domainkit 0.8.0 → 0.9.1

package/dist/Connect.mjs

@@ -0,0 +1,463 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { candidates, decode } from "./DomainName.mjs";
+import { Forbidden, InvalidInput, NotFound, Reconnect, Unauthenticated } from "./Reason.mjs";
+import { DomainKitError, decode as decode$1, fail } from "./internal/error.mjs";
+import { Service as Service$1 } from "./Custody.mjs";
+import { fresh } from "./internal/ids.mjs";
+import { pkce } from "./internal/oauth.mjs";
+import { Service as Service$2 } from "./Principal.mjs";
+import { Resolution, decodeContext, describeMethods, encodeContext } from "./Provider.mjs";
+import { Service as Service$3 } from "./Providers.mjs";
+import { Service as Service$4 } from "./Resolver.mjs";
+import { Attachment, Authorization, Continuation, Credential, Service as Service$5 } from "./Storage.mjs";
+import { Context, Data, DateTime, Duration, Effect, Layer, Option, Redacted, Schema } from "effect";
+//#region src/Connect.ts
+/**
+* Connect a provider, attach domains to it, and keep the credential alive. Interactive methods
+* (OAuth, integration) return a redirect and complete on callback; token methods connect in one
+* call. Reuse of an existing connection for a new domain is `attach`.
+*/
+var Connect_exports = /* @__PURE__ */ __exportAll({
+	Discovery: () => Discovery,
+	Method: () => Method,
+	Policy: () => Policy,
+	Selection: () => Selection,
+	Service: () => Service,
+	Started: () => Started,
+	attach: () => attach,
+	complete: () => complete,
+	defaults: () => defaults,
+	detach: () => detach,
+	disconnect: () => disconnect,
+	discover: () => discover,
+	inspect: () => inspect,
+	layer: () => layer,
+	make: () => make,
+	refresh: () => refresh,
+	session: () => session,
+	start: () => start
+});
+const MethodEnum = Data.taggedEnum();
+/** `token` accepts a lone string (`{ token }`) or a record; every value is wrapped in `Redacted`. */
+const Method = {
+	...MethodEnum,
+	token: (values) => MethodEnum.Token({ values: typeof values === "string" ? { token: Redacted.make(values) } : Object.fromEntries(Object.entries(values).map(([name, value]) => [name, typeof value === "string" ? Redacted.make(value) : value])) }),
+	oauth: (options = {}) => MethodEnum.OAuth(options),
+	integration: (options = {}) => MethodEnum.Integration(options)
+};
+const Started = Data.taggedEnum();
+const Selection = Data.taggedEnum();
+const Discovery = Data.taggedEnum();
+var Service = class extends Context.Service()("@domainkit/Connect") {};
+const defaults = {
+	allowReuse: () => Effect.succeed(true),
+	refreshBeforeMs: 6e5,
+	continuationTtlMs: 9e5
+};
+var Policy = class extends Context.Reference("@domainkit/Connect/Policy", { defaultValue: () => defaults }) {};
+const Payload = Schema.Struct({
+	method: Schema.Literals(["oauth", "integration"]),
+	codeVerifier: Schema.NullOr(Schema.String),
+	callbackUrl: Schema.String,
+	domain: Schema.NullOr(Schema.String)
+});
+const Target = Schema.Struct({
+	zone: Schema.String,
+	context: Schema.Unknown,
+	label: Schema.String
+});
+const invalid = (message, field) => fail(new InvalidInput({
+	message,
+	...field === void 0 ? {} : { field }
+}));
+const make = Effect.gen(function* () {
+	const storage = yield* Service$5;
+	const custody = yield* Service$1;
+	const providers = yield* Service$3;
+	const resolver = yield* Service$4;
+	const seal = (issued) => Effect.gen(function* () {
+		const ciphertext = yield* custody.seal(issued.secret);
+		return new Credential({
+			ciphertext,
+			expiresAt: issued.expiresAt,
+			rotatedAt: yield* DateTime.now
+		});
+	});
+	/** Plaintext credential with the context decoded from its stored envelope. */
+	const open = (authorization) => Effect.gen(function* () {
+		const definition = yield* providers.get(authorization.provider);
+		const row = yield* storage.authorizations.credential(authorization.id);
+		return {
+			secret: yield* custody.open(row.ciphertext),
+			context: yield* decodeContext(definition, authorization.context)
+		};
+	});
+	const refresherFor = (definition, method) => method === "oauth" ? definition.auth.oauth?.refresh : method === "integration" ? definition.auth.integration?.refresh : void 0;
+	const revokerFor = (definition, method) => method === "oauth" ? definition.auth.oauth?.revoke : method === "integration" ? definition.auth.integration?.revoke : void 0;
+	const revokeAt = (authorization) => Effect.gen(function* () {
+		const definition = yield* providers.get(authorization.provider);
+		const revoke = revokerFor(definition, authorization.method);
+		if (revoke === void 0) return;
+		yield* revoke(yield* open(authorization));
+	});
+	/** Finish revocations a crash interrupted; best effort, never blocks the caller. */
+	const recover = storage.authorizations.recoverRevocations(revokeAt).pipe(Effect.ignore);
+	const refresh = (connectionId) => Effect.gen(function* () {
+		const policy = yield* Policy;
+		const connection = yield* storage.connections.get(connectionId);
+		const authorization = yield* storage.authorizations.get(connection.authorizationId);
+		const definition = yield* providers.get(authorization.provider);
+		const refresher = refresherFor(definition, authorization.method);
+		const dueAt = (row, now) => row.expiresAt !== null && DateTime.toEpochMillis(row.expiresAt) - DateTime.toEpochMillis(now) <= policy.refreshBeforeMs;
+		const expired = (row, now) => row.expiresAt !== null && DateTime.toEpochMillis(row.expiresAt) <= DateTime.toEpochMillis(now);
+		const current = yield* storage.authorizations.credential(authorization.id);
+		const now = yield* DateTime.now;
+		if (!dueAt(current, now)) return "current";
+		if (refresher === void 0) return expired(current, now) ? "reconnect" : "current";
+		return yield* storage.withLock(`refresh:${authorization.id}`, Effect.gen(function* () {
+			const live = yield* storage.authorizations.get(authorization.id).pipe(Effect.map(Option.some), Effect.catchIf((error) => error.reason._tag === "NotFound", () => Effect.succeed(Option.none())));
+			if (Option.isNone(live) || live.value.revocation !== "active") return "reconnect";
+			const latest = yield* storage.authorizations.credential(authorization.id);
+			if (!dueAt(latest, yield* DateTime.now)) return "current";
+			const secret = yield* custody.open(latest.ciphertext);
+			const context = yield* decodeContext(definition, live.value.context);
+			const issued = yield* refresher({
+				secret,
+				context
+			});
+			yield* storage.authorizations.rotate(authorization.id, yield* seal(issued)).pipe(Effect.tapError((error) => error.reason._tag === "NotFound" ? (revokerFor(definition, authorization.method)?.(issued) ?? Effect.void).pipe(Effect.ignore) : Effect.void));
+			return "refreshed";
+		})).pipe(Effect.catchIf((error) => error.reason._tag === "Busy" && !expired(current, now), () => Effect.succeed("current")), Effect.catchIf((error) => error.reason._tag === "Unauthenticated", () => Effect.succeed("reconnect")));
+	});
+	const sessionFor = (connection) => Effect.gen(function* () {
+		const authorization = yield* storage.authorizations.get(connection.authorizationId);
+		const reconnect = fail(new Reconnect({
+			provider: authorization.provider,
+			connectionId: connection.id
+		}));
+		if (authorization.revocation !== "active") return yield* reconnect;
+		if ((yield* refresh(connection.id)) === "reconnect") return yield* reconnect;
+		return (yield* providers.get(authorization.provider)).session(yield* open(authorization));
+	});
+	const connectWith = (input) => Effect.gen(function* () {
+		const principal = yield* Service$2;
+		const session = input.definition.session(input.issued);
+		const held = yield* session.capabilities();
+		const missing = input.requiredCapabilities.filter((capability) => !held.includes(capability));
+		if (missing.length > 0) return yield* fail(new Forbidden({ message: `${input.definition.name} credential lacks ${missing.join(", ")}` }));
+		const authorization = new Authorization({
+			id: yield* fresh("auth"),
+			ownerId: principal.ownerId,
+			provider: input.definition.id,
+			method: input.method,
+			capabilities: held,
+			context: yield* encodeContext(input.definition, input.issued.context),
+			revocation: "active",
+			createdBy: principal.actorId,
+			createdAt: yield* DateTime.now
+		});
+		yield* storage.authorizations.upsert({
+			authorization,
+			credential: yield* seal(input.issued)
+		});
+		return {
+			connection: yield* storage.connections.create(authorization.id),
+			session
+		};
+	});
+	const attachWith = (input) => Effect.gen(function* () {
+		const domain = yield* decode(input.domain);
+		const existing = yield* storage.attachments.byDomain(domain);
+		if (Option.isSome(existing)) {
+			if (existing.value.connectionId === input.connection.id) return existing.value;
+			return yield* invalid(`${domain} is already attached to another connection`, "domain");
+		}
+		const resolution = input.target === void 0 ? yield* input.session.resolveTarget(domain) : Resolution.Resolved({ target: input.target });
+		switch (resolution._tag) {
+			case "SelectionRequired": return Selection.SelectionRequired({ candidates: resolution.candidates });
+			case "NotFound": return yield* fail(new NotFound({
+				entity: "zone",
+				id: domain
+			}));
+			case "Resolved": return yield* storage.attachments.create({
+				connectionId: input.connection.id,
+				domain,
+				zone: resolution.target.zone,
+				target: {
+					...resolution.target,
+					context: yield* encodeContext(input.definition, resolution.target.context)
+				}
+			});
+		}
+	});
+	const started = (connection, attached) => attached === null ? Started.Connected({
+		connection,
+		attachment: null
+	}) : attached instanceof Attachment ? Started.Connected({
+		connection,
+		attachment: attached
+	}) : Started.SelectionRequired({
