domainkit 0.8.0 → 0.9.1

package/dist/connect-oI8hcMxc.mjs

@@ -1,185 +0,0 @@
-import { l as Revocation, s as Service, w as project } from "./canonical-json-CQYKsZw7.mjs";
-import { Clock, Crypto, Data, Effect, Schema } from "effect";
-//#region src/auth/connect.ts
-const Method = Data.taggedEnum();
-const StartResult = Data.taggedEnum();
-var Error = class extends Schema.TaggedError()("ConnectionError", {
-	category: Schema.Literals([
-		"authorization",
-		"provider",
-		"validation"
-	]),
-	message: Schema.String,
-	operation: Schema.String,
-	retry: Schema.Literals([
-		"never",
-		"after-user-action",
-		"safe",
-		"unknown"
-	])
-}) {};
-const missingCapability = (authentication, requiredCapabilities) => requiredCapabilities.find((capability) => !authentication.capabilityEvidence.some((item) => item.capability === capability));
-const freshId = Effect.fn("Connection.freshId")(function* () {
-	return yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(Effect.mapError((cause) => new Error({
-		category: "validation",
-		message: cause.message,
-		operation: "Connection.connect",
-		retry: "safe"
-	})));
-});
-/** Persist one authenticated provider connection, optionally reusing a proven authorization. */
-const connect = Effect.fn("Connection.connect")(function* (input) {
-	const repository = yield* Service;
-	const now = new Date(yield* Clock.currentTimeMillis);
-	const missing = missingCapability(input.authentication, input.requiredCapabilities);
-	if (missing !== void 0) return yield* new Error({
-		category: "authorization",
-		message: `Provider authorization lacks evidence for ${missing}`,
-		operation: "Connection.connect",
-		retry: "after-user-action"
-	});
-	const existing = input.authorizationId === void 0 ? null : yield* repository.get(input.authorizationId);
-	if (input.authorizationId !== void 0 && existing === null) return yield* new Error({
-		category: "authorization",
-		message: "Provider authorization does not exist",
-		operation: "Connection.connect",
-		retry: "after-user-action"
-	});
-	if (existing?.authorization.revocation._tag === "Pending") return yield* new Error({
-		category: "authorization",
-		message: "Provider authorization is awaiting revocation recovery",
-		operation: "Connection.connect",
-		retry: "after-user-action"
-	});
-	if (existing !== null && (existing.authorization.providerId !== input.providerId || existing.authorization.method !== input.method)) return yield* new Error({
-		category: "authorization",
-		message: "Provider proof does not match the existing authorization",
-		operation: "Connection.connect",
-		retry: "never"
-	});
-	const authorizationId = existing?.authorization.id ?? (yield* freshId());
-	const authorization = existing === null ? {
-		authorizedById: input.authorizedById,
-		capabilityEvidence: [...input.authentication.capabilityEvidence],
-		createdAt: now,
-		id: authorizationId,
-		method: input.method,
-		providerContext: input.authentication.providerContext,
-		providerId: input.providerId,
-		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: Revocation.Active(),
-		scopes: [...input.authentication.scopes]
-	} : {
-		...existing.authorization,
-		capabilityEvidence: mergeEvidence(existing.authorization.capabilityEvidence, input.authentication.capabilityEvidence),
-		method: input.method,
-		providerContext: input.authentication.providerContext,
-		requiredCapabilities: [...input.requiredCapabilities],
-		revocation: Revocation.Active(),
-		scopes: [...input.authentication.scopes]
-	};
-	const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);
-	const connection = {
-		authorizationId,
-		createdAt: existingConnection?.createdAt ?? now,
-		id: existingConnection?.id ?? (yield* freshId()),
-		method: input.method,
-		ownerId: input.ownerId,
-		providerId: input.providerId
-	};
-	return yield* repository.connect({
-		authorization,
-		connection,
-		credential: input.authentication.credential,
-		...existing === null ? {} : { expectedAuthorizationId: existing.authorization.id },
-		...existingConnection === null ? {} : { expectedConnectionId: existingConnection.id }
-	});
-});
-const start = Effect.fn("Connection.start")(function* (input) {
-	if (input.method._tag === "Interactive") {
-		const crypto = yield* Crypto.Crypto;
-		const now = yield* Clock.currentTimeMillis;
-		const continuationId = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new Error({
