domainkit 0.10.0 → 0.12.0

package/dist/Server.mjs

@@ -5,12 +5,13 @@ import { InvalidInput, NotFound } from "./Reason.mjs";
 import { DomainKitError, fail } from "./internal/error.mjs";
 import { ApprovalId, Model as Model$2 } from "./Approval.mjs";
 import { Service } from "./Principal.mjs";
+import { Service as Service$1 } from "./Providers.mjs";
 import { Model as Model$3, ReceiptId } from "./Receipt.mjs";
-import { AttemptStatus, AuthMethod, Overall, Rejection, RequirementStatus, Service as Service$1 } from "./Storage.mjs";
-import { Method as Method$1, Service as Service$2 } from "./Connect.mjs";
-import { Service as Service$3 } from "./Provision.mjs";
-import { Service as Service$4 } from "./Cleanup.mjs";
-import { Evidence, HostEvidence, Service as Service$5 } from "./Verify.mjs";
+import { AttemptStatus, AuthMethod, Overall, Rejection, RequirementStatus, Service as Service$2 } from "./Storage.mjs";
+import { Method as Method$1, Service as Service$3 } from "./Connect.mjs";
+import { Service as Service$4 } from "./Provision.mjs";
+import { Service as Service$5 } from "./Cleanup.mjs";
+import { Evidence, HostEvidence, Service as Service$6 } from "./Verify.mjs";
 import { Context, Effect, Layer, Option, Schema } from "effect";
 import * as HttpRouter from "effect/unstable/http/HttpRouter";
 import * as HttpServer from "effect/unstable/http/HttpServer";
@@ -37,6 +38,7 @@ import * as HttpApiSchema from "effect/unstable/httpapi/HttpApiSchema";
 var Server_exports = /* @__PURE__ */ __exportAll({
 	ApprovePayload: () => ApprovePayload,
 	AttachPayload: () => AttachPayload,
+	Attachment: () => Attachment,
 	Attempt: () => Attempt,
 	Candidate: () => Candidate,
 	Connected: () => Connected,
@@ -54,6 +56,7 @@ var Server_exports = /* @__PURE__ */ __exportAll({
 	ObservePayload: () => ObservePayload,
 	PlanPayload: () => PlanPayload,
 	Readiness: () => Readiness,
+	ReconnectPayload: () => ReconnectPayload,
 	Redirect: () => Redirect,
 	RejectPayload: () => RejectPayload,
 	SelectionRequired: () => SelectionRequired,
@@ -61,6 +64,8 @@ var Server_exports = /* @__PURE__ */ __exportAll({
 	StartPayload: () => StartPayload,
 	Started: () => Started,
 	Token: () => Token,
+	Zone: () => Zone,
+	Zones: () => Zones,
 	api: () => api,
 	group: () => group,
 	layer: () => layer,
@@ -86,14 +91,21 @@ const MethodDescriptor = Schema.Struct({
 	fields: Schema.NullOr(Schema.Array(Field))
 });
 /** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */
+/** The attachment a domain holds, with the zone label the provider gave when it was created. */
+const Attachment = Schema.Struct({
+	id: Schema.String,
+	label: Schema.String
+});
 const Snapshot = Schema.Struct({
 	domain: Schema.String,
-	attachmentId: Schema.NullOr(Schema.String),
+	attachment: Schema.NullOr(Attachment),
 	connectionId: Schema.NullOr(Schema.String),
 	provider: Schema.NullOr(Schema.String),
 	method: Schema.NullOr(AuthMethod),
 	status: ConnectionStatus,
 	lastReceiptId: Schema.NullOr(Schema.String),
+	/** How many domains the connection serves, including this one; `0` without a connection. */
+	connectionDomains: Schema.Number,
 	reusable: Schema.Array(Schema.Struct({
 		connectionId: Schema.String,
 		provider: Schema.String,
@@ -118,17 +130,30 @@ const Method = Schema.Union([
 	OAuth,
 	Integration
 ]);
+/** A start without a domain connects the account alone; the customer picks a zone afterwards. */
 const StartPayload = Schema.Struct({
-	domain: Schema.String,
+	domain: Schema.optionalKey(Schema.String),
 	provider: Schema.String,
 	method: Method
 });
+/** How the customer proves the account again. The provider is the connection's own. */
+const ReconnectPayload = Schema.Struct({ method: Method });
 /** A zone the connection can serve, named for a customer to pick from. */
 var Candidate = class extends Schema.Class("@domainkit/server/Candidate")({
 	zone: Schema.String,
 	label: Schema.String
 }) {};
-var Connected = class extends Schema.TaggedClass("@domainkit/server/Started/Connected")("Connected", { snapshot: Snapshot }) {};
+/**
+* The connection the start produced. `label` names the account the way the customer will read it:
+* the attached zone's label, or the provider's name when the start carried no domain. `snapshot`
+* is the domain's state, and is null for a start that attached none.
+*/
+var Connected = class extends Schema.TaggedClass("@domainkit/server/Started/Connected")("Connected", {
+	connectionId: Schema.String,
+	provider: Schema.String,
+	label: Schema.String,
+	snapshot: Schema.NullOr(Snapshot)
+}) {};
 var Redirect = class extends Schema.TaggedClass("@domainkit/server/Started/Redirect")("Redirect", { authorizationUrl: Schema.String }) {};
 var SelectionRequired = class extends Schema.TaggedClass("@domainkit/server/Started/SelectionRequired")("SelectionRequired", {
 	connectionId: Schema.String,
@@ -164,6 +189,32 @@ const Discovery = Schema.Union([
 	DiscoverySelectionRequired,
 	DiscoveryNotFound
 ]);
+/** One zone a connection reaches, named for a customer to pick from. */
+const Zone = Schema.Struct({
+	connectionId: Schema.String,
+	provider: Schema.String,
+	zone: Schema.String,
+	label: Schema.String,
+	nameservers: Schema.optionalKey(Schema.Array(Schema.String))
+});
+/**
+* Every zone the principal's connections reach, and where each connection stands. A connection
+* marked `reconnect` contributes no zones and needs the customer to authorize it again.
+*/
+const Zones = Schema.Struct({
+	zones: Schema.Array(Zone),
+	connections: Schema.Array(Schema.Struct({
+		connectionId: Schema.String,
+		provider: Schema.String,
+		status: ConnectionStatus
+	})),
+	/** Every provider a customer could connect, so a picker offers one without a second call. */
+	providers: Schema.Array(Schema.Struct({
+		id: Schema.String,
+		name: Schema.String,
+		methods: Schema.Array(MethodDescriptor)
+	}))
+});
 const AttachPayload = Schema.Struct({
 	domain: Schema.String,
 	/** Which candidate zone to attach when `SelectionRequired` came back. */
@@ -224,6 +275,10 @@ const group = HttpApiGroup.make("domainkit").add(HttpApiEndpoint.get("inspect",
 	params: { domain: Schema.String },
 	success: Discovery,
 	error: errors
+})).add(HttpApiEndpoint.get("zones", "/zones", {
+	query: { provider: Schema.optionalKey(Schema.String) },
+	success: Zones,
+	error: errors
 })).add(HttpApiEndpoint.post("start", "/connections", {
 	payload: StartPayload,
 	success: Started,
@@ -236,6 +291,11 @@ const group = HttpApiGroup.make("domainkit").add(HttpApiEndpoint.get("inspect",
 	},
 	success: Redirected,
 	error: errors
+})).add(HttpApiEndpoint.post("reconnect", "/connections/:connectionId/reconnections", {
+	params: { connectionId: Schema.String },
+	payload: ReconnectPayload,
+	success: Started,
+	error: errors
 })).add(HttpApiEndpoint.post("attach", "/connections/:connectionId/attachments", {
 	params: { connectionId: Schema.String },
 	payload: AttachPayload,
@@ -287,6 +347,7 @@ const group = HttpApiGroup.make("domainkit").add(HttpApiEndpoint.get("inspect",
 	error: errors
 }));
 const START_ROUTE = "/connections";
+const reconnectRoute = (connectionId) => `/connections/${encodeURIComponent(connectionId)}/reconnections`;
 const callbackRoute = (provider) => `/callback/${encodeURIComponent(provider)}`;
 const invalid = (message, field) => fail(new InvalidInput({
 	message,
@@ -339,12 +400,16 @@ const sameOrigin = (destination, callback) => {
 };
 const snapshotOf = (snapshot) => ({
 	domain: snapshot.domain,
-	attachmentId: snapshot.attachment?.id ?? null,
+	attachment: snapshot.attachment === null ? null : {
+		id: snapshot.attachment.id,
+		label: snapshot.attachment.label
+	},
 	connectionId: snapshot.connection?.id ?? null,
 	provider: snapshot.authorization?.provider ?? null,
 	method: snapshot.authorization?.method ?? null,
 	status: snapshot.connection === null ? "disconnected" : snapshot.authorization?.revocation === "active" ? "connected" : "reconnect",
 	lastReceiptId: snapshot.lastReceiptId,
+	connectionDomains: snapshot.connectionDomains,
 	reusable: snapshot.reusable.map(({ connection, provider, method }) => ({
 		connectionId: connection.id,
 		provider,
@@ -374,11 +439,12 @@ const candidatesOf = (candidates) => candidates.map(({ zone, label }) => new Can
 */
 const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (handlers) => Effect.gen(function* () {
 	const identity = yield* Identity;
-	const connect = yield* Service$2;
-	const provision = yield* Service$3;
-	const cleanup = yield* Service$4;
-	const verify = yield* Service$5;
-	const storage = yield* Service$1;
+	const connect = yield* Service$3;
+	const provision = yield* Service$4;
+	const cleanup = yield* Service$5;
+	const verify = yield* Service$6;
+	const storage = yield* Service$2;
+	const providers = yield* Service$1;
 	/**
 	* Run a lifecycle effect as the principal the host derives from this request, once the host
 	* has allowed that principal onto this route.
@@ -403,10 +469,27 @@ const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (han
 			});
 		}
 	};
-	const connected = (domain) => Effect.map(snapshot(domain), (value) => new Connected({ snapshot: value }));
+	/**
+	* The connection a start or an attach produced. `label` is the zone the attachment named,
+	* or the provider itself where the connection carries no domain yet.
+	*/
+	const connected = (input) => Effect.gen(function* () {
+		const authorization = yield* storage.authorizations.get(input.connection.authorizationId);
+		const definition = yield* providers.get(authorization.provider);
+		return new Connected({
+			connectionId: input.connection.id,
+			provider: authorization.provider,
+			label: input.attachment?.label ?? definition.name,
+			snapshot: input.domain === void 0 ? null : yield* snapshot(input.domain)
+		});
+	});
 	const startedOf = (started, domain) => {
 		switch (started._tag) {
-			case "Connected": return connected(domain);
+			case "Connected": return connected({
+				attachment: started.attachment,
+				connection: started.connection,
+				domain
+			});
 			case "Redirect": return Effect.succeed(new Redirect({ authorizationUrl: started.authorizationUrl }));
 			case "SelectionRequired": return Effect.succeed(new SelectionRequired({
 				connectionId: started.connection.id,
@@ -419,11 +502,17 @@ const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (han
 	* behind a zone never crosses the wire, so resolve the candidates again and match by zone.
