domainkit 0.8.0 → 0.9.1

package/dist/Resolver.mjs

@@ -0,0 +1,75 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { decode } from "./DomainName.mjs";
+import { InvalidInput } from "./Reason.mjs";
+import { fail } from "./internal/error.mjs";
+import { query } from "./internal/doh.mjs";
+import { Context, Data, Effect, Layer } from "effect";
+//#region src/Resolver.ts
+/**
+* Public DNS observation. The default layer fans out to Cloudflare and Google DNS-over-HTTPS and
+* keeps every answer, so verification can show "found at Cloudflare, missing at Google".
+*/
+var Resolver_exports = /* @__PURE__ */ __exportAll({
+	Outcome: () => Outcome,
+	Service: () => Service,
+	cloudflare: () => cloudflare,
+	defaults: () => defaults,
+	google: () => google,
+	layer: () => layer,
+	layerWith: () => layerWith,
+	make: () => make
+});
+const Outcome = Data.taggedEnum();
+var Service = class extends Context.Service()("@domainkit/Resolver") {};
+const cloudflare = {
+	name: "cloudflare",
+	url: "https://cloudflare-dns.com/dns-query"
+};
+const google = {
+	name: "google",
+	url: "https://dns.google/dns-query"
+};
+const defaults = {
+	endpoints: [cloudflare, google],
+	timeoutMs: 3e3
+};
+const make = (options = {}) => Effect.gen(function* () {
+	const endpoints = options.endpoints ?? defaults.endpoints;
+	const timeoutMs = options.timeoutMs ?? defaults.timeoutMs;
+	const fetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	for (const endpoint of endpoints) if (!URL.canParse(endpoint.url)) return yield* fail(new InvalidInput({
+		message: `Resolver ${endpoint.name} has an invalid URL`,
+		field: "endpoints"
+	}));
+	const one = (endpoint, name, type, signal) => query({
+		resolver: endpoint.name,
+		url: endpoint.url,
+		fetch,
+		name,
+		type,
+		signal
+	}).pipe(Effect.timeout(timeoutMs), Effect.match({
+		onSuccess: (answer) => Outcome.Answered({ answer: {
+			resolver: endpoint.name,
+			...answer
+		} }),
+		onFailure: (failure) => failure._tag === "TimeoutError" ? Outcome.TimedOut({ resolver: endpoint.name }) : Outcome.Failed({
+			resolver: endpoint.name,
+			message: failure.message
+		})
+	}));
+	return { resolve: (input, type, query) => decode(input).pipe(Effect.match({
+		onFailure: (failure) => endpoints.map((endpoint) => Outcome.Failed({
+			resolver: endpoint.name,
+			message: failure.message
+		})),
+		onSuccess: (name) => name
+	}), Effect.flatMap((name) => typeof name === "string" ? Effect.forEach(endpoints, (endpoint) => one(endpoint, name, type, query?.signal), { concurrency: "unbounded" }) : Effect.succeed(name))) };
+});
+/** Cloudflare + Google DoH, 3s timeout. */
+const layer = Layer.effect(Service)(make().pipe(Effect.orDie));
+const layerWith = (options) => Layer.effect(Service)(make(options));
+//#endregion
+export { Outcome, Resolver_exports, Service, cloudflare, defaults, google, layer, layerWith, make };
+
+//# sourceMappingURL=Resolver.mjs.map

package/dist/Resolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Resolver.mjs","names":["Errors.fail","Reason.InvalidInput","Doh.query","DomainName.decode"],"sources":["../src/Resolver.ts"],"sourcesContent":["/**\n * Public DNS observation. The default layer fans out to Cloudflare and Google DNS-over-HTTPS and\n * keeps every answer, so verification can show \"found at Cloudflare, missing at Google\".