@entifix/service-shell 0.1.0-0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 r10c Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+export * from './require-organization.js';
+export * from './require-principal.js';
+export * from './require-service-crossing.js';
+export * from './service-token.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oBAAoB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,6 @@
+export * from './require-organization.js';
+export * from './require-principal.js';
+export * from './require-service-crossing.js';
+export * from './service-token.js';
+
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["export * from './require-organization.js';\nexport * from './require-principal.js';\nexport * from './require-service-crossing.js';\nexport * from './service-token.js';\n"],"names":[],"mappings":"AAAA,cAAc,4BAA4B;AAC1C,cAAc,yBAAyB;AACvC,cAAc,gCAAgC;AAC9C,cAAc,qBAAqB"}

package/dist/auth/require-organization.d.ts

@@ -0,0 +1,35 @@
+import { HttpServerResponse } from '@effect/platform';
+import type { Permission } from '@entifix/authz';
+import { Effect } from 'effect';
+import { type RequestPrincipal } from './require-principal.js';
+/**
+ * Guard a **tenant-plane** handler: authenticate, check the permission, and
+ * require that the session names an organization.
+ *
+ * **This is the first of exactly two ways a request resolves the organization
+ * it acts for, and the only *user-facing* one**
+ * ([ADR 0006](../../../../../../docs/adr/0006-multitenancy-planes-and-tenant-storage.md)).
+ * The second is {@link requireServiceCrossing}: an explicit `organizationId`
+ * presented with a service token *and* a narrow route permission, for a
+ * platform-plane caller acting for an organization it was handed rather than one
+ * it picked
+ * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).
+ *
+ * There is no third path, no fallback and no operator branch. A request
+ * satisfying neither guard never reaches a tenant handle at all, which is what
+ * keeps the most sensitive capability in the system from being the *absence* of
+ * a condition.
+ *
+ * The organization is handed to the handler so it can resolve its own storage
+ * through a `TenantDatabaseResolver`. Resolution happens **inside the request**
+ * — the connection pool is a boot-time `Layer`, and a per-request `Layer` would
+ * rebuild the pool per request.
+ *
+ * Here the value comes from the verified token and nowhere else. A route
+ * parameter or a body field naming an organization would be caller-controlled,
+ * which is the whole failure this guard exists to prevent — and is exactly why
+ * the other path honours a caller-named organization only *after* the caller has
+ * proved it is the fleet.
+ */
+export declare const requireOrganization: (permission: Permission) => <A, E, R>(use: (organizationId: string, principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, import("@entifix/authz").PolicyDecisionTag | import("@entifix/business").TokenServiceTag | import("@effect/platform/HttpServerRequest").HttpServerRequest | R>;
+//# sourceMappingURL=require-organization.d.ts.map

package/dist/auth/require-organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-organization.d.ts","sourceRoot":"","sources":["../../src/auth/require-organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAkBhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,mBAAmB,GAC7B,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EACN,KAAK,CACH,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,gBAAgB,KACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,mRAa1B,CAAC"}

package/dist/auth/require-organization.js

@@ -0,0 +1,59 @@
+import { HttpServerResponse } from '@effect/platform';
+import { Effect } from 'effect';
+import { requirePermission } from './require-principal.js';
+/**
+ * `409` rather than `403`: the caller is authenticated and permitted, but the
+ * session names no organization, so there is no storage to read. An operator
+ * hits this by design — crossing into a tenant is an explicit, audited
+ * act-as-organization re-mint, never a widening of the default (ADR 0012) —
+ * and a member of several organizations hits it before choosing one. The `code`
+ * is a key in the shared `errors` catalog, so a client renders "select an
+ * organization" instead of "forbidden" — a claim `@r10c/i18n-check` now holds
+ * to, because for a while it was simply false and the code reached the browser
+ * as its own literal text.
+ */ const noOrganization = HttpServerResponse.json({
+    error: 'no active organization',
+    code: 'noActiveOrganization'
+}, {
+    status: 409
+});
+/**
+ * Guard a **tenant-plane** handler: authenticate, check the permission, and
+ * require that the session names an organization.
+ *
+ * **This is the first of exactly two ways a request resolves the organization
+ * it acts for, and the only *user-facing* one**
+ * ([ADR 0006](../../../../../../docs/adr/0006-multitenancy-planes-and-tenant-storage.md)).
+ * The second is {@link requireServiceCrossing}: an explicit `organizationId`
+ * presented with a service token *and* a narrow route permission, for a
+ * platform-plane caller acting for an organization it was handed rather than one
+ * it picked
+ * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).
+ *
+ * There is no third path, no fallback and no operator branch. A request
+ * satisfying neither guard never reaches a tenant handle at all, which is what
+ * keeps the most sensitive capability in the system from being the *absence* of
+ * a condition.
+ *
+ * The organization is handed to the handler so it can resolve its own storage
+ * through a `TenantDatabaseResolver`. Resolution happens **inside the request**
+ * — the connection pool is a boot-time `Layer`, and a per-request `Layer` would
+ * rebuild the pool per request.
+ *
+ * Here the value comes from the verified token and nowhere else. A route
+ * parameter or a body field naming an organization would be caller-controlled,
+ * which is the whole failure this guard exists to prevent — and is exactly why
+ * the other path honours a caller-named organization only *after* the caller has
+ * proved it is the fleet.
+ */ export const requireOrganization = (permission)=>(use)=>requirePermission(permission)((principal)=>// `Effect.gen` rather than a ternary: the two branches have different
+            // success types, and a conditional expression would unify them against
+            // the first one instead of widening. `requirePrincipal` yields for the
+            // same reason.
+            Effect.gen(function*() {
+                if (principal.organizationId === undefined) {
+                    return yield* noOrganization;
+                }
+                return yield* use(principal.organizationId, principal);
+            }));
+
+//# sourceMappingURL=require-organization.js.map

