domainkit 0.12.2 → 0.14.0

package/README.md

@@ -109,7 +109,10 @@ The host provides two services beneath the layer and one per request:
 redirect and `Connect.complete`), attaches domains, refreshes credentials before they expire, and
 revokes them on disconnect. `Verify.observe` reads the provider and public DNS, stores readiness
 per requirement, and tells you when to look again; pass `requirements` to observe records a
-customer applies by hand on a domain with no attachment.
+customer applies by hand on a domain with no attachment. The stored readiness is the single fact
+about a domain: `Verify.latest` reads it back without observing, `Verify.summary` counts it, and
+`Verify.Observer` tells your application when DomainKit wrote it, so the clock and the projection
+are yours and the copy is not.
 
 ## Mount the routes
 

package/dist/DomainKit.mjs

@@ -15,8 +15,9 @@ import { Layer, Redacted } from "effect";
 * provides `Storage` and `Custody` beneath it, the same way `Persistence.layer` sits over a
 * backing store in Effect.
 *
-* Defaults: `Resolver.layer` (Cloudflare + Google DoH) and the `Policy` references. Override a
-* policy with `Effect.provideService`; pass `resolver` for a different pool.
+* Defaults: `Resolver.layer` (Cloudflare + Google DoH) and the reference-shaped seams, `Verify.Policy`
+* and `Verify.Observer`. Override either with `Effect.provideService` or `Layer.succeed` over this
+* layer; pass `resolver` for a different pool.
 */
 var DomainKit_exports = /* @__PURE__ */ __exportAll({
 	Error: () => DomainKitError,

package/dist/DomainKit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"DomainKit.mjs","names":["Provision.layer","Cleanup.layer","Verify.layer","Connect.layer","Providers.layer","Resolver.layer","Storage.layerMemory","Custody.layer","Custody.generateKey"],"sources":["../src/DomainKit.ts"],"sourcesContent":["/**\n * The composed layer. Provides every lifecycle service given a list of providers; the host\n * provides `Storage` and `Custody` beneath it, the same way `Persistence.layer` sits over a\n * backing store in Effect.\n *\n * Defaults: `Resolver.layer` (Cloudflare + Google DoH) and the `Policy` references. Override a\n * policy with `Effect.provideService`; pass `resolver` for a different pool.\n */\nimport { Layer, Redacted } from \"effect\";\n\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as Custody from \"./Custody.ts\";\nimport { DomainKitError } from \"./internal/error.ts\";\nimport type * as Provider from \"./Provider.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Resolver from \"./Resolver.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\nexport { DomainKitError as Error };\nexport type { Category as ErrorCategory } from \"./internal/error.ts\";\n\nexport const isError = (input: unknown): input is DomainKitError => input instanceof DomainKitError;\n\nexport interface Options {\n  readonly providers: ReadonlyArray<Provider.Definition>;\n  /** Replace the public DNS pool (e.g. `Testing.resolver()`); default `Resolver.layer`. */\n  readonly resolver?: Layer.Layer<Resolver.Service>;\n}\n\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Resolver.Service;\n\nexport const layer = (\n  options: Options,\n): Layer.Layer<Services, never, Storage.Service | Custody.Service> =>\n  Layer.mergeAll(Provision.layer, Cleanup.layer, Verify.layer).pipe(\n    Layer.provideMerge(Connect.layer),\n    Layer.provideMerge(\n      Layer.mergeAll(Providers.layer(options.providers), options.resolver ?? Resolver.layer),\n    ),\n  );\n\n/** `layer` with `Storage.layerMemory` and a throwaway custody key. Tests and playgrounds only. */\nexport const layerMemory = (\n  options: Options,\n): Layer.Layer<Services | Storage.Service | Custody.Service, DomainKitError> =>\n  layer(options).pipe(\n    Layer.provideMerge(\n      Layer.mergeAll(\n        Storage.layerMemory,\n        Custody.layer({ key: Redacted.make(Custody.generateKey()) }),\n      ),\n    ),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,WAAW,UAA4C,iBAAiB;AAgBrF,MAAa,SACX,YAEA,MAAM,SAASA,SAAiBC,SAAeC,OAAY,CAAC,CAAC,KAC3D,MAAM,aAAaC,OAAa,GAChC,MAAM,aACJ,MAAM,SAASC,QAAgB,QAAQ,SAAS,GAAG,QAAQ,YAAYC,OAAc,CACvF,CACF;;AAGF,MAAa,eACX,YAEA,MAAM,OAAO,CAAC,CAAC,KACb,MAAM,aACJ,MAAM,SACJC,eACAC,QAAc,EAAE,KAAK,SAAS,KAAKC,YAAoB,CAAC,EAAE,CAAC,CAC7D,CACF,CACF"}
+{"version":3,"file":"DomainKit.mjs","names":["Provision.layer","Cleanup.layer","Verify.layer","Connect.layer","Providers.layer","Resolver.layer","Storage.layerMemory","Custody.layer","Custody.generateKey"],"sources":["../src/DomainKit.ts"],"sourcesContent":["/**\n * The composed layer. Provides every lifecycle service given a list of providers; the host\n * provides `Storage` and `Custody` beneath it, the same way `Persistence.layer` sits over a\n * backing store in Effect.\n *\n * Defaults: `Resolver.layer` (Cloudflare + Google DoH) and the reference-shaped seams, `Verify.Policy`\n * and `Verify.Observer`. Override either with `Effect.provideService` or `Layer.succeed` over this\n * layer; pass `resolver` for a different pool.\n */\nimport { Layer, Redacted } from \"effect\";\n\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as Custody from \"./Custody.ts\";\nimport { DomainKitError } from \"./internal/error.ts\";\nimport type * as Provider from \"./Provider.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Resolver from \"./Resolver.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\nexport { DomainKitError as Error };\nexport type { Category as ErrorCategory } from \"./internal/error.ts\";\n\nexport const isError = (input: unknown): input is DomainKitError => input instanceof DomainKitError;\n\nexport interface Options {\n  readonly providers: ReadonlyArray<Provider.Definition>;\n  /** Replace the public DNS pool (e.g. `Testing.resolver()`); default `Resolver.layer`. */\n  readonly resolver?: Layer.Layer<Resolver.Service>;\n}\n\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Resolver.Service;\n\nexport const layer = (\n  options: Options,\n): Layer.Layer<Services, never, Storage.Service | Custody.Service> =>\n  Layer.mergeAll(Provision.layer, Cleanup.layer, Verify.layer).pipe(\n    Layer.provideMerge(Connect.layer),\n    Layer.provideMerge(\n      Layer.mergeAll(Providers.layer(options.providers), options.resolver ?? Resolver.layer),\n    ),\n  );\n\n/** `layer` with `Storage.layerMemory` and a throwaway custody key. Tests and playgrounds only. */\nexport const layerMemory = (\n  options: Options,\n): Layer.Layer<Services | Storage.Service | Custody.Service, DomainKitError> =>\n  layer(options).pipe(\n    Layer.provideMerge(\n      Layer.mergeAll(\n        Storage.layerMemory,\n        Custody.layer({ key: Redacted.make(Custody.generateKey()) }),\n      ),\n    ),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,WAAW,UAA4C,iBAAiB;AAgBrF,MAAa,SACX,YAEA,MAAM,SAASA,SAAiBC,SAAeC,OAAY,CAAC,CAAC,KAC3D,MAAM,aAAaC,OAAa,GAChC,MAAM,aACJ,MAAM,SAASC,QAAgB,QAAQ,SAAS,GAAG,QAAQ,YAAYC,OAAc,CACvF,CACF;;AAGF,MAAa,eACX,YAEA,MAAM,OAAO,CAAC,CAAC,KACb,MAAM,aACJ,MAAM,SACJC,eACAC,QAAc,EAAE,KAAK,SAAS,KAAKC,YAAoB,CAAC,EAAE,CAAC,CAC7D,CACF,CACF"}

package/dist/Server.mjs

@@ -244,6 +244,8 @@ const Readiness = Schema.Struct({
 	attachmentId: Schema.NullOr(Schema.String),
 	overall: Overall,
 	requirements: Schema.Array(Schema.Struct({
+		/** `Verify.requirementKey(record)`, so a client pairs rows by content, not by position. */
+		key: Schema.String,
 		operationId: Schema.NullOr(OperationId),
 		record: Model,
 		status: RequirementStatus,
@@ -341,6 +343,10 @@ const group = HttpApiGroup.make("domainkit").add(HttpApiEndpoint.get("inspect",
 	payload: ObservePayload,
 	success: Readiness,
 	error: errors
+})).add(HttpApiEndpoint.get("readiness", "/domains/:domain/readiness", {
+	params: { domain: Schema.String },
+	success: Schema.NullOr(Readiness),
+	error: errors
 })).add(HttpApiEndpoint.post("cleanupPlan", "/receipts/:receiptId/cleanup-plans", {
 	params: { receiptId: ReceiptId },
 	success: Model$1,
@@ -381,6 +387,16 @@ const callbackUrlFor = (input) => Effect.suspend(() => {
 		return Effect.succeed(new URL(`${url.origin}${path.slice(0, path.length - input.route.length)}${suffix}`));
 	});
 });
+/**
+* One refusal for every way a callback can fail to match a flow: no such `state`, one that has
+* expired, one presented at another provider's route, and one presented by a session that did not
+* start it. The text is constant on purpose — a caller holding a leaked `state` must not be able
+* to tell "no such flow" from "not your flow".
+*/
+const noSuchFlow = fail(new InvalidInput({
+	message: "This callback does not match a connection you started",
+	field: "state"
+}));
 const callbackConfigurationError = (message) => new DomainKitError({ reason: new InvalidInput({
 	message,
 	field: "callbackBaseUrl"
@@ -449,7 +465,7 @@ const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (han
 	* Run a lifecycle effect as the principal the host derives from this request, once the host
 	* has allowed that principal onto this route.
 	*/
-	const as = (endpoint, request, effect) => Effect.flatMap(identity.principal(request), (principal) => Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () => Effect.provideService(effect, Service, principal)));
+	const as = (endpoint, request, effect, context) => Effect.flatMap(identity.principal(request, context), (principal) => Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () => Effect.provideService(effect, Service, principal)));
 	const snapshot = (domain) => Effect.map(connect.inspect(domain), snapshotOf);
 	const discovered = (discovery) => {
 		switch (discovery._tag) {
@@ -573,27 +589,36 @@ const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (han
 			...callbackUrl === void 0 ? {} : { callbackUrl }
 		});
 		return yield* startedOf(started, void 0);
-	}))).handle("callback", ({ params, query, request }) => as("callback", request, Effect.gen(function* () {
-		const url = yield* absoluteUrl(request);
-		const base = yield* callbackUrlFor({
-			request,
-			provider: params.provider,
-			options,
-			route: callbackRoute(params.provider)
-		});
-		const requested = (yield* storage.continuations.get(query.state)).returnTo ?? options.defaultReturnTo;
-		if (requested === void 0) return yield* invalid("The flow carried no returnTo and the server has no defaultReturnTo", "returnTo");
-		const destination = sameOrigin(requested, base);
-		if (destination === null) return yield* invalid(`${requested} leaves this application`, "returnTo");
-		yield* connect.complete({
-			continuationId: query.state,
-			callbackUrl: url.toString()
-		});
-		return HttpApiSchema.withHeaders({
-			body: void 0,
-			headers: { location: destination }
+	}))).handle("callback", ({ params, query, request }) => Effect.gen(function* () {
+		const header = yield* storage.continuations.header(query.state).pipe(Effect.catch((error) => error.reason._tag === "NotFound" || error.reason._tag === "Expired" ? Effect.succeed(null) : Effect.fail(error)));
+		const continuation = header !== null && header.provider === params.provider ? header : null;
+		return yield* as("callback", request, Effect.gen(function* () {
+			const principal = yield* Service;
+			if (continuation === null || principal.ownerId !== continuation.ownerId || principal.actorId !== continuation.actorId) return yield* noSuchFlow;
+			const url = yield* absoluteUrl(request);
+			const base = yield* callbackUrlFor({
+				request,
+				provider: params.provider,
+				options,
+				route: callbackRoute(params.provider)
+			});
+			const requested = (yield* storage.continuations.get(query.state).pipe(Effect.catch((error) => error.reason._tag === "NotFound" || error.reason._tag === "Expired" ? noSuchFlow : Effect.fail(error)))).returnTo ?? options.defaultReturnTo;
+			if (requested === void 0) return yield* invalid("The flow carried no returnTo and the server has no defaultReturnTo", "returnTo");
+			const destination = sameOrigin(requested, base);
+			if (destination === null) return yield* invalid(`${requested} leaves this application`, "returnTo");
+			yield* connect.complete({
+				continuationId: query.state,
+				callbackUrl: url.toString()
+			});
+			return HttpApiSchema.withHeaders({
+				body: void 0,
+				headers: { location: destination }
+			});
+		}), continuation === null ? void 0 : {
+			endpoint: "callback",
+			continuation
 		});
-	}))).handle("attach", ({ params, payload, request }) => as("attach", request, attachAt({
+	})).handle("attach", ({ params, payload, request }) => as("attach", request, attachAt({
 		connectionId: params.connectionId,
 		domain: payload.domain,
 		zone: payload.zone
@@ -624,7 +649,7 @@ const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (han
 	})) : Effect.succeed(attempt.receipt)))).handle("observe", ({ params, payload, request }) => as("observe", request, verify.observe({
 		domain: params.domain,
 		...payload.requirements === void 0 ? {} : { requirements: payload.requirements }
-	}))).handle("cleanupPlan", ({ params, request }) => as("cleanupPlan", request, cleanup.plan({ receiptId: params.receiptId })));
+	}))).handle("readiness", ({ params, request }) => as("readiness", request, verify.latest(params.domain))).handle("cleanupPlan", ({ params, request }) => as("cleanupPlan", request, cleanup.plan({ receiptId: params.receiptId })));
 }));
 /** A standalone API for hosts not on HttpApi. Mount at any prefix. */
 const api = HttpApi.make("domainkit").add(group);

