@entifix/service-shell 0.1.4 → 0.2.0

package/dist/auth/require-organization.d.ts

@@ -1,6 +1,6 @@
-import { HttpServerResponse } from '@effect/platform';
 import type { Permission } from '@entifix/authz';
 import { Effect } from 'effect';
+import { HttpServerResponse } from 'effect/http';
 import { type RequestPrincipal } from './require-principal.js';
 /**
  * Guard a **tenant-plane** handler: authenticate, check the permission, and
@@ -31,5 +31,5 @@ import { type RequestPrincipal } from './require-principal.js';
  * the other path honours a caller-named organization only *after* the caller has
  * proved it is the fleet.
  */
-export declare const requireOrganization: (permission: Permission) => <A, E, R>(use: (organizationId: string, principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, import("@entifix/authz").PolicyDecisionTag | import("@entifix/business").TokenServiceTag | import("@effect/platform/HttpServerRequest").HttpServerRequest | R>;
+export declare const requireOrganization: (permission: Permission) => <A, E, R>(use: (organizationId: string, principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("effect/http/HttpBody").HttpBodyError | E, import("@entifix/authz").PolicyDecisionTag | import("@entifix/business").TokenServiceTag | import("effect/http/HttpServerRequest").HttpServerRequest | R>;
 //# sourceMappingURL=require-organization.d.ts.map

package/dist/auth/require-organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-organization.d.ts","sourceRoot":"","sources":["../../src/auth/require-organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAkBhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,mBAAmB,GAC7B,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EACN,KAAK,CACH,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,gBAAgB,KACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,mRAa1B,CAAC"}
+{"version":3,"file":"require-organization.d.ts","sourceRoot":"","sources":["../../src/auth/require-organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAkBhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,mBAAmB,GAC7B,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EACN,KAAK,CACH,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,gBAAgB,KACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,yQAa1B,CAAC"}

package/dist/auth/require-organization.js

@@ -1,5 +1,5 @@
-import { HttpServerResponse } from '@effect/platform';
 import { Effect } from 'effect';
+import { HttpServerResponse } from 'effect/http';
 import { requirePermission } from './require-principal.js';
 /**
  * `409` rather than `403`: the caller is authenticated and permitted, but the

package/dist/auth/require-organization.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/require-organization.ts"],"sourcesContent":["import { HttpServerResponse } from '@effect/platform';\nimport type { Permission } from '@entifix/authz';\nimport { Effect } from 'effect';\n\nimport {\n  type RequestPrincipal,\n  requirePermission,\n} from './require-principal.js';\n\n/**\n * `409` rather than `403`: the caller is authenticated and permitted, but the\n * session names no organization, so there is no storage to read. An operator\n * hits this by design — crossing into a tenant is an explicit, audited\n * act-as-organization re-mint, never a widening of the default (ADR 0012) —\n * and a member of several organizations hits it before choosing one. The `code`\n * is a key in the shared `errors` catalog, so a client renders \"select an\n * organization\" instead of \"forbidden\" — a claim `@r10c/i18n-check` now holds\n * to, because for a while it was simply false and the code reached the browser\n * as its own literal text.\n */\nconst noOrganization = HttpServerResponse.json(\n  { error: 'no active organization', code: 'noActiveOrganization' },\n  { status: 409 },\n);\n\n/**\n * Guard a **tenant-plane** handler: authenticate, check the permission, and\n * require that the session names an organization.\n *\n * **This is the first of exactly two ways a request resolves the organization\n * it acts for, and the only *user-facing* one**\n * ([ADR 0006](../../../../../../docs/adr/0006-multitenancy-planes-and-tenant-storage.md)).\n * The second is {@link requireServiceCrossing}: an explicit `organizationId`\n * presented with a service token *and* a narrow route permission, for a\n * platform-plane caller acting for an organization it was handed rather than one\n * it picked\n * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).\n *\n * There is no third path, no fallback and no operator branch. A request\n * satisfying neither guard never reaches a tenant handle at all, which is what\n * keeps the most sensitive capability in the system from being the *absence* of\n * a condition.\n *\n * The organization is handed to the handler so it can resolve its own storage\n * through a `TenantDatabaseResolver`. Resolution happens **inside the request**\n * — the connection pool is a boot-time `Layer`, and a per-request `Layer` would\n * rebuild the pool per request.\n *\n * Here the value comes from the verified token and nowhere else. A route\n * parameter or a body field naming an organization would be caller-controlled,\n * which is the whole failure this guard exists to prevent — and is exactly why\n * the other path honours a caller-named organization only *after* the caller has\n * proved it is the fleet.\n */\nexport const requireOrganization =\n  (permission: Permission) =>\n  <A, E, R>(\n    use: (\n      organizationId: string,\n      principal: RequestPrincipal,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    requirePermission(permission)(principal =>\n      // `Effect.gen` rather than a ternary: the two branches have different\n      // success types, and a conditional expression would unify them against\n      // the first one instead of widening. `requirePrincipal` yields for the\n      // same reason.\n      Effect.gen(function* () {\n        if (principal.organizationId === undefined) {\n          return yield* noOrganization;\n        }\n        return yield* use(principal.organizationId, principal);\n      }),\n    );\n"],"names":["HttpServerResponse","Effect","requirePermission","noOrganization","json","error","code","status","requireOrganization","permission","use","principal","gen","organizationId","undefined"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,mBAAmB;AAEtD,SAASC,MAAM,QAAQ,SAAS;AAEhC,SAEEC,iBAAiB,QACZ,yBAAyB;AAEhC;;;;;;;;;;CAUC,GACD,MAAMC,iBAAiBH,mBAAmBI,IAAI,CAC5C;IAAEC,OAAO;IAA0BC,MAAM;AAAuB,GAChE;IAAEC,QAAQ;AAAI;AAGhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,MAAMC,sBACX,CAACC,aACD,CACEC,MAKAR,kBAAkBO,YAAYE,CAAAA,YAC5B,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,eAAe;YACfV,OAAOW,GAAG,CAAC;gBACT,IAAID,UAAUE,cAAc,KAAKC,WAAW;oBAC1C,OAAO,OAAOX;gBAChB;gBACA,OAAO,OAAOO,IAAIC,UAAUE,cAAc,EAAEF;YAC9C,IACA"}
+{"version":3,"sources":["../../src/auth/require-organization.ts"],"sourcesContent":["import type { Permission } from '@entifix/authz';\nimport { Effect } from 'effect';\nimport { HttpServerResponse } from 'effect/http';\n\nimport {\n  type RequestPrincipal,\n  requirePermission,\n} from './require-principal.js';\n\n/**\n * `409` rather than `403`: the caller is authenticated and permitted, but the\n * session names no organization, so there is no storage to read. An operator\n * hits this by design — crossing into a tenant is an explicit, audited\n * act-as-organization re-mint, never a widening of the default (ADR 0012) —\n * and a member of several organizations hits it before choosing one. The `code`\n * is a key in the shared `errors` catalog, so a client renders \"select an\n * organization\" instead of \"forbidden\" — a claim `@r10c/i18n-check` now holds\n * to, because for a while it was simply false and the code reached the browser\n * as its own literal text.\n */\nconst noOrganization = HttpServerResponse.json(\n  { error: 'no active organization', code: 'noActiveOrganization' },\n  { status: 409 },\n);\n\n/**\n * Guard a **tenant-plane** handler: authenticate, check the permission, and\n * require that the session names an organization.\n *\n * **This is the first of exactly two ways a request resolves the organization\n * it acts for, and the only *user-facing* one**\n * ([ADR 0006](../../../../../../docs/adr/0006-multitenancy-planes-and-tenant-storage.md)).\n * The second is {@link requireServiceCrossing}: an explicit `organizationId`\n * presented with a service token *and* a narrow route permission, for a\n * platform-plane caller acting for an organization it was handed rather than one\n * it picked\n * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).\n *\n * There is no third path, no fallback and no operator branch. A request\n * satisfying neither guard never reaches a tenant handle at all, which is what\n * keeps the most sensitive capability in the system from being the *absence* of\n * a condition.\n *\n * The organization is handed to the handler so it can resolve its own storage\n * through a `TenantDatabaseResolver`. Resolution happens **inside the request**\n * — the connection pool is a boot-time `Layer`, and a per-request `Layer` would\n * rebuild the pool per request.\n *\n * Here the value comes from the verified token and nowhere else. A route\n * parameter or a body field naming an organization would be caller-controlled,\n * which is the whole failure this guard exists to prevent — and is exactly why\n * the other path honours a caller-named organization only *after* the caller has\n * proved it is the fleet.\n */\nexport const requireOrganization =\n  (permission: Permission) =>\n  <A, E, R>(\n    use: (\n      organizationId: string,\n      principal: RequestPrincipal,\n    ) => Effect.Effect<A, E, R>,\n  ) =>\n    requirePermission(permission)(principal =>\n      // `Effect.gen` rather than a ternary: the two branches have different\n      // success types, and a conditional expression would unify them against\n      // the first one instead of widening. `requirePrincipal` yields for the\n      // same reason.\n      Effect.gen(function* () {\n        if (principal.organizationId === undefined) {\n          return yield* noOrganization;\n        }\n        return yield* use(principal.organizationId, principal);\n      }),\n    );\n"],"names":["Effect","HttpServerResponse","requirePermission","noOrganization","json","error","code","status","requireOrganization","permission","use","principal","gen","organizationId","undefined"],"mappings":"AACA,SAASA,MAAM,QAAQ,SAAS;AAChC,SAASC,kBAAkB,QAAQ,cAAc;AAEjD,SAEEC,iBAAiB,QACZ,yBAAyB;AAEhC;;;;;;;;;;CAUC,GACD,MAAMC,iBAAiBF,mBAAmBG,IAAI,CAC5C;IAAEC,OAAO;IAA0BC,MAAM;AAAuB,GAChE;IAAEC,QAAQ;AAAI;AAGhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,MAAMC,sBACX,CAACC,aACD,CACEC,MAKAR,kBAAkBO,YAAYE,CAAAA,YAC5B,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,eAAe;YACfX,OAAOY,GAAG,CAAC;gBACT,IAAID,UAAUE,cAAc,KAAKC,WAAW;oBAC1C,OAAO,OAAOX;gBAChB;gBACA,OAAO,OAAOO,IAAIC,UAAUE,cAAc,EAAEF;YAC9C,IACA"}