\n */\nimport { Context, Data, Effect, Layer } from \"effect\";\n\nimport type * as DnsRecord from \"./DnsRecord.ts\";\nimport * as Errors from \"./internal/error.ts\";\nimport * as Reason from \"./Reason.ts\";\nimport * as DomainName from \"./DomainName.ts\";\nimport * as Doh from \"./internal/doh.ts\";\nimport type { Fetch } from \"./internal/http.ts\";\n\nexport interface Answer {\n  readonly resolver: string;\n  readonly records: ReadonlyArray<DnsRecord.Observed>;\n  readonly negative: boolean;\n  readonly ttl: number | null;\n}\n\nexport type Outcome = Data.TaggedEnum<{\n  Answered: { readonly answer: Answer };\n  Failed: { readonly resolver: string; readonly message: string };\n  TimedOut: { readonly resolver: string };\n}>;\nexport const Outcome = Data.taggedEnum<Outcome>();\n\nexport interface Interface {\n  /** Never fails: each resolver's outcome is preserved. */\n  readonly resolve: (\n    name: string,\n    type: DnsRecord.Type,\n    options?: { readonly signal?: AbortSignal | undefined },\n  ) => Effect.Effect<ReadonlyArray<Outcome>>;\n}\n\nexport class Service extends Context.Service<Service, Interface>()(\"@domainkit/Resolver\") {}\n\nexport interface Endpoint {\n  readonly name: string;\n  readonly url: string;\n}\n\nexport interface Options {\n  readonly endpoints?: ReadonlyArray<Endpoint>;\n  readonly timeoutMs?: number;\n  readonly fetch?: Fetch;\n}\n\nexport const cloudflare: Endpoint = {\n  name: \"cloudflare\",\n  url: \"https://cloudflare-dns.com/dns-query\",\n};\nexport const google: Endpoint = { name: \"google\", url: \"https://dns.google/dns-query\" };\n\nexport const defaults = { endpoints: [cloudflare, google], timeoutMs: 3_000 } as const;\n\nexport const make = (options: Options = {}): Effect.Effect<Interface, Errors.DomainKitError> =>\n  Effect.gen(function* () {\n    const endpoints = options.endpoints ?? defaults.endpoints;\n    const timeoutMs = options.timeoutMs ?? defaults.timeoutMs;\n    // See Transport.fromFetch: resolved at call time, never invoked as a method.\n    const fetch: Fetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));\n    for (const endpoint of endpoints) {\n      if (!URL.canParse(endpoint.url)) {\n        return yield* Errors.fail(\n          new Reason.InvalidInput({\n            message: `Resolver ${endpoint.name} has an invalid URL`,\n            field: \"endpoints\",\n          }),\n        );\n      }\n    }\n    const one = (\n      endpoint: Endpoint,\n      name: DomainName.Model,\n      type: DnsRecord.Type,\n      signal: AbortSignal | undefined,\n    ) =>\n      Doh.query({ resolver: endpoint.name, url: endpoint.url, fetch, name, type, signal }).pipe(\n        Effect.timeout(timeoutMs),\n        Effect.match({\n          onSuccess: (answer): Outcome =>\n            Outcome.Answered({ answer: { resolver: endpoint.name, ...answer } }),\n          onFailure: (failure): Outcome =>\n            failure._tag === \"TimeoutError\"\n              ? Outcome.TimedOut({ resolver: endpoint.name })\n              : Outcome.Failed({ resolver: endpoint.name, message: failure.message }),\n        }),\n      );\n    return {\n      resolve: (input, type, query) =>\n        DomainName.decode(input).pipe(\n          Effect.match({\n            onFailure: (failure): ReadonlyArray<Outcome> =>\n              endpoints.map((endpoint) =>\n                Outcome.Failed({ resolver: endpoint.name, message: failure.message }),\n              ),\n            onSuccess: (name) => name,\n          }),\n          Effect.flatMap((name) =>\n            typeof name === \"string\"\n              ? Effect.forEach(endpoints, (endpoint) => one(endpoint, name, type, query?.signal), {\n                  concurrency: \"unbounded\",\n                })\n              : Effect.succeed(name),\n          ),\n        ),\n    };\n  });\n\n/** Cloudflare + Google DoH, 3s timeout. */\nexport const layer: Layer.Layer<Service> = Layer.effect(Service)(make().pipe(Effect.orDie));\n\nexport const layerWith = (options: Options): Layer.Layer<Service, Errors.DomainKitError> =>\n  Layer.effect(Service)(make(options));\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,UAAU,KAAK,WAAoB;AAWhD,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAa3F,MAAa,aAAuB;CAClC,MAAM;CACN,KAAK;AACP;AACA,MAAa,SAAmB;CAAE,MAAM;CAAU,KAAK;AAA+B;AAEtF,MAAa,WAAW;CAAE,WAAW,CAAC,YAAY,MAAM;CAAG,WAAW;AAAM;AAE5E,MAAa,QAAQ,UAAmB,CAAC,MACvC,OAAO,IAAI,aAAa;CACtB,MAAM,YAAY,QAAQ,aAAa,SAAS;CAChD,MAAM,YAAY,QAAQ,aAAa,SAAS;CAEhD,MAAM,QAAe,QAAQ,WAAW,OAAO,SAAS,WAAW,MAAM,OAAO,IAAI;CACpF,KAAK,MAAM,YAAY,WACrB,IAAI,CAAC,IAAI,SAAS,SAAS,GAAG,GAC5B,OAAO,OAAOA,KACZ,IAAIC,aAAoB;EACtB,SAAS,YAAY,SAAS,KAAK;EACnC,OAAO;CACT,CAAC,CACH;CAGJ,MAAM,OACJ,UACA,MACA,MACA,WAEAC,MAAU;EAAE,UAAU,SAAS;EAAM,KAAK,SAAS;EAAK;EAAO;EAAM;EAAM;CAAO,CAAC,CAAC,CAAC,KACnF,OAAO,QAAQ,SAAS,GACxB,OAAO,MAAM;EACX,YAAY,WACV,QAAQ,SAAS,EAAE,QAAQ;GAAE,UAAU,SAAS;GAAM,GAAG;EAAO,EAAE,CAAC;EACrE,YAAY,YACV,QAAQ,SAAS,iBACb,QAAQ,SAAS,EAAE,UAAU,SAAS,KAAK,CAAC,IAC5C,QAAQ,OAAO;GAAE,UAAU,SAAS;GAAM,SAAS,QAAQ;EAAQ,CAAC;CAC5E,CAAC,CACH;CACF,OAAO,EACL,UAAU,OAAO,MAAM,UACrBC,OAAkB,KAAK,CAAC,CAAC,KACvB,OAAO,MAAM;EACX,YAAY,YACV,UAAU,KAAK,aACb,QAAQ,OAAO;GAAE,UAAU,SAAS;GAAM,SAAS,QAAQ;EAAQ,CAAC,CACtE;EACF,YAAY,SAAS;CACvB,CAAC,GACD,OAAO,SAAS,SACd,OAAO,SAAS,WACZ,OAAO,QAAQ,YAAY,aAAa,IAAI,UAAU,MAAM,MAAM,OAAO,MAAM,GAAG,EAChF,aAAa,YACf,CAAC,IACD,OAAO,QAAQ,IAAI,CACzB,CACF,EACJ;AACF,CAAC;;AAGH,MAAa,QAA8B,MAAM,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,CAAC;AAE1F,MAAa,aAAa,YACxB,MAAM,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC"}

package/dist/Server.mjs

@@ -0,0 +1,516 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { Model } from "./DnsRecord.mjs";
+import { Model as Model$1, OperationId, PlanId } from "./Plan.mjs";
+import { InvalidInput, NotFound } from "./Reason.mjs";
+import { DomainKitError, fail } from "./internal/error.mjs";
+import { ApprovalId, Model as Model$2 } from "./Approval.mjs";
+import { Service } from "./Principal.mjs";
+import { Model as Model$3, ReceiptId } from "./Receipt.mjs";
+import { AttemptStatus, AuthMethod, Overall, Rejection, RequirementStatus, Service as Service$1 } from "./Storage.mjs";
+import { Method as Method$1, Service as Service$2 } from "./Connect.mjs";
+import { Service as Service$3 } from "./Provision.mjs";
+import { Service as Service$4 } from "./Cleanup.mjs";
+import { Evidence, HostEvidence, Service as Service$5 } from "./Verify.mjs";
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpServer from "effect/unstable/http/HttpServer";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import * as HttpApiSchema from "effect/unstable/httpapi/HttpApiSchema";
+//#region src/Server.ts
+/**
+* domainkit/server — the whole lifecycle as one HttpApi group the host mounts.
+*
+*   const Api = HttpApi.make("app").add(Server.group)
+*   const ApiLive = HttpApiBuilder.layer(Api).pipe(
+*     Layer.provide([Server.layer(Api), DomainKitLive, IdentityLive]),
+*   )
+*
+* The host provides `Identity` (request -> `Principal.Interface`). Everything else comes from
+* `DomainKit.layer`. Non-HttpApi hosts use `toWebHandler`. The group carries no prefix of its
+* own, so `group.prefix("/internal/dns")` or a host router mount is all a different base path
+* takes; callback URLs follow the mount.