 	*/
 	const attachAt = (input) => Effect.gen(function* () {
+		const connection = yield* storage.connections.get(input.connectionId);
+		const attached = (attachment) => connected({
+			attachment,
+			connection,
+			domain: input.domain
+		});
 		const first = yield* connect.attach({
 			connectionId: input.connectionId,
 			domain: input.domain
 		});
-		if (!("_tag" in first)) return yield* connected(input.domain);
+		if (!("_tag" in first)) return yield* attached(first);
 		if (input.zone === void 0) return new SelectionRequired({
 			connectionId: input.connectionId,
 			candidates: candidatesOf(first.candidates)
@@ -433,16 +522,29 @@ const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (han
 			entity: "zone",
 			id: input.zone
 		}));
-		yield* connect.attach({
+		const second = yield* connect.attach({
 			connectionId: input.connectionId,
 			domain: input.domain,
 			target
 		});
-		return yield* connected(input.domain);
+		return "_tag" in second ? yield* fail(new NotFound({
+			entity: "zone",
+			id: input.zone
+		})) : yield* attached(second);
 	});
 	/** Provisioning and cleanup share the approve and apply routes; the attempt knows its kind. */
 	const kindOf = (attempt) => attempt.kind === "cleanup" ? cleanup : provision;
-	return handlers.handle("inspect", ({ params, request }) => as("inspect", request, snapshot(params.domain))).handle("discover", ({ params, request }) => as("discover", request, Effect.map(connect.discover(params.domain), discovered))).handle("start", ({ payload, request }) => as("start", request, Effect.gen(function* () {
+	return handlers.handle("inspect", ({ params, request }) => as("inspect", request, snapshot(params.domain))).handle("discover", ({ params, request }) => as("discover", request, Effect.map(connect.discover(params.domain), discovered))).handle("zones", ({ query, request }) => as("zones", request, Effect.map(connect.zones(query.provider === void 0 ? {} : { provider: query.provider }), (listing) => ({
+		zones: listing.zones.map(({ connectionId, provider, target }) => ({
+			connectionId,
+			provider,
+			zone: target.zone,
+			label: target.label,
+			...target.nameservers === void 0 ? {} : { nameservers: target.nameservers }
+		})),
+		connections: listing.connections,
+		providers: listing.providers
+	})))).handle("start", ({ payload, request }) => as("start", request, Effect.gen(function* () {
 		const callbackUrl = payload.method._tag === "Token" ? void 0 : (yield* callbackUrlFor({
 			request,
 			provider: payload.provider,
@@ -451,11 +553,26 @@ const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (han
 		})).toString();
 		const started = yield* connect.start({
 			provider: payload.provider,
-			domain: payload.domain,
+			...payload.domain === void 0 ? {} : { domain: payload.domain },
 			method: methodOf(payload.method),
 			...callbackUrl === void 0 ? {} : { callbackUrl }
 		});
 		return yield* startedOf(started, payload.domain);
+	}))).handle("reconnect", ({ params, payload, request }) => as("reconnect", request, Effect.gen(function* () {
+		const connection = yield* storage.connections.get(params.connectionId);
+		const authorization = yield* storage.authorizations.get(connection.authorizationId);
+		const callbackUrl = payload.method._tag === "Token" ? void 0 : (yield* callbackUrlFor({
+			request,
+			provider: authorization.provider,
+			options,
+			route: reconnectRoute(params.connectionId)
+		})).toString();
+		const started = yield* connect.reconnect({
+			connectionId: params.connectionId,
+			method: methodOf(payload.method),
+			...callbackUrl === void 0 ? {} : { callbackUrl }
+		});
+		return yield* startedOf(started, void 0);
 	}))).handle("callback", ({ params, query, request }) => as("callback", request, Effect.gen(function* () {
 		const url = yield* absoluteUrl(request);
 		const base = yield* callbackUrlFor({
@@ -518,6 +635,6 @@ const toWebHandler = (services, options = {}) => {
 	return HttpRouter.toWebHandler(app, { disableLogger: true });
 };
 //#endregion
-export { ApprovePayload, AttachPayload, Attempt, Candidate, Connected, ConnectionStatus, Discovery, DiscoveryNotFound, DiscoveryResolved, DiscoverySelectionRequired, Field, Identity, Integration, Method, MethodDescriptor, OAuth, ObservePayload, PlanPayload, Readiness, Redirect, RejectPayload, SelectionRequired, Server_exports, Snapshot, StartPayload, Started, Token, api, group, layer, toWebHandler };
+export { ApprovePayload, AttachPayload, Attachment, Attempt, Candidate, Connected, ConnectionStatus, Discovery, DiscoveryNotFound, DiscoveryResolved, DiscoverySelectionRequired, Field, Identity, Integration, Method, MethodDescriptor, OAuth, ObservePayload, PlanPayload, Readiness, ReconnectPayload, Redirect, RejectPayload, SelectionRequired, Server_exports, Snapshot, StartPayload, Started, Token, Zone, Zones, api, group, layer, toWebHandler };
 
 //# sourceMappingURL=Server.mjs.map

package/dist/Server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Server.mjs","names":["Storage.AuthMethod","DnsRecord.Model","Plan.OperationId","Plan.Model","Storage.AttemptStatus","Approval.Model","Receipt.Model","Storage.Rejection","Storage.Overall","Storage.RequirementStatus","Verify.Evidence","Verify.HostEvidence","Plan.PlanId","Approval.ApprovalId","Receipt.ReceiptId","Errors.fail","Reason.InvalidInput","Errors.DomainKitError","Connect.Service","Provision.Service","Cleanup.Service","Verify.Service","Storage.Service","Principal.Service","Reason.NotFound"],"sources":["../src/Server.ts"],"sourcesContent":["/**\n * domainkit/server — the whole lifecycle as one HttpApi group the host mounts.\n *\n *   const Api = HttpApi.make(\"app\").add(Server.group)\n *   const ApiLive = HttpApiBuilder.layer(Api).pipe(\n *     Layer.provide([Server.layer(Api), DomainKitLive, IdentityLive]),\n *   )\n *\n * The host provides `Identity` (request -> `Principal.Interface`). Everything else comes from\n * `DomainKit.layer`. Non-HttpApi hosts use `toWebHandler`. The group carries no prefix of its\n * own, so `group.prefix(\"/internal/dns\")` or a host router mount is all a different base path\n * takes; callback URLs follow the mount.\n */\nimport { Context, Effect, Layer, Option, Schema } from \"effect\";\nimport * as HttpRouter from \"effect/unstable/http/HttpRouter\";\nimport * as HttpServer from \"effect/unstable/http/HttpServer\";\nimport * as HttpServerRequest from \"effect/unstable/http/HttpServerRequest\";\nimport * as HttpApi from \"effect/unstable/httpapi/HttpApi\";\nimport * as HttpApiBuilder from \"effect/unstable/httpapi/HttpApiBuilder\";\nimport * as HttpApiEndpoint from \"effect/unstable/httpapi/HttpApiEndpoint\";\nimport * as HttpApiGroup from \"effect/unstable/httpapi/HttpApiGroup\";\nimport * as HttpApiSchema from \"effect/unstable/httpapi/HttpApiSchema\";\n\nimport * as Approval from \"./Approval.ts\";\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Receipt from \"./Receipt.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\n/** The only service a host must implement for the server. */\nexport interface IdentityService {\n  readonly principal: (\n    request: HttpServerRequest.HttpServerRequest,\n  ) => Effect.Effect<Principal.Interface, Errors.DomainKitError>;\n  /**\n   * Which routes this principal may reach, checked after `principal` on every request. Fail with\n   * reason `Forbidden` for the 403 a UI expects. Without it every authenticated principal reaches\n   * every route, which is the right default for a host whose own middleware already gates the\n   * mount.\n   */\n  readonly authorize?: (\n    principal: Principal.Interface,\n    endpoint: EndpointName,\n  ) => Effect.Effect<void, Errors.DomainKitError>;\n}\n\nexport class Identity extends Context.Service<Identity, IdentityService>()(\n  \"@domainkit/server/Identity\",\n) {}\n\n// ---------------------------------------------------------------------------------------------\n// Wire schemas (the transport contract `domainkit/client` and `@domainkit/react` consume)\n// ---------------------------------------------------------------------------------------------\n\nexport const ConnectionStatus = Schema.Literals([\"disconnected\", \"connected\", \"reconnect\"]);\nexport type ConnectionStatus = typeof ConnectionStatus.Type;\n\n/** One value a token method needs, so a form renders without knowing the provider. */\nexport const Field = Schema.Struct({\n  name: Schema.String,\n  required: Schema.Boolean,\n  secret: Schema.Boolean,\n});\nexport type Field = typeof Field.Type;\n\n/** How a provider can be connected; `fields` is `null` for the interactive methods. */\nexport const MethodDescriptor = Schema.Struct({\n  kind: Storage.AuthMethod,\n  label: Schema.String,\n  docsUrl: Schema.NullOr(Schema.String),\n  fields: Schema.NullOr(Schema.Array(Field)),\n});\nexport type MethodDescriptor = typeof MethodDescriptor.Type;\n\n/** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */\nexport const Snapshot = Schema.Struct({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  connectionId: Schema.NullOr(Schema.String),\n  provider: Schema.NullOr(Schema.String),\n  method: Schema.NullOr(Storage.AuthMethod),\n  status: ConnectionStatus,\n  lastReceiptId: Schema.NullOr(Schema.String),\n  reusable: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      method: Storage.AuthMethod,\n    }),\n  ),\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Snapshot = typeof Snapshot.Type;\n\n/**\n * How the client asks to connect. `values` is keyed by the provider's declared token fields, as\n * `Snapshot.providers[].methods[].fields` names them. Secrets are plaintext in transit and never\n * come back out.\n */\nexport class Token extends Schema.TaggedClass<Token>(\"@domainkit/server/Method/Token\")(\"Token\", {\n  values: Schema.Record(Schema.String, Schema.String),\n}) {}\nexport class OAuth extends Schema.TaggedClass<OAuth>(\"@domainkit/server/Method/OAuth\")(\"OAuth\", {\n  returnTo: Schema.optionalKey(Schema.String),\n}) {}\nexport class Integration extends Schema.TaggedClass<Integration>(\n  \"@domainkit/server/Method/Integration\",\n)(\"Integration\", { returnTo: Schema.optionalKey(Schema.String) }) {}\nexport const Method = Schema.Union([Token, OAuth, Integration]);\nexport type Method = typeof Method.Type;\n\nexport const StartPayload = Schema.Struct({\n  domain: Schema.String,\n  provider: Schema.String,\n  method: Method,\n});\nexport type StartPayload = typeof StartPayload.Type;\n\n/** A zone the connection can serve, named for a customer to pick from. */\nexport class Candidate extends Schema.Class<Candidate>(\"@domainkit/server/Candidate\")({\n  zone: Schema.String,\n  label: Schema.String,\n}) {}\n\nexport class Connected extends Schema.TaggedClass<Connected>(\"@domainkit/server/Started/Connected\")(\n  \"Connected\",\n  { snapshot: Snapshot },\n) {}\nexport class Redirect extends Schema.TaggedClass<Redirect>(\"@domainkit/server/Started/Redirect\")(\n  \"Redirect\",\n  { authorizationUrl: Schema.String },\n) {}\nexport class SelectionRequired extends Schema.TaggedClass<SelectionRequired>(\n  \"@domainkit/server/Started/SelectionRequired\",\n)(\"SelectionRequired\", { connectionId: Schema.String, candidates: Schema.Array(Candidate) }) {}\nexport const Started = Schema.Union([Connected, Redirect, SelectionRequired]);\nexport type Started = typeof Started.Type;\n\n/**\n * Which of the principal's connections already reaches a domain. The class names carry a\n * `Discovery` prefix because `Started` owns the unprefixed `SelectionRequired`; the wire tags are\n * the ones `Connect.Discovery` uses.\n */\nexport class DiscoveryResolved extends Schema.TaggedClass<DiscoveryResolved>(\n  \"@domainkit/server/Discovery/Resolved\",\n)(\"Resolved\", { connectionId: Schema.String, zone: Schema.String, label: Schema.String }) {}\nexport class DiscoverySelectionRequired extends Schema.TaggedClass<DiscoverySelectionRequired>(\n  \"@domainkit/server/Discovery/SelectionRequired\",\n)(\"SelectionRequired\", {\n  candidates: Schema.Array(\n    Schema.Struct({ connectionId: Schema.String, zone: Schema.String, label: Schema.String }),\n  ),\n}) {}\n/** `host` names the registered provider whose nameservers serve the domain, by definition id. */\nexport class DiscoveryNotFound extends Schema.TaggedClass<DiscoveryNotFound>(\n  \"@domainkit/server/Discovery/NotFound\",\n)(\"NotFound\", {\n  nameservers: Schema.Array(Schema.String),\n  host: Schema.NullOr(Schema.Struct({ provider: Schema.String })),\n}) {}\nexport const Discovery = Schema.Union([\n  DiscoveryResolved,\n  DiscoverySelectionRequired,\n  DiscoveryNotFound,\n]);\nexport type Discovery = typeof Discovery.Type;\n\nexport const AttachPayload = Schema.Struct({\n  domain: Schema.String,\n  /** Which candidate zone to attach when `SelectionRequired` came back. */\n  zone: Schema.optionalKey(Schema.String),\n});\nexport type AttachPayload = typeof AttachPayload.Type;\n\nexport const PlanPayload = Schema.Struct({\n  requirements: Schema.Array(DnsRecord.Model),\n});\nexport type PlanPayload = typeof PlanPayload.Type;\n\nexport const ObservePayload = Schema.Struct({\n  /** Records to observe instead of the attachment's receipt; required for an unattached domain. */\n  requirements: Schema.optionalKey(Schema.Array(DnsRecord.Model)),\n});\nexport type ObservePayload = typeof ObservePayload.Type;\n\nexport const ApprovePayload = Schema.Struct({\n  /** A subset of the plan's writes; omit to approve every write. */\n  operationIds: Schema.optionalKey(Schema.Array(Plan.OperationId)),\n});\nexport type ApprovePayload = typeof ApprovePayload.Type;\n\nexport const RejectPayload = Schema.Struct({\n  /** Why the customer declined, for the audit trail. */\n  reason: Schema.optionalKey(Schema.String),\n});\nexport type RejectPayload = typeof RejectPayload.Type;\n\n/** One durable plan -> approval -> receipt lifecycle, as `GET /plans/:planId` returns it. */\nexport const Attempt = Schema.Struct({\n  plan: Plan.Model,\n  status: Storage.AttemptStatus,\n  approval: Schema.NullOr(Approval.Model),\n  receipt: Schema.NullOr(Receipt.Model),\n  rejection: Schema.NullOr(Storage.Rejection),\n});\nexport type Attempt = typeof Attempt.Type;\n\n/** `Verify.Readiness` on