package/dist/auth/require-principal.d.ts

@@ -1,7 +1,7 @@
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { type Permission, PolicyDecisionTag } from '@entifix/authz';
 import { type TokenClaims, TokenServiceTag } from '@entifix/business';
 import { Effect } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 /**
  * The authenticated subject as a service sees it. Structurally identical to
  * `business-ts-authn`'s `Principal`, re-declared here so the shared shell does
@@ -56,7 +56,7 @@ export interface RequestPrincipal {
  * missing or invalid token is a `401`; the wrapped handler's own errors are
  * left intact.
  */
-export declare const requirePrincipal: <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, TokenServiceTag | HttpServerRequest.HttpServerRequest | R>;
+export declare const requirePrincipal: <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("effect/http/HttpBody").HttpBodyError | E, TokenServiceTag | HttpServerRequest.HttpServerRequest | R>;
 /**
  * Guard a handler behind a permission. Authenticates as above, then asks
  * {@link PolicyDecisionTag} whether this subject may perform the action — so
@@ -66,5 +66,5 @@ export declare const requirePrincipal: <A, E, R>(use: (principal: RequestPrincip
  * **This is the authorization boundary.** Filtering a nav menu or hiding a page
  * is presentation; a route that skips this guard is open regardless.
  */
-export declare const requirePermission: (permission: Permission) => <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, PolicyDecisionTag | TokenServiceTag | HttpServerRequest.HttpServerRequest | R>;
+export declare const requirePermission: (permission: Permission) => <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("effect/http/HttpBody").HttpBodyError | E, PolicyDecisionTag | TokenServiceTag | HttpServerRequest.HttpServerRequest | R>;
 //# sourceMappingURL=require-principal.d.ts.map

package/dist/auth/require-principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-principal.d.ts","sourceRoot":"","sources":["../../src/auth/require-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAEL,KAAK,UAAU,EACf,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AAExC;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAmED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACtC,KAAK,CAAC,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,+KAQ1D,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAC3B,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,mMAmBlE,CAAC"}
+{"version":3,"file":"require-principal.d.ts","sourceRoot":"","sources":["../../src/auth/require-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,UAAU,EACf,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAmED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACtC,KAAK,CAAC,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,0KAQ1D,CAAC;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAC3B,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,8LAmBlE,CAAC"}

package/dist/auth/require-principal.js

@@ -1,8 +1,8 @@
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { parsePermission, PolicyDecisionTag } from '@entifix/authz';
 import { TokenServiceTag } from '@entifix/business';
 import { ACCESS_COOKIE } from '@entifix/core';
 import { Effect, Option } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 /** Extract a bearer token from an `Authorization` header, if present. */ const bearerToken = (authorization)=>{
     if (authorization === undefined) {
         return undefined;

