@deslop/auth 0.1.1241 → 0.1.1243

package/dist/server.js

@@ -7720,6 +7720,61 @@ const containsWith = (isEquivalent) => dual(2, (self, a) => {
 * @since 2.0.0
 */
 const contains = /*#__PURE__*/ containsWith(/*#__PURE__*/ asEquivalence());
+const hashBucketsAdd = (buckets, value) => {
+	const hash$6 = hash(value);
+	const bucket = buckets.get(hash$6);
+	if (bucket === void 0) {
+		buckets.set(hash$6, [value]);
+		return true;
+	}
+	for (const previous of bucket) if (equals$1(previous, value)) return false;
+	bucket.push(value);
+	return true;
+};
+const makeHashBuckets = (values) => {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const value of values) hashBucketsAdd(buckets, value);
+	return buckets;
+};
+const hashBucketsHas = (buckets, value) => {
+	const bucket = buckets.get(hash(value));
+	if (bucket === void 0) return false;
+	for (const candidate of bucket) if (equals$1(candidate, value)) return true;
+	return false;
+};
+/**
+* Computes elements in the first array that are not in the second, using
+* `Equal.asEquivalence()`.
+*
+* **When to use**
+*
+* Use when you need to keep values from the first array that are absent from
+* the second and the default `Equal.asEquivalence()` comparison is appropriate.
+*
+* **Example** (Computing array differences)
+*
+* ```ts import.meta.vitest
+* import { Array } from "effect"
+*
+* Array.difference([1, 2, 3], [2, 3, 4]) // => [1]
+* ```
+*
+* @see {@link differenceWith} — use custom equality
+* @see {@link union} — elements in either array
+* @see {@link intersection} — elements in both arrays
+*
+* @stability stable
+* @category set operations
+* @since 2.0.0
+*/
+const difference = /*#__PURE__*/ dual(2, (self, that) => {
+	const thatArray = fromIterable$3(that);
+	const selfArray = fromIterable$3(self);
+	if (selfArray.length === 0) return [];
+	if (thatArray.length === 0) return selfArray.filter(() => true);
+	const buckets = makeHashBuckets(thatArray);
+	return selfArray.filter((value) => !hashBucketsHas(buckets, value));
+});
 /**
 * Creates an empty array.
 *
@@ -21863,6 +21918,48 @@ const formatIp = (self) => {
 	return `${segments.slice(0, bestStart).map((segment) => segment.toString(16)).join(":")}::${segments.slice(bestStart + bestLength).map((segment) => segment.toString(16)).join(":")}`;
 };
 /**
+* Returns `true` for IPv4 `127.0.0.0/8` or IPv6 `::1`.
+*
+* @stability unstable
+* @category predicates
+* @since 4.0.0
+*/
+const isLoopback = (self) => {
+	if (isIpv4Address(self)) return ipv4Value(self) >>> 24 === 127;
+	const { w0, w1, w2, w3 } = ipv6Words(self);
+	return w0 === 0 && w1 === 0 && w2 === 0 && w3 === 1;
+};
+/**
+* Returns `true` for IPv4 `169.254.0.0/16` or IPv6 `fe80::/10`.
+*
+* @stability unstable
+* @category predicates
+* @since 4.0.0
+*/
+const isLinkLocal = (self) => {
+	if (isIpv4Address(self)) return ipv4Value(self) >>> 16 === 43518;
+	return (ipv6Words(self).w0 >>> 16 & 65472) === 65152;
+};
+/**
+* Returns `true` for IPv4 private-use ranges defined by RFC 1918.
+*
+* @stability unstable
+* @category predicates
+* @since 4.0.0
+*/
+const isPrivate$1 = (self) => {
+	const value = ipv4Value(self);
+	return value >>> 24 === 10 || (value >>> 16 & 65520) === 44048 || value >>> 16 === 49320;
+};
+/**
+* Returns `true` for IPv6 unique-local addresses in `fc00::/7`.
+*
+* @stability unstable
+* @category predicates
+* @since 4.0.0
+*/
+const isUniqueLocal = (self) => (ipv6Words(self).w0 >>> 24 & 254) === 252;
+/**
 * Returns `true` when an IPv6 address is in the `::ffff:0:0/96` mapped range.
 *
 * @stability unstable
@@ -21873,6 +21970,14 @@ const isIpv4Mapped = (self) => {
 	const { w0, w1, w2 } = ipv6Words(self);
 	return w0 === 0 && w1 === 0 && w2 === 65535;
 };
+/**
+* Extracts the IPv4 value from an IPv4-mapped IPv6 address.
+*
+* @stability unstable
+* @category converting
+* @since 4.0.0
+*/
+const fromIpv4Mapped = (self) => isIpv4Mapped(self) ? some$1(makeIpv4(ipv6Words(self).w3)) : none();
 const InetV4Proto = {
 	...BaseProto,
 	_tag: "InetAddressV4",
@@ -71223,70 +71328,6 @@ const makeMemoryStore = /*#__PURE__*/ gen(function* () {
 * @since 4.0.0
 */
 const layerStoreMemory = /*#__PURE__*/ effect(RateLimiterStore)(/*#__PURE__*/ map$5(makeMemoryStore, (memory) => memory.store));
-// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/rpc/RpcMiddleware.js
-/**
-* Middleware services for the unstable RPC runtime.
-*
-* A middleware service wraps server handler execution and can also install a
-* client-side wrapper for generated clients. Its metadata records the services
-* provided to downstream handlers, the services required by the middleware
-* implementation, the schema for server-visible failures, the client-only error
-* type, and whether generated clients must require the matching client layer.
-*
-* @stability unstable
-* @since 4.0.0
-*/
-/**
-* The runtime type id used to attach and inspect RPC middleware metadata.
-*
-* @stability unstable
-* @category type IDs
-* @since 4.0.0
-*/
-const TypeId$8 = "~effect/rpc/RpcMiddleware";
-/**
-* Creates a typed RPC middleware service class, with optional service
-* requirements, provided services, error schema, and client-side requirement
-* metadata.
-*
-* @stability unstable
-* @category constructors
-* @since 4.0.0
-*/
-const Service = () => (id, options) => {
-	const limit = getStackTraceLimit();
-	let creationError;
-	if (limit !== 0) {
-		setStackTraceLimit(2);
-		creationError = new globalThis.Error();
-		setStackTraceLimit(limit);
-	}
-	function ServiceClass() {}
-	const ServiceClass_ = ServiceClass;
-	Object.setPrototypeOf(ServiceClass, Object.getPrototypeOf(Service$1(id)));
-	ServiceClass.key = id;
-	Object.defineProperty(ServiceClass, "stack", { get() {
-		return creationError?.stack;
-	} });
-	ServiceClass_[TypeId$8] = TypeId$8;
-	ServiceClass_.error = options?.error ?? Never;
-	ServiceClass_.requiredForClient = options?.requiredForClient ?? false;
-	return ServiceClass;
-};
-/**
-* Provides the client-side implementation for an RPC middleware service,
-* capturing the layer's environment and merging it into each middleware
-* invocation.
-*
-* @stability unstable
-* @category layers
-* @since 4.0.0
-*/
-const layerClient = (tag, service) => effectContext(gen(function* () {
-	const services = (yield* context()).pipe(omit$2(Scope));
-	const middleware = isEffect(service) ? yield* service : service;
-	return makeUnsafe$10(/* @__PURE__ */ new Map([[`${tag.key}/Client`, (options) => updateContext(middleware(options), (requestContext) => merge$4(services, requestContext))]]));
-}));
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/cli/CliError.js
 /**
 * Defines structured errors for the unstable CLI parser and runner.
@@ -71308,7 +71349,7 @@ const layerClient = (tag, service) => effectContext(gen(function* () {
 * @category type IDs
 * @since 4.0.0
 */
-const TypeId$7 = "~effect/cli/CliError";
+const TypeId$8 = "~effect/cli/CliError";
 /**
 * Type guard to check if a value is a CLI error.
 *
@@ -71330,7 +71371,7 @@ const TypeId$7 = "~effect/cli/CliError";
 * @category guards
 * @since 4.0.0
 */
-const isCliError = (u) => hasProperty(u, TypeId$7);
+const isCliError = (u) => hasProperty(u, TypeId$8);
 /**
 * Defines the runtime property key used to give an object error a user-facing
 * message.
@@ -71417,7 +71458,7 @@ const getUserMessage = (error) => "~effect/cli/CliError/userMessage" in error &&
 * @category errors
 * @since 4.0.0
 */
-var UnrecognizedOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/UnrecognizedOption`)("UnrecognizedOption", {
+var UnrecognizedOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/UnrecognizedOption`)("UnrecognizedOption", {
 	option: String$6,
 	command: /*#__PURE__*/ optional$8(/*#__PURE__*/ ArraySchema(String$6)),
 	suggestions: /*#__PURE__*/ ArraySchema(String$6)
@@ -71428,7 +71469,7 @@ var UnrecognizedOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/U
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Formats the unrecognized option with command context and suggestions.
 	*
@@ -71464,7 +71505,7 @@ var UnrecognizedOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/U
 * @category errors
 * @since 4.0.0
 */
-var DuplicateOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/DuplicateOption`)("DuplicateOption", {
+var DuplicateOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/DuplicateOption`)("DuplicateOption", {
 	option: String$6,
 	parentCommand: String$6,
 	childCommand: String$6
@@ -71475,7 +71516,7 @@ var DuplicateOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Dupl
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Explains which parent and child commands define the duplicate option.
 	*
@@ -71519,14 +71560,14 @@ var DuplicateOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Dupl
 * @category errors
 * @since 4.0.0
 */
-var MissingOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/MissingOption`)("MissingOption", { option: String$6 })) {
+var MissingOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/MissingOption`)("MissingOption", { option: String$6 })) {
 	/**
 	* Marks this value as a missing CLI option error for runtime guards.
 	*
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Formats the missing required flag for display.
 	*
@@ -71569,14 +71610,14 @@ var MissingOption = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Missin
 * @category errors
 * @since 4.0.0
 */
-var MissingArgument = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/MissingArgument`)("MissingArgument", { argument: String$6 })) {
+var MissingArgument = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/MissingArgument`)("MissingArgument", { argument: String$6 })) {
 	/**
 	* Marks this value as a missing CLI argument error for runtime guards.
 	*
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Formats the missing required positional argument for display.
 	*
@@ -71607,14 +71648,14 @@ var MissingArgument = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Miss
 * @category errors
 * @since 4.0.0
 */
-var UnexpectedArgument = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/UnexpectedArgument`)("UnexpectedArgument", { arguments: /*#__PURE__*/ ArraySchema(String$6) })) {
+var UnexpectedArgument = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/UnexpectedArgument`)("UnexpectedArgument", { arguments: /*#__PURE__*/ ArraySchema(String$6) })) {
 	/**
 	* Marks this value as an unexpected CLI argument error for runtime guards.
 	*
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Formats the unexpected positional arguments for display.
 	*
@@ -71660,7 +71701,7 @@ var UnexpectedArgument = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/U
 * @category errors
 * @since 4.0.0
 */
-var InvalidValue = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/InvalidValue`)("InvalidValue", {
+var InvalidValue = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/InvalidValue`)("InvalidValue", {
 	option: String$6,
 	value: String$6,
 	expected: String$6,
@@ -71672,7 +71713,7 @@ var InvalidValue = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Invalid
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Formats the invalid flag or argument value with the expected input.
