartResult as f, Caa as ft, Envelope as g, Mx as gt, Codec as h, Encoded as ht, CompleteInput as i, AsyncInterface as it, DomainAttachment as j, domain_name_d_exports as jt, AuthorizationError as k, DomainName as kt, InteractiveFlow as l, provider_d_exports as lt, start as m, DnsRecord as mt, AuthenticationFailure as n, Value as nt, ContinuationStore as o, Error$2 as ot, complete as p, Cname as pt, IntegrationMethod as q, BaseInput as r, secret_d_exports as rt, Error as s, Interface$1 as st, Authentication as t, manifest_d_exports as tt, InteractiveStart as u, A as ut, CryptoError as v, Observed as vt, DetachResult as w, Type as wt, AggregateSchema as x, Schema$3 as xt, canonical_json_d_exports as y, Opaque as yt, encode$1 as z };
-//# sourceMappingURL=connect-Db830jad.d.mts.map
+export { Schema$2 as $, ConnectionStatus as A, Schema$3 as At, project as B, ConnectInput as C, Txt as Ct, Interface as D, equals as Dt, Error$1 as E, dns_record_d_exports as Et, StoredConnection as F, authorization_d_exports as G, Capability as H, StoredCredential as I, Manifest as J, AsyncOAuthSubjectResolver as K, authorizationError as L, ProviderConnection as M, parse$1 as Mt, ProviderTarget as N, Error$3 as Nt, Service as O, parse as Ot, ProviderTargetEvidence as P, invalid_input_d_exports as Pt, OAuthSubjectResolver as Q, decode$1 as R, AttachmentResult as S, Srv as St, DisconnectResult as T, data as Tt, CapabilityEvidence as U, validate as V, ProviderAuthorization as W, OAuthClientConfiguration as X, Method$1 as Y, OAuthMethod as Z, provider_context_d_exports as _, Ns as _t, Continuation as a, CreateResult as at, Aggregate as b, RecordSchema as bt, Failure as c, Service$1 as ct, Method as d, Aaaa as dt, TokenValidation as et, StartResult as f, Caa as ft, Envelope as g, Mx as gt, Codec as h, Encoded as ht, CompleteInput as i, AsyncInterface as it, DomainAttachment as j, domain_name_d_exports as jt, AuthorizationError as k, DomainName as kt, InteractiveFlow as l, provider_d_exports as lt, start as m, DnsRecord as mt, AuthenticationFailure as n, Value as nt, ContinuationStore as o, Error$2 as ot, complete as p, Cname as pt, IntegrationMethod as q, BaseInput as r, secret_d_exports as rt, Error as s, Interface$1 as st, Authentication as t, manifest_d_exports as tt, InteractiveStart as u, A as ut, CryptoError as v, Observed as vt, DetachResult as w, Type as wt, AggregateSchema as x, RequirementMetadata as xt, canonical_json_d_exports as y, Opaque as yt, encode$1 as z };
+//# sourceMappingURL=connect-D-X8T9W8.d.mts.map

package/dist/{connect-ks3cpqBD.mjs → connect-oI8hcMxc.mjs}

@@ -1,4 +1,4 @@
-import { C as project, s as Service } from "./canonical-json-9x7gHIoS.mjs";
+import { l as Revocation, s as Service, w as project } from "./canonical-json-CQYKsZw7.mjs";
 import { Clock, Crypto, Data, Effect, Schema } from "effect";
 //#region src/auth/connect.ts
 const Method = Data.taggedEnum();
@@ -67,7 +67,7 @@ const connect = Effect.fn("Connection.connect")(function* (input) {
 		providerContext: input.authentication.providerContext,
 		providerId: input.providerId,
 		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: { _tag: "Active" },
+		revocation: Revocation.Active(),
 		scopes: [...input.authentication.scopes]
 	} : {
 		...existing.authorization,
@@ -75,7 +75,7 @@ const connect = Effect.fn("Connection.connect")(function* (input) {
 		method: input.method,
 		providerContext: input.authentication.providerContext,
 		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: { _tag: "Active" },
+		revocation: Revocation.Active(),
 		scopes: [...input.authentication.scopes]
 	};
 	const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);
@@ -182,4 +182,4 @@ function mergeEvidence(current, incoming) {
 //#endregion