package/dist/auth/require-principal.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/require-principal.ts"],"sourcesContent":["import { HttpServerRequest, HttpServerResponse } from '@effect/platform';\nimport {\n  parsePermission,\n  type Permission,\n  PolicyDecisionTag,\n} from '@entifix/authz';\nimport { type TokenClaims, TokenServiceTag } from '@entifix/business';\nimport { ACCESS_COOKIE } from '@entifix/core';\nimport { Effect, Option } from 'effect';\n\n/**\n * The authenticated subject as a service sees it. Structurally identical to\n * `business-ts-authn`'s `Principal`, re-declared here so the shared shell does\n * not depend on a single domain package.\n */\nexport interface RequestPrincipal {\n  readonly userId: TokenClaims['userId'];\n  readonly subject: string;\n  readonly sessionId: string;\n  readonly roles: readonly string[];\n  /**\n   * The organization this request acts for — the storage routing key, absent\n   * for a caller with no tenant scope (a buyer, or an operator). Kept out of\n   * `attributes` deliberately: attributes are policy inputs, this decides which\n   * database a handler reads.\n   */\n  readonly organizationId?: string;\n  /**\n   * Which population the caller belongs to — buyer, vendor staff, or platform\n   * staff. Carried so a handler never has to infer it from an absent\n   * `organizationId`, which a buyer and an operator share.\n   *\n   * Context, not a grant: what the caller may *do* still comes from `roles`\n   * through {@link PolicyDecisionTag}.\n   */\n  readonly partyRole?: string;\n  /**\n   * The party behind the account — the `Individual` id, absent for an account\n   * with no party record.\n   *\n   * Same rule as the two fields above: it comes from the verified token and\n   * never from anything the caller sets on the request. It says *whose* records\n   * these are, which is what a route scoping a read to its caller needs; it\n   * says nothing about what may be done with them.\n   */\n  readonly partyId?: string;\n  /**\n   * When the verified token stops being valid, as a Unix timestamp in seconds.\n   *\n   * Every REST route is already bounded by it implicitly — verification is\n   * stateless, so the next call after expiry simply fails. A **held-open**\n   * response has no next call, so `GET /api/transaction/events` reads it and\n   * closes the connection there (ADR 0036). Absent when the token carries no\n   * `exp`, which a signed one always does; the guard is for the type, not for a\n   * case the fleet produces.\n   */\n  readonly expiresAt?: number;\n  readonly attributes: Readonly<Record<string, unknown>>;\n}\n\n/** Extract a bearer token from an `Authorization` header, if present. */\nconst bearerToken = (authorization: string | undefined): string | undefined => {\n  if (authorization === undefined) {\n    return undefined;\n  }\n  const [scheme, value] = authorization.split(' ');\n  return scheme?.toLowerCase() === 'bearer' ? value : undefined;\n};\n\n/** Rebuild the request principal from verified token claims. */\nconst claimsToPrincipal = (claims: TokenClaims): RequestPrincipal => ({\n  userId: claims.userId,\n  subject: claims.subject,\n  sessionId: claims.sessionId,\n  roles: claims.roles,\n  // The organization comes from the *verified* token and nowhere else — never\n  // from a route parameter, a query string or a body, all of which the caller\n  // controls. That is what makes tenant isolation a property of the session\n  // rather than of every handler remembering to check.\n  organizationId: claims.activeOrganizationId,\n  // Same rule, same reason: it comes from the verified token, never from\n  // anything the caller can set on the request.\n  partyRole: claims.partyRole,\n  partyId: claims.partyId,\n  // `TokenClaims` carries an index signature, so `exp` arrives as `unknown`\n  // even though jose always sets it — hence the guard rather than a cast.\n  expiresAt: typeof claims.exp === 'number' ? claims.exp : undefined,\n  // Rich/volatile attributes are not in the token; a handler that needs them\n  // reads the session store by `sessionId`.\n  attributes: {},\n});\n\n// `code` is a key in the shared `errors` catalog; `error` stays English for\n// logs. `permission` is deliberately still in the 403 — it says which grant was\n// missing, which is diagnostic, not a leak.\nconst unauthenticated = HttpServerResponse.json(\n  { error: 'unauthenticated', code: 'unauthenticated' },\n  { status: 401 },\n);\n\nconst forbidden = (permission: Permission) =>\n  HttpServerResponse.json(\n    { error: 'forbidden', code: 'forbidden', permission },\n    { status: 403 },\n  );\n\n/**\n * Resolve the caller's principal from the request, or `None`. Reads the token\n * from the `entifix_at` cookie (the Next app forwards it) or an\n * `Authorization: Bearer` header and verifies it statelessly via\n * {@link TokenServiceTag} — no store round trip on the hot path.\n */\nconst resolvePrincipal = Effect.gen(function* () {\n  const req = yield* HttpServerRequest.HttpServerRequest;\n  const token =\n    req.cookies[ACCESS_COOKIE] ?? bearerToken(req.headers['authorization']);\n  if (token === undefined) {\n    return Option.none<RequestPrincipal>();\n  }\n\n  const tokens = yield* TokenServiceTag;\n  const claims = yield* tokens.verify(token).pipe(Effect.option);\n  return Option.map(claims, claimsToPrincipal);\n});\n\n/**\n * Guard a handler behind a valid access token — authentication only. Any\n * missing or invalid token is a `401`; the wrapped handler's own errors are\n * left intact.\n */\nexport const requirePrincipal = <A, E, R>(\n  use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const principal = yield* resolvePrincipal;\n    if (Option.isNone(principal)) {\n      return yield* unauthenticated;\n    }\n    return yield* use(principal.value);\n  });\n\n/**\n * Guard a handler behind a permission. Authenticates as above, then asks\n * {@link PolicyDecisionTag} whether this subject may perform the action — so\n * the two failure modes stay distinguishable: `401` means \"sign in\", `403`\n * means \"signed in, not allowed\".\n *\n * **This is the authorization boundary.** Filtering a nav menu or hiding a page\n * is presentation; a route that skips this guard is open regardless.\n */\nexport const requirePermission =\n  (permission: Permission) =>\n  <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) =>\n    Effect.gen(function* () {\n      const principal = yield* resolvePrincipal;\n      if (Option.isNone(principal)) {\n        return yield* unauthenticated;\n      }\n\n      const { resource, action } = parsePermission(permission);\n      const policy = yield* PolicyDecisionTag;\n      const allowed = policy.decide({\n        subject: { roles: principal.value.roles },\n        resource,\n        action,\n      });\n      if (!allowed) {\n        return yield* forbidden(permission);\n      }\n\n      return yield* use(principal.value);\n    });\n"],"names":["HttpServerRequest","HttpServerResponse","parsePermission","PolicyDecisionTag","TokenServiceTag","ACCESS_COOKIE","Effect","Option","bearerToken","authorization","undefined","scheme","value","split","toLowerCase","claimsToPrincipal","claims","userId","subject","sessionId","roles","organizationId","activeOrganizationId","partyRole","partyId","expiresAt","exp","attributes","unauthenticated","json","error","code","status","forbidden","permission","resolvePrincipal","gen","req","token","cookies","headers","none","tokens","verify","pipe","option","map","requirePrincipal","use","principal","isNone","requirePermission","resource","action","policy","allowed","decide"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,kBAAkB,QAAQ,mBAAmB;AACzE,SACEC,eAAe,EAEfC,iBAAiB,QACZ,iBAAiB;AACxB,SAA2BC,eAAe,QAAQ,oBAAoB;AACtE,SAASC,aAAa,QAAQ,gBAAgB;AAC9C,SAASC,MAAM,EAAEC,MAAM,QAAQ,SAAS;AAoDxC,uEAAuE,GACvE,MAAMC,cAAc,CAACC;IACnB,IAAIA,kBAAkBC,WAAW;QAC/B,OAAOA;IACT;IACA,MAAM,CAACC,QAAQC,MAAM,GAAGH,cAAcI,KAAK,CAAC;IAC5C,OAAOF,CAAAA,0BAAAA,OAAQG,WAAW,QAAO,WAAWF,QAAQF;AACtD;AAEA,8DAA8D,GAC9D,MAAMK,oBAAoB,CAACC,SAA2C,CAAA;QACpEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO;QACvBC,WAAWH,OAAOG,SAAS;QAC3BC,OAAOJ,OAAOI,KAAK;QACnB,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,qDAAqD;QACrDC,gBAAgBL,OAAOM,oBAAoB;QAC3C,uEAAuE;QACvE,8CAA8C;QAC9CC,WAAWP,OAAOO,SAAS;QAC3BC,SAASR,OAAOQ,OAAO;QACvB,0EAA0E;QAC1E,wEAAwE;QACxEC,WAAW,OAAOT,OAAOU,GAAG,KAAK,WAAWV,OAAOU,GAAG,GAAGhB;QACzD,2EAA2E;QAC3E,0CAA0C;QAC1CiB,YAAY,CAAC;IACf,CAAA;AAEA,4EAA4E;AAC5E,gFAAgF;AAChF,4CAA4C;AAC5C,MAAMC,kBAAkB3B,mBAAmB4B,IAAI,CAC7C;IAAEC,OAAO;IAAmBC,MAAM;AAAkB,GACpD;IAAEC,QAAQ;AAAI;AAGhB,MAAMC,YAAY,CAACC,aACjBjC,mBAAmB4B,IAAI,CACrB;QAAEC,OAAO;QAAaC,MAAM;QAAaG;IAAW,GACpD;QAAEF,QAAQ;IAAI;AAGlB;;;;;CAKC,GACD,MAAMG,mBAAmB7B,OAAO8B,GAAG,CAAC;QAGhCC;IAFF,MAAMA,MAAM,OAAOrC,kBAAkBA,iBAAiB;IACtD,MAAMsC,SACJD,6BAAAA,IAAIE,OAAO,CAAClC,cAAc,YAA1BgC,6BAA8B7B,YAAY6B,IAAIG,OAAO,CAAC,gBAAgB;IACxE,IAAIF,UAAU5B,WAAW;QACvB,OAAOH,OAAOkC,IAAI;IACpB;IAEA,MAAMC,SAAS,OAAOtC;IACtB,MAAMY,SAAS,OAAO0B,OAAOC,MAAM,CAACL,OAAOM,IAAI,CAACtC,OAAOuC,MAAM;IAC7D,OAAOtC,OAAOuC,GAAG,CAAC9B,QAAQD;AAC5B;AAEA;;;;CAIC,GACD,OAAO,MAAMgC,mBAAmB,CAC9BC,MAEA1C,OAAO8B,GAAG,CAAC;QACT,MAAMa,YAAY,OAAOd;QACzB,IAAI5B,OAAO2C,MAAM,CAACD,YAAY;YAC5B,OAAO,OAAOrB;QAChB;QACA,OAAO,OAAOoB,IAAIC,UAAUrC,KAAK;IACnC,GAAG;AAEL;;;;;;;;CAQC,GACD,OAAO,MAAMuC,oBACX,CAACjB,aACD,CAAUc,MACR1C,OAAO8B,GAAG,CAAC;YACT,MAAMa,YAAY,OAAOd;YACzB,IAAI5B,OAAO2C,MAAM,CAACD,YAAY;gBAC5B,OAAO,OAAOrB;YAChB;YAEA,MAAM,EAAEwB,QAAQ,EAAEC,MAAM,EAAE,GAAGnD,gBAAgBgC;YAC7C,MAAMoB,SAAS,OAAOnD;YACtB,MAAMoD,UAAUD,OAAOE,MAAM,CAAC;gBAC5BtC,SAAS;oBAAEE,OAAO6B,UAAUrC,KAAK,CAACQ,KAAK;gBAAC;gBACxCgC;gBACAC;YACF;YACA,IAAI,CAACE,SAAS;gBACZ,OAAO,OAAOtB,UAAUC;YAC1B;YAEA,OAAO,OAAOc,IAAIC,UAAUrC,KAAK;QACnC,GAAG"}
