domainkit 0.8.0 → 0.9.0

package/dist/Provider.mjs

@@ -0,0 +1,130 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { candidates } from "./DomainName.mjs";
+import { InvalidInput, Unsupported } from "./Reason.mjs";
+import { DomainKitError, decode, fail } from "./internal/error.mjs";
+import { fromAsync } from "./internal/provider-async.mjs";
+import { Data, Effect, Redacted, Schema } from "effect";
+//#region src/Provider.ts
+/**
+* One declarative definition per DNS provider. Auth methods are optional cases, so a provider that
+* only issues personal tokens declares `token` and nothing else. The definition drives connection
+* routes, refresh, the UI method catalog, and rebuilding a session from stored context.
+*/
+var Provider_exports = /* @__PURE__ */ __exportAll({
+	Envelope: () => Envelope,
+	Resolution: () => Resolution,
+	decodeContext: () => decodeContext,
+	describeMethods: () => describeMethods,
+	encodeContext: () => encodeContext,
+	fromAsync: () => fromAsync,
+	make: () => make,
+	methods: () => methods,
+	resolveAmong: () => resolveAmong,
+	tokenAuth: () => tokenAuth,
+	tokenFields: () => tokenFields
+});
+const Resolution = Data.taggedEnum();
+const tokenAuth = (input) => ({
+	label: input.label,
+	...input.docsUrl === void 0 ? {} : { docsUrl: input.docsUrl },
+	requiredCapabilities: input.requiredCapabilities,
+	fields: input.fields,
+	authenticate: (values) => decodeTokenValues(input.fields, values).pipe(Effect.flatMap(input.authenticate))
+});
+const decodeTokenValues = (fields, values) => {
+	const raw = {};
+	for (const [name, value] of Object.entries(values)) if (value !== void 0) raw[name] = Redacted.value(value);
+	return decode(fields, raw, "method");
+};
+/** Field descriptors derived from `TokenAuth.fields`: optional keys are not required, `Redacted` values are secret. */
+const tokenFields = (auth) => Object.entries(auth.fields.fields).map(([name, field]) => {
+	const ast = field.ast;
+	return {
+		name,
+		required: ast.context?.isOptional !== true,
+		secret: ast._tag === "Declaration"
+	};
+});
+const describeMethods = (definition) => {
+	const found = [];
+	if (definition.auth.token !== void 0) found.push({
+		kind: "token",
+		label: definition.auth.token.label,
+		docsUrl: definition.auth.token.docsUrl ?? null,
+		fields: tokenFields(definition.auth.token)
+	});
+	if (definition.auth.oauth !== void 0) found.push({
+		kind: "oauth",
+		label: definition.auth.oauth.label,
+		docsUrl: null,
+		fields: null
+	});
+	if (definition.auth.integration !== void 0) found.push({
+		kind: "integration",
+		label: definition.auth.integration.label,
+		docsUrl: null,
+		fields: null
+	});
+	return found;
+};
+/** How provider context is persisted: the definition's version tag beside the encoded value. */
+const Envelope = Schema.Struct({
+	version: Schema.String,
+	value: Schema.Unknown
+});
+/** Wrap a context value for storage; a value the schema rejects fails `InvalidInput`. */
+const encodeContext = (definition, value) => Schema.encodeEffect(definition.context)(value).pipe(Effect.map((encoded) => ({
+	version: definition.contextVersion,
+	value: encoded
+})), Effect.mapError((cause) => new DomainKitError({ reason: new InvalidInput({
+	message: cause.message,
+	field: "context"
+}) })));
+/** Validates a definition: an id and at least one auth method. Throws `DomainKit.Error` otherwise. */
+const make = (definition) => {
+	const invalid = (message, field) => new DomainKitError({ reason: new InvalidInput({
+		message,
+		field
+	}) });
+	if (!/^[a-z0-9][a-z0-9-]*$/.test(definition.id)) throw invalid(`Provider id ${JSON.stringify(definition.id)} must be lowercase kebab-case`, "id");
+	if (methods(definition).length === 0) throw invalid(`Provider ${definition.id} declares no auth method`, "auth");
+	if (definition.contextVersion.length === 0) throw invalid(`Provider ${definition.id} needs a contextVersion`, "contextVersion");
+	return definition;
+};
+const methods = (definition) => {
+	const found = [];
+	if (definition.auth.token !== void 0) found.push("token");
+	if (definition.auth.oauth !== void 0) found.push("oauth");
+	if (definition.auth.integration !== void 0) found.push("integration");
+	return found;
+};
+/**
+* Pick the most specific zone among `targets` for `domain`: exactly one match resolves, several
+* matches at the same depth need a selection, none is `NotFound`.
+*/
+const resolveAmong = (domain, targets) => {
+	for (const candidate of candidates(domain)) {
+		const matches = targets.filter((target) => target.zone === candidate);
+		const [only] = matches;
+		if (matches.length === 1 && only !== void 0) return Resolution.Resolved({ target: only });
+		if (matches.length > 1) return Resolution.SelectionRequired({ candidates: matches });
+	}
+	return Resolution.NotFound();
+};
+/**
+* Decode a stored envelope: the current version decodes with `context`, an older one goes
+* through `migrateContext`, anything else fails `Unsupported`.
+*/
+const decodeContext = (definition, stored) => decode(Envelope, stored, "context").pipe(Effect.flatMap((envelope) => {
+	if (envelope.version === definition.contextVersion) return decode(definition.context, envelope.value, "context");
+	if (definition.migrateContext !== void 0) return definition.migrateContext(envelope);
+	return fail(new Unsupported({
+		provider: definition.id,
+		operation: "context",
+		message: `${definition.id} context version ${envelope.version} is not supported (current ${definition.contextVersion})`
+	}));
+}));
+//#endregion
+export { Envelope, Provider_exports, Resolution, decodeContext, describeMethods, encodeContext, fromAsync, make, methods, resolveAmong, tokenAuth, tokenFields };
+
+//# sourceMappingURL=Provider.mjs.map

package/dist/Provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Provider.mjs","names":["Errors.decode","Errors.DomainKitError","Reason.InvalidInput","DomainName.candidates","Errors.fail","Reason.Unsupported"],"sources":["../src/Provider.ts"],"sourcesContent":["/**\n * One declarative definition per DNS provider. Auth methods are optional cases, so a provider that\n * only issues personal tokens declares `token` and nothing else. The definition drives connection\n * routes, refresh, the UI method catalog, and rebuilding a session from stored context.\n */\nimport { Data, type DateTime, Effect, Redacted, Schema } from \"effect\";\n\nimport type * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport type { Capability } from \"./Storage.ts\";\n\nexport type Fx<A> = Effect.Effect<A, Errors.DomainKitError>;\n\n/** A record as the provider reports it, with the id needed to read or delete it later. */\nexport interface ObservedRecord {\n  readonly record: DnsRecord.Observed;\n  readonly providerRecordId: string | null;\n}\n\n/** What a session can do inside one zone. The only thing planning and applying touch. */\nexport interface Dns {\n  readonly list: (zone: string) => Fx<ReadonlyArray<ObservedRecord>>;\n  /** Must return the provider's id for the new record; cleanup deletes by that id. */\n  readonly create: (\n    zone: string,\n    record: DnsRecord.Model,\n  ) => Fx<{ readonly providerRecordId: string }>;\n  readonly get: (zone: string, providerRecordId: string) => Fx<DnsRecord.Observed | null>;\n  readonly delete: (zone: string, providerRecordId: string) => Fx<void>;\n}\n\n/** A zone the credential can reach, with the provider identity needed to address it later. */\nexport interface Target {\n  readonly zone: string;\n  readonly context: unknown;\n  readonly label: string;\n  /** The zone's nameservers as the provider reports them; `Connect.discover` matches on them. */\n  readonly nameservers?: ReadonlyArray<string>;\n}\n\nexport type Resolution = Data.TaggedEnum<{\n  Resolved: { readonly target: Target };\n  SelectionRequired: { readonly candidates: ReadonlyArray<Target> };\n  NotFound: {};\n}>;\nexport const Resolution = Data.taggedEnum<Resolution>();\n\n/** A credential bound to provider account context. */\nexport interface Session {\n  readonly listTargets: () => Fx<ReadonlyArray<Target>>;\n  readonly resolveTarget: (domain: string) => Fx<Resolution>;\n  readonly dns: (target: Target) => Dns;\n  /** Capabilities actually held; promoted onto the authorization after first use. */\n  readonly capabilities: () => Fx<ReadonlyArray<Capability>>;\n}\n\n/**\n * Secret material plus the account context needed to rebuild a session. `secret` is opaque to\n * DomainKit: a provider may pack an access token and a refresh token into it.