domainkit 0.9.0 → 0.10.0

package/dist/types/internal/cloudflare/client.d.ts

@@ -12,8 +12,10 @@ export interface Options {
 type Fx<A> = Effect.Effect<A, Errors.DomainKitError>;
 /** Every zone the credential can see, across accounts; internal zones cannot host records. */
 export declare const listZones: (options: Options, accountId?: string) => Fx<ReadonlyArray<Protocol.Zone>>;
-/** Token expiry from the verify endpoint; `null` when the token never expires or verification is unavailable. */
-/** Token status and expiry from a verify endpoint; an inactive token is `Unauthenticated`. */
+/**
+ * Token status and expiry from a verify endpoint; `null` expiry means the token never expires. An
+ * inactive token, or a 403 from the verify endpoint, is `Unauthenticated`.
+ */
 export declare const verifyToken: (options: Options, path: string) => Fx<DateTime.Utc | null>;
 export declare const tokenExpiry: (options: Options, accountId: string | null) => Fx<{
     readonly expiresAt: DateTime.Utc | null;

package/dist/types/internal/conformance/provider.d.ts

@@ -1,12 +1,19 @@
 import { Effect } from "effect";
 import * as Errors from "../error.ts";
 import * as Provider from "../../Provider.ts";
-export declare const cases: readonly ["create-readback-cleanup", "exact-noop", "conflict", "stale-plan", "partial-apply-cleanup"];
+export declare const cases: readonly ["create-readback-cleanup", "exact-noop", "conflict", "stale-plan", "partial-apply-cleanup", "rejected-token"];
 export type Case = (typeof cases)[number];
 /**
- * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, and partial-apply against a
- * real provider definition, through the same Provision and Cleanup services hosts use.
+ * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and
+ * rejected-token against a real provider definition, through the same Provision and Cleanup
+ * services hosts use.
  */
 export declare const provider: (definition: Provider.Definition, credential: Provider.Credential, zone: string, options?: {
     readonly prefix?: string;
+    /**
+     * Token values the provider rejects, for the `rejected-token` case. Default: every required
+     * field set to an empty secret, which needs a token method whose required fields are all
+     * secrets.
+     */
+    readonly rejectedToken?: Provider.TokenValues;
 }) => Effect.Effect<void, Errors.DomainKitError>;

package/dist/types/internal/http.d.ts

@@ -23,5 +23,10 @@ export declare const headersFrom: (source: HeadersInit | (() => HeadersInit | Pr
  * conflict code -> ProviderConflict, 429/5xx -> ProviderUnavailable, else ProviderRejected.
  */
 export declare const classify: (provider: string, status: number, headers: Headers, message: string, code?: string) => Reason.Model;
+/**
+ * During token verification a `Forbidden` answer means the provider did not accept the token, so
+ * it reads as `Unauthenticated` with the provider's own message.
+ */
+export declare const rejectedToken: <A, R>(verification: Effect.Effect<A, Errors.DomainKitError, R>) => Effect.Effect<A, Errors.DomainKitError, R>;
 export declare const rejected: (provider: string, message: string, code?: string) => Errors.DomainKitError;
 export declare const bearer: (token: string, init?: RequestInit) => RequestInit;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domainkit",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Build reviewable DNS plans for custom domains in TypeScript",
   "keywords": [
     "custom-domains",