+{"version":3,"sources":["../../src/auth/require-principal.ts"],"sourcesContent":["import {\n  parsePermission,\n  type Permission,\n  PolicyDecisionTag,\n} from '@entifix/authz';\nimport { type TokenClaims, TokenServiceTag } from '@entifix/business';\nimport { ACCESS_COOKIE } from '@entifix/core';\nimport { Effect, Option } from 'effect';\nimport { HttpServerRequest, HttpServerResponse } from 'effect/http';\n\n/**\n * The authenticated subject as a service sees it. Structurally identical to\n * `business-ts-authn`'s `Principal`, re-declared here so the shared shell does\n * not depend on a single domain package.\n */\nexport interface RequestPrincipal {\n  readonly userId: TokenClaims['userId'];\n  readonly subject: string;\n  readonly sessionId: string;\n  readonly roles: readonly string[];\n  /**\n   * The organization this request acts for — the storage routing key, absent\n   * for a caller with no tenant scope (a buyer, or an operator). Kept out of\n   * `attributes` deliberately: attributes are policy inputs, this decides which\n   * database a handler reads.\n   */\n  readonly organizationId?: string;\n  /**\n   * Which population the caller belongs to — buyer, vendor staff, or platform\n   * staff. Carried so a handler never has to infer it from an absent\n   * `organizationId`, which a buyer and an operator share.\n   *\n   * Context, not a grant: what the caller may *do* still comes from `roles`\n   * through {@link PolicyDecisionTag}.\n   */\n  readonly partyRole?: string;\n  /**\n   * The party behind the account — the `Individual` id, absent for an account\n   * with no party record.\n   *\n   * Same rule as the two fields above: it comes from the verified token and\n   * never from anything the caller sets on the request. It says *whose* records\n   * these are, which is what a route scoping a read to its caller needs; it\n   * says nothing about what may be done with them.\n   */\n  readonly partyId?: string;\n  /**\n   * When the verified token stops being valid, as a Unix timestamp in seconds.\n   *\n   * Every REST route is already bounded by it implicitly — verification is\n   * stateless, so the next call after expiry simply fails. A **held-open**\n   * response has no next call, so `GET /api/transaction/events` reads it and\n   * closes the connection there (ADR 0036). Absent when the token carries no\n   * `exp`, which a signed one always does; the guard is for the type, not for a\n   * case the fleet produces.\n   */\n  readonly expiresAt?: number;\n  readonly attributes: Readonly<Record<string, unknown>>;\n}\n\n/** Extract a bearer token from an `Authorization` header, if present. */\nconst bearerToken = (authorization: string | undefined): string | undefined => {\n  if (authorization === undefined) {\n    return undefined;\n  }\n  const [scheme, value] = authorization.split(' ');\n  return scheme?.toLowerCase() === 'bearer' ? value : undefined;\n};\n\n/** Rebuild the request principal from verified token claims. */\nconst claimsToPrincipal = (claims: TokenClaims): RequestPrincipal => ({\n  userId: claims.userId,\n  subject: claims.subject,\n  sessionId: claims.sessionId,\n  roles: claims.roles,\n  // The organization comes from the *verified* token and nowhere else — never\n  // from a route parameter, a query string or a body, all of which the caller\n  // controls. That is what makes tenant isolation a property of the session\n  // rather than of every handler remembering to check.\n  organizationId: claims.activeOrganizationId,\n  // Same rule, same reason: it comes from the verified token, never from\n  // anything the caller can set on the request.\n  partyRole: claims.partyRole,\n  partyId: claims.partyId,\n  // `TokenClaims` carries an index signature, so `exp` arrives as `unknown`\n  // even though jose always sets it — hence the guard rather than a cast.\n  expiresAt: typeof claims.exp === 'number' ? claims.exp : undefined,\n  // Rich/volatile attributes are not in the token; a handler that needs them\n  // reads the session store by `sessionId`.\n  attributes: {},\n});\n\n// `code` is a key in the shared `errors` catalog; `error` stays English for\n// logs. `permission` is deliberately still in the 403 — it says which grant was\n// missing, which is diagnostic, not a leak.\nconst unauthenticated = HttpServerResponse.json(\n  { error: 'unauthenticated', code: 'unauthenticated' },\n  { status: 401 },\n);\n\nconst forbidden = (permission: Permission) =>\n  HttpServerResponse.json(\n    { error: 'forbidden', code: 'forbidden', permission },\n    { status: 403 },\n  );\n\n/**\n * Resolve the caller's principal from the request, or `None`. Reads the token\n * from the `entifix_at` cookie (the Next app forwards it) or an\n * `Authorization: Bearer` header and verifies it statelessly via\n * {@link TokenServiceTag} — no store round trip on the hot path.\n */\nconst resolvePrincipal = Effect.gen(function* () {\n  const req = yield* HttpServerRequest.HttpServerRequest;\n  const token =\n    req.cookies[ACCESS_COOKIE] ?? bearerToken(req.headers['authorization']);\n  if (token === undefined) {\n    return Option.none<RequestPrincipal>();\n  }\n\n  const tokens = yield* TokenServiceTag;\n  const claims = yield* tokens.verify(token).pipe(Effect.option);\n  return Option.map(claims, claimsToPrincipal);\n});\n\n/**\n * Guard a handler behind a valid access token — authentication only. Any\n * missing or invalid token is a `401`; the wrapped handler's own errors are\n * left intact.\n */\nexport const requirePrincipal = <A, E, R>(\n  use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const principal = yield* resolvePrincipal;\n    if (Option.isNone(principal)) {\n      return yield* unauthenticated;\n    }\n    return yield* use(principal.value);\n  });\n\n/**\n * Guard a handler behind a permission. Authenticates as above, then asks\n * {@link PolicyDecisionTag} whether this subject may perform the action — so\n * the two failure modes stay distinguishable: `401` means \"sign in\", `403`\n * means \"signed in, not allowed\".\n *\n * **This is the authorization boundary.** Filtering a nav menu or hiding a page\n * is presentation; a route that skips this guard is open regardless.\n */\nexport const requirePermission =\n  (permission: Permission) =>\n  <A, E, R>(use: (principal: RequestPrincipal) => Effect.Effect<A, E, R>) =>\n    Effect.gen(function* () {\n      const principal = yield* resolvePrincipal;\n      if (Option.isNone(principal)) {\n        return yield* unauthenticated;\n      }\n\n      const { resource, action } = parsePermission(permission);\n      const policy = yield* PolicyDecisionTag;\n      const allowed = policy.decide({\n        subject: { roles: principal.value.roles },\n        resource,\n        action,\n      });\n      if (!allowed) {\n        return yield* forbidden(permission);\n      }\n\n      return yield* use(principal.value);\n    });\n"],"names":["parsePermission","PolicyDecisionTag","TokenServiceTag","ACCESS_COOKIE","Effect","Option","HttpServerRequest","HttpServerResponse","bearerToken","authorization","undefined","scheme","value","split","toLowerCase","claimsToPrincipal","claims","userId","subject","sessionId","roles","organizationId","activeOrganizationId","partyRole","partyId","expiresAt","exp","attributes","unauthenticated","json","error","code","status","forbidden","permission","resolvePrincipal","gen","req","token","cookies","headers","none","tokens","verify","pipe","option","map","requirePrincipal","use","principal","isNone","requirePermission","resource","action","policy","allowed","decide"],"mappings":"AAAA,SACEA,eAAe,EAEfC,iBAAiB,QACZ,iBAAiB;AACxB,SAA2BC,eAAe,QAAQ,oBAAoB;AACtE,SAASC,aAAa,QAAQ,gBAAgB;AAC9C,SAASC,MAAM,EAAEC,MAAM,QAAQ,SAAS;AACxC,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,cAAc;AAoDpE,uEAAuE,GACvE,MAAMC,cAAc,CAACC;IACnB,IAAIA,kBAAkBC,WAAW;QAC/B,OAAOA;IACT;IACA,MAAM,CAACC,QAAQC,MAAM,GAAGH,cAAcI,KAAK,CAAC;IAC5C,OAAOF,CAAAA,0BAAAA,OAAQG,WAAW,QAAO,WAAWF,QAAQF;AACtD;AAEA,8DAA8D,GAC9D,MAAMK,oBAAoB,CAACC,SAA2C,CAAA;QACpEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO;QACvBC,WAAWH,OAAOG,SAAS;QAC3BC,OAAOJ,OAAOI,KAAK;QACnB,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,qDAAqD;QACrDC,gBAAgBL,OAAOM,oBAAoB;QAC3C,uEAAuE;QACvE,8CAA8C;QAC9CC,WAAWP,OAAOO,SAAS;QAC3BC,SAASR,OAAOQ,OAAO;QACvB,0EAA0E;QAC1E,wEAAwE;QACxEC,WAAW,OAAOT,OAAOU,GAAG,KAAK,WAAWV,OAAOU,GAAG,GAAGhB;QACzD,2EAA2E;QAC3E,0CAA0C;QAC1CiB,YAAY,CAAC;IACf,CAAA;AAEA,4EAA4E;AAC5E,gFAAgF;AAChF,4CAA4C;AAC5C,MAAMC,kBAAkBrB,mBAAmBsB,IAAI,CAC7C;IAAEC,OAAO;IAAmBC,MAAM;AAAkB,GACpD;IAAEC,QAAQ;AAAI;AAGhB,MAAMC,YAAY,CAACC,aACjB3B,mBAAmBsB,IAAI,CACrB;QAAEC,OAAO;QAAaC,MAAM;QAAaG;IAAW,GACpD;QAAEF,QAAQ;IAAI;AAGlB;;;;;CAKC,GACD,MAAMG,mBAAmB/B,OAAOgC,GAAG,CAAC;QAGhCC;IAFF,MAAMA,MAAM,OAAO/B,kBAAkBA,iBAAiB;IACtD,MAAMgC,SACJD,6BAAAA,IAAIE,OAAO,CAACpC,cAAc,YAA1BkC,6BAA8B7B,YAAY6B,IAAIG,OAAO,CAAC,gBAAgB;IACxE,IAAIF,UAAU5B,WAAW;QACvB,OAAOL,OAAOoC,IAAI;IACpB;IAEA,MAAMC,SAAS,OAAOxC;IACtB,MAAMc,SAAS,OAAO0B,OAAOC,MAAM,CAACL,OAAOM,IAAI,CAACxC,OAAOyC,MAAM;IAC7D,OAAOxC,OAAOyC,GAAG,CAAC9B,QAAQD;AAC5B;AAEA;;;;CAIC,GACD,OAAO,MAAMgC,mBAAmB,CAC9BC,MAEA5C,OAAOgC,GAAG,CAAC;QACT,MAAMa,YAAY,OAAOd;QACzB,IAAI9B,OAAO6C,MAAM,CAACD,YAAY;YAC5B,OAAO,OAAOrB;QAChB;QACA,OAAO,OAAOoB,IAAIC,UAAUrC,KAAK;IACnC,GAAG;AAEL;;;;;;;;CAQC,GACD,OAAO,MAAMuC,oBACX,CAACjB,aACD,CAAUc,MACR5C,OAAOgC,GAAG,CAAC;YACT,MAAMa,YAAY,OAAOd;YACzB,IAAI9B,OAAO6C,MAAM,CAACD,YAAY;gBAC5B,OAAO,OAAOrB;YAChB;YAEA,MAAM,EAAEwB,QAAQ,EAAEC,MAAM,EAAE,GAAGrD,gBAAgBkC;YAC7C,MAAMoB,SAAS,OAAOrD;YACtB,MAAMsD,UAAUD,OAAOE,MAAM,CAAC;gBAC5BtC,SAAS;oBAAEE,OAAO6B,UAAUrC,KAAK,CAACQ,KAAK;gBAAC;gBACxCgC;gBACAC;YACF;YACA,IAAI,CAACE,SAAS;gBACZ,OAAO,OAAOtB,UAAUC;YAC1B;YAEA,OAAO,OAAOc,IAAIC,UAAUrC,KAAK;QACnC,GAAG"}