package/dist/auth/require-organization.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/require-organization.ts"],"sourcesContent":["import { HttpServerResponse } from '@effect/platform';\nimport type { Permission } from '@entifix/authz';\nimport { Effect } from 'effect';\n\nimport {\n  type RequestPrincipal,\n  requirePermission,\n} from './require-principal.js';\n\n/**\n * `409` rather than `403`: the caller is authenticated and permitted, but the\n * session names no organization, so there is no storage to read. An operator\n * hits this by design — crossing into a tenant is an explicit, audited\n * act-as-organization re-mint, never a widening of the default (ADR 0012) —\n * and a member of several organizations hits it before choosing one. The `code`\n * is a key in the shared `errors` catalog, so a client renders \"select an\n * organization\" instead of \"forbidden\" — a claim `@r10c/i18n-check` now holds\n * to, because for a while it was simply false and the code reached the browser\n * as its own literal text.\n */\nconst noOrganization = HttpServerResponse.json(\n  { error: 'no active organization', code: 'noActiveOrganization' },\n  { status: 409 },\n);\n\n/**\n * Guard a **tenant-plane** handler: authenticate, check the permission, and\n * require that the session names an organization.\n *\n * **This is the first of exactly two ways a request resolves the organization\n * it acts for, and the only *user-facing* one**\n * ([ADR 0006](../../../../../../docs/adr/0006-multitenancy-planes-and-tenant-storage.md)).\n * The second is {@link requireServiceCrossing}: an explicit `organizationId`\n * presented with a service token *and* a narrow route permission, for a\n * platform-plane caller acting for an organization it was handed rather than one\n * it picked\n * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).\n *\n * There is no third path, no fallback and no operator branch. A request\n * satisfying neither guard never reaches a tenant handle at all, which is what\n * keeps the most sensitive capability in the system from being the *absence* of\n * a condition.\n *\n * The organization is handed to the handler so it can resolve its own storage\n * through a `TenantDatabaseResolver`. Resolution happens **inside the request**\n * — the connection pool is a boot-time `Layer`, and a per-request `Layer` would\n * rebuild the pool per request.\n *\n * Here the value comes from the verified token and nowhere else. A route\n * parameter or a body field naming an organization would be caller-controlled,\n * which is the whole failure this guard exists to prevent — and is exactly why\n * the other path honours a caller-named organization only *after* the caller has\n * proved it is the fleet.\n */\nexport const requireOrganization =\n  (permission: Permission) =>\n  <A, E, R>(\n    use: (\n      organizationId: string,\n      principal: RequestPrincipal,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    requirePermission(permission)(principal =>\n      // `Effect.gen` rather than a ternary: the two branches have different\n      // success types, and a conditional expression would unify them against\n      // the first one instead of widening. `requirePrincipal` yields for the\n      // same reason.\n      Effect.gen(function* () {\n        if (principal.organizationId === undefined) {\n          return yield* noOrganization;\n        }\n        return yield* use(principal.organizationId, principal);\n      }),\n    );\n"],"names":["HttpServerResponse","Effect","requirePermission","noOrganization","json","error","code","status","requireOrganization","permission","use","principal","gen","organizationId","undefined"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,mBAAmB;AAEtD,SAASC,MAAM,QAAQ,SAAS;AAEhC,SAEEC,iBAAiB,QACZ,yBAAyB;AAEhC;;;;;;;;;;CAUC,GACD,MAAMC,iBAAiBH,mBAAmBI,IAAI,CAC5C;IAAEC,OAAO;IAA0BC,MAAM;AAAuB,GAChE;IAAEC,QAAQ;AAAI;AAGhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,MAAMC,sBACX,CAACC,aACD,CACEC,MAKAR,kBAAkBO,YAAYE,CAAAA,YAC5B,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,eAAe;YACfV,OAAOW,GAAG,CAAC;gBACT,IAAID,UAAUE,cAAc,KAAKC,WAAW;oBAC1C,OAAO,OAAOX;gBAChB;gBACA,OAAO,OAAOO,IAAIC,UAAUE,cAAc,EAAEF;YAC9C,IACA"}