 	*
@@ -71723,7 +71764,7 @@ var InvalidValue = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Invalid
 * @category errors
 * @since 4.0.0
 */
-var UnknownSubcommand = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/UnknownSubcommand`)("UnknownSubcommand", {
+var UnknownSubcommand = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/UnknownSubcommand`)("UnknownSubcommand", {
 	subcommand: String$6,
 	parent: /*#__PURE__*/ optional$8(/*#__PURE__*/ ArraySchema(String$6)),
 	suggestions: /*#__PURE__*/ ArraySchema(String$6)
@@ -71734,7 +71775,7 @@ var UnknownSubcommand = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Un
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Formats the unknown subcommand with parent command context and suggestions.
 	*
@@ -71773,14 +71814,14 @@ var UnknownSubcommand = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Un
 * @category errors
 * @since 4.1.0
 */
-var ValidationError = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/ValidationError`)("ValidationError", { message: String$6 })) {
+var ValidationError = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/ValidationError`)("ValidationError", { message: String$6 })) {
 	/**
 	* Marks this value as a CLI validation error for runtime guards.
 	*
 	* @stability unstable
 	* @since 4.1.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 };
 /**
 * Error wrapper for user handler failures in the CLI error channel.
@@ -71828,7 +71869,7 @@ var ValidationError = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/Vali
 * @category errors
 * @since 4.0.0
 */
-var UserError = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/UserError`)("UserError", {
+var UserError = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/UserError`)("UserError", {
 	cause: /*#__PURE__*/ Defect(),
 	userMessage: /*#__PURE__*/ optionalKey(String$6)
 })) {
@@ -71838,7 +71879,7 @@ var UserError = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/UserError`
 	* @stability unstable
 	* @since 4.0.0
 	*/
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	/**
 	* Controls whether the runtime logger should report this error. The CLI
 	* runner sets this to `false` after rendering the error itself.
@@ -71905,11 +71946,11 @@ const NonShowHelpErrors = /*#__PURE__*/ Union([
 * @category errors
 * @since 4.0.0
 */
-var ShowHelp = class extends (/*#__PURE__*/ TaggedError(`${TypeId$7}/ShowHelp`)("ShowHelp", {
+var ShowHelp = class extends (/*#__PURE__*/ TaggedError(`${TypeId$8}/ShowHelp`)("ShowHelp", {
 	commandPath: /*#__PURE__*/ ArraySchema(String$6),
 	errors: /*#__PURE__*/ ArraySchema(NonShowHelpErrors)
 })) {
-	[TypeId$7] = TypeId$7;
+	[TypeId$8] = TypeId$8;
 	[errorExitCode] = this.errors.length ? 1 : 0;
 	[errorReported] = false;
 	get message() {
@@ -72297,7 +72338,7 @@ const eraseLines = (rows) => {
 * @stability unstable
 * @since 4.0.0
 */
-const TypeId$6 = "~effect/cli/Prompt";
+const TypeId$7 = "~effect/cli/Prompt";
 const defaultTheme = {
 	prefix: "?",
 	arrowUp: "↑",
@@ -72712,7 +72753,7 @@ const proto = {
 			return run$3(this);
 		}
 	}),
-	[TypeId$6]: { _Output: (_) => _ }
+	[TypeId$7]: { _Output: (_) => _ }
 };
 const runWithInput = (prompt, terminal, input) => suspend$2(() => {
 	const op = prompt;
@@ -73848,7 +73889,7 @@ const fromProcess = () => {
 * @stability unstable
 * @since 4.0.0
 */
-const TypeId$5 = "~effect/cli/Param";
+const TypeId$6 = "~effect/cli/Param";
 /**
 * Defines the kind discriminator for flag parameters.
 *
@@ -73865,7 +73906,7 @@ const TypeId$5 = "~effect/cli/Param";
 */
 const flagKind = "flag";
 const Proto$4 = {
-	[TypeId$5]: { _A: identity },
+	[TypeId$6]: { _A: identity },
 	pipe() {
 		return pipeArguments(this, arguments);
 	}
@@ -73887,7 +73928,7 @@ const Proto$4 = {
 * @category guards
 * @since 4.0.0
 */
-const isParam = (u) => hasProperty(u, TypeId$5);
+const isParam = (u) => hasProperty(u, TypeId$6);
 /**
 * Type guard to check if a Single param is a flag (not an argument).
 *
@@ -75119,7 +75160,7 @@ const reconstructTree = (tree, results) => {
 * Internal implementation details for CLI commands.
 * Public API is in ../Command.ts
 */
-const TypeId$4 = "~effect/cli/Command";
+const TypeId$5 = "~effect/cli/Command";
 /**
 * Casts a Command to its internal implementation.
 * For use by internal modules that need access to config, parse, handle, etc.
@@ -75203,7 +75244,7 @@ const makeCommand = (options) => {
 		};
 	};
 	return Object.assign(Object.create(Proto$3), {
-		[TypeId$4]: TypeId$4,
+		[TypeId$5]: TypeId$5,
 		name: options.name,
 		examples: resolveExamples([options.name]),
 		resolveExamples,
@@ -77853,7 +77894,7 @@ const formatShellArg = (arg) => /^[A-Za-z0-9_./:@%+=,-]+$/.test(arg) ? arg : `'$
 * @category guards
 * @since 4.0.0
 */
-const isCommand = (u) => hasProperty(u, TypeId$4);
+const isCommand = (u) => hasProperty(u, TypeId$5);
 /**
 * Creates a `Command` from a name, an optional configuration, and an optional
 * handler.
@@ -78539,32 +78580,25 @@ Struct({
 	expires_in: Finite,
 	refresh_token: NonEmptyString
 });
-const Origin$1 = String$6.check(makeFilter((value) => {
-	if (!URL.canParse(value)) return false;
-	const url = new URL(value);
-	return contains(["http:", "https:"], url.protocol) && url.username === "" && url.password === "" && url.hash === "";
-}, { expected: "an HTTP(S) URL without credentials or a fragment" })).check(makeFilter((value) => {
-	if (!URL.canParse(value)) return false;
-	const url = new URL(value);
-	return url.pathname === "/" && url.search === "";
-}, { expected: "an HTTP(S) origin without a path or query" }));
-const SecureOrigin = Origin$1.check(makeFilter((value) => {
-	if (!URL.canParse(value)) return false;
-	const url = new URL(value);
-	return url.protocol === "https:" || contains([
-		"localhost",
-		"127.0.0.1",
-		"[::1]"
-	], url.hostname);
-}, { expected: "HTTPS outside loopback" }));
+const Origin$1 = String$6.check(makeFilter((value) => exists(getSuccess(fromString(value)), (url) => contains(["http:", "https:"], url.protocol) && url.username === "" && url.password === "" && url.hash === ""), { expected: "an HTTP(S) URL without credentials or a fragment" })).check(makeFilter((value) => exists(getSuccess(fromString(value)), (url) => url.pathname === "/" && url.search === ""), { expected: "an HTTP(S) origin without a path or query" }));
+const SecureOrigin = Origin$1.check(makeFilter((value) => exists(getSuccess(fromString(value)), (url) => url.protocol === "https:" || contains([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+], url.hostname)), { expected: "HTTPS outside loopback" }));
 const Port = String$6.check(isPattern(/^\d{1,5}$/u), makeFilter((value) => exists(parse$2(value), (port) => port >= 1 && port <= 65535), { expected: "a port between 1 and 65535" }));
 const AppVersion = String$6.check(isPattern(/^0\.1\.\d+$/u));
+const RUNTIME_PATH = "/api/runtime";
 const RuntimeConfig = Struct({
 	auth: optionalKey(String$6),
 	name: String$6,
 	traces: String$6,
 	version: AppVersion
 });
+const RPC_PATH = "/api/rpc";
+const MCP_PATH = "/mcp";
+const MCP_METADATA_PATH = "/.well-known/oauth-protected-resource/mcp";
+const MANIFEST_PATH = "/manifest.webmanifest";
 const Account$1 = Struct({
 	...User.fields,
 	signOut: Boolean$5
@@ -79834,7 +79868,7 @@ const AiErrorReason = /*#__PURE__*/ Union([
 	ToolkitRequiredError,
 	InvalidUserInputError
 ]);
-const TypeId$3 = "~effect/ai/AiError";
+const TypeId$4 = "~effect/ai/AiError";
 /**
 * Schema for the top-level AI error wrapper using the `reason` pattern.
 *
@@ -79883,7 +79917,7 @@ var AiError = class extends (/*#__PURE__*/ Error$1("effect/ai/AiError/AiError")(
 	method: String$6,
 	reason: AiErrorReason
 })) {
-	[TypeId$3] = TypeId$3;
+	[TypeId$4] = TypeId$4;
 	cause = this.reason;
 	/**
 	* Delegates to the underlying reason's `isRetryable` getter.
@@ -79929,7 +79963,7 @@ var AiError = class extends (/*#__PURE__*/ Error$1("effect/ai/AiError/AiError")(
 * @category guards
 * @since 4.0.0
 */
-const isAiError = (u) => hasProperty(u, TypeId$3);
+const isAiError = (u) => hasProperty(u, TypeId$4);
 /**
 * Type guard to check if a value is an `AiErrorReason`.
 *
@@ -80001,7 +80035,7 @@ const make$14 = (params) => new AiError(params);
 * @category type IDs
 * @since 4.0.0
 */
-const TypeId$2 = "~effect/ai/Tool";
+const TypeId$3 = "~effect/ai/Tool";
 /**
 * Runtime type identifier carried by dynamic tools.
 *
@@ -80043,7 +80077,7 @@ const DynamicTypeId = "~effect/ai/Tool/Dynamic";
 const isDynamic = (u) => hasProperty(u, DynamicTypeId);
 const clone = (self, overrides) => Object.assign(Object.create(Object.getPrototypeOf(self)), self, overrides);
 const Proto$2 = {
-	[TypeId$2]: { _Requirements: identity },
+	[TypeId$3]: { _Requirements: identity },
 	pipe() {
 		return pipeArguments(this, arguments);
 	},
@@ -80427,7 +80461,7 @@ function resolveTopLevelReference(document) {
 * @stability unstable
 * @since 4.0.0
 */
-const TypeId$1 = "~effect/ai/Toolkit";
+const TypeId$2 = "~effect/ai/Toolkit";
 /**
 * Cause annotation identifying the phase of a typed `Toolkit.handle` failure.
 *
@@ -80646,7 +80680,7 @@ const Proto$1 = {
 			};
 		})
 	}),
-	[TypeId$1]: TypeId$1,
+	[TypeId$2]: TypeId$2,
 	of: identity,
 	toHandlers(build) {
 		return gen({ self: this }, function* () {
@@ -80723,6 +80757,70 @@ const resolveInput = (...tools) => {
 * @since 4.0.0
 */
 const make$12 = (...tools) => makeProto(resolveInput(...tools));
+// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/rpc/RpcMiddleware.js
+/**
+* Middleware services for the unstable RPC runtime.
+*
+* A middleware service wraps server handler execution and can also install a
+* client-side wrapper for generated clients. Its metadata records the services
+* provided to downstream handlers, the services required by the middleware
+* implementation, the schema for server-visible failures, the client-only error
+* type, and whether generated clients must require the matching client layer.
+*
+* @stability unstable
+* @since 4.0.0
+*/
+/**
+* The runtime type id used to attach and inspect RPC middleware metadata.
+*
+* @stability unstable
+* @category type IDs
+* @since 4.0.0
+*/
+const TypeId$1 = "~effect/rpc/RpcMiddleware";
+/**
+* Creates a typed RPC middleware service class, with optional service
+* requirements, provided services, error schema, and client-side requirement
+* metadata.