+*/
+var Server_exports = /* @__PURE__ */ __exportAll({
+	ApprovePayload: () => ApprovePayload,
+	AttachPayload: () => AttachPayload,
+	Attempt: () => Attempt,
+	Candidate: () => Candidate,
+	Connected: () => Connected,
+	ConnectionStatus: () => ConnectionStatus,
+	Discovery: () => Discovery,
+	DiscoveryNotFound: () => DiscoveryNotFound,
+	DiscoveryResolved: () => DiscoveryResolved,
+	DiscoverySelectionRequired: () => DiscoverySelectionRequired,
+	Field: () => Field,
+	Identity: () => Identity,
+	Integration: () => Integration,
+	Method: () => Method,
+	MethodDescriptor: () => MethodDescriptor,
+	OAuth: () => OAuth,
+	ObservePayload: () => ObservePayload,
+	PlanPayload: () => PlanPayload,
+	Readiness: () => Readiness,
+	Redirect: () => Redirect,
+	RejectPayload: () => RejectPayload,
+	SelectionRequired: () => SelectionRequired,
+	Snapshot: () => Snapshot,
+	StartPayload: () => StartPayload,
+	Started: () => Started,
+	Token: () => Token,
+	api: () => api,
+	group: () => group,
+	layer: () => layer,
+	toWebHandler: () => toWebHandler
+});
+var Identity = class extends Context.Service()("@domainkit/server/Identity") {};
+const ConnectionStatus = Schema.Literals([
+	"disconnected",
+	"connected",
+	"reconnect"
+]);
+/** One value a token method needs, so a form renders without knowing the provider. */
+const Field = Schema.Struct({
+	name: Schema.String,
+	required: Schema.Boolean,
+	secret: Schema.Boolean
+});
+/** How a provider can be connected; `fields` is `null` for the interactive methods. */
+const MethodDescriptor = Schema.Struct({
+	kind: AuthMethod,
+	label: Schema.String,
+	docsUrl: Schema.NullOr(Schema.String),
+	fields: Schema.NullOr(Schema.Array(Field))
+});
+/** Everything the UI needs about a domain, flattened; provider context never crosses the wire. */
+const Snapshot = Schema.Struct({
+	domain: Schema.String,
+	attachmentId: Schema.NullOr(Schema.String),
+	connectionId: Schema.NullOr(Schema.String),
+	provider: Schema.NullOr(Schema.String),
+	method: Schema.NullOr(AuthMethod),
+	status: ConnectionStatus,
+	lastReceiptId: Schema.NullOr(Schema.String),
+	reusable: Schema.Array(Schema.Struct({
+		connectionId: Schema.String,
+		provider: Schema.String,
+		method: AuthMethod
+	})),
+	providers: Schema.Array(Schema.Struct({
+		id: Schema.String,
+		name: Schema.String,
+		methods: Schema.Array(MethodDescriptor)
+	}))
+});
+/**
+* How the client asks to connect. `values` is keyed by the provider's declared token fields, as
+* `Snapshot.providers[].methods[].fields` names them. Secrets are plaintext in transit and never
+* come back out.
+*/
+var Token = class extends Schema.TaggedClass("@domainkit/server/Method/Token")("Token", { values: Schema.Record(Schema.String, Schema.String) }) {};
+var OAuth = class extends Schema.TaggedClass("@domainkit/server/Method/OAuth")("OAuth", { returnTo: Schema.optionalKey(Schema.String) }) {};
+var Integration = class extends Schema.TaggedClass("@domainkit/server/Method/Integration")("Integration", { returnTo: Schema.optionalKey(Schema.String) }) {};
+const Method = Schema.Union([
+	Token,
+	OAuth,
+	Integration
+]);
+const StartPayload = Schema.Struct({
+	domain: Schema.String,
+	provider: Schema.String,
+	method: Method
+});
+/** A zone the connection can serve, named for a customer to pick from. */
+var Candidate = class extends Schema.Class("@domainkit/server/Candidate")({
+	zone: Schema.String,
+	label: Schema.String
+}) {};
+var Connected = class extends Schema.TaggedClass("@domainkit/server/Started/Connected")("Connected", { snapshot: Snapshot }) {};
+var Redirect = class extends Schema.TaggedClass("@domainkit/server/Started/Redirect")("Redirect", { authorizationUrl: Schema.String }) {};
+var SelectionRequired = class extends Schema.TaggedClass("@domainkit/server/Started/SelectionRequired")("SelectionRequired", {
+	connectionId: Schema.String,
+	candidates: Schema.Array(Candidate)
+}) {};
+const Started = Schema.Union([
+	Connected,
+	Redirect,
+	SelectionRequired
+]);
+/**
+* Which of the principal's connections already reaches a domain. The class names carry a
+* `Discovery` prefix because `Started` owns the unprefixed `SelectionRequired`; the wire tags are
+* the ones `Connect.Discovery` uses.