\n */\nexport interface Credential {\n  readonly secret: Redacted.Redacted<string>;\n  readonly context: unknown;\n}\n\n/** A credential the provider just issued or refreshed; `null` expiry means it does not expire. */\nexport interface IssuedCredential extends Credential {\n  readonly expiresAt: DateTime.Utc | null;\n}\n\n/** Raw token-method input keyed by the provider's declared field names. */\nexport type TokenValues = Readonly<Record<string, Redacted.Redacted<string> | undefined>>;\n\nexport interface TokenAuth {\n  readonly label: string;\n  /** Where the customer creates the token; shown in the UI. */\n  readonly docsUrl?: string;\n  readonly requiredCapabilities: ReadonlyArray<Capability>;\n  /**\n   * The values this method needs, declared once so forms render from it: secrets as\n   * `Schema.RedactedFromValue(Schema.String)`, optional ones through `Schema.optionalKey`.\n   */\n  readonly fields: Schema.Struct<Schema.Struct.Fields>;\n  /** Validate the values (already decoded with `fields`) and return account context. */\n  readonly authenticate: (values: TokenValues) => Fx<IssuedCredential>;\n}\n\n/** Build a `TokenAuth` whose `authenticate` receives the record decoded by `fields`. */\n/** Field schemas whose decoding needs no services, so `authenticate` stays a plain `Fx`. */\nexport type TokenFieldSchemas = { readonly [name: string]: Schema.ConstraintDecoder<unknown> };\n\nexport const tokenAuth = <const Fields extends TokenFieldSchemas>(input: {\n  readonly label: string;\n  readonly docsUrl?: string;\n  readonly requiredCapabilities: ReadonlyArray<Capability>;\n  readonly fields: Schema.Struct<Fields>;\n  readonly authenticate: (values: Schema.Struct<Fields>[\"Type\"]) => Fx<IssuedCredential>;\n}): TokenAuth => ({\n  label: input.label,\n  ...(input.docsUrl === undefined ? {} : { docsUrl: input.docsUrl }),\n  requiredCapabilities: input.requiredCapabilities,\n  fields: input.fields as Schema.Struct<Schema.Struct.Fields>,\n  authenticate: (values) =>\n    decodeTokenValues(input.fields, values).pipe(Effect.flatMap(input.authenticate)),\n});\n\nconst decodeTokenValues = <Fields extends TokenFieldSchemas>(\n  fields: Schema.Struct<Fields>,\n  values: TokenValues,\n): Effect.Effect<Schema.Struct<Fields>[\"Type\"], Errors.DomainKitError> => {\n  const raw: Record<string, string> = {};\n  for (const [name, value] of Object.entries(values)) {\n    if (value !== undefined) raw[name] = Redacted.value(value);\n  }\n  return Errors.decode(fields, raw, \"method\");\n};\n\nexport interface FieldDescriptor {\n  readonly name: string;\n  readonly required: boolean;\n  readonly secret: boolean;\n}\n\n/** What a UI needs to render one auth method; `fields` is `null` for interactive methods. */\nexport interface MethodDescriptor {\n  readonly kind: AuthMethod;\n  readonly label: string;\n  readonly docsUrl: string | null;\n  readonly fields: ReadonlyArray<FieldDescriptor> | null;\n}\n\n/** Field descriptors derived from `TokenAuth.fields`: optional keys are not required, `Redacted` values are secret. */\nexport const tokenFields = (auth: TokenAuth): ReadonlyArray<FieldDescriptor> =>\n  Object.entries(auth.fields.fields).map(([name, field]) => {\n    const ast = (field as { readonly ast: FieldAst }).ast;\n    return {\n      name,\n      required: ast.context?.isOptional !== true,\n      secret: ast._tag === \"Declaration\",\n    };\n  });\n\ninterface FieldAst {\n  readonly _tag: string;\n  readonly context?: { readonly isOptional?: boolean } | undefined;\n}\n\nexport const describeMethods = (definition: Definition): ReadonlyArray<MethodDescriptor> => {\n  const found: Array<MethodDescriptor> = [];\n  if (definition.auth.token !== undefined) {\n    found.push({\n      kind: \"token\",\n      label: definition.auth.token.label,\n      docsUrl: definition.auth.token.docsUrl ?? null,\n      fields: tokenFields(definition.auth.token),\n    });\n  }\n  if (definition.auth.oauth !== undefined) {\n    found.push({ kind: \"oauth\", label: definition.auth.oauth.label, docsUrl: null, fields: null });\n  }\n  if (definition.auth.integration !== undefined) {\n    found.push({\n      kind: \"integration\",\n      label: definition.auth.integration.label,\n      docsUrl: null,\n      fields: null,\n    });\n  }\n  return found;\n};\n\nexport interface CallbackInput {\n  readonly code: string;\n  /** The redirect URI registered at start; token exchanges echo it. */\n  readonly callbackUrl: string;\n  /** Every query parameter the provider appended to the callback. */\n  readonly params: Readonly<Record<string, string>>;\n}\n\nexport interface OAuthAuth {\n  readonly label: string;\n  readonly scopes: ReadonlyArray<string>;\n  readonly start: (input: {\n    readonly state: string;\n    readonly callbackUrl: string;\n    readonly codeChallenge: string;\n  }) => Fx<{ readonly authorizationUrl: string }>;\n  readonly complete: (\n    input: CallbackInput & { readonly codeVerifier: string },\n  ) => Fx<IssuedCredential>;\n  readonly refresh: (credential: Credential) => Fx<IssuedCredential>;\n  readonly revoke?: (credential: Credential) => Fx<void>;\n}\n\n/** Marketplace-style installs (Vercel integrations) that redirect but are not OAuth. */\nexport interface IntegrationAuth {\n  readonly label: string;\n  readonly start: (input: {\n    readonly state: string;\n    readonly callbackUrl: string;\n  }) => Fx<{ readonly authorizationUrl: string }>;\n  readonly complete: (input: CallbackInput) => Fx<IssuedCredential>;\n  readonly refresh?: (credential: Credential) => Fx<IssuedCredential>;\n  readonly revoke?: (credential: Credential) => Fx<void>;\n}\n\nexport interface Definition<Context = unknown> {\n  readonly id: string;\n  readonly name: string;\n  readonly auth: {\n    readonly token?: TokenAuth;\n    readonly oauth?: OAuthAuth;\n    readonly integration?: IntegrationAuth;\n  };\n  /** Schema for the account/zone context stored on authorizations and attachments. */\n  readonly context: Schema.Codec<Context, unknown, never, never>;\n  /** Tag written into every stored context envelope, e.g. `cloudflare.v1`; bump it with the schema. */\n  readonly contextVersion: string;\n  /** Upgrade an envelope written under an older `contextVersion`; absent means `Unsupported`. */\n  readonly migrateContext?: (envelope: Envelope) => Fx<Context>;\n  readonly session: (credential: Credential) => Session;\n}\n\n/** How provider context is persisted: the definition's version tag beside the encoded value. */\nexport const Envelope = Schema.Struct({ version: Schema.String, value: Schema.Unknown });\nexport type Envelope = typeof Envelope.Type;\n\n/** Wrap a context value for storage; a value the schema rejects fails `InvalidInput`. */\nexport const encodeContext = <Context>(\n  definition: Definition<Context>,\n  value: Context,\n): Effect.Effect<Envelope, Errors.DomainKitError> =>\n  Schema.encodeEffect(definition.context)(value).pipe(\n    Effect.map((encoded) => ({ version: definition.contextVersion, value: encoded })),\n    Effect.mapError(\n      (cause) =>\n        new Errors.DomainKitError({\n          reason: new Reason.InvalidInput({ message: cause.message, field: \"context\" }),\n        }),\n    ),\n  );\n\nexport type AuthMethod = \"token\" | \"oauth\" | \"integration\";\n\n/** Validates a definition: an id and at least one auth method. Throws `DomainKit.Error` otherwise. */\nexport const make = <Context>(definition: Definition<Context>): Definition<Context> => {\n  const invalid = (message: string, field: string) =>\n    new Errors.DomainKitError({\n      reason: new Reason.InvalidInput({ message, field }),\n    });\n  if (!