the wire; timestamps encode as ISO strings. */\nexport const Readiness = Schema.Struct({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  overall: Storage.Overall,\n  requirements: Schema.Array(\n    Schema.Struct({\n      operationId: Schema.NullOr(Plan.OperationId),\n      record: DnsRecord.Model,\n      status: Storage.RequirementStatus,\n      evidence: Schema.Array(Verify.Evidence),\n    }),\n  ),\n  host: Schema.Array(Verify.HostEvidence),\n  checkedAt: Schema.DateTimeUtcFromString,\n  nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n});\nexport type Readiness = typeof Readiness.Type;\n\nconst Redirected = HttpApiSchema.WithHeaders(HttpApiSchema.Empty(302), {\n  location: Schema.String,\n});\n\n// ---------------------------------------------------------------------------------------------\n// Errors: one wire body, the status from `DomainKit.Error.httpStatus`\n// ---------------------------------------------------------------------------------------------\n\n/** `DomainKit.Error` narrowed to the reasons that answer with `status`. */\nconst errorAt = (status: number) =>\n  Errors.DomainKitError.check(\n    Schema.makeFilter((error: Errors.DomainKitError) => error.httpStatus === status),\n  ).pipe(HttpApiSchema.status(status));\n\nconst errors = [400, 401, 403, 404, 409, 500, 501, 502, 503].map(errorAt);\n\n// ---------------------------------------------------------------------------------------------\n// The group\n// ---------------------------------------------------------------------------------------------\n\nexport const group = HttpApiGroup.make(\"domainkit\")\n  .add(\n    HttpApiEndpoint.get(\"inspect\", \"/domains/:domain\", {\n      params: { domain: Schema.String },\n      success: Snapshot,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"discover\", \"/domains/:domain/discovery\", {\n      params: { domain: Schema.String },\n      success: Discovery,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"start\", \"/connections\", {\n      payload: StartPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"callback\", \"/callback/:provider\", {\n      params: { provider: Schema.String },\n      // `Connect.complete` reads every callback parameter off the request URL, because a provider\n      // may return `error`, `teamId`, or `configurationId` too. These two are declared so the\n      // OpenAPI document names what a provider is expected to send back.\n      query: { state: Schema.String, code: Schema.optionalKey(Schema.String) },\n      success: Redirected,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"attach\", \"/connections/:connectionId/attachments\", {\n      params: { connectionId: Schema.String },\n      payload: AttachPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"detach\", \"/attachments/:attachmentId\", {\n      params: { attachmentId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"disconnect\", \"/connections/:connectionId\", {\n      params: { connectionId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"createPlan\", \"/domains/:domain/plans\", {\n      params: { domain: Schema.String },\n      payload: PlanPayload,\n      success: Plan.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"approve\", \"/plans/:planId/approvals\", {\n      params: { planId: Plan.PlanId },\n      payload: ApprovePayload,\n      success: Approval.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reject\", \"/plans/:planId/rejections\", {\n      params: { planId: Plan.PlanId },\n      payload: RejectPayload,\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"apply\", \"/approvals/:approvalId/apply\", {\n      params: { approvalId: Approval.ApprovalId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"plan\", \"/plans/:planId\", {\n      params: { planId: Plan.PlanId },\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"receipt\", \"/receipts/:receiptId\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"observe\", \"/domains/:domain/observations\", {\n      params: { domain: Schema.String },\n      payload: ObservePayload,\n      success: Readiness,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"cleanupPlan\", \"/receipts/:receiptId/cleanup-plans\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Plan.Model,\n      error: errors,\n    }),\n  );\n// Cleanup approve, reject, and apply reuse those routes: the attempt knows its kind.\n\nexport type Group = typeof group;\n\n/** Every route in the group, by name; what `Identity.authorize` is asked about. */\nexport type EndpointName = HttpApiGroup.Endpoints<Group>[\"identifier\"];\n\nexport interface Options {\n  /**\n   * Where the callback route is reachable from the provider, without the `/callback/:provider`\n   * suffix. Defaults to the incoming request's origin and mount path.\n   */\n  readonly callbackBaseUrl?: string;\n  /** Where interactive flows return when the callback carries no `returnTo`. */\n  readonly defaultReturnTo?: string;\n}\n\n/** Everything the handlers need: the lifecycle services, Storage, and the host's `Identity`. */\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Storage.Service\n  | Identity;\n\n// ---------------------------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------------------------\n\nconst START_ROUTE = \"/connections\";\nconst callbackRoute = (provider: string) => `/callback/${encodeURIComponent(provider)}`;\n\nconst invalid = (message: string, field?: string) =>\n  Errors.fail(new Reason.InvalidInput({ message, ...(field === undefined ? {} : { field }) }));\n\n/** The request as an absolute URL: the web original when there is one, else scheme plus `Host`. */\nconst absoluteUrl = (\n  request: HttpServerRequest.HttpServerRequest,\n): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    try {\n      return Effect.succeed(new URL(request.originalUrl));\n    } catch {\n      const url = HttpServerRequest.toURL(request);\n      return Option.isNone(url)\n        ? invalid(\"The request has no usable origin; set callbackBaseUrl\", \"callbackBaseUrl\")\n        : Effect.succeed(url.value);\n    }\n  });\n\n/**\n * The absolute URL the provider redirects back to. `callbackBaseUrl` wins when the host set it,\n * because a proxy that rewrites `Host` leaves the request pointing at an origin the browser never\n * sees; otherwise it follows the prefix the group is mounted at, derived by stripping the handling\n * route's own path off the request.\n */\nconst callbackUrlFor = (input: {\n  readonly request: HttpServerRequest.HttpServerRequest;\n  readonly provider: string;\n  readonly options: Options;\n  /** The path of the route serving this request, stripped to find the mount. */\n  readonly route: string;\n}): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    const suffix = `/callback/${encodeURIComponent(input.provider)}`;\n    const configured = input.options.callbackBaseUrl;\n    if (configured !== undefined) {\n      return Effect.try({\n        try: () => new URL(`${configured.replace(/\\/+$/, \"\")}${suffix}`),\n        catch: () => callbackConfigurationError(`${configured} is not a URL`),\n      });\n    }\n    return Effect.flatMap(absoluteUrl(input.request), (url) => {\n      const path = url.pathname;\n      if (!path.endsWith(input.route)) {\n        return invalid(\n          `The ${input.route} route is not mounted where it says; set callbackBaseUrl`,\n          \"callbackBaseUrl\",\n        );\n      }\n      return Effect.succeed(\n        new URL(`${url.origin}${path.slice(0, path.length - input.route.length)}${suffix}`),\n      );\n    });\n  });\n\nconst callbackConfigurationError = (message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({ message, field: \"callbackBaseUrl\" }),\n  });\n\n/**\n * Where the callback may send the customer: a path under the callback's own base, or an absolute\n * URL on its origin. A destination that leaves the application is an open redirect, whoever\n * supplied it.\n */\nconst sameOrigin = (destination: string, callback: URL): string | null => {\n  try {\n    // Resolving against the callback is what makes this safe: the URL parser normalizes the forms\n    // a browser would follow off-origin (`//host`, `/\\host`, `\\/host`, encoded hosts) into a real\n    // origin, so comparing origins catches every one of them.\n    const url = new URL(destination, callback);\n    return url.origin === callback.origin ? url.toString() : null;\n  } catch {\n    return null;\n  }\n};\n\nconst snapshotOf = (snapshot: Connect.Snapshot): Snapshot => ({\n  domain: snapshot.domain,\n  attachmentId: snapshot.attachment?.id ?? null,\n  connectionId: snapshot.connection?.id ?? null,\n  provider: snapshot.authorization?.provider ?? null,\n  method: snapshot.authorization?.method ?? null,\n  status:\n    snapshot.connection === null\n      ? \"disconnected\"\n      : snapshot.authorization?.revocation === \"active\"\n        ? \"connected\"\n        : \"reconnect\",\n  lastReceiptId: snapshot.lastReceiptId,\n  reusable: snapshot.reusable.map(({ connection, provider, method }) => ({\n    connectionId: connection.id,\n    provider,\n    method,\n  })),\n  providers: snapshot.providers.map(({ id, name, methods }) => ({ id, name, methods })),\n});\n\n/** The wire method as `Connect` takes it; interactive cases carry the caller's return destination. */\nconst methodOf = (method: Method): Connect.Method => {\n  switch (method._tag) {\n    case \"Token\":\n      return Connect.Method.token(method.values);\n    case \"OAuth\":\n      return Connect.Method.oauth(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n    case \"Integration\":\n      return Connect.Method.integration(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n  }\n};\n\nconst candidatesOf = (\n  candidates: ReadonlyArray<{ readonly zone: string; readonly label: string }>,\n): ReadonlyArray<Candidate> => candidates.map(({ zone, label }) => new Candidate({ zone, label }));\n\n/**\n * Handlers for `group` inside the host's API. Every handler derives `Principal` from `Identity`\n * for the request it is serving and provides it to the lifecycle services.\n */\nexport const layer = <ApiId extends string, Groups extends HttpApiGroup.Constraint>(\n  api: HttpApi.HttpApi<ApiId, Groups>,\n  options: Options = {},\n): Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services> =>\n  // The host's API carries its own groups beside this one; only `\"domainkit\"` is implemented here,\n  // and `HttpApiBuilder.group` needs the group's own endpoint types to check the handlers.\n  HttpApiBuilder.group(api as unknown as HttpApi.HttpApi<ApiId, Group>, \"domainkit\", (handlers) =>\n    Effect.gen(function* () {\n      const identity = yield* Identity;\n      const connect = yield* Connect.Service;\n      const provision = yield* Provision.Service;\n      const cleanup = yield* Cleanup.Service;\n      const verify = yield* Verify.Service;\n      const storage = yield* Storage.Service;\n\n      /**\n       * Run a lifecycle effect as the principal the host derives from this request, once the host\n       * has allowed that principal onto this route.\n       */\n      const as = <A>(\n        endpoint: EndpointName,\n        request: HttpServerRequest.HttpServerRequest,\n        effect: Effect.Effect<A, Errors.DomainKitError, Principal.Service>,\n      ): Effect.Effect<A, Errors.DomainKitError> =>\n        Effect.flatMap(identity.principal(request), (principal) =>\n          Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () =>\n            Effect.provideService(effect, Principal.Service, principal),\n          ),\n        );\n\n      const snapshot = (domain: string) => Effect.map(connect.inspect(domain), snapshotOf);\n\n      const discovered = (discovery: Connect.Discovery): Discovery => {\n        switch (discovery._tag) {\n          case \"Resolved\":\n            return new DiscoveryResolved({\n              connectionId: discovery.connectionId,\n              zone: discovery.target.zone,\n              label: discovery.target.label,\n            });\n          case \"SelectionRequired\":\n            return new DiscoverySelectionRequired({\n              candidates: discovery.candidates.map(({ connectionId, target }) => ({\n                connectionId,\n                zone: target.zone,\n                label: target.label,\n              })),\n            });\n          case \"NotFound\":\n            return new DiscoveryNotFound({\n              nameservers: discovery.nameservers,\n              host: discovery.host,\n            });\n        }\n      };\n\n      const connected = (domain: string) =>\n        Effect.map(snapshot(domain), (value) => new Connected({ snapshot: value }));\n\n      const startedOf = (\n        started: Connect.Started,\n        domain: string,\n      ): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> => {\n        switch (started._tag) {\n          case \"Connected\":\n            return connected(domain);\n          case \"Redirect\":\n            return Effect.succeed(new Redirect({ authorizationUrl: started.authorizationUrl }));\n          case \"SelectionRequired\":\n            return Effect.succeed(\n              new SelectionRequired({\n                connectionId: started.connection.id,\n                candidates: candidatesOf(started.candidates),\n              }),\n            );\n        }\n      };\n\n      /**\n       * Attach with a zone the client picked out of a `SelectionRequired`. The provider target\n       * behind a zone never crosses the wire, so resolve the candidates again and match by zone.\n       */\n      const attachAt = (input: {\n        readonly connectionId: string;\n        readonly domain: string;\n        readonly zone: string | undefined;\n      }): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const first = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n          });\n          if (!