 export { start as a, complete as i, Method as n, StartResult as r, Error as t };
 
-//# sourceMappingURL=connect-ks3cpqBD.mjs.map
+//# sourceMappingURL=connect-oI8hcMxc.mjs.map

package/dist/connect-oI8hcMxc.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-oI8hcMxc.mjs","names":["Repository.Service","Connection.project"],"sources":["../src/auth/connect.ts"],"sourcesContent":["import { Clock, Crypto, Data, Effect, Schema } from \"effect\";\n\nimport { CryptoError } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport * as Connection from \"./connection.ts\";\nimport * as Repository from \"./lifecycle-repository.ts\";\nimport type * as ProviderContext from \"./provider-context.ts\";\nimport type * as Secret from \"./secret.ts\";\n\nexport interface Authentication {\n  readonly capabilityEvidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>;\n  readonly credential: Connection.StoredCredential;\n  /** Provider-specific subject identity used only during authentication; targets are selected later. */\n  readonly providerAccountId: string;\n  readonly providerContext: ProviderContext.Envelope;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport type AuthenticationFailure = Error | InvalidInputError | DnsProvider.Error;\n\nexport interface InteractiveStart {\n  readonly authorizationUrl: URL;\n  readonly payload: Secret.Value;\n}\n\nexport interface Continuation extends BaseInput {\n  readonly expiresAt: Date;\n  readonly id: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;\n  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (\n    payload: Secret.Value,\n    callbackUrl: URL,\n  ) => Effect.Effect<Authentication, AuthenticationFailure>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (\n    continuationId: string,\n  ) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (\n      token: Secret.Value,\n    ) => Effect.Effect<Authentication, AuthenticationFailure>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport type StartResult = Data.TaggedEnum<{\n  Connected: { readonly connection: Connection.ProviderConnection };\n  Redirect: { readonly authorizationUrl: URL; readonly continuationId: string };\n}>;\nexport const StartResult = Data.taggedEnum<StartResult>();\n\nexport class Error extends Schema.TaggedError<Error>()(\"ConnectionError\", {\n  category: Schema.Literals([\"authorization\", \"provider\", \"validation\"]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\n/** Inputs shared by token and interactive connection flows. */\nexport interface BaseInput {\n  readonly authorizedById: string;\n  /** Existing authorization may be supplied only after the host completed fresh provider proof. */\n  readonly authorizationId?: string;\n  readonly ownerId: string;\n}\n\nexport interface CompleteInput {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n}\n\nexport interface ConnectInput extends BaseInput {\n  readonly authentication: Authentication;\n  readonly method: \"integration\" | \"oauth2\" | \"token\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nconst missingCapability = (\n  authentication: Authentication,\n  requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>,\n): ProviderAuthorization.Capability | undefined =>\n  requiredCapabilities.find(\n    (capability) =>\n      !authentication.capabilityEvidence.some((item) => item.capability === capability),\n  );\n\nconst freshId = Effect.fn(\"Connection.freshId\")(function* () {\n  const crypto = yield* Crypto.Crypto;\n  return yield* crypto.randomUUIDv4.pipe(\n    Effect.mapError(\n      (cause) =>\n        new Error({\n          category: \"validation\",\n          message: cause.message,\n          operation: \"Connection.connect\",\n          retry: \"safe\",\n        }),\n    ),\n  );\n});\n\n/** Persist one authenticated provider connection, optionally reusing a proven authorization. */\nexport const connect = Effect.fn(\"Connection.connect\")(function* (input: ConnectInput) {\n  const repository = yield* Repository.Service;\n  const now = new Date(yield* Clock.currentTimeMillis);\n  const missing = missingCapability(input.authentication, input.requiredCapabilities);\n  if (missing !