package/dist/auth/require-service-crossing.d.ts

@@ -1,6 +1,6 @@
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { type Permission, ServiceCrossingPolicyTag } from '@entifix/authz';
 import { Context, Effect } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 /**
  * The header carrying the crossing secret.
  *
@@ -27,7 +27,7 @@ export declare const CROSSING_TOKEN_HEADER = "x-crossing-token";
  * that authorizes.
  */
 export declare const ORGANIZATION_HEADER = "x-organization-id";
-declare const ServiceCrossingTokenTag_base: Context.TagClass<ServiceCrossingTokenTag, "ServiceCrossingTokenTag", string>;
+declare const ServiceCrossingTokenTag_base: Context.ServiceClass<ServiceCrossingTokenTag, "ServiceCrossingTokenTag", string>;
 /**
  * The crossing secret this service expects, provided at the composition root
  * from its own configuration.
@@ -80,7 +80,7 @@ export declare class ServiceCrossingTokenTag extends ServiceCrossingTokenTag_bas
  * the key, and the request log. What would remove it is an RS256 service token
  * carrying a scope claim, which is named work rather than a gap nobody noticed.
  */
-export declare const requireServiceCrossing: (permission: Permission) => <A, E, R>(use: (organizationId: string) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, ServiceCrossingPolicyTag | HttpServerRequest.HttpServerRequest | ServiceCrossingTokenTag | R>;
+export declare const requireServiceCrossing: (permission: Permission) => <A, E, R>(use: (organizationId: string) => Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("effect/http/HttpBody").HttpBodyError | E, ServiceCrossingPolicyTag | HttpServerRequest.HttpServerRequest | ServiceCrossingTokenTag | R>;
 /**
  * The same fleet check, for a participant that has **no organization to name**.
  *
@@ -102,6 +102,6 @@ export declare const requireServiceCrossing: (permission: Permission) => <A, E,
  * holding it can act, bounded by the permission and by which slices are
  * configured with the key.
  */
-export declare const requireCrossing: (permission: Permission) => <A, E, R>(route: Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, ServiceCrossingPolicyTag | HttpServerRequest.HttpServerRequest | ServiceCrossingTokenTag | R>;
+export declare const requireCrossing: (permission: Permission) => <A, E, R>(route: Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("effect/http/HttpBody").HttpBodyError | E, ServiceCrossingPolicyTag | HttpServerRequest.HttpServerRequest | ServiceCrossingTokenTag | R>;
 export {};
 //# sourceMappingURL=require-service-crossing.d.ts.map

package/dist/auth/require-service-crossing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-service-crossing.d.ts","sourceRoot":"","sources":["../../src/auth/require-service-crossing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,KAAK,UAAU,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;;AAEvD;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,4BAET;CAAG;AAgCvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,sBAAsB,GAChC,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,kNAwB7D,CAAC;AAEP;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,GACzB,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,kNAenC,CAAC"}
+{"version":3,"file":"require-service-crossing.d.ts","sourceRoot":"","sources":["../../src/auth/require-service-crossing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,UAAU,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;;AAEvD;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,4BAGf;CAAG;AAgCjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,sBAAsB,GAChC,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,6MAwB7D,CAAC;AAEP;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,GACzB,YAAY,UAAU,MACtB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,6MAenC,CAAC"}

package/dist/auth/require-service-crossing.js

@@ -1,7 +1,7 @@
 import { timingSafeEqual } from 'node:crypto';
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { ServiceCrossingPolicyTag } from '@entifix/authz';
 import { Context, Effect } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 /**
  * The header carrying the crossing secret.
  *
@@ -34,7 +34,7 @@ import { Context, Effect } from 'effect';
  * {@link requireServiceToken}: the value is a per-service secret held in
  * config-service as an `is_secret` row, so it arrives through the same boot
  * fetch as `mongo.uri` and can be rotated without redeploying a container.
- */ export class ServiceCrossingTokenTag extends Context.Tag('ServiceCrossingTokenTag')() {
+ */ export class ServiceCrossingTokenTag extends Context.Service()('ServiceCrossingTokenTag') {
 }
 /** Constant-time comparison, so the secret cannot be recovered byte by byte. */ const matches = (provided, expected)=>{
     if (provided === undefined) return false;