package/dist/auth/require-principal.d.ts

@@ -0,0 +1,70 @@
+import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
+import { type Permission, PolicyDecisionTag } from '@entifix/authz';
+import { type TokenClaims, TokenServiceTag } from '@entifix/business';
+import { Effect } from 'effect';
+/**
+ * The authenticated subject as a service sees it. Structurally identical to
+ * `business-ts-authn`'s `Principal`, re-declared here so the shared shell does
+ * not depend on a single domain package.
+ */
+export interface RequestPrincipal {
+    readonly userId: TokenClaims['userId'];
+    readonly subject: string;
+    readonly sessionId: string;
+    readonly roles: readonly string[];
+    /**
+     * The organization this request acts for — the storage routing key, absent
+     * for a caller with no tenant scope (a buyer, or an operator). Kept out of
+     * `attributes` deliberately: attributes are policy inputs, this decides which
+     * database a handler reads.
+     */
+    readonly organizationId?: string;
+    /**
+     * Which population the caller belongs to — buyer, vendor staff, or platform
+     * staff. Carried so a handler never has to infer it from an absent
+     * `organizationId`, which a buyer and an operator share.
+     *
+     * Context, not a grant: what the caller may *do* still comes from `roles`
+     * through {@link PolicyDecisionTag}.
+     */
+    readonly partyRole?: string;
+    /**
+     * The party behind the account — the `Individual` id, absent for an account
+     * with no party record.
+     *
+     * Same rule as the two fields above: it comes from the verified token and
+     * never from anything the caller sets on the request. It says *whose* records
+     * these are, which is what a route scoping a read to its caller needs; it
+     * says nothing about what may be done with them.
+     */
+    readonly partyId?: string;
+    /**
+     * When the verified token stops being valid, as a Unix timestamp in seconds.
+     *
+     * Every REST route is already bounded by it implicitly — verification is
+     * stateless, so the next call after expiry simply fails. A **held-open**
+     * response has no next call, so `GET /api/transaction/events` reads it and
+     * closes the connection there (ADR 0036). Absent when the token carries no
+     * `exp`, which a signed one always does; the guard is for the type, not for a
+     * case the fleet produces.
+     */
+    readonly expiresAt?: number;
+    readonly attributes: Readonly<Record<string, unknown>>;
+}
+/**
+ * Guard a handler behind a valid access token — authentication only. Any
+ * missing or invalid token is a `401`; the wrapped handler's own errors are
+ * left intact.
+ */
+export declare const requirePrincipal: <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, TokenServiceTag | HttpServerRequest.HttpServerRequest | R>;
+/**
+ * Guard a handler behind a permission. Authenticates as above, then asks
+ * {@link PolicyDecisionTag} whether this subject may perform the action — so
+ * the two failure modes stay distinguishable: `401` means "sign in", `403`
+ * means "signed in, not allowed".
+ *
+ * **This is the authorization boundary.** Filtering a nav menu or hiding a page
+ * is presentation; a route that skips this guard is open regardless.
+ */
+export declare const requirePermission: (permission: Permission) => <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, PolicyDecisionTag | TokenServiceTag | HttpServerRequest.HttpServerRequest | R>;
+//# sourceMappingURL=require-principal.d.ts.map

package/dist/auth/require-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-principal.d.ts","sourceRoot":"","sources":["../../src/auth/require-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAEL,KAAK,UAAU,EACf,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AAExC;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAmED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACtC,KAAK,CAAC,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,+KAQ1D,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAC3B,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,mMAmBlE,CAAC"}

package/dist/auth/require-principal.js

@@ -0,0 +1,105 @@
+import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
+import { parsePermission, PolicyDecisionTag } from '@entifix/authz';
+import { TokenServiceTag } from '@entifix/business';
+import { ACCESS_COOKIE } from '@entifix/core';
+import { Effect, Option } from 'effect';