+		connection,
+		candidates: attached.candidates
+	});
+	/** Authoritative nameservers for the closest zone that answers an NS query. */
+	const authoritative = (candidates) => Effect.gen(function* () {
+		for (const zone of candidates) {
+			const names = (yield* resolver.resolve(zone, "NS")).flatMap((outcome) => outcome._tag === "Answered" ? outcome.answer.records.flatMap((record) => record._tag === "NS" ? [record.nameserver] : []) : []);
+			if (names.length > 0) return [...new Set(names)].sort();
+		}
+		return [];
+	});
+	const discover = (input) => Effect.gen(function* () {
+		const domain = yield* decode(input);
+		const candidates$1 = candidates(domain);
+		const nameservers = yield* authoritative(candidates$1);
+		const reachable = [];
+		for (const connection of yield* storage.connections.list()) {
+			const targets = yield* sessionFor(connection).pipe(Effect.flatMap((session) => session.listTargets()), Effect.catch(() => Effect.succeed([])));
+			for (const target of targets) if (candidates$1.includes(target.zone)) reachable.push({
+				connectionId: connection.id,
+				target
+			});
+		}
+		const normalize = (name) => name.toLowerCase().replace(/\.$/, "");
+		for (const zone of candidates$1) {
+			const matches = reachable.filter(({ target }) => target.zone === zone).sort((left, right) => left.connectionId.localeCompare(right.connectionId));
+			if (matches.length === 0) continue;
+			const [only] = matches;
+			if (matches.length === 1 && only !== void 0) return Discovery.Resolved(only);
+			const decisive = matches.filter(({ target }) => {
+				const configured = new Set((target.nameservers ?? []).map(normalize));
+				return nameservers.length > 0 && nameservers.every((name) => configured.has(name));
+			});
+			const [winner] = decisive;
+			if (decisive.length === 1 && winner !== void 0) return Discovery.Resolved(winner);
+			return Discovery.SelectionRequired({ candidates: matches });
+		}
+		return Discovery.NotFound({ nameservers });
+	});
+	const inspect = (input) => Effect.gen(function* () {
+		const domain = yield* decode(input);
+		const policy = yield* Policy;
+		const attachment = Option.getOrNull(yield* storage.attachments.byDomain(domain));
+		const connection = attachment === null ? null : yield* storage.connections.get(attachment.connectionId);
+		const authorization = connection === null ? null : yield* storage.authorizations.get(connection.authorizationId);
+		const latest = attachment === null ? Option.none() : yield* storage.attempts.latest(attachment.id, "provisioning");
+		const reusable = [];
+		for (const candidate of yield* storage.connections.list()) {
+			if (candidate.id === connection?.id) continue;
+			if (!(yield* policy.allowReuse({
+				connection: candidate,
+				domain
+			}))) continue;
+			const candidateAuthorization = yield* storage.authorizations.get(candidate.authorizationId);
+			if (candidateAuthorization.revocation !== "active") continue;
+			reusable.push({
+				connection: candidate,
+				provider: candidateAuthorization.provider,
+				method: candidateAuthorization.method
+			});
+		}
+		return {
+			domain,
+			attachment,
+			connection,
+			authorization: authorization === null ? null : {
+				id: authorization.id,
+				provider: authorization.provider,
+				method: authorization.method,
+				capabilities: authorization.capabilities,
+				revocation: authorization.revocation
+			},
+			lastReceiptId: Option.isSome(latest) ? latest.value.receipt?.id ?? null : null,
+			reusable,
+			providers: providers.list().map((definition) => ({
+				id: definition.id,
+				name: definition.name,
+				methods: describeMethods(definition)
+			}))
+		};
+	});
+	const start = (input) => Effect.gen(function* () {
+		yield* recover;
+		const principal = yield* Service$2;
+		const policy = yield* Policy;
+		const definition = yield* providers.get(input.provider);
+		if (input.domain !== void 0) yield* decode(input.domain);
+		switch (input.method._tag) {
+			case "Token": {
+				const token = definition.auth.token;
+				if (token === void 0) return yield* invalid(`${definition.name} does not accept tokens`, "method");
+				const issued = yield* token.authenticate(input.method.values);
+				const { connection, session } = yield* connectWith({
+					definition,
+					method: "token",
+					issued,
+					requiredCapabilities: token.requiredCapabilities
+				});
+				const attached = input.domain === void 0 ? null : yield* attachWith({
+					definition,
+					connection,
+					session,
+					domain: input.domain
+				});
+				return started(connection, attached);
+			}
+			case "OAuth":
+			case "Integration": {
+				const interactive = input.method._tag === "OAuth" ? definition.auth.oauth : definition.auth.integration;
+				if (interactive === void 0) return yield* invalid(`${definition.name} does not offer ${input.method._tag.toLowerCase()} connections`, "method");
+				if (input.callbackUrl === void 0) return yield* invalid("Interactive connections need a callbackUrl", "callbackUrl");
+				const continuationId = yield* fresh("cont");
+				const pkce$1 = input.method._tag === "OAuth" ? yield* pkce() : null;
+				const redirect = input.method._tag === "OAuth" ? yield* interactive.start({
+					state: continuationId,
+					callbackUrl: input.callbackUrl,
+					codeChallenge: pkce$1?.codeChallenge ?? ""
+				}) : yield* interactive.start({
+					state: continuationId,
+					callbackUrl: input.callbackUrl
+				});
+				yield* storage.continuations.put(new Continuation({
+					id: continuationId,
+					ownerId: principal.ownerId,
+					actorId: principal.actorId,
+					provider: definition.id,
+					payload: Schema.encodeSync(Payload)({
+						method: input.method._tag === "OAuth" ? "oauth" : "integration",
+						codeVerifier: pkce$1?.codeVerifier ?? null,
+						callbackUrl: input.callbackUrl,
+						domain: input.domain ?? null
+					}),
+					returnTo: input.method.returnTo ?? null,
+					expiresAt: DateTime.addDuration(yield* DateTime.now, Duration.millis(policy.continuationTtlMs))
+				}));
+				return Started.Redirect({
+					authorizationUrl: redirect.authorizationUrl,
+					continuationId
+				});
+			}
+		}
+	});
+	const complete = (input) => Effect.gen(function* () {
+		const callback = yield* Effect.try({
+			try: () => new URL(input.callbackUrl),
+			catch: () => new DomainKitError({ reason: new InvalidInput({
+				message: "callbackUrl is not a URL",
+				field: "callbackUrl"
+			}) })
+		});
+		const params = Object.fromEntries(callback.searchParams);
+		const unauthenticated = (message) => fail(new Unauthenticated({ message }));
+		if (params.error !== void 0) return yield* unauthenticated(`Provider returned ${params.error}`);
+		if (params.state !== input.continuationId) return yield* unauthenticated("Callback state does not match the continuation");
+		const code = params.code;
+		if (code === void 0) return yield* unauthenticated("Callback has no code");
+		return yield* storage.withLock(`continuation:${input.continuationId}`, Effect.gen(function* () {
+			const continuation = yield* storage.continuations.get(input.continuationId);
+			const payload = yield* decode$1(Payload, continuation.payload, "continuation");
+			const definition = yield* providers.get(continuation.provider);
+			const issued = payload.method === "oauth" ? yield* Effect.gen(function* () {
+				const oauth = definition.auth.oauth;
+				if (oauth === void 0 || payload.codeVerifier === null) return yield* invalid(`${definition.name} does not offer oauth connections`, "method");
+				return yield* oauth.complete({
+					code,
+					callbackUrl: payload.callbackUrl,
+					codeVerifier: payload.codeVerifier,
+					params
+				});
+			}) : yield* Effect.gen(function* () {
+				const integration = definition.auth.integration;
+				if (integration === void 0) return yield* invalid(`${definition.name} does not offer integration connections`, "method");
+				return yield* integration.complete({
+					code,
+					callbackUrl: payload.callbackUrl,
+					params
+				});
+			});
+			const { connection, session } = yield* connectWith({
+				definition,
+				method: payload.method,
+				issued,
+				requiredCapabilities: []
+			});
+			const attached = payload.domain === null ? null : yield* attachWith({
+				definition,
+				connection,
+				session,
+				domain: payload.domain
+			});
+			yield* storage.continuations.consume(input.continuationId).pipe(Effect.ignore);
+			return started(connection, attached);
+		}));
+	});
+	const attach = (input) => Effect.gen(function* () {
+		const connection = yield* storage.connections.get(input.connectionId);
+		const authorization = yield* storage.authorizations.get(connection.authorizationId);
+		const definition = yield* providers.get(authorization.provider);
+		const session = yield* sessionFor(connection);
+		return yield* attachWith({
+			definition,
+			connection,
+			session,
+			domain: input.domain,
+			...input.target === void 0 ? {} : { target: input.target }
+		});
+	});
+	const disconnect = (connectionId) => Effect.gen(function* () {
+		yield* recover;
+		const connection = yield* storage.connections.get(connectionId);
+		const attachments = yield* storage.attachments.list(connectionId);
+		yield* Effect.forEach(attachments, (attachment) => storage.attachments.remove(attachment.id));
+		yield* storage.connections.remove(connectionId);
+		if ((yield* storage.connections.list()).some((candidate) => candidate.authorizationId === connection.authorizationId)) return;
+		const authorization = yield* storage.authorizations.get(connection.authorizationId);
+		yield* storage.authorizations.revoke(authorization.id, revokeAt(authorization));
+	});
+	const session = (attachmentId) => Effect.gen(function* () {
+		const attachment = yield* storage.attachments.get(attachmentId);