/^[a-z0-9][a-z0-9-]*$/.test(definition.id)) {\n    throw invalid(\n      `Provider id ${JSON.stringify(definition.id)} must be lowercase kebab-case`,\n      \"id\",\n    );\n  }\n  if (methods(definition).length === 0) {\n    throw invalid(`Provider ${definition.id} declares no auth method`, \"auth\");\n  }\n  if (definition.contextVersion.length === 0) {\n    throw invalid(`Provider ${definition.id} needs a contextVersion`, \"contextVersion\");\n  }\n  return definition;\n};\n\nexport const methods = (definition: Definition): ReadonlyArray<AuthMethod> => {\n  const found: Array<AuthMethod> = [];\n  if (definition.auth.token !== undefined) found.push(\"token\");\n  if (definition.auth.oauth !== undefined) found.push(\"oauth\");\n  if (definition.auth.integration !== undefined) found.push(\"integration\");\n  return found;\n};\n\n/**\n * Pick the most specific zone among `targets` for `domain`: exactly one match resolves, several\n * matches at the same depth need a selection, none is `NotFound`.\n */\nexport const resolveAmong = (\n  domain: DomainName.Model,\n  targets: ReadonlyArray<Target>,\n): Resolution => {\n  for (const candidate of DomainName.candidates(domain)) {\n    const matches = targets.filter((target) => target.zone === candidate);\n    const [only] = matches;\n    if (matches.length === 1 && only !== undefined) return Resolution.Resolved({ target: only });\n    if (matches.length > 1) return Resolution.SelectionRequired({ candidates: matches });\n  }\n  return Resolution.NotFound();\n};\n\n/**\n * Decode a stored envelope: the current version decodes with `context`, an older one goes\n * through `migrateContext`, anything else fails `Unsupported`.\n */\nexport const decodeContext = <Context>(\n  definition: Definition<Context>,\n  stored: unknown,\n): Effect.Effect<Context, Errors.DomainKitError> =>\n  Errors.decode(Envelope, stored, \"context\").pipe(\n    Effect.flatMap((envelope) => {\n      if (envelope.version === definition.contextVersion) {\n        return Errors.decode(definition.context, envelope.value, \"context\");\n      }\n      if (definition.migrateContext !== undefined) return definition.migrateContext(envelope);\n      return Errors.fail(\n        new Reason.Unsupported({\n          provider: definition.id,\n          operation: \"context\",\n          message: `${definition.id} context version ${envelope.version} is not supported (current ${definition.contextVersion})`,\n        }),\n      );\n    }),\n  );\n\nexport {\n  type AsyncCredential,\n  type AsyncDefinition,\n  type AsyncDns,\n  type AsyncIntegrationAuth,\n  type AsyncIssuedCredential,\n  type AsyncOAuthAuth,\n  type AsyncSession,\n  type AsyncTokenAuth,\n  fromAsync,\n} from \"./internal/provider-async.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,MAAa,aAAa,KAAK,WAAuB;AA8CtD,MAAa,aAAqD,WAMhD;CAChB,OAAO,MAAM;CACb,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;CAChE,sBAAsB,MAAM;CAC5B,QAAQ,MAAM;CACd,eAAe,WACb,kBAAkB,MAAM,QAAQ,MAAM,CAAC,CAAC,KAAK,OAAO,QAAQ,MAAM,YAAY,CAAC;AACnF;AAEA,MAAM,qBACJ,QACA,WACwE;CACxE,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,UAAU,KAAA,GAAW,IAAI,QAAQ,SAAS,MAAM,KAAK;CAE3D,OAAOA,OAAc,QAAQ,KAAK,QAAQ;AAC5C;;AAiBA,MAAa,eAAe,SAC1B,OAAO,QAAQ,KAAK,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW;CACxD,MAAM,MAAO,MAAqC;CAClD,OAAO;EACL;EACA,UAAU,IAAI,SAAS,eAAe;EACtC,QAAQ,IAAI,SAAS;CACvB;AACF,CAAC;AAOH,MAAa,mBAAmB,eAA4D;CAC1F,MAAM,QAAiC,CAAC;CACxC,IAAI,WAAW,KAAK,UAAU,KAAA,GAC5B,MAAM,KAAK;EACT,MAAM;EACN,OAAO,WAAW,KAAK,MAAM;EAC7B,SAAS,WAAW,KAAK,MAAM,WAAW;EAC1C,QAAQ,YAAY,WAAW,KAAK,KAAK;CAC3C,CAAC;CAEH,IAAI,WAAW,KAAK,UAAU,KAAA,GAC5B,MAAM,KAAK;EAAE,MAAM;EAAS,OAAO,WAAW,KAAK,MAAM;EAAO,SAAS;EAAM,QAAQ;CAAK,CAAC;CAE/F,IAAI,WAAW,KAAK,gBAAgB,KAAA,GAClC,MAAM,KAAK;EACT,MAAM;EACN,OAAO,WAAW,KAAK,YAAY;EACnC,SAAS;EACT,QAAQ;CACV,CAAC;CAEH,OAAO;AACT;;AAuDA,MAAa,WAAW,OAAO,OAAO;CAAE,SAAS,OAAO;CAAQ,OAAO,OAAO;AAAQ,CAAC;;AAIvF,MAAa,iBACX,YACA,UAEA,OAAO,aAAa,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,KAAK,aAAa;CAAE,SAAS,WAAW;CAAgB,OAAO;AAAQ,EAAE,GAChF,OAAO,UACJ,UACC,IAAIC,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;CAAE,SAAS,MAAM;CAAS,OAAO;AAAU,CAAC,EAC9E,CAAC,CACL,CACF;;AAKF,MAAa,QAAiB,eAAyD;CACrF,MAAM,WAAW,SAAiB,UAChC,IAAID,eAAsB,EACxB,QAAQ,IAAIC,aAAoB;EAAE;EAAS;CAAM,CAAC,EACpD,CAAC;CACH,IAAI,CAAC,uBAAuB,KAAK,WAAW,EAAE,GAC5C,MAAM,QACJ,eAAe,KAAK,UAAU,WAAW,EAAE,EAAE,gCAC7C,IACF;CAEF,IAAI,QAAQ,UAAU,CAAC,CAAC,WAAW,GACjC,MAAM,QAAQ,YAAY,WAAW,GAAG,2BAA2B,MAAM;CAE3E,IAAI,WAAW,eAAe,WAAW,GACvC,MAAM,QAAQ,YAAY,WAAW,GAAG,0BAA0B,gBAAgB;CAEpF,OAAO;AACT;AAEA,MAAa,WAAW,eAAsD;CAC5E,MAAM,QAA2B,CAAC;CAClC,IAAI,WAAW,KAAK,UAAU,KAAA,GAAW,MAAM,KAAK,OAAO;CAC3D,IAAI,WAAW,KAAK,UAAU,KAAA,GAAW,MAAM,KAAK,OAAO;CAC3D,IAAI,WAAW,KAAK,gBAAgB,KAAA,GAAW,MAAM,KAAK,aAAa;CACvE,OAAO;AACT;;;;;AAMA,MAAa,gBACX,QACA,YACe;CACf,KAAK,MAAM,aAAaC,WAAsB,MAAM,GAAG;EACrD,MAAM,UAAU,QAAQ,QAAQ,WAAW,OAAO,SAAS,SAAS;EACpE,MAAM,CAAC,QAAQ;EACf,IAAI,QAAQ,WAAW,KAAK,SAAS,KAAA,GAAW,OAAO,WAAW,SAAS,EAAE,QAAQ,KAAK,CAAC;EAC3F,IAAI,QAAQ,SAAS,GAAG,OAAO,WAAW,kBAAkB,EAAE,YAAY,QAAQ,CAAC;CACrF;CACA,OAAO,WAAW,SAAS;AAC7B;;;;;AAMA,MAAa,iBACX,YACA,WAEAH,OAAc,UAAU,QAAQ,SAAS,CAAC,CAAC,KACzC,OAAO,SAAS,aAAa;CAC3B,IAAI,SAAS,YAAY,WAAW,gBAClC,OAAOA,OAAc,WAAW,SAAS,SAAS,OAAO,SAAS;CAEpE,IAAI,WAAW,mBAAmB,KAAA,GAAW,OAAO,WAAW,eAAe,QAAQ;CACtF,OAAOI,KACL,IAAIC,YAAmB;EACrB,UAAU,WAAW;EACrB,WAAW;EACX,SAAS,GAAG,WAAW,GAAG,mBAAmB,SAAS,QAAQ,6BAA6B,WAAW,eAAe;CACvH,CAAC,CACH;AACF,CAAC,CACH"}

package/dist/Providers.mjs

@@ -0,0 +1,40 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { InvalidInput, NotFound } from "./Reason.mjs";
+import { DomainKitError, fail } from "./internal/error.mjs";
+import { methods } from "./Provider.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/Providers.ts
+/** The registry of provider definitions a host enabled. Built by `DomainKit.layer`. */
+var Providers_exports = /* @__PURE__ */ __exportAll({
+	Service: () => Service,
+	layer: () => layer,
+	make: () => make
+});
+var Service = class extends Context.Service()("@domainkit/Providers") {};
+const make = (definitions) => {
+	const byId = /* @__PURE__ */ new Map();
+	for (const definition of definitions) {
+		if (byId.has(definition.id)) throw new DomainKitError({ reason: new InvalidInput({
+			message: `Provider ${definition.id} is registered twice`,
+			field: "providers"
+		}) });
+		byId.set(definition.id, definition);
+	}
+	const get = (id) => Effect.suspend(() => {
+		const definition = byId.get(id);
+		return definition === void 0 ? fail(new NotFound({
+			entity: "provider",
+			id
+		})) : Effect.succeed(definition);
+	});
+	return {
+		get,
+		list: () => [...byId.values()],
+		methods: (id) => Effect.map(get(id), methods)
+	};
+};
+const layer = (definitions) => Layer.sync(Service)(() => make(definitions));
+//#endregion