+/** Extract a bearer token from an `Authorization` header, if present. */ const bearerToken = (authorization)=>{
+    if (authorization === undefined) {
+        return undefined;
+    }
+    const [scheme, value] = authorization.split(' ');
+    return (scheme == null ? void 0 : scheme.toLowerCase()) === 'bearer' ? value : undefined;
+};
+/** Rebuild the request principal from verified token claims. */ const claimsToPrincipal = (claims)=>({
+        userId: claims.userId,
+        subject: claims.subject,
+        sessionId: claims.sessionId,
+        roles: claims.roles,
+        // The organization comes from the *verified* token and nowhere else — never
+        // from a route parameter, a query string or a body, all of which the caller
+        // controls. That is what makes tenant isolation a property of the session
+        // rather than of every handler remembering to check.
+        organizationId: claims.activeOrganizationId,
+        // Same rule, same reason: it comes from the verified token, never from
+        // anything the caller can set on the request.
+        partyRole: claims.partyRole,
+        partyId: claims.partyId,
+        // `TokenClaims` carries an index signature, so `exp` arrives as `unknown`
+        // even though jose always sets it — hence the guard rather than a cast.
+        expiresAt: typeof claims.exp === 'number' ? claims.exp : undefined,
+        // Rich/volatile attributes are not in the token; a handler that needs them
+        // reads the session store by `sessionId`.
+        attributes: {}
+    });
+// `code` is a key in the shared `errors` catalog; `error` stays English for
+// logs. `permission` is deliberately still in the 403 — it says which grant was
+// missing, which is diagnostic, not a leak.
+const unauthenticated = HttpServerResponse.json({
+    error: 'unauthenticated',
+    code: 'unauthenticated'
+}, {
+    status: 401
+});
+const forbidden = (permission)=>HttpServerResponse.json({
+        error: 'forbidden',
+        code: 'forbidden',
+        permission
+    }, {
+        status: 403
+    });
+/**
+ * Resolve the caller's principal from the request, or `None`. Reads the token
+ * from the `entifix_at` cookie (the Next app forwards it) or an
+ * `Authorization: Bearer` header and verifies it statelessly via
+ * {@link TokenServiceTag} — no store round trip on the hot path.
+ */ const resolvePrincipal = Effect.gen(function*() {
+    var _req_cookies_ACCESS_COOKIE;
+    const req = yield* HttpServerRequest.HttpServerRequest;
+    const token = (_req_cookies_ACCESS_COOKIE = req.cookies[ACCESS_COOKIE]) != null ? _req_cookies_ACCESS_COOKIE : bearerToken(req.headers['authorization']);
+    if (token === undefined) {
+        return Option.none();
+    }
+    const tokens = yield* TokenServiceTag;
+    const claims = yield* tokens.verify(token).pipe(Effect.option);
+    return Option.map(claims, claimsToPrincipal);
+});
+/**
+ * Guard a handler behind a valid access token — authentication only. Any
+ * missing or invalid token is a `401`; the wrapped handler's own errors are
+ * left intact.
+ */ export const requirePrincipal = (use)=>Effect.gen(function*() {
+        const principal = yield* resolvePrincipal;
+        if (Option.isNone(principal)) {
+            return yield* unauthenticated;
+        }
+        return yield* use(principal.value);
+    });
+/**
+ * Guard a handler behind a permission. Authenticates as above, then asks
+ * {@link PolicyDecisionTag} whether this subject may perform the action — so
+ * the two failure modes stay distinguishable: `401` means "sign in", `403`
+ * means "signed in, not allowed".
+ *
+ * **This is the authorization boundary.** Filtering a nav menu or hiding a page
+ * is presentation; a route that skips this guard is open regardless.
+ */ export const requirePermission = (permission)=>(use)=>Effect.gen(function*() {
+            const principal = yield* resolvePrincipal;
+            if (Option.isNone(principal)) {
+                return yield* unauthenticated;
+            }
+            const { resource, action } = parsePermission(permission);
+            const policy = yield* PolicyDecisionTag;
+            const allowed = policy.decide({
+                subject: {
+                    roles: principal.value.roles
+                },
+                resource,
+                action
+            });
+            if (!allowed) {
+                return yield* forbidden(permission);
+            }
+            return yield* use(principal.value);
+        });
+
+//# sourceMappingURL=require-principal.js.map