+		const connection = yield* storage.connections.get(attachment.connectionId);
+		const authorization = yield* storage.authorizations.get(connection.authorizationId);
+		const definition = yield* providers.get(authorization.provider);
+		const stored = yield* decode$1(Target, attachment.target, "target");
+		const target = {
+			...stored,
+			context: yield* decodeContext(definition, stored.context)
+		};
+		const built = yield* sessionFor(connection);
+		if (!(yield* built.listTargets()).some((candidate) => candidate.zone === target.zone)) return yield* fail(new NotFound({
+			entity: "zone",
+			id: target.zone
+		}));
+		return {
+			session: built,
+			target
+		};
+	});
+	return {
+		inspect,
+		discover,
+		start,
+		complete,
+		attach,
+		detach: (attachmentId) => storage.attachments.remove(attachmentId),
+		disconnect,
+		refresh,
+		session
+	};
+});
+const layer = Layer.effect(Service)(make);
+const accessor = (pick) => (...args) => Effect.flatMap(Service, (service) => pick(service)(...args));
+const inspect = accessor((service) => service.inspect);
+const discover = accessor((service) => service.discover);
+const start = accessor((service) => service.start);
+const complete = accessor((service) => service.complete);
+const attach = accessor((service) => service.attach);
+const detach = accessor((service) => service.detach);
+const disconnect = accessor((service) => service.disconnect);
+const refresh = accessor((service) => service.refresh);
+const session = accessor((service) => service.session);
+//#endregion
+export { Connect_exports, Discovery, Method, Policy, Selection, Service, Started, attach, complete, defaults, detach, disconnect, discover, inspect, layer, make, refresh, session, start };
+
+//# sourceMappingURL=Connect.mjs.map

package/dist/Connect.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Connect.mjs","names":["Errors.fail","Reason.InvalidInput","Storage.Service","Custody.Service","Providers.Service","Resolver.Service","Storage.Credential","Provider.decodeContext","Reason.Reconnect","Principal.Service","Reason.Forbidden","Storage.Authorization","Provider.encodeContext","DomainName.decode","Reason.NotFound","Storage.Attachment","candidates","DomainName.candidates","Provider.describeMethods","pkce","OAuth.pkce","Storage.Continuation","Errors.DomainKitError","Reason.Unauthenticated","Errors.decode"],"sources":["../src/Connect.ts"],"sourcesContent":["/**\n * Connect a provider, attach domains to it, and keep the credential alive. Interactive methods\n * (OAuth, integration) return a redirect and complete on callback; token methods connect in one\n * call. Reuse of an existing connection for a new domain is `attach`.\n */\nimport { Context, Data, DateTime, Duration, Effect, Layer, Option, Redacted, Schema } from \"effect\";\n\nimport * as Custody from \"./Custody.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport { fresh } from \"./internal/ids.ts\";\nimport * as OAuth from \"./internal/oauth.ts\";\nimport * as Principal from \"./Principal.ts\";\nimport * as Provider from \"./Provider.ts\";\nimport * as Providers from \"./Providers.ts\";\nimport * as Resolver from \"./Resolver.ts\";\nimport * as Storage from \"./Storage.ts\";\n\ntype Fx<A> = Effect.Effect<A, Errors.DomainKitError, Principal.Service>;\n\nexport type Method = Data.TaggedEnum<{\n  /** Values keyed by the provider's declared `auth.token.fields`. */\n  Token: { readonly values: Provider.TokenValues };\n  OAuth: { readonly returnTo?: string };\n  Integration: { readonly returnTo?: string };\n}>;\nconst MethodEnum = Data.taggedEnum<Method>();\n/** `token` accepts a lone string (`{ token }`) or a record; every value is wrapped in `Redacted`. */\nexport const Method = {\n  ...MethodEnum,\n  token: (\n    values: string | Readonly<Record<string, Redacted.Redacted<string> | string | undefined>>,\n  ): Method =>\n    MethodEnum.Token({\n      values:\n        typeof values === \"string\"\n          ? { token: Redacted.make(values) }\n          : Object.fromEntries(\n              Object.entries(values).map(([name, value]) => [\n                name,\n                typeof value === \"string\" ? Redacted.make(value) : value,\n              ]),\n            ),\n    }),\n  oauth: (options: { readonly returnTo?: string } = {}): Method => MethodEnum.OAuth(options),\n  integration: (options: { readonly returnTo?: string } = {}): Method =>\n    MethodEnum.Integration(options),\n} as const;\n\n/** Everything the UI needs about a domain's provider state. */\nexport interface Snapshot {\n  readonly domain: string;\n  readonly attachment: Storage.Attachment | null;\n  readonly connection: Storage.Connection | null;\n  readonly authorization: Pick<\n    Storage.Authorization,\n    \"id\" | \"provider\" | \"method\" | \"capabilities\" | \"revocation\"\n  > | null;\n  readonly lastReceiptId: string | null;\n  /** Other connections of this owner that could serve this domain. */\n  readonly reusable: ReadonlyArray<{\n    readonly connection: Storage.Connection;\n    readonly provider: string;\n    readonly method: Storage.AuthMethod;\n  }>;\n  readonly providers: ReadonlyArray<{\n    readonly id: string;\n    readonly name: string;\n    readonly methods: ReadonlyArray<Provider.MethodDescriptor>;\n  }>;\n}\n\nexport type Started = Data.TaggedEnum<{\n  Connected: {\n    readonly connection: Storage.Connection;\n    readonly attachment: Storage.Attachment | null;\n  };\n  Redirect: { readonly authorizationUrl: string; readonly continuationId: string };\n  SelectionRequired: {\n    readonly connection: Storage.Connection;\n    readonly candidates: ReadonlyArray<Provider.Target>;\n  };\n}>;\nexport const Started = Data.taggedEnum<Started>();\n\n/** `attach` either attached the domain or needs the caller to pick a zone. */\nexport type Selection = Data.TaggedEnum<{\n  SelectionRequired: { readonly candidates: ReadonlyArray<Provider.Target> };\n}>;\nexport const Selection = Data.taggedEnum<Selection>();\n\nexport type Attached = Storage.Attachment | Selection;\n\nexport type Refreshed = \"current\" | \"refreshed\" | \"reconnect\";\n\n/** Which of the principal's connections serves a domain, from nameserver evidence and zone lists. */\nexport type Discovery = Data.TaggedEnum<{\n  Resolved: { readonly connectionId: string; readonly target: Provider.Target };\n  SelectionRequired: {\n    readonly candidates: ReadonlyArray<{\n      readonly connectionId: string;\n      readonly target: Provider.Target;\n    }>;\n  };\n  NotFound: { readonly nameservers: ReadonlyArray<string> };\n}>;\nexport const Discovery = Data.taggedEnum<Discovery>();\n\nexport interface Interface {\n  readonly inspect: (domain: string) => Fx<Snapshot>;\n  /**\n   * Resolve the domain's authoritative nameservers, then match them against the zones each of\n   * the principal's connections can reach: the closest zone wins, a decisive nameserver match\n   * breaks ties, and anything else needs a selection.\n   */\n  readonly discover: (domain: string) => Fx<Discovery>;\n  /** Connect a provider and, when `domain` is given, attach it. Token methods finish here. */\n  readonly start: (input: {\n    readonly provider: string;\n    readonly method: Method;\n    readonly domain?: string;\n    readonly callbackUrl?: string;\n  }) => Fx<Started>;\n  /** Finish an interactive connection from the provider callback (the full callback URL). */\n  readonly complete: (input: {\n    readonly continuationId: string;\n    readonly callbackUrl: string;\n  }) => Fx<Started>;\n  readonly attach: (input: {\n    readonly connectionId: string;\n    readonly domain: string;\n    readonly target?: Provider.Target;\n  }) => Fx<Attached>;\n  /** Records stay in DNS; DomainKit forgets the domain. Use `Cleanup` first to remove records. */\n  readonly detach: (attachmentId: string) => Fx<void>;\n  /** Detach every domain and revoke the credential at the provider when the method supports it. */\n  readonly disconnect: (connectionId: string) => Fx<void>;\n  /** Refresh a near-expiry credential, single-flighted. Called automatically before provider use. */\n  readonly refresh: (connectionId: string) => Fx<Refreshed>;\n  /** Live provider session for an attachment; used by Provision, Cleanup, Verify. */\n  readonly session: (\n    attachmentId: string,\n  ) => Fx<{ readonly session: Provider.Session; readonly target: Provider.Target }>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Connect\") {}\n\n/** Which owner-scoped reuse is allowed. Default: any connection of the same owner may serve any of its domains. */\nexport interface PolicyShape {\n  readonly allowReuse: (input: {\n    readonly connection: Storage.Connection;\n    readonly domain: string;\n  }) => Effect.Effect<boolean, never, Principal.Service>;\n  /** Refresh this long before expiry. Default 10 minutes. */\n  readonly refreshBeforeMs: number;\n  /** Continuation lifetime. Default 15 minutes. */\n  readonly continuationTtlMs: number;\n}\nexport const defaults: PolicyShape = {\n  allowReuse: () => Effect.succeed(true),\n  refreshBeforeMs: 10 * 60_000,\n  continuationTtlMs: 15 * 60_000,\n};\nexport class Policy extends Context.Reference<PolicyShape>(\"@domainkit/Connect/Policy\", {\n  defaultValue: () => defaults,\n}) {}\n\n// ---------------------------------------------------------------------------------------------\n// Implementation\n// ---------------------------------------------------------------------------------------------\n\nconst Payload = Schema.Struct({\n  method: Schema.Literals([\"oauth\", \"integration\"]),\n  codeVerifier: Schema.NullOr(Schema.String),\n  callbackUrl: Schema.String,\n  domain: Schema.NullOr(Schema.String),\n});\n\nconst Target = Schema.Struct({\n  zone: Schema.String,\n  context: Schema.Unknown,\n  label: Schema.String,\n});\n\nconst invalid = (message: string, field?: string) =>\n  Errors.fail(new Reason.InvalidInput({ message, ...