package/dist/Server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Server.mjs","names":["Storage.AuthMethod","DnsRecord.Model","Plan.OperationId","Plan.Model","Storage.AttemptStatus","Approval.Model","Receipt.Model","Storage.Rejection","Storage.Overall","Storage.RequirementStatus","Verify.Evidence","Verify.HostEvidence","Plan.PlanId","Approval.ApprovalId","Receipt.ReceiptId","Errors.fail","Reason.InvalidInput","Errors.DomainKitError","Connect.Service","Provision.Service","Cleanup.Service","Verify.Service","Storage.Service","Providers.Service","Principal.Service","Reason.NotFound"],"sources":["../src/Server.ts"],"sourcesContent":["/**\n * domainkit/server — the whole lifecycle as one HttpApi group the host mounts.\n *\n *   const Api = HttpApi.make(\"app\").add(Server.group)\n *   const ApiLive = HttpApiBuilder.layer(Api).pipe(\n *     Layer.provide([Server.layer(Api), DomainKitLive, IdentityLive]),\n *   )\n *\n * The host provides `Identity` (request -> `Principal.Interface`). Everything else comes from\n * `DomainKit.layer`. Non-HttpApi hosts use `toWebHandler`. The group carries no prefix of its\n * own, so `group.prefix(\"/internal/dns\")` or a host router mount is all a different base path\n * takes; callback URLs follow the mount.\n */\nimport { Context, Effect, Layer, Option, Schema } from \"effect\";\nimport * as HttpRouter from \"effect/unstable/http/HttpRouter\";\nimport * as HttpServer from \"effect/unstable/http/HttpServer\";\nimport * as HttpServerRequest from \"effect/unstable/http/HttpServerRequest\";\nimport * as HttpApi from \"effect/unstable/httpapi/HttpApi\";\nimport * as HttpApiBuilder from \"effect/unstable/httpapi/HttpApiBuilder\";\nimport * as HttpApiEndpoint from \"effect/unstable/httpapi/HttpApiEndpoint\";\nimport * as HttpApiGroup from \"effect/unstable/httpapi/HttpApiGroup\";\nimport * as HttpApiSchema from \"effect/unstable/httpapi/HttpApiSchema\";\n\nimport * as Approval from \"./Approval.ts\";\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Receipt from \"./Receipt.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\n/** The only service a host must implement for the server. */\nexport interface IdentityService {\n  readonly principal: (\n    request: HttpServerRequest.HttpServerRequest,\n  ) => Effect.Effect<Principal.Interface, Errors.DomainKitError>;\n  /**\n   * Which routes this principal may reach, checked after `principal` on every request. Fail with\n   * reason `Forbidden` for the 403 a UI expects. Without it every authenticated principal reaches\n   * every route, which is the right default for a host whose own middleware already gates the\n   * mount.\n   */\n  readonly authorize?: (\n    principal: Principal.Interface,\n    endpoint: EndpointName,\n  ) => Effect.Effect<void, Errors.DomainKitError>;\n}\n\nexport class Identity extends Context.Service<Identity, IdentityService>()(\n  \"@domainkit/server/Identity\",\n) {}\n\n// ---------------------------------------------------------------------------------------------\n// Wire schemas (the transport contract `domainkit/client` and `@domainkit/react` consume)\n// ---------------------------------------------------------------------------------------------\n\nexport const ConnectionStatus = Schema.Literals([\"disconnected\", \"connected\", \"reconnect\"]);\nexport type ConnectionStatus = typeof ConnectionStatus.Type;\n\n/** One value a token method needs, so a form renders without knowing the provider. */\nexport const Field = Schema.Struct({\n  name: Schema.String,\n  required: Schema.Boolean,\n  secret: Schema.Boolean,\n});\nexport type Field = typeof Field.Type;\n\n/** How a provider can be connected; `fields` is `null` for the interactive methods. */\nexport const MethodDescriptor = Schema.Struct({\n  kind: Storage.AuthMethod,\n  label: Schema.String,\n  docsUrl: Schema.NullOr(Schema.String),\n  fields: Schema.NullOr(Schema.Array(Field)),\n});\nexport type MethodDescriptor = typeof MethodDescriptor.Type;\n\n/** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */\n/** The attachment a domain holds, with the zone label the provider gave when it was created. */\nexport const Attachment = Schema.Struct({\n  id: Schema.String,\n  label: Schema.String,\n});\nexport type Attachment = typeof Attachment.Type;\n\nexport const Snapshot = Schema.Struct({\n  domain: Schema.String,\n  attachment: Schema.NullOr(Attachment),\n  connectionId: Schema.NullOr(Schema.String),\n  provider: Schema.NullOr(Schema.String),\n  method: Schema.NullOr(Storage.AuthMethod),\n  status: ConnectionStatus,\n  lastReceiptId: Schema.NullOr(Schema.String),\n  /** How many domains the connection serves, including this one; `0` without a connection. */\n  connectionDomains: Schema.Number,\n  reusable: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      method: Storage.AuthMethod,\n    }),\n  ),\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Snapshot = typeof Snapshot.Type;\n\n/**\n * How the client asks to connect. `values` is keyed by the provider's declared token fields, as\n * `Snapshot.providers[].methods[].fields` names them. Secrets are plaintext in transit and never\n * come back out.\n */\nexport class Token extends Schema.TaggedClass<Token>(\"@domainkit/server/Method/Token\")(\"Token\", {\n  values: Schema.Record(Schema.String, Schema.String),\n}) {}\nexport class OAuth extends Schema.TaggedClass<OAuth>(\"@domainkit/server/Method/OAuth\")(\"OAuth\", {\n  returnTo: Schema.optionalKey(Schema.String),\n}) {}\nexport class Integration extends Schema.TaggedClass<Integration>(\n  \"@domainkit/server/Method/Integration\",\n)(\"Integration\", { returnTo: Schema.optionalKey(Schema.String) }) {}\nexport const Method = Schema.Union([Token, OAuth, Integration]);\nexport type Method = typeof Method.Type;\n\n/** A start without a domain connects the account alone; the customer picks a zone afterwards. */\nexport const StartPayload = Schema.Struct({\n  domain: Schema.optionalKey(Schema.String),\n  provider: Schema.String,\n  method: Method,\n});\nexport type StartPayload = typeof StartPayload.Type;\n\n/** How the customer proves the account again. The provider is the connection's own. */\nexport const ReconnectPayload = Schema.Struct({ method: Method });\nexport type ReconnectPayload = typeof ReconnectPayload.Type;\n\n/** A zone the connection can serve, named for a customer to pick from. */\nexport class Candidate extends Schema.Class<Candidate>(\"@domainkit/server/Candidate\")({\n  zone: Schema.String,\n  label: Schema.String,\n}) {}\n\n/**\n * The connection the start produced. `label` names the account the way the customer will read it:\n * the attached zone's label, or the provider's name when the start carried no domain. `snapshot`\n * is the domain's state, and is null for a start that attached none.\n */\nexport class Connected extends Schema.TaggedClass<Connected>(\"@domainkit/server/Started/Connected\")(\n  \"Connected\",\n  {\n    connectionId: Schema.String,\n    provider: Schema.String,\n    label: Schema.String,\n    snapshot: Schema.NullOr(Snapshot),\n  },\n) {}\nexport class Redirect extends Schema.TaggedClass<Redirect>(\"@domainkit/server/Started/Redirect\")(\n  \"Redirect\",\n  { authorizationUrl: Schema.String },\n) {}\nexport class SelectionRequired extends Schema.TaggedClass<SelectionRequired>(\n  \"@domainkit/server/Started/SelectionRequired\",\n)(\"SelectionRequired\", { connectionId: Schema.String, candidates: Schema.Array(Candidate) }) {}\nexport const Started = Schema.Union([Connected, Redirect, SelectionRequired]);\nexport type Started = typeof Started.Type;\n\n/**\n * Which of the principal's connections already reaches a domain. The class names carry a\n * `Discovery` prefix because `Started` owns the unprefixed `SelectionRequired`; the wire tags are\n * the ones `Connect.Discovery` uses.\n */\nexport class DiscoveryResolved extends Schema.TaggedClass<DiscoveryResolved>(\n  \"@domainkit/server/Discovery/Resolved\",\n)(\"Resolved\", { connectionId: Schema.String, zone: Schema.String, label: Schema.String }) {}\nexport class DiscoverySelectionRequired extends Schema.TaggedClass<DiscoverySelectionRequired>(\n  \"@domainkit/server/Discovery/SelectionRequired\",\n)(\"SelectionRequired\", {\n  candidates: Schema.Array(\n    Schema.Struct({ connectionId: Schema.String, zone: Schema.String, label: Schema.String }),\n  ),\n}) {}\n/** `host` names the registered provider whose nameservers serve the domain, by definition id. */\nexport class DiscoveryNotFound extends Schema.TaggedClass<DiscoveryNotFound>(\n  \"@domainkit/server/Discovery/NotFound\",\n)(\"NotFound\", {\n  nameservers: Schema.Array(Schema.String),\n  host: Schema.NullOr(Schema.Struct({ provider: Schema.String })),\n}) {}\nexport const Discovery = Schema.Union([\n  DiscoveryResolved,\n  DiscoverySelectionRequired,\n  DiscoveryNotFound,\n]);\nexport type Discovery = typeof Discovery.Type;\n\n/** One zone a connection reaches, named for a customer to pick from. */\nexport const Zone = Schema.Struct({\n  connectionId: Schema.String,\n  provider: Schema.String,\n  zone: Schema.String,\n  label: Schema.String,\n  nameservers: Schema.optionalKey(Schema.Array(Schema.String)),\n});\nexport type Zone = typeof Zone.Type;\n\n/**\n * Every zone the principal's connections reach, and where each connection stands. A connection\n * marked `reconnect` contributes no zones and needs the customer to authorize it again.\n */\nexport const Zones = Schema.Struct({\n  zones: Schema.Array(Zone),\n  connections: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      status: ConnectionStatus,\n    }),\n  ),\n  /** Every provider a customer could connect, so a picker offers one without a second call. */\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Zones = typeof Zones.Type;\n\nexport const AttachPayload = Schema.Struct({\n  domain: Schema.String,\n  /** Which candidate zone to attach when `SelectionRequired` came back. */\n  zone: Schema.optionalKey(Schema.String),\n});\nexport type AttachPayload = typeof AttachPayload.Type;\n\nexport const PlanPayload = Schema.Struct({\n  requirements: Schema.Array(DnsRecord.Model),\n});\nexport type PlanPayload = typeof PlanPayload.Type;\n\nexport const ObservePayload = Schema.Struct({\n  /** Records to observe instead of the attachment's receipt; required for an unattached domain. */\n  requirements: Schema.optionalKey(Schema.Array(DnsRecord.Model)),\n});\nexport type ObservePayload = typeof ObservePayload.Type;\n\nexport const ApprovePayload = Schema.Struct({\n  /** A subset of the plan's writes; omit to approve every write. */\n  operationIds: Schema.optionalKey(Schema.Array(Plan.OperationId)),\n});\nexport type ApprovePayload = typeof ApprovePayload.Type;\n\nexport const RejectPayload = Schema.Struct({\n  /** Why the customer declined, for the audit trail. */\n  reason: Schema.optionalKey(Schema.String),\n});\nexport type RejectPayload = typeof RejectPayload.Type;\n\n/** One durable plan -> approval -> receipt lifecycle, as `GET /plans/:planId` returns it. */\nexport const Attempt = Schema.Struct({\n  plan: Plan.Model,\n  status: Storage.AttemptStatus,\n  approval: Schema.NullOr(Approval.Model),\n  receipt: Schema.NullOr(Receipt.Model),\n  rejection: Schema.NullOr(Storage.Rejection),\n});\nexport type Attempt = typeof Attempt.Type;\n\n/** `Verify.Readiness` on the wire; timestamps encode as ISO strings. */\nexport const Readiness = Schema.Struct({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  overall: Storage.Overall,\n  requirements: Schema.Array(\n    Schema.Struct({\n      operationId: Schema.NullOr(Plan.OperationId),\n      record: DnsRecord.Model,\n      status: Storage.RequirementStatus,\n      evidence: Schema.Array(Verify.Evidence),\n    }),\n  ),\n  host: Schema.Array(Verify.HostEvidence),\n  checkedAt: Schema.DateTimeUtcFromString,\n  nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n});\nexport type Readiness = typeof Readiness.Type;\n\nconst Redirected = HttpApiSchema.WithHeaders(HttpApiSchema.Empty(302), {\n  location: Schema.String,\n});\n\n// ---------------------------------------------------------------------------------------------\n// Errors: one wire body, the status from `DomainKit.Error.httpStatus`\n// ---------------------------------------------------------------------------------------------\n\n/** `DomainKit.Error` narrowed to the reasons that answer with `status`. */\nconst errorAt = (status: number) =>\n  Errors.DomainKitError.check(\n    Schema.makeFilter((error: Errors.DomainKitError) => error.httpStatus === status),\n  ).pipe(HttpApiSchema.status(status));\n\nconst errors = [400, 401, 403, 404, 409, 500, 501, 502, 503].map(errorAt);\n\n// ---------------------------------------------------------------------------------------------\n// The group\n// ---------------------------------------------------------------------------------------------\n\nexport const group = HttpApiGroup.make(\"domainkit\")\n  .add(\n    HttpApiEndpoint.get(\"inspect\", \"/domains/:domain\", {\n      params: { domain: Schema.String },\n      success: Snapshot,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"discover\", \"/domains/:domain/discovery\", {\n      params: { domain: Schema.String },\n      success: Discovery,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"zones\", \"/zones\", {\n      query: { provider: Schema.optionalKey(Schema.String) },\n      success: Zones,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"start\", \"/connections\", {\n      payload: StartPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"callback\", \"/callback/:provider\", {\n      params: { provider: Schema.String },\n      // `Connect.complete` reads every callback parameter off the request URL, because a provider\n      // may return `error`, `teamId`, or `configurationId` too. These two are declared so the\n      // OpenAPI document names what a provider is expected to send back.\n      query: { state: Schema.String, code: Schema.optionalKey(Schema.String) },\n      success: Redirected,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reconnect\", \"/connections/:connectionId/reconnections\", {\n      params: { connectionId: Schema.String },\n      payload: ReconnectPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"attach\", \"/connections/:connectionId/attachments\", {\n      params: { connectionId: Schema.String },\n      payload: AttachPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"detach\", \"/attachments/:attachmentId\", {\n      params: { attachmentId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"disconnect\", \"/connections/:connectionId\", {\n      params: { connectionId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"createPlan\", \"/domains/:domain/plans\", {\n      params: { domain: Schema.String },\n      payload: PlanPayload,\n      success: Plan.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"approve\", \"/plans/:planId/approvals\", {\n      params: { planId: Plan.PlanId },\n      payload: ApprovePayload,\n      success: Approval.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reject\", \"/plans/:planId/rejections\", {\n      params: { planId: Plan.PlanId },\n      payload: RejectPayload,\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"apply\", \"/approvals/:approvalId/apply\", {\n      params: { approvalId: Approval.ApprovalId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"plan\", \"/plans/:planId\", {\n      params: { planId: Plan.PlanId },\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"receipt\", \"/receipts/:receiptId\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"observe\", \"/domains/:domain/observations\", {\n      params: { domain: Schema.String },\n      payload: ObservePayload,\n      success: Readiness,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"cleanupPlan\", \"/receipts/:receiptId/cleanup-plans\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Plan.Model,\n      error: errors,\n    }),\n  );\n// Cleanup approve, reject, and apply reuse those routes: the attempt knows its kind.\n\nexport type Group = typeof group;\n\n/** Every route in the group, by name; what `Identity.authorize` is asked about. */\nexport type EndpointName = HttpApiGroup.Endpoints<Group>[\"identifier\"];\n\nexport interface Options {\n  /**\n   * Where the callback route is reachable from the provider, without the `/callback/:provider`\n   * suffix. Defaults to the incoming request's origin and mount path.\n   */\n  readonly callbackBaseUrl?: string;\n  /** Where interactive flows return when the callback carries no `returnTo`. */\n  readonly defaultReturnTo?: string;\n}\n\n/** Everything the handlers need: the lifecycle services, Storage, and the host's `Identity`. */\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Storage.Service\n  | Identity;\n\n// ---------------------------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------------------------\n\nconst START_ROUTE = \"/connections\";\nconst reconnectRoute = (connectionId: string) =>\n  `/connections/${encodeURIComponent(connectionId)}/reconnections`;\nconst callbackRoute = (provider: string) => `/callback/${encodeURIComponent(provider)}`;\n\nconst invalid = (message: string, field?: string) =>\n  Errors.fail(new Reason.InvalidInput({ message, ...(field === undefined ? {} : { field }) }));\n\n/** The request as an absolute URL: the web original when there is one, else scheme plus `Host`. */\nconst absoluteUrl = (\n  request: HttpServerRequest.HttpServerRequest,\n): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    try {\n      return Effect.succeed(new URL(request.originalUrl));\n    } catch {\n      const url = HttpServerRequest.toURL(request);\n      return Option.isNone(url)\n        ? invalid(\"The request has no usable origin; set callbackBaseUrl\", \"callbackBaseUrl\")\n        : Effect.succeed(url.value);\n    }\n  });\n\n/**\n * The absolute URL the provider redirects back to. `callbackBaseUrl` wins when the host set it,\n * because a proxy that rewrites `Host` leaves the request pointing at an origin the browser never\n * sees; otherwise it follows the prefix the group is mounted at, derived by stripping the handling\n * route's own path off the request.