(\"_tag\" in first)) return yield* connected(input.domain);\n          if (input.zone === undefined) {\n            return new SelectionRequired({\n              connectionId: input.connectionId,\n              candidates: candidatesOf(first.candidates),\n            });\n          }\n          const target = first.candidates.find(({ zone }) => zone === input.zone);\n          if (target === undefined) {\n            return yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }));\n          }\n          yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n            target,\n          });\n          return yield* connected(input.domain);\n        });\n\n      /** Provisioning and cleanup share the approve and apply routes; the attempt knows its kind. */\n      const kindOf = (attempt: Storage.Attempt) =>\n        attempt.kind === \"cleanup\" ? cleanup : provision;\n\n      return handlers\n        .handle(\"inspect\", ({ params, request }) => as(\"inspect\", request, snapshot(params.domain)))\n        .handle(\"discover\", ({ params, request }) =>\n          as(\"discover\", request, Effect.map(connect.discover(params.domain), discovered)),\n        )\n        .handle(\"start\", ({ payload, request }) =>\n          as(\n            \"start\",\n            request,\n            Effect.gen(function* () {\n              // Token methods connect in one call; the interactive ones need somewhere to land.\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: payload.provider,\n                      options,\n                      route: START_ROUTE,\n                    })).toString();\n              const started = yield* connect.start({\n                provider: payload.provider,\n                domain: payload.domain,\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, payload.domain);\n            }),\n          ),\n        )\n        .handle(\"callback\", ({ params, query, request }) =>\n          as(\n            \"callback\",\n            request,\n            Effect.gen(function* () {\n              const url = yield* absoluteUrl(request);\n              // Resolve the destination against the callback's public base, not the request: a\n              // proxy that rewrites `Host` leaves the request on an origin the browser never sees.\n              const base = yield* callbackUrlFor({\n                request,\n                provider: params.provider,\n                options,\n                route: callbackRoute(params.provider),\n              });\n              // Where the customer lands comes from the continuation this owner started, never\n              // from the provider's query string, and it is resolved before the callback is spent:\n              // a server with nowhere to send them must not connect the provider and then fail.\n              const continuation = yield* storage.continuations.get(query.state);\n              const requested = continuation.returnTo ?? options.defaultReturnTo;\n              if (requested === undefined) {\n                return yield* invalid(\n                  \"The flow carried no returnTo and the server has no defaultReturnTo\",\n                  \"returnTo\",\n                );\n              }\n              const destination = sameOrigin(requested, base);\n              if (destination === null) {\n                return yield* invalid(`${requested} leaves this application`, \"returnTo\");\n              }\n              yield* connect.complete({\n                continuationId: query.state,\n                callbackUrl: url.toString(),\n              });\n              return HttpApiSchema.withHeaders({\n                body: undefined as void,\n                headers: { location: destination },\n              });\n            }),\n          ),\n        )\n        .handle(\"attach\", ({ params, payload, request }) =>\n          as(\n            \"attach\",\n            request,\n            attachAt({\n              connectionId: params.connectionId,\n              domain: payload.domain,\n              zone: payload.zone,\n            }),\n          ),\n        )\n        .handle(\"detach\", ({ params, request }) =>\n          as(\"detach\", request, connect.detach(params.attachmentId)),\n        )\n        .handle(\"disconnect\", ({ params, request }) =>\n          as(\"disconnect\", request, connect.disconnect(params.connectionId)),\n        )\n        .handle(\"createPlan\", ({ params, payload, request }) =>\n          as(\n            \"createPlan\",\n            request,\n            provision.plan({ domain: params.domain, requirements: payload.requirements }),\n          ),\n        )\n        .handle(\"approve\", ({ params, payload, request }) =>\n          as(\n            \"approve\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).approve(params.planId, {\n                ...(payload.operationIds === undefined\n                  ? {}\n                  : { operationIds: payload.operationIds, allowPartial: true }),\n              });\n            }),\n          ),\n        )\n        .handle(\"reject\", ({ params, payload, request }) =>\n          as(\n            \"reject\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).reject(params.planId, {\n                ...(payload.reason === undefined ? {} : { reason: payload.reason }),\n              });\n            }),\n          ),\n        )\n        .handle(\"apply\", ({ params, request }) =>\n          as(\n            \"apply\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.byApproval(params.approvalId);\n              return yield* kindOf(attempt).apply(params.approvalId);\n            }),\n          ),\n        )\n        .handle(\"plan\", ({ params, request }) =>\n          as(\n            \"plan\",\n            request,\n            Effect.map(storage.attempts.get(params.planId), (attempt) => ({\n              plan: attempt.plan,\n              status: attempt.status,\n              approval: attempt.approval,\n              receipt: attempt.receipt,\n              rejection: attempt.rejection,\n            })),\n          ),\n        )\n        .handle(\"receipt\", ({ params, request }) =>\n          as(\n            \"receipt\",\n            request,\n            Effect.flatMap(storage.attempts.byReceipt(params.receiptId), (attempt) =>\n              attempt.receipt === null\n                ? Errors.fail(new Reason.NotFound({ entity: \"receipt\", id: params.receiptId }))\n                : Effect.succeed(attempt.receipt),\n            ),\n          ),\n        )\n        .handle(\"observe\", ({ params, payload, request }) =>\n          as(\n            \"observe\",\n            request,\n            verify.observe({\n              domain: params.domain,\n              ...(payload.requirements === undefined ? {} : { requirements: payload.requirements }),\n            }),\n          ),\n        )\n        .handle(\"cleanupPlan\", ({ params, request }) =>\n          as(\"cleanupPlan\", request, cleanup.plan({ receiptId: params.receiptId })),\n        );\n    }),\n  ) as Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services>;\n\n/** A standalone API for hosts not on HttpApi. Mount at any prefix. */\nexport const api: HttpApi.HttpApi<\"domainkit\", Group> = HttpApi.make(\"domainkit\").add(group);\n\nexport interface WebHandlerOptions extends Options {\n  /** Mount every route under this path, e.g. `/api/domainkit`. */\n  readonly prefix?: `/${string}`;\n}\n\n/** The Promise edge: a `fetch`-shaped handler over the group for hosts that are not Effect-native. */\nexport const toWebHandler = (\n  services: Layer.Layer<Services, Errors.DomainKitError>,\n  options: WebHandlerOptions = {},\n): {\n  readonly handler: (request: Request) => Promise<Response>;\n  readonly dispose: () => Promise<void>;\n} => {\n  // `group.prefix` widens the endpoint paths in the type, which `Group` states unprefixed; the\n  // handlers are keyed by endpoint identifier, so the routes still line up.\n  const prefixed =\n    options.prefix === undefined\n      ? api\n      : (HttpApi.make(\"domainkit\").add(group.prefix(options.prefix)) as unknown as HttpApi.HttpApi<\n          \"domainkit\",\n          Group\n        >);\n  const app = HttpApiBuilder.layer(prefixed).pipe(\n    Layer.provide(layer(prefixed, options)),\n    Layer.provide(services),\n    Layer.provide(HttpServer.layerServices),\n  );\n  return HttpRouter.toWebHandler(app, { disableLogger: true });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAa,WAAb,cAA8B,QAAQ,QAAmC,CAAC,CACxE,4BACF,CAAC,CAAC,CAAC;AAMH,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAgB;CAAa;AAAW,CAAC;;AAI1F,MAAa,QAAQ,OAAO,OAAO;CACjC,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ,OAAO;AACjB,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO;CAC5C,MAAMA;CACN,OAAO,OAAO;CACd,SAAS,OAAO,OAAO,OAAO,MAAM;CACpC,QAAQ,OAAO,OAAO,OAAO,MAAM,KAAK,CAAC;AAC3C,CAAC;;AAID,MAAa,WAAW,OAAO,OAAO;CACpC,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,UAAU,OAAO,OAAO,OAAO,MAAM;CACrC,QAAQ,OAAO,OAAOA,UAAkB;CACxC,QAAQ;CACR,eAAe,OAAO,OAAO,OAAO,MAAM;CAC1C,UAAU,OAAO,MACf,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQA;CACV,CAAC,CACH;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;;;;;;AAQD,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,EACpD,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,UAAU,OAAO,YAAY,OAAO,MAAM,EAC5C,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,cAAb,cAAiC,OAAO,YACtC,sCACF,CAAC,CAAC,eAAe,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACnE,MAAa,SAAS,OAAO,MAAM;CAAC;CAAO;CAAO;AAAW,CAAC;AAG9D,MAAa,eAAe,OAAO,OAAO;CACxC,QAAQ,OAAO;CACf,UAAU,OAAO;CACjB,QAAQ;AACV,CAAC;;AAID,IAAa,YAAb,cAA+B,OAAO,MAAiB,6BAA6B,CAAC,CAAC;CACpF,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,YAAb,cAA+B,OAAO,YAAuB,qCAAqC,CAAC,CACjG,aACA,EAAE,UAAU,SAAS,CACvB,CAAC,CAAC,CAAC;AACH,IAAa,WAAb,cAA8B,OAAO,YAAsB,oCAAoC,CAAC,CAC9F,YACA,EAAE,kBAAkB,OAAO,OAAO,CACpC,CAAC,CAAC,CAAC;AACH,IAAa,oBAAb,cAAuC,OAAO,YAC5C,6CACF,CAAC,CAAC,qBAAqB;CAAE,cAAc,OAAO;CAAQ,YAAY,OAAO,MAAM,SAAS;AAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAa,UAAU,OAAO,MAAM;CAAC;CAAW;CAAU;AAAiB,CAAC;;;;;;AAQ5E,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAAC,CAAC,CAAC;AAC3F,IAAa,6BAAb,cAAgD,OAAO,YACrD,+CACF,CAAC,CAAC,qBAAqB,EACrB,YAAY,OAAO,MACjB,OAAO,OAAO;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAC1F,EACF,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CACZ,aAAa,OAAO,MAAM,OAAO,MAAM;CACvC,MAAM,OAAO,OAAO,OAAO,OAAO,EAAE,UAAU,OAAO,OAAO,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,YAAY,OAAO,MAAM;CACpC;CACA;CACA;AACF,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;CACzC,QAAQ,OAAO;;CAEf,MAAM,OAAO,YAAY,OAAO,MAAM;AACxC,CAAC;AAGD,MAAa,cAAc,OAAO,OAAO,EACvC,cAAc,OAAO,MAAMC,KAAe,EAC5C,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMA,KAAe,CAAC,EAChE,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMC,WAAgB,CAAC,EACjE,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;;AAEzC,QAAQ,OAAO,YAAY,OAAO,MAAM,EAC1C,CAAC;;AAID,MAAa,UAAU,OAAO,OAAO;CACnC,MAAMC;CACN,QAAQC;CACR,UAAU,OAAO,OAAOC,OAAc;CACtC,SAAS,OAAO,OAAOC,OAAa;CACpC,WAAW,OAAO,OAAOC,SAAiB;AAC5C,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,SAASC;CACT,cAAc,OAAO,MACnB,OAAO,OAAO;EACZ,aAAa,OAAO,OAAON,WAAgB;EAC3C,QAAQD;EACR,QAAQQ;EACR,UAAU,OAAO,MAAMC,QAAe;CACxC,CAAC,CACH;CACA,MAAM,OAAO,MAAMC,YAAmB;CACtC,WAAW,OAAO;CAClB,aAAa,OAAO,OAAO,OAAO,qBAAqB;AACzD,CAAC;AAGD,MAAM,aAAa,cAAc,YAAY,cAAc,MAAM,GAAG,GAAG,EACrE,UAAU,OAAO,OACnB,CAAC;;AAOD,MAAM,WAAW,WAAA,eACO,MACpB,OAAO,YAAY,UAAiC,MAAM,eAAe,MAAM,CACjF,CAAC,CAAC,KAAK,cAAc,OAAO,MAAM,CAAC;AAErC,MAAM,SAAS;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC,CAAC,IAAI,OAAO;AAMxE,MAAa,QAAQ,aAAa,KAAK,WAAW,CAAC,CAChD,IACC,gBAAgB,IAAI,WAAW,oBAAoB;CACjD,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,8BAA8B;CAC5D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gBAAgB;CAC5C,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,uBAAuB;CACrD,QAAQ,EAAE,UAAU,OAAO,OAAO;CAIlC,OAAO;EAAE,OAAO,OAAO;EAAQ,MAAM,OAAO,YAAY,OAAO,MAAM;CAAE;CACvE,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,0CAA0C;CACvE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,UAAU,8BAA8B;CAC7D,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,cAAc,8BAA8B;CACjE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,cAAc,0BAA0B;CAC3D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,4BAA4B;CAC1D,QAAQ,EAAE,QAAQS,OAAY;CAC9B,SAAS;CACT,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,6BAA6B;CAC1D,QAAQ,EAAE,QAAQO,OAAY;CAC9B,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gCAAgC;CAC5D,QAAQ,EAAE,YAAYC,WAAoB;CAC1C,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,QAAQ,kBAAkB;CAC5C,QAAQ,EAAE,QAAQM,OAAY;CAC9B,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,WAAW,wBAAwB;CACrD,QAAQ,EAAE,WAAWE,UAAkB;CACvC,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,iCAAiC;CAC/D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,eAAe,sCAAsC;CACxE,QAAQ,EAAE,WAAWQ,UAAkB;CACvC,SAASX;CACT,OAAO;AACT,CAAC,CACH;AAgCF,MAAM,cAAc;AACpB,MAAM,iBAAiB,aAAqB,aAAa,mBAAmB,QAAQ;AAEpF,MAAM,WAAW,SAAiB,UAChCY,KAAY,IAAIC,aAAoB;CAAE;CAAS,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AAAG,CAAC,CAAC;;AAG7F,MAAM,eACJ,YAEA,OAAO,cAAc;CACnB,IAAI;EACF,OAAO,OAAO,QAAQ,IAAI,IAAI,QAAQ,WAAW,CAAC;CACpD,QAAQ;EACN,MAAM,MAAM,kBAAkB,MAAM,OAAO;EAC3C,OAAO,OAAO,OAAO,GAAG,IACpB,QAAQ,yDAAyD,iBAAiB,IAClF,OAAO,QAAQ,IAAI,KAAK;CAC9B;AACF,CAAC;;;;;;;AAQH,MAAM,kBAAkB,UAOtB,OAAO,cAAc;CACnB,MAAM,SAAS,aAAa,mBAAmB,MAAM,QAAQ;CAC7D,MAAM,aAAa,MAAM,QAAQ;CACjC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,IAAI;EAChB,WAAW,IAAI,IAAI,GAAG,WAAW,QAAQ,QAAQ,EAAE,IAAI,QAAQ;EAC/D,aAAa,2BAA2B,GAAG,WAAW,cAAc;CACtE,CAAC;CAEH,OAAO,OAAO,QAAQ,YAAY,MAAM,OAAO,IAAI,QAAQ;EACzD,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,KAAK,SAAS,MAAM,KAAK,GAC5B,OAAO,QACL,OAAO,MAAM,MAAM,2DACnB,iBACF;EAEF,OAAO,OAAO,QACZ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,MAAM,GAAG,KAAK,SAAS,MAAM,MAAM,MAAM,IAAI,QAAQ,CACpF;CACF,CAAC;AACH,CAAC;AAEH,MAAM,8BAA8B,YAClC,IAAIC,eAAsB,EACxB,QAAQ,IAAID,aAAoB;CAAE;CAAS,OAAO;AAAkB,CAAC,EACvE,CAAC;;;;;;AAOH,MAAM,cAAc,aAAqB,aAAiC;CACxE,IAAI;EAIF,MAAM,MAAM,IAAI,IAAI,aAAa,QAAQ;EACzC,OAAO,IAAI,WAAW,SAAS,SAAS,IAAI,SAAS,IAAI;CAC3D,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,cAAc,cAA0C;CAC5D,QAAQ,SAAS;CACjB,cAAc,SAAS,YAAY,MAAM;CACzC,cAAc,SAAS,YAAY,MAAM;CACzC,UAAU,SAAS,eAAe,YAAY;CAC9C,QAAQ,SAAS,eAAe,UAAU;CAC1C,QACE,SAAS,eAAe,OACpB,iBACA,SAAS,eAAe,eAAe,WACrC,cACA;CACR,eAAe,SAAS;CACxB,UAAU,SAAS,SAAS,KAAK,EAAE,YAAY,UAAU,cAAc;EACrE,