(field === undefined ? {} : { field }) }));\n\nexport const make: Effect.Effect<\n  Interface,\n  never,\n  Storage.Service | Custody.Service | Providers.Service | Resolver.Service\n> = Effect.gen(function* () {\n  const storage = yield* Storage.Service;\n  const custody = yield* Custody.Service;\n  const providers = yield* Providers.Service;\n  const resolver = yield* Resolver.Service;\n\n  const seal = (issued: Provider.IssuedCredential) =>\n    Effect.gen(function* () {\n      const ciphertext = yield* custody.seal(issued.secret);\n      return new Storage.Credential({\n        ciphertext,\n        expiresAt: issued.expiresAt,\n        rotatedAt: yield* DateTime.now,\n      });\n    });\n\n  /** Plaintext credential with the context decoded from its stored envelope. */\n  const open = (authorization: Storage.Authorization): Fx<Provider.Credential> =>\n    Effect.gen(function* () {\n      const definition = yield* providers.get(authorization.provider);\n      const row = yield* storage.authorizations.credential(authorization.id);\n      const secret = yield* custody.open(row.ciphertext);\n      const context = yield* Provider.decodeContext(definition, authorization.context);\n      return { secret, context };\n    });\n\n  const refresherFor = (definition: Provider.Definition, method: Storage.AuthMethod) =>\n    method === \"oauth\"\n      ? definition.auth.oauth?.refresh\n      : method === \"integration\"\n        ? definition.auth.integration?.refresh\n        : undefined;\n\n  const revokerFor = (definition: Provider.Definition, method: Storage.AuthMethod) =>\n    method === \"oauth\"\n      ? definition.auth.oauth?.revoke\n      : method === \"integration\"\n        ? definition.auth.integration?.revoke\n        : undefined;\n\n  const revokeAt = (authorization: Storage.Authorization): Fx<void> =>\n    Effect.gen(function* () {\n      const definition = yield* providers.get(authorization.provider);\n      const revoke = revokerFor(definition, authorization.method);\n      if (revoke === undefined) return;\n      const credential = yield* open(authorization);\n      yield* revoke(credential);\n    });\n\n  /** Finish revocations a crash interrupted; best effort, never blocks the caller. */\n  const recover = storage.authorizations.recoverRevocations(revokeAt).pipe(Effect.ignore);\n\n  const refresh: Interface[\"refresh\"] = (connectionId) =>\n    Effect.gen(function* () {\n      const policy = yield* Policy;\n      const connection = yield* storage.connections.get(connectionId);\n      const authorization = yield* storage.authorizations.get(connection.authorizationId);\n      const definition = yield* providers.get(authorization.provider);\n      const refresher = refresherFor(definition, authorization.method);\n      const dueAt = (row: Storage.Credential, now: DateTime.Utc) =>\n        row.expiresAt !== null &&\n        DateTime.toEpochMillis(row.expiresAt) - DateTime.toEpochMillis(now) <=\n          policy.refreshBeforeMs;\n      const expired = (row: Storage.Credential, now: DateTime.Utc) =>\n        row.expiresAt !== null &&\n        DateTime.toEpochMillis(row.expiresAt) <= DateTime.toEpochMillis(now);\n      const current = yield* storage.authorizations.credential(authorization.id);\n      const now = yield* DateTime.now;\n      if (!dueAt(current, now)) return \"current\" as const;\n      if (refresher === undefined)\n        return expired(current, now) ? (\"reconnect\" as const) : (\"current\" as const);\n      return yield* storage\n        .withLock(\n          `refresh:${authorization.id}`,\n          Effect.gen(function* () {\n            // Disconnect's two-phase revocation does not take this lock: re-read the row here\n            // so a revocation that started meanwhile skips the refresh instead of racing it.\n            const live = yield* storage.authorizations.get(authorization.id).pipe(\n              Effect.map(Option.some),\n              Effect.catchIf(\n                (error) => error.reason._tag === \"NotFound\",\n                () => Effect.succeed(Option.none<Storage.Authorization>()),\n              ),\n            );\n            if (Option.isNone(live) || live.value.revocation !== \"active\") {\n              return \"reconnect\" as const;\n            }\n            const latest = yield* storage.authorizations.credential(authorization.id);\n            if (!dueAt(latest, yield* DateTime.now)) return \"current\" as const;\n            const secret = yield* custody.open(latest.ciphertext);\n            const context = yield* Provider.decodeContext(definition, live.value.context);\n            const issued = yield* refresher({ secret, context });\n            // A revocation that completed while the provider was issuing leaves no row to\n            // rotate; revoke the fresh credential so it does not stay live without a home.\n            yield* storage.authorizations\n              .rotate(authorization.id, yield* seal(issued))\n              .pipe(\n                Effect.tapError((error) =>\n                  error.reason._tag === \"NotFound\"\n                    ? (revokerFor(definition, authorization.method)?.(issued) ?? Effect.void).pipe(\n                        Effect.ignore,\n                      )\n                    : Effect.void,\n                ),\n              );\n            return \"refreshed\" as const;\n          }),\n        )\n        .pipe(\n          Effect.catchIf(\n            (error) => error.reason._tag === \"Busy\" && !expired(current, now),\n            () => Effect.succeed(\"current\" as const),\n          ),\n          Effect.catchIf(\n            (error) => error.reason._tag === \"Unauthenticated\",\n            () => Effect.succeed(\"reconnect\" as const),\n          ),\n        );\n    });\n\n  const sessionFor = (connection: Storage.Connection): Fx<Provider.Session> =>\n    Effect.gen(function* () {\n      const authorization = yield* storage.authorizations.get(connection.authorizationId);\n      const reconnect = Errors.fail(\n        new Reason.Reconnect({\n          provider: authorization.provider,\n          connectionId: connection.id,\n        }),\n      );\n      if (authorization.revocation !== \"active\") return yield* reconnect;\n      if ((yield* refresh(connection.id)) === \"reconnect\") return yield* reconnect;\n      const definition = yield* providers.get(authorization.provider);\n      return definition.session(yield* open(authorization));\n    });\n\n  const connectWith = (input: {\n    readonly definition: Provider.Definition;\n    readonly method: Storage.AuthMethod;\n    readonly issued: Provider.IssuedCredential;\n    readonly requiredCapabilities: ReadonlyArray<Storage.Capability>;\n  }): Fx<{ readonly connection: Storage.Connection; readonly session: Provider.Session }> =>\n    Effect.gen(function* () {\n      const principal = yield* Principal.Service;\n      const session = input.definition.session(input.issued);\n      const held = yield* session.capabilities();\n      const missing = input.requiredCapabilities.filter((capability) => !held.includes(capability));\n      if (missing.length > 0) {\n        return yield* Errors.fail(\n          new Reason.Forbidden({\n            message: `${input.definition.name} credential lacks ${missing.join(\", \")}`,\n          }),\n        );\n      }\n      const authorization = new Storage.Authorization({\n        id: yield* fresh(\"auth\"),\n        ownerId: principal.ownerId,\n        provider: input.definition.id,\n        method: input.method,\n        capabilities: held,\n        context: yield* Provider.encodeContext(input.definition, input.issued.context),\n        revocation: \"active\",\n        createdBy: principal.actorId,\n        createdAt: yield* DateTime.now,\n      });\n      yield* storage.authorizations.upsert({\n        authorization,\n        credential: yield* seal(input.issued),\n      });\n      const connection = yield* storage.connections.create(authorization.id);\n      return { connection, session };\n    });\n\n  const attachWith = (input: {\n    readonly definition: Provider.Definition;\n    readonly connection: Storage.Connection;\n    readonly session: Provider.Session;\n    readonly domain: string;\n    readonly target?: Provider.Target;\n  }): Fx<Attached> =>\n    Effect.gen(function* () {\n      const domain = yield* DomainName.decode(input.domain);\n      const existing = yield* storage.attachments.byDomain(domain);\n      if (Option.isSome(existing)) {\n        if (existing.value.connectionId === input.connection.id) return existing.value;\n        return yield* invalid(`${domain} is already attached to another connection`, \"domain\");\n      }\n      const resolution: Provider.Resolution =\n        input.target === undefined\n          ? yield* input.session.resolveTarget(domain)\n          : Provider.Resolution.Resolved({ target: input.target });\n      switch (resolution._tag) {\n        case \"SelectionRequired\":\n          return Selection.SelectionRequired({ candidates: resolution.candidates });\n        case \"NotFound\":\n          return yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: domain }));\n        case \"Resolved\":\n          return yield* storage.attachments.create({\n            connectionId: input.connection.id,\n            domain,\n            zone: resolution.target.zone,\n            target: {\n              ...resolution.target,\n              context: yield* Provider.encodeContext(input.definition, resolution.target.context),\n            },\n          });\n      }\n    });\n\n  const started = (connection: Storage.Connection, attached: Attached | null): Started =>\n    attached === null\n      ? Started.Connected({ connection, attachment: null })\n      : attached instanceof Storage.Attachment\n        ? Started.Connected({ connection, attachment: attached })\n        : Started.SelectionRequired({ connection, candidates: attached.candidates });\n\n  /** Authoritative nameservers for the closest zone that answers an NS query. */\n  const authoritative = (candidates: ReadonlyArray<DomainName.Model>) =>\n    Effect.gen(function* () {\n      for (const zone of candidates) {\n        const outcomes = yield* resolver.resolve(zone, \"NS\");\n        const names = outcomes.flatMap((outcome) =>\n          outcome._tag === \"Answered\"\n            ? outcome.answer.records.flatMap((record) =>\n                record._tag === \"NS\" ? [record.nameserver] : [],\n              )\n            : [],\n        );\n        if (names.length > 0) return [...new Set(names)].sort();\n      }\n      return [] as ReadonlyArray<string>;\n    });\n\n  const discover: Interface[\"discover\"] = (input) =>\n    Effect.gen(function* () {\n      const domain = yield* DomainName.decode(input);\n      const candidates = DomainName.candidates(domain);\n      const nameservers = yield* authoritative(candidates);\n      const reachable: Array<{\n        readonly connectionId: string;\n        readonly target: Provider.Target;\n      }> = [];\n      for (const connection of yield* storage.connections.list()) {\n        const targets = yield* sessionFor(connection).pipe(\n          Effect.flatMap((session) => session.listTargets()),\n          Effect.catch(() => Effect.succeed([] as ReadonlyArray<Provider.Target>)),\n        );\n        for (const target of targets) {\n          if (candidates.includes(target.zone as DomainName.Model)) {\n            reachable.push({ connectionId: connection.id, target });\n          }\n        }\n      }\n      const normalize = (name: string) => name.toLowerCase().replace(/\\.$/, \"\");\n      for (const zone of candidates) {\n        const matches = reachable\n          .filter(({ target }) => target.zone === zone)\n          .sort((left, right) => left.connectionId.localeCompare(right.connectionId));\n        if (matches.length === 0) continue;\n        const [only] = matches;\n        if (matches.length === 1 && only !== undefined) return Discovery.Resolved(only);\n        const decisive = matches.filter(({ target }) => {\n          const configured = new Set((target.nameservers ?? []).map(normalize));\n          return nameservers.length > 0 && nameservers.every((name) => configured.has(name));\n        });\n        const [winner] = decisive;\n        if (decisive.length === 1 && winner !== undefined) return Discovery.Resolved(winner);\n        return Discovery.SelectionRequired({ candidates: matches });\n      }\n      return Discovery.NotFound({ nameservers });\n    });\n\n  const inspect: Interface[\"inspect\"] = (input) =>\n    Effect.gen(function* () {\n      const domain = yield* DomainName.decode(input);\n      const policy = yield* Policy;\n      const attachment = Option.getOrNull(yield* storage.attachments.byDomain(domain));\n      const connection =\n        attachment === null ? null : yield* storage.connections.get(attachment.connectionId);\n      const authorization =\n        connection === null ? null : yield* storage.authorizations.get(connection.authorizationId);\n      const latest =\n        attachment === null\n          ? Option.none()\n          : yield* storage.attempts.latest(attachment.id, \"provisioning\");\n      const reusable: Array<Snapshot[\"reusable\"][number]> = [];\n      for (const candidate of yield* storage.connections.list()) {\n        if (candidate.id === connection?.id) continue;\n        if (!(yield* policy.allowReuse({ connection: candidate, domain }))) continue;\n        const candidateAuthorization = yield* storage.authorizations.get(candidate.authorizationId);\n        if (candidateAuthorization.revocation !== \"active\") continue;\n        reusable.push({\n          connection: candidate,\n          provider: candidateAuthorization.provider,\n          method: candidateAuthorization.method,\n        });\n      }\n      return {\n        domain,\n        attachment,\n        connection,\n        authorization:\n          authorization === null\n            ? null\n            : {\n                id: authorization.id,\n                provider: authorization.provider,\n                method: authorization.method,\n                capabilities: authorization.capabilities,\n                revocation: authorization.revocation,\n              },\n        lastReceiptId: Option.isSome(latest) ? (latest.value.receipt?.id ?? null) : null,\n        reusable,\n        providers: providers.list().map((definition) => ({\n          id: definition.id,\n          name: definition.name,\n          methods: Provider.describeMethods(definition),\n        })),\n      };\n    });\n\n  const start: Interface[\"start\"] = (input) =>\n    Effect.gen(function* () {\n      yield* recover;\n      const principal = yield* Principal.Service;\n      const policy = yield* Policy;\n      const definition = yield* providers.get(input.provider);\n      if (input.domain !== undefined) yield* DomainName.decode(input.domain);\n      switch (input.method._tag) {\n        case \"Token\": {\n          const token = definition.auth.token;\n          if (token === undefined) {\n            return yield* invalid(`${definition.name} does not accept tokens`, \"method\");\n          }\n          const issued = yield* token.authenticate(input.method.values);\n          const { connection, session } = yield* connectWith({\n            definition,\n            method: \"token\",\n            issued,\n            requiredCapabilities: token.requiredCapabilities,\n          });\n          const attached =\n            input.domain === undefined\n              ? null\n              : yield* attachWith({ definition, connection, session, domain: input.domain });\n          return started(connection, attached);\n        }\n        case \"OAuth\":\n        case \"Integration\": {\n          const interactive =\n            input.method._tag === \"OAuth\" ? definition.auth.oauth : definition.auth.integration;\n          if (interactive === undefined) {\n            return yield* invalid(\n              `${definition.name} does not offer ${input.method._tag.toLowerCase()} connections`,\n              \"method\",\n            );\n          }\n          if (input.callbackUrl === undefined) {\n            return yield* invalid(\"Interactive connections need a callbackUrl\", \"callbackUrl\");\n          }\n          const continuationId = yield* fresh(\"cont\");\n          const pkce = input.method._tag === \"OAuth\" ? yield* OAuth.pkce() : null;\n          const redirect =\n            input.method._tag === \"OAuth\"\n              ? yield* (interactive as Provider.OAuthAuth).start({\n                  state: continuationId,\n                  callbackUrl: input.callbackUrl,\n                  codeChallenge: pkce?.codeChallenge ?? \"\",\n                })\n              : yield* (interactive as Provider.IntegrationAuth).start({\n                  state: continuationId,\n                  callbackUrl: input.callbackUrl,\n                });\n          yield* storage.continuations.put(\n            new Storage.Continuation({\n              id: continuationId,\n              ownerId: principal.ownerId,\n              actorId: principal.actorId,\n              provider: definition.id,\n              payload: Schema.encodeSync(Payload)({\n                method: input.method._tag === \"OAuth\" ? \"oauth\" : \"integration\",\n                codeVerifier: pkce?.codeVerifier ?? null,\n                callbackUrl: input.callbackUrl,\n                domain: input.domain ?? null,\n              }),\n              returnTo: input.method.returnTo ?? null,\n              expiresAt: DateTime.addDuration(\n                yield* DateTime.now,\n                Duration.millis(policy.continuationTtlMs),\n              ),\n            }),\n          );\n          return Started.Redirect({\n            authorizationUrl: redirect.authorizationUrl,\n            continuationId,\n          });\n        }\n      }\n    });\n\n  const complete: Interface[\"complete\"] = (input) =>\n    Effect.gen(function* () {\n      // The continuation is spent only after the credential and connection are persisted, so a\n      // failure before that (bad callback, provider outage, storage outage) leaves the flow\n      // retryable. Concurrent callbacks for the same continuation serialize on a lock; the\n      // loser sees Busy or NotFound. A provider code is single-use, so a retry after the\n      // provider already redeemed it fails Unauthenticated and the customer starts over.\n      const callback = yield* Effect.try({\n        try: () => new URL(input.callbackUrl),\n        catch: () =>\n          new Errors.DomainKitError({\n            reason: new Reason.InvalidInput({\n              message: \"callbackUrl is not a URL\",\n              field: \"callbackUrl\",\n            }),\n          }),\n      });\n      const params = Object.fromEntries(callback.searchParams);\n      const unauthenticated = (message: string) =>\n        Errors.fail(new Reason.Unauthenticated({ message }));\n      if (params.error !== undefined) {\n        return yield* unauthenticated(`Provider returned ${params.error}`);\n      }\n      if (params.state !