\n */\nconst callbackUrlFor = (input: {\n  readonly request: HttpServerRequest.HttpServerRequest;\n  readonly provider: string;\n  readonly options: Options;\n  /** The path of the route serving this request, stripped to find the mount. */\n  readonly route: string;\n}): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    const suffix = `/callback/${encodeURIComponent(input.provider)}`;\n    const configured = input.options.callbackBaseUrl;\n    if (configured !== undefined) {\n      return Effect.try({\n        try: () => new URL(`${configured.replace(/\\/+$/, \"\")}${suffix}`),\n        catch: () => callbackConfigurationError(`${configured} is not a URL`),\n      });\n    }\n    return Effect.flatMap(absoluteUrl(input.request), (url) => {\n      const path = url.pathname;\n      if (!path.endsWith(input.route)) {\n        return invalid(\n          `The ${input.route} route is not mounted where it says; set callbackBaseUrl`,\n          \"callbackBaseUrl\",\n        );\n      }\n      return Effect.succeed(\n        new URL(`${url.origin}${path.slice(0, path.length - input.route.length)}${suffix}`),\n      );\n    });\n  });\n\nconst callbackConfigurationError = (message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({ message, field: \"callbackBaseUrl\" }),\n  });\n\n/**\n * Where the callback may send the customer: a path under the callback's own base, or an absolute\n * URL on its origin. A destination that leaves the application is an open redirect, whoever\n * supplied it.\n */\nconst sameOrigin = (destination: string, callback: URL): string | null => {\n  try {\n    // Resolving against the callback is what makes this safe: the URL parser normalizes the forms\n    // a browser would follow off-origin (`//host`, `/\\host`, `\\/host`, encoded hosts) into a real\n    // origin, so comparing origins catches every one of them.\n    const url = new URL(destination, callback);\n    return url.origin === callback.origin ? url.toString() : null;\n  } catch {\n    return null;\n  }\n};\n\nconst snapshotOf = (snapshot: Connect.Snapshot): Snapshot => ({\n  domain: snapshot.domain,\n  attachment:\n    snapshot.attachment === null\n      ? null\n      : { id: snapshot.attachment.id, label: snapshot.attachment.label },\n  connectionId: snapshot.connection?.id ?? null,\n  provider: snapshot.authorization?.provider ?? null,\n  method: snapshot.authorization?.method ?? null,\n  status:\n    snapshot.connection === null\n      ? \"disconnected\"\n      : snapshot.authorization?.revocation === \"active\"\n        ? \"connected\"\n        : \"reconnect\",\n  lastReceiptId: snapshot.lastReceiptId,\n  connectionDomains: snapshot.connectionDomains,\n  reusable: snapshot.reusable.map(({ connection, provider, method }) => ({\n    connectionId: connection.id,\n    provider,\n    method,\n  })),\n  providers: snapshot.providers.map(({ id, name, methods }) => ({ id, name, methods })),\n});\n\n/** The wire method as `Connect` takes it; interactive cases carry the caller's return destination. */\nconst methodOf = (method: Method): Connect.Method => {\n  switch (method._tag) {\n    case \"Token\":\n      return Connect.Method.token(method.values);\n    case \"OAuth\":\n      return Connect.Method.oauth(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n    case \"Integration\":\n      return Connect.Method.integration(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n  }\n};\n\nconst candidatesOf = (\n  candidates: ReadonlyArray<{ readonly zone: string; readonly label: string }>,\n): ReadonlyArray<Candidate> => candidates.map(({ zone, label }) => new Candidate({ zone, label }));\n\n/**\n * Handlers for `group` inside the host's API. Every handler derives `Principal` from `Identity`\n * for the request it is serving and provides it to the lifecycle services.\n */\nexport const layer = <ApiId extends string, Groups extends HttpApiGroup.Constraint>(\n  api: HttpApi.HttpApi<ApiId, Groups>,\n  options: Options = {},\n): Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services> =>\n  // The host's API carries its own groups beside this one; only `\"domainkit\"` is implemented here,\n  // and `HttpApiBuilder.group` needs the group's own endpoint types to check the handlers.\n  HttpApiBuilder.group(api as unknown as HttpApi.HttpApi<ApiId, Group>, \"domainkit\", (handlers) =>\n    Effect.gen(function* () {\n      const identity = yield* Identity;\n      const connect = yield* Connect.Service;\n      const provision = yield* Provision.Service;\n      const cleanup = yield* Cleanup.Service;\n      const verify = yield* Verify.Service;\n      const storage = yield* Storage.Service;\n      const providers = yield* Providers.Service;\n\n      /**\n       * Run a lifecycle effect as the principal the host derives from this request, once the host\n       * has allowed that principal onto this route.\n       */\n      const as = <A>(\n        endpoint: EndpointName,\n        request: HttpServerRequest.HttpServerRequest,\n        effect: Effect.Effect<A, Errors.DomainKitError, Principal.Service>,\n      ): Effect.Effect<A, Errors.DomainKitError> =>\n        Effect.flatMap(identity.principal(request), (principal) =>\n          Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () =>\n            Effect.provideService(effect, Principal.Service, principal),\n          ),\n        );\n\n      const snapshot = (domain: string) => Effect.map(connect.inspect(domain), snapshotOf);\n\n      const discovered = (discovery: Connect.Discovery): Discovery => {\n        switch (discovery._tag) {\n          case \"Resolved\":\n            return new DiscoveryResolved({\n              connectionId: discovery.connectionId,\n              zone: discovery.target.zone,\n              label: discovery.target.label,\n            });\n          case \"SelectionRequired\":\n            return new DiscoverySelectionRequired({\n              candidates: discovery.candidates.map(({ connectionId, target }) => ({\n                connectionId,\n                zone: target.zone,\n                label: target.label,\n              })),\n            });\n          case \"NotFound\":\n            return new DiscoveryNotFound({\n              nameservers: discovery.nameservers,\n              host: discovery.host,\n            });\n        }\n      };\n\n      /**\n       * The connection a start or an attach produced. `label` is the zone the attachment named,\n       * or the provider itself where the connection carries no domain yet.\n       */\n      const connected = (input: {\n        readonly connection: Storage.Connection;\n        readonly attachment: Storage.Attachment | null;\n        readonly domain: string | undefined;\n      }): Effect.Effect<Connected, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const authorization = yield* storage.authorizations.get(input.connection.authorizationId);\n          const definition = yield* providers.get(authorization.provider);\n          return new Connected({\n            connectionId: input.connection.id,\n            provider: authorization.provider,\n            label: input.attachment?.label ?? definition.name,\n            snapshot: input.domain === undefined ? null : yield* snapshot(input.domain),\n          });\n        });\n\n      const startedOf = (\n        started: Connect.Started,\n        domain: string | undefined,\n      ): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> => {\n        switch (started._tag) {\n          case \"Connected\":\n            return connected({\n              attachment: started.attachment,\n              connection: started.connection,\n              domain,\n            });\n          case \"Redirect\":\n            return Effect.succeed(new Redirect({ authorizationUrl: started.authorizationUrl }));\n          case \"SelectionRequired\":\n            return Effect.succeed(\n              new SelectionRequired({\n                connectionId: started.connection.id,\n                candidates: candidatesOf(started.candidates),\n              }),\n            );\n        }\n      };\n\n      /**\n       * Attach with a zone the client picked out of a `SelectionRequired`. The provider target\n       * behind a zone never crosses the wire, so resolve the candidates again and match by zone.\n       */\n      const attachAt = (input: {\n        readonly connectionId: string;\n        readonly domain: string;\n        readonly zone: string | undefined;\n      }): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const connection = yield* storage.connections.get(input.connectionId);\n          const attached = (attachment: Storage.Attachment) =>\n            connected({ attachment, connection, domain: input.domain });\n          const first = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n          });\n          if (!(\"_tag\" in first)) return yield* attached(first);\n          if (input.zone === undefined) {\n            return new SelectionRequired({\n              connectionId: input.connectionId,\n              candidates: candidatesOf(first.candidates),\n            });\n          }\n          const target = first.candidates.find(({ zone }) => zone === input.zone);\n          if (target === undefined) {\n            return yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }));\n          }\n          const second = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n            target,\n          });\n          return \"_tag\" in second\n            ? yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }))\n            : yield* attached(second);\n        });\n\n      /** Provisioning and cleanup share the approve and apply routes; the attempt knows its kind. */\n      const kindOf = (attempt: Storage.Attempt) =>\n        attempt.kind === \"cleanup\" ? cleanup : provision;\n\n      return handlers\n        .handle(\"inspect\", ({ params, request }) => as(\"inspect\", request, snapshot(params.domain)))\n        .handle(\"discover\", ({ params, request }) =>\n          as(\"discover\", request, Effect.map(connect.discover(params.domain), discovered)),\n        )\n        .handle(\"zones\", ({ query, request }) =>\n          as(\n            \"zones\",\n            request,\n            Effect.map(\n              connect.zones(query.provider === undefined ? {} : { provider: query.provider }),\n              (listing): Zones => ({\n                zones: listing.zones.map(({ connectionId, provider, target }) => ({\n                  connectionId,\n                  provider,\n                  zone: target.zone,\n                  label: target.label,\n                  ...(target.nameservers === undefined ? {} : { nameservers: target.nameservers }),\n                })),\n                connections: listing.connections,\n                providers: listing.providers,\n              }),\n            ),\n          ),\n        )\n        .handle(\"start\", ({ payload, request }) =>\n          as(\n            \"start\",\n            request,\n            Effect.gen(function* () {\n              // Token methods connect in one call; the interactive ones need somewhere to land.\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: payload.provider,\n                      options,\n                      route: START_ROUTE,\n                    })).toString();\n              const started = yield* connect.start({\n                provider: payload.provider,\n                ...(payload.domain === undefined ? {} : { domain: payload.domain }),\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, payload.domain);\n            }),\n          ),\n        )\n        .handle(\"reconnect\", ({ params, payload, request }) =>\n          as(\n            \"reconnect\",\n            request,\n            Effect.gen(function* () {\n              const connection = yield* storage.connections.get(params.connectionId);\n              const authorization = yield* storage.authorizations.get(connection.authorizationId);\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: authorization.provider,\n                      options,\n                      route: reconnectRoute(params.connectionId),\n                    })).toString();\n              const started = yield* connect.reconnect({\n                connectionId: params.connectionId,\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, undefined);\n            }),\n          ),\n        )\n        .handle(\"callback\", ({ params, query, request }) =>\n          as(\n            \"callback\",\n            request,\n            Effect.gen(function* () {\n              const url = yield* absoluteUrl(request);\n              // Resolve the destination against the callback's public base, not the request: a\n              // proxy that rewrites `Host` leaves the request on an origin the browser never sees.\n              const base = yield* callbackUrlFor({\n                request,\n                provider: params.provider,\n                options,\n                route: callbackRoute(params.provider),\n              });\n              // Where the customer lands comes from the continuation this owner started, never\n              // from the provider's query string, and it is resolved before the callback is spent:\n              // a server with nowhere to send them must not connect the provider and then fail.\n              const continuation = yield* storage.continuations.get(query.state);\n              const requested = continuation.returnTo ?? options.defaultReturnTo;\n              if (requested === undefined) {\n                return yield* invalid(\n                  \"The flow carried no returnTo and the server has no defaultReturnTo\",\n                  \"returnTo\",\n                );\n              }\n              const destination = sameOrigin(requested, base);\n              if (destination === null) {\n                return yield* invalid(`${requested} leaves this application`, \"returnTo\");\n              }\n              yield* connect.complete({\n                continuationId: query.state,\n                callbackUrl: url.toString(),\n              });\n              return HttpApiSchema.withHeaders({\n                body: undefined as void,\n                headers: { location: destination },\n              });\n            }),\n          ),\n        )\n        .handle(\"attach\", ({ params, payload, request }) =>\n          as(\n            \"attach\",\n            request,\n            attachAt({\n              connectionId: params.connectionId,\n              domain: payload.domain,\n              zone: payload.zone,\n            }),\n          ),\n        )\n        .handle(\"detach\", ({ params, request }) =>\n          as(\"detach\", request, connect.detach(params.attachmentId)),\n        )\n        .handle(\"disconnect\", ({ params, request }) =>\n          as(\"disconnect\", request, connect.disconnect(params.connectionId)),\n        )\n        .handle(\"createPlan\", ({ params, payload, request }) =>\n          as(\n            \"createPlan\",\n            request,\n            provision.plan({ domain: params.domain, requirements: payload.requirements }),\n          ),\n        )\n        .handle(\"approve\", ({ params, payload, request }) =>\n          as(\n            \"approve\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).approve(params.planId, {\n                ...