+*
+* @stability unstable
+* @category constructors
+* @since 4.0.0
+*/
+const Service = () => (id, options) => {
+	const limit = getStackTraceLimit();
+	let creationError;
+	if (limit !== 0) {
+		setStackTraceLimit(2);
+		creationError = new globalThis.Error();
+		setStackTraceLimit(limit);
+	}
+	function ServiceClass() {}
+	const ServiceClass_ = ServiceClass;
+	Object.setPrototypeOf(ServiceClass, Object.getPrototypeOf(Service$1(id)));
+	ServiceClass.key = id;
+	Object.defineProperty(ServiceClass, "stack", { get() {
+		return creationError?.stack;
+	} });
+	ServiceClass_[TypeId$1] = TypeId$1;
+	ServiceClass_.error = options?.error ?? Never;
+	ServiceClass_.requiredForClient = options?.requiredForClient ?? false;
+	return ServiceClass;
+};
+/**
+* Provides the client-side implementation for an RPC middleware service,
+* capturing the layer's environment and merging it into each middleware
+* invocation.
+*
+* @stability unstable
+* @category layers
+* @since 4.0.0
+*/
+const layerClient = (tag, service) => effectContext(gen(function* () {
+	const services = (yield* context()).pipe(omit$2(Scope));
+	const middleware = isEffect(service) ? yield* service : service;
+	return makeUnsafe$10(/* @__PURE__ */ new Map([[`${tag.key}/Client`, (options) => updateContext(middleware(options), (requestContext) => merge$4(services, requestContext))]]));
+}));
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/ai/McpSchema.js
 /**
 * Defines schemas for Model Context Protocol messages.
@@ -88901,11 +88999,33 @@ function layerOtlp(serviceName, url, runtime, version) {
 }
 // ../../packages/runtime/src/auth/lib/utils.ts
 const AUTH_URL = "https://auth.mp281x.xyz";
+const ISSUER_PATH = "/api/auth";
+const ISSUER = `${AUTH_URL}${ISSUER_PATH}`;
+const APPS_PATH = "/api/apps";
+const SESSION_PATH = "/auth/session";
+const VERIFY_PATH = "/auth/verify";
 const DEVELOPER = {
 	id: "github:0",
 	name: "dev"
 };
 const localAuth = map$2(option(String$5("AUTH_URL")), isNone);
+const adminIds = gen(function* () {
+	const listed = Array$1(String$6, "GITHUB_ADMINS");
+	if (yield* localAuth) return yield* withDefault$2(listed, ["0"]);
+	return yield* listed;
+});
+function isAdmin(admins, id) {
+	return contains(admins, replace("github:", "")(id));
+}
+function rejected$1(message) {
+	return mapError$2((cause) => {
+		if (is$2(AuthError)(cause)) return cause;
+		return AuthError.make({
+			cause,
+			message
+		});
+	});
+}
 var CurrentUser = class extends Service$1()("@deslop/runtime/auth/lib/utils/CurrentUser") {};
 var RpcAuth = class RpcAuth extends Service()("@deslop/runtime/auth/lib/utils/RpcAuth", { error: AuthError }) {
 	static layerClient = (token) => layerClient(RpcAuth, (options) => gen(function* () {
@@ -88916,7 +89036,7 @@ var RpcAuth = class RpcAuth extends Service()("@deslop/runtime/auth/lib/utils/Rp
 	}));
 };
 // ../../packages/runtime/src/auth/service.ts
-function rejected$6(message) {
+function rejected(message) {
 	return mapError$2((cause) => {
 		if (is$2(AuthError)(cause)) return cause;
 		if (isHttpClientError(cause) && cause.reason._tag === "StatusCodeError" && cause.reason.response.status === 401) return AuthError.make({
@@ -88948,17 +89068,17 @@ var Auth = class Auth extends Service$1()("@deslop/runtime/auth/service/Auth") {
 		const canonical = new URL(yield* String$5("APP_URL")).origin;
 		const client = filterStatusOk(yield* HttpClient);
 		const access = fn("Auth.access")(function* (headers, audience) {
-			return yield* pipe(client.get(new URL("/auth/verify", issuer).href, {
+			return yield* pipe(client.get(new URL(VERIFY_PATH, issuer).href, {
 				headers: { authorization: headers["authorization"] ?? "" },
 				urlParams: { resource: audience }
 			}), flatMap$2(schemaBodyJson$1(User)), timeout("10 seconds"));
-		}, rejected$6("Sign in first"));
+		}, rejected("Sign in first"));
 		return Auth.makeContext(Auth.of({
 			access,
 			user: fn("Auth.user")(function* (headers) {
 				if (isSome(get$6(headers, "authorization"))) return yield* access(headers, canonical);
-				return yield* pipe(client.get(new URL("/auth/session", issuer).href, { headers: { cookie: headers["cookie"] ?? "" } }), flatMap$2(schemaBodyJson$1(User)), timeout("10 seconds"));
-			}, rejected$6("Sign in first"))
+				return yield* pipe(client.get(new URL(SESSION_PATH, issuer).href, { headers: { cookie: headers["cookie"] ?? "" } }), flatMap$2(schemaBodyJson$1(User)), timeout("10 seconds"));
+			}, rejected("Sign in first"))
 		}));
 	}));
 };
@@ -88979,7 +89099,7 @@ function layerMcpAuth(resource) {
 		if (yield* localAuth) return (app) => provideService(app, CurrentUser, DEVELOPER);
 		return (app) => gen(function* () {
 			const headers = (yield* HttpServerRequest).headers;
-			const challenge = `Bearer resource_metadata="${new URL("/.well-known/oauth-protected-resource/mcp", resource).href}", scope="deslop"`;
+			const challenge = `Bearer resource_metadata="${new URL(MCP_METADATA_PATH, resource).href}", scope="deslop"`;
 			if (isNone(get$6(headers, "authorization"))) return text("OAuth authorization required; sign in with your MCP client", {
 				headers: { "www-authenticate": challenge },
 				status: 401
@@ -89115,7 +89235,7 @@ const layerRoutes = use((router) => gen(function* () {
 			})
 		});
 	});
-	yield* router.add("GET", "/api/runtime", gen(function* () {
+	yield* router.add("GET", RUNTIME_PATH, gen(function* () {
 		return yield* schemaJson(RuntimeConfig)({
 			...match$8(issuer, {
 				onNone: () => ({}),
@@ -89143,7 +89263,7 @@ const layerAnnounce = effectDiscard(gen(function* () {
 	yield* match$8(yield* option(String$5("AUTH_URL")), {
 		onNone: () => void_$1,
 		onSome: fnUntraced(function* (issuer) {
-			yield* pipe(post(new URL("/api/apps", issuer).href), bodyJsonUnsafe({ origin }), client.execute, delay("2 seconds"), retry({
+			yield* pipe(post(new URL(APPS_PATH, issuer).href), bodyJsonUnsafe({ origin }), client.execute, delay("2 seconds"), retry({
 				schedule: spaced("1 minute"),
 				times: 60
 			}), ignore$1({
@@ -89164,7 +89284,7 @@ const layerWeb = unwrap$7(gen(function* () {
 	const client = fileURLToPath(new URL("./client", import.meta.url));
 	if (!(yield* (yield* FileSystem).exists((yield* Path$1).join(client, "index.html")))) return empty$11;
 	const name = capitalize(yield* appName);
-	return mergeAll$1(add("GET", "/manifest.webmanifest", succeed$5(jsonUnsafe({
+	return mergeAll$1(add("GET", MANIFEST_PATH, succeed$5(jsonUnsafe({
 		background_color: "#0a0a0a",
 		display: "standalone",
 		icons: [{
@@ -89193,29 +89313,38 @@ const layerWeb = unwrap$7(gen(function* () {
 		spa: true
 	}));
 }));
-function layerMcp$1(options) {
+function layerRpc(options) {
+	return pipe(layerHttp$1({
+		disableTracing: options.disableTracing,
+		group: options.group,
+		path: RPC_PATH,
+		protocol: "websocket"
+	}), provide$2(options.handlers));
+}
+function layerMcp(options) {
 	return unwrap$7(gen(function* () {
 		const metadata = yield* packageMetadata;
 		const canonical = yield* String$5("APP_URL");
 		const issuer = yield* option(String$5("AUTH_URL"));
-		const resource = new URL("/mcp", canonical).href;
+		const resource = new URL(MCP_PATH, canonical).href;
 		const endpoint = pipe(layerHttp({
-			...options,
 			allowSessionTermination: true,
 			icons: [{ src: new URL("/icon", canonical).href }],
+			instructions: options.instructions,
 			name: yield* appName,
-			path: "/mcp",
+			path: MCP_PATH,
 			protocols: [
 				v2026_07_28,
 				v2025_11_25,
 				v2025_06_18
 			],
+			registrations: pipe(toolkit(options.tools), provide$2(options.handlers)),
 			version: metadata.version
 		}), provide$2(layerMcpAuth(resource)));
 		return match$8(issuer, {
 			onNone: () => endpoint,
-			onSome: (origin) => mergeAll$1(endpoint, add("GET", "/.well-known/oauth-protected-resource/mcp", succeed$5(jsonUnsafe({
-				authorization_servers: [new URL("/api/auth", origin).href],
+			onSome: (origin) => mergeAll$1(endpoint, add("GET", MCP_METADATA_PATH, succeed$5(jsonUnsafe({
+				authorization_servers: [new URL(ISSUER_PATH, origin).href],
 				bearer_methods_supported: ["header"],
 				resource,
 				scopes_supported: ["deslop"]
@@ -89345,7 +89474,7 @@ const update$1 = fnUntraced(function* (name) {
 	yield* activate(name, path.join(directory, "node_modules", "@deslop", name));
 	yield* restart(name);
 	const kept = [latest, ...toArray(map$11(previous, (link) => path.basename(path.resolve(link, "../../.."))))];
-	yield* forEach$1(filter$6(yield* fs.readDirectory(path.join(root, "releases")), (entry) => !contains(kept, entry)), (entry) => fs.remove(path.join(root, "releases", entry), { recursive: true }), { concurrency: 1 });
+	yield* forEach$1(difference(yield* fs.readDirectory(path.join(root, "releases")), kept), (entry) => fs.remove(path.join(root, "releases", entry), { recursive: true }), { concurrency: 1 });
 	return `Updated ${name} from ${running} to ${latest}\n`;
 });
 // ../../packages/runtime/src/cli.ts
@@ -89454,15 +89583,6 @@ const App = Struct({
 const Catalog = ArraySchema(App);
 const AppParams = Struct({ origin: SecureOrigin });
 // src/services/apps/service.ts
-function rejected$5(message) {
-	return mapError$2((cause) => {
-		if (is$2(AuthError)(cause)) return cause;
-		return AuthError.make({
-			cause,
-			message
-		});
-	});
-}
 var Apps = class Apps extends Service$1()("@deslop/auth/services/apps/service/Apps") {
 	static layer = effect(this, gen(function* () {
 		const store = toSchemaStore(yield* KeyValueStore, Catalog);
@@ -89477,12 +89597,12 @@ var Apps = class Apps extends Service$1()("@deslop/auth/services/apps/service/Ap
 					error: "access_denied",
 					message: `Only apps on ${domain} are listed`
 				});
-				const runtime = yield* pipe(client.get(new URL("/api/runtime", origin).href), flatMap$2(schemaBodyJson$1(RuntimeConfig)), timeout("10 seconds"), rejected$5(`${origin} did not answer /api/runtime`));
+				const runtime = yield* pipe(client.get(new URL(RUNTIME_PATH, origin).href), flatMap$2(schemaBodyJson$1(RuntimeConfig)), timeout("10 seconds"), rejected$1(`${origin} did not answer ${RUNTIME_PATH}`));
 				if (!exists(fromUndefinedOr(runtime.auth), (auth) => new URL(auth).origin === self.origin)) return yield* AuthError.make({
 					error: "access_denied",
 					message: `${origin} signs in elsewhere`
 				});
-				const web = yield* pipe(client.get(new URL("/manifest.webmanifest", origin).href), timeout("10 seconds"), as(true), orElseSucceed(() => false));