+*/
+var DiscoveryResolved = class extends Schema.TaggedClass("@domainkit/server/Discovery/Resolved")("Resolved", {
+	connectionId: Schema.String,
+	zone: Schema.String,
+	label: Schema.String
+}) {};
+var DiscoverySelectionRequired = class extends Schema.TaggedClass("@domainkit/server/Discovery/SelectionRequired")("SelectionRequired", { candidates: Schema.Array(Schema.Struct({
+	connectionId: Schema.String,
+	zone: Schema.String,
+	label: Schema.String
+})) }) {};
+var DiscoveryNotFound = class extends Schema.TaggedClass("@domainkit/server/Discovery/NotFound")("NotFound", { nameservers: Schema.Array(Schema.String) }) {};
+const Discovery = Schema.Union([
+	DiscoveryResolved,
+	DiscoverySelectionRequired,
+	DiscoveryNotFound
+]);
+const AttachPayload = Schema.Struct({
+	domain: Schema.String,
+	/** Which candidate zone to attach when `SelectionRequired` came back. */
+	zone: Schema.optionalKey(Schema.String)
+});
+const PlanPayload = Schema.Struct({ requirements: Schema.Array(Model) });
+const ObservePayload = Schema.Struct({ 
+/** Records to observe instead of the attachment's receipt; required for an unattached domain. */
+requirements: Schema.optionalKey(Schema.Array(Model)) });
+const ApprovePayload = Schema.Struct({ 
+/** A subset of the plan's writes; omit to approve every write. */
+operationIds: Schema.optionalKey(Schema.Array(OperationId)) });
+const RejectPayload = Schema.Struct({ 
+/** Why the customer declined, for the audit trail. */
+reason: Schema.optionalKey(Schema.String) });
+/** One durable plan -> approval -> receipt lifecycle, as `GET /plans/:planId` returns it. */
+const Attempt = Schema.Struct({
+	plan: Model$1,
+	status: AttemptStatus,
+	approval: Schema.NullOr(Model$2),
+	receipt: Schema.NullOr(Model$3),
+	rejection: Schema.NullOr(Rejection)
+});
+/** `Verify.Readiness` on the wire; timestamps encode as ISO strings. */
+const Readiness = Schema.Struct({
+	domain: Schema.String,
+	attachmentId: Schema.NullOr(Schema.String),
+	overall: Overall,
+	requirements: Schema.Array(Schema.Struct({
+		operationId: Schema.NullOr(OperationId),
+		record: Model,
+		status: RequirementStatus,
+		evidence: Schema.Array(Evidence)
+	})),
+	host: Schema.Array(HostEvidence),
+	checkedAt: Schema.DateTimeUtcFromString,
+	nextCheckAt: Schema.NullOr(Schema.DateTimeUtcFromString)
+});
+const Redirected = HttpApiSchema.WithHeaders(HttpApiSchema.Empty(302), { location: Schema.String });
+/** `DomainKit.Error` narrowed to the reasons that answer with `status`. */
+const errorAt = (status) => DomainKitError.check(Schema.makeFilter((error) => error.httpStatus === status)).pipe(HttpApiSchema.status(status));
+const errors = [
+	400,
+	401,
+	403,
+	404,
+	409,
+	500,
+	501,
+	502,
+	503
+].map(errorAt);
+const group = HttpApiGroup.make("domainkit").add(HttpApiEndpoint.get("inspect", "/domains/:domain", {
+	params: { domain: Schema.String },
+	success: Snapshot,
+	error: errors
+})).add(HttpApiEndpoint.get("discover", "/domains/:domain/discovery", {
+	params: { domain: Schema.String },
+	success: Discovery,
+	error: errors
+})).add(HttpApiEndpoint.post("start", "/connections", {
+	payload: StartPayload,
+	success: Started,
+	error: errors
+})).add(HttpApiEndpoint.get("callback", "/callback/:provider", {
+	params: { provider: Schema.String },
+	query: {
+		state: Schema.String,
+		code: Schema.optionalKey(Schema.String)
+	},
+	success: Redirected,
+	error: errors
+})).add(HttpApiEndpoint.post("attach", "/connections/:connectionId/attachments", {
+	params: { connectionId: Schema.String },
+	payload: AttachPayload,
+	success: Started,
+	error: errors
+})).add(HttpApiEndpoint.delete("detach", "/attachments/:attachmentId", {
+	params: { attachmentId: Schema.String },
+	success: Schema.Void,
+	error: errors
+})).add(HttpApiEndpoint.delete("disconnect", "/connections/:connectionId", {
+	params: { connectionId: Schema.String },
+	success: Schema.Void,
+	error: errors
+})).add(HttpApiEndpoint.post("createPlan", "/domains/:domain/plans", {
+	params: { domain: Schema.String },
+	payload: PlanPayload,
+	success: Model$1,
+	error: errors
+})).add(HttpApiEndpoint.post("approve", "/plans/:planId/approvals", {
+	params: { planId: PlanId },
+	payload: ApprovePayload,
+	success: Model$2,
+	error: errors
+})).add(HttpApiEndpoint.post("reject", "/plans/:planId/rejections", {
+	params: { planId: PlanId },
+	payload: RejectPayload,
+	success: Attempt,
+	error: errors