-			category: "validation",
-			message: cause.message,
-			operation: "Connection.start",
-			retry: "safe"
-		})));
-		const started = yield* input.method.flow.start(continuationId);
-		yield* input.method.continuations.put({
-			authorizedById: input.authorizedById,
-			...input.authorizationId === void 0 ? {} : { authorizationId: input.authorizationId },
-			expiresAt: new Date(now + (input.method.ttlMs ?? 6e5)),
-			id: continuationId,
-			method: input.method.flow.method,
-			ownerId: input.ownerId,
-			payload: started.payload,
-			providerId: input.method.flow.providerId,
-			requiredCapabilities: [...input.method.flow.requiredCapabilities]
-		});
-		return StartResult.Redirect({
-			authorizationUrl: started.authorizationUrl,
-			continuationId
-		});
-	}
-	const authentication = yield* input.method.authenticate(input.method.token);
-	const aggregate = yield* connect({
-		authentication,
-		authorizedById: input.authorizedById,
-		...input.authorizationId === void 0 ? {} : { authorizationId: input.authorizationId },
-		method: "token",
-		ownerId: input.ownerId,
-		providerId: input.method.providerId,
-		requiredCapabilities: input.method.requiredCapabilities
-	});
-	const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === input.ownerId);
-	if (storedConnection === void 0) return yield* new Error({
-		category: "validation",
-		message: "Connected provider authorization returned no organization connection",
-		operation: "Connection.start",
-		retry: "safe"
-	});
-	return StartResult.Connected({ connection: project(storedConnection, aggregate.authorization, aggregate.credential) });
-});
-const complete = Effect.fn("Connection.complete")(function* (input) {
-	const continuation = yield* input.continuations.consume(input.continuationId, new Date(yield* Clock.currentTimeMillis));
-	if (continuation === null) return yield* new Error({
-		category: "authorization",
-		message: "Connection continuation is expired, unknown, or already consumed",
-		operation: "Connection.complete",
-		retry: "after-user-action"
-	});
-	if (continuation.providerId !== input.flow.providerId || continuation.method !== input.flow.method) return yield* new Error({
-		category: "authorization",
-		message: "Connection continuation does not match the provider flow",
-		operation: "Connection.complete",
-		retry: "never"
-	});
-	const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);
-	const aggregate = yield* connect({
-		authentication,
-		authorizedById: continuation.authorizedById,
-		...continuation.authorizationId === void 0 ? {} : { authorizationId: continuation.authorizationId },
-		method: continuation.method,
-		ownerId: continuation.ownerId,
-		providerId: continuation.providerId,
-		requiredCapabilities: continuation.requiredCapabilities
-	});
-	const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === continuation.ownerId);
-	if (storedConnection === void 0) return yield* new Error({
-		category: "validation",
-		message: "Connected provider authorization returned no organization connection",
-		operation: "Connection.complete",
-		retry: "safe"
-	});
-	return project(storedConnection, aggregate.authorization, aggregate.credential);
-});
-function mergeEvidence(current, incoming) {
-	const byCapability = new Map(current.map((item) => [item.capability, item]));
-	for (const item of incoming) byCapability.set(item.capability, item);
-	return [...byCapability.values()];
-}
-//#endregion
-export { start as a, complete as i, Method as n, StartResult as r, Error as t };
-
-//# sourceMappingURL=connect-oI8hcMxc.mjs.map

package/dist/connect-oI8hcMxc.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-oI8hcMxc.mjs","names":["Repository.Service","Connection.project"],"sources":["../src/auth/connect.ts"],"sourcesContent":["import { Clock, Crypto, Data, Effect, Schema } from \"effect\";\n\nimport { CryptoError } from \"../plan/canonical-json.ts\";\nimport type { Error as InvalidInputError } from \"../invalid-input.ts\";\nimport type * as DnsProvider from \"../provider/provider.ts\";\nimport * as ProviderAuthorization from \"./authorization.ts\";\nimport * as Connection from \"./connection.ts\";\nimport * as Repository from \"./lifecycle-repository.ts\";\nimport type * as ProviderContext from \"./provider-context.ts\";\nimport type * as Secret from \"./secret.ts\";\n\nexport