cAAc,WAAW;EACzB;EACA;CACF,EAAE;CACF,WAAW,SAAS,UAAU,KAAK,EAAE,IAAI,MAAM,eAAe;EAAE;EAAI;EAAM;CAAQ,EAAE;AACtF;;AAGA,MAAM,YAAY,WAAmC;CACnD,QAAQ,OAAO,MAAf;EACE,KAAK,SACH,OAAA,SAAsB,MAAM,OAAO,MAAM;EAC3C,KAAK,SACH,OAAA,SAAsB,MACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;EACF,KAAK,eACH,OAAA,SAAsB,YACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;CACJ;AACF;AAEA,MAAM,gBACJ,eAC6B,WAAW,KAAK,EAAE,MAAM,YAAY,IAAI,UAAU;CAAE;CAAM;AAAM,CAAC,CAAC;;;;;AAMjG,MAAa,SACX,KACA,UAAmB,CAAC,MAIpB,eAAe,MAAM,KAAiD,cAAc,aAClF,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAOE;CACvB,MAAM,YAAY,OAAOC;CACzB,MAAM,UAAU,OAAOC;CACvB,MAAM,SAAS,OAAOC;CACtB,MAAM,UAAU,OAAOC;;;;;CAMvB,MAAM,MACJ,UACA,SACA,WAEA,OAAO,QAAQ,SAAS,UAAU,OAAO,IAAI,cAC3C,OAAO,QAAQ,SAAS,YAAY,WAAW,QAAQ,KAAK,OAAO,YACjE,OAAO,eAAe,QAAQC,SAAmB,SAAS,CAC5D,CACF;CAEF,MAAM,YAAY,WAAmB,OAAO,IAAI,QAAQ,QAAQ,MAAM,GAAG,UAAU;CAEnF,MAAM,cAAc,cAA4C;EAC9D,QAAQ,UAAU,MAAlB;GACE,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,cAAc,UAAU;IACxB,MAAM,UAAU,OAAO;IACvB,OAAO,UAAU,OAAO;GAC1B,CAAC;GACH,KAAK,qBACH,OAAO,IAAI,2BAA2B,EACpC,YAAY,UAAU,WAAW,KAAK,EAAE,cAAc,cAAc;IAClE;IACA,MAAM,OAAO;IACb,OAAO,OAAO;GAChB,EAAE,EACJ,CAAC;GACH,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,aAAa,UAAU;IACvB,MAAM,UAAU;GAClB,CAAC;EACL;CACF;CAEA,MAAM,aAAa,WACjB,OAAO,IAAI,SAAS,MAAM,IAAI,UAAU,IAAI,UAAU,EAAE,UAAU,MAAM,CAAC,CAAC;CAE5E,MAAM,aACJ,SACA,WACqE;EACrE,QAAQ,QAAQ,MAAhB;GACE,KAAK,aACH,OAAO,UAAU,MAAM;GACzB,KAAK,YACH,OAAO,OAAO,QAAQ,IAAI,SAAS,EAAE,kBAAkB,QAAQ,iBAAiB,CAAC,CAAC;GACpF,KAAK,qBACH,OAAO,OAAO,QACZ,IAAI,kBAAkB;IACpB,cAAc,QAAQ,WAAW;IACjC,YAAY,aAAa,QAAQ,UAAU;GAC7C,CAAC,CACH;EACJ;CACF;;;;;CAMA,MAAM,YAAY,UAKhB,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,QAAQ,OAAO;GAClC,cAAc,MAAM;GACpB,QAAQ,MAAM;EAChB,CAAC;EACD,IAAI,EAAE,UAAU,QAAQ,OAAO,OAAO,UAAU,MAAM,MAAM;EAC5D,IAAI,MAAM,SAAS,KAAA,GACjB,OAAO,IAAI,kBAAkB;GAC3B,cAAc,MAAM;GACpB,YAAY,aAAa,MAAM,UAAU;EAC3C,CAAC;EAEH,MAAM,SAAS,MAAM,WAAW,MAAM,EAAE,WAAW,SAAS,MAAM,IAAI;EACtE,IAAI,WAAW,KAAA,GACb,OAAO,OAAOR,KAAY,IAAIS,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC;EAEnF,OAAO,QAAQ,OAAO;GACpB,cAAc,MAAM;GACpB,QAAQ,MAAM;GACd;EACF,CAAC;EACD,OAAO,OAAO,UAAU,MAAM,MAAM;CACtC,CAAC;;CAGH,MAAM,UAAU,YACd,QAAQ,SAAS,YAAY,UAAU;CAEzC,OAAO,SACJ,OAAO,YAAY,EAAE,QAAQ,cAAc,GAAG,WAAW,SAAS,SAAS,OAAO,MAAM,CAAC,CAAC,CAAC,CAC3F,OAAO,aAAa,EAAE,QAAQ,cAC7B,GAAG,YAAY,SAAS,OAAO,IAAI,QAAQ,SAAS,OAAO,MAAM,GAAG,UAAU,CAAC,CACjF,CAAC,CACA,OAAO,UAAU,EAAE,SAAS,cAC3B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EAEtB,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,QAAQ;GAClB;GACA,OAAO;EACT,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,MAAM;GACnC,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,QAAQ,MAAM;CACjD,CAAC,CACH,CACF,CAAC,CACA,OAAO,aAAa,EAAE,QAAQ,OAAO,cACpC,GACE,YACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,YAAY,OAAO;EAGtC,MAAM,OAAO,OAAO,eAAe;GACjC;GACA,UAAU,OAAO;GACjB;GACA,OAAO,cAAc,OAAO,QAAQ;EACtC,CAAC;EAKD,MAAM,aAAY,OADU,QAAQ,cAAc,IAAI,MAAM,KAAK,EAAA,CAClC,YAAY,QAAQ;EACnD,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,QACZ,sEACA,UACF;EAEF,MAAM,cAAc,WAAW,WAAW,IAAI;EAC9C,IAAI,gBAAgB,MAClB,OAAO,OAAO,QAAQ,GAAG,UAAU,2BAA2B,UAAU;EAE1E,OAAO,QAAQ,SAAS;GACtB,gBAAgB,MAAM;GACtB,aAAa,IAAI,SAAS;EAC5B,CAAC;EACD,OAAO,cAAc,YAAY;GAC/B,MAAM,KAAA;GACN,SAAS,EAAE,UAAU,YAAY;EACnC,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,SAAS;EACP,cAAc,OAAO;EACrB,QAAQ,QAAQ;EAChB,MAAM,QAAQ;CAChB,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,cAC3B,GAAG,UAAU,SAAS,QAAQ,OAAO,OAAO,YAAY,CAAC,CAC3D,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,cAC/B,GAAG,cAAc,SAAS,QAAQ,WAAW,OAAO,YAAY,CAAC,CACnE,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,SAAS,cACxC,GACE,cACA,SACA,UAAU,KAAK;EAAE,QAAQ,OAAO;EAAQ,cAAc,QAAQ;CAAa,CAAC,CAC9E,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,QAAQ,OAAO,QAAQ,EACnD,GAAI,QAAQ,iBAAiB,KAAA,IACzB,CAAC,IACD;GAAE,cAAc,QAAQ;GAAc,cAAc;EAAK,EAC/D,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,EAClD,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO,EACnE,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,UAAU,EAAE,QAAQ,cAC1B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,WAAW,OAAO,UAAU;EACpE,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,MAAM,OAAO,UAAU;CACvD,CAAC,CACH,CACF,CAAC,CACA,OAAO,SAAS,EAAE,QAAQ,cACzB,GACE,QACA,SACA,OAAO,IAAI,QAAQ,SAAS,IAAI,OAAO,MAAM,IAAI,aAAa;EAC5D,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,UAAU,QAAQ;EAClB,SAAS,QAAQ;EACjB,WAAW,QAAQ;CACrB,EAAE,CACJ,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,cAC5B,GACE,WACA,SACA,OAAO,QAAQ,QAAQ,SAAS,UAAU,OAAO,SAAS,IAAI,YAC5D,QAAQ,YAAY,OAChBT,KAAY,IAAIS,SAAgB;EAAE,QAAQ;EAAW,IAAI,OAAO;CAAU,CAAC,CAAC,IAC5E,OAAO,QAAQ,QAAQ,OAAO,CACpC,CACF,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,QAAQ;EACb,QAAQ,OAAO;EACf,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;CACrF,CAAC,CACH,CACF,CAAC,CACA,OAAO,gBAAgB,EAAE,QAAQ,cAChC,GAAG,eAAe,SAAS,QAAQ,KAAK,EAAE,WAAW,OAAO,UAAU,CAAC,CAAC,CAC1E;AACJ,CAAC,CACH;;AAGF,MAAa,MAA2C,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,KAAK;;AAQ3F,MAAa,gBACX,UACA,UAA6B,CAAC,MAI3B;CAGH,MAAM,WACJ,QAAQ,WAAW,KAAA,IACf,MACC,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,MAAM,OAAO,QAAQ,MAAM,CAAC;CAIjE,MAAM,MAAM,eAAe,MAAM,QAAQ,CAAC,CAAC,KACzC,MAAM,QAAQ,MAAM,UAAU,OAAO,CAAC,GACtC,MAAM,QAAQ,QAAQ,GACtB,MAAM,QAAQ,WAAW,aAAa,CACxC;CACA,OAAO,WAAW,aAAa,KAAK,EAAE,eAAe,KAAK,CAAC;AAC7D"}
+{"version":3,"file":"Server.mjs","names":["Storage.AuthMethod","DnsRecord.Model","Plan.OperationId","Plan.Model","Storage.AttemptStatus","Approval.Model","Receipt.Model","Storage.Rejection","Storage.Overall","Storage.RequirementStatus","Verify.Evidence","Verify.HostEvidence","Plan.PlanId","Approval.ApprovalId","Receipt.ReceiptId","Errors.fail","Reason.InvalidInput","Errors.DomainKitError","Connect.Service","Provision.Service","Cleanup.Service","Verify.Service","Storage.Service","Providers.Service","Principal.Service","Reason.NotFound"],"sources":["../src/Server.ts"],"sourcesContent":["/**\n * domainkit/server — the whole lifecycle as one HttpApi group the host mounts.\n *\n *   const Api = HttpApi.make(\"app\").add(Server.group)\n *   const ApiLive = HttpApiBuilder.layer(Api).pipe(\n *     Layer.provide([Server.layer(Api), DomainKitLive, IdentityLive]),\n *   )\n *\n * The host provides `Identity` (request -> `Principal.Interface`). Everything else comes from\n * `DomainKit.layer`. Non-HttpApi hosts use `toWebHandler`. The group carries no prefix of its\n * own, so `group.prefix(\"/internal/dns\")` or a host router mount is all a different base path\n * takes; callback URLs follow the mount.\n */\nimport { Context, Effect, Layer, Option, Schema } from \"effect\";\nimport * as HttpRouter from \"effect/unstable/http/HttpRouter\";\nimport * as HttpServer from \"effect/unstable/http/HttpServer\";\nimport * as HttpServerRequest from \"effect/unstable/http/HttpServerRequest\";\nimport * as HttpApi from \"effect/unstable/httpapi/HttpApi\";\nimport * as HttpApiBuilder from \"effect/unstable/httpapi/HttpApiBuilder\";\nimport * as HttpApiEndpoint from \"effect/unstable/httpapi/HttpApiEndpoint\";\nimport * as HttpApiGroup from \"effect/unstable/httpapi/HttpApiGroup\";\nimport * as HttpApiSchema from \"effect/unstable/httpapi/HttpApiSchema\";\n\nimport * as Approval from \"./Approval.ts\";\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Receipt from \"./Receipt.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\n/** The only service a host must implement for the server. */\nexport interface IdentityService {\n  readonly principal: (\n    request: HttpServerRequest.HttpServerRequest,\n  ) => Effect.Effect<Principal.Interface, Errors.DomainKitError>;\n  /**\n   * Which routes this principal may reach, checked after `principal` on every request. Fail with\n   * reason `Forbidden` for the 403 a UI expects. Without it every authenticated principal reaches\n   * every route, which is the right default for a host whose own middleware already gates the\n   * mount.\n   */\n  readonly authorize?: (\n    principal: Principal.Interface,\n    endpoint: EndpointName,\n  ) => Effect.Effect<void, Errors.DomainKitError>;\n}\n\nexport class Identity extends Context.Service<Identity, IdentityService>()(\n  \"@domainkit/server/Identity\",\n) {}\n\n// ---------------------------------------------------------------------------------------------\n// Wire schemas (the transport contract `domainkit/client` and `@domainkit/react` consume)\n// ---------------------------------------------------------------------------------------------\n\nexport const ConnectionStatus = Schema.Literals([\"disconnected\", \"connected\", \"reconnect\"]);\nexport type ConnectionStatus = typeof ConnectionStatus.Type;\n\n/** One value a token method needs, so a form renders without knowing the provider. */\nexport const Field = Schema.Struct({\n  name: Schema.String,\n  required: Schema.Boolean,\n  secret: Schema.Boolean,\n});\nexport type Field = typeof Field.Type;\n\n/** How a provider can be connected; `fields` is `null` for the interactive methods. */\nexport const MethodDescriptor = Schema.Struct({\n  kind: Storage.AuthMethod,\n  label: Schema.String,\n  docsUrl: Schema.NullOr(Schema.String),\n  fields: Schema.NullOr(Schema.Array(Field)),\n});\nexport type MethodDescriptor = typeof MethodDescriptor.Type;\n\n/** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */\n/** The attachment a domain holds, with the zone label the provider gave when it was created. */\nexport const Attachment = Schema.Struct({\n  id: Schema.String,\n  label: Schema.String,\n});\nexport type Attachment = typeof Attachment.Type;\n\nexport const Snapshot = Schema.Struct({\n  domain: Schema.String,\n  attachment: Schema.NullOr(Attachment),\n  connectionId: Schema.NullOr(Schema.String),\n  provider: Schema.NullOr(Schema.String),\n  method: Schema.NullOr(Storage.AuthMethod),\n  status: ConnectionStatus,\n  lastReceiptId: Schema.NullOr(Schema.String),\n  /** How many domains the connection serves, including this one; `0` without a connection. */\n  connectionDomains: Schema.Number,\n  reusable: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      method: Storage.AuthMethod,\n    }),\n  ),\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Snapshot = typeof Snapshot.Type;\n\n/**\n * How the client asks to connect. `values` is keyed by the provider's declared token fields, as\n * `Snapshot.providers[].methods[].fields` names them. Secrets are plaintext in transit and never\n * come back out.\n */\nexport class Token extends Schema.TaggedClass<Token>(\"@domainkit/server/Method/Token\")(\"Token\", {\n  values: Schema.Record(Schema.String, Schema.String),\n}) {}\nexport class OAuth extends Schema.TaggedClass<OAuth>(\"@domainkit/server/Method/OAuth\")(\"OAuth\", {\n  returnTo: Schema.optionalKey(Schema.String),\n}) {}\nexport class Integration extends Schema.TaggedClass<Integration>(\n  \"@domainkit/server/Method/Integration\",\n)(\"Integration\", { returnTo: Schema.optionalKey(Schema.String) }) {}\nexport const Method = Schema.Union([Token, OAuth, Integration]);\nexport type Method = typeof Method.Type;\n\n/** A start without a domain connects the account alone; the customer picks a zone afterwards. */\nexport const StartPayload = Schema.Struct({\n  domain: Schema.optionalKey(Schema.String),\n  provider: Schema.String,\n  method: Method,\n});\nexport type StartPayload = typeof StartPayload.Type;\n\n/** How the customer proves the account again. The provider is the connection's own. */\nexport const ReconnectPayload = Schema.Struct({ method: Method });\nexport type ReconnectPayload = typeof ReconnectPayload.Type;\n\n/** A zone the connection can serve, named for a customer to pick from. */\nexport class Candidate extends Schema.Class<Candidate>(\"@domainkit/server/Candidate\")({\n  zone: Schema.String,\n  label: Schema.String,\n}) {}\n\n/**\n * The connection the start produced. `label` names the account the way the customer will read it:\n * the attached zone's label, or the provider's name when the start carried no domain. `snapshot`\n * is the domain's state, and is null for a start that attached none.\n */\nexport class Connected extends Schema.TaggedClass<Connected>(\"@domainkit/server/Started/Connected\")(\n  \"Connected\",\n  {\n    connectionId: Schema.String,\n    provider: Schema.String,\n    label: Schema.String,\n    snapshot: Schema.NullOr(Snapshot),\n  },\n) {}\nexport class Redirect extends Schema.TaggedClass<Redirect>(\"@domainkit/server/Started/Redirect\")(\n  \"Redirect\",\n  { authorizationUrl: Schema.String },\n) {}\nexport class SelectionRequired extends Schema.TaggedClass<SelectionRequired>(\n  \"@domainkit/server/Started/SelectionRequired\",\n)(\"SelectionRequired\", { connectionId: Schema.String, candidates: Schema.Array(Candidate) }) {}\nexport const Started = Schema.Union([Connected, Redirect, SelectionRequired]);\nexport type Started = typeof Started.Type;\n\n/**\n * Which of the principal's connections already reaches a domain. The class names carry a\n * `Discovery` prefix because `Started` owns the unprefixed `SelectionRequired`; the wire tags are\n * the ones `Connect.Discovery` uses.\n */\nexport class DiscoveryResolved extends Schema.TaggedClass<DiscoveryResolved>(\n  \"@domainkit/server/Discovery/Resolved\",\n)(\"Resolved\", { connectionId: Schema.String, zone: Schema.String, label: Schema.String }) {}\nexport class DiscoverySelectionRequired extends Schema.TaggedClass<DiscoverySelectionRequired>(\n  \"@domainkit/server/Discovery/SelectionRequired\",\n)(\"SelectionRequired\", {\n  candidates: Schema.Array(\n    Schema.Struct({ connectionId: Schema.String, zone: Schema.String, label: Schema.String }),\n  ),\n}) {}\n/** `host` names the registered provider whose nameservers serve the domain, by definition id. */\nexport class DiscoveryNotFound extends Schema.TaggedClass<DiscoveryNotFound>(\n  \"@domainkit/server/Discovery/NotFound\",\n)(\"NotFound\", {\n  nameservers: Schema.Array(Schema.String),\n  host: Schema.NullOr(Schema.Struct({ provider: Schema.String })),\n}) {}\nexport const Discovery = Schema.Union([\n  DiscoveryResolved,\n  DiscoverySelectionRequired,\n  DiscoveryNotFound,\n]);\nexport type Discovery = typeof Discovery.Type;\n\n/** One zone a connection reaches, named for a customer to pick from. */\nexport const Zone = Schema.Struct({\n  connectionId: Schema.String,\n  provider: Schema.String,\n  zone: Schema.String,\n  label: Schema.String,\n  nameservers: Schema.optionalKey(Schema.Array(Schema.String)),\n});\nexport type Zone = typeof Zone.Type;\n\n/**\n * Every zone the principal's connections reach, and where each connection stands. A connection\n * marked `reconnect` contributes no zones and needs the customer to authorize it again.