+})).add(HttpApiEndpoint.post("apply", "/approvals/:approvalId/apply", {
+	params: { approvalId: ApprovalId },
+	success: Model$3,
+	error: errors
+})).add(HttpApiEndpoint.get("plan", "/plans/:planId", {
+	params: { planId: PlanId },
+	success: Attempt,
+	error: errors
+})).add(HttpApiEndpoint.get("receipt", "/receipts/:receiptId", {
+	params: { receiptId: ReceiptId },
+	success: Model$3,
+	error: errors
+})).add(HttpApiEndpoint.post("observe", "/domains/:domain/observations", {
+	params: { domain: Schema.String },
+	payload: ObservePayload,
+	success: Readiness,
+	error: errors
+})).add(HttpApiEndpoint.post("cleanupPlan", "/receipts/:receiptId/cleanup-plans", {
+	params: { receiptId: ReceiptId },
+	success: Model$1,
+	error: errors
+}));
+const START_ROUTE = "/connections";
+const callbackRoute = (provider) => `/callback/${encodeURIComponent(provider)}`;
+const invalid = (message, field) => fail(new InvalidInput({
+	message,
+	...field === void 0 ? {} : { field }
+}));
+/** The request as an absolute URL: the web original when there is one, else scheme plus `Host`. */
+const absoluteUrl = (request) => Effect.suspend(() => {
+	try {
+		return Effect.succeed(new URL(request.originalUrl));
+	} catch {
+		const url = HttpServerRequest.toURL(request);
+		return Option.isNone(url) ? invalid("The request has no usable origin; set callbackBaseUrl", "callbackBaseUrl") : Effect.succeed(url.value);
+	}
+});
+/**
+* The absolute URL the provider redirects back to. `callbackBaseUrl` wins when the host set it,
+* because a proxy that rewrites `Host` leaves the request pointing at an origin the browser never
+* sees; otherwise it follows the prefix the group is mounted at, derived by stripping the handling
+* route's own path off the request.
+*/
+const callbackUrlFor = (input) => Effect.suspend(() => {
+	const suffix = `/callback/${encodeURIComponent(input.provider)}`;
+	const configured = input.options.callbackBaseUrl;
+	if (configured !== void 0) return Effect.try({
+		try: () => new URL(`${configured.replace(/\/+$/, "")}${suffix}`),
+		catch: () => callbackConfigurationError(`${configured} is not a URL`)
+	});
+	return Effect.flatMap(absoluteUrl(input.request), (url) => {
+		const path = url.pathname;
+		if (!path.endsWith(input.route)) return invalid(`The ${input.route} route is not mounted where it says; set callbackBaseUrl`, "callbackBaseUrl");
+		return Effect.succeed(new URL(`${url.origin}${path.slice(0, path.length - input.route.length)}${suffix}`));
+	});
+});
+const callbackConfigurationError = (message) => new DomainKitError({ reason: new InvalidInput({
+	message,
+	field: "callbackBaseUrl"
+}) });
+/**
+* Where the callback may send the customer: a path under the callback's own base, or an absolute
+* URL on its origin. A destination that leaves the application is an open redirect, whoever
+* supplied it.
+*/
+const sameOrigin = (destination, callback) => {
+	try {
+		const url = new URL(destination, callback);
+		return url.origin === callback.origin ? url.toString() : null;
+	} catch {
+		return null;
+	}
+};
+const snapshotOf = (snapshot) => ({
+	domain: snapshot.domain,
+	attachmentId: snapshot.attachment?.id ?? null,
+	connectionId: snapshot.connection?.id ?? null,
+	provider: snapshot.authorization?.provider ?? null,
+	method: snapshot.authorization?.method ?? null,
+	status: snapshot.connection === null ? "disconnected" : snapshot.authorization?.revocation === "active" ? "connected" : "reconnect",
+	lastReceiptId: snapshot.lastReceiptId,
+	reusable: snapshot.reusable.map(({ connection, provider, method }) => ({
+		connectionId: connection.id,
+		provider,
+		method
+	})),
+	providers: snapshot.providers.map(({ id, name, methods }) => ({
+		id,
+		name,
+		methods
+	}))
+});
+/** The wire method as `Connect` takes it; interactive cases carry the caller's return destination. */
+const methodOf = (method) => {
+	switch (method._tag) {
+		case "Token": return Method$1.token(method.values);
+		case "OAuth": return Method$1.oauth(method.returnTo === void 0 ? {} : { returnTo: method.returnTo });
+		case "Integration": return Method$1.integration(method.returnTo === void 0 ? {} : { returnTo: method.returnTo });
+	}
+};
+const candidatesOf = (candidates) => candidates.map(({ zone, label }) => new Candidate({
+	zone,
+	label
+}));
+/**
+* Handlers for `group` inside the host's API. Every handler derives `Principal` from `Identity`
+* for the request it is serving and provides it to the lifecycle services.