== input.continuationId) {\n        return yield* unauthenticated(\"Callback state does not match the continuation\");\n      }\n      const code = params.code;\n      if (code === undefined) return yield* unauthenticated(\"Callback has no code\");\n      return yield* storage.withLock(\n        `continuation:${input.continuationId}`,\n        Effect.gen(function* () {\n          const continuation = yield* storage.continuations.get(input.continuationId);\n          const payload = yield* Errors.decode(Payload, continuation.payload, \"continuation\");\n          const definition = yield* providers.get(continuation.provider);\n          const issued =\n            payload.method === \"oauth\"\n              ? yield* Effect.gen(function* () {\n                  const oauth = definition.auth.oauth;\n                  if (oauth === undefined || payload.codeVerifier === null) {\n                    return yield* invalid(\n                      `${definition.name} does not offer oauth connections`,\n                      \"method\",\n                    );\n                  }\n                  return yield* oauth.complete({\n                    code,\n                    callbackUrl: payload.callbackUrl,\n                    codeVerifier: payload.codeVerifier,\n                    params,\n                  });\n                })\n              : yield* Effect.gen(function* () {\n                  const integration = definition.auth.integration;\n                  if (integration === undefined) {\n                    return yield* invalid(\n                      `${definition.name} does not offer integration connections`,\n                      \"method\",\n                    );\n                  }\n                  return yield* integration.complete({\n                    code,\n                    callbackUrl: payload.callbackUrl,\n                    params,\n                  });\n                });\n          const { connection, session } = yield* connectWith({\n            definition,\n            method: payload.method,\n            issued,\n            requiredCapabilities: [],\n          });\n          const attached =\n            payload.domain === null\n              ? null\n              : yield* attachWith({ definition, connection, session, domain: payload.domain });\n          // The connection is durable at this point. Whatever happens to the continuation\n          // now (expired, already spent, or a storage failure while spending it) no longer\n          // changes the outcome: the row expires on its own and a replayed callback fails at\n          // the provider, so the persisted result is returned.\n          yield* storage.continuations.consume(input.continuationId).pipe(Effect.ignore);\n          return started(connection, attached);\n        }),\n      );\n    });\n\n  const attach: Interface[\"attach\"] = (input) =>\n    Effect.gen(function* () {\n      const connection = yield* storage.connections.get(input.connectionId);\n      const authorization = yield* storage.authorizations.get(connection.authorizationId);\n      const definition = yield* providers.get(authorization.provider);\n      const session = yield* sessionFor(connection);\n      return yield* attachWith({\n        definition,\n        connection,\n        session,\n        domain: input.domain,\n        ...(input.target === undefined ? {} : { target: input.target }),\n      });\n    });\n\n  const disconnect: Interface[\"disconnect\"] = (connectionId) =>\n    Effect.gen(function* () {\n      yield* recover;\n      const connection = yield* storage.connections.get(connectionId);\n      const attachments = yield* storage.attachments.list(connectionId);\n      yield* Effect.forEach(attachments, (attachment) => storage.attachments.remove(attachment.id));\n      yield* storage.connections.remove(connectionId);\n      const remaining = (yield* storage.connections.list()).some(\n        (candidate) => candidate.authorizationId === connection.authorizationId,\n      );\n      if (remaining) return;\n      const authorization = yield* storage.authorizations.get(connection.authorizationId);\n      yield* storage.authorizations.revoke(authorization.id, revokeAt(authorization));\n    });\n\n  const session: Interface[\"session\"] = (attachmentId) =>\n    Effect.gen(function* () {\n      const attachment = yield* storage.attachments.get(attachmentId);\n      const connection = yield* storage.connections.get(attachment.connectionId);\n      const authorization = yield* storage.authorizations.get(connection.authorizationId);\n      const definition = yield* providers.get(authorization.provider);\n      const stored = yield* Errors.decode(Target, attachment.target, \"target\");\n      const target: Provider.Target = {\n        ...stored,\n        context: yield* Provider.decodeContext(definition, stored.context),\n      };\n      const built = yield* sessionFor(connection);\n      // The zone must still be reachable by this credential: it may have moved account, been\n      // deleted, or become a kind the provider cannot host records in.\n      const reachable = yield* built.listTargets();\n      if (!reachable.some((candidate) => candidate.zone === target.zone)) {\n        return yield* Errors.fail(new Reason.NotFound({ entity: \"zone\", id: target.zone }));\n      }\n      return { session: built, target };\n    });\n\n  return {\n    inspect,\n    discover,\n    start,\n    complete,\n    attach,\n    detach: (attachmentId) => storage.attachments.remove(attachmentId),\n    disconnect,\n    refresh,\n    session,\n  };\n});\n\nexport const layer: Layer.Layer<\n  Service,\n  never,\n  Storage.Service | Custody.Service | Providers.Service | Resolver.Service\n> = Layer.effect(Service)(make);\n\nconst accessor =\n  <Args extends ReadonlyArray<unknown>, A>(\n    pick: (service: Interface) => (...args: Args) => Fx<A>,\n  ): ((...args: Args) => Effect.Effect<A, Errors.DomainKitError, Principal.Service | Service>) =>\n  (...args) =>\n    Effect.flatMap(Service, (service) => pick(service)(...args));\n\nexport const inspect = accessor((service) => service.inspect);\nexport const discover = accessor((service) => service.discover);\nexport const start = accessor((service) => service.start);\nexport const complete = accessor((service) => service.complete);\nexport const attach = accessor((service) => service.attach);\nexport const detach = accessor((service) => service.detach);\nexport const disconnect = accessor((service) => service.disconnect);\nexport const refresh = accessor((service) => service.refresh);\nexport const session = accessor((service) => service.session);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,aAAa,KAAK,WAAmB;;AAE3C,MAAa,SAAS;CACpB,GAAG;CACH,QACE,WAEA,WAAW,MAAM,EACf,QACE,OAAO,WAAW,WACd,EAAE,OAAO,SAAS,KAAK,MAAM,EAAE,IAC/B,OAAO,YACL,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAC5C,MACA,OAAO,UAAU,WAAW,SAAS,KAAK,KAAK,IAAI,KACrD,CAAC,CACH,EACR,CAAC;CACH,QAAQ,UAA0C,CAAC,MAAc,WAAW,MAAM,OAAO;CACzF,cAAc,UAA0C,CAAC,MACvD,WAAW,YAAY,OAAO;AAClC;AAoCA,MAAa,UAAU,KAAK,WAAoB;AAMhD,MAAa,YAAY,KAAK,WAAsB;AAiBpD,MAAa,YAAY,KAAK,WAAsB;AAuCpD,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAa1F,MAAa,WAAwB;CACnC,kBAAkB,OAAO,QAAQ,IAAI;CACrC,iBAAiB;CACjB,mBAAmB;AACrB;AACA,IAAa,SAAb,cAA4B,QAAQ,UAAuB,6BAA6B,EACtF,oBAAoB,SACtB,CAAC,CAAC,CAAC,CAAC;AAMJ,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ,OAAO,SAAS,CAAC,SAAS,aAAa,CAAC;CAChD,cAAc,OAAO,OAAO,OAAO,MAAM;CACzC,aAAa,OAAO;CACpB,QAAQ,OAAO,OAAO,OAAO,MAAM;AACrC,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,MAAM,OAAO;CACb,SAAS,OAAO;CAChB,OAAO,OAAO;AAChB,CAAC;AAED,MAAM,WAAW,SAAiB,UAChCA,KAAY,IAAIC,aAAoB;CAAE;CAAS,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;AAAG,CAAC,CAAC;AAE7F,MAAa,OAIT,OAAO,IAAI,aAAa;CAC1B,MAAM,UAAU,OAAOC;CACvB,MAAM,UAAU,OAAOC;CACvB,MAAM,YAAY,OAAOC;CACzB,MAAM,WAAW,OAAOC;CAExB,MAAM,QAAQ,WACZ,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,KAAK,OAAO,MAAM;EACpD,OAAO,IAAIC,WAAmB;GAC5B;GACA,WAAW,OAAO;GAClB,WAAW,OAAO,SAAS;EAC7B,CAAC;CACH,CAAC;;CAGH,MAAM,QAAQ,kBACZ,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,MAAM,MAAM,OAAO,QAAQ,eAAe,WAAW,cAAc,EAAE;EAGrE,OAAO;GAAE,QAAA,OAFa,QAAQ,KAAK,IAAI,UAAU;GAEhC,SAAA,OADMC,cAAuB,YAAY,cAAc,OAAO;EACtD;CAC3B,CAAC;CAEH,MAAM,gBAAgB,YAAiC,WACrD,WAAW,UACP,WAAW,KAAK,OAAO,UACvB,WAAW,gBACT,WAAW,KAAK,aAAa,UAC7B,KAAA;CAER,MAAM,cAAc,YAAiC,WACnD,WAAW,UACP,WAAW,KAAK,OAAO,SACvB,WAAW,gBACT,WAAW,KAAK,aAAa,SAC7B,KAAA;CAER,MAAM,YAAY,kBAChB,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,MAAM,SAAS,WAAW,YAAY,cAAc,MAAM;EAC1D,IAAI,WAAW,KAAA,GAAW;EAE1B,OAAO,OAAO,OADY,KAAK,aAAa,CACpB;CAC1B,CAAC;;CAGH,MAAM,UAAU,QAAQ,eAAe,mBAAmB,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;CAEtF,MAAM,WAAiC,iBACrC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,YAAY;EAC9D,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,MAAM,YAAY,aAAa,YAAY,cAAc,MAAM;EAC/D,MAAM,SAAS,KAAyB,QACtC,IAAI,cAAc,QAClB,SAAS,cAAc,IAAI,SAAS,IAAI,SAAS,cAAc,GAAG,KAChE,OAAO;EACX,MAAM,WAAW,KAAyB,QACxC,IAAI,cAAc,QAClB,SAAS,cAAc,IAAI,SAAS,KAAK,SAAS,cAAc,GAAG;EACrE,MAAM,UAAU,OAAO,QAAQ,eAAe,WAAW,cAAc,EAAE;EACzE,MAAM,MAAM,OAAO,SAAS;EAC5B,IAAI,CAAC,MAAM,SAAS,GAAG,GAAG,OAAO;EACjC,IAAI,cAAc,KAAA,GAChB,OAAO,QAAQ,SAAS,GAAG,IAAK,cAAyB;EAC3D,OAAO,OAAO,QACX,SACC,WAAW,cAAc,MACzB,OAAO,IAAI,aAAa;GAGtB,MAAM,OAAO,OAAO,QAAQ,eAAe,IAAI,cAAc,EAAE,CAAC,CAAC,KAC/D,OAAO,IAAI,OAAO,IAAI,GACtB,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,kBAC3B,OAAO,QAAQ,OAAO,KAA4B,CAAC,CAC3D,CACF;GACA,IAAI,OAAO,OAAO,IAAI,KAAK,KAAK,MAAM,eAAe,UACnD,OAAO;GAET,MAAM,SAAS,OAAO,QAAQ,eAAe,WAAW,cAAc,EAAE;GACxE,IAAI,CAAC,MAAM,QAAQ,OAAO,SAAS,GAAG,GAAG,OAAO;GAChD,MAAM,SAAS,OAAO,QAAQ,KAAK,OAAO,UAAU;GACpD,MAAM,UAAU,OAAOA,cAAuB,YAAY,KAAK,MAAM,OAAO;GAC5E,MAAM,SAAS,OAAO,UAAU;IAAE;IAAQ;GAAQ,CAAC;GAGnD,OAAO,QAAQ,eACZ,OAAO,cAAc,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAC7C,KACC,OAAO,UAAU,UACf,MAAM,OAAO,SAAS,cACjB,WAAW,YAAY,cAAc,MAAM,CAAC,GAAG,MAAM,KAAK,OAAO,KAAA,CAAM,KACtE,OAAO,MACT,IACA,OAAO,IACb,CACF;GACF,OAAO;EACT,CAAC,CACH,CAAC,CACA,KACC,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,UAAU,CAAC,QAAQ,SAAS,GAAG,SAC1D,OAAO,QAAQ,SAAkB,CACzC,GACA,OAAO,SACJ,UAAU,MAAM,OAAO,SAAS,yBAC3B,OAAO,QAAQ,WAAoB,CAC3C,CACF;CACJ,CAAC;CAEH,MAAM,cAAc,eAClB,OAAO,IAAI,aAAa;EACtB,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,MAAM,YAAYP,KAChB,IAAIQ,UAAiB;GACnB,UAAU,cAAc;GACxB,cAAc,WAAW;EAC3B,CAAC,CACH;EACA,IAAI,cAAc,eAAe,UAAU,OAAO,OAAO;EACzD,KAAK,OAAO,QAAQ,WAAW,EAAE,OAAO,aAAa,OAAO,OAAO;EAEnE,QAAO,OADmB,UAAU,IAAI,cAAc,QAAQ,EAAA,CAC5C,QAAQ,OAAO,KAAK,aAAa,CAAC;CACtD,CAAC;CAEH,MAAM,eAAe,UAMnB,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,OAAOC;EACzB,MAAM,UAAU,MAAM,WAAW,QAAQ,MAAM,MAAM;EACrD,MAAM,OAAO,OAAO,QAAQ,aAAa;EACzC,MAAM,UAAU,MAAM,qBAAqB,QAAQ,eAAe,CAAC,KAAK,SAAS,UAAU,CAAC;EAC5F,IAAI,QAAQ,SAAS,GACnB,OAAO,OAAOT,KACZ,IAAIU,UAAiB,EACnB,SAAS,GAAG,MAAM,WAAW,KAAK,oBAAoB,QAAQ,KAAK,IAAI,IACzE,CAAC,CACH;EAEF,MAAM,gBAAgB,IAAIC,cAAsB;GAC9C,IAAI,OAAO,MAAM,MAAM;GACvB,SAAS,UAAU;GACnB,UAAU,MAAM,WAAW;GAC3B,QAAQ,MAAM;GACd,cAAc;GACd,SAAS,OAAOC,cAAuB,MAAM,YAAY,MAAM,OAAO,OAAO;GAC7E,YAAY;GACZ,WAAW,UAAU;GACrB,WAAW,OAAO,SAAS;EAC7B,CAAC;EACD,OAAO,QAAQ,eAAe,OAAO;GACnC;GACA,YAAY,OAAO,KAAK,MAAM,MAAM;EACtC,CAAC;EAED,OAAO;GAAE,YAAA,OADiB,QAAQ,YAAY,OAAO,cAAc,EAAE;GAChD;EAAQ;CAC/B,CAAC;CAEH,MAAM,cAAc,UAOlB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAOC,OAAkB,MAAM,MAAM;EACpD,MAAM,WAAW,OAAO,QAAQ,YAAY,SAAS,MAAM;EAC3D,IAAI,OAAO,OAAO,QAAQ,GAAG;GAC3B,IAAI,SAAS,MAAM,iBAAiB,MAAM,WAAW,IAAI,OAAO,SAAS;GACzE,OAAO,OAAO,QAAQ,GAAG,OAAO,6CAA6C,QAAQ;EACvF;EACA,MAAM,aACJ,MAAM,WAAW,KAAA,IACb,OAAO,MAAM,QAAQ,cAAc,MAAM,IAAA,WACrB,SAAS,EAAE,QAAQ,MAAM,OAAO,CAAC;EAC3D,QAAQ,WAAW,MAAnB;GACE,KAAK,qBACH,OAAO,UAAU,kBAAkB,EAAE,YAAY,WAAW,WAAW,CAAC;GAC1E,KAAK,YACH,OAAO,OAAOb,KAAY,IAAIc,SAAgB;IAAE,QAAQ;IAAQ,IAAI;GAAO,CAAC,CAAC;GAC/E,KAAK,YACH,OAAO,OAAO,QAAQ,YAAY,OAAO;IACvC,cAAc,MAAM,WAAW;IAC/B;IACA,MAAM,WAAW,OAAO;IACxB,QAAQ;KACN,GAAG,WAAW;KACd,SAAS,OAAOF,cAAuB,MAAM,YAAY,WAAW,OAAO,OAAO;IACpF;GACF,CAAC;EACL;CACF,CAAC;CAEH,MAAM,WAAW,YAAgC,aAC/C,aAAa,OACT,QAAQ,UAAU;EAAE;EAAY,YAAY;CAAK,CAAC,IAClD,oBAAoBG,aAClB,QAAQ,UAAU;EAAE;EAAY,YAAY;CAAS,CAAC,IACtD,QAAQ,kBAAkB;EAAE;EAAY,YAAY,SAAS;CAAW,CAAC;;CAGjF,MAAM,iBAAiB,eACrB,OAAO,IAAI,aAAa;EACtB,KAAK,MAAM,QAAQ,YAAY;GAE7B,MAAM,SAAQ,OADU,SAAS,QAAQ,MAAM,IAAI,EAAA,CAC5B,SAAS,YAC9B,QAAQ,SAAS,aACb,QAAQ,OAAO,QAAQ,SAAS,WAC9B,OAAO,SAAS,OAAO,CAAC,OAAO,UAAU,IAAI,CAAC,CAChD,IACA,CAAC,CACP;GACA,IAAI,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK;EACxD;EACA,OAAO,CAAC;CACV,CAAC;CAEH,MAAM,YAAmC,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAOF,OAAkB,KAAK;EAC7C,MAAMG,eAAaC,WAAsB,MAAM;EAC/C,MAAM,cAAc,OAAO,cAAcD,YAAU;EACnD,MAAM,YAGD,CAAC;EACN,KAAK,MAAM,cAAc,OAAO,QAAQ,YAAY,KAAK,GAAG;GAC1D,MAAM,UAAU,OAAO,WAAW,UAAU,CAAC,CAAC,KAC5C,OAAO,SAAS,YAAY,QAAQ,YAAY,CAAC,GACjD,OAAO,YAAY,OAAO,QAAQ,CAAC,CAAmC,CAAC,CACzE;GACA,KAAK,MAAM,UAAU,SACnB,IAAIA,aAAW,SAAS,OAAO,IAAwB,GACrD,UAAU,KAAK;IAAE,cAAc,WAAW;IAAI;GAAO,CAAC;EAG5D;EACA,MAAM,aAAa,SAAiB,KAAK,YAAY,CAAC,CAAC,QAAQ,OAAO,EAAE;EACxE,KAAK,MAAM,QAAQA,cAAY;GAC7B,MAAM,UAAU,UACb,QAAQ,EAAE,aAAa,OAAO,SAAS,IAAI,CAAC,CAC5C,MAAM,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;GAC5E,IAAI,QAAQ,WAAW,GAAG;GAC1B,MAAM,CAAC,QAAQ;GACf,IAAI,QAAQ,WAAW,KAAK,SAAS,KAAA,GAAW,OAAO,UAAU,SAAS,IAAI;GAC9E,MAAM,WAAW,QAAQ,QAAQ,EAAE,aAAa;IAC9C,MAAM,aAAa,IAAI,KAAK,OAAO,eAAe,CAAC,EAAA,CAAG,IAAI,SAAS,CAAC;IACpE,OAAO,YAAY,SAAS,KAAK,YAAY,OAAO,SAAS,WAAW,IAAI,IAAI,CAAC;GACnF,CAAC;GACD,MAAM,CAAC,UAAU;GACjB,IAAI,SAAS,WAAW,KAAK,WAAW,KAAA,GAAW,OAAO,UAAU,SAAS,MAAM;GACnF,OAAO,UAAU,kBAAkB,EAAE,YAAY,QAAQ,CAAC;EAC5D;EACA,OAAO,UAAU,SAAS,EAAE,YAAY,CAAC;CAC3C,CAAC;CAEH,MAAM,WAAiC,UACrC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAOH,OAAkB,KAAK;EAC7C,MAAM,SAAS,OAAO;EACtB,MAAM,aAAa,OAAO,UAAU,OAAO,QAAQ,YAAY,SAAS,MAAM,CAAC;EAC/E,MAAM,aACJ,eAAe,OAAO,OAAO,OAAO,QAAQ,YAAY,IAAI,WAAW,YAAY;EACrF,MAAM,gBACJ,eAAe,OAAO,OAAO,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAC3F,MAAM,SACJ,eAAe,OACX,OAAO,KAAK,IACZ,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI,cAAc;EAClE,MAAM,WAAgD,CAAC;EACvD,KAAK,MAAM,aAAa,OAAO,QAAQ,YAAY,KAAK,GAAG;GACzD,IAAI,UAAU,OAAO,YAAY,IAAI;GACrC,IAAI,EAAE,OAAO,OAAO,WAAW;IAAE,YAAY;IAAW;GAAO,CAAC,IAAI;GACpE,MAAM,yBAAyB,OAAO,QAAQ,eAAe,IAAI,UAAU,eAAe;GAC1F,IAAI,uBAAuB,eAAe,UAAU;GACpD,SAAS,KAAK;IACZ,YAAY;IACZ,UAAU,uBAAuB;IACjC,QAAQ,uBAAuB;GACjC,CAAC;EACH;EACA,OAAO;GACL;GACA;GACA;GACA,eACE,kBAAkB,OACd,OACA;IACE,IAAI,cAAc;IAClB,UAAU,cAAc;IACxB,QAAQ,cAAc;IACtB,cAAc,cAAc;IAC5B,YAAY,cAAc;GAC5B;GACN,eAAe,OAAO,OAAO,MAAM,IAAK,OAAO,MAAM,SAAS,MAAM,OAAQ;GAC5E;GACA,WAAW,UAAU,KAAK,CAAC,CAAC,KAAK,gBAAgB;IAC/C,IAAI,WAAW;IACf,MAAM,WAAW;IACjB,SAASK,gBAAyB,UAAU;GAC9C,EAAE;EACJ;CACF,CAAC;CAEH,MAAM,SAA6B,UACjC,OAAO,IAAI,aAAa;EACtB,OAAO;EACP,MAAM,YAAY,OAAOT;EACzB,MAAM,SAAS,OAAO;EACtB,MAAM,aAAa,OAAO,UAAU,IAAI,MAAM,QAAQ;EACtD,IAAI,MAAM,WAAW,KAAA,GAAW,OAAOI,OAAkB,MAAM,MAAM;EACrE,QAAQ,MAAM,OAAO,MAArB;GACE,KAAK,SAAS;IACZ,MAAM,QAAQ,WAAW,KAAK;IAC9B,IAAI,UAAU,KAAA,GACZ,OAAO,OAAO,QAAQ,GAAG,WAAW,KAAK,0BAA0B,QAAQ;IAE7E,MAAM,SAAS,OAAO,MAAM,aAAa,MAAM,OAAO,MAAM;IAC5D,MAAM,EAAE,YAAY,YAAY,OAAO,YAAY;KACjD;KACA,QAAQ;KACR;KACA,sBAAsB,MAAM;IAC9B,CAAC;IACD,MAAM,WACJ,MAAM,WAAW,KAAA,IACb,OACA,OAAO,WAAW;KAAE;KAAY;KAAY;KAAS,QAAQ,MAAM;IAAO,CAAC;IACjF,OAAO,QAAQ,YAAY,QAAQ;GACrC;GACA,KAAK;GACL,KAAK,eAAe;IAClB,MAAM,cACJ,MAAM,OAAO,SAAS,UAAU,WAAW,KAAK,QAAQ,WAAW,KAAK;IAC1E,IAAI,gBAAgB,KAAA,GAClB,OAAO,OAAO,QACZ,GAAG,WAAW,KAAK,kBAAkB,MAAM,OAAO,KAAK,YAAY,EAAE,eACrE,QACF;IAEF,IAAI,MAAM,gBAAgB,KAAA,GACxB,OAAO,OAAO,QAAQ,8CAA8C,aAAa;IAEnF,MAAM,iBAAiB,OAAO,MAAM,MAAM;IAC1C,MAAMM,SAAO,MAAM,OAAO,SAAS,UAAU,OAAOC,KAAW,IAAI;IACnE,MAAM,WACJ,MAAM,OAAO,SAAS,UAClB,OAAQ,YAAmC,MAAM;KAC/C,OAAO;KACP,aAAa,MAAM;KACnB,eAAeD,QAAM,iBAAiB;IACxC,CAAC,IACD,OAAQ,YAAyC,MAAM;KACrD,OAAO;KACP,aAAa,MAAM;IACrB,CAAC;IACP,OAAO,QAAQ,cAAc,IAC3B,IAAIE,aAAqB;KACvB,IAAI;KACJ,SAAS,UAAU;KACnB,SAAS,UAAU;KACnB,UAAU,WAAW;KACrB,SAAS,OAAO,WAAW,OAAO,CAAC,CAAC;MAClC,QAAQ,MAAM,OAAO,SAAS,UAAU,UAAU;MAClD,cAAcF,QAAM,gBAAgB;MACpC,aAAa,MAAM;MACnB,QAAQ,MAAM,UAAU;KAC1B,CAAC;KACD,UAAU,MAAM,OAAO,YAAY;KACnC,WAAW,SAAS,YAClB,OAAO,SAAS,KAChB,SAAS,OAAO,OAAO,iBAAiB,CAC1C;IACF,CAAC,CACH;IACA,OAAO,QAAQ,SAAS;KACtB,kBAAkB,SAAS;KAC3B;IACF,CAAC;GACH;EACF;CACF,CAAC;CAEH,MAAM,YAAmC,UACvC,OAAO,IAAI,aAAa;EAMtB,MAAM,WAAW,OAAO,OAAO,IAAI;GACjC,WAAW,IAAI,IAAI,MAAM,WAAW;GACpC,aACE,IAAIG,eAAsB,EACxB,QAAQ,IAAIrB,aAAoB;IAC9B,SAAS;IACT,OAAO;GACT,CAAC,EACH,CAAC;EACL,CAAC;EACD,MAAM,SAAS,OAAO,YAAY,SAAS,YAAY;EACvD,MAAM,mBAAmB,YACvBD,KAAY,IAAIuB,gBAAuB,EAAE,QAAQ,CAAC,CAAC;EACrD,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,OAAO,gBAAgB,qBAAqB,OAAO,OAAO;EAEnE,IAAI,OAAO,UAAU,MAAM,gBACzB,OAAO,OAAO,gBAAgB,gDAAgD;EAEhF,MAAM,OAAO,OAAO;EACpB,IAAI,SAAS,KAAA,GAAW,OAAO,OAAO,gBAAgB,sBAAsB;EAC5E,OAAO,OAAO,QAAQ,SACpB,gBAAgB,MAAM,kBACtB,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,OAAO,QAAQ,cAAc,IAAI,MAAM,cAAc;GAC1E,MAAM,UAAU,OAAOC,SAAc,SAAS,aAAa,SAAS,cAAc;GAClF,MAAM,aAAa,OAAO,UAAU,IAAI,aAAa,QAAQ;GAC7D,MAAM,SACJ,QAAQ,WAAW,UACf,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,QAAQ,WAAW,KAAK;IAC9B,IAAI,UAAU,KAAA,KAAa,QAAQ,iBAAiB,MAClD,OAAO,OAAO,QACZ,GAAG,WAAW,KAAK,oCACnB,QACF;IAEF,OAAO,OAAO,MAAM,SAAS;KAC3B;KACA,aAAa,QAAQ;KACrB,cAAc,QAAQ;KACtB;IACF,CAAC;GACH,CAAC,IACD,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,cAAc,WAAW,KAAK;IACpC,IAAI,gBAAgB,KAAA,GAClB,OAAO,OAAO,QACZ,GAAG,WAAW,KAAK,0CACnB,QACF;IAEF,OAAO,OAAO,YAAY,SAAS;KACjC;KACA,aAAa,QAAQ;KACrB;IACF,CAAC;GACH,CAAC;GACP,MAAM,EAAE,YAAY,YAAY,OAAO,YAAY;IACjD;IACA,QAAQ,QAAQ;IAChB;IACA,sBAAsB,CAAC;GACzB,CAAC;GACD,MAAM,WACJ,QAAQ,WAAW,OACf,OACA,OAAO,WAAW;IAAE;IAAY;IAAY;IAAS,QAAQ,QAAQ;GAAO,CAAC;GAKnF,OAAO,QAAQ,cAAc,QAAQ,MAAM,cAAc,CAAC,CAAC,KAAK,OAAO,MAAM;GAC7E,OAAO,QAAQ,YAAY,QAAQ;EACrC,CAAC,CACH;CACF,CAAC;CAEH,MAAM,UAA+B,UACnC,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,MAAM,YAAY;EACpE,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,MAAM,UAAU,OAAO,WAAW,UAAU;EAC5C,OAAO,OAAO,WAAW;GACvB;GACA;GACA;GACA,QAAQ,MAAM;GACd,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;EAC/D,CAAC;CACH,CAAC;CAEH,MAAM,cAAuC,iBAC3C,OAAO,IAAI,aAAa;EACtB,OAAO;EACP,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,YAAY;EAC9D,MAAM,cAAc,OAAO,QAAQ,YAAY,KAAK,YAAY;EAChE,OAAO,OAAO,QAAQ,cAAc,eAAe,QAAQ,YAAY,OAAO,WAAW,EAAE,CAAC;EAC5F,OAAO,QAAQ,YAAY,OAAO,YAAY;EAI9C,KAHmB,OAAO,QAAQ,YAAY,KAAK,EAAA,CAAG,MACnD,cAAc,UAAU,oBAAoB,WAAW,eAE9C,GAAG;EACf,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,OAAO,QAAQ,eAAe,OAAO,cAAc,IAAI,SAAS,aAAa,CAAC;CAChF,CAAC;CAEH,MAAM,WAAiC,iBACrC,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,YAAY;EAC9D,MAAM,aAAa,OAAO,QAAQ,YAAY,IAAI,WAAW,YAAY;EACzE,MAAM,gBAAgB,OAAO,QAAQ,eAAe,IAAI,WAAW,eAAe;EAClF,MAAM,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ;EAC9D,MAAM,SAAS,OAAOA,SAAc,QAAQ,WAAW,QAAQ,QAAQ;EACvE,MAAM,SAA0B;GAC9B,GAAG;GACH,SAAS,OAAOjB,cAAuB,YAAY,OAAO,OAAO;EACnE;EACA,MAAM,QAAQ,OAAO,WAAW,UAAU;EAI1C,IAAI,EAAC,OADoB,MAAM,YAAY,EAAA,CAC5B,MAAM,cAAc,UAAU,SAAS,OAAO,IAAI,GAC/D,OAAO,OAAOP,KAAY,IAAIc,SAAgB;GAAE,QAAQ;GAAQ,IAAI,OAAO;EAAK,CAAC,CAAC;EAEpF,OAAO;GAAE,SAAS;GAAO;EAAO;CAClC,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA,SAAS,iBAAiB,QAAQ,YAAY,OAAO,YAAY;EACjE;EACA;EACA;CACF;AACF,CAAC;AAED,MAAa,QAIT,MAAM,OAAO,OAAO,CAAC,CAAC,IAAI;AAE9B,MAAM,YAEF,UAED,GAAG,SACF,OAAO,QAAQ,UAAU,YAAY,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;AAE/D,MAAa,UAAU,UAAU,YAAY,QAAQ,OAAO;AAC5D,MAAa,WAAW,UAAU,YAAY,QAAQ,QAAQ;AAC9D,MAAa,QAAQ,UAAU,YAAY,QAAQ,KAAK;AACxD,MAAa,WAAW,UAAU,YAAY,QAAQ,QAAQ;AAC9D,MAAa,SAAS,UAAU,YAAY,QAAQ,MAAM;AAC1D,MAAa,SAAS,UAAU,YAAY,QAAQ,MAAM;AAC1D,MAAa,aAAa,UAAU,YAAY,QAAQ,UAAU;AAClE,MAAa,UAAU,UAAU,YAAY,QAAQ,OAAO;AAC5D,MAAa,UAAU,UAAU,YAAY,QAAQ,OAAO"}

package/dist/Custody.mjs

@@ -0,0 +1,64 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { CryptoFailed, InvalidInput } from "./Reason.mjs";
+import { DomainKitError, fail, isDomainKitError } from "./internal/error.mjs";
+import { decodeKey, generateKey as generateKey$1, importKey, open, seal } from "./internal/aes.mjs";
+import { Config, Context, Effect, Layer, Redacted } from "effect";
+//#region src/Custody.ts
+/**
+* Seals provider credentials before Storage writes them. The default is AES-256-GCM through
+* WebCrypto from one configured key; hosts with a KMS provide their own. There is no plaintext
+* mode.