== undefined) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: `Provider authorization lacks evidence for ${missing}`,\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n\n  const existing =\n    input.authorizationId === undefined ? null : yield* repository.get(input.authorizationId);\n  if (input.authorizationId !== undefined && existing === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization does not exist\",\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (existing?.authorization.revocation._tag === \"Pending\") {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization is awaiting revocation recovery\",\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    existing !== null &&\n    (existing.authorization.providerId !== input.providerId ||\n      existing.authorization.method !== input.method)\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider proof does not match the existing authorization\",\n      operation: \"Connection.connect\",\n      retry: \"never\",\n    });\n  }\n\n  const authorizationId = existing?.authorization.id ?? (yield* freshId());\n  const authorization: ProviderAuthorization.ProviderAuthorization =\n    existing === null\n      ? {\n          authorizedById: input.authorizedById,\n          capabilityEvidence: [...input.authentication.capabilityEvidence],\n          createdAt: now,\n          id: authorizationId,\n          method: input.method,\n          providerContext: input.authentication.providerContext,\n          providerId: input.providerId,\n          requiredCapabilities: [...input.requiredCapabilities],\n          revocation: ProviderAuthorization.Revocation.Active(),\n          scopes: [...input.authentication.scopes],\n        }\n      : {\n          ...existing.authorization,\n          capabilityEvidence: mergeEvidence(\n            existing.authorization.capabilityEvidence,\n            input.authentication.capabilityEvidence,\n          ),\n          method: input.method,\n          providerContext: input.authentication.providerContext,\n          requiredCapabilities: [...input.requiredCapabilities],\n          revocation: ProviderAuthorization.Revocation.Active(),\n          scopes: [...input.authentication.scopes],\n        };\n  const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);\n  const connection: Connection.StoredConnection = {\n    authorizationId,\n    createdAt: existingConnection?.createdAt ?? now,\n    id: existingConnection?.id ?? (yield* freshId()),\n    method: input.method,\n    ownerId: input.ownerId,\n    providerId: input.providerId,\n  };\n  return yield* repository.connect({\n    authorization,\n    connection,\n    credential: input.authentication.credential,\n    ...(existing === null ? {} : { expectedAuthorizationId: existing.authorization.id }),\n    ...(existingConnection === null ? {} : { expectedConnectionId: existingConnection.id }),\n  });\n});\n\nexport const start = Effect.fn(\"Connection.start\")(function* (\n  input: BaseInput & { readonly method: Method },\n) {\n  if (input.method._tag === \"Interactive\") {\n    const crypto = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const continuationId = yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.start\",\n            retry: \"safe\",\n          }),\n      ),\n    );\n    const started = yield* input.method.flow.start(continuationId);\n    yield* input.method.continuations.put({\n      authorizedById: input.authorizedById,\n      ...