+export { Providers_exports, Service, layer, make };
+
+//# sourceMappingURL=Providers.mjs.map

package/dist/Providers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Providers.mjs","names":["Errors.DomainKitError","Reason.InvalidInput","Errors.fail","Reason.NotFound","Provider.methods"],"sources":["../src/Providers.ts"],"sourcesContent":["/** The registry of provider definitions a host enabled. Built by `DomainKit.layer`. */\nimport { Context, Effect, Layer } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Provider from \"./Provider.ts\";\n\nexport interface Interface {\n  readonly get: (id: string) => Effect.Effect<Provider.Definition, Errors.DomainKitError>;\n  readonly list: () => ReadonlyArray<Provider.Definition>;\n  /** For UI catalogs: which methods each provider offers. */\n  readonly methods: (\n    id: string,\n  ) => Effect.Effect<ReadonlyArray<Provider.AuthMethod>, Errors.DomainKitError>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Providers\") {}\n\nexport const make = (definitions: ReadonlyArray<Provider.Definition>): Interface => {\n  const byId = new Map<string, Provider.Definition>();\n  for (const definition of definitions) {\n    if (byId.has(definition.id)) {\n      throw new Errors.DomainKitError({\n        reason: new Reason.InvalidInput({\n          message: `Provider ${definition.id} is registered twice`,\n          field: \"providers\",\n        }),\n      });\n    }\n    byId.set(definition.id, definition);\n  }\n  const get: Interface[\"get\"] = (id) =>\n    Effect.suspend(() => {\n      const definition = byId.get(id);\n      return definition === undefined\n        ? Errors.fail(new Reason.NotFound({ entity: \"provider\", id }))\n        : Effect.succeed(definition);\n    });\n  return {\n    get,\n    list: () => [...byId.values()],\n    methods: (id) => Effect.map(get(id), Provider.methods),\n  };\n};\n\nexport const layer = (definitions: ReadonlyArray<Provider.Definition>): Layer.Layer<Service> =>\n  Layer.sync(Service)(() => make(definitions));\n"],"mappings":";;;;;;;;;;;;AAgBA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAE5F,MAAa,QAAQ,gBAA+D;CAClF,MAAM,uBAAO,IAAI,IAAiC;CAClD,KAAK,MAAM,cAAc,aAAa;EACpC,IAAI,KAAK,IAAI,WAAW,EAAE,GACxB,MAAM,IAAIA,eAAsB,EAC9B,QAAQ,IAAIC,aAAoB;GAC9B,SAAS,YAAY,WAAW,GAAG;GACnC,OAAO;EACT,CAAC,EACH,CAAC;EAEH,KAAK,IAAI,WAAW,IAAI,UAAU;CACpC;CACA,MAAM,OAAyB,OAC7B,OAAO,cAAc;EACnB,MAAM,aAAa,KAAK,IAAI,EAAE;EAC9B,OAAO,eAAe,KAAA,IAClBC,KAAY,IAAIC,SAAgB;GAAE,QAAQ;GAAY;EAAG,CAAC,CAAC,IAC3D,OAAO,QAAQ,UAAU;CAC/B,CAAC;CACH,OAAO;EACL;EACA,YAAY,CAAC,GAAG,KAAK,OAAO,CAAC;EAC7B,UAAU,OAAO,OAAO,IAAI,IAAI,EAAE,GAAGC,OAAgB;CACvD;AACF;AAEA,MAAa,SAAS,gBACpB,MAAM,KAAK,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC"}

package/dist/Provision.mjs

@@ -0,0 +1,93 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { decode } from "./DomainName.mjs";
+import { NotFound } from "./Reason.mjs";
+import { fail } from "./internal/error.mjs";
+import { Service as Service$1 } from "./Storage.mjs";
+import { Service as Service$2 } from "./Connect.mjs";
+import { reconcile } from "./internal/planner.mjs";
+import { assertWithin, make as make$1 } from "./internal/attempts.mjs";
+import { Context, Effect, Layer, Option } from "effect";
+//#region src/Provision.ts
+/**
+* plan -> approve -> apply, durable. Every step is a stored attempt, so a host can render the
+* plan in one request, collect consent in another, and apply in a third, and a retry of any step
+* is idempotent.
+*/
+var Provision_exports = /* @__PURE__ */ __exportAll({
+	Policy: () => Policy,
+	Service: () => Service,
+	apply: () => apply,
+	approve: () => approve,
+	defaults: () => defaults,
+	get: () => get,
+	latest: () => latest,
+	layer: () => layer,
+	make: () => make,
+	plan: () => plan,
+	reject: () => reject
+});
+var Service = class extends Context.Service()("@domainkit/Provision") {};
+const defaults = {
+	planTtlMs: 36e5,
+	applyLeaseMs: 12e4
+};
+var Policy = class extends Context.Reference("@domainkit/Provision/Policy", { defaultValue: () => defaults }) {};
+const make = Effect.gen(function* () {
+	const storage = yield* Service$1;
+	const connect = yield* Service$2;
+	const attempts = make$1(storage, connect, "provisioning");
+	const attachmentFor = (input) => Effect.gen(function* () {
+		const domain = yield* decode(input);
+		const attachment = yield* storage.attachments.byDomain(domain);
+		if (Option.isNone(attachment)) return yield* fail(new NotFound({
+			entity: "attachment",
+			id: domain
+		}));
+		return attachment.value;
+	});
+	const view = (attempt) => ({
+		plan: attempt.plan,
+		status: attempt.status,
+		approval: attempt.approval,
+		receipt: attempt.receipt,
+		rejection: attempt.rejection
+	});
+	return {
+		plan: (input) => Effect.gen(function* () {
+			const policy = yield* Policy;
+			const attachment = yield* attachmentFor(input.domain);
+			yield* assertWithin(attachment, input.requirements);
+			const { session, target } = yield* connect.session(attachment.id);
+			const observed = yield* session.dns(target).list(target.zone);
+			const operations = yield* reconcile(input.requirements, observed.map(({ record }) => record));
+			return yield* attempts.record({
+				attachment,
+				target,
+				operations,
+				ttlMs: policy.planTtlMs,
+				sourceReceiptId: null
+			});
+		}),
+		approve: (plan, options) => attempts.approve(plan, options),
+		reject: (plan, options) => Effect.map(attempts.reject(plan, options), view),
+		apply: (approval) => Effect.flatMap(Policy, (policy) => attempts.apply(approval, policy)),
+		get: (planId) => Effect.map(attempts.attemptOf(planId), view),
+		latest: (domain) => Effect.gen(function* () {
+			const attachment = yield* attachmentFor(domain);
+			const latest = yield* storage.attempts.latest(attachment.id, "provisioning");
+			return Option.isSome(latest) ? view(latest.value) : null;
+		})
+	};
+});
+const layer = Layer.effect(Service)(make);
+const accessor = (pick) => (...args) => Effect.flatMap(Service, (service) => pick(service)(...args));
+const plan = accessor((service) => service.plan);
+const approve = accessor((service) => service.approve);
+const reject = accessor((service) => service.reject);
+const apply = accessor((service) => service.apply);
+const get = accessor((service) => service.get);
+const latest = accessor((service) => service.latest);
+//#endregion
+export { Policy, Provision_exports, Service, apply, approve, defaults, get, latest, layer, make, plan, reject };
+
+//# sourceMappingURL=Provision.mjs.map