+				const web = yield* pipe(client.get(new URL(MANIFEST_PATH, origin).href), timeout("10 seconds"), as(true), orElseSucceed(() => false));
 				const app = App.make({
 					name: runtime.name,
 					open: match$1(web, {
@@ -89494,7 +89614,7 @@ var Apps = class Apps extends Service$1()("@deslop/auth/services/apps/service/Ap
 				yield* pipe(modifyEffect(state, (current) => {
 					const next = sort([...filter$6(current, (known) => known.origin !== app.origin), app], mapInput(Order$3, (known) => known.name));
 					return as(store.set("apps", next), [void 0, next]);
-				}), uninterruptible, rejected$5("The app list could not be saved"));
+				}), uninterruptible, rejected$1("The app list could not be saved"));
 				return app;
 			})
 		});
@@ -89666,15 +89786,6 @@ const DEVELOPER_PROFILE = GitHubUser.make({
 	id: 0,
 	login: DEVELOPER.name
 });
-function failed(message) {
-	return mapError$2((cause) => {
-		if (is$2(AuthError)(cause)) return cause;
-		return AuthError.make({
-			cause,
-			message
-		});
-	});
-}
 var GitHub = class GitHub extends Service$1()("@deslop/auth/services/github/service/GitHub") {
 	static layer = effect(GitHub, gen(function* () {
 		const random = yield* SecureRandom;
@@ -89737,10 +89848,10 @@ var GitHub = class GitHub extends Service$1()("@deslop/auth/services/github/serv
 					flow,
 					profile: yield* user(bearerToken(get$3("https://api.github.com/user"), token.access_token))
 				};
-			}, failed("GitHub sign-in failed")),
+			}, rejected$1("GitHub sign-in failed")),
 			profile: fn("GitHub.profile")(function* (id) {
 				return yield* user(get$3(`https://api.github.com/user/${id}`));
-			}, failed("Cannot read the GitHub profile")),
+			}, rejected$1("Cannot read the GitHub profile")),
 			start: fn("GitHub.start")(function* (flow) {
 				const state = yield* nonce;
 				const verifier = yield* nonce;
@@ -89760,7 +89871,7 @@ var GitHub = class GitHub extends Service$1()("@deslop/auth/services/github/serv
 					state,
 					url: url.href
 				};
-			}, failed("Cannot start GitHub sign-in"))
+			}, rejected$1("Cannot start GitHub sign-in"))
 		});
 	}));
 };
@@ -110912,989 +111023,30 @@ async function verifyAuthenticationResponse(options) {
 	};
 }
 // src/services/tokens/lib/utils.ts
-var import_ipaddr = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module, this$1) => {
-	(function(root) {
-		"use strict";
-		const ipv4Part = "(0?\\d+|0x[a-f0-9]+)";
-		const ipv4Regexes = {
-			fourOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
-			threeOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
-			twoOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}$`, "i"),
-			longValue: new RegExp(`^${ipv4Part}$`, "i")
-		};
-		const octalRegex = new RegExp(`^0[0-7]+$`, "i");
-		const hexRegex = new RegExp(`^0x[a-f0-9]+$`, "i");
-		const zoneIndex = "%[0-9a-z]{1,}";
-		const ipv6Part = "(?:[0-9a-f]+::?)+";
-		const ipv6Regexes = {
-			zoneIndex: new RegExp(zoneIndex, "i"),
-			"native": new RegExp(`^(::)?(${ipv6Part})?([0-9a-f]+)?(::)?(${zoneIndex})?$`, "i"),
-			deprecatedTransitional: new RegExp(`^(?:::)(${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?)$`, "i"),
-			transitional: new RegExp(`^((?:${ipv6Part})|(?:::)(?:${ipv6Part})?)${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?$`, "i")
-		};
-		function expandIPv6(string, parts) {
-			if (string.indexOf("::") !== string.lastIndexOf("::")) return null;
-			let colonCount = 0;
-			let lastColon = -1;
-			let zoneId = (string.match(ipv6Regexes.zoneIndex) || [])[0];
-			let replacement, replacementCount;
-			if (zoneId) {
-				zoneId = zoneId.substring(1);
-				string = string.replace(/%.+$/, "");
-			}
-			while ((lastColon = string.indexOf(":", lastColon + 1)) >= 0) colonCount++;
-			if (string.substr(0, 2) === "::") colonCount--;
-			if (string.substr(-2, 2) === "::") colonCount--;
-			if (colonCount >= parts) return null;
-			replacementCount = parts - colonCount;
-			replacement = ":";
-			while (replacementCount--) replacement += "0:";
-			string = string.replace("::", replacement);
-			if (string[0] === ":") string = string.slice(1);
-			if (string[string.length - 1] === ":") string = string.slice(0, -1);
-			parts = (function() {
-				const ref = string.split(":");
-				const results = [];
-				for (let i = 0; i < ref.length; i++) results.push(ref[i].length > 4 ? NaN : parseInt(ref[i], 16));
-				return results;
-			})();
-			return {
-				parts,
-				zoneId
-			};
-		}
-		function matchCIDR(first, second, partSize, cidrBits) {
-			if (first.length !== second.length) throw new Error("ipaddr: cannot match CIDR for objects with different lengths");
-			let part = 0;
-			let shift;
-			while (cidrBits > 0) {
-				shift = partSize - cidrBits;
-				if (shift < 0) shift = 0;
-				if (first[part] >> shift !== second[part] >> shift) return false;
-				cidrBits -= partSize;
-				part += 1;
-			}
-			return true;
-		}
-		function parseIntAuto(string) {
-			if (hexRegex.test(string)) return parseInt(string, 16);
-			if (string[0] === "0" && !isNaN(parseInt(string[1], 10))) {
-				if (octalRegex.test(string)) return parseInt(string, 8);
-				throw new Error(`ipaddr: cannot parse ${string} as octal`);
-			}
-			return parseInt(string, 10);
-		}
-		function padPart(part, length) {
-			while (part.length < length) part = `0${part}`;
-			return part;
-		}
-		const ipaddr = {};
-		ipaddr.IPv4 = (function() {
-			function IPv4(octets) {
-				if (octets.length !== 4) throw new Error("ipaddr: ipv4 octet count should be 4");
-				let i, octet;
-				for (i = 0; i < octets.length; i++) {
-					octet = octets[i];
-					if (!(0 <= octet && octet <= 255)) throw new Error("ipaddr: ipv4 octet should fit in 8 bits");
-				}
-				this.octets = octets;
-			}
-			IPv4.prototype.SpecialRanges = {
-				unspecified: [[new IPv4([
-					0,
-					0,
-					0,
-					0
-				]), 8]],
-				broadcast: [[new IPv4([
-					255,
-					255,
-					255,
-					255
-				]), 32]],
-				multicast: [[new IPv4([
-					224,
-					0,
-					0,
-					0
-				]), 4]],
-				linkLocal: [[new IPv4([
-					169,
-					254,
-					0,
-					0
-				]), 16]],
-				loopback: [[new IPv4([
-					127,
-					0,
-					0,
-					0
-				]), 8]],
-				carrierGradeNat: [[new IPv4([
-					100,
-					64,
-					0,
-					0
-				]), 10]],
-				"private": [
-					[new IPv4([
-						10,
-						0,
-						0,
-						0
-					]), 8],
-					[new IPv4([
-						172,
-						16,
-						0,
-						0
-					]), 12],
-					[new IPv4([
-						192,
-						168,
-						0,
-						0
-					]), 16]
-				],
-				reserved: [
-					[new IPv4([
-						192,
-						0,
-						0,
-						0
-					]), 24],
-					[new IPv4([
-						192,
-						0,
-						2,
-						0
-					]), 24],
-					[new IPv4([
-						192,
-						88,
-						99,
-						0
-					]), 24],
-					[new IPv4([
-						198,
-						18,
-						0,
-						0
-					]), 15],
-					[new IPv4([
-						198,
-						51,
-						100,
-						0
-					]), 24],
-					[new IPv4([
-						203,
-						0,
-						113,
-						0
-					]), 24],
-					[new IPv4([
-						240,
-						0,
-						0,
-						0
-					]), 4]
-				],
-				as112: [[new IPv4([
-					192,
-					175,
-					48,
-					0
-				]), 24], [new IPv4([
-					192,
-					31,
-					196,
-					0
-				]), 24]],
-				amt: [[new IPv4([
-					192,
-					52,
-					193,
-					0
-				]), 24]]
-			};
-			IPv4.prototype.kind = function() {
-				return "ipv4";
-			};
-			IPv4.prototype.match = function(other, cidrRange) {
-				let ref;
-				if (cidrRange === void 0) {
-					ref = other;
-					other = ref[0];
-					cidrRange = ref[1];
-				}
-				if (other.kind() !== "ipv4") throw new Error("ipaddr: cannot match ipv4 address with non-ipv4 one");
-				return matchCIDR(this.octets, other.octets, 8, cidrRange);
-			};
-			IPv4.prototype.prefixLengthFromSubnetMask = function() {
-				let cidr = 0;
-				let stop = false;
-				const zerotable = {
-					0: 8,
-					128: 7,
-					192: 6,
-					224: 5,
-					240: 4,
-					248: 3,
-					252: 2,
-					254: 1,
-					255: 0
-				};
-				let i, octet, zeros;
-				for (i = 3; i >= 0; i -= 1) {
-					octet = this.octets[i];
-					if (octet in zerotable) {
-						zeros = zerotable[octet];
-						if (stop && zeros !== 0) return null;
-						if (zeros !== 8) stop = true;
-						cidr += zeros;
-					} else return null;
-				}
-				return 32 - cidr;
-			};
-			IPv4.prototype.range = function() {
-				return ipaddr.subnetMatch(this, this.SpecialRanges);
-			};
-			IPv4.prototype.toByteArray = function() {
-				return this.octets.slice(0);
-			};
-			IPv4.prototype.toIPv4MappedAddress = function() {
-				return ipaddr.IPv6.parse(`::ffff:${this.toString()}`);
-			};
-			IPv4.prototype.toNormalizedString = function() {
-				return this.toString();
-			};
-			IPv4.prototype.toString = function() {
-				return this.octets.join(".");
-			};
-			return IPv4;
-		})();
-		ipaddr.IPv4.broadcastAddressFromCIDR = function(string) {
-			try {
-				const cidr = this.parseCIDR(string);
-				const ipInterfaceOctets = cidr[0].toByteArray();
-				const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				const octets = [];
-				let i = 0;
-				while (i < 4) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv4 CIDR format", { cause: e });
-			}
-		};
-		ipaddr.IPv4.isIPv4 = function(string) {
-			return this.parser(string) !== null;
-		};
-		ipaddr.IPv4.isValid = function(string) {
-			try {
-				new this(this.parser(string));
-				return true;
-			} catch {
-				return false;
-			}
-		};
-		ipaddr.IPv4.isValidCIDR = function(string) {
-			try {
-				this.parseCIDR(string);
-				return true;
-			} catch {
-				return false;
-			}
-		};
-		ipaddr.IPv4.isValidFourPartDecimal = function(string) {
-			if (ipaddr.IPv4.isValid(string) && string.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/)) return true;
-			else return false;
-		};
-		ipaddr.IPv4.isValidCIDRFourPartDecimal = function(string) {
-			const match = string.match(/^(.+)\/(\d+)$/);
-			if (!ipaddr.IPv4.isValidCIDR(string) || !match) return false;
-			return ipaddr.IPv4.isValidFourPartDecimal(match[1]);
-		};
-		ipaddr.IPv4.networkAddressFromCIDR = function(string) {
-			let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
-			try {
-				cidr = this.parseCIDR(string);
-				ipInterfaceOctets = cidr[0].toByteArray();
-				subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				octets = [];
-				i = 0;
-				while (i < 4) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv4 CIDR format", { cause: e });
-			}