interface Authentication {\n  readonly capabilityEvidence: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>;\n  readonly credential: Connection.StoredCredential;\n  /** Provider-specific subject identity used only during authentication; targets are selected later. */\n  readonly providerAccountId: string;\n  readonly providerContext: ProviderContext.Envelope;\n  readonly scopes: ReadonlyArray<string>;\n}\n\nexport type AuthenticationFailure = Error | InvalidInputError | DnsProvider.Error;\n\nexport interface InteractiveStart {\n  readonly authorizationUrl: URL;\n  readonly payload: Secret.Value;\n}\n\nexport interface Continuation extends BaseInput {\n  readonly expiresAt: Date;\n  readonly id: string;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly payload: Secret.Value;\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nexport interface ContinuationStore {\n  readonly consume: (id: string, now: Date) => Effect.Effect<Continuation | null, Error>;\n  readonly put: (continuation: Continuation) => Effect.Effect<void, Error>;\n}\n\nexport interface InteractiveFlow {\n  readonly complete: (\n    payload: Secret.Value,\n    callbackUrl: URL,\n  ) => Effect.Effect<Authentication, AuthenticationFailure>;\n  readonly method: \"integration\" | \"oauth2\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n  readonly start: (\n    continuationId: string,\n  ) => Effect.Effect<InteractiveStart, AuthenticationFailure, Crypto.Crypto>;\n}\n\nexport type Method = Data.TaggedEnum<{\n  Interactive: {\n    readonly continuations: ContinuationStore;\n    readonly flow: InteractiveFlow;\n    readonly ttlMs?: number;\n  };\n  Token: {\n    readonly authenticate: (\n      token: Secret.Value,\n    ) => Effect.Effect<Authentication, AuthenticationFailure>;\n    readonly providerId: string;\n    readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n    readonly token: Secret.Value;\n  };\n}>;\nexport const Method = Data.taggedEnum<Method>();\n\nexport type StartResult = Data.TaggedEnum<{\n  Connected: { readonly connection: Connection.ProviderConnection };\n  Redirect: { readonly authorizationUrl: URL; readonly continuationId: string };\n}>;\nexport const StartResult = Data.taggedEnum<StartResult>();\n\nexport class Error extends Schema.TaggedError<Error>()(\"ConnectionError\", {\n  category: Schema.Literals([\"authorization\", \"provider\", \"validation\"]),\n  message: Schema.String,\n  operation: Schema.String,\n  retry: Schema.Literals([\"never\", \"after-user-action\", \"safe\", \"unknown\"]),\n}) {}\n\n/** Inputs shared by token and interactive connection flows. */\nexport interface BaseInput {\n  readonly authorizedById: string;\n  /** Existing authorization may be supplied only after the host completed fresh provider proof. */\n  readonly authorizationId?: string;\n  readonly ownerId: string;\n}\n\nexport interface CompleteInput {\n  readonly callbackUrl: URL;\n  readonly continuationId: string;\n  readonly continuations: ContinuationStore;\n  readonly flow: InteractiveFlow;\n}\n\nexport interface ConnectInput extends BaseInput {\n  readonly authentication: Authentication;\n  readonly method: \"integration\" | \"oauth2\" | \"token\";\n  readonly providerId: string;\n  readonly requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>;\n}\n\nconst missingCapability = (\n  authentication: Authentication,\n  requiredCapabilities: ReadonlyArray<ProviderAuthorization.Capability>,\n): ProviderAuthorization.Capability | undefined =>\n  requiredCapabilities.find(\n    (capability) =>\n      !authentication.capabilityEvidence.some((item) => item.capability === capability),\n  );\n\nconst freshId = Effect.fn(\"Connection.freshId\")(function* () {\n  const crypto = yield* Crypto.Crypto;\n  return yield* crypto.randomUUIDv4.pipe(\n    Effect.mapError(\n      (cause) =>\n        new Error({\n          category: \"validation\",\n          message: cause.message,\n          operation: \"Connection.connect\",\n          retry: \"safe\",\n        }),\n    ),\n  );\n});\n\n/** Persist one authenticated provider connection, optionally reusing a proven authorization. */\nexport const connect = Effect.fn(\"Connection.connect\")(function* (input: ConnectInput) {\n  const repository = yield* Repository.Service;\n  const now = new Date(yield* Clock.currentTimeMillis);\n  const missing = missingCapability(input.authentication, input.requiredCapabilities);\n  if (missing !