(payload.operationIds === undefined\n                  ? {}\n                  : { operationIds: payload.operationIds, allowPartial: true }),\n              });\n            }),\n          ),\n        )\n        .handle(\"reject\", ({ params, payload, request }) =>\n          as(\n            \"reject\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).reject(params.planId, {\n                ...(payload.reason === undefined ? {} : { reason: payload.reason }),\n              });\n            }),\n          ),\n        )\n        .handle(\"apply\", ({ params, request }) =>\n          as(\n            \"apply\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.byApproval(params.approvalId);\n              return yield* kindOf(attempt).apply(params.approvalId);\n            }),\n          ),\n        )\n        .handle(\"plan\", ({ params, request }) =>\n          as(\n            \"plan\",\n            request,\n            Effect.map(storage.attempts.get(params.planId), (attempt) => ({\n              plan: attempt.plan,\n              status: attempt.status,\n              approval: attempt.approval,\n              receipt: attempt.receipt,\n              rejection: attempt.rejection,\n            })),\n          ),\n        )\n        .handle(\"receipt\", ({ params, request }) =>\n          as(\n            \"receipt\",\n            request,\n            Effect.flatMap(storage.attempts.byReceipt(params.receiptId), (attempt) =>\n              attempt.receipt === null\n                ? Errors.fail(new Reason.NotFound({ entity: \"receipt\", id: params.receiptId }))\n                : Effect.succeed(attempt.receipt),\n            ),\n          ),\n        )\n        .handle(\"observe\", ({ params, payload, request }) =>\n          as(\n            \"observe\",\n            request,\n            verify.observe({\n              domain: params.domain,\n              ...(payload.requirements === undefined ? {} : { requirements: payload.requirements }),\n            }),\n          ),\n        )\n        .handle(\"cleanupPlan\", ({ params, request }) =>\n          as(\"cleanupPlan\", request, cleanup.plan({ receiptId: params.receiptId })),\n        );\n    }),\n  ) as Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services>;\n\n/** A standalone API for hosts not on HttpApi. Mount at any prefix. */\nexport const api: HttpApi.HttpApi<\"domainkit\", Group> = HttpApi.make(\"domainkit\").add(group);\n\nexport interface WebHandlerOptions extends Options {\n  /** Mount every route under this path, e.g. `/api/domainkit`. */\n  readonly prefix?: `/${string}`;\n}\n\n/** The Promise edge: a `fetch`-shaped handler over the group for hosts that are not Effect-native. */\nexport const toWebHandler = (\n  services: Layer.Layer<Services, Errors.DomainKitError>,\n  options: WebHandlerOptions = {},\n): {\n  readonly handler: (request: Request) => Promise<Response>;\n  readonly dispose: () => Promise<void>;\n} => {\n  // `group.prefix` widens the endpoint paths in the type, which `Group` states unprefixed; the\n  // handlers are keyed by endpoint identifier, so the routes still line up.\n  const prefixed =\n    options.prefix === undefined\n      ? api\n      : (HttpApi.make(\"domainkit\").add(group.prefix(options.prefix)) as unknown as HttpApi.HttpApi<\n          \"domainkit\",\n          Group\n        >);\n  const app = HttpApiBuilder.layer(prefixed).pipe(\n    Layer.provide(layer(prefixed, options)),\n    Layer.provide(services),\n    Layer.provide(HttpServer.layerServices),\n  );\n  return HttpRouter.toWebHandler(app, { disableLogger: true });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAa,WAAb,cAA8B,QAAQ,QAAmC,CAAC,CACxE,4BACF,CAAC,CAAC,CAAC;AAMH,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAgB;CAAa;AAAW,CAAC;;AAI1F,MAAa,QAAQ,OAAO,OAAO;CACjC,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ,OAAO;AACjB,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO;CAC5C,MAAMA;CACN,OAAO,OAAO;CACd,SAAS,OAAO,OAAO,OAAO,MAAM;CACpC,QAAQ,OAAO,OAAO,OAAO,MAAM,KAAK,CAAC;AAC3C,CAAC;;;AAKD,MAAa,aAAa,OAAO,OAAO;CACtC,IAAI,OAAO;CACX,OAAO,OAAO;AAChB,CAAC;AAGD,MAAa,WAAW,OAAO,OAAO;CACpC,QAAQ,OAAO;CACf,YAAY,OAAO,OAAO,UAAU;CACpC,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,UAAU,OAAO,OAAO,OAAO,MAAM;CACrC,QAAQ,OAAO,OAAOA,UAAkB;CACxC,QAAQ;CACR,eAAe,OAAO,OAAO,OAAO,MAAM;;CAE1C,mBAAmB,OAAO;CAC1B,UAAU,OAAO,MACf,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQA;CACV,CAAC,CACH;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;;;;;;AAQD,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,EACpD,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,UAAU,OAAO,YAAY,OAAO,MAAM,EAC5C,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,cAAb,cAAiC,OAAO,YACtC,sCACF,CAAC,CAAC,eAAe,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACnE,MAAa,SAAS,OAAO,MAAM;CAAC;CAAO;CAAO;AAAW,CAAC;;AAI9D,MAAa,eAAe,OAAO,OAAO;CACxC,QAAQ,OAAO,YAAY,OAAO,MAAM;CACxC,UAAU,OAAO;CACjB,QAAQ;AACV,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO,EAAE,QAAQ,OAAO,CAAC;;AAIhE,IAAa,YAAb,cAA+B,OAAO,MAAiB,6BAA6B,CAAC,CAAC;CACpF,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,YAAb,cAA+B,OAAO,YAAuB,qCAAqC,CAAC,CACjG,aACA;CACE,cAAc,OAAO;CACrB,UAAU,OAAO;CACjB,OAAO,OAAO;CACd,UAAU,OAAO,OAAO,QAAQ;AAClC,CACF,CAAC,CAAC,CAAC;AACH,IAAa,WAAb,cAA8B,OAAO,YAAsB,oCAAoC,CAAC,CAC9F,YACA,EAAE,kBAAkB,OAAO,OAAO,CACpC,CAAC,CAAC,CAAC;AACH,IAAa,oBAAb,cAAuC,OAAO,YAC5C,6CACF,CAAC,CAAC,qBAAqB;CAAE,cAAc,OAAO;CAAQ,YAAY,OAAO,MAAM,SAAS;AAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAa,UAAU,OAAO,MAAM;CAAC;CAAW;CAAU;AAAiB,CAAC;;;;;;AAQ5E,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAAC,CAAC,CAAC;AAC3F,IAAa,6BAAb,cAAgD,OAAO,YACrD,+CACF,CAAC,CAAC,qBAAqB,EACrB,YAAY,OAAO,MACjB,OAAO,OAAO;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAC1F,EACF,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CACZ,aAAa,OAAO,MAAM,OAAO,MAAM;CACvC,MAAM,OAAO,OAAO,OAAO,OAAO,EAAE,UAAU,OAAO,OAAO,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,YAAY,OAAO,MAAM;CACpC;CACA;CACA;AACF,CAAC;;AAID,MAAa,OAAO,OAAO,OAAO;CAChC,cAAc,OAAO;CACrB,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,OAAO,OAAO;CACd,aAAa,OAAO,YAAY,OAAO,MAAM,OAAO,MAAM,CAAC;AAC7D,CAAC;;;;;AAOD,MAAa,QAAQ,OAAO,OAAO;CACjC,OAAO,OAAO,MAAM,IAAI;CACxB,aAAa,OAAO,MAClB,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQ;CACV,CAAC,CACH;;CAEA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;CACzC,QAAQ,OAAO;;CAEf,MAAM,OAAO,YAAY,OAAO,MAAM;AACxC,CAAC;AAGD,MAAa,cAAc,OAAO,OAAO,EACvC,cAAc,OAAO,MAAMC,KAAe,EAC5C,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMA,KAAe,CAAC,EAChE,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMC,WAAgB,CAAC,EACjE,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;;AAEzC,QAAQ,OAAO,YAAY,OAAO,MAAM,EAC1C,CAAC;;AAID,MAAa,UAAU,OAAO,OAAO;CACnC,MAAMC;CACN,QAAQC;CACR,UAAU,OAAO,OAAOC,OAAc;CACtC,SAAS,OAAO,OAAOC,OAAa;CACpC,WAAW,OAAO,OAAOC,SAAiB;AAC5C,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,SAASC;CACT,cAAc,OAAO,MACnB,OAAO,OAAO;EACZ,aAAa,OAAO,OAAON,WAAgB;EAC3C,QAAQD;EACR,QAAQQ;EACR,UAAU,OAAO,MAAMC,QAAe;CACxC,CAAC,CACH;CACA,MAAM,OAAO,MAAMC,YAAmB;CACtC,WAAW,OAAO;CAClB,aAAa,OAAO,OAAO,OAAO,qBAAqB;AACzD,CAAC;AAGD,MAAM,aAAa,cAAc,YAAY,cAAc,MAAM,GAAG,GAAG,EACrE,UAAU,OAAO,OACnB,CAAC;;AAOD,MAAM,WAAW,WAAA,eACO,MACpB,OAAO,YAAY,UAAiC,MAAM,eAAe,MAAM,CACjF,CAAC,CAAC,KAAK,cAAc,OAAO,MAAM,CAAC;AAErC,MAAM,SAAS;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC,CAAC,IAAI,OAAO;AAMxE,MAAa,QAAQ,aAAa,KAAK,WAAW,CAAC,CAChD,IACC,gBAAgB,IAAI,WAAW,oBAAoB;CACjD,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,8BAA8B;CAC5D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,SAAS,UAAU;CACrC,OAAO,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE;CACrD,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gBAAgB;CAC5C,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,uBAAuB;CACrD,QAAQ,EAAE,UAAU,OAAO,OAAO;CAIlC,OAAO;EAAE,OAAO,OAAO;EAAQ,MAAM,OAAO,YAAY,OAAO,MAAM;CAAE;CACvE,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,aAAa,4CAA4C;CAC5E,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,0CAA0C;CACvE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,UAAU,8BAA8B;CAC7D,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,cAAc,8BAA8B;CACjE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,cAAc,0BAA0B;CAC3D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,4BAA4B;CAC1D,QAAQ,EAAE,QAAQS,OAAY;CAC9B,SAAS;CACT,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,6BAA6B;CAC1D,QAAQ,EAAE,QAAQO,OAAY;CAC9B,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gCAAgC;CAC5D,QAAQ,EAAE,YAAYC,WAAoB;CAC1C,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,QAAQ,kBAAkB;CAC5C,QAAQ,EAAE,QAAQM,OAAY;CAC9B,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,WAAW,wBAAwB;CACrD,QAAQ,EAAE,WAAWE,UAAkB;CACvC,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,iCAAiC;CAC/D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,eAAe,sCAAsC;CACxE,QAAQ,EAAE,WAAWQ,UAAkB;CACvC,SAASX;CACT,OAAO;AACT,CAAC,CACH;AAgCF,MAAM,cAAc;AACpB,MAAM,kBAAkB,iBACtB,gBAAgB,mBAAmB,YAAY,EAAE;AACnD,MAAM,iBAAiB,aAAqB,aAAa,mBAAmB,QAAQ;AAEpF,MAAM,WAAW,SAAiB,UAChCY,KAAY,IAAIC,aAAoB;CAAE;CAAS,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AAAG,CAAC,CAAC;;AAG7F,MAAM,eACJ,YAEA,OAAO,cAAc;CACnB,IAAI;EACF,OAAO,OAAO,QAAQ,IAAI,IAAI,QAAQ,WAAW,CAAC;CACpD,QAAQ;EACN,MAAM,MAAM,kBAAkB,MAAM,OAAO;EAC3C,OAAO,OAAO,OAAO,GAAG,IACpB,QAAQ,yDAAyD,iBAAiB,IAClF,OAAO,QAAQ,IAAI,KAAK;CAC9B;AACF,CAAC;;;;;;;AAQH,MAAM,kBAAkB,UAOtB,OAAO,cAAc;CACnB,MAAM,SAAS,aAAa,mBAAmB,MAAM,QAAQ;CAC7D,MAAM,aAAa,MAAM,QAAQ;CACjC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,IAAI;EAChB,WAAW,IAAI,IAAI,GAAG,WAAW,QAAQ,QAAQ,EAAE,IAAI,QAAQ;EAC/D,aAAa,2BAA2B,GAAG,WAAW,cAAc;CACtE,CAAC;CAEH,OAAO,OAAO,QAAQ,YAAY,MAAM,OAAO,IAAI,QAAQ;EACzD,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,KAAK,SAAS,MAAM,KAAK,GAC5B,OAAO,QACL,OAAO,MAAM,MAAM,2DACnB,iBACF;EAEF,OAAO,OAAO,QACZ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,MAAM,GAAG,KAAK,SAAS,MAAM,MAAM,MAAM,IAAI,QAAQ,CACpF;CACF,CAAC;AACH,CAAC;AAEH,MAAM,8BAA8B,YAClC,IAAIC,eAAsB,EACxB,QAAQ,IAAID,aAAoB;CAAE;CAAS,OAAO;AAAkB,CAAC,EACvE,CAAC;;;;;;AAOH,MAAM,cAAc,aAAqB,aAAiC;CACxE,IAAI;EAIF,MAAM,MAAM,IAAI,IAAI,aAAa,QAAQ;EACzC,OAAO,IAAI,WAAW,SAAS,SAAS,IAAI,SAAS,IAAI;CAC3D,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,cAAc,cAA0C;CAC5D,QAAQ,SAAS;CACjB,YACE,SAAS,eAAe,OACpB,OACA;EAAE,IAAI,SAAS,WAAW;EAAI,OAAO,SAAS,WAAW;CAAM;CACrE,cAAc,SAAS,YAAY,MAAM;CACzC,UAAU,SAAS,eAAe,YAAY;CAC9C,QAAQ,SAAS,eAAe,UAAU;CAC1C,QACE,SAAS,eAAe,OACpB,iBACA,SAAS,eAAe,eAAe,WACrC,cACA;CACR,eAAe,SAAS;CACxB,mBAAmB,SAAS;CAC5B,UAAU,SAAS,SAAS,KAAK,EAAE,YAAY,UAAU,cAAc;EACrE,cAAc,WAAW;EACzB;EACA;CACF,EAAE;CACF,WAAW,SAAS,UAAU,KAAK,EAAE,IAAI,MAAM,eAAe;EAAE;EAAI;EAAM;CAAQ,EAAE;AACtF;;AAGA,MAAM,YAAY,WAAmC;CACnD,QAAQ,OAAO,MAAf;EACE,KAAK,SACH,OAAA,SAAsB,MAAM,OAAO,MAAM;EAC3C,KAAK,SACH,OAAA,SAAsB,MACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;EACF,KAAK,eACH,OAAA,SAAsB,YACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;CACJ;AACF;AAEA,MAAM,gBACJ,eAC6B,WAAW,KAAK,EAAE,MAAM,YAAY,IAAI,UAAU;CAAE;CAAM;AAAM,CAAC,CAAC;;;;;AAMjG,MAAa,SACX,KACA,UAAmB,CAAC,MAIpB,eAAe,MAAM,KAAiD,cAAc,aAClF,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAOE;CACvB,MAAM,YAAY,OAAOC;CACzB,MAAM,UAAU,OAAOC;CACvB,MAAM,SAAS,OAAOC;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,YAAY,OAAOC;;;;;CAMzB,MAAM,MACJ,UACA,SACA,WAEA,OAAO,QAAQ,SAAS,UAAU,OAAO,IAAI,cAC3C,OAAO,QAAQ,SAAS,YAAY,WAAW,QAAQ,KAAK,OAAO,YACjE,OAAO,eAAe,QAAQC,SAAmB,SAAS,CAC5D,CACF;CAEF,MAAM,YAAY,WAAmB,OAAO,IAAI,QAAQ,QAAQ,MAAM,GAAG,UAAU;CAEnF,MAAM,cAAc,cAA4C;EAC9D,QAAQ,UAAU,MAAlB;GACE,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,cAAc,UAAU;IACxB,MAAM,UAAU,OAAO;IACvB,OAAO,UAAU,OAAO;GAC1B,CAAC;GACH,KAAK,qBACH,OAAO,IAAI,2BAA2B,EACpC,YAAY,UAAU,WAAW,KAAK,EAAE,cAAc,cAAc;IAClE;IACA,MAAM,OAAO;IACb,OAAO,OAAO;GAChB,EAAE,EACJ,CAAC;GACH,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,aAAa,UAAU;IACvB,MAAM,UAAU;GAClB,CAAC;EACL;CACF;;;;;CAMA,MAAM,aAAa,UAKjB,OAAO,IAAI,aAAa;EACtB,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,MAAM,WAAW,eAAe;EACxF,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,OAAO,IAAI,UAAU;GACnB,cAAc,MAAM,WAAW;GAC/B,UAAU,cAAc;GACxB,OAAO,MAAM,YAAY,SAAS,WAAW;GAC7C,UAAU,MAAM,WAAW,KAAA,IAAY,OAAO,OAAO,SAAS,MAAM,MAAM;EAC5E,CAAC;CACH,CAAC;CAEH,MAAM,aACJ,SACA,WACqE;EACrE,QAAQ,QAAQ,MAAhB;GACE,KAAK,aACH,OAAO,UAAU;IACf,YAAY,QAAQ;IACpB,YAAY,QAAQ;IACpB;GACF,CAAC;GACH,KAAK,YACH,OAAO,OAAO,QAAQ,IAAI,SAAS,EAAE,kBAAkB,QAAQ,iBAAiB,CAAC,CAAC;GACpF,KAAK,qBACH,OAAO,OAAO,QACZ,IAAI,kBAAkB;IACpB,cAAc,QAAQ,WAAW;IACjC,YAAY,aAAa,QAAQ,UAAU;GAC7C,CAAC,CACH;EACJ;CACF;;;;;CAMA,MAAM,YAAY,UAKhB,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,MAAM,YAAY;EACpE,MAAM,YAAY,eAChB,UAAU;GAAE;GAAY;GAAY,QAAQ,MAAM;EAAO,CAAC;EAC5D,MAAM,QAAQ,OAAO,QAAQ,OAAO;GAClC,cAAc,MAAM;GACpB,QAAQ,MAAM;EAChB,CAAC;EACD,IAAI,EAAE,UAAU,QAAQ,OAAO,OAAO,SAAS,KAAK;EACpD,IAAI,MAAM,SAAS,KAAA,GACjB,OAAO,IAAI,kBAAkB;GAC3B,cAAc,MAAM;GACpB,YAAY,aAAa,MAAM,UAAU;EAC3C,CAAC;EAEH,MAAM,SAAS,MAAM,WAAW,MAAM,EAAE,WAAW,SAAS,MAAM,IAAI;EACtE,IAAI,WAAW,KAAA,GACb,OAAO,OAAOT,KAAY,IAAIU,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC;EAEnF,MAAM,SAAS,OAAO,QAAQ,OAAO;GACnC,cAAc,MAAM;GACpB,QAAQ,MAAM;GACd;EACF,CAAC;EACD,OAAO,UAAU,SACb,OAAOV,KAAY,IAAIU,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC,IAC1E,OAAO,SAAS,MAAM;CAC5B,CAAC;;CAGH,MAAM,UAAU,YACd,QAAQ,SAAS,YAAY,UAAU;CAEzC,OAAO,SACJ,OAAO,YAAY,EAAE,QAAQ,cAAc,GAAG,WAAW,SAAS,SAAS,OAAO,MAAM,CAAC,CAAC,CAAC,CAC3F,OAAO,aAAa,EAAE,QAAQ,cAC7B,GAAG,YAAY,SAAS,OAAO,IAAI,QAAQ,SAAS,OAAO,MAAM,GAAG,UAAU,CAAC,CACjF,CAAC,CACA,OAAO,UAAU,EAAE,OAAO,cACzB,GACE,SACA,SACA,OAAO,IACL,QAAQ,MAAM,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS,CAAC,IAC7E,aAAoB;EACnB,OAAO,QAAQ,MAAM,KAAK,EAAE,cAAc,UAAU,cAAc;GAChE;GACA;GACA,MAAM,OAAO;GACb,OAAO,OAAO;GACd,GAAI,OAAO,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,OAAO,YAAY;EAChF,EAAE;EACF,aAAa,QAAQ;EACrB,WAAW,QAAQ;CACrB,EACF,CACF,CACF,CAAC,CACA,OAAO,UAAU,EAAE,SAAS,cAC3B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EAEtB,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,QAAQ;GAClB;GACA,OAAO;EACT,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,MAAM;GACnC,UAAU,QAAQ;GAClB,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;GACjE,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,QAAQ,MAAM;CACjD,CAAC,CACH,CACF,CAAC,CACA,OAAO,cAAc,EAAE,QAAQ,SAAS,cACvC,GACE,aACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,OAAO,YAAY;EACrE,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,cAAc;GACxB;GACA,OAAO,eAAe,OAAO,YAAY;EAC3C,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,UAAU;GACvC,cAAc,OAAO;GACrB,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,KAAA,CAAS;CAC5C,CAAC,CACH,CACF,CAAC,CACA,OAAO,aAAa,EAAE,QAAQ,OAAO,cACpC,GACE,YACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,YAAY,OAAO;EAGtC,MAAM,OAAO,OAAO,eAAe;GACjC;GACA,UAAU,OAAO;GACjB;GACA,OAAO,cAAc,OAAO,QAAQ;EACtC,CAAC;EAKD,MAAM,aAAY,OADU,QAAQ,cAAc,IAAI,MAAM,KAAK,EAAA,CAClC,YAAY,QAAQ;EACnD,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,QACZ,sEACA,UACF;EAEF,MAAM,cAAc,WAAW,WAAW,IAAI;EAC9C,IAAI,gBAAgB,MAClB,OAAO,OAAO,QAAQ,GAAG,UAAU,2BAA2B,UAAU;EAE1E,OAAO,QAAQ,SAAS;GACtB,gBAAgB,MAAM;GACtB,aAAa,IAAI,SAAS;EAC5B,CAAC;EACD,OAAO,cAAc,YAAY;GAC/B,MAAM,KAAA;GACN,SAAS,EAAE,UAAU,YAAY;EACnC,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,SAAS;EACP,cAAc,OAAO;EACrB,QAAQ,QAAQ;EAChB,MAAM,QAAQ;CAChB,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,cAC3B,GAAG,UAAU,SAAS,QAAQ,OAAO,OAAO,YAAY,CAAC,CAC3D,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,cAC/B,GAAG,cAAc,SAAS,QAAQ,WAAW,OAAO,YAAY,CAAC,CACnE,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,SAAS,cACxC,GACE,cACA,SACA,UAAU,KAAK;EAAE,QAAQ,OAAO;EAAQ,cAAc,QAAQ;CAAa,CAAC,CAC9E,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,QAAQ,OAAO,QAAQ,EACnD,GAAI,QAAQ,iBAAiB,KAAA,IACzB,CAAC,IACD;GAAE,cAAc,QAAQ;GAAc,cAAc;EAAK,EAC/D,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,EAClD,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO,EACnE,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,UAAU,EAAE,QAAQ,cAC1B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,WAAW,OAAO,UAAU;EACpE,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,MAAM,OAAO,UAAU;CACvD,CAAC,CACH,CACF,CAAC,CACA,OAAO,SAAS,EAAE,QAAQ,cACzB,GACE,QACA,SACA,OAAO,IAAI,QAAQ,SAAS,IAAI,OAAO,MAAM,IAAI,aAAa;EAC5D,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,UAAU,QAAQ;EAClB,SAAS,QAAQ;EACjB,WAAW,QAAQ;CACrB,EAAE,CACJ,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,cAC5B,GACE,WACA,SACA,OAAO,QAAQ,QAAQ,SAAS,UAAU,OAAO,SAAS,IAAI,YAC5D,QAAQ,YAAY,OAChBV,KAAY,IAAIU,SAAgB;EAAE,QAAQ;EAAW,IAAI,OAAO;CAAU,CAAC,CAAC,IAC5E,OAAO,QAAQ,QAAQ,OAAO,CACpC,CACF,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,QAAQ;EACb,QAAQ,OAAO;EACf,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;CACrF,CAAC,CACH,CACF,CAAC,CACA,OAAO,gBAAgB,EAAE,QAAQ,cAChC,GAAG,eAAe,SAAS,QAAQ,KAAK,EAAE,WAAW,OAAO,UAAU,CAAC,CAAC,CAC1E;AACJ,CAAC,CACH;;AAGF,MAAa,MAA2C,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,KAAK;;AAQ3F,MAAa,gBACX,UACA,UAA6B,CAAC,MAI3B;CAGH,MAAM,WACJ,QAAQ,WAAW,KAAA,IACf,MACC,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,MAAM,OAAO,QAAQ,MAAM,CAAC;CAIjE,MAAM,MAAM,eAAe,MAAM,QAAQ,CAAC,CAAC,KACzC,MAAM,QAAQ,MAAM,UAAU,OAAO,CAAC,GACtC,MAAM,QAAQ,QAAQ,GACtB,MAAM,QAAQ,WAAW,aAAa,CACxC;CACA,OAAO,WAAW,aAAa,KAAK,EAAE,eAAe,KAAK,CAAC;AAC7D"}