+*/
+const layer = (api, options = {}) => HttpApiBuilder.group(api, "domainkit", (handlers) => Effect.gen(function* () {
+	const identity = yield* Identity;
+	const connect = yield* Service$2;
+	const provision = yield* Service$3;
+	const cleanup = yield* Service$4;
+	const verify = yield* Service$5;
+	const storage = yield* Service$1;
+	/**
+	* Run a lifecycle effect as the principal the host derives from this request, once the host
+	* has allowed that principal onto this route.
+	*/
+	const as = (endpoint, request, effect) => Effect.flatMap(identity.principal(request), (principal) => Effect.flatMap(identity.authorize?.(principal, endpoint) ?? Effect.void, () => Effect.provideService(effect, Service, principal)));
+	const snapshot = (domain) => Effect.map(connect.inspect(domain), snapshotOf);
+	const discovered = (discovery) => {
+		switch (discovery._tag) {
+			case "Resolved": return new DiscoveryResolved({
+				connectionId: discovery.connectionId,
+				zone: discovery.target.zone,
+				label: discovery.target.label
+			});
+			case "SelectionRequired": return new DiscoverySelectionRequired({ candidates: discovery.candidates.map(({ connectionId, target }) => ({
+				connectionId,
+				zone: target.zone,
+				label: target.label
+			})) });
+			case "NotFound": return new DiscoveryNotFound({ nameservers: discovery.nameservers });
+		}
+	};
+	const connected = (domain) => Effect.map(snapshot(domain), (value) => new Connected({ snapshot: value }));
+	const startedOf = (started, domain) => {
+		switch (started._tag) {
+			case "Connected": return connected(domain);
+			case "Redirect": return Effect.succeed(new Redirect({ authorizationUrl: started.authorizationUrl }));
+			case "SelectionRequired": return Effect.succeed(new SelectionRequired({
+				connectionId: started.connection.id,
+				candidates: candidatesOf(started.candidates)
+			}));
+		}
+	};
+	/**
+	* Attach with a zone the client picked out of a `SelectionRequired`. The provider target
+	* behind a zone never crosses the wire, so resolve the candidates again and match by zone.
+	*/
+	const attachAt = (input) => Effect.gen(function* () {
+		const first = yield* connect.attach({
+			connectionId: input.connectionId,
+			domain: input.domain
+		});
+		if (!("_tag" in first)) return yield* connected(input.domain);
+		if (input.zone === void 0) return new SelectionRequired({
+			connectionId: input.connectionId,
+			candidates: candidatesOf(first.candidates)
+		});
+		const target = first.candidates.find(({ zone }) => zone === input.zone);
+		if (target === void 0) return yield* fail(new NotFound({
+			entity: "zone",
+			id: input.zone
+		}));
+		yield* connect.attach({
+			connectionId: input.connectionId,
+			domain: input.domain,
+			target
+		});
+		return yield* connected(input.domain);
+	});
+	/** Provisioning and cleanup share the approve and apply routes; the attempt knows its kind. */
+	const kindOf = (attempt) => attempt.kind === "cleanup" ? cleanup : provision;
+	return handlers.handle("inspect", ({ params, request }) => as("inspect", request, snapshot(params.domain))).handle("discover", ({ params, request }) => as("discover", request, Effect.map(connect.discover(params.domain), discovered))).handle("start", ({ payload, request }) => as("start", request, Effect.gen(function* () {
+		const callbackUrl = payload.method._tag === "Token" ? void 0 : (yield* callbackUrlFor({
+			request,
+			provider: payload.provider,
+			options,
+			route: START_ROUTE
+		})).toString();
+		const started = yield* connect.start({
+			provider: payload.provider,
+			domain: payload.domain,
+			method: methodOf(payload.method),
+			...callbackUrl === void 0 ? {} : { callbackUrl }
+		});
+		return yield* startedOf(started, payload.domain);
+	}))).handle("callback", ({ params, query, request }) => as("callback", request, Effect.gen(function* () {
+		const url = yield* absoluteUrl(request);
+		const base = yield* callbackUrlFor({
+			request,
+			provider: params.provider,
+			options,
+			route: callbackRoute(params.provider)