-		};
-		ipaddr.IPv4.parse = function(string) {
-			const parts = this.parser(string);
-			if (parts === null) throw new Error("ipaddr: string is not formatted like an IPv4 Address");
-			return new this(parts);
-		};
-		ipaddr.IPv4.parseCIDR = function(string) {
-			let match;
-			if (match = string.match(/^(.+)\/(\d+)$/)) {
-				const maskLength = parseInt(match[2]);
-				if (maskLength >= 0 && maskLength <= 32) {
-					const parsed = [this.parse(match[1]), maskLength];
-					Object.defineProperty(parsed, "toString", { value: function() {
-						return this.join("/");
-					} });
-					return parsed;
-				}
-			}
-			throw new Error("ipaddr: string is not formatted like an IPv4 CIDR range");
-		};
-		ipaddr.IPv4.parser = function(string) {
-			let match, part, value;
-			if (match = string.match(ipv4Regexes.fourOctet)) return (function() {
-				const ref = match.slice(1, 6);
-				const results = [];
-				for (let i = 0; i < ref.length; i++) {
-					part = ref[i];
-					results.push(parseIntAuto(part));
-				}
-				return results;
-			})();
-			else if (match = string.match(ipv4Regexes.longValue)) {
-				value = parseIntAuto(match[1]);
-				if (value > 4294967295 || value < 0) throw new Error("ipaddr: address outside defined range");
-				return (function() {
-					const results = [];
-					let shift = 0;
-					for (; shift <= 24; shift += 8) results.push(value >> shift & 255);
-					return results;
-				})().reverse();
-			} else if (match = string.match(ipv4Regexes.twoOctet)) return (function() {
-				const ref = match.slice(1, 4);
-				const results = [];
-				value = parseIntAuto(ref[1]);
-				if (value > 16777215 || value < 0) throw new Error("ipaddr: address outside defined range");
-				results.push(parseIntAuto(ref[0]));
-				results.push(value >> 16 & 255);
-				results.push(value >> 8 & 255);
-				results.push(value & 255);
-				return results;
-			})();
-			else if (match = string.match(ipv4Regexes.threeOctet)) return (function() {
-				const ref = match.slice(1, 5);
-				const results = [];
-				value = parseIntAuto(ref[2]);
-				if (value > 65535 || value < 0) throw new Error("ipaddr: address outside defined range");
-				results.push(parseIntAuto(ref[0]));
-				results.push(parseIntAuto(ref[1]));
-				results.push(value >> 8 & 255);
-				results.push(value & 255);
-				return results;
-			})();
-			else return null;
-		};
-		ipaddr.IPv4.subnetMaskFromPrefixLength = function(prefix) {
-			prefix = parseInt(prefix);
-			if (Number.isNaN(prefix) || prefix < 0 || prefix > 32) throw new Error("ipaddr: invalid IPv4 prefix length");
-			const octets = [
-				0,
-				0,
-				0,
-				0
-			];
-			let j = 0;
-			const filledOctetCount = Math.floor(prefix / 8);
-			while (j < filledOctetCount) {
-				octets[j] = 255;
-				j++;
-			}
-			if (filledOctetCount < 4) octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
-			return new this(octets);
-		};
-		ipaddr.IPv6 = (function() {
-			function IPv6(parts, zoneId) {
-				let i, part;
-				if (parts.length === 16) {
-					this.parts = [];
-					for (i = 0; i <= 14; i += 2) this.parts.push(parts[i] << 8 | parts[i + 1]);
-				} else if (parts.length === 8) this.parts = parts;
-				else throw new Error("ipaddr: ipv6 part count should be 8 or 16");
-				for (i = 0; i < this.parts.length; i++) {
-					part = this.parts[i];
-					if (!(0 <= part && part <= 65535)) throw new Error("ipaddr: ipv6 part should fit in 16 bits");
-				}
-				if (zoneId) this.zoneId = zoneId;
-			}
-			IPv6.prototype.SpecialRanges = {
-				unspecified: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 128],
-				linkLocal: [new IPv6([
-					65152,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 10],
-				multicast: [new IPv6([
-					65280,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 8],
-				loopback: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					1
-				]), 128],
-				uniqueLocal: [new IPv6([
-					64512,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 7],
-				ipv4Mapped: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					0,
-					65535,
-					0,
-					0
-				]), 96],
-				deprecatedSiteLocal: [new IPv6([
-					65216,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 10],
-				discard: [new IPv6([
-					256,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 64],
-				rfc6145: [new IPv6([
-					0,
-					0,
-					0,
-					0,
-					65535,
-					0,
-					0,
-					0
-				]), 96],
-				rfc6052: [[new IPv6([
-					100,
-					65435,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 96], [new IPv6([
-					100,
-					65435,
-					1,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48]],
-				"6to4": [new IPv6([
-					8194,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 16],
-				teredo: [new IPv6([
-					8193,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 32],
-				benchmarking: [new IPv6([
-					8193,
-					2,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48],
-				amt: [new IPv6([
-					8193,
-					3,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 32],
-				as112v6: [[new IPv6([
-					8193,
-					4,
-					274,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48], [new IPv6([
-					9760,
-					79,
-					32768,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 48]],
-				deprecatedOrchid: [new IPv6([
-					8193,
-					16,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				orchid2: [new IPv6([
-					8193,
-					32,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				droneRemoteIdProtocolEntityTags: [new IPv6([
-					8193,
-					48,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 28],
-				segmentRouting: [new IPv6([
-					24320,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0,
-					0
-				]), 16],
-				reserved: [
-					[new IPv6([
-						8193,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 23],
-					[new IPv6([
-						8193,
-						3512,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 32],
-					[new IPv6([
-						16383,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0,
-						0
-					]), 20]
-				]
-			};
-			IPv6.prototype.isIPv4MappedAddress = function() {
-				return this.range() === "ipv4Mapped";
-			};
-			IPv6.prototype.kind = function() {
-				return "ipv6";
-			};
-			IPv6.prototype.match = function(other, cidrRange) {
-				let ref;
-				if (cidrRange === void 0) {
-					ref = other;
-					other = ref[0];
-					cidrRange = ref[1];
-				}
-				if (other.kind() !== "ipv6") throw new Error("ipaddr: cannot match ipv6 address with non-ipv6 one");
-				return matchCIDR(this.parts, other.parts, 16, cidrRange);
-			};
-			IPv6.prototype.prefixLengthFromSubnetMask = function() {
-				let cidr = 0;
-				let stop = false;
-				const zerotable = {
-					0: 16,
-					32768: 15,
-					49152: 14,
-					57344: 13,
-					61440: 12,
-					63488: 11,
-					64512: 10,
-					65024: 9,
-					65280: 8,
-					65408: 7,
-					65472: 6,
-					65504: 5,
-					65520: 4,
-					65528: 3,
-					65532: 2,
-					65534: 1,
-					65535: 0
-				};
-				let part, zeros;
-				for (let i = 7; i >= 0; i -= 1) {
-					part = this.parts[i];
-					if (part in zerotable) {
-						zeros = zerotable[part];
-						if (stop && zeros !== 0) return null;
-						if (zeros !== 16) stop = true;
-						cidr += zeros;
-					} else return null;
-				}
-				return 128 - cidr;
-			};
-			IPv6.prototype.range = function() {
-				return ipaddr.subnetMatch(this, this.SpecialRanges);
-			};
-			IPv6.prototype.toByteArray = function() {
-				let part;
-				const bytes = [];
-				const ref = this.parts;
-				for (let i = 0; i < ref.length; i++) {
-					part = ref[i];
-					bytes.push(part >> 8);
-					bytes.push(part & 255);
-				}
-				return bytes;
-			};
-			IPv6.prototype.toFixedLengthString = function() {
-				const addr = (function() {
-					const results = [];
-					for (let i = 0; i < this.parts.length; i++) results.push(padPart(this.parts[i].toString(16), 4));
-					return results;
-				}).call(this).join(":");
-				let suffix = "";
-				if (this.zoneId) suffix = `%${this.zoneId}`;
-				return addr + suffix;
-			};
-			IPv6.prototype.toIPv4Address = function() {
-				if (!this.isIPv4MappedAddress()) throw new Error("ipaddr: trying to convert a generic ipv6 address to ipv4");
-				const ref = this.parts.slice(-2);
-				const high = ref[0];
-				const low = ref[1];
-				return new ipaddr.IPv4([
-					high >> 8,
-					high & 255,
-					low >> 8,
-					low & 255
-				]);
-			};
-			IPv6.prototype.toNormalizedString = function() {
-				const addr = (function() {
-					const results = [];
-					for (let i = 0; i < this.parts.length; i++) results.push(this.parts[i].toString(16));
-					return results;
-				}).call(this).join(":");
-				let suffix = "";
-				if (this.zoneId) suffix = `%${this.zoneId}`;
-				return addr + suffix;
-			};
-			IPv6.prototype.toRFC5952String = function() {
-				const regex = /((^|:)(0(:|$)){2,})/g;
-				let suffix = "";
-				if (this.zoneId) suffix = `%${this.zoneId}`;
-				const normalized = this.toNormalizedString();
-				const string = normalized.slice(0, normalized.length - suffix.length);
-				let bestMatchIndex = 0;
-				let bestMatchLength = -1;
-				let bestMatchGroups = -1;
-				let match;
-				while (match = regex.exec(string)) {
-					const groups = (match[0].match(/0/g) || []).length;
-					if (groups > bestMatchGroups) {
-						bestMatchGroups = groups;
-						bestMatchIndex = match.index;
-						bestMatchLength = match[0].length;
-					}
-				}
-				if (bestMatchLength < 0) return string + suffix;
-				return `${string.substring(0, bestMatchIndex)}::${string.substring(bestMatchIndex + bestMatchLength)}${suffix}`;
-			};
-			IPv6.prototype.toString = function() {
-				return this.toRFC5952String();
-			};
-			return IPv6;
-		})();
-		ipaddr.IPv6.broadcastAddressFromCIDR = function(string) {
-			try {
-				const cidr = this.parseCIDR(string);
-				const ipInterfaceOctets = cidr[0].toByteArray();
-				const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				const octets = [];
-				let i = 0;
-				while (i < 16) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv6 CIDR format", { cause: e });
-			}
-		};
-		ipaddr.IPv6.isIPv6 = function(string) {
-			return this.parser(string) !== null;
-		};
-		ipaddr.IPv6.isValid = function(string) {
-			if (typeof string === "string" && string.indexOf(":") === -1) return false;
-			try {
-				const addr = this.parser(string);
-				new this(addr.parts, addr.zoneId);
-				return true;
-			} catch {
-				return false;