== undefined) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: `Provider authorization lacks evidence for ${missing}`,\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n\n  const existing =\n    input.authorizationId === undefined ? null : yield* repository.get(input.authorizationId);\n  if (input.authorizationId !== undefined && existing === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization does not exist\",\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (existing?.authorization.revocation._tag === \"Pending\") {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider authorization is awaiting revocation recovery\",\n      operation: \"Connection.connect\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    existing !== null &&\n    (existing.authorization.providerId !== input.providerId ||\n      existing.authorization.method !== input.method)\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Provider proof does not match the existing authorization\",\n      operation: \"Connection.connect\",\n      retry: \"never\",\n    });\n  }\n\n  const authorizationId = existing?.authorization.id ?? (yield* freshId());\n  const authorization: ProviderAuthorization.ProviderAuthorization =\n    existing === null\n      ? {\n          authorizedById: input.authorizedById,\n          capabilityEvidence: [...input.authentication.capabilityEvidence],\n          createdAt: now,\n          id: authorizationId,\n          method: input.method,\n          providerContext: input.authentication.providerContext,\n          providerId: input.providerId,\n          requiredCapabilities: [...input.requiredCapabilities],\n          revocation: ProviderAuthorization.Revocation.Active(),\n          scopes: [...input.authentication.scopes],\n        }\n      : {\n          ...existing.authorization,\n          capabilityEvidence: mergeEvidence(\n            existing.authorization.capabilityEvidence,\n            input.authentication.capabilityEvidence,\n          ),\n          method: input.method,\n          providerContext: input.authentication.providerContext,\n          requiredCapabilities: [...input.requiredCapabilities],\n          revocation: ProviderAuthorization.Revocation.Active(),\n          scopes: [...input.authentication.scopes],\n        };\n  const existingConnection = yield* repository.findConnection(input.ownerId, authorizationId);\n  const connection: Connection.StoredConnection = {\n    authorizationId,\n    createdAt: existingConnection?.createdAt ?? now,\n    id: existingConnection?.id ?? (yield* freshId()),\n    method: input.method,\n    ownerId: input.ownerId,\n    providerId: input.providerId,\n  };\n  return yield* repository.connect({\n    authorization,\n    connection,\n    credential: input.authentication.credential,\n    ...(existing === null ? {} : { expectedAuthorizationId: existing.authorization.id }),\n    ...(existingConnection === null ? {} : { expectedConnectionId: existingConnection.id }),\n  });\n});\n\nexport const start = Effect.fn(\"Connection.start\")(function* (\n  input: BaseInput & { readonly method: Method },\n) {\n  if (input.method._tag === \"Interactive\") {\n    const crypto = yield* Crypto.Crypto;\n    const now = yield* Clock.currentTimeMillis;\n    const continuationId = yield* crypto.randomUUIDv4.pipe(\n      Effect.mapError(\n        (cause) =>\n          new Error({\n            category: \"validation\",\n            message: cause.message,\n            operation: \"Connection.start\",\n            retry: \"safe\",\n          }),\n      ),\n    );\n    const started = yield* input.method.flow.start(continuationId);\n    yield* input.method.continuations.put({\n      authorizedById: input.authorizedById,\n      ...(input.authorizationId === undefined ? {} : { authorizationId: input.authorizationId }),\n      expiresAt: new Date(now + (input.method.ttlMs ?? 10 * 60_000)),\n      id: continuationId,\n      method: input.method.flow.method,\n      ownerId: input.ownerId,\n      payload: started.payload,\n      providerId: input.method.flow.providerId,\n      requiredCapabilities: [...input.method.flow.requiredCapabilities],\n    });\n    return StartResult.Redirect({\n      authorizationUrl: started.authorizationUrl,\n      continuationId,\n    });\n  }\n  const authentication = yield* input.method.authenticate(input.method.token);\n  const aggregate = yield* connect({\n    authentication,\n    authorizedById: input.authorizedById,\n    ...