package/dist/auth/require-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/require-principal.ts"],"sourcesContent":["import { HttpServerRequest, HttpServerResponse } from '@effect/platform';\nimport {\n  parsePermission,\n  type Permission,\n  PolicyDecisionTag,\n} from '@entifix/authz';\nimport { type TokenClaims, TokenServiceTag } from '@entifix/business';\nimport { ACCESS_COOKIE } from '@entifix/core';\nimport { Effect, Option } from 'effect';\n\n/**\n * The authenticated subject as a service sees it. Structurally identical to\n * `business-ts-authn`'s `Principal`, re-declared here so the shared shell does\n * not depend on a single domain package.\n */\nexport interface RequestPrincipal {\n  readonly userId: TokenClaims['userId'];\n  readonly subject: string;\n  readonly sessionId: string;\n  readonly roles: readonly string[];\n  /**\n   * The organization this request acts for — the storage routing key, absent\n   * for a caller with no tenant scope (a buyer, or an operator). Kept out of\n   * `attributes` deliberately: attributes are policy inputs, this decides which\n   * database a handler reads.\n   */\n  readonly organizationId?: string;\n  /**\n   * Which population the caller belongs to — buyer, vendor staff, or platform\n   * staff. Carried so a handler never has to infer it from an absent\n   * `organizationId`, which a buyer and an operator share.\n   *\n   * Context, not a grant: what the caller may *do* still comes from `roles`\n   * through {@link PolicyDecisionTag}.\n   */\n  readonly partyRole?: string;\n  /**\n   * The party behind the account — the `Individual` id, absent for an account\n   * with no party record.\n   *\n   * Same rule as the two fields above: it comes from the verified token and\n   * never from anything the caller sets on the request. It says *whose* records\n   * these are, which is what a route scoping a read to its caller needs; it\n   * says nothing about what may be done with them.\n   */\n  readonly partyId?: string;\n  /**\n   * When the verified token stops being valid, as a Unix timestamp in seconds.\n   *\n   * Every REST route is already bounded by it implicitly — verification is\n   * stateless, so the next call after expiry simply fails. A **held-open**\n   * response has no next call, so `GET /api/transaction/events` reads it and\n   * closes the connection there (ADR 0036). Absent when the token carries no\n   * `exp`, which a signed one always does; the guard is for the type, not for a\n   * case the fleet produces.\n   */\n  readonly expiresAt?: number;\n  readonly attributes: Readonly<Record<string, unknown>>;\n}\n\n/** Extract a bearer token from an `Authorization` header, if present. */\nconst bearerToken = (authorization: string | undefined): string | undefined => {\n  if (authorization === undefined) {\n    return undefined;\n  }\n  const [scheme, value] = authorization.split(' ');\n  return scheme?.toLowerCase() === 'bearer' ? value : undefined;\n};\n\n/** Rebuild the request principal from verified token claims. */\nconst claimsToPrincipal = (claims: TokenClaims): RequestPrincipal => ({\n  userId: claims.userId,\n  subject: claims.subject,\n  sessionId: claims.sessionId,\n  roles: claims.roles,\n  // The organization comes from the *verified* token and nowhere else — never\n  // from a route parameter, a query string or a body, all of which the caller\n  // controls. That is what makes tenant isolation a property of the session\n  // rather than of every handler remembering to check.\n  organizationId: claims.activeOrganizationId,\n  // Same rule, same reason: it comes from the verified token, never from\n  // anything the caller can set on the request.\n  partyRole: claims.partyRole,\n  partyId: claims.partyId,\n  // `TokenClaims` carries an index signature, so `exp` arrives as `unknown`\n  // even though jose always sets it — hence the guard rather than a cast.\n  expiresAt: typeof claims.exp === 'number' ? claims.exp : undefined,\n  // Rich/volatile attributes are not in the token; a handler that needs them\n  // reads the session store by `sessionId`.\n  attributes: {},\n});\n\n// `code` is a key in the shared `errors` catalog; `error` stays English for\n// logs. `permission` is deliberately still in the 403 — it says which grant was\n// missing, which is diagnostic, not a leak.\nconst unauthenticated = HttpServerResponse.json(\n  { error: 'unauthenticated', code: 'unauthenticated' },\n  { status: 401 },\n);\n\nconst forbidden = (permission: Permission) =>\n  HttpServerResponse.json(\n    { error: 'forbidden', code: 'forbidden', permission },\n    { status: 403 },\n  );\n\n/**\n * Resolve the caller's principal from the request, or `None`. Reads the token\n * from the `entifix_at` cookie (the Next app forwards it) or an\n * `Authorization: Bearer` header and verifies it statelessly via\n * {@link TokenServiceTag} — no store round trip on the hot path.