package/dist/auth/require-service-crossing.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/require-service-crossing.ts"],"sourcesContent":["import { timingSafeEqual } from 'node:crypto';\n\nimport { HttpServerRequest, HttpServerResponse } from '@effect/platform';\nimport { type Permission, ServiceCrossingPolicyTag } from '@entifix/authz';\nimport { Context, Effect } from 'effect';\n\n/**\n * The header carrying the crossing secret.\n *\n * ⚠️ **Deliberately not `x-service-token`.** That header is config-service's\n * fleet lookup, and the two secrets are not comparable: one grants a\n * configuration *read*, this one a tenant-data *write* for any organization the\n * caller names. Sharing the header name is how a proxy configured to forward the\n * fleet token ends up presenting it to a route that writes stock, and how a\n * copy-pasted value looks right while being the wrong secret entirely\n * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).\n */\nexport const CROSSING_TOKEN_HEADER = 'x-crossing-token';\n\n/**\n * The header naming the organization the caller is acting for.\n *\n * It rides beside the token rather than inside the request body because\n * entities are organization-agnostic by rule — no `organizationId` member, no\n * tenant filter — so there is nowhere in an entity envelope for it to live. A\n * header also serves the crossings that carry no body at all (releasing a hold,\n * converting one), which a body field would have needed a second convention for.\n *\n * On its own it grants **nothing**: it is only read after the token has proved\n * the caller is the fleet, so the input the caller controls is never the input\n * that authorizes.\n */\nexport const ORGANIZATION_HEADER = 'x-organization-id';\n\n/**\n * The crossing secret this service expects, provided at the composition root\n * from its own configuration.\n *\n * A `Context.Tag` rather than an environment read, which is the difference from\n * {@link requireServiceToken}: the value is a per-service secret held in\n * config-service as an `is_secret` row, so it arrives through the same boot\n * fetch as `mongo.uri` and can be rotated without redeploying a container.\n */\nexport class ServiceCrossingTokenTag extends Context.Tag(\n  'ServiceCrossingTokenTag',\n)<ServiceCrossingTokenTag, string>() {}\n\n/** Constant-time comparison, so the secret cannot be recovered byte by byte. */\nconst matches = (provided: string | undefined, expected: string): boolean => {\n  if (provided === undefined) return false;\n  const left = Buffer.from(provided);\n  const right = Buffer.from(expected);\n  // `timingSafeEqual` throws on a length mismatch, so lengths are compared\n  // first — the length of a shared secret is not what protects it.\n  return left.length === right.length && timingSafeEqual(left, right);\n};\n\nconst unauthenticated = HttpServerResponse.json(\n  { error: 'unauthenticated', code: 'unauthenticated' },\n  { status: 401 },\n);\n\nconst forbidden = (permission: Permission) =>\n  HttpServerResponse.json(\n    { error: 'forbidden', code: 'forbidden', permission },\n    { status: 403 },\n  );\n\nconst organizationRequired = HttpServerResponse.json(\n  {\n    error: 'the crossing must name an organization',\n    code: 'invalidRequest',\n    detail: `${ORGANIZATION_HEADER} is required`,\n  },\n  { status: 400 },\n);\n\n/**\n * Guard a **service-to-service** tenant crossing: the second — and only other —\n * way a request resolves the organization it acts for.\n *\n * The first is {@link requireOrganization}, which reads the session's\n * `activeOrganizationId` and is the only *user-facing* resolution. This one\n * exists because a platform-plane caller sometimes acts for an organization the\n * principal is not a member of: checkout reserving a vendor's stock, where the\n * organization comes from the **item** and a buyer's session carries none — and\n * never will, since making a buyer a member of every vendor they buy from would\n * be a far worse breach than the problem it solved.\n *\n * There is no third path, no fallback and no operator branch. A request\n * satisfying neither guard simply never reaches a tenant handle\n * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md);\n * ADR 0012's operator crossing is a *different* mechanism — a person choosing an\n * organization, which needs a human's permission, a time box and a `Crossing`\n * record).\n *\n * ⚠️ **This guard reads no cookie and no `Authorization` header, and that is\n * the design.** A route guarded here accepts the crossing token and nothing\n * else: two accepted credentials on one route means the weaker one is the\n * security level. It matters concretely — `super-admin` holds `*:*:*`, which\n * matches every crossing permission, so a route that also took a session would\n * be reachable by an operator's browser tab.\n *\n * Three checks, in this order, so nothing is revealed before fleet membership is\n * proven:\n *\n * 1. the token, compared in constant time → `401`;\n * 2. the permission, against `ServiceCrossingPolicyTag` → `403`. The token\n *    proves the caller is the fleet; it does not say what the caller may do, and\n *    fleet membership is not a capability;\n * 3. the organization header, non-blank → `400`.\n *\n * **The recorded residual** (ADR 0023, not argued away here): a shared secret\n * means any process holding it can name any organization. What bounds it is the\n * permission above, the fact that only the slices needing it are configured with\n * the key, and the request log. What would remove it is an RS256 service token\n * carrying a scope claim, which is named work rather than a gap nobody noticed.\n */\nexport const requireServiceCrossing =\n  (permission: Permission) =>\n  <A, E, R>(use: (organizationId: string) => Effect.Effect<A, E, R>) =>\n    // The return type is inferred rather than written out, for the reason\n    // `requireServiceToken` records: `HttpServerResponse.json` contributes an\n    // `HttpBodyError` to the failure channel, and spelling the type out while\n    // omitting it is what makes the declaration emit fail invisibly.\n    Effect.gen(function* () {\n      const request = yield* HttpServerRequest.HttpServerRequest;\n      const expected = yield* ServiceCrossingTokenTag;\n\n      if (!matches(request.headers[CROSSING_TOKEN_HEADER], expected)) {\n        return yield* unauthenticated;\n      }\n\n      const crossing = yield* ServiceCrossingPolicyTag;\n      if (!crossing.allows(permission)) {\n        return yield* forbidden(permission);\n      }\n\n      const organizationId = request.headers[ORGANIZATION_HEADER]?.trim();\n      if (organizationId === undefined || organizationId === '') {\n        return yield* organizationRequired;\n      }\n\n      return yield* use(organizationId);\n    });\n\n/**\n * The same fleet check, for a participant that has **no organization to name**.\n *\n * ⚠️ **A platform-plane store is the whole difference.** `requireServiceCrossing`\n * above ends with an organization header because it is about to resolve a tenant\n * database handle from it, and a blank one there would read some other vendor's\n * storage. order-service names one database at boot, so there is no handle to\n * choose — and demanding a header nothing consumes would be theatre that a\n * caller learns to satisfy with any value.\n *\n * What is unchanged, and is the part that matters: the token proves the caller\n * is the fleet, the host's `ServiceCrossingPolicy` says what the fleet may do,\n * and **no session is accepted**. A saga step is not a person's act — the buyer\n * behind a checkout holds no grant over the order the coordinator is writing on\n * their behalf, and accepting their session here would make the weaker\n * credential the security level ([ADR 0052](../../../../../../docs/adr/0052-the-checkout-saga.md)).\n *\n * The recorded residual carries over verbatim: a shared secret means any process\n * holding it can act, bounded by the permission and by which slices are\n * configured with the key.\n */\nexport const requireCrossing =\n  (permission: Permission) =>\n  <A, E, R>(route: Effect.Effect<A, E, R>) =>\n    Effect.gen(function* () {\n      const request = yield* HttpServerRequest.HttpServerRequest;\n      const expected = yield* ServiceCrossingTokenTag;\n\n      if (!matches(request.headers[CROSSING_TOKEN_HEADER], expected)) {\n        return yield* unauthenticated;\n      }\n\n      const crossing = yield* ServiceCrossingPolicyTag;\n      if (!crossing.allows(permission)) {\n        return yield* forbidden(permission);\n      }\n\n      return yield* route;\n    });\n"],"names":["timingSafeEqual","HttpServerRequest","HttpServerResponse","ServiceCrossingPolicyTag","Context","Effect","CROSSING_TOKEN_HEADER","ORGANIZATION_HEADER","ServiceCrossingTokenTag","Tag","matches","provided","expected","undefined","left","Buffer","from","right","length","unauthenticated","json","error","code","status","forbidden","permission","organizationRequired","detail","requireServiceCrossing","use","gen","request","headers","crossing","allows","organizationId","trim","requireCrossing","route"],"mappings":"AAAA,SAASA,eAAe,QAAQ,cAAc;AAE9C,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,mBAAmB;AACzE,SAA0BC,wBAAwB,QAAQ,iBAAiB;AAC3E,SAASC,OAAO,EAAEC,MAAM,QAAQ,SAAS;AAEzC;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,wBAAwB,mBAAmB;AAExD;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,sBAAsB,oBAAoB;AAEvD;;;;;;;;CAQC,GACD,OAAO,MAAMC,gCAAgCJ,QAAQK,GAAG,CACtD;AACoC;AAEtC,8EAA8E,GAC9E,MAAMC,UAAU,CAACC,UAA8BC;IAC7C,IAAID,aAAaE,WAAW,OAAO;IACnC,MAAMC,OAAOC,OAAOC,IAAI,CAACL;IACzB,MAAMM,QAAQF,OAAOC,IAAI,CAACJ;IAC1B,yEAAyE;IACzE,iEAAiE;IACjE,OAAOE,KAAKI,MAAM,KAAKD,MAAMC,MAAM,IAAIlB,gBAAgBc,MAAMG;AAC/D;AAEA,MAAME,kBAAkBjB,mBAAmBkB,IAAI,CAC7C;IAAEC,OAAO;IAAmBC,MAAM;AAAkB,GACpD;IAAEC,QAAQ;AAAI;AAGhB,MAAMC,YAAY,CAACC,aACjBvB,mBAAmBkB,IAAI,CACrB;QAAEC,OAAO;QAAaC,MAAM;QAAaG;IAAW,GACpD;QAAEF,QAAQ;IAAI;AAGlB,MAAMG,uBAAuBxB,mBAAmBkB,IAAI,CAClD;IACEC,OAAO;IACPC,MAAM;IACNK,QAAQ,GAAGpB,oBAAoB,YAAY,CAAC;AAC9C,GACA;IAAEgB,QAAQ;AAAI;AAGhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,MAAMK,yBACX,CAACH,aACD,CAAUI,MACR,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,iEAAiE;QACjExB,OAAOyB,GAAG,CAAC;gBAacC;YAZvB,MAAMA,UAAU,OAAO9B,kBAAkBA,iBAAiB;YAC1D,MAAMW,WAAW,OAAOJ;YAExB,IAAI,CAACE,QAAQqB,QAAQC,OAAO,CAAC1B,sBAAsB,EAAEM,WAAW;gBAC9D,OAAO,OAAOO;YAChB;YAEA,MAAMc,WAAW,OAAO9B;YACxB,IAAI,CAAC8B,SAASC,MAAM,CAACT,aAAa;gBAChC,OAAO,OAAOD,UAAUC;YAC1B;YAEA,MAAMU,kBAAiBJ,uCAAAA,QAAQC,OAAO,CAACzB,oBAAoB,qBAApCwB,qCAAsCK,IAAI;YACjE,IAAID,mBAAmBtB,aAAasB,mBAAmB,IAAI;gBACzD,OAAO,OAAOT;YAChB;YAEA,OAAO,OAAOG,IAAIM;QACpB,GAAG;AAEP;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,MAAME,kBACX,CAACZ,aACD,CAAUa,QACRjC,OAAOyB,GAAG,CAAC;YACT,MAAMC,UAAU,OAAO9B,kBAAkBA,iBAAiB;YAC1D,MAAMW,WAAW,OAAOJ;YAExB,IAAI,CAACE,QAAQqB,QAAQC,OAAO,CAAC1B,sBAAsB,EAAEM,WAAW;gBAC9D,OAAO,OAAOO;YAChB;YAEA,MAAMc,WAAW,OAAO9B;YACxB,IAAI,CAAC8B,SAASC,MAAM,CAACT,aAAa;gBAChC,OAAO,OAAOD,UAAUC;YAC1B;YAEA,OAAO,OAAOa;QAChB,GAAG"}
