domainkit 0.9.1 → 0.11.0

package/dist/types/Provider.d.ts

@@ -170,6 +170,10 @@ export interface MethodDescriptor {
 }
 /** Field descriptors derived from `TokenAuth.fields`: optional keys are not required, `Redacted` values are secret. */
 export declare const tokenFields: (auth: TokenAuth) => ReadonlyArray<FieldDescriptor>;
+/**
+ * Every method a provider offers, in the order a UI should present them: the interactive ones a
+ * customer clicks through first, then the token they have to go and fetch themselves.
+ */
 export declare const describeMethods: (definition: Definition) => ReadonlyArray<MethodDescriptor>;
 export interface CallbackInput {
     readonly code: string;
@@ -210,6 +214,12 @@ export interface IntegrationAuth {
 export interface Definition<Context = unknown> {
     readonly id: string;
     readonly name: string;
+    /**
+     * Hostname suffixes of the nameservers this provider operates, e.g. `ns.cloudflare.com`.
+     * `Connect.discover` names the provider as a domain's host when every authoritative nameserver
+     * ends in one of them.
+     */
+    readonly nameservers?: ReadonlyArray<string>;
     readonly auth: {
         readonly token?: TokenAuth;
         readonly oauth?: OAuthAuth;
@@ -234,6 +244,7 @@ export declare const encodeContext: <Context>(definition: Definition<Context>, v
 export type AuthMethod = "token" | "oauth" | "integration";
 /** Validates a definition: an id and at least one auth method. Throws `DomainKit.Error` otherwise. */
 export declare const make: <Context>(definition: Definition<Context>) => Definition<Context>;
+/** The kinds alone, in the same order `describeMethods` puts them: interactive first, token last. */
 export declare const methods: (definition: Definition) => ReadonlyArray<AuthMethod>;
 /**
  * Pick the most specific zone among `targets` for `domain`: exactly one match resolves, several

package/dist/types/Server.d.ts

@@ -74,6 +74,8 @@ export declare const Snapshot: Schema.Struct<{
     readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
     readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
     readonly lastReceiptId: Schema.NullOr<Schema.String>;
+    /** How many domains the connection serves, including this one; `0` without a connection. */
+    readonly connectionDomains: Schema.Number;
     readonly reusable: Schema.$Array<Schema.Struct<{
         readonly connectionId: Schema.String;
         readonly provider: Schema.String;
@@ -139,6 +141,8 @@ declare const Connected_base: Schema.Class<Connected, Schema.TaggedStruct<"Conne
         readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
         readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
         readonly lastReceiptId: Schema.NullOr<Schema.String>;
+        /** How many domains the connection serves, including this one; `0` without a connection. */
+        readonly connectionDomains: Schema.Number;
         readonly reusable: Schema.$Array<Schema.Struct<{
             readonly connectionId: Schema.String;
             readonly provider: Schema.String;
@@ -198,7 +202,11 @@ export declare class DiscoverySelectionRequired extends DiscoverySelectionRequir
 }
 declare const DiscoveryNotFound_base: Schema.Class<DiscoveryNotFound, Schema.TaggedStruct<"NotFound", {
     readonly nameservers: Schema.$Array<Schema.String>;
+    readonly host: Schema.NullOr<Schema.Struct<{
+        readonly provider: Schema.String;
+    }>>;
 }>, {}>;
+/** `host` names the registered provider whose nameservers serve the domain, by definition id. */
 export declare class DiscoveryNotFound extends DiscoveryNotFound_base {
 }
 export declare const Discovery: Schema.Union<readonly [typeof DiscoveryResolved, typeof DiscoverySelectionRequired, typeof DiscoveryNotFound]>;
@@ -3971,6 +3979,8 @@ export declare const group: HttpApiGroup.HttpApiGroup<"domainkit", HttpApiEndpoi
     readonly method: Schema.NullOr<Schema.Literals<readonly ["token", "oauth", "integration"]>>;
     readonly status: Schema.Literals<readonly ["disconnected", "connected", "reconnect"]>;
     readonly lastReceiptId: Schema.NullOr<Schema.String>;
+    /** How many domains the connection serves, including this one; `0` without a connection. */
+    readonly connectionDomains: Schema.Number;
     readonly reusable: Schema.$Array<Schema.Struct<{
         readonly connectionId: Schema.String;
         readonly provider: Schema.String;