-			}
-		};
-		ipaddr.IPv6.isValidCIDR = function(string) {
-			if (typeof string === "string" && string.indexOf(":") === -1) return false;
-			try {
-				this.parseCIDR(string);
-				return true;
-			} catch {
-				return false;
-			}
-		};
-		ipaddr.IPv6.networkAddressFromCIDR = function(string) {
-			let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
-			try {
-				cidr = this.parseCIDR(string);
-				ipInterfaceOctets = cidr[0].toByteArray();
-				subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
-				octets = [];
-				i = 0;
-				while (i < 16) {
-					octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
-					i++;
-				}
-				return new this(octets);
-			} catch (e) {
-				throw new Error("ipaddr: the address does not have IPv6 CIDR format", { cause: e });
-			}
-		};
-		ipaddr.IPv6.parse = function(string) {
-			const addr = this.parser(string);
-			if (addr === null) throw new Error("ipaddr: string is not formatted like an IPv6 Address");
-			return new this(addr.parts, addr.zoneId);
-		};
-		ipaddr.IPv6.parseCIDR = function(string) {
-			let maskLength, match, parsed;
-			if (match = string.match(/^(.+)\/(\d+)$/)) {
-				maskLength = parseInt(match[2]);
-				if (maskLength >= 0 && maskLength <= 128) {
-					parsed = [this.parse(match[1]), maskLength];
-					Object.defineProperty(parsed, "toString", { value: function() {
-						return this.join("/");
-					} });
-					return parsed;
-				}
-			}
-			throw new Error("ipaddr: string is not formatted like an IPv6 CIDR range");
-		};
-		ipaddr.IPv6.parser = function(string) {
-			let addr, i, match, octet, octets, zoneId;
-			if (match = string.match(ipv6Regexes.deprecatedTransitional)) return this.parser(`::ffff:${match[1]}`);
-			if (ipv6Regexes.native.test(string)) return expandIPv6(string, 8);
-			if (match = string.match(ipv6Regexes.transitional)) {
-				zoneId = match[6] || "";
-				addr = match[1];
-				if (!match[1].endsWith("::")) addr = addr.slice(0, -1);
-				addr = expandIPv6(addr + zoneId, 6);
-				if (addr && addr.parts) {
-					octets = [
-						parseInt(match[2]),
-						parseInt(match[3]),
-						parseInt(match[4]),
-						parseInt(match[5])
-					];
-					for (i = 0; i < octets.length; i++) {
-						octet = octets[i];
-						if (!(0 <= octet && octet <= 255)) return null;
-					}
-					addr.parts.push(octets[0] << 8 | octets[1]);
-					addr.parts.push(octets[2] << 8 | octets[3]);
-					return {
-						parts: addr.parts,
-						zoneId: addr.zoneId
-					};
-				}
-			}
-			return null;
-		};
-		ipaddr.IPv6.subnetMaskFromPrefixLength = function(prefix) {
-			prefix = parseInt(prefix);
-			if (Number.isNaN(prefix) || prefix < 0 || prefix > 128) throw new Error("ipaddr: invalid IPv6 prefix length");
-			const octets = [
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0
-			];
-			let j = 0;
-			const filledOctetCount = Math.floor(prefix / 8);
-			while (j < filledOctetCount) {
-				octets[j] = 255;
-				j++;
-			}
-			if (filledOctetCount < 16) octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
-			return new this(octets);
-		};
-		ipaddr.fromByteArray = function(bytes) {
-			const length = bytes.length;
-			if (length === 4) return new ipaddr.IPv4(bytes);
-			else if (length === 16) return new ipaddr.IPv6(bytes);
-			else throw new Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address");
-		};
-		ipaddr.isValid = function(string) {
-			return ipaddr.IPv6.isValid(string) || ipaddr.IPv4.isValid(string);
-		};
-		ipaddr.isValidCIDR = function(string) {
-			return ipaddr.IPv6.isValidCIDR(string) || ipaddr.IPv4.isValidCIDR(string);
-		};
-		ipaddr.parse = function(string) {
-			if (ipaddr.IPv6.isValid(string)) return ipaddr.IPv6.parse(string);
-			else if (ipaddr.IPv4.isValid(string)) return ipaddr.IPv4.parse(string);
-			else throw new Error("ipaddr: the address has neither IPv6 nor IPv4 format");
-		};
-		ipaddr.parseCIDR = function(string) {
-			try {
-				return ipaddr.IPv6.parseCIDR(string);
-			} catch {
-				try {
-					return ipaddr.IPv4.parseCIDR(string);
-				} catch (e) {
-					throw new Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format", { cause: e });
-				}
-			}
-		};
-		ipaddr.process = function(string) {
-			const addr = this.parse(string);
-			if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) return addr.toIPv4Address();
-			else return addr;
-		};
-		ipaddr.subnetMatch = function(address, rangeList, defaultName) {
-			let i, rangeName, rangeSubnets, subnet;
-			if (defaultName === void 0 || defaultName === null) defaultName = "unicast";
-			for (rangeName in rangeList) if (Object.prototype.hasOwnProperty.call(rangeList, rangeName)) {
-				rangeSubnets = rangeList[rangeName];
-				if (rangeSubnets[0] && !(rangeSubnets[0] instanceof Array)) rangeSubnets = [rangeSubnets];
-				for (i = 0; i < rangeSubnets.length; i++) {
-					subnet = rangeSubnets[i];
-					if (address.kind() === subnet[0].kind() && address.match.apply(address, subnet)) return rangeName;
-				}
-			}
-			return defaultName;
-		};
-		if (typeof module !== "undefined" && module.exports) module.exports = ipaddr;
-		else root.ipaddr = ipaddr;
-	})(this$1);
-})))(), 1);
 const WORKERS = {
 	"77.237.236.132": "dev",
 	"100.68.201.107": "dev",
 	"100.97.120.3": "desktop",
 	"100.115.207.60": "macbook-pro"
 };
-const LOCAL_RANGES = [
-	"linkLocal",
-	"loopback",
-	"private",
-	"uniqueLocal"
-];
+function parsedAddress(address) {
+	return pipe(getSuccess(ipFromString(address)), map$11((ip) => {
+		if (isIpv6Address(ip)) return getOrElse(fromIpv4Mapped(ip), () => ip);
+		return ip;
+	}));
+}
+function isPrivate(ip) {
+	if (isIpv4Address(ip)) return isPrivate$1(ip);
+	return isUniqueLocal(ip);
+}
 function addressGroup(address) {
-	if (!import_ipaddr.default.isValid(address)) return address;
-	const parsed = import_ipaddr.default.process(address);
-	if (parsed.kind() === "ipv4") return parsed.toString();
-	return join$2(take$3(split$1(parsed.toNormalizedString(), ":"), 4), ":");
+	return match$8(parsedAddress(address), {
+		onNone: () => address,
+		onSome: (ip) => {
+			if (isIpv4Address(ip)) return formatIp(ip);
+			return join$2(map$8(take$3(ipv6ToSegments(ip), 4), (segment) => segment.toString(16)), ":");
+		}
+	});
 }
 function clientAddress(headers, remote) {
 	return pipe(get$6(headers, "x-forwarded-for"), flatMap$7((forwarded) => last(split$1(",")(forwarded))), map$11(trim), filter$8(isNonEmpty$1), orElse$3(() => remote));
@@ -111937,7 +111089,7 @@ function browserLabel(origin) {
 }
 function deviceLabel(origin) {
 	return pipe(flatMap$7(fromUndefinedOr(origin.address), (address) => {
-		if (import_ipaddr.default.isValid(address) && contains(LOCAL_RANGES, import_ipaddr.default.process(address).range())) return some$1("dev");
+		if (exists(parsedAddress(address), (ip) => isLinkLocal(ip) || isLoopback(ip) || isPrivate(ip))) return some$1("dev");
 		return get$13(WORKERS, address);
 	}), orElse$3(() => flatMap$7(fromUndefinedOr(origin.userAgent), platform)), getOrElse(() => origin.address ?? "unknown"));
 }
@@ -112023,15 +111175,6 @@ function returnable(next, url) {
 }
 // src/services/passkeys/service.ts
 const LIFETIME = 3e5;
-function rejected$4(message) {
-	return mapError$2((cause) => {
-		if (is$2(AuthError)(cause)) return cause;
-		return AuthError.make({
-			cause,
-			message
-		});
-	});
-}
 function invalid(cause) {
 	return AuthError.make({
 		cause,
@@ -112109,10 +111252,10 @@ var Passkeys = class Passkeys extends Service$1()("@deslop/auth/services/passkey
 					transports,
 					user
 				}]);
-			}, rejected$4("Cannot add the passkey")),
+			}, rejected$1("Cannot add the passkey")),
 			forget: fn("Passkeys.forget")(function* (userId) {
 				yield* change((current) => filter$6(current, (found) => found.user.id !== userId));
-			}, rejected$4("Cannot remove the account’s passkeys")),
+			}, rejected$1("Cannot remove the account’s passkeys")),
 			list: (user) => map$3(changes(state), (current) => map$8(filter$6(current, (found) => found.user.id === user.id), (found) => ({
 				addedFrom: found.addedFrom,
 				createdAt: found.createdAt,
@@ -112148,17 +111291,17 @@ var Passkeys = class Passkeys extends Service$1()("@deslop/auth/services/passkey
 					expiresAt: now + LIFETIME
 				}));
 				return yield* decodeEffect(fromJsonString(CreationOptions))(yield* encodeUnknownEffect(fromJsonString(Unknown))(options));
-			}, rejected$4("Cannot start adding a passkey")),
+			}, rejected$1("Cannot start adding a passkey")),
 			remove: fn("Passkeys.remove")(function* (id, user) {
 				yield* change((current) => filter$6(current, (found) => found.id !== id || found.user.id !== user.id));
-			}, rejected$4("Cannot remove the passkey")),
+			}, rejected$1("Cannot remove the passkey")),
 			request: pipe(tryPromise({
 				catch: invalid,
 				try: () => generateAuthenticationOptions({
 					rpID,
 					userVerification: "required"
 				})
-			}), tap$1((options) => flatMap$2(currentTimeMillis, (now) => update$3(signingIn, (issued) => set$1(live$1(issued, now), options.challenge, { expiresAt: now + LIFETIME })))), flatMap$2(encodeUnknownEffect(fromJsonString(Unknown))), flatMap$2(decodeEffect(fromJsonString(RequestOptions))), rejected$4("Cannot start a passkey sign-in"), withSpan("Passkeys.request")),
+			}), tap$1((options) => flatMap$2(currentTimeMillis, (now) => update$3(signingIn, (issued) => set$1(live$1(issued, now), options.challenge, { expiresAt: now + LIFETIME })))), flatMap$2(encodeUnknownEffect(fromJsonString(Unknown))), flatMap$2(decodeEffect(fromJsonString(RequestOptions))), rejected$1("Cannot start a passkey sign-in"), withSpan("Passkeys.request")),
 			signIn: fn("Passkeys.signIn")(function* (response) {
 				const challenge = yield* challengeOf(response.response.clientDataJSON);
 				const now = yield* currentTimeMillis;
@@ -112191,21 +111334,12 @@ var Passkeys = class Passkeys extends Service$1()("@deslop/auth/services/passkey
 					};
 				}));
 				return found.user;
-			}, rejected$4("Cannot sign in with the passkey"))
+			}, rejected$1("Cannot sign in with the passkey"))
 		});
 	}));
 };
 // src/services/tokens/service.ts
 const SESSION_COOKIE = "__Secure-session";
-function rejected$3(message) {
-	return mapError$2((cause) => {
-		if (is$2(AuthError)(cause)) return cause;
-		return AuthError.make({
-			cause,
-			message
-		});
-	});
-}
 const expired$1 = AuthError.make({
 	error: "invalid_grant",
 	message: "The authorization expired. Sign in again."