+{"version":3,"file":"Server.mjs","names":["Storage.AuthMethod","DnsRecord.Model","Plan.OperationId","Plan.Model","Storage.AttemptStatus","Approval.Model","Receipt.Model","Storage.Rejection","Storage.Overall","Storage.RequirementStatus","Verify.Evidence","Verify.HostEvidence","Plan.PlanId","Approval.ApprovalId","Receipt.ReceiptId","Errors.fail","Reason.InvalidInput","Errors.DomainKitError","Connect.Service","Provision.Service","Cleanup.Service","Verify.Service","Storage.Service","Providers.Service","Principal.Service","Reason.NotFound"],"sources":["../src/Server.ts"],"sourcesContent":["/**\n * domainkit/server — the whole lifecycle as one HttpApi group the host mounts.\n *\n *   const Api = HttpApi.make(\"app\").add(Server.group)\n *   const ApiLive = HttpApiBuilder.layer(Api).pipe(\n *     Layer.provide([Server.layer(Api), DomainKitLive, IdentityLive]),\n *   )\n *\n * The host provides `Identity` (request -> `Principal.Interface`). Everything else comes from\n * `DomainKit.layer`. Non-HttpApi hosts use `toWebHandler`. The group carries no prefix of its\n * own, so `group.prefix(\"/internal/dns\")` or a host router mount is all a different base path\n * takes; callback URLs follow the mount.\n */\nimport { Context, Effect, Layer, Option, Schema } from \"effect\";\nimport * as HttpRouter from \"effect/unstable/http/HttpRouter\";\nimport * as HttpServer from \"effect/unstable/http/HttpServer\";\nimport * as HttpServerRequest from \"effect/unstable/http/HttpServerRequest\";\nimport * as HttpApi from \"effect/unstable/httpapi/HttpApi\";\nimport * as HttpApiBuilder from \"effect/unstable/httpapi/HttpApiBuilder\";\nimport * as HttpApiEndpoint from \"effect/unstable/httpapi/HttpApiEndpoint\";\nimport * as HttpApiGroup from \"effect/unstable/httpapi/HttpApiGroup\";\nimport * as HttpApiSchema from \"effect/unstable/httpapi/HttpApiSchema\";\n\nimport * as Approval from \"./Approval.ts\";\nimport * as Cleanup from \"./Cleanup.ts\";\nimport * as Connect from \"./Connect.ts\";\nimport * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Plan from \"./Plan.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Provision from \"./Provision.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Receipt from \"./Receipt.ts\";\nimport * as Storage from \"./Storage.ts\";\nimport * as Verify from \"./Verify.ts\";\n\n/**\n * What DomainKit already knows about the request when it asks the host who is making it. Only\n * `/callback/:provider` passes one, because it is the only route that points at a flow DomainKit\n * recorded earlier; every other route calls `principal` with the request alone.\n */\nexport interface IdentityContext {\n  /** The route being served. */\n  readonly endpoint: EndpointName;\n  /** The flow this callback claims to finish, as DomainKit recorded it when the flow started. */\n  readonly continuation: Storage.ContinuationHeader;\n}\n\n/** The only service a host must implement for the server. */\nexport interface IdentityService {\n  /**\n   * `context` is present only on the callback, where a host that keeps per-request tenancy can use\n   * `context.continuation.ownerId` to pick the right tenant out of a session that holds several.\n   * Ignoring it is safe everywhere: DomainKit checks the principal against the recorded flow on\n   * that route regardless, so a host that answers with the wrong one is refused rather than\n   * trusted.\n   */\n  readonly principal: (\n    request: HttpServerRequest.HttpServerRequest,\n    context?: IdentityContext,\n  ) => Effect.Effect<Principal.Interface, Errors.DomainKitError>;\n  /**\n   * Which routes this principal may reach, checked after `principal` on every request. Fail with\n   * reason `Forbidden` for the 403 a UI expects. Without it every authenticated principal reaches\n   * every route, which is the right default for a host whose own middleware already gates the\n   * mount.\n   */\n  readonly authorize?: (\n    principal: Principal.Interface,\n    endpoint: EndpointName,\n  ) => Effect.Effect<void, Errors.DomainKitError>;\n}\n\nexport class Identity extends Context.Service<Identity, IdentityService>()(\n  \"@domainkit/server/Identity\",\n) {}\n\n// ---------------------------------------------------------------------------------------------\n// Wire schemas (the transport contract `domainkit/client` and `@domainkit/react` consume)\n// ---------------------------------------------------------------------------------------------\n\nexport const ConnectionStatus = Schema.Literals([\"disconnected\", \"connected\", \"reconnect\"]);\nexport type ConnectionStatus = typeof ConnectionStatus.Type;\n\n/** One value a token method needs, so a form renders without knowing the provider. */\nexport const Field = Schema.Struct({\n  name: Schema.String,\n  required: Schema.Boolean,\n  secret: Schema.Boolean,\n});\nexport type Field = typeof Field.Type;\n\n/** How a provider can be connected; `fields` is `null` for the interactive methods. */\nexport const MethodDescriptor = Schema.Struct({\n  kind: Storage.AuthMethod,\n  label: Schema.String,\n  docsUrl: Schema.NullOr(Schema.String),\n  fields: Schema.NullOr(Schema.Array(Field)),\n});\nexport type MethodDescriptor = typeof MethodDescriptor.Type;\n\n/** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */\n/** The attachment a domain holds, with the zone label the provider gave when it was created. */\nexport const Attachment = Schema.Struct({\n  id: Schema.String,\n  label: Schema.String,\n});\nexport type Attachment = typeof Attachment.Type;\n\nexport const Snapshot = Schema.Struct({\n  domain: Schema.String,\n  attachment: Schema.NullOr(Attachment),\n  connectionId: Schema.NullOr(Schema.String),\n  provider: Schema.NullOr(Schema.String),\n  method: Schema.NullOr(Storage.AuthMethod),\n  status: ConnectionStatus,\n  lastReceiptId: Schema.NullOr(Schema.String),\n  /** How many domains the connection serves, including this one; `0` without a connection. */\n  connectionDomains: Schema.Number,\n  reusable: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      method: Storage.AuthMethod,\n    }),\n  ),\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Snapshot = typeof Snapshot.Type;\n\n/**\n * How the client asks to connect. `values` is keyed by the provider's declared token fields, as\n * `Snapshot.providers[].methods[].fields` names them. Secrets are plaintext in transit and never\n * come back out.\n */\nexport class Token extends Schema.TaggedClass<Token>(\"@domainkit/server/Method/Token\")(\"Token\", {\n  values: Schema.Record(Schema.String, Schema.String),\n}) {}\nexport class OAuth extends Schema.TaggedClass<OAuth>(\"@domainkit/server/Method/OAuth\")(\"OAuth\", {\n  returnTo: Schema.optionalKey(Schema.String),\n}) {}\nexport class Integration extends Schema.TaggedClass<Integration>(\n  \"@domainkit/server/Method/Integration\",\n)(\"Integration\", { returnTo: Schema.optionalKey(Schema.String) }) {}\nexport const Method = Schema.Union([Token, OAuth, Integration]);\nexport type Method = typeof Method.Type;\n\n/** A start without a domain connects the account alone; the customer picks a zone afterwards. */\nexport const StartPayload = Schema.Struct({\n  domain: Schema.optionalKey(Schema.String),\n  provider: Schema.String,\n  method: Method,\n});\nexport type StartPayload = typeof StartPayload.Type;\n\n/** How the customer proves the account again. The provider is the connection's own. */\nexport const ReconnectPayload = Schema.Struct({ method: Method });\nexport type ReconnectPayload = typeof ReconnectPayload.Type;\n\n/** A zone the connection can serve, named for a customer to pick from. */\nexport class Candidate extends Schema.Class<Candidate>(\"@domainkit/server/Candidate\")({\n  zone: Schema.String,\n  label: Schema.String,\n}) {}\n\n/**\n * The connection the start produced. `label` names the account the way the customer will read it:\n * the attached zone's label, or the provider's name when the start carried no domain. `snapshot`\n * is the domain's state, and is null for a start that attached none.\n */\nexport class Connected extends Schema.TaggedClass<Connected>(\"@domainkit/server/Started/Connected\")(\n  \"Connected\",\n  {\n    connectionId: Schema.String,\n    provider: Schema.String,\n    label: Schema.String,\n    snapshot: Schema.NullOr(Snapshot),\n  },\n) {}\nexport class Redirect extends Schema.TaggedClass<Redirect>(\"@domainkit/server/Started/Redirect\")(\n  \"Redirect\",\n  { authorizationUrl: Schema.String },\n) {}\nexport class SelectionRequired extends Schema.TaggedClass<SelectionRequired>(\n  \"@domainkit/server/Started/SelectionRequired\",\n)(\"SelectionRequired\", { connectionId: Schema.String, candidates: Schema.Array(Candidate) }) {}\nexport const Started = Schema.Union([Connected, Redirect, SelectionRequired]);\nexport type Started = typeof Started.Type;\n\n/**\n * Which of the principal's connections already reaches a domain. The class names carry a\n * `Discovery` prefix because `Started` owns the unprefixed `SelectionRequired`; the wire tags are\n * the ones `Connect.Discovery` uses.\n */\nexport class DiscoveryResolved extends Schema.TaggedClass<DiscoveryResolved>(\n  \"@domainkit/server/Discovery/Resolved\",\n)(\"Resolved\", { connectionId: Schema.String, zone: Schema.String, label: Schema.String }) {}\nexport class DiscoverySelectionRequired extends Schema.TaggedClass<DiscoverySelectionRequired>(\n  \"@domainkit/server/Discovery/SelectionRequired\",\n)(\"SelectionRequired\", {\n  candidates: Schema.Array(\n    Schema.Struct({ connectionId: Schema.String, zone: Schema.String, label: Schema.String }),\n  ),\n}) {}\n/** `host` names the registered provider whose nameservers serve the domain, by definition id. */\nexport class DiscoveryNotFound extends Schema.TaggedClass<DiscoveryNotFound>(\n  \"@domainkit/server/Discovery/NotFound\",\n)(\"NotFound\", {\n  nameservers: Schema.Array(Schema.String),\n  host: Schema.NullOr(Schema.Struct({ provider: Schema.String })),\n}) {}\nexport const Discovery = Schema.Union([\n  DiscoveryResolved,\n  DiscoverySelectionRequired,\n  DiscoveryNotFound,\n]);\nexport type Discovery = typeof Discovery.Type;\n\n/** One zone a connection reaches, named for a customer to pick from. */\nexport const Zone = Schema.Struct({\n  connectionId: Schema.String,\n  provider: Schema.String,\n  zone: Schema.String,\n  label: Schema.String,\n  nameservers: Schema.optionalKey(Schema.Array(Schema.String)),\n});\nexport type Zone = typeof Zone.Type;\n\n/**\n * Every zone the principal's connections reach, and where each connection stands. A connection\n * marked `reconnect` contributes no zones and needs the customer to authorize it again.\n */\nexport const Zones = Schema.Struct({\n  zones: Schema.Array(Zone),\n  connections: Schema.Array(\n    Schema.Struct({\n      connectionId: Schema.String,\n      provider: Schema.String,\n      status: ConnectionStatus,\n    }),\n  ),\n  /** Every provider a customer could connect, so a picker offers one without a second call. */\n  providers: Schema.Array(\n    Schema.Struct({\n      id: Schema.String,\n      name: Schema.String,\n      methods: Schema.Array(MethodDescriptor),\n    }),\n  ),\n});\nexport type Zones = typeof Zones.Type;\n\nexport const AttachPayload = Schema.Struct({\n  domain: Schema.String,\n  /** Which candidate zone to attach when `SelectionRequired` came back. */\n  zone: Schema.optionalKey(Schema.String),\n});\nexport type AttachPayload = typeof AttachPayload.Type;\n\nexport const PlanPayload = Schema.Struct({\n  requirements: Schema.Array(DnsRecord.Model),\n});\nexport type PlanPayload = typeof PlanPayload.Type;\n\nexport const ObservePayload = Schema.Struct({\n  /** Records to observe instead of the attachment's receipt; required for an unattached domain. */\n  requirements: Schema.optionalKey(Schema.Array(DnsRecord.Model)),\n});\nexport type ObservePayload = typeof ObservePayload.Type;\n\nexport const ApprovePayload = Schema.Struct({\n  /** A subset of the plan's writes; omit to approve every write. */\n  operationIds: Schema.optionalKey(Schema.Array(Plan.OperationId)),\n});\nexport type ApprovePayload = typeof ApprovePayload.Type;\n\nexport const RejectPayload = Schema.Struct({\n  /** Why the customer declined, for the audit trail. */\n  reason: Schema.optionalKey(Schema.String),\n});\nexport type RejectPayload = typeof RejectPayload.Type;\n\n/** One durable plan -> approval -> receipt lifecycle, as `GET /plans/:planId` returns it. */\nexport const Attempt = Schema.Struct({\n  plan: Plan.Model,\n  status: Storage.AttemptStatus,\n  approval: Schema.NullOr(Approval.Model),\n  receipt: Schema.NullOr(Receipt.Model),\n  rejection: Schema.NullOr(Storage.Rejection),\n});\nexport type Attempt = typeof Attempt.Type;\n\n/** `Verify.Readiness` on the wire; timestamps encode as ISO strings. */\nexport const Readiness = Schema.Struct({\n  domain: Schema.String,\n  attachmentId: Schema.NullOr(Schema.String),\n  overall: Storage.Overall,\n  requirements: Schema.Array(\n    Schema.Struct({\n      /** `Verify.requirementKey(record)`, so a client pairs rows by content, not by position. */\n      key: Schema.String,\n      operationId: Schema.NullOr(Plan.OperationId),\n      record: DnsRecord.Model,\n      status: Storage.RequirementStatus,\n      evidence: Schema.Array(Verify.Evidence),\n    }),\n  ),\n  host: Schema.Array(Verify.HostEvidence),\n  checkedAt: Schema.DateTimeUtcFromString,\n  nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString),\n});\nexport type Readiness = typeof Readiness.Type;\n\nconst Redirected = HttpApiSchema.WithHeaders(HttpApiSchema.Empty(302), {\n  location: Schema.String,\n});\n\n// ---------------------------------------------------------------------------------------------\n// Errors: one wire body, the status from `DomainKit.Error.httpStatus`\n// ---------------------------------------------------------------------------------------------\n\n/** `DomainKit.Error` narrowed to the reasons that answer with `status`. */\nconst errorAt = (status: number) =>\n  Errors.DomainKitError.check(\n    Schema.makeFilter((error: Errors.DomainKitError) => error.httpStatus === status),\n  ).pipe(HttpApiSchema.status(status));\n\nconst errors = [400, 401, 403, 404, 409, 500, 501, 502, 503].map(errorAt);\n\n// ---------------------------------------------------------------------------------------------\n// The group\n// ---------------------------------------------------------------------------------------------\n\nexport const group = HttpApiGroup.make(\"domainkit\")\n  .add(\n    HttpApiEndpoint.get(\"inspect\", \"/domains/:domain\", {\n      params: { domain: Schema.String },\n      success: Snapshot,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"discover\", \"/domains/:domain/discovery\", {\n      params: { domain: Schema.String },\n      success: Discovery,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"zones\", \"/zones\", {\n      query: { provider: Schema.optionalKey(Schema.String) },\n      success: Zones,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"start\", \"/connections\", {\n      payload: StartPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"callback\", \"/callback/:provider\", {\n      params: { provider: Schema.String },\n      // `Connect.complete` reads every callback parameter off the request URL, because a provider\n      // may return `error`, `teamId`, or `configurationId` too. These two are declared so the\n      // OpenAPI document names what a provider is expected to send back.