+*
+* Envelope format: `v1.<iv>.<ciphertext>` with base64url segments and a 12-byte IV. Rotating
+* the key requires re-sealing stored credentials; `open` fails with `CryptoFailed` on a mismatch.
+*/
+var Custody_exports = /* @__PURE__ */ __exportAll({
+	Service: () => Service,
+	fromAsync: () => fromAsync,
+	generateKey: () => generateKey,
+	layer: () => layer,
+	layerConfig: () => layerConfig,
+	layerFromAsync: () => layerFromAsync,
+	make: () => make
+});
+var Service = class extends Context.Service()("@domainkit/Custody") {};
+const make = (options) => Effect.gen(function* () {
+	const raw = decodeKey(Redacted.value(options.key));
+	if (raw === null) return yield* fail(new InvalidInput({
+		message: "Custody key must be 32 bytes encoded as base64 or hex",
+		field: "key"
+	}));
+	const key = yield* importKey(raw);
+	return {
+		seal: (plaintext) => seal(key, plaintext),
+		open: (ciphertext) => open(key, ciphertext)
+	};
+});
+const layer = (options) => Layer.effect(Service)(make(options));
+/** Same options, each field a `Config`. Defaults to `DOMAINKIT_CUSTODY_KEY`. */
+const layerConfig = (options = {}) => Layer.effect(Service)(Effect.gen(function* () {
+	const key = yield* (options.key ?? Config.redacted("DOMAINKIT_CUSTODY_KEY")).pipe(Effect.mapError((cause) => new DomainKitError({ reason: new InvalidInput({
+		message: cause.message,
+		field: "key"
+	}) })));
+	return yield* make({ key });
+}));
+/** A fresh random key in the accepted encoding; for tests, playgrounds, and first-time setup. */
+const generateKey = generateKey$1;
+const cryptoFailed = (operation) => (cause) => isDomainKitError(cause) ? cause : new DomainKitError({ reason: new CryptoFailed({ operation }) });
+/** Wrap a Promise-shaped KMS client; rejections become `CryptoFailed`. */
+const fromAsync = (service) => ({
+	seal: (plaintext) => Effect.tryPromise({
+		try: () => service.seal(Redacted.value(plaintext)),
+		catch: cryptoFailed("seal")
+	}),
+	open: (ciphertext) => Effect.tryPromise({
+		try: () => service.open(ciphertext),
+		catch: cryptoFailed("open")
+	}).pipe(Effect.map((value) => Redacted.make(value)))
+});
+const layerFromAsync = (service) => Layer.succeed(Service)(fromAsync(service));
+//#endregion
+export { Custody_exports, Service, fromAsync, generateKey, layer, layerConfig, layerFromAsync, make };
+
+//# sourceMappingURL=Custody.mjs.map

package/dist/Custody.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Custody.mjs","names":["Aes.decodeKey","Errors.fail","Reason.InvalidInput","Aes.importKey","Aes.seal","Aes.open","Errors.DomainKitError","Aes.generateKey","Errors.isDomainKitError","Reason.CryptoFailed"],"sources":["../src/Custody.ts"],"sourcesContent":["/**\n * Seals provider credentials before Storage writes them. The default is AES-256-GCM through\n * WebCrypto from one configured key; hosts with a KMS provide their own. There is no plaintext\n * mode.\n *\n * Envelope format: `v1.<iv>.<ciphertext>` with base64url segments and a 12-byte IV. Rotating\n * the key requires re-sealing stored credentials; `open` fails with `CryptoFailed` on a mismatch.\n */\nimport { Config, Context, Effect, Layer, Redacted } from \"effect\";\n\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as Aes from \"./internal/aes.ts\";\n\nexport interface Interface {\n  readonly seal: (\n    plaintext: Redacted.Redacted<string>,\n  ) => Effect.Effect<string, Errors.DomainKitError>;\n  readonly open: (\n    ciphertext: string,\n  ) => Effect.Effect<Redacted.Redacted<string>, Errors.DomainKitError>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Custody\") {}\n\nexport interface Options {\n  /** 32 bytes, base64 or hex. Rotating it requires re-sealing stored credentials. */\n  readonly key: Redacted.Redacted<string>;\n}\n\nexport const make = (options: Options): Effect.Effect<Interface, Errors.DomainKitError> =>\n  Effect.gen(function* () {\n    const raw = Aes.decodeKey(Redacted.value(options.key));\n    if (raw === null) {\n      return yield* Errors.fail(\n        new Reason.InvalidInput({\n          message: \"Custody key must be 32 bytes encoded as base64 or hex\",\n          field: \"key\",\n        }),\n      );\n    }\n    const key = yield* Aes.importKey(raw);\n    return {\n      seal: (plaintext) => Aes.seal(key, plaintext),\n      open: (ciphertext) => Aes.open(key, ciphertext),\n    };\n  });\n\nexport const layer = (options: Options): Layer.Layer<Service, Errors.DomainKitError> =>\n  Layer.effect(Service)(make(options));\n\n/** Same options, each field a `Config`. Defaults to `DOMAINKIT_CUSTODY_KEY`. */\nexport const layerConfig = (\n  options: { readonly key?: Config.Config<Redacted.Redacted<string>> } = {},\n): Layer.Layer<Service, Errors.DomainKitError> =>\n  Layer.effect(Service)(\n    Effect.gen(function* () {\n      const key = yield* (options.key ?? Config.redacted(\"DOMAINKIT_CUSTODY_KEY\")).pipe(\n        Effect.mapError(\n          (cause) =>\n            new Errors.DomainKitError({\n              reason: new Reason.InvalidInput({ message: cause.message, field: \"key\" }),\n            }),\n        ),\n      );\n      return yield* make({ key });\n    }),\n  );\n\n/** A fresh random key in the accepted encoding; for tests, playgrounds, and first-time setup. */\nexport const generateKey = Aes.generateKey;\n\nexport interface AsyncInterface {\n  readonly seal: (plaintext: string) => Promise<string>;\n  readonly open: (ciphertext: string) => Promise<string>;\n}\n\nconst cryptoFailed = (operation: \"seal\" | \"open\") => (cause: unknown) =>\n  Errors.isDomainKitError(cause)\n    ? cause\n    : new Errors.DomainKitError({ reason: new Reason.CryptoFailed({ operation }) });\n\n/** Wrap a Promise-shaped KMS client; rejections become `CryptoFailed`. */\nexport const fromAsync = (service: AsyncInterface): Interface => ({\n  seal: (plaintext) =>\n    Effect.tryPromise({\n      try: () => service.seal(Redacted.value(plaintext)),\n      catch: cryptoFailed(\"seal\"),\n    }),\n  open: (ciphertext) =>\n    Effect.tryPromise({ try: () => service.open(ciphertext), catch: cryptoFailed(\"open\") }).pipe(\n      Effect.map((value) => Redacted.make(value)),\n    ),\n});\n\nexport const layerFromAsync = (service: AsyncInterface): Layer.Layer<Service> =>\n  Layer.succeed(Service)(fromAsync(service));\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAO1F,MAAa,QAAQ,YACnB,OAAO,IAAI,aAAa;CACtB,MAAM,MAAMA,UAAc,SAAS,MAAM,QAAQ,GAAG,CAAC;CACrD,IAAI,QAAQ,MACV,OAAO,OAAOC,KACZ,IAAIC,aAAoB;EACtB,SAAS;EACT,OAAO;CACT,CAAC,CACH;CAEF,MAAM,MAAM,OAAOC,UAAc,GAAG;CACpC,OAAO;EACL,OAAO,cAAcC,KAAS,KAAK,SAAS;EAC5C,OAAO,eAAeC,KAAS,KAAK,UAAU;CAChD;AACF,CAAC;AAEH,MAAa,SAAS,YACpB,MAAM,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC;;AAGrC,MAAa,eACX,UAAuE,CAAC,MAExE,MAAM,OAAO,OAAO,CAAC,CACnB,OAAO,IAAI,aAAa;CACtB,MAAM,MAAM,QAAQ,QAAQ,OAAO,OAAO,SAAS,uBAAuB,EAAA,CAAG,KAC3E,OAAO,UACJ,UACC,IAAIC,eAAsB,EACxB,QAAQ,IAAIJ,aAAoB;EAAE,SAAS,MAAM;EAAS,OAAO;CAAM,CAAC,EAC1E,CAAC,CACL,CACF;CACA,OAAO,OAAO,KAAK,EAAE,IAAI,CAAC;AAC5B,CAAC,CACH;;AAGF,MAAa,cAAcK;AAO3B,MAAM,gBAAgB,eAAgC,UACpDC,iBAAwB,KAAK,IACzB,QACA,IAAIF,eAAsB,EAAE,QAAQ,IAAIG,aAAoB,EAAE,UAAU,CAAC,EAAE,CAAC;;AAGlF,MAAa,aAAa,aAAwC;CAChE,OAAO,cACL,OAAO,WAAW;EAChB,WAAW,QAAQ,KAAK,SAAS,MAAM,SAAS,CAAC;EACjD,OAAO,aAAa,MAAM;CAC5B,CAAC;CACH,OAAO,eACL,OAAO,WAAW;EAAE,WAAW,QAAQ,KAAK,UAAU;EAAG,OAAO,aAAa,MAAM;CAAE,CAAC,CAAC,CAAC,KACtF,OAAO,KAAK,UAAU,SAAS,KAAK,KAAK,CAAC,CAC5C;AACJ;AAEA,MAAa,kBAAkB,YAC7B,MAAM,QAAQ,OAAO,CAAC,CAAC,UAAU,OAAO,CAAC"}