\n */\nconst resolvePrincipal = Effect.gen(function* () {\n  const req = yield* HttpServerRequest.HttpServerRequest;\n  const token =\n    req.cookies[ACCESS_COOKIE] ?? bearerToken(req.headers['authorization']);\n  if (token === undefined) {\n    return Option.none<RequestPrincipal>();\n  }\n\n  const tokens = yield* TokenServiceTag;\n  const claims = yield* tokens.verify(token).pipe(Effect.option);\n  return Option.map(claims, claimsToPrincipal);\n});\n\n/**\n * Guard a handler behind a valid access token — authentication only. Any\n * missing or invalid token is a `401`; the wrapped handler's own errors are\n * left intact.\n */\nexport const requirePrincipal = <A, E, R>(\n  use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const principal = yield* resolvePrincipal;\n    if (Option.isNone(principal)) {\n      return yield* unauthenticated;\n    }\n    return yield* use(principal.value);\n  });\n\n/**\n * Guard a handler behind a permission. Authenticates as above, then asks\n * {@link PolicyDecisionTag} whether this subject may perform the action — so\n * the two failure modes stay distinguishable: `401` means \"sign in\", `403`\n * means \"signed in, not allowed\".\n *\n * **This is the authorization boundary.** Filtering a nav menu or hiding a page\n * is presentation; a route that skips this guard is open regardless.\n */\nexport const requirePermission =\n  (permission: Permission) =>\n  <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) =>\n    Effect.gen(function* () {\n      const principal = yield* resolvePrincipal;\n      if (Option.isNone(principal)) {\n        return yield* unauthenticated;\n      }\n\n      const { resource, action } = parsePermission(permission);\n      const policy = yield* PolicyDecisionTag;\n      const allowed = policy.decide({\n        subject: { roles: principal.value.roles },\n        resource,\n        action,\n      });\n      if (!allowed) {\n        return yield* forbidden(permission);\n      }\n\n      return yield* use(principal.value);\n    });\n"],"names":["HttpServerRequest","HttpServerResponse","parsePermission","PolicyDecisionTag","TokenServiceTag","ACCESS_COOKIE","Effect","Option","bearerToken","authorization","undefined","scheme","value","split","toLowerCase","claimsToPrincipal","claims","userId","subject","sessionId","roles","organizationId","activeOrganizationId","partyRole","partyId","expiresAt","exp","attributes","unauthenticated","json","error","code","status","forbidden","permission","resolvePrincipal","gen","req","token","cookies","headers","none","tokens","verify","pipe","option","map","requirePrincipal","use","principal","isNone","requirePermission","resource","action","policy","allowed","decide"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,kBAAkB,QAAQ,mBAAmB;AACzE,SACEC,eAAe,EAEfC,iBAAiB,QACZ,iBAAiB;AACxB,SAA2BC,eAAe,QAAQ,oBAAoB;AACtE,SAASC,aAAa,QAAQ,gBAAgB;AAC9C,SAASC,MAAM,EAAEC,MAAM,QAAQ,SAAS;AAoDxC,uEAAuE,GACvE,MAAMC,cAAc,CAACC;IACnB,IAAIA,kBAAkBC,WAAW;QAC/B,OAAOA;IACT;IACA,MAAM,CAACC,QAAQC,MAAM,GAAGH,cAAcI,KAAK,CAAC;IAC5C,OAAOF,CAAAA,0BAAAA,OAAQG,WAAW,QAAO,WAAWF,QAAQF;AACtD;AAEA,8DAA8D,GAC9D,MAAMK,oBAAoB,CAACC,SAA2C,CAAA;QACpEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO;QACvBC,WAAWH,OAAOG,SAAS;QAC3BC,OAAOJ,OAAOI,KAAK;QACnB,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,qDAAqD;QACrDC,gBAAgBL,OAAOM,oBAAoB;QAC3C,uEAAuE;QACvE,8CAA8C;QAC9CC,WAAWP,OAAOO,SAAS;QAC3BC,SAASR,OAAOQ,OAAO;QACvB,0EAA0E;QAC1E,wEAAwE;QACxEC,WAAW,OAAOT,OAAOU,GAAG,KAAK,WAAWV,OAAOU,GAAG,GAAGhB;QACzD,2EAA2E;QAC3E,0CAA0C;QAC1CiB,YAAY,CAAC;IACf,CAAA;AAEA,4EAA4E;AAC5E,gFAAgF;AAChF,4CAA4C;AAC5C,MAAMC,kBAAkB3B,mBAAmB4B,IAAI,CAC7C;IAAEC,OAAO;IAAmBC,MAAM;AAAkB,GACpD;IAAEC,QAAQ;AAAI;AAGhB,MAAMC,YAAY,CAACC,aACjBjC,mBAAmB4B,IAAI,CACrB;QAAEC,OAAO;QAAaC,MAAM;QAAaG;IAAW,GACpD;QAAEF,QAAQ;IAAI;AAGlB;;;;;CAKC,GACD,MAAMG,mBAAmB7B,OAAO8B,GAAG,CAAC;QAGhCC;IAFF,MAAMA,MAAM,OAAOrC,kBAAkBA,iBAAiB;IACtD,MAAMsC,SACJD,6BAAAA,IAAIE,OAAO,CAAClC,cAAc,YAA1BgC,6BAA8B7B,YAAY6B,IAAIG,OAAO,CAAC,gBAAgB;IACxE,IAAIF,UAAU5B,WAAW;QACvB,OAAOH,OAAOkC,IAAI;IACpB;IAEA,MAAMC,SAAS,OAAOtC;IACtB,MAAMY,SAAS,OAAO0B,OAAOC,MAAM,CAACL,OAAOM,IAAI,CAACtC,OAAOuC,MAAM;IAC7D,OAAOtC,OAAOuC,GAAG,CAAC9B,QAAQD;AAC5B;AAEA;;;;CAIC,GACD,OAAO,MAAMgC,mBAAmB,CAC9BC,MAEA1C,OAAO8B,GAAG,CAAC;QACT,MAAMa,YAAY,OAAOd;QACzB,IAAI5B,OAAO2C,MAAM,CAACD,YAAY;YAC5B,OAAO,OAAOrB;QAChB;QACA,OAAO,OAAOoB,IAAIC,UAAUrC,KAAK;IACnC,GAAG;AAEL;;;;;;;;CAQC,GACD,OAAO,MAAMuC,oBACX,CAACjB,aACD,CAAUc,MACR1C,OAAO8B,GAAG,CAAC;YACT,MAAMa,YAAY,OAAOd;YACzB,IAAI5B,OAAO2C,MAAM,CAACD,YAAY;gBAC5B,OAAO,OAAOrB;YAChB;YAEA,MAAM,EAAEwB,QAAQ,EAAEC,MAAM,EAAE,GAAGnD,gBAAgBgC;YAC7C,MAAMoB,SAAS,OAAOnD;YACtB,MAAMoD,UAAUD,OAAOE,MAAM,CAAC;gBAC5BtC,SAAS;oBAAEE,OAAO6B,UAAUrC,KAAK,CAACQ,KAAK;gBAAC;gBACxCgC;gBACAC;YACF;YACA,IAAI,CAACE,SAAS;gBACZ,OAAO,OAAOtB,UAAUC;YAC1B;YAEA,OAAO,OAAOc,IAAIC,UAAUrC,KAAK;QACnC,GAAG"}