@@ -112267,7 +111401,7 @@ var Tokens = class Tokens extends Service$1()("@deslop/auth/services/tokens/serv
 				user: found.grant.user,
 				via: found.grant.credential.via ?? "Code"
 			};
-		}, rejected$3("Sign in first"));
+		}, rejected$1("Sign in first"));
 		const session = fn("Tokens.session")(function* (headers) {
 			return (yield* browser(headers)).user;
 		});
@@ -112279,7 +111413,7 @@ var Tokens = class Tokens extends Service$1()("@deslop/auth/services/tokens/serv
 			const found = yield* grantOf(token);
 			if (found.grant.credential._tag !== "App" || !some(found.grant.credential.access, (entry) => entry.hash === found.hash && contains(entry.resources, resource))) return yield* AuthError.make({ message: "The token is not valid for this app" });
 			return found.grant.user;
-		}, rejected$3("Sign in first"));
+		}, rejected$1("Sign in first"));
 		const mint = fnUntraced(function* (family, generation, resources, now) {
 			const accessSecret = yield* secret(32);
 			const refreshSecret = yield* secret(32);
@@ -112435,22 +111569,22 @@ var Tokens = class Tokens extends Service$1()("@deslop/auth/services/tokens/serv
 					if (!exists(get$13(current, family), (grant) => grant.user.id === user.id)) return yield* AuthError.make({ message: "This sign-in has already ended" });
 					return [void 0, remove$6(current, family)];
 				}));
-			}, rejected$3("Cannot sign this out")),
+			}, rejected$1("Cannot sign this out")),
 			endSession: fn("Tokens.endSession")(function* (headers) {
 				const found = yield* option$1(grantOf(parseHeader(headers["cookie"] ?? "")["__Secure-session"] ?? ""));
 				yield* match$8(filter$8(found, (current) => current.grant.credential.hash === current.hash), {
 					onNone: () => void_$1,
 					onSome: (own) => change((saved) => succeed$5([void 0, remove$6(saved, own.family)]))
 				});
-			}, rejected$3("Cannot sign out")),
+			}, rejected$1("Cannot sign out")),
 			exchange: fn("Tokens.exchange")(function* (params, origin, allowed) {
 				if (params.grant_type === "authorization_code") return yield* redeem(params, origin, allowed);
 				return yield* rotate(params, origin, allowed);
-			}, rejected$3("Invalid token request")),
+			}, rejected$1("Invalid token request")),
 			forget: fn("Tokens.forget")(function* (id) {
 				yield* change((current) => succeed$5([void 0, filter$7(current, (grant) => grant.user.id !== id)]));
 				yield* update$3(codes, filter((entry) => entry.state._tag === "Used" || entry.state.user.id !== id));
-			}, rejected$3("Cannot sign this account out")),
+			}, rejected$1("Cannot sign this account out")),
 			issue: fn("Tokens.issue")(function* (request, user) {
 				const code = yield* secret(32);
 				const key = yield* hash(code);
@@ -112464,7 +111598,7 @@ var Tokens = class Tokens extends Service$1()("@deslop/auth/services/tokens/serv
 					}
 				}));
 				return code;
-			}, rejected$3("Cannot issue the authorization code")),
+			}, rejected$1("Cannot issue the authorization code")),
 			revoke: fn("Tokens.revoke")(function* (params) {
 				yield* match$8(parts(params.token), {
 					onNone: () => void_$1,
@@ -112476,7 +111610,7 @@ var Tokens = class Tokens extends Service$1()("@deslop/auth/services/tokens/serv
 						})]));
 					})
 				});
-			}, rejected$3("Cannot revoke the token")),
+			}, rejected$1("Cannot revoke the token")),
 			session,
 			sessionVia,
 			startSession: fn("Tokens.startSession")(function* (user, origin, via) {
@@ -112505,7 +111639,7 @@ var Tokens = class Tokens extends Service$1()("@deslop/auth/services/tokens/serv
 					seconds,
 					token: `${family}.${sessionSecret}`
 				};
-			}, rejected$3("Cannot start the session"))
+			}, rejected$1("Cannot start the session"))
 		});
 	}));
 };
@@ -112515,15 +111649,6 @@ const ROLE_ORDER = {
 	Member: 2,
 	Waiting: 1
 };
-function rejected$2(message) {
-	return mapError$2((cause) => {
-		if (is$2(AuthError)(cause)) return cause;
-		return AuthError.make({
-			cause,
-			message
-		});
-	});
-}
 function memberOf(github, since, status) {
 	return {
 		fullName: github.name ?? "",
@@ -112543,16 +111668,12 @@ var People = class People extends Service$1()("@deslop/auth/services/people/serv
 		const tokens = yield* Tokens;
 		const passkeys = yield* Passkeys;
 		const github = yield* GitHub;
-		const listed = Array$1(String$6, "GITHUB_ADMINS");
-		const admins = yield* match$1(yield* localAuth, {
-			onFalse: () => listed,
-			onTrue: () => withDefault$2(listed, ["0"])
-		});
+		const admins = yield* adminIds;
 		const transact = fnUntraced(function* (change) {
 			return yield* modifyEffect(state, (current) => tap$1(change(current), (result) => store.set("members", result[1])));
 		}, uninterruptible);
 		function roleOf(id, row) {
-			if (contains(admins, replace("github:", "")(id))) return "Admin";
+			if (isAdmin(admins, id)) return "Admin";
 			if (exists(row, (found) => found.status === "Allowed")) return "Member";
 			return "Waiting";
 		}
@@ -112578,7 +111699,7 @@ var People = class People extends Service$1()("@deslop/auth/services/people/serv
 			return user;
 		});
 		const admin = fnUntraced(function* (user) {
-			if (roleOf(user.id, none()) !== "Admin") return yield* AuthError.make({
+			if (!isAdmin(admins, user.id)) return yield* AuthError.make({
 				error: "access_denied",
 				message: "Only an admin can manage people"
 			});
@@ -112592,7 +111713,7 @@ var People = class People extends Service$1()("@deslop/auth/services/people/serv
 				role: "Admin",
 				since: 0
 			})), ...known], mapInput(Order$4, (person) => ROLE_ORDER[person.role]));
-		}, rejected$2("Cannot read people"));
+		}, rejected$1("Cannot read people"));
 		yield* pipe(forEach$1(admins, fnUntraced(function* (id) {
 			if (isSome(member(`github:${id}`, yield* get(state)))) return;
 			const profile = yield* github.profile(id);
@@ -112622,7 +111743,7 @@ var People = class People extends Service$1()("@deslop/auth/services/people/serv
 						via: session.via
 					})
 				});
-			}), rejected$2("Cannot read the account")))),
+			}), rejected$1("Cannot read the account")))),
 			admin,
 			admit: fn("People.admit")(function* (params, user) {
 				yield* admin(user);
@@ -112649,7 +111770,7 @@ var People = class People extends Service$1()("@deslop/auth/services/people/serv
 					yield* passkeys.forget(params.id);
 				}
 				return person;
-			}, rejected$2("Cannot answer the access request")),
+			}, rejected$1("Cannot answer the access request")),
 			allowed: fn("People.allowed")(allowed),
 			list,
 			people: (user) => mapEffect$1(changes(state), () => list(user)),
@@ -112675,7 +111796,7 @@ var People = class People extends Service$1()("@deslop/auth/services/people/serv
 						})
 					})]);
 				});
-			}, rejected$2("Cannot record the GitHub account")),
+			}, rejected$1("Cannot record the GitHub account")),
 			remove: fn("People.remove")(function* (id, user) {
 				yield* admin(user);
 				if (roleOf(id, none()) === "Admin") return yield* AuthError.make({ message: "Admins come from GITHUB_ADMINS, so they cannot be removed here" });
@@ -112684,7 +111805,7 @@ var People = class People extends Service$1()("@deslop/auth/services/people/serv
 				yield* tokens.forget(id);
 				yield* passkeys.forget(id);
 				return found;
-			}, rejected$2("Cannot remove this account"))
+			}, rejected$1("Cannot remove this account"))
 		});
 		return pipe(make$85(People, people), merge$4(Auth.makeContext(Auth.of({
 			access: fn("Auth.access")(function* (headers, resource) {
@@ -120006,15 +119127,6 @@ const waitFor = waitFor$1;
 const start = start$1;
 // src/services/sign-ins/service.ts
 const REQUEST_COOKIE = "__Host-request-";
-function rejected$1(message) {
-	return mapError$2((cause) => {
-		if (is$2(AuthError)(cause)) return cause;
-		return AuthError.make({
-			cause,
-			message
-		});
-	});
-}
 const expired = AuthError.make({ message: "This sign-in expired. Start it again in the app." });
 const notWaiting = AuthError.make({ message: "No waiting sign-in has this code: it is mistyped, already answered or expired after 10 minutes. Read the code again from the page or command that is still waiting; start a new sign-in only if none is." });
 const deliver = fnUntraced(function* (input) {
@@ -120273,7 +119385,6 @@ const COOKIE = {
 	secure: true
 };
 const LOGIN_COOKIE = "__Host-login";
-const ISSUER = `${AUTH_URL}/api/auth`;
 function sessionCookie(local) {
 	if (local) return {
 		...COOKIE,
@@ -120284,15 +119395,6 @@ function sessionCookie(local) {
 		domain: cookieDomain(AUTH_URL)
 	};
 }
-function rejected(message) {
-	return mapError$2((cause) => {
-		if (is$2(AuthError)(cause)) return cause;
-		return AuthError.make({
-			cause,
-			message
-		});
-	});
-}
 function oauth(handler) {
 	return pipe(handler, catchIf(is$2(AuthError), (failure) => succeed$5(jsonUnsafe({
 		error: failure.error ?? "invalid_request",
@@ -120302,6 +119404,9 @@ function oauth(handler) {
 function originOf(request) {
 	return originFrom(request.headers, request.remoteAddress);
 }
+function answered(answer) {
+	return pipe(answer, flatMap$2((user) => schemaJson(User)(user, { headers: { "cache-control": "no-store" } })), orElseSucceed(() => empty({ status: 401 })));
+}
 function waitingAt(started) {
 	return setCookieUnsafe(redirect(`/?request=${started.code}`), `${REQUEST_COOKIE}${started.code}`, started.receiver, {
 		...COOKIE,
@@ -120366,11 +119471,11 @@ const HttpHandlers = use((router) => gen(function* () {
 			}));
 		});
 	}
-	yield* router.add("POST", "/api/apps", limited("apps", 10)(pipe(gen(function* () {
-		const params = yield* pipe(schemaBodyJson(AppParams), rejected("Send the app’s origin"));
+	yield* router.add("POST", APPS_PATH, limited("apps", 10)(pipe(gen(function* () {
+		const params = yield* pipe(schemaBodyJson(AppParams), rejected$1("Send the app’s origin"));
 		return yield* schemaJson(App)(yield* apps.register(params.origin));
 	}), catchIf(is$2(AuthError), (failure) => succeed$5(text(failure.message, { status: 403 }))))));
-	yield* router.add("GET", "/.well-known/oauth-authorization-server/api/auth", jsonUnsafe({