package/dist/Provision.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Provision.mjs","names":["Storage.Service","Connect.Service","Attempts.make","DomainName.decode","Errors.fail","Reason.NotFound","Attempts.assertWithin","Planner.reconcile"],"sources":["../src/Provision.ts"],"sourcesContent":["/**\n * plan -> approve -> apply, durable. Every step is a stored attempt, so a host can render the\n * plan in one request, collect consent in another, and apply in a third, and a retry of any step\n * is idempotent.\n */\nimport { Context, Effect, Layer, Option } from \"effect\";\n\nimport type * as Approval from \"./Approval.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport type * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport * as Attempts from \"./internal/attempts.ts\";\nimport * as Planner from \"./internal/planner.ts\";\nimport type * as Plan from \"./Plan.ts\";\nimport type * as Principal from \"./Principal.ts\";\nimport type * as Receipt from \"./Receipt.ts\";\nimport * as Storage from \"./Storage.ts\";\n\ntype Fx<A> = Effect.Effect<A, Errors.DomainKitError, Principal.Service>;\n\nexport interface Attempt {\n  readonly plan: Plan.Model;\n  readonly status: Storage.AttemptStatus;\n  readonly approval: Approval.Model | null;\n  readonly receipt: Receipt.Model | null;\n  readonly rejection: Storage.Rejection | null;\n}\n\nexport interface RejectOptions {\n  readonly reason?: string;\n}\n\nexport interface Interface {\n  /** Read provider state and build an additive plan. Fails `NotFound` when the domain is not attached. */\n  readonly plan: (input: {\n    readonly domain: string;\n    readonly requirements: ReadonlyArray<DnsRecord.Model>;\n  }) => Fx<Plan.Model>;\n  /**\n   * Record the principal's consent. Fails `Conflict` unless `allowPartial` and the selected\n   * operations are conflict-free. Approving an already-approved plan returns the same approval.\n   */\n  readonly approve: (\n    plan: Plan.Model | Plan.PlanId,\n    options?: Attempts.ApproveOptions,\n  ) => Fx<Approval.Model>;\n  /**\n   * Decline the plan for the acting principal; terminal. Rejecting again returns the same\n   * attempt; a plan that was approved or applied fails `Stale`.\n   */\n  readonly reject: (plan: Plan.Model | Plan.PlanId, options?: RejectOptions) => Fx<Attempt>;\n  /**\n   * Re-plan the zone, fail `Stale` if the digest moved, then create records. Partial success is a\n   * `partial` receipt. Applying an attempt that already completed returns its receipt.\n   */\n  readonly apply: (approval: Approval.Model | Approval.ApprovalId) => Fx<Receipt.Model>;\n  readonly get: (planId: Plan.PlanId) => Fx<Attempt>;\n  readonly latest: (domain: string) => Fx<Attempt | null>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Provision\") {}\n\nexport interface PolicyShape {\n  /** Plan lifetime before it must be rebuilt. Default 1 hour. */\n  readonly planTtlMs: number;\n  /** Apply lease; a crashed apply can be retried after this. Default 2 minutes. */\n  readonly applyLeaseMs: number;\n}\nexport const defaults: PolicyShape = { planTtlMs: 60 * 60_000, applyLeaseMs: 2 * 60_000 };\nexport class Policy extends Context.Reference<PolicyShape>(\"@domainkit/Provision/Policy\", {\n  defaultValue: () => defaults,\n}) {}\n\nexport const make: Effect.Effect<Interface, never, Storage.Service | Connect.Service> = Effect.gen(\n  function* () {\n    const storage = yield* Storage.Service;\n    const connect = yield* Connect.Service;\n    const attempts = Attempts.make(storage, connect, \"provisioning\");\n\n    const attachmentFor = (input: string): Fx<Storage.Attachment> =>\n      Effect.gen(function* () {\n        const domain = yield* DomainName.decode(input);\n        const attachment = yield* storage.attachments.byDomain(domain);\n        if (Option.isNone(attachment)) {\n          return yield* Errors.fail(new Reason.NotFound({ entity: \"attachment\", id: domain }));\n        }\n        return attachment.value;\n      });\n\n    const view = (attempt: Storage.Attempt): Attempt => ({\n      plan: attempt.plan,\n      status: attempt.status,\n      approval: attempt.approval,\n      receipt: attempt.receipt,\n      rejection: attempt.rejection,\n    });\n\n    return {\n      plan: (input) =>\n        Effect.gen(function* () {\n          const policy = yield* Policy;\n          const attachment = yield* attachmentFor(input.domain);\n          yield* Attempts.assertWithin(attachment, input.requirements);\n          const { session, target } = yield* connect.session(attachment.id);\n          const observed = yield* session.dns(target).list(target.zone);\n          const operations = yield* Planner.reconcile(\n            input.requirements,\n            observed.map(({ record }) => record),\n          );\n          return yield* attempts.record({\n            attachment,\n            target,\n            operations,\n            ttlMs: policy.planTtlMs,\n            sourceReceiptId: null,\n          });\n        }),\n      approve: (plan, options) => attempts.approve(plan, options),\n      reject: (plan, options) => Effect.map(attempts.reject(plan, options), view),\n      apply: (approval) => Effect.flatMap(Policy, (policy) => attempts.apply(approval, policy)),\n      get: (planId) => Effect.map(attempts.attemptOf(planId), view),\n      latest: (domain) =>\n        Effect.gen(function* () {\n          const attachment = yield* attachmentFor(domain);\n          const latest = yield* storage.attempts.latest(attachment.id, \"provisioning\");\n          return Option.isSome(latest) ? view(latest.value) : null;\n        }),\n    };\n  },\n);\n\nexport const layer: Layer.Layer<Service, never, Storage.Service | Connect.Service> =\n  Layer.effect(Service)(make);\n\nconst accessor =\n  <Args extends ReadonlyArray<unknown>, A>(\n    pick: (service: Interface) => (...args: Args) => Fx<A>,\n  ): ((...args: Args) => Effect.Effect<A, Errors.DomainKitError, Principal.Service | Service>) =>\n  (...args) =>\n    Effect.flatMap(Service, (service) => pick(service)(...args));\n\nexport const plan = accessor((service) => service.plan);\nexport const approve = accessor((service) => service.approve);\nexport const reject = accessor((service) => service.reject);\nexport const apply = accessor((service) => service.apply);\nexport const get = accessor((service) => service.get);\nexport const latest = accessor((service) => service.latest);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAQ5F,MAAa,WAAwB;CAAE,WAAW;CAAa,cAAc;AAAW;AACxF,IAAa,SAAb,cAA4B,QAAQ,UAAuB,+BAA+B,EACxF,oBAAoB,SACtB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,OAA2E,OAAO,IAC7F,aAAa;CACX,MAAM,UAAU,OAAOA;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,WAAWC,OAAc,SAAS,SAAS,cAAc;CAE/D,MAAM,iBAAiB,UACrB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAOC,OAAkB,KAAK;EAC7C,MAAM,aAAa,OAAO,QAAQ,YAAY,SAAS,MAAM;EAC7D,IAAI,OAAO,OAAO,UAAU,GAC1B,OAAO,OAAOC,KAAY,IAAIC,SAAgB;GAAE,QAAQ;GAAc,IAAI;EAAO,CAAC,CAAC;EAErF,OAAO,WAAW;CACpB,CAAC;CAEH,MAAM,QAAQ,aAAuC;EACnD,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,UAAU,QAAQ;EAClB,SAAS,QAAQ;EACjB,WAAW,QAAQ;CACrB;CAEA,OAAO;EACL,OAAO,UACL,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO;GACtB,MAAM,aAAa,OAAO,cAAc,MAAM,MAAM;GACpD,OAAOC,aAAsB,YAAY,MAAM,YAAY;GAC3D,MAAM,EAAE,SAAS,WAAW,OAAO,QAAQ,QAAQ,WAAW,EAAE;GAChE,MAAM,WAAW,OAAO,QAAQ,IAAI,MAAM,CAAC,CAAC,KAAK,OAAO,IAAI;GAC5D,MAAM,aAAa,OAAOC,UACxB,MAAM,cACN,SAAS,KAAK,EAAE,aAAa,MAAM,CACrC;GACA,OAAO,OAAO,SAAS,OAAO;IAC5B;IACA;IACA;IACA,OAAO,OAAO;IACd,iBAAiB;GACnB,CAAC;EACH,CAAC;EACH,UAAU,MAAM,YAAY,SAAS,QAAQ,MAAM,OAAO;EAC1D,SAAS,MAAM,YAAY,OAAO,IAAI,SAAS,OAAO,MAAM,OAAO,GAAG,IAAI;EAC1E,QAAQ,aAAa,OAAO,QAAQ,SAAS,WAAW,SAAS,MAAM,UAAU,MAAM,CAAC;EACxF,MAAM,WAAW,OAAO,IAAI,SAAS,UAAU,MAAM,GAAG,IAAI;EAC5D,SAAS,WACP,OAAO,IAAI,aAAa;GACtB,MAAM,aAAa,OAAO,cAAc,MAAM;GAC9C,MAAM,SAAS,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,cAAc;GAC3E,OAAO,OAAO,OAAO,MAAM,IAAI,KAAK,OAAO,KAAK,IAAI;EACtD,CAAC;CACL;AACF,CACF;AAEA,MAAa,QACX,MAAM,OAAO,OAAO,CAAC,CAAC,IAAI;AAE5B,MAAM,YAEF,UAED,GAAG,SACF,OAAO,QAAQ,UAAU,YAAY,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;AAE/D,MAAa,OAAO,UAAU,YAAY,QAAQ,IAAI;AACtD,MAAa,UAAU,UAAU,YAAY,QAAQ,OAAO;AAC5D,MAAa,SAAS,UAAU,YAAY,QAAQ,MAAM;AAC1D,MAAa,QAAQ,UAAU,YAAY,QAAQ,KAAK;AACxD,MAAa,MAAM,UAAU,YAAY,QAAQ,GAAG;AACpD,MAAa,SAAS,UAAU,YAAY,QAAQ,MAAM"}

package/dist/Reason.mjs

@@ -0,0 +1,162 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Conflict as Conflict$1, Digest as Digest$1, PlanId as PlanId$1 } from "./Plan.mjs";
+import { Schema } from "effect";
+//#region src/Reason.ts
+/**
+* Why an operation failed. Every `DomainKit.Error` carries exactly one of these as `reason`; hosts
+* match on `reason._tag` and add a reason here rather than a new error class.