(input.authorizationId === undefined ? {} : { authorizationId: input.authorizationId }),\n      expiresAt: new Date(now + (input.method.ttlMs ?? 10 * 60_000)),\n      id: continuationId,\n      method: input.method.flow.method,\n      ownerId: input.ownerId,\n      payload: started.payload,\n      providerId: input.method.flow.providerId,\n      requiredCapabilities: [...input.method.flow.requiredCapabilities],\n    });\n    return StartResult.Redirect({\n      authorizationUrl: started.authorizationUrl,\n      continuationId,\n    });\n  }\n  const authentication = yield* input.method.authenticate(input.method.token);\n  const aggregate = yield* connect({\n    authentication,\n    authorizedById: input.authorizedById,\n    ...(input.authorizationId === undefined ? {} : { authorizationId: input.authorizationId }),\n    method: \"token\",\n    ownerId: input.ownerId,\n    providerId: input.method.providerId,\n    requiredCapabilities: input.method.requiredCapabilities,\n  });\n  const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === input.ownerId);\n  if (storedConnection === undefined) {\n    return yield* new Error({\n      category: \"validation\",\n      message: \"Connected provider authorization returned no organization connection\",\n      operation: \"Connection.start\",\n      retry: \"safe\",\n    });\n  }\n  return StartResult.Connected({\n    connection: Connection.project(storedConnection, aggregate.authorization, aggregate.credential),\n  });\n});\n\nexport const complete = Effect.fn(\"Connection.complete\")(function* (input: CompleteInput) {\n  const continuation = yield* input.continuations.consume(\n    input.continuationId,\n    new Date(yield* Clock.currentTimeMillis),\n  );\n  if (continuation === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation is expired, unknown, or already consumed\",\n      operation: \"Connection.complete\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    continuation.providerId !== input.flow.providerId ||\n    continuation.method !== input.flow.method\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation does not match the provider flow\",\n      operation: \"Connection.complete\",\n      retry: \"never\",\n    });\n  }\n  const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);\n  const aggregate = yield* connect({\n    authentication,\n    authorizedById: continuation.authorizedById,\n    ...(continuation.authorizationId === undefined\n      ? {}\n      : { authorizationId: continuation.authorizationId }),\n    method: continuation.method,\n    ownerId: continuation.ownerId,\n    providerId: continuation.providerId,\n    requiredCapabilities: continuation.requiredCapabilities,\n  });\n  const storedConnection = aggregate.connections.find(\n    ({ ownerId }) => ownerId === continuation.ownerId,\n  );\n  if (storedConnection === undefined) {\n    return yield* new Error({\n      category: \"validation\",\n      message: \"Connected provider authorization returned no organization connection\",\n      operation: \"Connection.complete\",\n      retry: \"safe\",\n    });\n  }\n  return Connection.project(storedConnection, aggregate.authorization, aggregate.credential);\n});\n\nfunction mergeEvidence(\n  current: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  incoming: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n): ReadonlyArray<ProviderAuthorization.CapabilityEvidence> {\n  const byCapability = new Map(current.map((item) => [item.capability, item]));\n  for (const item of incoming) byCapability.set(item.capability, item);\n  return [...byCapability.values()];\n}\n\nexport