package/dist/auth/require-service-crossing.d.ts

@@ -0,0 +1,107 @@
+import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
+import { type Permission, ServiceCrossingPolicyTag } from '@entifix/authz';
+import { Context, Effect } from 'effect';
+/**
+ * The header carrying the crossing secret.
+ *
+ * ⚠️ **Deliberately not `x-service-token`.** That header is config-service's
+ * fleet lookup, and the two secrets are not comparable: one grants a
+ * configuration *read*, this one a tenant-data *write* for any organization the
+ * caller names. Sharing the header name is how a proxy configured to forward the
+ * fleet token ends up presenting it to a route that writes stock, and how a
+ * copy-pasted value looks right while being the wrong secret entirely
+ * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).
+ */
+export declare const CROSSING_TOKEN_HEADER = "x-crossing-token";
+/**
+ * The header naming the organization the caller is acting for.
+ *
+ * It rides beside the token rather than inside the request body because
+ * entities are organization-agnostic by rule — no `organizationId` member, no
+ * tenant filter — so there is nowhere in an entity envelope for it to live. A
+ * header also serves the crossings that carry no body at all (releasing a hold,
+ * converting one), which a body field would have needed a second convention for.
+ *
+ * On its own it grants **nothing**: it is only read after the token has proved
+ * the caller is the fleet, so the input the caller controls is never the input
+ * that authorizes.
+ */
+export declare const ORGANIZATION_HEADER = "x-organization-id";
+declare const ServiceCrossingTokenTag_base: Context.TagClass<ServiceCrossingTokenTag, "ServiceCrossingTokenTag", string>;
+/**
+ * The crossing secret this service expects, provided at the composition root
+ * from its own configuration.
+ *
+ * A `Context.Tag` rather than an environment read, which is the difference from
+ * {@link requireServiceToken}: the value is a per-service secret held in
+ * config-service as an `is_secret` row, so it arrives through the same boot
+ * fetch as `mongo.uri` and can be rotated without redeploying a container.
+ */
+export declare class ServiceCrossingTokenTag extends ServiceCrossingTokenTag_base {
+}
+/**
+ * Guard a **service-to-service** tenant crossing: the second — and only other —
+ * way a request resolves the organization it acts for.
+ *
+ * The first is {@link requireOrganization}, which reads the session's
+ * `activeOrganizationId` and is the only *user-facing* resolution. This one
+ * exists because a platform-plane caller sometimes acts for an organization the
+ * principal is not a member of: checkout reserving a vendor's stock, where the
+ * organization comes from the **item** and a buyer's session carries none — and
+ * never will, since making a buyer a member of every vendor they buy from would
+ * be a far worse breach than the problem it solved.
+ *
+ * There is no third path, no fallback and no operator branch. A request
+ * satisfying neither guard simply never reaches a tenant handle
+ * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md);
+ * ADR 0012's operator crossing is a *different* mechanism — a person choosing an
+ * organization, which needs a human's permission, a time box and a `Crossing`
+ * record).
+ *
+ * ⚠️ **This guard reads no cookie and no `Authorization` header, and that is
+ * the design.** A route guarded here accepts the crossing token and nothing
+ * else: two accepted credentials on one route means the weaker one is the
+ * security level. It matters concretely — `super-admin` holds `*:*:*`, which
+ * matches every crossing permission, so a route that also took a session would
+ * be reachable by an operator's browser tab.
+ *
+ * Three checks, in this order, so nothing is revealed before fleet membership is
+ * proven:
+ *
+ * 1. the token, compared in constant time → `401`;
+ * 2. the permission, against `ServiceCrossingPolicyTag` → `403`. The token
+ *    proves the caller is the fleet; it does not say what the caller may do, and
+ *    fleet membership is not a capability;
+ * 3. the organization header, non-blank → `400`.
+ *
+ * **The recorded residual** (ADR 0023, not argued away here): a shared secret
+ * means any process holding it can name any organization. What bounds it is the
+ * permission above, the fact that only the slices needing it are configured with
+ * the key, and the request log. What would remove it is an RS256 service token
+ * carrying a scope claim, which is named work rather than a gap nobody noticed.
+ */
+export declare const requireServiceCrossing: (permission: Permission) => <A, E, R>(use: (organizationId: string) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, ServiceCrossingPolicyTag | HttpServerRequest.HttpServerRequest | ServiceCrossingTokenTag | R>;
+/**
+ * The same fleet check, for a participant that has **no organization to name**.
+ *
+ * ⚠️ **A platform-plane store is the whole difference.** `requireServiceCrossing`
+ * above ends with an organization header because it is about to resolve a tenant
+ * database handle from it, and a blank one there would read some other vendor's
+ * storage. order-service names one database at boot, so there is no handle to
+ * choose — and demanding a header nothing consumes would be theatre that a
+ * caller learns to satisfy with any value.
+ *
+ * What is unchanged, and is the part that matters: the token proves the caller
+ * is the fleet, the host's `ServiceCrossingPolicy` says what the fleet may do,
+ * and **no session is accepted**. A saga step is not a person's act — the buyer
+ * behind a checkout holds no grant over the order the coordinator is writing on
+ * their behalf, and accepting their session here would make the weaker
+ * credential the security level ([ADR 0052](../../../../../../docs/adr/0052-the-checkout-saga.md)).
+ *
+ * The recorded residual carries over verbatim: a shared secret means any process
+ * holding it can act, bounded by the permission and by which slices are
+ * configured with the key.
+ */
+export declare const requireCrossing: (permission: Permission) => <A, E, R>(route: Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, ServiceCrossingPolicyTag | HttpServerRequest.HttpServerRequest | ServiceCrossingTokenTag | R>;
+export {};
+//# sourceMappingURL=require-service-crossing.d.ts.map

package/dist/auth/require-service-crossing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-service-crossing.d.ts","sourceRoot":"","sources":["../../src/auth/require-service-crossing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,KAAK,UAAU,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;;AAEvD;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,4BAET;CAAG;AAgCvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,sBAAsB,GAChC,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,kNAwB7D,CAAC;AAEP;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,GACzB,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,kNAenC,CAAC"}