(input.authorizationId === undefined ? {} : { authorizationId: input.authorizationId }),\n    method: \"token\",\n    ownerId: input.ownerId,\n    providerId: input.method.providerId,\n    requiredCapabilities: input.method.requiredCapabilities,\n  });\n  const storedConnection = aggregate.connections.find(({ ownerId }) => ownerId === input.ownerId);\n  if (storedConnection === undefined) {\n    return yield* new Error({\n      category: \"validation\",\n      message: \"Connected provider authorization returned no organization connection\",\n      operation: \"Connection.start\",\n      retry: \"safe\",\n    });\n  }\n  return StartResult.Connected({\n    connection: Connection.project(storedConnection, aggregate.authorization, aggregate.credential),\n  });\n});\n\nexport const complete = Effect.fn(\"Connection.complete\")(function* (input: CompleteInput) {\n  const continuation = yield* input.continuations.consume(\n    input.continuationId,\n    new Date(yield* Clock.currentTimeMillis),\n  );\n  if (continuation === null) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation is expired, unknown, or already consumed\",\n      operation: \"Connection.complete\",\n      retry: \"after-user-action\",\n    });\n  }\n  if (\n    continuation.providerId !== input.flow.providerId ||\n    continuation.method !== input.flow.method\n  ) {\n    return yield* new Error({\n      category: \"authorization\",\n      message: \"Connection continuation does not match the provider flow\",\n      operation: \"Connection.complete\",\n      retry: \"never\",\n    });\n  }\n  const authentication = yield* input.flow.complete(continuation.payload, input.callbackUrl);\n  const aggregate = yield* connect({\n    authentication,\n    authorizedById: continuation.authorizedById,\n    ...(continuation.authorizationId === undefined\n      ? {}\n      : { authorizationId: continuation.authorizationId }),\n    method: continuation.method,\n    ownerId: continuation.ownerId,\n    providerId: continuation.providerId,\n    requiredCapabilities: continuation.requiredCapabilities,\n  });\n  const storedConnection = aggregate.connections.find(\n    ({ ownerId }) => ownerId === continuation.ownerId,\n  );\n  if (storedConnection === undefined) {\n    return yield* new Error({\n      category: \"validation\",\n      message: \"Connected provider authorization returned no organization connection\",\n      operation: \"Connection.complete\",\n      retry: \"safe\",\n    });\n  }\n  return Connection.project(storedConnection, aggregate.authorization, aggregate.credential);\n});\n\nfunction mergeEvidence(\n  current: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n  incoming: ReadonlyArray<ProviderAuthorization.CapabilityEvidence>,\n): ReadonlyArray<ProviderAuthorization.CapabilityEvidence> {\n  const byCapability = new Map(current.map((item) => [item.capability, item]));\n  for (const item of incoming) byCapability.set(item.capability, item);\n  return [...byCapability.values()];\n}\n\nexport type Requirements = Repository.Service | Crypto.Crypto;\nexport type Failure = AuthenticationFailure | Repository.Error | CryptoError;\n"],"mappings":";;;AAqEA,MAAa,SAAS,KAAK,WAAmB;AAM9C,MAAa,cAAc,KAAK,WAAwB;AAExD,IAAa,QAAb,cAA2B,OAAO,YAAmB,CAAC,CAAC,mBAAmB;CACxE,UAAU,OAAO,SAAS;EAAC;EAAiB;EAAY;CAAY,CAAC;CACrE,SAAS,OAAO;CAChB,WAAW,OAAO;CAClB,OAAO,OAAO,SAAS;EAAC;EAAS;EAAqB;EAAQ;CAAS,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AAwBJ,MAAM,qBACJ,gBACA,yBAEA,qBAAqB,MAClB,eACC,CAAC,eAAe,mBAAmB,MAAM,SAAS,KAAK,eAAe,UAAU,CACpF;AAEF,MAAM,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,aAAa;CAE3D,OAAO,QAAO,OADQ,OAAO,OAAA,CACR,aAAa,KAChC,OAAO,UACJ,UACC,IAAI,MAAM;EACR,UAAU;EACV,SAAS,MAAM;EACf,WAAW;EACX,OAAO;CACT,CAAC,CACL,CACF;AACF,CAAC;;AAGD,MAAa,UAAU,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,OAAqB;CACrF,MAAM,aAAa,OAAOA;CAC1B,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB;CACnD,MAAM,UAAU,kBAAkB,MAAM,gBAAgB,MAAM,oBAAoB;CAClF,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS,6CAA6C;EACtD,WAAW;EACX,OAAO;CACT,CAAC;CAGH,MAAM,WACJ,MAAM,oBAAoB,KAAA,IAAY,OAAO,OAAO,WAAW,IAAI,MAAM,eAAe;CAC1F,IAAI,MAAM,oBAAoB,KAAA,KAAa,aAAa,MACtD,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IAAI,UAAU,cAAc,WAAW,SAAS,WAC9