+	yield* router.add("GET", `/.well-known/oauth-authorization-server${ISSUER_PATH}`, jsonUnsafe({
 		authorization_endpoint: `${ISSUER}/oauth2/authorize`,
 		authorization_response_iss_parameter_supported: true,
 		code_challenge_methods_supported: ["S256"],
@@ -120383,7 +119488,7 @@ const HttpHandlers = use((router) => gen(function* () {
 		token_endpoint: `${ISSUER}/oauth2/token`,
 		token_endpoint_auth_methods_supported: ["none"]
 	}));
-	yield* router.add("POST", "/api/auth/oauth2/register", limited("register", 10)(oauth(gen(function* () {
+	yield* router.add("POST", `${ISSUER_PATH}/oauth2/register`, limited("register", 10)(oauth(gen(function* () {
 		const params = yield* pipe(schemaBodyJson(Registration$1), mapError$2((cause) => AuthError.make({
 			cause,
 			error: "invalid_client_metadata",
@@ -120406,11 +119511,11 @@ const HttpHandlers = use((router) => gen(function* () {
 			token_endpoint_auth_method: "none"
 		}, { status: 201 });
 	}))));
-	yield* router.add("GET", "/api/auth/oauth2/authorize", limited("authorize", 20)(oauth(gen(function* () {
+	yield* router.add("GET", `${ISSUER_PATH}/oauth2/authorize`, limited("authorize", 20)(oauth(gen(function* () {
 		const request = yield* HttpServerRequest;
-		const asked = yield* pipe(schemaSearchParams(AuthorizeClient), rejected("The authorization request names no client_id"));
+		const asked = yield* pipe(schemaSearchParams(AuthorizeClient), rejected$1("The authorization request names no client_id"));
 		const client = yield* tokens.client(asked);
-		return yield* pipe(schemaSearchParams(AuthorizeParams), rejected("Invalid authorization request"), flatMap$2((params) => clientRequest(asked, client, params)), flatMap$2((checked) => signIns.start({
+		return yield* pipe(schemaSearchParams(AuthorizeParams), rejected$1("Invalid authorization request"), flatMap$2((params) => clientRequest(asked, client, params)), flatMap$2((checked) => signIns.start({
 			_tag: "Client",
 			request: checked
 		}, originOf(request))), map$5(waitingAt), catchIf(is$2(AuthError), (failure) => succeed$5(redirect(callbackUrl({
@@ -120421,13 +119526,13 @@ const HttpHandlers = use((router) => gen(function* () {
 			error_description: failure.message
 		})))));
 	}))));
-	yield* router.add("POST", "/api/auth/oauth2/token", limited("token", 60)(oauth(gen(function* () {
-		const grant = yield* pipe(schemaBodyUrlParams(TokenGrant), rejected("Send a grant_type"));
+	yield* router.add("POST", `${ISSUER_PATH}/oauth2/token`, limited("token", 60)(oauth(gen(function* () {
+		const grant = yield* pipe(schemaBodyUrlParams(TokenGrant), rejected$1("Send a grant_type"));
 		if (grant.grant_type !== "authorization_code" && grant.grant_type !== "refresh_token") return yield* AuthError.make({
 			error: "unsupported_grant_type",
 			message: "Use grant_type authorization_code or refresh_token"
 		});
-		return valueTags(yield* tokens.exchange(yield* pipe(schemaBodyUrlParams(TokenParams), rejected("Invalid token request")), originOf(yield* HttpServerRequest), people.allowed), {
+		return valueTags(yield* tokens.exchange(yield* pipe(schemaBodyUrlParams(TokenParams), rejected$1("Invalid token request")), originOf(yield* HttpServerRequest), people.allowed), {
 			Granted: (granted) => jsonUnsafe(granted.tokens),
 			Replayed: (replayed) => jsonUnsafe({
 				error: "invalid_grant",
@@ -120435,31 +119540,31 @@ const HttpHandlers = use((router) => gen(function* () {
 			}, { status: 400 })
 		});
 	}))));
-	yield* router.add("POST", "/api/auth/oauth2/revoke", limited("revoke", 60)(oauth(gen(function* () {
-		yield* tokens.revoke(yield* pipe(schemaBodyUrlParams(RevokeParams), rejected("Invalid revocation request")));
+	yield* router.add("POST", `${ISSUER_PATH}/oauth2/revoke`, limited("revoke", 60)(oauth(gen(function* () {
+		yield* tokens.revoke(yield* pipe(schemaBodyUrlParams(RevokeParams), rejected$1("Invalid revocation request")));
 		return empty();
 	}))));
-	yield* router.add("GET", "/auth/session", pipe(flatMap$2(HttpServerRequest, (request) => auth.user(request.headers)), flatMap$2((user) => schemaJson(User)(user, { headers: { "cache-control": "no-store" } })), orElseSucceed(() => empty({ status: 401 }))));
-	yield* router.add("GET", "/auth/verify", pipe(gen(function* () {
+	yield* router.add("GET", SESSION_PATH, answered(flatMap$2(HttpServerRequest, (request) => auth.user(request.headers))));
+	yield* router.add("GET", VERIFY_PATH, answered(gen(function* () {
 		const params = yield* schemaSearchParams(VerificationParams);
 		return yield* auth.access((yield* HttpServerRequest).headers, params.resource);
-	}), flatMap$2((user) => schemaJson(User)(user, { headers: { "cache-control": "no-store" } })), orElseSucceed(() => empty({ status: 401 }))));
+	})));
 	yield* router.add("GET", "/auth/github", limited("github", 10)(oauth(gen(function* () {
-		const started = yield* github.start(yield* pipe(schemaSearchParams(SignInParams), rejected("Invalid sign-in request")));
+		const started = yield* github.start(yield* pipe(schemaSearchParams(SignInParams), rejected$1("Invalid sign-in request")));
 		return setCookieUnsafe(redirect(started.url), LOGIN_COOKIE, started.state, {
 			...COOKIE,
 			maxAge: "10 minutes"
 		});
 	}))));
 	yield* router.add("GET", "/auth/github/callback", pipe(gen(function* () {
-		const params = yield* pipe(schemaSearchParams(CallbackParams), rejected("GitHub sent no code"));
+		const params = yield* pipe(schemaSearchParams(CallbackParams), rejected$1("GitHub sent no code"));
 		if ((yield* HttpServerRequest).cookies[LOGIN_COOKIE] !== params.state) return yield* AuthError.make({ message: "The sign-in state does not match" });
 		const request = yield* HttpServerRequest;
 		const finished = yield* github.finish(params.code, params.state);
 		return yield* pipe(people.register(finished.profile), tap$1(() => tokens.endSession(request.headers)), flatMap$2((user) => tokens.startSession(user, originOf(request), "GitHub")), map$5((started) => pipe(redirect(returnTo(finished.flow)), expireCookieUnsafe(LOGIN_COOKIE, COOKIE), setCookieUnsafe(SESSION_COOKIE, started.token, session(started.seconds)))), catch_$2((cause) => githubFailed(cause, some$1(finished.flow))));
 	}), catch_$2((cause) => flatMap$2(option$1(flatMap$2(schemaSearchParams(LoginState), (found) => github.cancel(found.state))), (flow) => githubFailed(cause, flow)))));
 	yield* router.add("GET", "/auth/code", limited("code", 20)(oauth(gen(function* () {
-		const next = (yield* pipe(schemaSearchParams(BrowserParams), rejected("Invalid sign-in request"))).next;
+		const next = (yield* pipe(schemaSearchParams(BrowserParams), rejected$1("Invalid sign-in request"))).next;
 		return waitingAt(yield* signIns.start({
 			_tag: "Browser",
 			...pipe(fromUndefinedOr(next), filter$8((page) => returnable(page, AUTH_URL)), match$8({
@@ -120471,7 +119576,7 @@ const HttpHandlers = use((router) => gen(function* () {
 	yield* router.add("GET", "/auth/passkey", limited("passkey", 20)(oauth(map$5(passkeys.request, (options) => jsonUnsafe(options)))));
 	yield* router.add("POST", "/auth/passkey", limited("passkey", 20)(oauth(gen(function* () {
 		const request = yield* HttpServerRequest;
-		const input = yield* pipe(schemaBodyJson(PasskeySignIn), rejected("Send the passkey’s answer"));
+		const input = yield* pipe(schemaBodyJson(PasskeySignIn), rejected$1("Send the passkey’s answer"));
 		const started = yield* tokens.startSession(yield* people.allowed(yield* passkeys.signIn(input.response)), originOf(request), "Passkey");
 		return setCookieUnsafe(jsonUnsafe(match$8(filter$8(fromUndefinedOr(input.next), (page) => returnable(page, AUTH_URL)), {
 			onNone: () => ({}),
@@ -120480,7 +119585,7 @@ const HttpHandlers = use((router) => gen(function* () {
 	}))));
 	yield* router.add("GET", "/auth/continue", pipe(gen(function* () {
 		const request = yield* HttpServerRequest;
-		const params = yield* pipe(schemaSearchParams(RequestParams), rejected("Name the sign-in"));
+		const params = yield* pipe(schemaSearchParams(RequestParams), rejected$1("Name the sign-in"));
 		const collected = yield* signIns.collect(params.request, request.headers);
 		const cookie = `${REQUEST_COOKIE}${typedCode(params.request)}`;
 		return valueTags(collected, {
@@ -120491,7 +119596,7 @@ const HttpHandlers = use((router) => gen(function* () {
 				status: 408
 			})
 		});
-	}), rejected("Cannot complete the sign-in"), catch_$2((failure) => succeed$5(text(failure.message, { status: 400 }))), map$5(setHeader("cache-control", "no-store"))));
+	}), rejected$1("Cannot complete the sign-in"), catch_$2((failure) => succeed$5(text(failure.message, { status: 400 }))), map$5(setHeader("cache-control", "no-store"))));
 	yield* router.add("POST", "/auth/sign-out", oauth(gen(function* () {
 		yield* tokens.endSession((yield* HttpServerRequest).headers);
 		return expireCookieUnsafe(empty(), SESSION_COOKIE, sessionCookie(local));
@@ -120614,20 +119719,19 @@ const ToolHandlers = Tools.toLayer(gen(function* () {
 		return yield* signIns.answer(input, yield* CurrentUser, "Token");
 	}) });
 }));
-const layerMcp = layerMcp$1({
-	instructions: "Approve a sign-in you started with answer_request.",
-	registrations: pipe(toolkit(Tools), provide$2(ToolHandlers))
-});
 // src/main.server.ts
 const layerServices = pipe(mergeAll$1(SignIns.layer, layer$3), provideMerge(People.layer), provideMerge(mergeAll$1(Tokens.layer, Passkeys.layer, GitHub.layer, Apps.layer, layerStoreMemory)), provide$2(layerDataStore), provide$2(succeed$6(RequestInit, { redirect: "error" })));
 runApp({
 	icon: icon_default,
 	middleware: (app) => map$5(app, setHeader("content-security-policy", "frame-ancestors 'none'")),
-	routes: pipe(mergeAll$1(HttpHandlers, pipe(layerHttp$1({
+	routes: pipe(mergeAll$1(HttpHandlers, layerRpc({
 		group: RpcContracts,
-		path: "/api/rpc",
-		protocol: "websocket"
-	}), provide$2(RpcHandlers)), layerMcp), provide$2(layerServices)),
+		handlers: RpcHandlers
+	}), layerMcp({
+		handlers: ToolHandlers,
+		instructions: "Approve a sign-in you started with answer_request.",
+		tools: Tools
+	})), provide$2(layerServices)),
 	settings: {
 		GITHUB_ADMINS: ADMINS,
 		GITHUB_CLIENT_ID: {