\n */\nexport const Zones = Schema.Struct({\n  zones: Schema.Array(Zone),\n  connections: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      status: ConnectionStatus,\n    }),\n  ),\n  /** Every provider a customer could connect, so a picker offers one without a second call. */\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Zones = typeof Zones.Type;\n\nexport const AttachPayload = Schema.Struct({\n  domain: Schema.String,\n  /** Which candidate zone to attach when `SelectionRequired` came back. */\n  zone: Schema.optionalKey(Schema.String),\n});\nexport type AttachPayload = typeof AttachPayload.Type;\n\nexport const PlanPayload = Schema.Struct({\n  requirements: Schema.Array(DnsRecord.Model),\n});\nexport type PlanPayload = typeof PlanPayload.Type;\n\nexport const ObservePayload = Schema.Struct({\n  /** Records to observe instead of the attachment's receipt; required for an unattached domain. */\n  requirements: Schema.optionalKey(Schema.Array(DnsRecord.Model)),\n});\nexport type ObservePayload = typeof ObservePayload.Type;\n\nexport const ApprovePayload = Schema.Struct({\n  /** A subset of the plan's writes; omit to approve every write. */\n  operationIds: Schema.optionalKey(Schema.Array(Plan.OperationId)),\n});\nexport type ApprovePayload = typeof ApprovePayload.Type;\n\nexport const RejectPayload = Schema.Struct({\n  /** Why the customer declined, for the audit trail. */\n  reason: Schema.optionalKey(Schema.String),\n});\nexport type RejectPayload = typeof RejectPayload.Type;\n\n/** One durable plan -> approval -> receipt lifecycle, as `GET /plans/:planId` returns it. */\nexport const Attempt = Schema.Struct({\n  plan: Plan.Model,\n  status: Storage.AttemptStatus,\n  approval: Schema.NullOr(Approval.Model),\n  receipt: Schema.NullOr(Receipt.Model),\n  rejection: Schema.NullOr(Storage.Rejection),\n});\nexport type Attempt = typeof Attempt.Type;\n\n/** `Verify.Readiness` on the wire; timestamps encode as ISO strings. */\nexport const Readiness = Schema.Struct({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  overall: Storage.Overall,\n  requirements: Schema.Array(\n    Schema.Struct({\n      operationId: Schema.NullOr(Plan.OperationId),\n      record: DnsRecord.Model,\n      status: Storage.RequirementStatus,\n      evidence: Schema.Array(Verify.Evidence),\n    }),\n  ),\n  host: Schema.Array(Verify.HostEvidence),\n  checkedAt: Schema.DateTimeUtcFromString,\n  nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n});\nexport type Readiness = typeof Readiness.Type;\n\nconst Redirected = HttpApiSchema.WithHeaders(HttpApiSchema.Empty(302), {\n  location: Schema.String,\n});\n\n// ---------------------------------------------------------------------------------------------\n// Errors: one wire body, the status from `DomainKit.Error.httpStatus`\n// ---------------------------------------------------------------------------------------------\n\n/** `DomainKit.Error` narrowed to the reasons that answer with `status`. */\nconst errorAt = (status: number) =>\n  Errors.DomainKitError.check(\n    Schema.makeFilter((error: Errors.DomainKitError) => error.httpStatus === status),\n  ).pipe(HttpApiSchema.status(status));\n\nconst errors = [400, 401, 403, 404, 409, 500, 501, 502, 503].map(errorAt);\n\n// ---------------------------------------------------------------------------------------------\n// The group\n// ---------------------------------------------------------------------------------------------\n\nexport const group = HttpApiGroup.make(\"domainkit\")\n  .add(\n    HttpApiEndpoint.get(\"inspect\", \"/domains/:domain\", {\n      params: { domain: Schema.String },\n      success: Snapshot,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"discover\", \"/domains/:domain/discovery\", {\n      params: { domain: Schema.String },\n      success: Discovery,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"zones\", \"/zones\", {\n      query: { provider: Schema.optionalKey(Schema.String) },\n      success: Zones,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"start\", \"/connections\", {\n      payload: StartPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"callback\", \"/callback/:provider\", {\n      params: { provider: Schema.String },\n      // `Connect.complete` reads every callback parameter off the request URL, because a provider\n      // may return `error`, `teamId`, or `configurationId` too. These two are declared so the\n      // OpenAPI document names what a provider is expected to send back.\n      query: { state: Schema.String, code: Schema.optionalKey(Schema.String) },\n      success: Redirected,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reconnect\", \"/connections/:connectionId/reconnections\", {\n      params: { connectionId: Schema.String },\n      payload: ReconnectPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"attach\", \"/connections/:connectionId/attachments\", {\n      params: { connectionId: Schema.String },\n      payload: AttachPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"detach\", \"/attachments/:attachmentId\", {\n      params: { attachmentId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"disconnect\", \"/connections/:connectionId\", {\n      params: { connectionId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"createPlan\", \"/domains/:domain/plans\", {\n      params: { domain: Schema.String },\n      payload: PlanPayload,\n      success: Plan.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"approve\", \"/plans/:planId/approvals\", {\n      params: { planId: Plan.PlanId },\n      payload: ApprovePayload,\n      success: Approval.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reject\", \"/plans/:planId/rejections\", {\n      params: { planId: Plan.PlanId },\n      payload: RejectPayload,\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"apply\", \"/approvals/:approvalId/apply\", {\n      params: { approvalId: Approval.ApprovalId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"plan\", \"/plans/:planId\", {\n      params: { planId: Plan.PlanId },\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"receipt\", \"/receipts/:receiptId\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"observe\", \"/domains/:domain/observations\", {\n      params: { domain: Schema.String },\n      payload: ObservePayload,\n      success: Readiness,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"cleanupPlan\", \"/receipts/:receiptId/cleanup-plans\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Plan.Model,\n      error: errors,\n    }),\n  );\n// Cleanup approve, reject, and apply reuse those routes: the attempt knows its kind.\n\nexport type Group = typeof group;\n\n/** Every route in the group, by name; what `Identity.authorize` is asked about. */\nexport type EndpointName = HttpApiGroup.Endpoints<Group>[\"identifier\"];\n\nexport interface Options {\n  /**\n   * Where the callback route is reachable from the provider, without the `/callback/:provider`\n   * suffix. Defaults to the incoming request's origin and mount path.\n   */\n  readonly callbackBaseUrl?: string;\n  /** Where interactive flows return when the callback carries no `returnTo`. */\n  readonly defaultReturnTo?: string;\n}\n\n/** Everything the handlers need: the lifecycle services, Storage, and the host's `Identity`. */\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Storage.Service\n  | Identity;\n\n// ---------------------------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------------------------\n\nconst START_ROUTE = \"/connections\";\nconst reconnectRoute = (connectionId: string) =>\n  `/connections/${encodeURIComponent(connectionId)}/reconnections`;\nconst callbackRoute = (provider: string) => `/callback/${encodeURIComponent(provider)}`;\n\nconst invalid = (message: string, field?: string) =>\n  Errors.fail(new Reason.InvalidInput({ message, ...(field === undefined ? {} : { field }) }));\n\n/** The request as an absolute URL: the web original when there is one, else scheme plus `Host`. */\nconst absoluteUrl = (\n  request: HttpServerRequest.HttpServerRequest,\n): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    try {\n      return Effect.succeed(new URL(request.originalUrl));\n    } catch {\n      const url = HttpServerRequest.toURL(request);\n      return Option.isNone(url)\n        ? invalid(\"The request has no usable origin; set callbackBaseUrl\", \"callbackBaseUrl\")\n        : Effect.succeed(url.value);\n    }\n  });\n\n/**\n * The absolute URL the provider redirects back to. `callbackBaseUrl` wins when the host set it,\n * because a proxy that rewrites `Host` leaves the request pointing at an origin the browser never\n * sees; otherwise it follows the prefix the group is mounted at, derived by stripping the handling\n * route's own path off the request.\n */\nconst callbackUrlFor = (input: {\n  readonly request: HttpServerRequest.HttpServerRequest;\n  readonly provider: string;\n  readonly options: Options;\n  /** The path of the route serving this request, stripped to find the mount. */\n  readonly route: string;\n}): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    const suffix = `/callback/${encodeURIComponent(input.provider)}`;\n    const configured = input.options.callbackBaseUrl;\n    if (configured !== undefined) {\n      return Effect.try({\n        try: () => new URL(`${configured.replace(/\\/+$/, \"\")}${suffix}`),\n        catch: () => callbackConfigurationError(`${configured} is not a URL`),\n      });\n    }\n    return Effect.flatMap(absoluteUrl(input.request), (url) => {\n      const path = url.pathname;\n      if (!path.endsWith(input.route)) {\n        return invalid(\n          `The ${input.route} route is not mounted where it says; set callbackBaseUrl`,\n          \"callbackBaseUrl\",\n        );\n      }\n      return Effect.succeed(\n        new URL(`${url.origin}${path.slice(0, path.length - input.route.length)}${suffix}`),\n      );\n    });\n  });\n\nconst callbackConfigurationError = (message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({ message, field: \"callbackBaseUrl\" }),\n  });\n\n/**\n * Where the callback may send the customer: a path under the callback's own base, or an absolute\n * URL on its origin. A destination that leaves the application is an open redirect, whoever\n * supplied it.\n */\nconst sameOrigin = (destination: string, callback: URL): string | null => {\n  try {\n    // Resolving against the callback is what makes this safe: the URL parser normalizes the forms\n    // a browser would follow off-origin (`//host`, `/\\host`, `\\/host`, encoded hosts) into a real\n    // origin, so comparing origins catches every one of them.\n    const url = new URL(destination, callback);\n    return url.origin === callback.origin ? url.toString() : null;\n  } catch {\n    return null;\n  }\n};\n\nconst snapshotOf = (snapshot: Connect.Snapshot): Snapshot => ({\n  domain: snapshot.domain,\n  attachment:\n    snapshot.attachment === null\n      ? null\n      : { id: snapshot.attachment.id, label: snapshot.attachment.label },\n  connectionId: snapshot.connection?.id ?? null,\n  provider: snapshot.authorization?.provider ?? null,\n  method: snapshot.authorization?.method ?? null,\n  status:\n    snapshot.connection === null\n      ? \"disconnected\"\n      : snapshot.authorization?.revocation === \"active\"\n        ? \"connected\"\n        : \"reconnect\",\n  lastReceiptId: snapshot.lastReceiptId,\n  connectionDomains: snapshot.connectionDomains,\n  reusable: snapshot.reusable.map(({ connection, provider, method }) => ({\n    connectionId: connection.id,\n    provider,\n    method,\n  })),\n  providers: snapshot.providers.map(({ id, name, methods }) => ({ id, name, methods })),\n});\n\n/** The wire method as `Connect` takes it; interactive cases carry the caller's return destination. */\nconst methodOf = (method: Method): Connect.Method => {\n  switch (method._tag) {\n    case \"Token\":\n      return Connect.Method.token(method.values);\n    case \"OAuth\":\n      return Connect.Method.oauth(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n    case \"Integration\":\n      return Connect.Method.integration(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n  }\n};\n\nconst candidatesOf = (\n  candidates: ReadonlyArray<{ readonly zone: string; readonly label: string }>,\n): ReadonlyArray<Candidate> => candidates.map(({ zone, label }) => new Candidate({ zone, label }));\n\n/**\n * Handlers for `group` inside the host's API. Every handler derives `Principal` from `Identity`\n * for the request it is serving and provides it to the lifecycle services.\n */\nexport const layer = <ApiId extends string, Groups extends HttpApiGroup.Constraint>(\n  api: HttpApi.HttpApi<ApiId, Groups>,\n  options: Options = {},\n): Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services> =>\n  // The host's API carries its own groups beside this one; only `\"domainkit\"` is implemented here,\n  // and `HttpApiBuilder.group` needs the group's own endpoint types to check the handlers.\n  HttpApiBuilder.group(api as unknown as HttpApi.HttpApi<ApiId, Group>, \"domainkit\", (handlers) =>\n    Effect.gen(function* () {\n      const identity = yield* Identity;\n      const connect = yield* Connect.Service;\n      const provision = yield* Provision.Service;\n      const cleanup = yield* Cleanup.Service;\n      const verify = yield* Verify.Service;\n      const storage = yield* Storage.Service;\n      const providers = yield* Providers.Service;\n\n      /**\n       * Run a lifecycle effect as the principal the host derives from this request, once the host\n       * has allowed that principal onto this route.