C,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,SACZ,SAAS,cAAc,eAAe,MAAM,cAC3C,SAAS,cAAc,WAAW,MAAM,SAE1C,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAGH,MAAM,kBAAkB,UAAU,cAAc,OAAO,OAAO,QAAQ;CACtE,MAAM,gBACJ,aAAa,OACT;EACE,gBAAgB,MAAM;EACtB,oBAAoB,CAAC,GAAG,MAAM,eAAe,kBAAkB;EAC/D,WAAW;EACX,IAAI;EACJ,QAAQ,MAAM;EACd,iBAAiB,MAAM,eAAe;EACtC,YAAY,MAAM;EAClB,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;EACpD,YAAA,WAA6C,OAAO;EACpD,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;CACzC,IACA;EACE,GAAG,SAAS;EACZ,oBAAoB,cAClB,SAAS,cAAc,oBACvB,MAAM,eAAe,kBACvB;EACA,QAAQ,MAAM;EACd,iBAAiB,MAAM,eAAe;EACtC,sBAAsB,CAAC,GAAG,MAAM,oBAAoB;EACpD,YAAA,WAA6C,OAAO;EACpD,QAAQ,CAAC,GAAG,MAAM,eAAe,MAAM;CACzC;CACN,MAAM,qBAAqB,OAAO,WAAW,eAAe,MAAM,SAAS,eAAe;CAC1F,MAAM,aAA0C;EAC9C;EACA,WAAW,oBAAoB,aAAa;EAC5C,IAAI,oBAAoB,OAAO,OAAO,QAAQ;EAC9C,QAAQ,MAAM;EACd,SAAS,MAAM;EACf,YAAY,MAAM;CACpB;CACA,OAAO,OAAO,WAAW,QAAQ;EAC/B;EACA;EACA,YAAY,MAAM,eAAe;EACjC,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,yBAAyB,SAAS,cAAc,GAAG;EAClF,GAAI,uBAAuB,OAAO,CAAC,IAAI,EAAE,sBAAsB,mBAAmB,GAAG;CACvF,CAAC;AACH,CAAC;AAED,MAAa,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WACjD,OACA;CACA,IAAI,MAAM,OAAO,SAAS,eAAe;EACvC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,MAAM,OAAO,MAAM;EACzB,MAAM,iBAAiB,OAAO,OAAO,aAAa,KAChD,OAAO,UACJ,UACC,IAAI,MAAM;GACR,UAAU;GACV,SAAS,MAAM;GACf,WAAW;GACX,OAAO;EACT,CAAC,CACL,CACF;EACA,MAAM,UAAU,OAAO,MAAM,OAAO,KAAK,MAAM,cAAc;EAC7D,OAAO,MAAM,OAAO,cAAc,IAAI;GACpC,gBAAgB,MAAM;GACtB,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;GACxF,WAAW,IAAI,KAAK,OAAO,MAAM,OAAO,SAAS,IAAY;GAC7D,IAAI;GACJ,QAAQ,MAAM,OAAO,KAAK;GAC1B,SAAS,MAAM;GACf,SAAS,QAAQ;GACjB,YAAY,MAAM,OAAO,KAAK;GAC9B,sBAAsB,CAAC,GAAG,MAAM,OAAO,KAAK,oBAAoB;EAClE,CAAC;EACD,OAAO,YAAY,SAAS;GAC1B,kBAAkB,QAAQ;GAC1B;EACF,CAAC;CACH;CACA,MAAM,iBAAiB,OAAO,MAAM,OAAO,aAAa,MAAM,OAAO,KAAK;CAC1E,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,MAAM;EACtB,GAAI,MAAM,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;EACxF,QAAQ;EACR,SAAS,MAAM;EACf,YAAY,MAAM,OAAO;EACzB,sBAAsB,MAAM,OAAO;CACrC,CAAC;CACD,MAAM,mBAAmB,UAAU,YAAY,MAAM,EAAE,cAAc,YAAY,MAAM,OAAO;CAC9F,IAAI,qBAAqB,KAAA,GACvB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAO,YAAY,UAAU,EAC3B,YAAYC,QAAmB,kBAAkB,UAAU,eAAe,UAAU,UAAU,EAChG,CAAC;AACH,CAAC;AAED,MAAa,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAsB;CACxF,MAAM,eAAe,OAAO,MAAM,cAAc,QAC9C,MAAM,gBACN,IAAI,KAAK,OAAO,MAAM,iBAAiB,CACzC;CACA,IAAI,iBAAiB,MACnB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,IACE,aAAa,eAAe,MAAM,KAAK,cACvC,aAAa,WAAW,MAAM,KAAK,QAEnC,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,MAAM,iBAAiB,OAAO,MAAM,KAAK,SAAS,aAAa,SAAS,MAAM,WAAW;CACzF,MAAM,YAAY,OAAO,QAAQ;EAC/B;EACA,gBAAgB,aAAa;EAC7B,GAAI,aAAa,oBAAoB,KAAA,IACjC,CAAC,IACD,EAAE,iBAAiB,aAAa,gBAAgB;EACpD,QAAQ,aAAa;EACrB,SAAS,aAAa;EACtB,YAAY,aAAa;EACzB,sBAAsB,aAAa;CACrC,CAAC;CACD,MAAM,mBAAmB,UAAU,YAAY,MAC5C,EAAE,cAAc,YAAY,aAAa,OAC5C;CACA,IAAI,qBAAqB,KAAA,GACvB,OAAO,OAAO,IAAI,MAAM;EACtB,UAAU;EACV,SAAS;EACT,WAAW;EACX,OAAO;CACT,CAAC;CAEH,OAAOA,QAAmB,kBAAkB,UAAU,eAAe,UAAU,UAAU;AAC3F,CAAC;AAED,SAAS,cACP,SACA,UACyD;CACzD,MAAM,eAAe,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;CAC3E,KAAK,MAAM,QAAQ,UAAU,aAAa,IAAI,KAAK,YAAY,IAAI;CACnE,OAAO,CAAC,GAAG,aAAa,OAAO,CAAC;AAClC"}

package/dist/connection-Dp6ZdSo8.d.mts

@@ -1,186 +0,0 @@
-import { A as ConnectionStatus, C as ConnectInput, D as Interface, E as Error, F as StoredConnection, H as Capability, I as StoredCredential, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, S as AttachmentResult, T as DisconnectResult, U as CapabilityEvidence, V as validate, W as ProviderAuthorization, a as Continuation, b as Aggregate, c as Failure, d as Method$1, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow$1, n as AuthenticationFailure, nt as Value, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-D-X8T9W8.mjs";
-import { Data, Layer } from "effect";
-declare namespace managed_dns_connections_d_exports {
-  export { AsyncInterface, AttachmentResult, DetachResult, DisconnectResult, Error, from, layerFromAsync, toAsync };
-}
-interface AsyncInterface {
-  readonly attach: (input: {
-    readonly attachment: DomainAttachment;
-    readonly connectionId: string;
-    readonly ownerId: string;
-  }) => Promise<AttachmentResult>;
-  readonly connect: (input: ConnectInput) => Promise<Aggregate>;