+{"version":3,"sources":["../../src/auth/require-service-crossing.ts"],"sourcesContent":["import { timingSafeEqual } from 'node:crypto';\n\nimport { type Permission, ServiceCrossingPolicyTag } from '@entifix/authz';\nimport { Context, Effect } from 'effect';\nimport { HttpServerRequest, HttpServerResponse } from 'effect/http';\n\n/**\n * The header carrying the crossing secret.\n *\n * ⚠️ **Deliberately not `x-service-token`.** That header is config-service's\n * fleet lookup, and the two secrets are not comparable: one grants a\n * configuration *read*, this one a tenant-data *write* for any organization the\n * caller names. Sharing the header name is how a proxy configured to forward the\n * fleet token ends up presenting it to a route that writes stock, and how a\n * copy-pasted value looks right while being the wrong secret entirely\n * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md)).\n */\nexport const CROSSING_TOKEN_HEADER = 'x-crossing-token';\n\n/**\n * The header naming the organization the caller is acting for.\n *\n * It rides beside the token rather than inside the request body because\n * entities are organization-agnostic by rule — no `organizationId` member, no\n * tenant filter — so there is nowhere in an entity envelope for it to live. A\n * header also serves the crossings that carry no body at all (releasing a hold,\n * converting one), which a body field would have needed a second convention for.\n *\n * On its own it grants **nothing**: it is only read after the token has proved\n * the caller is the fleet, so the input the caller controls is never the input\n * that authorizes.\n */\nexport const ORGANIZATION_HEADER = 'x-organization-id';\n\n/**\n * The crossing secret this service expects, provided at the composition root\n * from its own configuration.\n *\n * A `Context.Tag` rather than an environment read, which is the difference from\n * {@link requireServiceToken}: the value is a per-service secret held in\n * config-service as an `is_secret` row, so it arrives through the same boot\n * fetch as `mongo.uri` and can be rotated without redeploying a container.\n */\nexport class ServiceCrossingTokenTag extends Context.Service<\n  ServiceCrossingTokenTag,\n  string\n>()('ServiceCrossingTokenTag') {}\n\n/** Constant-time comparison, so the secret cannot be recovered byte by byte. */\nconst matches = (provided: string | undefined, expected: string): boolean => {\n  if (provided === undefined) return false;\n  const left = Buffer.from(provided);\n  const right = Buffer.from(expected);\n  // `timingSafeEqual` throws on a length mismatch, so lengths are compared\n  // first — the length of a shared secret is not what protects it.\n  return left.length === right.length && timingSafeEqual(left, right);\n};\n\nconst unauthenticated = HttpServerResponse.json(\n  { error: 'unauthenticated', code: 'unauthenticated' },\n  { status: 401 },\n);\n\nconst forbidden = (permission: Permission) =>\n  HttpServerResponse.json(\n    { error: 'forbidden', code: 'forbidden', permission },\n    { status: 403 },\n  );\n\nconst organizationRequired = HttpServerResponse.json(\n  {\n    error: 'the crossing must name an organization',\n    code: 'invalidRequest',\n    detail: `${ORGANIZATION_HEADER} is required`,\n  },\n  { status: 400 },\n);\n\n/**\n * Guard a **service-to-service** tenant crossing: the second — and only other —\n * way a request resolves the organization it acts for.\n *\n * The first is {@link requireOrganization}, which reads the session's\n * `activeOrganizationId` and is the only *user-facing* resolution. This one\n * exists because a platform-plane caller sometimes acts for an organization the\n * principal is not a member of: checkout reserving a vendor's stock, where the\n * organization comes from the **item** and a buyer's session carries none — and\n * never will, since making a buyer a member of every vendor they buy from would\n * be a far worse breach than the problem it solved.\n *\n * There is no third path, no fallback and no operator branch. A request\n * satisfying neither guard simply never reaches a tenant handle\n * ([ADR 0023](../../../../../../docs/adr/0023-service-to-service-tenant-crossing.md);\n * ADR 0012's operator crossing is a *different* mechanism — a person choosing an\n * organization, which needs a human's permission, a time box and a `Crossing`\n * record).\n *\n * ⚠️ **This guard reads no cookie and no `Authorization` header, and that is\n * the design.** A route guarded here accepts the crossing token and nothing\n * else: two accepted credentials on one route means the weaker one is the\n * security level. It matters concretely — `super-admin` holds `*:*:*`, which\n * matches every crossing permission, so a route that also took a session would\n * be reachable by an operator's browser tab.\n *\n * Three checks, in this order, so nothing is revealed before fleet membership is\n * proven:\n *\n * 1. the token, compared in constant time → `401`;\n * 2. the permission, against `ServiceCrossingPolicyTag` → `403`. The token\n *    proves the caller is the fleet; it does not say what the caller may do, and\n *    fleet membership is not a capability;\n * 3. the organization header, non-blank → `400`.\n *\n * **The recorded residual** (ADR 0023, not argued away here): a shared secret\n * means any process holding it can name any organization. What bounds it is the\n * permission above, the fact that only the slices needing it are configured with\n * the key, and the request log. What would remove it is an RS256 service token\n * carrying a scope claim, which is named work rather than a gap nobody noticed.\n */\nexport const requireServiceCrossing =\n  (permission: Permission) =>\n  <A, E, R>(use: (organizationId: string) => Effect.Effect<A, E, R>) =>\n    // The return type is inferred rather than written out, for the reason\n    // `requireServiceToken` records: `HttpServerResponse.json` contributes an\n    // `HttpBodyError` to the failure channel, and spelling the type out while\n    // omitting it is what makes the declaration emit fail invisibly.\n    Effect.gen(function* () {\n      const request = yield* HttpServerRequest.HttpServerRequest;\n      const expected = yield* ServiceCrossingTokenTag;\n\n      if (!matches(request.headers[CROSSING_TOKEN_HEADER], expected)) {\n        return yield* unauthenticated;\n      }\n\n      const crossing = yield* ServiceCrossingPolicyTag;\n      if (!crossing.allows(permission)) {\n        return yield* forbidden(permission);\n      }\n\n      const organizationId = request.headers[ORGANIZATION_HEADER]?.trim();\n      if (organizationId === undefined || organizationId === '') {\n        return yield* organizationRequired;\n      }\n\n      return yield* use(organizationId);\n    });\n\n/**\n * The same fleet check, for a participant that has **no organization to name**.\n *\n * ⚠️ **A platform-plane store is the whole difference.** `requireServiceCrossing`\n * above ends with an organization header because it is about to resolve a tenant\n * database handle from it, and a blank one there would read some other vendor's\n * storage. order-service names one database at boot, so there is no handle to\n * choose — and demanding a header nothing consumes would be theatre that a\n * caller learns to satisfy with any value.\n *\n * What is unchanged, and is the part that matters: the token proves the caller\n * is the fleet, the host's `ServiceCrossingPolicy` says what the fleet may do,\n * and **no session is accepted**. A saga step is not a person's act — the buyer\n * behind a checkout holds no grant over the order the coordinator is writing on\n * their behalf, and accepting their session here would make the weaker\n * credential the security level ([ADR 0052](../../../../../../docs/adr/0052-the-checkout-saga.md)).\n *\n * The recorded residual carries over verbatim: a shared secret means any process\n * holding it can act, bounded by the permission and by which slices are\n * configured with the key.\n */\nexport const requireCrossing =\n  (permission: Permission) =>\n  <A, E, R>(route: Effect.Effect<A, E, R>) =>\n    Effect.gen(function* () {\n      const request = yield* HttpServerRequest.HttpServerRequest;\n      const expected = yield* ServiceCrossingTokenTag;\n\n      if (!matches(request.headers[CROSSING_TOKEN_HEADER], expected)) {\n        return yield* unauthenticated;\n      }\n\n      const crossing = yield* ServiceCrossingPolicyTag;\n      if (!crossing.allows(permission)) {\n        return yield* forbidden(permission);\n      }\n\n      return yield* route;\n    });\n"],"names":["timingSafeEqual","ServiceCrossingPolicyTag","Context","Effect","HttpServerRequest","HttpServerResponse","CROSSING_TOKEN_HEADER","ORGANIZATION_HEADER","ServiceCrossingTokenTag","Service","matches","provided","expected","undefined","left","Buffer","from","right","length","unauthenticated","json","error","code","status","forbidden","permission","organizationRequired","detail","requireServiceCrossing","use","gen","request","headers","crossing","allows","organizationId","trim","requireCrossing","route"],"mappings":"AAAA,SAASA,eAAe,QAAQ,cAAc;AAE9C,SAA0BC,wBAAwB,QAAQ,iBAAiB;AAC3E,SAASC,OAAO,EAAEC,MAAM,QAAQ,SAAS;AACzC,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,cAAc;AAEpE;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,wBAAwB,mBAAmB;AAExD;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,sBAAsB,oBAAoB;AAEvD;;;;;;;;CAQC,GACD,OAAO,MAAMC,gCAAgCN,QAAQO,OAAO,GAGxD;AAA4B;AAEhC,8EAA8E,GAC9E,MAAMC,UAAU,CAACC,UAA8BC;IAC7C,IAAID,aAAaE,WAAW,OAAO;IACnC,MAAMC,OAAOC,OAAOC,IAAI,CAACL;IACzB,MAAMM,QAAQF,OAAOC,IAAI,CAACJ;IAC1B,yEAAyE;IACzE,iEAAiE;IACjE,OAAOE,KAAKI,MAAM,KAAKD,MAAMC,MAAM,IAAIlB,gBAAgBc,MAAMG;AAC/D;AAEA,MAAME,kBAAkBd,mBAAmBe,IAAI,CAC7C;IAAEC,OAAO;IAAmBC,MAAM;AAAkB,GACpD;IAAEC,QAAQ;AAAI;AAGhB,MAAMC,YAAY,CAACC,aACjBpB,mBAAmBe,IAAI,CACrB;QAAEC,OAAO;QAAaC,MAAM;QAAaG;IAAW,GACpD;QAAEF,QAAQ;IAAI;AAGlB,MAAMG,uBAAuBrB,mBAAmBe,IAAI,CAClD;IACEC,OAAO;IACPC,MAAM;IACNK,QAAQ,GAAGpB,oBAAoB,YAAY,CAAC;AAC9C,GACA;IAAEgB,QAAQ;AAAI;AAGhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,MAAMK,yBACX,CAACH,aACD,CAAUI,MACR,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,iEAAiE;QACjE1B,OAAO2B,GAAG,CAAC;gBAacC;YAZvB,MAAMA,UAAU,OAAO3B,kBAAkBA,iBAAiB;YAC1D,MAAMQ,WAAW,OAAOJ;YAExB,IAAI,CAACE,QAAQqB,QAAQC,OAAO,CAAC1B,sBAAsB,EAAEM,WAAW;gBAC9D,OAAO,OAAOO;YAChB;YAEA,MAAMc,WAAW,OAAOhC;YACxB,IAAI,CAACgC,SAASC,MAAM,CAACT,aAAa;gBAChC,OAAO,OAAOD,UAAUC;YAC1B;YAEA,MAAMU,kBAAiBJ,uCAAAA,QAAQC,OAAO,CAACzB,oBAAoB,qBAApCwB,qCAAsCK,IAAI;YACjE,IAAID,mBAAmBtB,aAAasB,mBAAmB,IAAI;gBACzD,OAAO,OAAOT;YAChB;YAEA,OAAO,OAAOG,IAAIM;QACpB,GAAG;AAEP;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,MAAME,kBACX,CAACZ,aACD,CAAUa,QACRnC,OAAO2B,GAAG,CAAC;YACT,MAAMC,UAAU,OAAO3B,kBAAkBA,iBAAiB;YAC1D,MAAMQ,WAAW,OAAOJ;YAExB,IAAI,CAACE,QAAQqB,QAAQC,OAAO,CAAC1B,sBAAsB,EAAEM,WAAW;gBAC9D,OAAO,OAAOO;YAChB;YAEA,MAAMc,WAAW,OAAOhC;YACxB,IAAI,CAACgC,SAASC,MAAM,CAACT,aAAa;gBAChC,OAAO,OAAOD,UAAUC;YAC1B;YAEA,OAAO,OAAOa;QAChB,GAAG"}