+		});
+		const requested = (yield* storage.continuations.get(query.state)).returnTo ?? options.defaultReturnTo;
+		if (requested === void 0) return yield* invalid("The flow carried no returnTo and the server has no defaultReturnTo", "returnTo");
+		const destination = sameOrigin(requested, base);
+		if (destination === null) return yield* invalid(`${requested} leaves this application`, "returnTo");
+		yield* connect.complete({
+			continuationId: query.state,
+			callbackUrl: url.toString()
+		});
+		return HttpApiSchema.withHeaders({
+			body: void 0,
+			headers: { location: destination }
+		});
+	}))).handle("attach", ({ params, payload, request }) => as("attach", request, attachAt({
+		connectionId: params.connectionId,
+		domain: payload.domain,
+		zone: payload.zone
+	}))).handle("detach", ({ params, request }) => as("detach", request, connect.detach(params.attachmentId))).handle("disconnect", ({ params, request }) => as("disconnect", request, connect.disconnect(params.connectionId))).handle("createPlan", ({ params, payload, request }) => as("createPlan", request, provision.plan({
+		domain: params.domain,
+		requirements: payload.requirements
+	}))).handle("approve", ({ params, payload, request }) => as("approve", request, Effect.gen(function* () {
+		const attempt = yield* storage.attempts.get(params.planId);
+		return yield* kindOf(attempt).approve(params.planId, { ...payload.operationIds === void 0 ? {} : {
+			operationIds: payload.operationIds,
+			allowPartial: true
+		} });
+	}))).handle("reject", ({ params, payload, request }) => as("reject", request, Effect.gen(function* () {
+		const attempt = yield* storage.attempts.get(params.planId);
+		return yield* kindOf(attempt).reject(params.planId, { ...payload.reason === void 0 ? {} : { reason: payload.reason } });
+	}))).handle("apply", ({ params, request }) => as("apply", request, Effect.gen(function* () {
+		const attempt = yield* storage.attempts.byApproval(params.approvalId);
+		return yield* kindOf(attempt).apply(params.approvalId);
+	}))).handle("plan", ({ params, request }) => as("plan", request, Effect.map(storage.attempts.get(params.planId), (attempt) => ({
+		plan: attempt.plan,
+		status: attempt.status,
+		approval: attempt.approval,
+		receipt: attempt.receipt,
+		rejection: attempt.rejection
+	})))).handle("receipt", ({ params, request }) => as("receipt", request, Effect.flatMap(storage.attempts.byReceipt(params.receiptId), (attempt) => attempt.receipt === null ? fail(new NotFound({
+		entity: "receipt",
+		id: params.receiptId
+	})) : Effect.succeed(attempt.receipt)))).handle("observe", ({ params, payload, request }) => as("observe", request, verify.observe({
+		domain: params.domain,
+		...payload.requirements === void 0 ? {} : { requirements: payload.requirements }
+	}))).handle("cleanupPlan", ({ params, request }) => as("cleanupPlan", request, cleanup.plan({ receiptId: params.receiptId })));
+}));
+/** A standalone API for hosts not on HttpApi. Mount at any prefix. */
+const api = HttpApi.make("domainkit").add(group);
+/** The Promise edge: a `fetch`-shaped handler over the group for hosts that are not Effect-native. */
+const toWebHandler = (services, options = {}) => {
+	const prefixed = options.prefix === void 0 ? api : HttpApi.make("domainkit").add(group.prefix(options.prefix));
+	const app = HttpApiBuilder.layer(prefixed).pipe(Layer.provide(layer(prefixed, options)), Layer.provide(services), Layer.provide(HttpServer.layerServices));
+	return HttpRouter.toWebHandler(app, { disableLogger: true });
+};
+//#endregion
+export { ApprovePayload, AttachPayload, Attempt, Candidate, Connected, ConnectionStatus, Discovery, DiscoveryNotFound, DiscoveryResolved, DiscoverySelectionRequired, Field, Identity, Integration, Method, MethodDescriptor, OAuth, ObservePayload, PlanPayload, Readiness, Redirect, RejectPayload, SelectionRequired, Server_exports, Snapshot, StartPayload, Started, Token, api, group, layer, toWebHandler };
+
+//# sourceMappingURL=Server.mjs.map