\n      query: { state: Schema.String, code: Schema.optionalKey(Schema.String) },\n      success: Redirected,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reconnect\", \"/connections/:connectionId/reconnections\", {\n      params: { connectionId: Schema.String },\n      payload: ReconnectPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"attach\", \"/connections/:connectionId/attachments\", {\n      params: { connectionId: Schema.String },\n      payload: AttachPayload,\n      success: Started,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"detach\", \"/attachments/:attachmentId\", {\n      params: { attachmentId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.delete(\"disconnect\", \"/connections/:connectionId\", {\n      params: { connectionId: Schema.String },\n      success: Schema.Void,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"createPlan\", \"/domains/:domain/plans\", {\n      params: { domain: Schema.String },\n      payload: PlanPayload,\n      success: Plan.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"approve\", \"/plans/:planId/approvals\", {\n      params: { planId: Plan.PlanId },\n      payload: ApprovePayload,\n      success: Approval.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"reject\", \"/plans/:planId/rejections\", {\n      params: { planId: Plan.PlanId },\n      payload: RejectPayload,\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"apply\", \"/approvals/:approvalId/apply\", {\n      params: { approvalId: Approval.ApprovalId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"plan\", \"/plans/:planId\", {\n      params: { planId: Plan.PlanId },\n      success: Attempt,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"receipt\", \"/receipts/:receiptId\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Receipt.Model,\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"observe\", \"/domains/:domain/observations\", {\n      params: { domain: Schema.String },\n      payload: ObservePayload,\n      success: Readiness,\n      error: errors,\n    }),\n  )\n  .add(\n    // The stored observation, or `null` when nothing has been observed for the domain yet. A\n    // domain with no readiness is not a missing route, so it answers 200 with a null body and\n    // leaves 404 to name a domain this owner cannot reach.\n    HttpApiEndpoint.get(\"readiness\", \"/domains/:domain/readiness\", {\n      params: { domain: Schema.String },\n      success: Schema.NullOr(Readiness),\n      error: errors,\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"cleanupPlan\", \"/receipts/:receiptId/cleanup-plans\", {\n      params: { receiptId: Receipt.ReceiptId },\n      success: Plan.Model,\n      error: errors,\n    }),\n  );\n// Cleanup approve, reject, and apply reuse those routes: the attempt knows its kind.\n\nexport type Group = typeof group;\n\n/** Every route in the group, by name; what `Identity.authorize` is asked about. */\nexport type EndpointName = HttpApiGroup.Endpoints<Group>[\"identifier\"];\n\nexport interface Options {\n  /**\n   * Where the callback route is reachable from the provider, without the `/callback/:provider`\n   * suffix. Defaults to the incoming request's origin and mount path.\n   */\n  readonly callbackBaseUrl?: string;\n  /** Where interactive flows return when the callback carries no `returnTo`. */\n  readonly defaultReturnTo?: string;\n}\n\n/** Everything the handlers need: the lifecycle services, Storage, and the host's `Identity`. */\nexport type Services =\n  | Provision.Service\n  | Cleanup.Service\n  | Connect.Service\n  | Verify.Service\n  | Providers.Service\n  | Storage.Service\n  | Identity;\n\n// ---------------------------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------------------------\n\nconst START_ROUTE = \"/connections\";\nconst reconnectRoute = (connectionId: string) =>\n  `/connections/${encodeURIComponent(connectionId)}/reconnections`;\nconst callbackRoute = (provider: string) => `/callback/${encodeURIComponent(provider)}`;\n\nconst invalid = (message: string, field?: string) =>\n  Errors.fail(new Reason.InvalidInput({ message, ...(field === undefined ? {} : { field }) }));\n\n/** The request as an absolute URL: the web original when there is one, else scheme plus `Host`. */\nconst absoluteUrl = (\n  request: HttpServerRequest.HttpServerRequest,\n): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    try {\n      return Effect.succeed(new URL(request.originalUrl));\n    } catch {\n      const url = HttpServerRequest.toURL(request);\n      return Option.isNone(url)\n        ? invalid(\"The request has no usable origin; set callbackBaseUrl\", \"callbackBaseUrl\")\n        : Effect.succeed(url.value);\n    }\n  });\n\n/**\n * The absolute URL the provider redirects back to. `callbackBaseUrl` wins when the host set it,\n * because a proxy that rewrites `Host` leaves the request pointing at an origin the browser never\n * sees; otherwise it follows the prefix the group is mounted at, derived by stripping the handling\n * route's own path off the request.\n */\nconst callbackUrlFor = (input: {\n  readonly request: HttpServerRequest.HttpServerRequest;\n  readonly provider: string;\n  readonly options: Options;\n  /** The path of the route serving this request, stripped to find the mount. */\n  readonly route: string;\n}): Effect.Effect<URL, Errors.DomainKitError> =>\n  Effect.suspend(() => {\n    const suffix = `/callback/${encodeURIComponent(input.provider)}`;\n    const configured = input.options.callbackBaseUrl;\n    if (configured !== undefined) {\n      return Effect.try({\n        try: () => new URL(`${configured.replace(/\\/+$/, \"\")}${suffix}`),\n        catch: () => callbackConfigurationError(`${configured} is not a URL`),\n      });\n    }\n    return Effect.flatMap(absoluteUrl(input.request), (url) => {\n      const path = url.pathname;\n      if (!path.endsWith(input.route)) {\n        return invalid(\n          `The ${input.route} route is not mounted where it says; set callbackBaseUrl`,\n          \"callbackBaseUrl\",\n        );\n      }\n      return Effect.succeed(\n        new URL(`${url.origin}${path.slice(0, path.length - input.route.length)}${suffix}`),\n      );\n    });\n  });\n\n/**\n * One refusal for every way a callback can fail to match a flow: no such `state`, one that has\n * expired, one presented at another provider's route, and one presented by a session that did not\n * start it. The text is constant on purpose — a caller holding a leaked `state` must not be able\n * to tell \"no such flow\" from \"not your flow\".\n */\nconst noSuchFlow = Errors.fail(\n  new Reason.InvalidInput({\n    message: \"This callback does not match a connection you started\",\n    field: \"state\",\n  }),\n);\n\nconst callbackConfigurationError = (message: string) =>\n  new Errors.DomainKitError({\n    reason: new Reason.InvalidInput({ message, field: \"callbackBaseUrl\" }),\n  });\n\n/**\n * Where the callback may send the customer: a path under the callback's own base, or an absolute\n * URL on its origin. A destination that leaves the application is an open redirect, whoever\n * supplied it.\n */\nconst sameOrigin = (destination: string, callback: URL): string | null => {\n  try {\n    // Resolving against the callback is what makes this safe: the URL parser normalizes the forms\n    // a browser would follow off-origin (`//host`, `/\\host`, `\\/host`, encoded hosts) into a real\n    // origin, so comparing origins catches every one of them.\n    const url = new URL(destination, callback);\n    return url.origin === callback.origin ? url.toString() : null;\n  } catch {\n    return null;\n  }\n};\n\nconst snapshotOf = (snapshot: Connect.Snapshot): Snapshot => ({\n  domain: snapshot.domain,\n  attachment:\n    snapshot.attachment === null\n      ? null\n      : { id: snapshot.attachment.id, label: snapshot.attachment.label },\n  connectionId: snapshot.connection?.id ?? null,\n  provider: snapshot.authorization?.provider ?? null,\n  method: snapshot.authorization?.method ?? null,\n  status:\n    snapshot.connection === null\n      ? \"disconnected\"\n      : snapshot.authorization?.revocation === \"active\"\n        ? \"connected\"\n        : \"reconnect\",\n  lastReceiptId: snapshot.lastReceiptId,\n  connectionDomains: snapshot.connectionDomains,\n  reusable: snapshot.reusable.map(({ connection, provider, method }) => ({\n    connectionId: connection.id,\n    provider,\n    method,\n  })),\n  providers: snapshot.providers.map(({ id, name, methods }) => ({ id, name, methods })),\n});\n\n/** The wire method as `Connect` takes it; interactive cases carry the caller's return destination. */\nconst methodOf = (method: Method): Connect.Method => {\n  switch (method._tag) {\n    case \"Token\":\n      return Connect.Method.token(method.values);\n    case \"OAuth\":\n      return Connect.Method.oauth(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n    case \"Integration\":\n      return Connect.Method.integration(\n        method.returnTo === undefined ? {} : { returnTo: method.returnTo },\n      );\n  }\n};\n\nconst candidatesOf = (\n  candidates: ReadonlyArray<{ readonly zone: string; readonly label: string }>,\n): ReadonlyArray<Candidate> => candidates.map(({ zone, label }) => new Candidate({ zone, label }));\n\n/**\n * Handlers for `group` inside the host's API. Every handler derives `Principal` from `Identity`\n * for the request it is serving and provides it to the lifecycle services.\n */\nexport const layer = <ApiId extends string, Groups extends HttpApiGroup.Constraint>(\n  api: HttpApi.HttpApi<ApiId, Groups>,\n  options: Options = {},\n): Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services> =>\n  // The host's API carries its own groups beside this one; only `\"domainkit\"` is implemented here,\n  // and `HttpApiBuilder.group` needs the group's own endpoint types to check the handlers.\n  HttpApiBuilder.group(api as unknown as HttpApi.HttpApi<ApiId, Group>, \"domainkit\", (handlers) =>\n    Effect.gen(function* () {\n      const identity = yield* Identity;\n      const connect = yield* Connect.Service;\n      const provision = yield* Provision.Service;\n      const cleanup = yield* Cleanup.Service;\n      const verify = yield* Verify.Service;\n      const storage = yield* Storage.Service;\n      const providers = yield* Providers.Service;\n\n      /**\n       * Run a lifecycle effect as the principal the host derives from this request, once the host\n       * has allowed that principal onto this route.\n       */\n      const as = <A>(\n        endpoint: EndpointName,\n        request: HttpServerRequest.HttpServerRequest,\n        effect: Effect.Effect<A, Errors.DomainKitError, Principal.Service>,\n        context?: IdentityContext,\n      ): Effect.Effect<A, Errors.DomainKitError> =>\n        Effect.flatMap(identity.principal(request, context), (principal) =>\n          Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () =>\n            Effect.provideService(effect, Principal.Service, principal),\n          ),\n        );\n\n      const snapshot = (domain: string) => Effect.map(connect.inspect(domain), snapshotOf);\n\n      const discovered = (discovery: Connect.Discovery): Discovery => {\n        switch (discovery._tag) {\n          case \"Resolved\":\n            return new DiscoveryResolved({\n              connectionId: discovery.connectionId,\n              zone: discovery.target.zone,\n              label: discovery.target.label,\n            });\n          case \"SelectionRequired\":\n            return new DiscoverySelectionRequired({\n              candidates: discovery.candidates.map(({ connectionId, target }) => ({\n                connectionId,\n                zone: target.zone,\n                label: target.label,\n              })),\n            });\n          case \"NotFound\":\n            return new DiscoveryNotFound({\n              nameservers: discovery.nameservers,\n              host: discovery.host,\n            });\n        }\n      };\n\n      /**\n       * The connection a start or an attach produced. `label` is the zone the attachment named,\n       * or the provider itself where the connection carries no domain yet.\n       */\n      const connected = (input: {\n        readonly connection: Storage.Connection;\n        readonly attachment: Storage.Attachment | null;\n        readonly domain: string | undefined;\n      }): Effect.Effect<Connected, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const authorization = yield* storage.authorizations.get(input.connection.authorizationId);\n          const definition = yield* providers.get(authorization.provider);\n          return new Connected({\n            connectionId: input.connection.id,\n            provider: authorization.provider,\n            label: input.attachment?.label ?? definition.name,\n            snapshot: input.domain === undefined ? null : yield* snapshot(input.domain),\n          });\n        });\n\n      const startedOf = (\n        started: Connect.Started,\n        domain: string | undefined,\n      ): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> => {\n        switch (started._tag) {\n          case \"Connected\":\n            return connected({\n              attachment: started.attachment,\n              connection: started.connection,\n              domain,\n            });\n          case \"Redirect\":\n            return Effect.succeed(new Redirect({ authorizationUrl: started.authorizationUrl }));\n          case \"SelectionRequired\":\n            return Effect.succeed(\n              new SelectionRequired({\n                connectionId: started.connection.id,\n                candidates: candidatesOf(started.candidates),\n              }),\n            );\n        }\n      };\n\n      /**\n       * Attach with a zone the client picked out of a `SelectionRequired`. The provider target\n       * behind a zone never crosses the wire, so resolve the candidates again and match by zone.\n       */\n      const attachAt = (input: {\n        readonly connectionId: string;\n        readonly domain: string;\n        readonly zone: string | undefined;\n      }): Effect.Effect<Started, Errors.DomainKitError, Principal.Service> =>\n        Effect.gen(function* () {\n          const connection = yield* storage.connections.get(input.connectionId);\n          const attached = (attachment: Storage.Attachment) =>\n            connected({ attachment, connection, domain: input.domain });\n          const first = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n          });\n          if (!