package/dist/types/Testing.d.ts

@@ -16,6 +16,8 @@ export declare const storage: Layer.Layer<Storage.Service>;
 export declare const principal: Principal.Interface;
 export interface FakeProviderOptions {
     readonly id?: string;
+    /** The name a customer reads. Default `Fake <id>`; a fixture that ships screenshots sets it. */
+    readonly name?: string;
     /** Zones the fake credential can reach. Default: `example.com`. */
     readonly zones?: ReadonlyArray<string>;
     /** Pre-existing records, to produce `Noop` and `Conflict` operations. */
@@ -29,6 +31,8 @@ export interface FakeProviderOptions {
     readonly failWrite?: (index: number) => boolean;
     /** Nameservers per zone; default `ns1.<zone>`, `ns2.<zone>`. `resolver()` answers NS queries from them. */
     readonly nameservers?: Readonly<Record<string, ReadonlyArray<string>>>;
+    /** Suffixes the fake declares as `Definition.nameservers`, so `Connect.discover` can name it as a host. */
+    readonly nameserverSuffixes?: ReadonlyArray<string>;
 }
 export interface FakeProvider extends Provider.Definition<FakeContext> {
     readonly records: (zone: string) => ReadonlyArray<DnsRecord.Observed>;
@@ -47,18 +51,23 @@ type FakeContext = typeof Context.Type;
 export declare const provider: (options?: FakeProviderOptions) => FakeProvider;
 /** Records every fake provider currently holds for `name`, across all fake zones. */
 export declare const fakeRecords: (name: string) => ReadonlyArray<DnsRecord.Observed>;
+export interface FakeResolverOptions {
+    /** The name every answer carries. A UI reads it as the observer. Default `fake`. */
+    readonly id?: string;
+}
 /**
- * A resolver answering from the fake providers' zones, or from an explicit table. Every answer
- * is attributed to the resolver named `fake`.
+ * A resolver answering from the fake providers' zones, or from an explicit table. Every answer is
+ * attributed to `options.id`, which a fixture that ships screenshots names after a real resolver.
  */
 export declare const resolver: (answers?: ReadonlyArray<{
     readonly name: string;
     readonly records: ReadonlyArray<DnsRecord.Observed>;
-}>) => Layer.Layer<Resolver.Service>;
+}>, options?: FakeResolverOptions) => Layer.Layer<Resolver.Service>;
 export interface TransportOptions {
     /** Which groups the fake server exposes, so a UI can be tested against a partial host. */
     readonly capabilities?: ReadonlyArray<Transport.Capability>;
     readonly provider?: FakeProviderOptions;
+    readonly resolver?: FakeResolverOptions;
 }
 export interface RecordedCall {
     /** `connection.inspect`, `provisioning.approve`, ... */
@@ -79,6 +88,6 @@ export type { Case as StorageCase } from "./internal/conformance/storage.ts";
 export declare const conformance: {
     /** Runs every Storage invariant (tenant isolation, leases, exactly-once continuations, revocation recovery). */
     storage: typeof storageCases;
-    /** Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply against a real provider definition. */
+    /** Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and rejected-token against a real provider definition. */
     provider: typeof providerCases;
 };

package/dist/types/Vercel.d.ts

@@ -1,6 +1,6 @@
 /** Vercel: personal tokens and marketplace integrations. */
 import { type Config, Redacted, Schema } from "effect";
-import type { Fetch } from "./internal/http.ts";
+import { type Fetch } from "./internal/http.ts";
 import * as Provider from "./Provider.ts";
 /** `teamId` is `null` for a personal account; targets carry the team that owns the zone. */
 export declare const TeamContext: Schema.Struct<{