-  readonly detach: (input: {
-    readonly attachmentId: string;
-    readonly ownerId: string;
-  }) => Promise<DetachResult>;
-  readonly disconnect: (input: {
-    readonly connectionId: string;
-    readonly ownerId: string;
-    readonly revoke: (authorization: ProviderAuthorization) => Promise<void>;
-  }) => Promise<DisconnectResult>;
-  readonly findConnection: (ownerId: string, authorizationId: string) => Promise<StoredConnection | null>;
-  readonly get: (authorizationId: string) => Promise<Aggregate | null>;
-  readonly getAttachment: (attachmentId: string) => Promise<DomainAttachment | null>;
-  readonly getByConnectionId: (connectionId: string) => Promise<Aggregate | null>;
-  readonly listAttachments: (connectionId: string, ownerId: string) => Promise<ReadonlyArray<DomainAttachment>>;
-  readonly promoteEvidence: (authorizationId: string, evidence: ReadonlyArray<CapabilityEvidence>) => Promise<Aggregate>;
-  readonly recover: (input: {
-    readonly authorizationId: string;
-    readonly revoke: (authorization: ProviderAuthorization) => Promise<void>;
-  }) => Promise<DisconnectResult>;
-  readonly rotate: (authorizationId: string, credential: StoredCredential) => Promise<Aggregate>;
-}
-declare const layerFromAsync: (repository: AsyncInterface) => Layer.Layer<Service>;
-declare const toAsync: (service: Interface) => AsyncInterface;
-declare const from: (repository: AsyncInterface) => AsyncInterface;
-declare namespace connection_d_exports {
-  export { Authentication, AuthenticationFailure, AuthorizationError, BaseInput, CompleteInput, ConnectionStatus, Continuation, ContinuationStore, DomainAttachment, Error$1 as Error, Failure, InteractiveFlow, InteractiveStart, Method, ProviderConnection, ProviderTarget, ProviderTargetEvidence, StartResult, attach, authorizationError, complete, decode, detach, disconnect, encode, fromEffectFlow, fromEffectTokenMethod, start, validate };
-}
-declare function decode(input: unknown): Promise<ProviderConnection>;
-type Method = Data.TaggedEnum<{
-  Interactive: {
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  };
-  Token: {
-    readonly authenticate: (token: Value) => Promise<Authentication>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  };
-}>;
-declare const Method: {
-  readonly $is: <Tag extends "Interactive" | "Token">(tag: Tag) => (u: unknown) => u is Extract<{
-    readonly _tag: "Interactive";
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  }, {
-    readonly _tag: Tag;
-  }> | Extract<{
-    readonly _tag: "Token";
-    readonly authenticate: (token: Value) => Promise<Authentication>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  }, {
-    readonly _tag: Tag;
-  }>;
-  readonly $match: {
-    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Promise<Authentication>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(cases: Cases): (value: {
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Promise<Authentication>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }) => import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
-    <Cases extends { readonly [Tag in "Interactive" | "Token"]: (args: Extract<{
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Promise<Authentication>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, {
-      readonly _tag: Tag;
-    }>) => any; }>(value: {
-      readonly _tag: "Interactive";
-      readonly continuations: ContinuationStore;
-      readonly flow: InteractiveFlow;
-      readonly ttlMs?: number;
-    } | {
-      readonly _tag: "Token";
-      readonly authenticate: (token: Value) => Promise<Authentication>;
-      readonly providerId: string;
-      readonly requiredCapabilities: ReadonlyArray<Capability>;
-      readonly token: Value;
-    }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Interactive" | "Token"]>>;
-  };
-  readonly Interactive: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Interactive";
-    readonly continuations: ContinuationStore;
-    readonly flow: InteractiveFlow;
-    readonly ttlMs?: number;
-  }, "_tag">;
-  readonly Token: Data.TaggedEnum.ConstructorFrom<{
-    readonly _tag: "Token";
-    readonly authenticate: (token: Value) => Promise<Authentication>;
-    readonly providerId: string;
-    readonly requiredCapabilities: ReadonlyArray<Capability>;
-    readonly token: Value;
-  }, "_tag">;
-};
-interface ContinuationStore {