(\"_tag\" in first)) return yield* attached(first);\n          if (input.zone === undefined) {\n            return new SelectionRequired({\n              connectionId: input.connectionId,\n              candidates: candidatesOf(first.candidates),\n            });\n          }\n          const target = first.candidates.find(({ zone }) => zone === input.zone);\n          if (target === undefined) {\n            return yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }));\n          }\n          const second = yield* connect.attach({\n            connectionId: input.connectionId,\n            domain: input.domain,\n            target,\n          });\n          return \"_tag\" in second\n            ? yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: input.zone }))\n            : yield* attached(second);\n        });\n\n      /** Provisioning and cleanup share the approve and apply routes; the attempt knows its kind. */\n      const kindOf = (attempt: Storage.Attempt) =>\n        attempt.kind === \"cleanup\" ? cleanup : provision;\n\n      return handlers\n        .handle(\"inspect\", ({ params, request }) => as(\"inspect\", request, snapshot(params.domain)))\n        .handle(\"discover\", ({ params, request }) =>\n          as(\"discover\", request, Effect.map(connect.discover(params.domain), discovered)),\n        )\n        .handle(\"zones\", ({ query, request }) =>\n          as(\n            \"zones\",\n            request,\n            Effect.map(\n              connect.zones(query.provider === undefined ? {} : { provider: query.provider }),\n              (listing): Zones => ({\n                zones: listing.zones.map(({ connectionId, provider, target }) => ({\n                  connectionId,\n                  provider,\n                  zone: target.zone,\n                  label: target.label,\n                  ...(target.nameservers === undefined ? {} : { nameservers: target.nameservers }),\n                })),\n                connections: listing.connections,\n                providers: listing.providers,\n              }),\n            ),\n          ),\n        )\n        .handle(\"start\", ({ payload, request }) =>\n          as(\n            \"start\",\n            request,\n            Effect.gen(function* () {\n              // Token methods connect in one call; the interactive ones need somewhere to land.\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: payload.provider,\n                      options,\n                      route: START_ROUTE,\n                    })).toString();\n              const started = yield* connect.start({\n                provider: payload.provider,\n                ...(payload.domain === undefined ? {} : { domain: payload.domain }),\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, payload.domain);\n            }),\n          ),\n        )\n        .handle(\"reconnect\", ({ params, payload, request }) =>\n          as(\n            \"reconnect\",\n            request,\n            Effect.gen(function* () {\n              const connection = yield* storage.connections.get(params.connectionId);\n              const authorization = yield* storage.authorizations.get(connection.authorizationId);\n              const callbackUrl =\n                payload.method._tag === \"Token\"\n                  ? undefined\n                  : (yield* callbackUrlFor({\n                      request,\n                      provider: authorization.provider,\n                      options,\n                      route: reconnectRoute(params.connectionId),\n                    })).toString();\n              const started = yield* connect.reconnect({\n                connectionId: params.connectionId,\n                method: methodOf(payload.method),\n                ...(callbackUrl === undefined ? {} : { callbackUrl }),\n              });\n              return yield* startedOf(started, undefined);\n            }),\n          ),\n        )\n        .handle(\"callback\", ({ params, query, request }) =>\n          Effect.gen(function* () {\n            // The one route that establishes its identity from something other than the request.\n            // A provider callback is a top-level navigation carrying a `state` the provider echoed\n            // back and whatever credential the browser attaches by itself, so the flow DomainKit\n            // recorded is the only authority on whose it is. Read its header first — a read, never\n            // a spend, so a leaked `state` cannot burn the flow it names — tell the host which\n            // flow is being finished, and then hold the host's answer against the record.\n            const header = yield* storage.continuations\n              .header(query.state)\n              .pipe(\n                Effect.catch((error) =>\n                  error.reason._tag === \"NotFound\" || error.reason._tag === \"Expired\"\n                    ? Effect.succeed(null)\n                    : Effect.fail(error),\n                ),\n              );\n            const continuation =\n              header !== null && header.provider === params.provider ? header : null;\n            // The host authenticates even when there is nothing to finish, so the status cannot\n            // tell a caller whether the `state` it holds names a flow at all.\n            return yield* as(\n              \"callback\",\n              request,\n              Effect.gen(function* () {\n                // The owner comes from the record and the actor from the host's own session;\n                // nothing in the query string contributes either. The scoped `get` below keeps\n                // its owner filter, so a host that answers with the wrong principal still fails\n                // closed even if this check were ever removed.\n                const principal = yield* Principal.Service;\n                if (\n                  continuation === null ||\n                  principal.ownerId !== continuation.ownerId ||\n                  principal.actorId !== continuation.actorId\n                ) {\n                  return yield* noSuchFlow;\n                }\n                const url = yield* absoluteUrl(request);\n                // Resolve the destination against the callback's public base, not the request: a\n                // proxy that rewrites `Host` leaves the request on an origin the browser never\n                // sees.\n                const base = yield* callbackUrlFor({\n                  request,\n                  provider: params.provider,\n                  options,\n                  route: callbackRoute(params.provider),\n                });\n                // Where the customer lands comes from the continuation this owner started, never\n                // from the provider's query string, and it is resolved before the callback is\n                // spent: a server with nowhere to send them must not connect the provider and\n                // then fail.\n                // The host's authentication sits between the header read and this one, so the\n                // flow can expire or be spent in that window. It refuses the same way it would\n                // have a moment earlier, rather than changing shape because of when it happened.\n                // This is also where the owner filter fails closed when a host resolves the wrong\n                // principal, and that refusal must look like every other one.\n                const flow = yield* storage.continuations\n                  .get(query.state)\n                  .pipe(\n                    Effect.catch((error) =>\n                      error.reason._tag === \"NotFound\" || error.reason._tag === \"Expired\"\n                        ? noSuchFlow\n                        : Effect.fail(error),\n                    ),\n                  );\n                const requested = flow.returnTo ?? options.defaultReturnTo;\n                if (requested === undefined) {\n                  return yield* invalid(\n                    \"The flow carried no returnTo and the server has no defaultReturnTo\",\n                    \"returnTo\",\n                  );\n                }\n                const destination = sameOrigin(requested, base);\n                if (destination === null) {\n                  return yield* invalid(`${requested} leaves this application`, \"returnTo\");\n                }\n                yield* connect.complete({\n                  continuationId: query.state,\n                  callbackUrl: url.toString(),\n                });\n                return HttpApiSchema.withHeaders({\n                  body: undefined as void,\n                  headers: { location: destination },\n                });\n              }),\n              continuation === null ? undefined : { endpoint: \"callback\", continuation },\n            );\n          }),\n        )\n        .handle(\"attach\", ({ params, payload, request }) =>\n          as(\n            \"attach\",\n            request,\n            attachAt({\n              connectionId: params.connectionId,\n              domain: payload.domain,\n              zone: payload.zone,\n            }),\n          ),\n        )\n        .handle(\"detach\", ({ params, request }) =>\n          as(\"detach\", request, connect.detach(params.attachmentId)),\n        )\n        .handle(\"disconnect\", ({ params, request }) =>\n          as(\"disconnect\", request, connect.disconnect(params.connectionId)),\n        )\n        .handle(\"createPlan\", ({ params, payload, request }) =>\n          as(\n            \"createPlan\",\n            request,\n            provision.plan({ domain: params.domain, requirements: payload.requirements }),\n          ),\n        )\n        .handle(\"approve\", ({ params, payload, request }) =>\n          as(\n            \"approve\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).approve(params.planId, {\n                ...(payload.operationIds === undefined\n                  ? {}\n                  : { operationIds: payload.operationIds, allowPartial: true }),\n              });\n            }),\n          ),\n        )\n        .handle(\"reject\", ({ params, payload, request }) =>\n          as(\n            \"reject\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.get(params.planId);\n              return yield* kindOf(attempt).reject(params.planId, {\n                ...(payload.reason === undefined ? {} : { reason: payload.reason }),\n              });\n            }),\n          ),\n        )\n        .handle(\"apply\", ({ params, request }) =>\n          as(\n            \"apply\",\n            request,\n            Effect.gen(function* () {\n              const attempt = yield* storage.attempts.byApproval(params.approvalId);\n              return yield* kindOf(attempt).apply(params.approvalId);\n            }),\n          ),\n        )\n        .handle(\"plan\", ({ params, request }) =>\n          as(\n            \"plan\",\n            request,\n            Effect.map(storage.attempts.get(params.planId), (attempt) => ({\n              plan: attempt.plan,\n              status: attempt.status,\n              approval: attempt.approval,\n              receipt: attempt.receipt,\n              rejection: attempt.rejection,\n            })),\n          ),\n        )\n        .handle(\"receipt\", ({ params, request }) =>\n          as(\n            \"receipt\",\n            request,\n            Effect.flatMap(storage.attempts.byReceipt(params.receiptId), (attempt) =>\n              attempt.receipt === null\n                ? Errors.fail(new Reason.NotFound({ entity: \"receipt\", id: params.receiptId }))\n                : Effect.succeed(attempt.receipt),\n            ),\n          ),\n        )\n        .handle(\"observe\", ({ params, payload, request }) =>\n          as(\n            \"observe\",\n            request,\n            verify.observe({\n              domain: params.domain,\n              ...(payload.requirements === undefined ? {} : { requirements: payload.requirements }),\n            }),\n          ),\n        )\n        .handle(\"readiness\", ({ params, request }) =>\n          as(\"readiness\", request, verify.latest(params.domain)),\n        )\n        .handle(\"cleanupPlan\", ({ params, request }) =>\n          as(\"cleanupPlan\", request, cleanup.plan({ receiptId: params.receiptId })),\n        );\n    }),\n  ) as Layer.Layer<HttpApiGroup.Service<ApiId, \"domainkit\">, never, Services>;\n\n/** A standalone API for hosts not on HttpApi. Mount at any prefix. */\nexport const api: HttpApi.HttpApi<\"domainkit\", Group> = HttpApi.make(\"domainkit\").add(group);\n\nexport interface WebHandlerOptions extends Options {\n  /** Mount every route under this path, e.g. `/api/domainkit`. */\n  readonly prefix?: `/${string}`;\n}\n\n/** The Promise edge: a `fetch`-shaped handler over the group for hosts that are not Effect-native. */\nexport const toWebHandler = (\n  services: Layer.Layer<Services, Errors.DomainKitError>,\n  options: WebHandlerOptions = {},\n): {\n  readonly handler: (request: Request) => Promise<Response>;\n  readonly dispose: () => Promise<void>;\n} => {\n  // `group.prefix` widens the endpoint paths in the type, which `Group` states unprefixed; the\n  // handlers are keyed by endpoint identifier, so the routes still line up.