+*/
+var Reason_exports = /* @__PURE__ */ __exportAll({
+	Busy: () => Busy,
+	Conflict: () => Conflict,
+	CryptoFailed: () => CryptoFailed,
+	Expired: () => Expired,
+	Forbidden: () => Forbidden,
+	InvalidInput: () => InvalidInput,
+	Model: () => Model,
+	NotFound: () => NotFound,
+	ProviderConflict: () => ProviderConflict,
+	ProviderRejected: () => ProviderRejected,
+	ProviderUnavailable: () => ProviderUnavailable,
+	Reconnect: () => Reconnect,
+	ResolverFailed: () => ResolverFailed,
+	Stale: () => Stale,
+	StorageFailed: () => StorageFailed,
+	Unauthenticated: () => Unauthenticated,
+	Unsupported: () => Unsupported
+});
+const PlanId = Schema.suspend(() => PlanId$1);
+const Digest = Schema.suspend(() => Digest$1);
+const Conflicts = Schema.suspend(() => Schema.Array(Conflict$1));
+var InvalidInput = class extends Schema.TaggedError("@domainkit/Reason/InvalidInput")("InvalidInput", {
+	message: Schema.String,
+	field: Schema.optionalKey(Schema.String)
+}) {};
+var Unauthenticated = class extends Schema.TaggedError("@domainkit/Reason/Unauthenticated")("Unauthenticated", { message: Schema.String }) {};
+var Forbidden = class extends Schema.TaggedError("@domainkit/Reason/Forbidden")("Forbidden", { message: Schema.String }) {};
+var NotFound = class extends Schema.TaggedError("@domainkit/Reason/NotFound")("NotFound", {
+	entity: Schema.Literals([
+		"connection",
+		"attachment",
+		"plan",
+		"approval",
+		"receipt",
+		"continuation",
+		"provider",
+		"zone",
+		"authorization",
+		"record"
+	]),
+	id: Schema.String
+}) {
+	get message() {
+		return `${this.entity} ${this.id} was not found`;
+	}
+};
+/** The plan contains conflicts and cannot be applied. */
+var Conflict = class extends Schema.TaggedError("@domainkit/Reason/Conflict")("Conflict", {
+	planId: PlanId,
+	operations: Conflicts
+}) {
+	get message() {
+		return `plan ${this.planId} has ${this.operations.length} conflicting operation(s)`;
+	}
+};
+/** Provider state moved since the plan was built; build a new plan. */
+var Stale = class extends Schema.TaggedError("@domainkit/Reason/Stale")("Stale", {
+	planId: PlanId,
+	digest: Digest
+}) {
+	get message() {
+		return `plan ${this.planId} is stale; provider state no longer matches digest ${this.digest}`;
+	}
+};
+var Expired = class extends Schema.TaggedError("@domainkit/Reason/Expired")("Expired", {
+	entity: Schema.Literals([
+		"plan",
+		"approval",
+		"continuation",
+		"credential"
+	]),
+	id: Schema.String
+}) {
+	get message() {
+		return `${this.entity} ${this.id} has expired`;
+	}
+};
+/** Another operation holds the lock (e.g. concurrent apply or refresh). Retrying is safe. */
+var Busy = class extends Schema.TaggedError("@domainkit/Reason/Busy")("Busy", { key: Schema.String }) {
+	get message() {
+		return `${this.key} is busy`;
+	}
+};
+var ProviderRejected = class extends Schema.TaggedError("@domainkit/Reason/ProviderRejected")("ProviderRejected", {
+	provider: Schema.String,
+	code: Schema.optionalKey(Schema.String),
+	message: Schema.String
+}) {};
+var ProviderUnavailable = class extends Schema.TaggedError("@domainkit/Reason/ProviderUnavailable")("ProviderUnavailable", {
+	provider: Schema.String,
+	retryAfterMs: Schema.optionalKey(Schema.Number),
+	message: Schema.String
+}) {};
+/** The provider credential no longer works; the customer must reconnect. */
+var Reconnect = class extends Schema.TaggedError("@domainkit/Reason/Reconnect")("Reconnect", {
+	provider: Schema.String,
+	connectionId: Schema.String
+}) {
+	get message() {
+		return `${this.provider} connection ${this.connectionId} must be reconnected`;
+	}
+};
+var StorageFailed = class extends Schema.TaggedError("@domainkit/Reason/StorageFailed")("StorageFailed", {
+	operation: Schema.String,
+	message: Schema.String
+}) {};
+var CryptoFailed = class extends Schema.TaggedError("@domainkit/Reason/CryptoFailed")("CryptoFailed", { operation: Schema.Literals([
+	"digest",
+	"seal",
+	"open"
+]) }) {
+	get message() {
+		return `crypto ${this.operation} failed`;
+	}
+};
+var ResolverFailed = class extends Schema.TaggedError("@domainkit/Reason/ResolverFailed")("ResolverFailed", {
+	resolver: Schema.String,
+	message: Schema.String
+}) {};
+/** The provider refused the write because a conflicting record already exists there. */
+var ProviderConflict = class extends Schema.TaggedError("@domainkit/Reason/ProviderConflict")("ProviderConflict", {
+	provider: Schema.String,
+	code: Schema.optionalKey(Schema.String),
+	message: Schema.String
+}) {};
+/** The provider, or this target within it, cannot do the requested operation. */
+var Unsupported = class extends Schema.TaggedError("@domainkit/Reason/Unsupported")("Unsupported", {
+	provider: Schema.String,
+	operation: Schema.String,
+	message: Schema.String
+}) {};
+const Model = Schema.Union([
+	InvalidInput,
+	Unauthenticated,
+	Forbidden,
+	NotFound,
+	Conflict,
+	Stale,
+	Expired,
+	Busy,
+	ProviderRejected,
+	ProviderUnavailable,
+	ProviderConflict,
+	Unsupported,
+	Reconnect,
+	StorageFailed,
+	CryptoFailed,
+	ResolverFailed
+]);
+//#endregion
+export { Busy, Conflict, CryptoFailed, Expired, Forbidden, InvalidInput, Model, NotFound, ProviderConflict, ProviderRejected, ProviderUnavailable, Reason_exports, Reconnect, ResolverFailed, Stale, StorageFailed, Unauthenticated, Unsupported };
+
+//# sourceMappingURL=Reason.mjs.map

package/dist/Reason.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Reason.mjs","names":["Plan.PlanId","Plan.Digest","Plan.Conflict"],"sources":["../src/Reason.ts"],"sourcesContent":["/**\n * Why an operation failed. Every `DomainKit.Error` carries exactly one of these as `reason`; hosts\n * match on `reason._tag` and add a reason here rather than a new error class.\n */\nimport { Schema } from \"effect\";\n\nimport * as Plan from \"./Plan.ts\";\n\n// Plan imports `internal/error.ts`, which imports this module; read Plan lazily so evaluation\n// order inside the cycle does not matter.\nconst PlanId = Schema.suspend(() => Plan.PlanId);\nconst Digest = Schema.suspend(() => Plan.Digest);\nconst Conflicts = Schema.suspend(() => Schema.Array(Plan.Conflict));\n\nexport class InvalidInput extends Schema.TaggedError<InvalidInput>(\n  \"@domainkit/Reason/InvalidInput\",\n)(\"InvalidInput\", { message: Schema.String, field: Schema.optionalKey(Schema.String) }) {}\nexport class Unauthenticated extends Schema.TaggedError<Unauthenticated>(\n  \"@domainkit/Reason/Unauthenticated\",\n)(\"Unauthenticated\", { message: Schema.String }) {}\nexport class Forbidden extends Schema.TaggedError<Forbidden>(\"@domainkit/Reason/Forbidden\")(\n  \"Forbidden\",\n  { message: Schema.String },\n) {}\nexport class NotFound extends Schema.TaggedError<NotFound>(\"@domainkit/Reason/NotFound\")(\n  \"NotFound\",\n  {\n    entity: Schema.Literals([\n      \"connection\",\n      \"attachment\",\n      \"plan\",\n      \"approval\",\n      \"receipt\",\n      \"continuation\",\n      \"provider\",\n      \"zone\",\n      \"authorization\",\n      \"record\",\n    ]),\n    id: Schema.String,\n  },\n) {\n  override get message(): string {\n    return `${this.entity} ${this.id} was not found`;\n  }\n}\n/** The plan contains conflicts and cannot be applied. */\nexport class Conflict extends Schema.TaggedError<Conflict>(\"@domainkit/Reason/Conflict\")(\n  \"Conflict\",\n  {\n    planId: PlanId,\n    operations: Conflicts,\n  },\n) {\n  override get message(): string {\n    return `plan ${this.planId} has ${this.operations.length} conflicting operation(s)`;\n  }\n}\n/** Provider state moved since the plan was built; build a new plan. */\nexport class Stale extends Schema.TaggedError<Stale>(\"@domainkit/Reason/Stale\")(\"Stale\", {\n  planId: PlanId,\n  digest: Digest,\n}) {\n  override get message(): string {\n    return `plan ${this.planId} is stale; provider state no longer matches digest ${this.digest}`;\n  }\n}\nexport class Expired extends Schema.TaggedError<Expired>(\"@domainkit/Reason/Expired\")(\"Expired\", {\n  entity: Schema.Literals([\"plan\", \"approval\", \"continuation\", \"credential\"]),\n  id: Schema.String,\n}) {\n  override get message(): string {\n    return `${this.entity} ${this.id} has expired`;\n  }\n}\n/** Another operation holds the lock (e.g. concurrent apply or refresh). Retrying is safe. */\nexport class Busy extends Schema.TaggedError<Busy>(\"@domainkit/Reason/Busy\")(\"Busy\", {\n  key: Schema.String,\n}) {\n  override get message(): string {\n    return `${this.key} is busy`;\n  }\n}\nexport class ProviderRejected extends Schema.TaggedError<ProviderRejected>(\n  \"@domainkit/Reason/ProviderRejected\",\n)(\"ProviderRejected\", {\n  provider: Schema.String,\n  code: Schema.optionalKey(Schema.String),\n  message: Schema.String,\n}) {}\nexport class ProviderUnavailable extends Schema.TaggedError<ProviderUnavailable>(\n  \"@domainkit/Reason/ProviderUnavailable\",\n)(\"ProviderUnavailable\", {\n  provider: Schema.String,\n  retryAfterMs: Schema.optionalKey(Schema.Number),\n  message: Schema.String,\n}) {}\n/** The provider credential no longer works; the customer must reconnect. */\nexport class Reconnect extends Schema.TaggedError<Reconnect>(\"@domainkit/Reason/Reconnect\")(\n  \"Reconnect\",\n  { provider: Schema.String, connectionId: Schema.String },\n) {\n  override get message(): string {\n    return `${this.provider} connection ${this.connectionId} must be reconnected`;\n  }\n}\nexport class StorageFailed extends Schema.TaggedError<StorageFailed>(\n  \"@domainkit/Reason/StorageFailed\",\n)(\"StorageFailed\", { operation: Schema.String, message: Schema.String }) {}\nexport class CryptoFailed extends Schema.TaggedError<CryptoFailed>(\n  \"@domainkit/Reason/CryptoFailed\",\n)(\"CryptoFailed\", { operation: Schema.Literals([\"digest\", \"seal\", \"open\"]) }) {\n  override get message(): string {\n    return `crypto ${this.operation} failed`;\n  }\n}\nexport class ResolverFailed extends Schema.TaggedError<ResolverFailed>(\n  \"@domainkit/Reason/ResolverFailed\",\n)(\"ResolverFailed\", { resolver: Schema.String, message: Schema.String }) {}\n\n/** The provider refused the write because a conflicting record already exists there. */\nexport class ProviderConflict extends Schema.TaggedError<ProviderConflict>(\n  \"@domainkit/Reason/ProviderConflict\",\n)(\"ProviderConflict\", {\n  provider: Schema.String,\n  code: Schema.optionalKey(Schema.String),\n  message: Schema.String,\n}) {}\n/** The provider, or this target within it, cannot do the requested operation. */\nexport class Unsupported extends Schema.TaggedError<Unsupported>(\"@domainkit/Reason/Unsupported\")(\n  \"Unsupported\",\n  { provider: Schema.String, operation: Schema.String, message: Schema.String },\n) {}\n\nexport const Model = Schema.Union([\n  InvalidInput,\n  Unauthenticated,\n  Forbidden,\n  NotFound,\n  Conflict,\n  Stale,\n  Expired,\n  Busy,\n  ProviderRejected,\n  ProviderUnavailable,\n  ProviderConflict,\n  Unsupported,\n  Reconnect,\n  StorageFailed,\n  CryptoFailed,\n  ResolverFailed,\n]);\nexport type Model = typeof Model.Type;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAM,SAAS,OAAO,cAAcA,QAAW;AAC/C,MAAM,SAAS,OAAO,cAAcC,QAAW;AAC/C,MAAM,YAAY,OAAO,cAAc,OAAO,MAAMC,UAAa,CAAC;AAElE,IAAa,eAAb,cAAkC,OAAO,YACvC,gCACF,CAAC,CAAC,gBAAgB;CAAE,SAAS,OAAO;CAAQ,OAAO,OAAO,YAAY,OAAO,MAAM;AAAE,CAAC,CAAC,CAAC,CAAC;AACzF,IAAa,kBAAb,cAAqC,OAAO,YAC1C,mCACF,CAAC,CAAC,mBAAmB,EAAE,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AAClD,IAAa,YAAb,cAA+B,OAAO,YAAuB,6BAA6B,CAAC,CACzF,aACA,EAAE,SAAS,OAAO,OAAO,CAC3B,CAAC,CAAC,CAAC;AACH,IAAa,WAAb,cAA8B,OAAO,YAAsB,4BAA4B,CAAC,CACtF,YACA;CACE,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,OAAO;AACb,CACF,CAAC,CAAC;CACA,IAAa,UAAkB;EAC7B,OAAO,GAAG,KAAK,OAAO,GAAG,KAAK,GAAG;CACnC;AACF;;AAEA,IAAa,WAAb,cAA8B,OAAO,YAAsB,4BAA4B,CAAC,CACtF,YACA;CACE,QAAQ;CACR,YAAY;AACd,CACF,CAAC,CAAC;CACA,IAAa,UAAkB;EAC7B,OAAO,QAAQ,KAAK,OAAO,OAAO,KAAK,WAAW,OAAO;CAC3D;AACF;;AAEA,IAAa,QAAb,cAA2B,OAAO,YAAmB,yBAAyB,CAAC,CAAC,SAAS;CACvF,QAAQ;CACR,QAAQ;AACV,CAAC,CAAC,CAAC;CACD,IAAa,UAAkB;EAC7B,OAAO,QAAQ,KAAK,OAAO,qDAAqD,KAAK;CACvF;AACF;AACA,IAAa,UAAb,cAA6B,OAAO,YAAqB,2BAA2B,CAAC,CAAC,WAAW;CAC/F,QAAQ,OAAO,SAAS;EAAC;EAAQ;EAAY;EAAgB;CAAY,CAAC;CAC1E,IAAI,OAAO;AACb,CAAC,CAAC,CAAC;CACD,IAAa,UAAkB;EAC7B,OAAO,GAAG,KAAK,OAAO,GAAG,KAAK,GAAG;CACnC;AACF;;AAEA,IAAa,OAAb,cAA0B,OAAO,YAAkB,wBAAwB,CAAC,CAAC,QAAQ,EACnF,KAAK,OAAO,OACd,CAAC,CAAC,CAAC;CACD,IAAa,UAAkB;EAC7B,OAAO,GAAG,KAAK,IAAI;CACrB;AACF;AACA,IAAa,mBAAb,cAAsC,OAAO,YAC3C,oCACF,CAAC,CAAC,oBAAoB;CACpB,UAAU,OAAO;CACjB,MAAM,OAAO,YAAY,OAAO,MAAM;CACtC,SAAS,OAAO;AAClB,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,sBAAb,cAAyC,OAAO,YAC9C,uCACF,CAAC,CAAC,uBAAuB;CACvB,UAAU,OAAO;CACjB,cAAc,OAAO,YAAY,OAAO,MAAM;CAC9C,SAAS,OAAO;AAClB,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,YAAb,cAA+B,OAAO,YAAuB,6BAA6B,CAAC,CACzF,aACA;CAAE,UAAU,OAAO;CAAQ,cAAc,OAAO;AAAO,CACzD,CAAC,CAAC;CACA,IAAa,UAAkB;EAC7B,OAAO,GAAG,KAAK,SAAS,cAAc,KAAK,aAAa;CAC1D;AACF;AACA,IAAa,gBAAb,cAAmC,OAAO,YACxC,iCACF,CAAC,CAAC,iBAAiB;CAAE,WAAW,OAAO;CAAQ,SAAS,OAAO;AAAO,CAAC,CAAC,CAAC,CAAC;AAC1E,IAAa,eAAb,cAAkC,OAAO,YACvC,gCACF,CAAC,CAAC,gBAAgB,EAAE,WAAW,OAAO,SAAS;CAAC;CAAU;CAAQ;AAAM,CAAC,EAAE,CAAC,CAAC,CAAC;CAC5E,IAAa,UAAkB;EAC7B,OAAO,UAAU,KAAK,UAAU;CAClC;AACF;AACA,IAAa,iBAAb,cAAoC,OAAO,YACzC,kCACF,CAAC,CAAC,kBAAkB;CAAE,UAAU,OAAO;CAAQ,SAAS,OAAO;AAAO,CAAC,CAAC,CAAC,CAAC;;AAG1E,IAAa,mBAAb,cAAsC,OAAO,YAC3C,oCACF,CAAC,CAAC,oBAAoB;CACpB,UAAU,OAAO;CACjB,MAAM,OAAO,YAAY,OAAO,MAAM;CACtC,SAAS,OAAO;AAClB,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,cAAb,cAAiC,OAAO,YAAyB,+BAA+B,CAAC,CAC/F,eACA;CAAE,UAAU,OAAO;CAAQ,WAAW,OAAO;CAAQ,SAAS,OAAO;AAAO,CAC9E,CAAC,CAAC,CAAC;AAEH,MAAa,QAAQ,OAAO,MAAM;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/Receipt.mjs

@@ -0,0 +1,71 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Digest, Kind, OperationId, PlanId } from "./Plan.mjs";
+import { decode as decode$1 } from "./internal/error.mjs";
+import { ApprovalId } from "./Approval.mjs";
+import { Schema } from "effect";
+//#region src/Receipt.ts
+/**
+* What actually happened when an approval was applied. Partial application is a normal outcome
+* carried here as `status: "partial"`, never an error. Cleanup plans are built only from receipts.