package/dist/auth/require-service-crossing.js

@@ -0,0 +1,161 @@
+import { timingSafeEqual } from 'node:crypto';
+import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
+import { ServiceCrossingPolicyTag } from '@entifix/authz';
+import { Context, Effect } from 'effect';
+/**
+ * The header carrying the crossing secret.
+ *
+ * ⚠️ **Deliberately not `x-service-token`.** That header is config-service's
+ * fleet lookup, and the two secrets are not comparable: one grants a
+ * configuration *read*, this one a tenant-data *write* for any organization the
+ * caller names. Sharing the header name is how a proxy configured to forward the
+ * fleet token ends up presenting it to a route that writes stock, and how a
+ * copy-pasted value looks right while being the wrong secret entirely
+ * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).
+ */ export const CROSSING_TOKEN_HEADER = 'x-crossing-token';
+/**
+ * The header naming the organization the caller is acting for.
+ *
+ * It rides beside the token rather than inside the request body because
+ * entities are organization-agnostic by rule — no `organizationId` member, no
+ * tenant filter — so there is nowhere in an entity envelope for it to live. A
+ * header also serves the crossings that carry no body at all (releasing a hold,
+ * converting one), which a body field would have needed a second convention for.
+ *
+ * On its own it grants **nothing**: it is only read after the token has proved
+ * the caller is the fleet, so the input the caller controls is never the input
+ * that authorizes.
+ */ export const ORGANIZATION_HEADER = 'x-organization-id';
+/**
+ * The crossing secret this service expects, provided at the composition root
+ * from its own configuration.
+ *
+ * A `Context.Tag` rather than an environment read, which is the difference from
+ * {@link requireServiceToken}: the value is a per-service secret held in
+ * config-service as an `is_secret` row, so it arrives through the same boot
+ * fetch as `mongo.uri` and can be rotated without redeploying a container.
+ */ export class ServiceCrossingTokenTag extends Context.Tag('ServiceCrossingTokenTag')() {
+}
+/** Constant-time comparison, so the secret cannot be recovered byte by byte. */ const matches = (provided, expected)=>{
+    if (provided === undefined) return false;
+    const left = Buffer.from(provided);
+    const right = Buffer.from(expected);
+    // `timingSafeEqual` throws on a length mismatch, so lengths are compared
+    // first — the length of a shared secret is not what protects it.
+    return left.length === right.length && timingSafeEqual(left, right);
+};
+const unauthenticated = HttpServerResponse.json({
+    error: 'unauthenticated',
+    code: 'unauthenticated'
+}, {
+    status: 401
+});
+const forbidden = (permission)=>HttpServerResponse.json({
+        error: 'forbidden',
+        code: 'forbidden',
+        permission
+    }, {
+        status: 403
+    });
+const organizationRequired = HttpServerResponse.json({
+    error: 'the crossing must name an organization',
+    code: 'invalidRequest',
+    detail: `${ORGANIZATION_HEADER} is required`
+}, {
+    status: 400
+});
+/**
+ * Guard a **service-to-service** tenant crossing: the second — and only other —
+ * way a request resolves the organization it acts for.
+ *
+ * The first is {@link requireOrganization}, which reads the session's
+ * `activeOrganizationId` and is the only *user-facing* resolution. This one
+ * exists because a platform-plane caller sometimes acts for an organization the
+ * principal is not a member of: checkout reserving a vendor's stock, where the
+ * organization comes from the **item** and a buyer's session carries none — and
+ * never will, since making a buyer a member of every vendor they buy from would
+ * be a far worse breach than the problem it solved.
+ *
+ * There is no third path, no fallback and no operator branch. A request
+ * satisfying neither guard simply never reaches a tenant handle
+ * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md);
+ * ADR 0012's operator crossing is a *different* mechanism — a person choosing an
+ * organization, which needs a human's permission, a time box and a `Crossing`
+ * record).
+ *
+ * ⚠️ **This guard reads no cookie and no `Authorization` header, and that is
+ * the design.** A route guarded here accepts the crossing token and nothing
+ * else: two accepted credentials on one route means the weaker one is the
+ * security level. It matters concretely — `super-admin` holds `*:*:*`, which
+ * matches every crossing permission, so a route that also took a session would
+ * be reachable by an operator's browser tab.
+ *
+ * Three checks, in this order, so nothing is revealed before fleet membership is
+ * proven:
+ *
+ * 1. the token, compared in constant time → `401`;
+ * 2. the permission, against `ServiceCrossingPolicyTag` → `403`. The token
+ *    proves the caller is the fleet; it does not say what the caller may do, and
+ *    fleet membership is not a capability;
+ * 3. the organization header, non-blank → `400`.
+ *
+ * **The recorded residual** (ADR 0023, not argued away here): a shared secret
+ * means any process holding it can name any organization. What bounds it is the
+ * permission above, the fact that only the slices needing it are configured with
+ * the key, and the request log. What would remove it is an RS256 service token
+ * carrying a scope claim, which is named work rather than a gap nobody noticed.
+ */ export const requireServiceCrossing = (permission)=>(use)=>// The return type is inferred rather than written out, for the reason
+        // `requireServiceToken` records: `HttpServerResponse.json` contributes an
+        // `HttpBodyError` to the failure channel, and spelling the type out while
+        // omitting it is what makes the declaration emit fail invisibly.
+        Effect.gen(function*() {
+            var _request_headers_ORGANIZATION_HEADER;
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            const expected = yield* ServiceCrossingTokenTag;
+            if (!matches(request.headers[CROSSING_TOKEN_HEADER], expected)) {
+                return yield* unauthenticated;
+            }
+            const crossing = yield* ServiceCrossingPolicyTag;
+            if (!crossing.allows(permission)) {
+                return yield* forbidden(permission);
+            }
+            const organizationId = (_request_headers_ORGANIZATION_HEADER = request.headers[ORGANIZATION_HEADER]) == null ? void 0 : _request_headers_ORGANIZATION_HEADER.trim();
+            if (organizationId === undefined || organizationId === '') {
+                return yield* organizationRequired;
+            }
+            return yield* use(organizationId);
+        });
+/**
+ * The same fleet check, for a participant that has **no organization to name**.
+ *
+ * ⚠️ **A platform-plane store is the whole difference.** `requireServiceCrossing`
+ * above ends with an organization header because it is about to resolve a tenant
+ * database handle from it, and a blank one there would read some other vendor's
+ * storage. order-service names one database at boot, so there is no handle to
+ * choose — and demanding a header nothing consumes would be theatre that a
+ * caller learns to satisfy with any value.
+ *
+ * What is unchanged, and is the part that matters: the token proves the caller
+ * is the fleet, the host's `ServiceCrossingPolicy` says what the fleet may do,
+ * and **no session is accepted**. A saga step is not a person's act — the buyer
+ * behind a checkout holds no grant over the order the coordinator is writing on
+ * their behalf, and accepting their session here would make the weaker
+ * credential the security level ([ADR 0052](../../../../../../docs/adr/0052-the-checkout-saga.md)).
+ *
+ * The recorded residual carries over verbatim: a shared secret means any process
+ * holding it can act, bounded by the permission and by which slices are
+ * configured with the key.
+ */ export const requireCrossing = (permission)=>(route)=>Effect.gen(function*() {
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            const expected = yield* ServiceCrossingTokenTag;
+            if (!matches(request.headers[CROSSING_TOKEN_HEADER], expected)) {
+                return yield* unauthenticated;
+            }
+            const crossing = yield* ServiceCrossingPolicyTag;
+            if (!crossing.allows(permission)) {
+                return yield* forbidden(permission);
+            }
+            return yield* route;
+        });
+
+//# sourceMappingURL=require-service-crossing.js.map