type Requirements = Repository.Service | Crypto.Crypto;\nexport type Failure = AuthenticationFailure | Repository.Error | CryptoError;\n"],"mappings":";;;AAqEA,MAAa,SAAS,KAAK,WAAmB;AAM9C,MAAa,cAAc,KAAK,WAAwB;AAExD,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,mBAAmB;CACxE,UAAU,OAAO,SAAS;EAAC;EAAiB;EAAY;CAAY,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAwBJ,MAAM,qBACJ,gBACA,yBAEA,qBAAqB,MAClB,eACC,CAAC,eAAe,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CACpF;AAEF,MAAM,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,aAAa;CAE3D,OAAO,QAAO,OADQ,OAAO,OAAA,CACR,aAAa,KAChC,OAAO,UACJ,UACC,IAAI,MAAM;EACR,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF,CAAC;;AAGD,MAAa,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,OAAqB;CACrF,MAAM,aAAa,OAAOA;CAC1B,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,MAAM,UAAU,kBAAkB,MAAM,gBAAgB,MAAM,oBAAoB;CAClF,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS,6CAA6C;EACtD,WAAW;EACX,OAAO;CACT,CAAC;CAGH,MAAM,WACJ,MAAM,oBAAoB,KAAA,IAAY,OAAO,OAAO,WAAW,IAAI,MAAM,eAAe;CAC1F,IAAI,MAAM,oBAAoB,KAAA,KAAa,aAAa,MACtD,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,SACZ,SAAS,cAAc,eAAe,MAAM,cAC3C,SAAS,cAAc,WAAW,MAAM,SAE1C,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAGH,MAAM,kBAAkB,UAAU,cAAc,OAAO,OAAO,QAAQ;CACtE,MAAM,gBACJ,aAAa,OACT;EACE,gBAAgB,MAAM;EACtB,oBAAoB,CAAC,GAAG,MAAM,eAAe,kBAAkB;EAC/D,WAAW;EACX,IAAI;EACJ,QAAQ,MAAM;EACd,iBAAiB,MAAM,eAAe;EACtC,YAAY,MAAM;EAClB,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;EACpD,YAAA,WAA6C,OAAO;EACpD,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;CACzC,IACA;EACE,GAAG,SAAS;EACZ,oBAAoB,cAClB,SAAS,cAAc,oBACvB,MAAM,eAAe,kBACvB;EACA,QAAQ,MAAM;EACd,iBAAiB,MAAM,eAAe;EACtC,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;EACpD,YAAA,WAA6C,OAAO;EACpD,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;CACzC;CACN,MAAM,qBAAqB,OAAO,WAAW,eAAe,MAAM,SAAS,eAAe;CAC1F,MAAM,aAA0C;EAC9C;EACA,WAAW,oBAAoB,aAAa;EAC5C,IAAI,oBAAoB,OAAO,OAAO,QAAQ;EAC9C,QAAQ,MAAM;EACd,SAAS,MAAM;EACf,YAAY,MAAM;CACpB;CACA,OAAO,OAAO,WAAW,QAAQ;EAC/B;EACA;EACA,YAAY,MAAM,eAAe;EACjC,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,yBAAyB,SAAS,cAAc,GAAG;EAClF,GAAI,uBAAuB,OAAO,CAAC,IAAI,EAAE,sBAAsB,mBAAmB,GAAG;CACvF,CAAC;AACH,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WACjD,OACA;CACA,IAAI,MAAM,OAAO,SAAS,eAAe;EACvC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,iBAAiB,OAAO,OAAO,aAAa,KAChD,OAAO,UACJ,UACC,IAAI,MAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACA,MAAM,UAAU,OAAO,MAAM,OAAO,KAAK,MAAM,cAAc;EAC7D,OAAO,MAAM,OAAO,cAAc,IAAI;GACpC,gBAAgB,MAAM;GACtB,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;GACxF,WAAW,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS,IAAY;GAC7D,IAAI;GACJ,QAAQ,MAAM,OAAO,KAAK;GAC1B,SAAS,MAAM;GACf,SAAS,QAAQ;GACjB,YAAY,MAAM,OAAO,KAAK;GAC9B,sBAAsB,CAAC,GAAG,MAAM,OAAO,KAAK,oBAAoB;EAClE,CAAC;EACD,OAAO,YAAY,SAAS;GAC1B,kBAAkB,QAAQ;GAC1B;EACF,CAAC;CACH;CACA,MAAM,iBAAiB,OAAO,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK;CAC1E,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,MAAM;EACtB,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;EACxF,QAAQ;EACR,SAAS,MAAM;EACf,YAAY,MAAM,OAAO;EACzB,sBAAsB,MAAM,OAAO;CACrC,CAAC;CACD,MAAM,mBAAmB,UAAU,YAAY,MAAM,EAAE,cAAc,YAAY,MAAM,OAAO;CAC9F,IAAI,qBAAqB,KAAA,GACvB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAO,YAAY,UAAU,EAC3B,YAAYC,QAAmB,kBAAkB,UAAU,eAAe,UAAU,UAAU,EAChG,CAAC;AACH,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAsB;CACxF,MAAM,eAAe,OAAO,MAAM,cAAc,QAC9C,MAAM,gBACN,IAAI,KAAK,OAAO,MAAM,iBAAiB,CACzC;CACA,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,eAAe,MAAM,KAAK,cACvC,aAAa,WAAW,MAAM,KAAK,QAEnC,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,iBAAiB,OAAO,MAAM,KAAK,SAAS,aAAa,SAAS,MAAM,WAAW;CACzF,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,aAAa;EAC7B,GAAI,aAAa,oBAAoB,KAAA,IACjC,CAAC,IACD,EAAE,iBAAiB,aAAa,gBAAgB;EACpD,QAAQ,aAAa;EACrB,SAAS,aAAa;EACtB,YAAY,aAAa;EACzB,sBAAsB,aAAa;CACrC,CAAC;CACD,MAAM,mBAAmB,UAAU,YAAY,MAC5C,EAAE,cAAc,YAAY,aAAa,OAC5C;CACA,IAAI,qBAAqB,KAAA,GACvB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAOA,QAAmB,kBAAkB,UAAU,eAAe,UAAU,UAAU;AAC3F,CAAC;AAED,SAAS,cACP,SACA,UACyD;CACzD,MAAM,eAAe,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;CAC3E,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;CACnE,OAAO,CAAC,GAAG,aAAa,OAAO,CAAC;AAClC"}

package/dist/{connection-DuYDgWir.d.mts → connection-Dp6ZdSo8.d.mts}

@@ -1,4 +1,4 @@
-import { A as ConnectionStatus, C as ConnectInput, D as Interface, E as Error, F as StoredConnection, H as Capability, I as StoredCredential, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, S as AttachmentResult, T as DisconnectResult, U as CapabilityEvidence, V as validate, W as ProviderAuthorization, a as Continuation, b as Aggregate, c as Failure, d as Method$1, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow$1, n as AuthenticationFailure, nt as Value, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-Db830jad.mjs";
+import { A as ConnectionStatus, C as ConnectInput, D as Interface, E as Error, F as StoredConnection, H as Capability, I as StoredCredential, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, S as AttachmentResult, T as DisconnectResult, U as CapabilityEvidence, V as validate, W as ProviderAuthorization, a as Continuation, b as Aggregate, c as Failure, d as Method$1, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow$1, n as AuthenticationFailure, nt as Value, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-D-X8T9W8.mjs";
 import { Data, Layer } from "effect";
 declare namespace managed_dns_connections_d_exports {
   export { AsyncInterface, AttachmentResult, DetachResult, DisconnectResult, Error, from, layerFromAsync, toAsync };
@@ -183,4 +183,4 @@ declare function disconnect(input: {
 }): Promise<DisconnectResult>;
 //#endregion
 export { managed_dns_connections_d_exports as a, AsyncInterface as i, Method as n, connection_d_exports as r, InteractiveFlow as t };
-//# sourceMappingURL=connection-DuYDgWir.d.mts.map
+//# sourceMappingURL=connection-Dp6ZdSo8.d.mts.map

package/dist/{connection-api-B__0M3PA.d.mts → connection-api-lqG1nBtD.d.mts}

@@ -1,4 +1,4 @@
-import { A as ConnectionStatus, B as project, E as Error, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, R as decode, S as AttachmentResult, T as DisconnectResult, V as validate, W as ProviderAuthorization, a as Continuation, c as Failure, d as Method, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow, m as start, n as AuthenticationFailure, o as ContinuationStore, p as complete, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-Db830jad.mjs";
+import { A as ConnectionStatus, B as project, E as Error, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, R as decode, S as AttachmentResult, T as DisconnectResult, V as validate, W as ProviderAuthorization, a as Continuation, c as Failure, d as Method, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow, m as start, n as AuthenticationFailure, o as ContinuationStore, p as complete, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-D-X8T9W8.mjs";
 import { Effect } from "effect";
 //#region src/auth/connection-lifecycle.d.ts
 /** Attach one exact provider target to one organization domain. */
@@ -23,4 +23,4 @@ declare namespace connection_api_d_exports {
 }
 //#endregion
 export { connection_api_d_exports as t };
-//# sourceMappingURL=connection-api-B__0M3PA.d.mts.map
+//# sourceMappingURL=connection-api-lqG1nBtD.d.mts.map