\n       */\n      const as = <A>(\n        endpoint: EndpointName,\n        request: HttpServerRequest.HttpServerRequest,\n        effect: Effect.Effect<A, Errors.DomainKitError, Principal.Service>,\n      ): Effect.Effect<A, Errors.DomainKitError> =>\n        Effect.flatMap(identity.principal(request), (principal) =>\n          Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () =>\n            Effect.provideService(effect, Principal.Service, principal),\n          ),\n        );\n\n      const snapshot = (domain: string) => Effect.map(connect.inspect(domain), snapshotOf);\n\n      const discovered = (discovery: Connect.Discovery): Discovery => {\n        switch (discovery._tag) {\n          case \"Resolved\":\n            return new DiscoveryResolved({\n              connectionId: discovery.connectionId,\n              zone: discovery.target.zone,\n              label: discovery.target.label,\n            });\n          case \"SelectionRequired\":\n            return new DiscoverySelectionRequired({\n              candidates: discovery.candidates.map(({ connectionId, target }) => ({\n                connectionId,\n                zone: target.zone,\n                label: target.label,\n              })),\n            });\n          case \"NotFound\":\n            return new DiscoveryNotFound({\n              nameservers: discovery.nameservers,\n              host: discovery.host,\n            });\n        }\n      };\n\n      /**\n       * The connection a start or an attach produced. `label` is the zone the attachment named,\n       * or the provider itself where the connection carries no domain yet.\n       */\n      const connected = (input: {\n        readonly connection: Storage.Connection;\n        readonly attachment: Storage.Attachment | null;\n        readonly domain: string | undefined;\n      }): Effect.Effect<Connected, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const authorization = yield* storage.authorizations.get(input.connection.authorizationId);\n          const definition = yield* providers.get(authorization.provider);\n          return new Connected({\n            connectionId: input.connection.id,\n            provider: authorization.provider,\n            label: input.attachment?.label ?? definition.name,\n            snapshot: input.domain === undefined ? null : yield* snapshot(input.domain),\n          });\n        });\n\n      const startedOf = (\n        started: Connect.Started,\n        domain: string | undefined,\n      ): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> => {\n        switch (started._tag) {\n          case \"Connected\":\n            return connected({\n              attachment: started.attachment,\n              connection: started.connection,\n              domain,\n            });\n          case \"Redirect\":\n            return Effect.succeed(new Redirect({ authorizationUrl: started.authorizationUrl }));\n          case \"SelectionRequired\":\n            return Effect.succeed(\n              new SelectionRequired({\n                connectionId: started.connection.id,\n                candidates: candidatesOf(started.candidates),\n              }),\n            );\n        }\n      };\n\n      /**\n       * Attach with a zone the client picked out of a `SelectionRequired`. The provider target\n       * behind a zone never crosses the wire, so resolve the candidates again and match by zone.\n       */\n      const attachAt = (input: {\n        readonly connectionId: string;\n        readonly domain: string;\n        readonly zone: string | undefined;\n      }): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const connection = yield* storage.connections.get(input.connectionId);\n          const attached = (attachment: Storage.Attachment) =>\n            connected({ attachment, connection, domain: input.domain });\n          const first = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n          });\n          if (!(\"_tag\" in first)) return yield* attached(first);\n          if (input.zone === undefined) {\n            return new SelectionRequired({\n              connectionId: input.connectionId,\n              candidates: candidatesOf(first.candidates),\n            });\n          }\n          const target = first.candidates.find(({ zone }) => zone === input.zone);\n          if (target === undefined) {\n            return yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }));\n          }\n          const second = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n            target,\n          });\n          return \"_tag\" in second\n            ? yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }))\n            : yield* attached(second);\n        });\n\n      /** Provisioning and cleanup share the approve and apply routes; the attempt knows its kind. */\n      const kindOf = (attempt: Storage.Attempt) =>\n        attempt.kind === \"cleanup\" ? cleanup : provision;\n\n      return handlers\n        .handle(\"inspect\", ({ params, request }) => as(\"inspect\", request, snapshot(params.domain)))\n        .handle(\"discover\", ({ params, request }) =>\n          as(\"discover\", request, Effect.map(connect.discover(params.domain), discovered)),\n        )\n        .handle(\"zones\", ({ query, request }) =>\n          as(\n            \"zones\",\n            request,\n            Effect.map(\n              connect.zones(query.provider === undefined ? {} : { provider: query.provider }),\n              (listing): Zones => ({\n                zones: listing.zones.map(({ connectionId, provider, target }) => ({\n                  connectionId,\n                  provider,\n                  zone: target.zone,\n                  label: target.label,\n                  ...(target.nameservers === undefined ? {} : { nameservers: target.nameservers }),\n                })),\n                connections: listing.connections,\n                providers: listing.providers,\n              }),\n            ),\n          ),\n        )\n        .handle(\"start\", ({ payload, request }) =>\n          as(\n            \"start\",\n            request,\n            Effect.gen(function* () {\n              // Token methods connect in one call; the interactive ones need somewhere to land.\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: payload.provider,\n                      options,\n                      route: START_ROUTE,\n                    })).toString();\n              const started = yield* connect.start({\n                provider: payload.provider,\n                ...(payload.domain === undefined ? {} : { domain: payload.domain }),\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, payload.domain);\n            }),\n          ),\n        )\n        .handle(\"reconnect\", ({ params, payload, request }) =>\n          as(\n            \"reconnect\",\n            request,\n            Effect.gen(function* () {\n              const connection = yield* storage.connections.get(params.connectionId);\n              const authorization = yield* storage.authorizations.get(connection.authorizationId);\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: authorization.provider,\n                      options,\n                      route: reconnectRoute(params.connectionId),\n                    })).toString();\n              const started = yield* connect.reconnect({\n                connectionId: params.connectionId,\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, undefined);\n            }),\n          ),\n        )\n        .handle(\"callback\", ({ params, query, request }) =>\n          as(\n            \"callback\",\n            request,\n            Effect.gen(function* () {\n              const url = yield* absoluteUrl(request);\n              // Resolve the destination against the callback's public base, not the request: a\n              // proxy that rewrites `Host` leaves the request on an origin the browser never sees.\n              const base = yield* callbackUrlFor({\n                request,\n                provider: params.provider,\n                options,\n                route: callbackRoute(params.provider),\n              });\n              // Where the customer lands comes from the continuation this owner started, never\n              // from the provider's query string, and it is resolved before the callback is spent:\n              // a server with nowhere to send them must not connect the provider and then fail.\n              const continuation = yield* storage.continuations.get(query.state);\n              const requested = continuation.returnTo ?? options.defaultReturnTo;\n              if (requested === undefined) {\n                return yield* invalid(\n                  \"The flow carried no returnTo and the server has no defaultReturnTo\",\n                  \"returnTo\",\n                );\n              }\n              const destination = sameOrigin(requested, base);\n              if (destination === null) {\n                return yield* invalid(`${requested} leaves this application`, \"returnTo\");\n              }\n              yield* connect.complete({\n                continuationId: query.state,\n                callbackUrl: url.toString(),\n              });\n              return HttpApiSchema.withHeaders({\n                body: undefined as void,\n                headers: { location: destination },\n              });\n            }),\n          ),\n        )\n        .handle(\"attach\", ({ params, payload, request }) =>\n          as(\n            \"attach\",\n            request,\n            attachAt({\n              connectionId: params.connectionId,\n              domain: payload.domain,\n              zone: payload.zone,\n            }),\n          ),\n        )\n        .handle(\"detach\", ({ params, request }) =>\n          as(\"detach\", request, connect.detach(params.attachmentId)),\n        )\n        .handle(\"disconnect\", ({ params, request }) =>\n          as(\"disconnect\", request, connect.disconnect(params.connectionId)),\n        )\n        .handle(\"createPlan\", ({ params, payload, request }) =>\n          as(\n            \"createPlan\",\n            request,\n            provision.plan({ domain: params.domain, requirements: payload.requirements }),\n          ),\n        )\n        .handle(\"approve\", ({ params, payload, request }) =>\n          as(\n            \"approve\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).approve(params.planId, {\n                ...(payload.operationIds === undefined\n                  ? {}\n                  : { operationIds: payload.operationIds, allowPartial: true }),\n              });\n            }),\n          ),\n        )\n        .handle(\"reject\", ({ params, payload, request }) =>\n          as(\n            \"reject\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).reject(params.planId, {\n                ...(payload.reason === undefined ? {} : { reason: payload.reason }),\n              });\n            }),\n          ),\n        )\n        .handle(\"apply\", ({ params, request }) =>\n          as(\n            \"apply\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.byApproval(params.approvalId);\n              return yield* kindOf(attempt).apply(params.approvalId);\n            }),\n          ),\n        )\n        .handle(\"plan\", ({ params, request }) =>\n          as(\n            \"plan\",\n            request,\n            Effect.map(storage.attempts.get(params.planId), (attempt) => ({\n              plan: attempt.plan,\n              status: attempt.status,\n              approval: attempt.approval,\n              receipt: attempt.receipt,\n              rejection: attempt.rejection,\n            })),\n          ),\n        )\n        .handle(\"receipt\", ({ params, request }) =>\n          as(\n            \"receipt\",\n            request,\n            Effect.flatMap(storage.attempts.byReceipt(params.receiptId), (attempt) =>\n              attempt.receipt === null\n                ? Errors.fail(new Reason.NotFound({ entity: \"receipt\", id: params.receiptId }))\n                : Effect.succeed(attempt.receipt),\n            ),\n          ),\n        )\n        .handle(\"observe\", ({ params, payload, request }) =>\n          as(\n            \"observe\",\n            request,\n            verify.observe({\n              domain: params.domain,\n              ...(payload.requirements === undefined ? {} : { requirements: payload.requirements }),\n            }),\n          ),\n        )\n        .handle(\"cleanupPlan\", ({ params, request }) =>\n          as(\"cleanupPlan\", request, cleanup.plan({ receiptId: params.receiptId })),\n        );\n    }),\n  ) as Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services>;\n\n/** A standalone API for hosts not on HttpApi. Mount at any prefix. */\nexport const api: HttpApi.HttpApi<\"domainkit\", Group> = HttpApi.make(\"domainkit\").add(group);\n\nexport interface WebHandlerOptions extends Options {\n  /** Mount every route under this path, e.g. `/api/domainkit`. */\n  readonly prefix?: `/${string}`;\n}\n\n/** The Promise edge: a `fetch`-shaped handler over the group for hosts that are not Effect-native. */\nexport const toWebHandler = (\n  services: Layer.Layer<Services, Errors.DomainKitError>,\n  options: WebHandlerOptions = {},\n): {\n  readonly handler: (request: Request) => Promise<Response>;\n  readonly dispose: () => Promise<void>;\n} => {\n  // `group.prefix` widens the endpoint paths in the type, which `Group` states unprefixed; the\n  // handlers are keyed by endpoint identifier, so the routes still line up.