-  readonly consume: (id: string, now: Date) => Promise<Continuation | null>;
-  readonly put: (continuation: Continuation) => Promise<void>;
-}
-interface InteractiveFlow {
-  readonly complete: (payload: Value, callbackUrl: URL) => Promise<Authentication>;
-  readonly method: "integration" | "oauth2";
-  readonly providerId: string;
-  readonly requiredCapabilities: ReadonlyArray<Capability>;
-  readonly start: (continuationId: string) => Promise<InteractiveStart>;
-}
-/** Adapts an Effect-native provider flow to the Promise facade. */
-declare const fromEffectFlow: (flow: InteractiveFlow$1) => InteractiveFlow;
-/** Adapts an Effect-native token method to the Promise facade. */
-declare function fromEffectTokenMethod(method: Extract<Method$1, {
-  readonly _tag: "Token";
-}>): Extract<Method, {
-  readonly _tag: "Token";
-}>;
-declare function start(input: BaseInput & {
-  readonly method: Method;
-  readonly repository: AsyncInterface;
-}): Promise<StartResult>;
-declare function complete(input: {
-  readonly callbackUrl: URL;
-  readonly continuationId: string;
-  readonly continuations: ContinuationStore;
-  readonly flow: InteractiveFlow;
-  readonly repository: AsyncInterface;
-}): Promise<ProviderConnection>;
-declare function attach(input: {
-  readonly attachment: DomainAttachment;
-  readonly connectionId: string;
-  readonly ownerId: string;
-  readonly repository: AsyncInterface;
-}): Promise<AttachmentResult>;
-declare function detach(input: {
-  readonly attachmentId: string;
-  readonly ownerId: string;
-  readonly repository: AsyncInterface;
-}): Promise<DetachResult>;
-declare function disconnect(input: {
-  readonly connectionId: string;
-  readonly ownerId: string;
-  readonly repository: AsyncInterface;
-  readonly revoke: (authorization: ProviderAuthorization) => Promise<void>;
-}): Promise<DisconnectResult>;
-//#endregion
-export { managed_dns_connections_d_exports as a, AsyncInterface as i, Method as n, connection_d_exports as r, InteractiveFlow as t };
-//# sourceMappingURL=connection-Dp6ZdSo8.d.mts.map

package/dist/connection-api-lqG1nBtD.d.mts

@@ -1,26 +0,0 @@
-import { A as ConnectionStatus, B as project, E as Error, L as authorizationError, M as ProviderConnection, N as ProviderTarget, O as Service, P as ProviderTargetEvidence, R as decode, S as AttachmentResult, T as DisconnectResult, V as validate, W as ProviderAuthorization, a as Continuation, c as Failure, d as Method, f as StartResult, i as CompleteInput, j as DomainAttachment, k as AuthorizationError, l as InteractiveFlow, m as start, n as AuthenticationFailure, o as ContinuationStore, p as complete, r as BaseInput, s as Error$1, t as Authentication, u as InteractiveStart, w as DetachResult, z as encode } from "./connect-D-X8T9W8.mjs";
-import { Effect } from "effect";
-//#region src/auth/connection-lifecycle.d.ts
-/** Attach one exact provider target to one organization domain. */
-declare const attach: (input: {
-  readonly attachment: DomainAttachment;
-  readonly connectionId: string;
-  readonly ownerId: string;
-}) => Effect.Effect<AttachmentResult, Error, Service>;
-/** Remove one domain attachment while retaining the organization connection. */
-declare const detach: (input: {
-  readonly attachmentId: string;
-  readonly ownerId: string;
-}) => Effect.Effect<DetachResult, Error, Service>;
-/** Disconnect one organization connection, revoking the shared authorization only when final. */
-declare function disconnect<E>(input: {
-  readonly connectionId: string;
-  readonly ownerId: string;
-  readonly revokeAuthorization: (authorization: ProviderAuthorization) => Effect.Effect<void, E>;
-}): Effect.Effect<DisconnectResult, Error | E, Service>;
-declare namespace connection_api_d_exports {
-  export { AttachmentResult, Authentication, AuthenticationFailure, AuthorizationError, BaseInput, CompleteInput, Method as ConnectionMethod, StartResult as ConnectionStartResult, ConnectionStatus, Continuation, ContinuationStore, DetachResult, DisconnectResult, DomainAttachment, Error$1 as Error, Failure, InteractiveFlow, InteractiveStart, Method, ProviderConnection, ProviderTarget, ProviderTargetEvidence, StartResult, attach, authorizationError, complete, decode, detach, disconnect, encode, project, start, validate };
-}
-//#endregion
-export { connection_api_d_exports as t };
-//# sourceMappingURL=connection-api-lqG1nBtD.d.mts.map