+*/
+var Receipt_exports = /* @__PURE__ */ __exportAll({
+	Applied: () => Applied,
+	Failed: () => Failed,
+	Model: () => Model,
+	Outcome: () => Outcome,
+	ReceiptId: () => ReceiptId,
+	Skipped: () => Skipped,
+	applied: () => applied,
+	decode: () => decode,
+	encode: () => encode,
+	isComplete: () => isComplete
+});
+const ReceiptId = Schema.String.pipe(Schema.brand("@domainkit/ReceiptId"));
+var Applied = class extends Schema.TaggedClass("@domainkit/Receipt/Applied")("Applied", {
+	operationId: OperationId,
+	/** The record created (provisioning) or deleted (cleanup). */
+	providerRecordId: Schema.String
+}) {};
+/**
+* `noop`: the record already existed. `not-approved`: the approval excluded the operation.
+* `not-attempted`: an earlier operation failed and apply stopped before reaching this one.
+*/
+var Skipped = class extends Schema.TaggedClass("@domainkit/Receipt/Skipped")("Skipped", {
+	operationId: OperationId,
+	reason: Schema.Literals([
+		"noop",
+		"not-approved",
+		"not-attempted"
+	])
+}) {};
+var Failed = class extends Schema.TaggedClass("@domainkit/Receipt/Failed")("Failed", {
+	operationId: OperationId,
+	message: Schema.String
+}) {};
+const Outcome = Schema.Union([
+	Applied,
+	Skipped,
+	Failed
+]);
+var Model = class extends Schema.Class("@domainkit/Receipt")({
+	id: ReceiptId,
+	version: Schema.Literal("domainkit.receipt.v2"),
+	kind: Kind,
+	planId: PlanId,
+	approvalId: ApprovalId,
+	digest: Digest,
+	provider: Schema.String,
+	zone: Schema.String,
+	status: Schema.Literals(["complete", "partial"]),
+	outcomes: Schema.Array(Outcome),
+	appliedAt: Schema.DateTimeUtcFromString
+}) {};
+const decode = (input) => decode$1(Model, input);
+const encode = Schema.encodeSync(Model);
+const isComplete = (receipt) => receipt.status === "complete";
+/** Operations the receipt proves were written, with the provider record ids needed to undo them. */
+const applied = (receipt) => receipt.outcomes.filter((outcome) => outcome._tag === "Applied");
+//#endregion
+export { Applied, Failed, Model, Outcome, ReceiptId, Receipt_exports, Skipped, applied, decode, encode, isComplete };
+
+//# sourceMappingURL=Receipt.mjs.map

package/dist/Receipt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Receipt.mjs","names":["Plan.OperationId","Plan.Kind","Plan.PlanId","Approval.ApprovalId","Plan.Digest","Errors.decode"],"sources":["../src/Receipt.ts"],"sourcesContent":["/**\n * What actually happened when an approval was applied. Partial application is a normal outcome\n * carried here as `status: \"partial\"`, never an error. Cleanup plans are built only from receipts.\n */\nimport { Effect, Schema } from \"effect\";\n\nimport * as Approval from \"./Approval.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Plan from \"./Plan.ts\";\n\nexport const ReceiptId = Schema.String.pipe(Schema.brand(\"@domainkit/ReceiptId\"));\nexport type ReceiptId = typeof ReceiptId.Type;\n\nexport class Applied extends Schema.TaggedClass<Applied>(\"@domainkit/Receipt/Applied\")(\"Applied\", {\n  operationId: Plan.OperationId,\n  /** The record created (provisioning) or deleted (cleanup). */\n  providerRecordId: Schema.String,\n}) {}\n/**\n * `noop`: the record already existed. `not-approved`: the approval excluded the operation.\n * `not-attempted`: an earlier operation failed and apply stopped before reaching this one.\n */\nexport class Skipped extends Schema.TaggedClass<Skipped>(\"@domainkit/Receipt/Skipped\")(\"Skipped\", {\n  operationId: Plan.OperationId,\n  reason: Schema.Literals([\"noop\", \"not-approved\", \"not-attempted\"]),\n}) {}\nexport class Failed extends Schema.TaggedClass<Failed>(\"@domainkit/Receipt/Failed\")(\"Failed\", {\n  operationId: Plan.OperationId,\n  message: Schema.String,\n}) {}\nexport const Outcome = Schema.Union([Applied, Skipped, Failed]);\nexport type Outcome = typeof Outcome.Type;\n\nexport class Model extends Schema.Class<Model>(\"@domainkit/Receipt\")({\n  id: ReceiptId,\n  version: Schema.Literal(\"domainkit.receipt.v2\"),\n  kind: Plan.Kind,\n  planId: Plan.PlanId,\n  approvalId: Approval.ApprovalId,\n  digest: Plan.Digest,\n  provider: Schema.String,\n  zone: Schema.String,\n  status: Schema.Literals([\"complete\", \"partial\"]),\n  outcomes: Schema.Array(Outcome),\n  appliedAt: Schema.DateTimeUtcFromString,\n}) {}\nexport type Encoded = typeof Model.Encoded;\n\nexport const decode = (input: unknown): Effect.Effect<Model, Errors.DomainKitError> =>\n  Errors.decode(Model, input);\nexport const encode: (receipt: Model) => Encoded = Schema.encodeSync(Model);\nexport const isComplete = (receipt: Model): boolean => receipt.status === \"complete\";\n\n/** Operations the receipt proves were written, with the provider record ids needed to undo them. */\nexport const applied = (receipt: Model): ReadonlyArray<Applied> =>\n  receipt.outcomes.filter((outcome): outcome is Applied => outcome._tag === \"Applied\");\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY,OAAO,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAC;AAGhF,IAAa,UAAb,cAA6B,OAAO,YAAqB,4BAA4B,CAAC,CAAC,WAAW;CAChG,aAAaA;;CAEb,kBAAkB,OAAO;AAC3B,CAAC,CAAC,CAAC,CAAC;;;;;AAKJ,IAAa,UAAb,cAA6B,OAAO,YAAqB,4BAA4B,CAAC,CAAC,WAAW;CAChG,aAAaA;CACb,QAAQ,OAAO,SAAS;EAAC;EAAQ;EAAgB;CAAe,CAAC;AACnE,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,SAAb,cAA4B,OAAO,YAAoB,2BAA2B,CAAC,CAAC,UAAU;CAC5F,aAAaA;CACb,SAAS,OAAO;AAClB,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,UAAU,OAAO,MAAM;CAAC;CAAS;CAAS;AAAM,CAAC;AAG9D,IAAa,QAAb,cAA2B,OAAO,MAAa,oBAAoB,CAAC,CAAC;CACnE,IAAI;CACJ,SAAS,OAAO,QAAQ,sBAAsB;CAC9C,MAAMC;CACN,QAAQC;CACR,YAAYC;CACZ,QAAQC;CACR,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,QAAQ,OAAO,SAAS,CAAC,YAAY,SAAS,CAAC;CAC/C,UAAU,OAAO,MAAM,OAAO;CAC9B,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAGJ,MAAa,UAAU,UACrBC,SAAc,OAAO,KAAK;AAC5B,MAAa,SAAsC,OAAO,WAAW,KAAK;AAC1E,MAAa,cAAc,YAA4B,QAAQ,WAAW;;AAG1E,MAAa,WAAW,YACtB,QAAQ,SAAS,QAAQ,YAAgC,QAAQ,SAAS,SAAS"}