\n  const prefixed =\n    options.prefix === undefined\n      ? api\n      : (HttpApi.make(\"domainkit\").add(group.prefix(options.prefix)) as unknown as HttpApi.HttpApi<\n          \"domainkit\",\n          Group\n        >);\n  const app = HttpApiBuilder.layer(prefixed).pipe(\n    Layer.provide(layer(prefixed, options)),\n    Layer.provide(services),\n    Layer.provide(HttpServer.layerServices),\n  );\n  return HttpRouter.toWebHandler(app, { disableLogger: true });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAa,WAAb,cAA8B,QAAQ,QAAmC,CAAC,CACxE,4BACF,CAAC,CAAC,CAAC;AAMH,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAgB;CAAa;AAAW,CAAC;;AAI1F,MAAa,QAAQ,OAAO,OAAO;CACjC,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ,OAAO;AACjB,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO;CAC5C,MAAMA;CACN,OAAO,OAAO;CACd,SAAS,OAAO,OAAO,OAAO,MAAM;CACpC,QAAQ,OAAO,OAAO,OAAO,MAAM,KAAK,CAAC;AAC3C,CAAC;;;AAKD,MAAa,aAAa,OAAO,OAAO;CACtC,IAAI,OAAO;CACX,OAAO,OAAO;AAChB,CAAC;AAGD,MAAa,WAAW,OAAO,OAAO;CACpC,QAAQ,OAAO;CACf,YAAY,OAAO,OAAO,UAAU;CACpC,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,UAAU,OAAO,OAAO,OAAO,MAAM;CACrC,QAAQ,OAAO,OAAOA,UAAkB;CACxC,QAAQ;CACR,eAAe,OAAO,OAAO,OAAO,MAAM;;CAE1C,mBAAmB,OAAO;CAC1B,UAAU,OAAO,MACf,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQA;CACV,CAAC,CACH;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;;;;;;AAQD,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,EACpD,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,UAAU,OAAO,YAAY,OAAO,MAAM,EAC5C,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,cAAb,cAAiC,OAAO,YACtC,sCACF,CAAC,CAAC,eAAe,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACnE,MAAa,SAAS,OAAO,MAAM;CAAC;CAAO;CAAO;AAAW,CAAC;;AAI9D,MAAa,eAAe,OAAO,OAAO;CACxC,QAAQ,OAAO,YAAY,OAAO,MAAM;CACxC,UAAU,OAAO;CACjB,QAAQ;AACV,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO,EAAE,QAAQ,OAAO,CAAC;;AAIhE,IAAa,YAAb,cAA+B,OAAO,MAAiB,6BAA6B,CAAC,CAAC;CACpF,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,YAAb,cAA+B,OAAO,YAAuB,qCAAqC,CAAC,CACjG,aACA;CACE,cAAc,OAAO;CACrB,UAAU,OAAO;CACjB,OAAO,OAAO;CACd,UAAU,OAAO,OAAO,QAAQ;AAClC,CACF,CAAC,CAAC,CAAC;AACH,IAAa,WAAb,cAA8B,OAAO,YAAsB,oCAAoC,CAAC,CAC9F,YACA,EAAE,kBAAkB,OAAO,OAAO,CACpC,CAAC,CAAC,CAAC;AACH,IAAa,oBAAb,cAAuC,OAAO,YAC5C,6CACF,CAAC,CAAC,qBAAqB;CAAE,cAAc,OAAO;CAAQ,YAAY,OAAO,MAAM,SAAS;AAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAa,UAAU,OAAO,MAAM;CAAC;CAAW;CAAU;AAAiB,CAAC;;;;;;AAQ5E,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAAC,CAAC,CAAC;AAC3F,IAAa,6BAAb,cAAgD,OAAO,YACrD,+CACF,CAAC,CAAC,qBAAqB,EACrB,YAAY,OAAO,MACjB,OAAO,OAAO;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAC1F,EACF,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CACZ,aAAa,OAAO,MAAM,OAAO,MAAM;CACvC,MAAM,OAAO,OAAO,OAAO,OAAO,EAAE,UAAU,OAAO,OAAO,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,YAAY,OAAO,MAAM;CACpC;CACA;CACA;AACF,CAAC;;AAID,MAAa,OAAO,OAAO,OAAO;CAChC,cAAc,OAAO;CACrB,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,OAAO,OAAO;CACd,aAAa,OAAO,YAAY,OAAO,MAAM,OAAO,MAAM,CAAC;AAC7D,CAAC;;;;;AAOD,MAAa,QAAQ,OAAO,OAAO;CACjC,OAAO,OAAO,MAAM,IAAI;CACxB,aAAa,OAAO,MAClB,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQ;CACV,CAAC,CACH;;CAEA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;CACzC,QAAQ,OAAO;;CAEf,MAAM,OAAO,YAAY,OAAO,MAAM;AACxC,CAAC;AAGD,MAAa,cAAc,OAAO,OAAO,EACvC,cAAc,OAAO,MAAMC,KAAe,EAC5C,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMA,KAAe,CAAC,EAChE,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMC,WAAgB,CAAC,EACjE,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;;AAEzC,QAAQ,OAAO,YAAY,OAAO,MAAM,EAC1C,CAAC;;AAID,MAAa,UAAU,OAAO,OAAO;CACnC,MAAMC;CACN,QAAQC;CACR,UAAU,OAAO,OAAOC,OAAc;CACtC,SAAS,OAAO,OAAOC,OAAa;CACpC,WAAW,OAAO,OAAOC,SAAiB;AAC5C,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,SAASC;CACT,cAAc,OAAO,MACnB,OAAO,OAAO;EACZ,aAAa,OAAO,OAAON,WAAgB;EAC3C,QAAQD;EACR,QAAQQ;EACR,UAAU,OAAO,MAAMC,QAAe;CACxC,CAAC,CACH;CACA,MAAM,OAAO,MAAMC,YAAmB;CACtC,WAAW,OAAO;CAClB,aAAa,OAAO,OAAO,OAAO,qBAAqB;AACzD,CAAC;AAGD,MAAM,aAAa,cAAc,YAAY,cAAc,MAAM,GAAG,GAAG,EACrE,UAAU,OAAO,OACnB,CAAC;;AAOD,MAAM,WAAW,WAAA,eACO,MACpB,OAAO,YAAY,UAAiC,MAAM,eAAe,MAAM,CACjF,CAAC,CAAC,KAAK,cAAc,OAAO,MAAM,CAAC;AAErC,MAAM,SAAS;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC,CAAC,IAAI,OAAO;AAMxE,MAAa,QAAQ,aAAa,KAAK,WAAW,CAAC,CAChD,IACC,gBAAgB,IAAI,WAAW,oBAAoB;CACjD,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,8BAA8B;CAC5D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,SAAS,UAAU;CACrC,OAAO,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE;CACrD,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gBAAgB;CAC5C,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,uBAAuB;CACrD,QAAQ,EAAE,UAAU,OAAO,OAAO;CAIlC,OAAO;EAAE,OAAO,OAAO;EAAQ,MAAM,OAAO,YAAY,OAAO,MAAM;CAAE;CACvE,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,aAAa,4CAA4C;CAC5E,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,0CAA0C;CACvE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,UAAU,8BAA8B;CAC7D,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,cAAc,8BAA8B;CACjE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,cAAc,0BAA0B;CAC3D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,4BAA4B;CAC1D,QAAQ,EAAE,QAAQS,OAAY;CAC9B,SAAS;CACT,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,6BAA6B;CAC1D,QAAQ,EAAE,QAAQO,OAAY;CAC9B,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gCAAgC;CAC5D,QAAQ,EAAE,YAAYC,WAAoB;CAC1C,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,QAAQ,kBAAkB;CAC5C,QAAQ,EAAE,QAAQM,OAAY;CAC9B,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,WAAW,wBAAwB;CACrD,QAAQ,EAAE,WAAWE,UAAkB;CACvC,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,iCAAiC;CAC/D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,eAAe,sCAAsC;CACxE,QAAQ,EAAE,WAAWQ,UAAkB;CACvC,SAASX;CACT,OAAO;AACT,CAAC,CACH;AAgCF,MAAM,cAAc;AACpB,MAAM,kBAAkB,iBACtB,gBAAgB,mBAAmB,YAAY,EAAE;AACnD,MAAM,iBAAiB,aAAqB,aAAa,mBAAmB,QAAQ;AAEpF,MAAM,WAAW,SAAiB,UAChCY,KAAY,IAAIC,aAAoB;CAAE;CAAS,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AAAG,CAAC,CAAC;;AAG7F,MAAM,eACJ,YAEA,OAAO,cAAc;CACnB,IAAI;EACF,OAAO,OAAO,QAAQ,IAAI,IAAI,QAAQ,WAAW,CAAC;CACpD,QAAQ;EACN,MAAM,MAAM,kBAAkB,MAAM,OAAO;EAC3C,OAAO,OAAO,OAAO,GAAG,IACpB,QAAQ,yDAAyD,iBAAiB,IAClF,OAAO,QAAQ,IAAI,KAAK;CAC9B;AACF,CAAC;;;;;;;AAQH,MAAM,kBAAkB,UAOtB,OAAO,cAAc;CACnB,MAAM,SAAS,aAAa,mBAAmB,MAAM,QAAQ;CAC7D,MAAM,aAAa,MAAM,QAAQ;CACjC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,IAAI;EAChB,WAAW,IAAI,IAAI,GAAG,WAAW,QAAQ,QAAQ,EAAE,IAAI,QAAQ;EAC/D,aAAa,2BAA2B,GAAG,WAAW,cAAc;CACtE,CAAC;CAEH,OAAO,OAAO,QAAQ,YAAY,MAAM,OAAO,IAAI,QAAQ;EACzD,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,KAAK,SAAS,MAAM,KAAK,GAC5B,OAAO,QACL,OAAO,MAAM,MAAM,2DACnB,iBACF;EAEF,OAAO,OAAO,QACZ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,MAAM,GAAG,KAAK,SAAS,MAAM,MAAM,MAAM,IAAI,QAAQ,CACpF;CACF,CAAC;AACH,CAAC;AAEH,MAAM,8BAA8B,YAClC,IAAIC,eAAsB,EACxB,QAAQ,IAAID,aAAoB;CAAE;CAAS,OAAO;AAAkB,CAAC,EACvE,CAAC;;;;;;AAOH,MAAM,cAAc,aAAqB,aAAiC;CACxE,IAAI;EAIF,MAAM,MAAM,IAAI,IAAI,aAAa,QAAQ;EACzC,OAAO,IAAI,WAAW,SAAS,SAAS,IAAI,SAAS,IAAI;CAC3D,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,cAAc,cAA0C;CAC5D,QAAQ,SAAS;CACjB,YACE,SAAS,eAAe,OACpB,OACA;EAAE,IAAI,SAAS,WAAW;EAAI,OAAO,SAAS,WAAW;CAAM;CACrE,cAAc,SAAS,YAAY,MAAM;CACzC,UAAU,SAAS,eAAe,YAAY;CAC9C,QAAQ,SAAS,eAAe,UAAU;CAC1C,QACE,SAAS,eAAe,OACpB,iBACA,SAAS,eAAe,eAAe,WACrC,cACA;CACR,eAAe,SAAS;CACxB,mBAAmB,SAAS;CAC5B,UAAU,SAAS,SAAS,KAAK,EAAE,YAAY,UAAU,cAAc;EACrE,cAAc,WAAW;EACzB;EACA;CACF,EAAE;CACF,WAAW,SAAS,UAAU,KAAK,EAAE,IAAI,MAAM,eAAe;EAAE;EAAI;EAAM;CAAQ,EAAE;AACtF;;AAGA,MAAM,YAAY,WAAmC;CACnD,QAAQ,OAAO,MAAf;EACE,KAAK,SACH,OAAA,SAAsB,MAAM,OAAO,MAAM;EAC3C,KAAK,SACH,OAAA,SAAsB,MACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;EACF,KAAK,eACH,OAAA,SAAsB,YACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;CACJ;AACF;AAEA,MAAM,gBACJ,eAC6B,WAAW,KAAK,EAAE,MAAM,YAAY,IAAI,UAAU;CAAE;CAAM;AAAM,CAAC,CAAC;;;;;AAMjG,MAAa,SACX,KACA,UAAmB,CAAC,MAIpB,eAAe,MAAM,KAAiD,cAAc,aAClF,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAOE;CACvB,MAAM,YAAY,OAAOC;CACzB,MAAM,UAAU,OAAOC;CACvB,MAAM,SAAS,OAAOC;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,YAAY,OAAOC;;;;;CAMzB,MAAM,MACJ,UACA,SACA,WAEA,OAAO,QAAQ,SAAS,UAAU,OAAO,IAAI,cAC3C,OAAO,QAAQ,SAAS,YAAY,WAAW,QAAQ,KAAK,OAAO,YACjE,OAAO,eAAe,QAAQC,SAAmB,SAAS,CAC5D,CACF;CAEF,MAAM,YAAY,WAAmB,OAAO,IAAI,QAAQ,QAAQ,MAAM,GAAG,UAAU;CAEnF,MAAM,cAAc,cAA4C;EAC9D,QAAQ,UAAU,MAAlB;GACE,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,cAAc,UAAU;IACxB,MAAM,UAAU,OAAO;IACvB,OAAO,UAAU,OAAO;GAC1B,CAAC;GACH,KAAK,qBACH,OAAO,IAAI,2BAA2B,EACpC,YAAY,UAAU,WAAW,KAAK,EAAE,cAAc,cAAc;IAClE;IACA,MAAM,OAAO;IACb,OAAO,OAAO;GAChB,EAAE,EACJ,CAAC;GACH,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,aAAa,UAAU;IACvB,MAAM,UAAU;GAClB,CAAC;EACL;CACF;;;;;CAMA,MAAM,aAAa,UAKjB,OAAO,IAAI,aAAa;EACtB,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,MAAM,WAAW,eAAe;EACxF,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,OAAO,IAAI,UAAU;GACnB,cAAc,MAAM,WAAW;GAC/B,UAAU,cAAc;GACxB,OAAO,MAAM,YAAY,SAAS,WAAW;GAC7C,UAAU,MAAM,WAAW,KAAA,IAAY,OAAO,OAAO,SAAS,MAAM,MAAM;EAC5E,CAAC;CACH,CAAC;CAEH,MAAM,aACJ,SACA,WACqE;EACrE,QAAQ,QAAQ,MAAhB;GACE,KAAK,aACH,OAAO,UAAU;IACf,YAAY,QAAQ;IACpB,YAAY,QAAQ;IACpB;GACF,CAAC;GACH,KAAK,YACH,OAAO,OAAO,QAAQ,IAAI,SAAS,EAAE,kBAAkB,QAAQ,iBAAiB,CAAC,CAAC;GACpF,KAAK,qBACH,OAAO,OAAO,QACZ,IAAI,kBAAkB;IACpB,cAAc,QAAQ,WAAW;IACjC,YAAY,aAAa,QAAQ,UAAU;GAC7C,CAAC,CACH;EACJ;CACF;;;;;CAMA,MAAM,YAAY,UAKhB,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,MAAM,YAAY;EACpE,MAAM,YAAY,eAChB,UAAU;GAAE;GAAY;GAAY,QAAQ,MAAM;EAAO,CAAC;EAC5D,MAAM,QAAQ,OAAO,QAAQ,OAAO;GAClC,cAAc,MAAM;GACpB,QAAQ,MAAM;EAChB,CAAC;EACD,IAAI,EAAE,UAAU,QAAQ,OAAO,OAAO,SAAS,KAAK;EACpD,IAAI,MAAM,SAAS,KAAA,GACjB,OAAO,IAAI,kBAAkB;GAC3B,cAAc,MAAM;GACpB,YAAY,aAAa,MAAM,UAAU;EAC3C,CAAC;EAEH,MAAM,SAAS,MAAM,WAAW,MAAM,EAAE,WAAW,SAAS,MAAM,IAAI;EACtE,IAAI,WAAW,KAAA,GACb,OAAO,OAAOT,KAAY,IAAIU,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC;EAEnF,MAAM,SAAS,OAAO,QAAQ,OAAO;GACnC,cAAc,MAAM;GACpB,QAAQ,MAAM;GACd;EACF,CAAC;EACD,OAAO,UAAU,SACb,OAAOV,KAAY,IAAIU,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC,IAC1E,OAAO,SAAS,MAAM;CAC5B,CAAC;;CAGH,MAAM,UAAU,YACd,QAAQ,SAAS,YAAY,UAAU;CAEzC,OAAO,SACJ,OAAO,YAAY,EAAE,QAAQ,cAAc,GAAG,WAAW,SAAS,SAAS,OAAO,MAAM,CAAC,CAAC,CAAC,CAC3F,OAAO,aAAa,EAAE,QAAQ,cAC7B,GAAG,YAAY,SAAS,OAAO,IAAI,QAAQ,SAAS,OAAO,MAAM,GAAG,UAAU,CAAC,CACjF,CAAC,CACA,OAAO,UAAU,EAAE,OAAO,cACzB,GACE,SACA,SACA,OAAO,IACL,QAAQ,MAAM,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS,CAAC,IAC7E,aAAoB;EACnB,OAAO,QAAQ,MAAM,KAAK,EAAE,cAAc,UAAU,cAAc;GAChE;GACA;GACA,MAAM,OAAO;GACb,OAAO,OAAO;GACd,GAAI,OAAO,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,OAAO,YAAY;EAChF,EAAE;EACF,aAAa,QAAQ;EACrB,WAAW,QAAQ;CACrB,EACF,CACF,CACF,CAAC,CACA,OAAO,UAAU,EAAE,SAAS,cAC3B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EAEtB,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,QAAQ;GAClB;GACA,OAAO;EACT,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,MAAM;GACnC,UAAU,QAAQ;GAClB,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;GACjE,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,QAAQ,MAAM;CACjD,CAAC,CACH,CACF,CAAC,CACA,OAAO,cAAc,EAAE,QAAQ,SAAS,cACvC,GACE,aACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,OAAO,YAAY;EACrE,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,cAAc;GACxB;GACA,OAAO,eAAe,OAAO,YAAY;EAC3C,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,UAAU;GACvC,cAAc,OAAO;GACrB,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,KAAA,CAAS;CAC5C,CAAC,CACH,CACF,CAAC,CACA,OAAO,aAAa,EAAE,QAAQ,OAAO,cACpC,GACE,YACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,YAAY,OAAO;EAGtC,MAAM,OAAO,OAAO,eAAe;GACjC;GACA,UAAU,OAAO;GACjB;GACA,OAAO,cAAc,OAAO,QAAQ;EACtC,CAAC;EAKD,MAAM,aAAY,OADU,QAAQ,cAAc,IAAI,MAAM,KAAK,EAAA,CAClC,YAAY,QAAQ;EACnD,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,QACZ,sEACA,UACF;EAEF,MAAM,cAAc,WAAW,WAAW,IAAI;EAC9C,IAAI,gBAAgB,MAClB,OAAO,OAAO,QAAQ,GAAG,UAAU,2BAA2B,UAAU;EAE1E,OAAO,QAAQ,SAAS;GACtB,gBAAgB,MAAM;GACtB,aAAa,IAAI,SAAS;EAC5B,CAAC;EACD,OAAO,cAAc,YAAY;GAC/B,MAAM,KAAA;GACN,SAAS,EAAE,UAAU,YAAY;EACnC,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,SAAS;EACP,cAAc,OAAO;EACrB,QAAQ,QAAQ;EAChB,MAAM,QAAQ;CAChB,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,cAC3B,GAAG,UAAU,SAAS,QAAQ,OAAO,OAAO,YAAY,CAAC,CAC3D,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,cAC/B,GAAG,cAAc,SAAS,QAAQ,WAAW,OAAO,YAAY,CAAC,CACnE,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,SAAS,cACxC,GACE,cACA,SACA,UAAU,KAAK;EAAE,QAAQ,OAAO;EAAQ,cAAc,QAAQ;CAAa,CAAC,CAC9E,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,QAAQ,OAAO,QAAQ,EACnD,GAAI,QAAQ,iBAAiB,KAAA,IACzB,CAAC,IACD;GAAE,cAAc,QAAQ;GAAc,cAAc;EAAK,EAC/D,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,EAClD,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO,EACnE,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,UAAU,EAAE,QAAQ,cAC1B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,WAAW,OAAO,UAAU;EACpE,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,MAAM,OAAO,UAAU;CACvD,CAAC,CACH,CACF,CAAC,CACA,OAAO,SAAS,EAAE,QAAQ,cACzB,GACE,QACA,SACA,OAAO,IAAI,QAAQ,SAAS,IAAI,OAAO,MAAM,IAAI,aAAa;EAC5D,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,UAAU,QAAQ;EAClB,SAAS,QAAQ;EACjB,WAAW,QAAQ;CACrB,EAAE,CACJ,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,cAC5B,GACE,WACA,SACA,OAAO,QAAQ,QAAQ,SAAS,UAAU,OAAO,SAAS,IAAI,YAC5D,QAAQ,YAAY,OAChBV,KAAY,IAAIU,SAAgB;EAAE,QAAQ;EAAW,IAAI,OAAO;CAAU,CAAC,CAAC,IAC5E,OAAO,QAAQ,QAAQ,OAAO,CACpC,CACF,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,QAAQ;EACb,QAAQ,OAAO;EACf,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;CACrF,CAAC,CACH,CACF,CAAC,CACA,OAAO,gBAAgB,EAAE,QAAQ,cAChC,GAAG,eAAe,SAAS,QAAQ,KAAK,EAAE,WAAW,OAAO,UAAU,CAAC,CAAC,CAC1E;AACJ,CAAC,CACH;;AAGF,MAAa,MAA2C,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,KAAK;;AAQ3F,MAAa,gBACX,UACA,UAA6B,CAAC,MAI3B;CAGH,MAAM,WACJ,QAAQ,WAAW,KAAA,IACf,MACC,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,MAAM,OAAO,QAAQ,MAAM,CAAC;CAIjE,MAAM,MAAM,eAAe,MAAM,QAAQ,CAAC,CAAC,KACzC,MAAM,QAAQ,MAAM,UAAU,OAAO,CAAC,GACtC,MAAM,QAAQ,QAAQ,GACtB,MAAM,QAAQ,WAAW,aAAa,CACxC;CACA,OAAO,WAAW,aAAa,KAAK,EAAE,eAAe,KAAK,CAAC;AAC7D"}

package/dist/Storage.mjs

@@ -83,6 +83,8 @@ var Attachment = class extends Schema.Class("@domainkit/Storage/Attachment")({
 	connectionId: Schema.String,
 	domain: Schema.String,
 	zone: Schema.String,
+	/** The target's label as the provider gave it at attach time, so a UI names the account without a provider call. */
+	label: Schema.String,
 	/** Provider zone identity (zone id, account id) decoded by the provider's `context` schema. */
 	target: Schema.Unknown,
 	createdAt: Schema.DateTimeUtcFromString