package/dist/types/internal/cloudflare/client.d.ts

@@ -12,8 +12,10 @@ export interface Options {
 type Fx<A> = Effect.Effect<A, Errors.DomainKitError>;
 /** Every zone the credential can see, across accounts; internal zones cannot host records. */
 export declare const listZones: (options: Options, accountId?: string) => Fx<ReadonlyArray<Protocol.Zone>>;
-/** Token expiry from the verify endpoint; `null` when the token never expires or verification is unavailable. */
-/** Token status and expiry from a verify endpoint; an inactive token is `Unauthenticated`. */
+/**
+ * Token status and expiry from a verify endpoint; `null` expiry means the token never expires. An
+ * inactive token, or a 403 from the verify endpoint, is `Unauthenticated`.
+ */
 export declare const verifyToken: (options: Options, path: string) => Fx<DateTime.Utc | null>;
 export declare const tokenExpiry: (options: Options, accountId: string | null) => Fx<{
     readonly expiresAt: DateTime.Utc | null;

package/dist/types/internal/conformance/provider.d.ts

@@ -1,12 +1,19 @@
 import { Effect } from "effect";
 import * as Errors from "../error.ts";
 import * as Provider from "../../Provider.ts";
-export declare const cases: readonly ["create-readback-cleanup", "exact-noop", "conflict", "stale-plan", "partial-apply-cleanup"];
+export declare const cases: readonly ["create-readback-cleanup", "exact-noop", "conflict", "stale-plan", "partial-apply-cleanup", "rejected-token"];
 export type Case = (typeof cases)[number];
 /**
- * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, and partial-apply against a
- * real provider definition, through the same Provision and Cleanup services hosts use.
+ * Runs create/readback/cleanup, exact-noop, conflict, stale-plan, partial-apply, and
+ * rejected-token against a real provider definition, through the same Provision and Cleanup
+ * services hosts use.
  */
 export declare const provider: (definition: Provider.Definition, credential: Provider.Credential, zone: string, options?: {
     readonly prefix?: string;
+    /**
+     * Token values the provider rejects, for the `rejected-token` case. Default: every required
+     * field set to an empty secret, which needs a token method whose required fields are all
+     * secrets.
+     */
+    readonly rejectedToken?: Provider.TokenValues;
 }) => Effect.Effect<void, Errors.DomainKitError>;

package/dist/types/internal/http.d.ts

@@ -23,5 +23,10 @@ export declare const headersFrom: (source: HeadersInit | (() => HeadersInit | Pr
  * conflict code -> ProviderConflict, 429/5xx -> ProviderUnavailable, else ProviderRejected.
  */
 export declare const classify: (provider: string, status: number, headers: Headers, message: string, code?: string) => Reason.Model;
+/**
+ * During token verification a `Forbidden` answer means the provider did not accept the token, so
+ * it reads as `Unauthenticated` with the provider's own message.
+ */
+export declare const rejectedToken: <A, R>(verification: Effect.Effect<A, Errors.DomainKitError, R>) => Effect.Effect<A, Errors.DomainKitError, R>;
 export declare const rejected: (provider: string, message: string, code?: string) => Errors.DomainKitError;
 export declare const bearer: (token: string, init?: RequestInit) => RequestInit;

package/dist/types/internal/oauth.d.ts

@@ -41,6 +41,8 @@ export declare const exchangeCode: (input: {
     readonly callbackUrl: string;
     readonly codeVerifier: string;
     readonly fetch?: Fetch;
+    /** Permit an `http:` endpoint that is not loopback. Development only; see `insecureAllowed`. */
+    readonly allowPlaintext?: boolean;
 }) => Effect.Effect<Tokens, Errors.DomainKitError>;
 export declare const refresh: (input: {
     readonly provider: string;
@@ -48,6 +50,7 @@ export declare const refresh: (input: {
     readonly client: Client;
     readonly refreshToken: string;
     readonly fetch?: Fetch;
+    readonly allowPlaintext?: boolean;
 }) => Effect.Effect<Tokens, Errors.DomainKitError>;
 export declare const revoke: (input: {
     readonly provider: string;
@@ -55,4 +58,5 @@ export declare const revoke: (input: {
     readonly client: Client;
     readonly token: string;
     readonly fetch?: Fetch;
+    readonly allowPlaintext?: boolean;
 }) => Effect.Effect<void, Errors.DomainKitError>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domainkit",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Build reviewable DNS plans for custom domains in TypeScript",
   "keywords": [
     "custom-domains",