\n  const prefixed =\n    options.prefix === undefined\n      ? api\n      : (HttpApi.make(\"domainkit\").add(group.prefix(options.prefix)) as unknown as HttpApi.HttpApi<\n          \"domainkit\",\n          Group\n        >);\n  const app = HttpApiBuilder.layer(prefixed).pipe(\n    Layer.provide(layer(prefixed, options)),\n    Layer.provide(services),\n    Layer.provide(HttpServer.layerServices),\n  );\n  return HttpRouter.toWebHandler(app, { disableLogger: true });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,IAAa,WAAb,cAA8B,QAAQ,QAAmC,CAAC,CACxE,4BACF,CAAC,CAAC,CAAC;AAMH,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAgB;CAAa;AAAW,CAAC;;AAI1F,MAAa,QAAQ,OAAO,OAAO;CACjC,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ,OAAO;AACjB,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO;CAC5C,MAAMA;CACN,OAAO,OAAO;CACd,SAAS,OAAO,OAAO,OAAO,MAAM;CACpC,QAAQ,OAAO,OAAO,OAAO,MAAM,KAAK,CAAC;AAC3C,CAAC;;;AAKD,MAAa,aAAa,OAAO,OAAO;CACtC,IAAI,OAAO;CACX,OAAO,OAAO;AAChB,CAAC;AAGD,MAAa,WAAW,OAAO,OAAO;CACpC,QAAQ,OAAO;CACf,YAAY,OAAO,OAAO,UAAU;CACpC,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,UAAU,OAAO,OAAO,OAAO,MAAM;CACrC,QAAQ,OAAO,OAAOA,UAAkB;CACxC,QAAQ;CACR,eAAe,OAAO,OAAO,OAAO,MAAM;;CAE1C,mBAAmB,OAAO;CAC1B,UAAU,OAAO,MACf,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQA;CACV,CAAC,CACH;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;;;;;;AAQD,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,EACpD,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,QAAb,cAA2B,OAAO,YAAmB,gCAAgC,CAAC,CAAC,SAAS,EAC9F,UAAU,OAAO,YAAY,OAAO,MAAM,EAC5C,CAAC,CAAC,CAAC,CAAC;AACJ,IAAa,cAAb,cAAiC,OAAO,YACtC,sCACF,CAAC,CAAC,eAAe,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACnE,MAAa,SAAS,OAAO,MAAM;CAAC;CAAO;CAAO;AAAW,CAAC;;AAI9D,MAAa,eAAe,OAAO,OAAO;CACxC,QAAQ,OAAO,YAAY,OAAO,MAAM;CACxC,UAAU,OAAO;CACjB,QAAQ;AACV,CAAC;;AAID,MAAa,mBAAmB,OAAO,OAAO,EAAE,QAAQ,OAAO,CAAC;;AAIhE,IAAa,YAAb,cAA+B,OAAO,MAAiB,6BAA6B,CAAC,CAAC;CACpF,MAAM,OAAO;CACb,OAAO,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,YAAb,cAA+B,OAAO,YAAuB,qCAAqC,CAAC,CACjG,aACA;CACE,cAAc,OAAO;CACrB,UAAU,OAAO;CACjB,OAAO,OAAO;CACd,UAAU,OAAO,OAAO,QAAQ;AAClC,CACF,CAAC,CAAC,CAAC;AACH,IAAa,WAAb,cAA8B,OAAO,YAAsB,oCAAoC,CAAC,CAC9F,YACA,EAAE,kBAAkB,OAAO,OAAO,CACpC,CAAC,CAAC,CAAC;AACH,IAAa,oBAAb,cAAuC,OAAO,YAC5C,6CACF,CAAC,CAAC,qBAAqB;CAAE,cAAc,OAAO;CAAQ,YAAY,OAAO,MAAM,SAAS;AAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAa,UAAU,OAAO,MAAM;CAAC;CAAW;CAAU;AAAiB,CAAC;;;;;;AAQ5E,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAAC,CAAC,CAAC;AAC3F,IAAa,6BAAb,cAAgD,OAAO,YACrD,+CACF,CAAC,CAAC,qBAAqB,EACrB,YAAY,OAAO,MACjB,OAAO,OAAO;CAAE,cAAc,OAAO;CAAQ,MAAM,OAAO;CAAQ,OAAO,OAAO;AAAO,CAAC,CAC1F,EACF,CAAC,CAAC,CAAC,CAAC;;AAEJ,IAAa,oBAAb,cAAuC,OAAO,YAC5C,sCACF,CAAC,CAAC,YAAY;CACZ,aAAa,OAAO,MAAM,OAAO,MAAM;CACvC,MAAM,OAAO,OAAO,OAAO,OAAO,EAAE,UAAU,OAAO,OAAO,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC,CAAC;AACJ,MAAa,YAAY,OAAO,MAAM;CACpC;CACA;CACA;AACF,CAAC;;AAID,MAAa,OAAO,OAAO,OAAO;CAChC,cAAc,OAAO;CACrB,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,OAAO,OAAO;CACd,aAAa,OAAO,YAAY,OAAO,MAAM,OAAO,MAAM,CAAC;AAC7D,CAAC;;;;;AAOD,MAAa,QAAQ,OAAO,OAAO;CACjC,OAAO,OAAO,MAAM,IAAI;CACxB,aAAa,OAAO,MAClB,OAAO,OAAO;EACZ,cAAc,OAAO;EACrB,UAAU,OAAO;EACjB,QAAQ;CACV,CAAC,CACH;;CAEA,WAAW,OAAO,MAChB,OAAO,OAAO;EACZ,IAAI,OAAO;EACX,MAAM,OAAO;EACb,SAAS,OAAO,MAAM,gBAAgB;CACxC,CAAC,CACH;AACF,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;CACzC,QAAQ,OAAO;;CAEf,MAAM,OAAO,YAAY,OAAO,MAAM;AACxC,CAAC;AAGD,MAAa,cAAc,OAAO,OAAO,EACvC,cAAc,OAAO,MAAMC,KAAe,EAC5C,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMA,KAAe,CAAC,EAChE,CAAC;AAGD,MAAa,iBAAiB,OAAO,OAAO;;AAE1C,cAAc,OAAO,YAAY,OAAO,MAAMC,WAAgB,CAAC,EACjE,CAAC;AAGD,MAAa,gBAAgB,OAAO,OAAO;;AAEzC,QAAQ,OAAO,YAAY,OAAO,MAAM,EAC1C,CAAC;;AAID,MAAa,UAAU,OAAO,OAAO;CACnC,MAAMC;CACN,QAAQC;CACR,UAAU,OAAO,OAAOC,OAAc;CACtC,SAAS,OAAO,OAAOC,OAAa;CACpC,WAAW,OAAO,OAAOC,SAAiB;AAC5C,CAAC;;AAID,MAAa,YAAY,OAAO,OAAO;CACrC,QAAQ,OAAO;CACf,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,SAASC;CACT,cAAc,OAAO,MACnB,OAAO,OAAO;;EAEZ,KAAK,OAAO;EACZ,aAAa,OAAO,OAAON,WAAgB;EAC3C,QAAQD;EACR,QAAQQ;EACR,UAAU,OAAO,MAAMC,QAAe;CACxC,CAAC,CACH;CACA,MAAM,OAAO,MAAMC,YAAmB;CACtC,WAAW,OAAO;CAClB,aAAa,OAAO,OAAO,OAAO,qBAAqB;AACzD,CAAC;AAGD,MAAM,aAAa,cAAc,YAAY,cAAc,MAAM,GAAG,GAAG,EACrE,UAAU,OAAO,OACnB,CAAC;;AAOD,MAAM,WAAW,WAAA,eACO,MACpB,OAAO,YAAY,UAAiC,MAAM,eAAe,MAAM,CACjF,CAAC,CAAC,KAAK,cAAc,OAAO,MAAM,CAAC;AAErC,MAAM,SAAS;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC,CAAC,IAAI,OAAO;AAMxE,MAAa,QAAQ,aAAa,KAAK,WAAW,CAAC,CAChD,IACC,gBAAgB,IAAI,WAAW,oBAAoB;CACjD,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,8BAA8B;CAC5D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,SAAS,UAAU;CACrC,OAAO,EAAE,UAAU,OAAO,YAAY,OAAO,MAAM,EAAE;CACrD,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gBAAgB;CAC5C,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,YAAY,uBAAuB;CACrD,QAAQ,EAAE,UAAU,OAAO,OAAO;CAIlC,OAAO;EAAE,OAAO,OAAO;EAAQ,MAAM,OAAO,YAAY,OAAO,MAAM;CAAE;CACvE,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,aAAa,4CAA4C;CAC5E,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,0CAA0C;CACvE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,UAAU,8BAA8B;CAC7D,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,OAAO,cAAc,8BAA8B;CACjE,QAAQ,EAAE,cAAc,OAAO,OAAO;CACtC,SAAS,OAAO;CAChB,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,cAAc,0BAA0B;CAC3D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,4BAA4B;CAC1D,QAAQ,EAAE,QAAQS,OAAY;CAC9B,SAAS;CACT,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,UAAU,6BAA6B;CAC1D,QAAQ,EAAE,QAAQO,OAAY;CAC9B,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,SAAS,gCAAgC;CAC5D,QAAQ,EAAE,YAAYC,WAAoB;CAC1C,SAASP;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,QAAQ,kBAAkB;CAC5C,QAAQ,EAAE,QAAQM,OAAY;CAC9B,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,IAAI,WAAW,wBAAwB;CACrD,QAAQ,EAAE,WAAWE,UAAkB;CACvC,SAASR;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,WAAW,iCAAiC;CAC/D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS;CACT,SAAS;CACT,OAAO;AACT,CAAC,CACH,CAAC,CACA,IAIC,gBAAgB,IAAI,aAAa,8BAA8B;CAC7D,QAAQ,EAAE,QAAQ,OAAO,OAAO;CAChC,SAAS,OAAO,OAAO,SAAS;CAChC,OAAO;AACT,CAAC,CACH,CAAC,CACA,IACC,gBAAgB,KAAK,eAAe,sCAAsC;CACxE,QAAQ,EAAE,WAAWQ,UAAkB;CACvC,SAASX;CACT,OAAO;AACT,CAAC,CACH;AAgCF,MAAM,cAAc;AACpB,MAAM,kBAAkB,iBACtB,gBAAgB,mBAAmB,YAAY,EAAE;AACnD,MAAM,iBAAiB,aAAqB,aAAa,mBAAmB,QAAQ;AAEpF,MAAM,WAAW,SAAiB,UAChCY,KAAY,IAAIC,aAAoB;CAAE;CAAS,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AAAG,CAAC,CAAC;;AAG7F,MAAM,eACJ,YAEA,OAAO,cAAc;CACnB,IAAI;EACF,OAAO,OAAO,QAAQ,IAAI,IAAI,QAAQ,WAAW,CAAC;CACpD,QAAQ;EACN,MAAM,MAAM,kBAAkB,MAAM,OAAO;EAC3C,OAAO,OAAO,OAAO,GAAG,IACpB,QAAQ,yDAAyD,iBAAiB,IAClF,OAAO,QAAQ,IAAI,KAAK;CAC9B;AACF,CAAC;;;;;;;AAQH,MAAM,kBAAkB,UAOtB,OAAO,cAAc;CACnB,MAAM,SAAS,aAAa,mBAAmB,MAAM,QAAQ;CAC7D,MAAM,aAAa,MAAM,QAAQ;CACjC,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,IAAI;EAChB,WAAW,IAAI,IAAI,GAAG,WAAW,QAAQ,QAAQ,EAAE,IAAI,QAAQ;EAC/D,aAAa,2BAA2B,GAAG,WAAW,cAAc;CACtE,CAAC;CAEH,OAAO,OAAO,QAAQ,YAAY,MAAM,OAAO,IAAI,QAAQ;EACzD,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,KAAK,SAAS,MAAM,KAAK,GAC5B,OAAO,QACL,OAAO,MAAM,MAAM,2DACnB,iBACF;EAEF,OAAO,OAAO,QACZ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,MAAM,GAAG,KAAK,SAAS,MAAM,MAAM,MAAM,IAAI,QAAQ,CACpF;CACF,CAAC;AACH,CAAC;;;;;;;AAQH,MAAM,aAAaD,KACjB,IAAIC,aAAoB;CACtB,SAAS;CACT,OAAO;AACT,CAAC,CACH;AAEA,MAAM,8BAA8B,YAClC,IAAIC,eAAsB,EACxB,QAAQ,IAAID,aAAoB;CAAE;CAAS,OAAO;AAAkB,CAAC,EACvE,CAAC;;;;;;AAOH,MAAM,cAAc,aAAqB,aAAiC;CACxE,IAAI;EAIF,MAAM,MAAM,IAAI,IAAI,aAAa,QAAQ;EACzC,OAAO,IAAI,WAAW,SAAS,SAAS,IAAI,SAAS,IAAI;CAC3D,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,cAAc,cAA0C;CAC5D,QAAQ,SAAS;CACjB,YACE,SAAS,eAAe,OACpB,OACA;EAAE,IAAI,SAAS,WAAW;EAAI,OAAO,SAAS,WAAW;CAAM;CACrE,cAAc,SAAS,YAAY,MAAM;CACzC,UAAU,SAAS,eAAe,YAAY;CAC9C,QAAQ,SAAS,eAAe,UAAU;CAC1C,QACE,SAAS,eAAe,OACpB,iBACA,SAAS,eAAe,eAAe,WACrC,cACA;CACR,eAAe,SAAS;CACxB,mBAAmB,SAAS;CAC5B,UAAU,SAAS,SAAS,KAAK,EAAE,YAAY,UAAU,cAAc;EACrE,cAAc,WAAW;EACzB;EACA;CACF,EAAE;CACF,WAAW,SAAS,UAAU,KAAK,EAAE,IAAI,MAAM,eAAe;EAAE;EAAI;EAAM;CAAQ,EAAE;AACtF;;AAGA,MAAM,YAAY,WAAmC;CACnD,QAAQ,OAAO,MAAf;EACE,KAAK,SACH,OAAA,SAAsB,MAAM,OAAO,MAAM;EAC3C,KAAK,SACH,OAAA,SAAsB,MACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;EACF,KAAK,eACH,OAAA,SAAsB,YACpB,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS,CACnE;CACJ;AACF;AAEA,MAAM,gBACJ,eAC6B,WAAW,KAAK,EAAE,MAAM,YAAY,IAAI,UAAU;CAAE;CAAM;AAAM,CAAC,CAAC;;;;;AAMjG,MAAa,SACX,KACA,UAAmB,CAAC,MAIpB,eAAe,MAAM,KAAiD,cAAc,aAClF,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAOE;CACvB,MAAM,YAAY,OAAOC;CACzB,MAAM,UAAU,OAAOC;CACvB,MAAM,SAAS,OAAOC;CACtB,MAAM,UAAU,OAAOC;CACvB,MAAM,YAAY,OAAOC;;;;;CAMzB,MAAM,MACJ,UACA,SACA,QACA,YAEA,OAAO,QAAQ,SAAS,UAAU,SAAS,OAAO,IAAI,cACpD,OAAO,QAAQ,SAAS,YAAY,WAAW,QAAQ,KAAK,OAAO,YACjE,OAAO,eAAe,QAAQC,SAAmB,SAAS,CAC5D,CACF;CAEF,MAAM,YAAY,WAAmB,OAAO,IAAI,QAAQ,QAAQ,MAAM,GAAG,UAAU;CAEnF,MAAM,cAAc,cAA4C;EAC9D,QAAQ,UAAU,MAAlB;GACE,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,cAAc,UAAU;IACxB,MAAM,UAAU,OAAO;IACvB,OAAO,UAAU,OAAO;GAC1B,CAAC;GACH,KAAK,qBACH,OAAO,IAAI,2BAA2B,EACpC,YAAY,UAAU,WAAW,KAAK,EAAE,cAAc,cAAc;IAClE;IACA,MAAM,OAAO;IACb,OAAO,OAAO;GAChB,EAAE,EACJ,CAAC;GACH,KAAK,YACH,OAAO,IAAI,kBAAkB;IAC3B,aAAa,UAAU;IACvB,MAAM,UAAU;GAClB,CAAC;EACL;CACF;;;;;CAMA,MAAM,aAAa,UAKjB,OAAO,IAAI,aAAa;EACtB,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,MAAM,WAAW,eAAe;EACxF,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,OAAO,IAAI,UAAU;GACnB,cAAc,MAAM,WAAW;GAC/B,UAAU,cAAc;GACxB,OAAO,MAAM,YAAY,SAAS,WAAW;GAC7C,UAAU,MAAM,WAAW,KAAA,IAAY,OAAO,OAAO,SAAS,MAAM,MAAM;EAC5E,CAAC;CACH,CAAC;CAEH,MAAM,aACJ,SACA,WACqE;EACrE,QAAQ,QAAQ,MAAhB;GACE,KAAK,aACH,OAAO,UAAU;IACf,YAAY,QAAQ;IACpB,YAAY,QAAQ;IACpB;GACF,CAAC;GACH,KAAK,YACH,OAAO,OAAO,QAAQ,IAAI,SAAS,EAAE,kBAAkB,QAAQ,iBAAiB,CAAC,CAAC;GACpF,KAAK,qBACH,OAAO,OAAO,QACZ,IAAI,kBAAkB;IACpB,cAAc,QAAQ,WAAW;IACjC,YAAY,aAAa,QAAQ,UAAU;GAC7C,CAAC,CACH;EACJ;CACF;;;;;CAMA,MAAM,YAAY,UAKhB,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,MAAM,YAAY;EACpE,MAAM,YAAY,eAChB,UAAU;GAAE;GAAY;GAAY,QAAQ,MAAM;EAAO,CAAC;EAC5D,MAAM,QAAQ,OAAO,QAAQ,OAAO;GAClC,cAAc,MAAM;GACpB,QAAQ,MAAM;EAChB,CAAC;EACD,IAAI,EAAE,UAAU,QAAQ,OAAO,OAAO,SAAS,KAAK;EACpD,IAAI,MAAM,SAAS,KAAA,GACjB,OAAO,IAAI,kBAAkB;GAC3B,cAAc,MAAM;GACpB,YAAY,aAAa,MAAM,UAAU;EAC3C,CAAC;EAEH,MAAM,SAAS,MAAM,WAAW,MAAM,EAAE,WAAW,SAAS,MAAM,IAAI;EACtE,IAAI,WAAW,KAAA,GACb,OAAO,OAAOT,KAAY,IAAIU,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC;EAEnF,MAAM,SAAS,OAAO,QAAQ,OAAO;GACnC,cAAc,MAAM;GACpB,QAAQ,MAAM;GACd;EACF,CAAC;EACD,OAAO,UAAU,SACb,OAAOV,KAAY,IAAIU,SAAgB;GAAE,QAAQ;GAAQ,IAAI,MAAM;EAAK,CAAC,CAAC,IAC1E,OAAO,SAAS,MAAM;CAC5B,CAAC;;CAGH,MAAM,UAAU,YACd,QAAQ,SAAS,YAAY,UAAU;CAEzC,OAAO,SACJ,OAAO,YAAY,EAAE,QAAQ,cAAc,GAAG,WAAW,SAAS,SAAS,OAAO,MAAM,CAAC,CAAC,CAAC,CAC3F,OAAO,aAAa,EAAE,QAAQ,cAC7B,GAAG,YAAY,SAAS,OAAO,IAAI,QAAQ,SAAS,OAAO,MAAM,GAAG,UAAU,CAAC,CACjF,CAAC,CACA,OAAO,UAAU,EAAE,OAAO,cACzB,GACE,SACA,SACA,OAAO,IACL,QAAQ,MAAM,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS,CAAC,IAC7E,aAAoB;EACnB,OAAO,QAAQ,MAAM,KAAK,EAAE,cAAc,UAAU,cAAc;GAChE;GACA;GACA,MAAM,OAAO;GACb,OAAO,OAAO;GACd,GAAI,OAAO,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,OAAO,YAAY;EAChF,EAAE;EACF,aAAa,QAAQ;EACrB,WAAW,QAAQ;CACrB,EACF,CACF,CACF,CAAC,CACA,OAAO,UAAU,EAAE,SAAS,cAC3B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EAEtB,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,QAAQ;GAClB;GACA,OAAO;EACT,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,MAAM;GACnC,UAAU,QAAQ;GAClB,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;GACjE,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,QAAQ,MAAM;CACjD,CAAC,CACH,CACF,CAAC,CACA,OAAO,cAAc,EAAE,QAAQ,SAAS,cACvC,GACE,aACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,OAAO,YAAY;EACrE,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,MAAM,cACJ,QAAQ,OAAO,SAAS,UACpB,KAAA,KACC,OAAO,eAAe;GACrB;GACA,UAAU,cAAc;GACxB;GACA,OAAO,eAAe,OAAO,YAAY;EAC3C,CAAC,EAAA,CAAG,SAAS;EACnB,MAAM,UAAU,OAAO,QAAQ,UAAU;GACvC,cAAc,OAAO;GACrB,QAAQ,SAAS,QAAQ,MAAM;GAC/B,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO,OAAO,UAAU,SAAS,KAAA,CAAS;CAC5C,CAAC,CACH,CACF,CAAC,CACA,OAAO,aAAa,EAAE,QAAQ,OAAO,cACpC,OAAO,IAAI,aAAa;EAOtB,MAAM,SAAS,OAAO,QAAQ,cAC3B,OAAO,MAAM,KAAK,CAAC,CACnB,KACC,OAAO,OAAO,UACZ,MAAM,OAAO,SAAS,cAAc,MAAM,OAAO,SAAS,YACtD,OAAO,QAAQ,IAAI,IACnB,OAAO,KAAK,KAAK,CACvB,CACF;EACF,MAAM,eACJ,WAAW,QAAQ,OAAO,aAAa,OAAO,WAAW,SAAS;EAGpE,OAAO,OAAO,GACZ,YACA,SACA,OAAO,IAAI,aAAa;GAKtB,MAAM,YAAY,OAAOD;GACzB,IACE,iBAAiB,QACjB,UAAU,YAAY,aAAa,WACnC,UAAU,YAAY,aAAa,SAEnC,OAAO,OAAO;GAEhB,MAAM,MAAM,OAAO,YAAY,OAAO;GAItC,MAAM,OAAO,OAAO,eAAe;IACjC;IACA,UAAU,OAAO;IACjB;IACA,OAAO,cAAc,OAAO,QAAQ;GACtC,CAAC;GAmBD,MAAM,aAAY,OATE,QAAQ,cACzB,IAAI,MAAM,KAAK,CAAC,CAChB,KACC,OAAO,OAAO,UACZ,MAAM,OAAO,SAAS,cAAc,MAAM,OAAO,SAAS,YACtD,aACA,OAAO,KAAK,KAAK,CACvB,CACF,EAAA,CACqB,YAAY,QAAQ;GAC3C,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,QACZ,sEACA,UACF;GAEF,MAAM,cAAc,WAAW,WAAW,IAAI;GAC9C,IAAI,gBAAgB,MAClB,OAAO,OAAO,QAAQ,GAAG,UAAU,2BAA2B,UAAU;GAE1E,OAAO,QAAQ,SAAS;IACtB,gBAAgB,MAAM;IACtB,aAAa,IAAI,SAAS;GAC5B,CAAC;GACD,OAAO,cAAc,YAAY;IAC/B,MAAM,KAAA;IACN,SAAS,EAAE,UAAU,YAAY;GACnC,CAAC;EACH,CAAC,GACD,iBAAiB,OAAO,KAAA,IAAY;GAAE,UAAU;GAAY;EAAa,CAC3E;CACF,CAAC,CACH,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,SAAS;EACP,cAAc,OAAO;EACrB,QAAQ,QAAQ;EAChB,MAAM,QAAQ;CAChB,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,cAC3B,GAAG,UAAU,SAAS,QAAQ,OAAO,OAAO,YAAY,CAAC,CAC3D,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,cAC/B,GAAG,cAAc,SAAS,QAAQ,WAAW,OAAO,YAAY,CAAC,CACnE,CAAC,CACA,OAAO,eAAe,EAAE,QAAQ,SAAS,cACxC,GACE,cACA,SACA,UAAU,KAAK;EAAE,QAAQ,OAAO;EAAQ,cAAc,QAAQ;CAAa,CAAC,CAC9E,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,QAAQ,OAAO,QAAQ,EACnD,GAAI,QAAQ,iBAAiB,KAAA,IACzB,CAAC,IACD;GAAE,cAAc,QAAQ;GAAc,cAAc;EAAK,EAC/D,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,WAAW,EAAE,QAAQ,SAAS,cACpC,GACE,UACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,IAAI,OAAO,MAAM;EACzD,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,EAClD,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO,EACnE,CAAC;CACH,CAAC,CACH,CACF,CAAC,CACA,OAAO,UAAU,EAAE,QAAQ,cAC1B,GACE,SACA,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,WAAW,OAAO,UAAU;EACpE,OAAO,OAAO,OAAO,OAAO,CAAC,CAAC,MAAM,OAAO,UAAU;CACvD,CAAC,CACH,CACF,CAAC,CACA,OAAO,SAAS,EAAE,QAAQ,cACzB,GACE,QACA,SACA,OAAO,IAAI,QAAQ,SAAS,IAAI,OAAO,MAAM,IAAI,aAAa;EAC5D,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,UAAU,QAAQ;EAClB,SAAS,QAAQ;EACjB,WAAW,QAAQ;CACrB,EAAE,CACJ,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,cAC5B,GACE,WACA,SACA,OAAO,QAAQ,QAAQ,SAAS,UAAU,OAAO,SAAS,IAAI,YAC5D,QAAQ,YAAY,OAChBT,KAAY,IAAIU,SAAgB;EAAE,QAAQ;EAAW,IAAI,OAAO;CAAU,CAAC,CAAC,IAC5E,OAAO,QAAQ,QAAQ,OAAO,CACpC,CACF,CACF,CAAC,CACA,OAAO,YAAY,EAAE,QAAQ,SAAS,cACrC,GACE,WACA,SACA,OAAO,QAAQ;EACb,QAAQ,OAAO;EACf,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;CACrF,CAAC,CACH,CACF,CAAC,CACA,OAAO,cAAc,EAAE,QAAQ,cAC9B,GAAG,aAAa,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC,CACvD,CAAC,CACA,OAAO,gBAAgB,EAAE,QAAQ,cAChC,GAAG,eAAe,SAAS,QAAQ,KAAK,EAAE,WAAW,OAAO,UAAU,CAAC,CAAC,CAC1E;AACJ,CAAC,CACH;;AAGF,MAAa,MAA2C,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,KAAK;;AAQ3F,MAAa,gBACX,UACA,UAA6B,CAAC,MAI3B;CAGH,MAAM,WACJ,QAAQ,WAAW,KAAA,IACf,MACC,QAAQ,KAAK,WAAW,CAAC,CAAC,IAAI,MAAM,OAAO,QAAQ,MAAM,CAAC;CAIjE,MAAM,MAAM,eAAe,MAAM,QAAQ,CAAC,CAAC,KACzC,MAAM,QAAQ,MAAM,UAAU,OAAO,CAAC,GACtC,MAAM,QAAQ,QAAQ,GACtB,MAAM,QAAQ,WAAW,aAAa,CACxC;CACA,OAAO,WAAW,aAAa,KAAK,EAAE,eAAe,KAAK,CAAC;AAC7D"}

package/dist/Storage.mjs

@@ -29,6 +29,7 @@ var Storage_exports = /* @__PURE__ */ __exportAll({
 	Capability: () => Capability,
 	Connection: () => Connection,
 	Continuation: () => Continuation,
+	ContinuationHeader: () => ContinuationHeader,
 	Credential: () => Credential,
 	Overall: () => Overall,
 	Readiness: () => Readiness,
@@ -99,6 +100,16 @@ var Continuation = class extends Schema.Class("@domainkit/Storage/Continuation")
 	returnTo: Schema.NullOr(Schema.String),
 	expiresAt: Schema.DateTimeUtcFromString
 }) {};
+/**
+* Who a continuation belongs to, without the continuation itself. `payload` has no place here: it
+* carries the PKCE `codeVerifier`, which only the owner-scoped read may reach.
+*/
+var ContinuationHeader = class extends Schema.Class("@domainkit/Storage/ContinuationHeader")({
+	ownerId: Schema.String,
+	actorId: Schema.String,
+	provider: Schema.String,
+	expiresAt: Schema.DateTimeUtcFromString
+}) {};
 const AttemptStatus = Schema.Literals([
 	"planned",
 	"approved",
@@ -210,6 +221,10 @@ const fromAsync = (service) => {
 		continuations: {
 			put: (continuation) => call("continuations.put", (p) => service.continuations.put(p, continuation)),
 			get: (id) => call("continuations.get", (p) => service.continuations.get(p, id)),
+			header: (id) => Effect.tryPromise({
+				try: () => service.continuations.header(id),
+				catch: storageFailed("continuations.header")
+			}),
 			consume: (id) => call("continuations.consume", (p) => service.continuations.consume(p, id))
 		},
 		attempts: {
@@ -233,6 +248,6 @@ const fromAsync = (service) => {
 };
 const layerFromAsync = (service) => Layer.succeed(Service)(fromAsync(service));
 //#endregion
-export { Attachment, Attempt, AttemptStatus, AuthMethod, Authorization, Capability, Connection, Continuation, Credential, Overall, Readiness, Rejection, RequirementStatus, Service, Storage_exports, fromAsync, layerFromAsync, layerMemory, layerMemoryWith, makeMemory };
+export { Attachment, Attempt, AttemptStatus, AuthMethod, Authorization, Capability, Connection, Continuation, ContinuationHeader, Credential, Overall, Readiness, Rejection, RequirementStatus, Service, Storage_exports, fromAsync, layerFromAsync, layerMemory, layerMemoryWith, makeMemory };
 
 //# sourceMappingURL=Storage.mjs.map