package/dist/auth/service-token.d.ts

@@ -1,5 +1,5 @@
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { Effect } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 /** The header a caller of config-service's fleet lookup presents. */
 export declare const SERVICE_TOKEN_HEADER = "x-service-token";
 /**
@@ -33,5 +33,5 @@ export declare const serviceToken: () => string;
  * Health endpoints are **not** guarded — a probe must answer without credentials,
  * or a readiness check becomes an authentication problem.
  */
-export declare const requireServiceToken: <A, E, R>(route: Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("@effect/platform/HttpBody").HttpBodyError | E, HttpServerRequest.HttpServerRequest | R>;
+export declare const requireServiceToken: <A, E, R>(route: Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("effect/http/HttpBody").HttpBodyError | E, HttpServerRequest.HttpServerRequest | R>;
 //# sourceMappingURL=service-token.d.ts.map

package/dist/auth/service-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-token.d.ts","sourceRoot":"","sources":["../../src/auth/service-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAO,MACuB,CAAC;AAYxD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,6JAiBtE,CAAC"}
+{"version":3,"file":"service-token.d.ts","sourceRoot":"","sources":["../../src/auth/service-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAO,MACuB,CAAC;AAYxD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,wJAiBtE,CAAC"}

package/dist/auth/service-token.js

@@ -1,6 +1,6 @@
 import { timingSafeEqual } from 'node:crypto';
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { Effect } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 /** The header a caller of config-service's fleet lookup presents. */ export const SERVICE_TOKEN_HEADER = 'x-service-token';
 /**
  * Local-dev default, so `pnpm run back-office:dev` stays zero-config. Same

package/dist/auth/service-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/service-token.ts"],"sourcesContent":["import { timingSafeEqual } from 'node:crypto';\n\nimport { HttpServerRequest, HttpServerResponse } from '@effect/platform';\nimport { Effect } from 'effect';\n\n/** The header a caller of config-service's fleet lookup presents. */\nexport const SERVICE_TOKEN_HEADER = 'x-service-token';\n\n/**\n * Local-dev default, so `pnpm run back-office:dev` stays zero-config. Same\n * convention as the seeded `jwt.secret`: obviously a placeholder, replaced per\n * environment through `CONFIG_SERVICE_TOKEN`.\n */\nexport const DEV_SERVICE_TOKEN = 'dev-config-service-token-change-me';\n\n/**\n * The expected token, read from the environment on each call rather than captured\n * at module load — so a test can set it without re-importing the module.\n */\nexport const serviceToken = (): string =>\n  process.env.CONFIG_SERVICE_TOKEN ?? DEV_SERVICE_TOKEN;\n\n/** Constant-time comparison, so the token cannot be recovered byte by byte. */\nconst matches = (provided: string | undefined): boolean => {\n  if (provided === undefined) return false;\n  const left = Buffer.from(provided);\n  const right = Buffer.from(serviceToken());\n  // `timingSafeEqual` throws on a length mismatch, so the lengths are compared\n  // first — the length of a shared secret is not what protects it.\n  return left.length === right.length && timingSafeEqual(left, right);\n};\n\n/**\n * Guards config-service's fleet configuration lookup.\n *\n * `GET /api/config/:service` hands out `jwt.secret`, `mongo.uri`, `redis.uri` and\n * `rabbitmq.uri` in plaintext, because that is exactly what a booting service\n * needs — the values cannot be redacted here without breaking the boot the route\n * exists to serve. So the route is gated on a shared token instead, which closes\n * the drive-by read that being merely \"cluster-internal\" did not.\n *\n * This is deliberately **not** service identity: every caller presents the same\n * token, so it proves fleet membership and nothing more. Per-service credentials,\n * with the response scoped to the service that asked, are separate work; this is\n * the cheap step that stops the port from being self-serve.\n *\n * It lives here beside {@link loadRemoteConfiguration}, the client half of the\n * same protocol, so the header and the token cannot drift apart.\n *\n * Health endpoints are **not** guarded — a probe must answer without credentials,\n * or a readiness check becomes an authentication problem.\n */\nexport const requireServiceToken = <A, E, R>(route: Effect.Effect<A, E, R>) =>\n  // The return type is inferred rather than written out: `HttpServerResponse.json`\n  // contributes an `HttpBodyError` to the failure channel, and spelling the type\n  // out while omitting it is what makes `tsc` refuse the declaration emit — which\n  // `@nx/js:swc` hides, leaving a green build with no `.d.ts` and a TS6305\n  // cascade in every consumer. `requirePrincipal` infers for the same reason.\n  Effect.gen(function* () {\n    const request = yield* HttpServerRequest.HttpServerRequest;\n\n    if (!matches(request.headers[SERVICE_TOKEN_HEADER])) {\n      return yield* HttpServerResponse.json(\n        { error: 'unauthenticated', code: 'unauthenticated' },\n        { status: 401 },\n      );\n    }\n\n    return yield* route;\n  });\n"],"names":["timingSafeEqual","HttpServerRequest","HttpServerResponse","Effect","SERVICE_TOKEN_HEADER","DEV_SERVICE_TOKEN","serviceToken","process","env","CONFIG_SERVICE_TOKEN","matches","provided","undefined","left","Buffer","from","right","length","requireServiceToken","route","gen","request","headers","json","error","code","status"],"mappings":"AAAA,SAASA,eAAe,QAAQ,cAAc;AAE9C,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,mBAAmB;AACzE,SAASC,MAAM,QAAQ,SAAS;AAEhC,mEAAmE,GACnE,OAAO,MAAMC,uBAAuB,kBAAkB;AAEtD;;;;CAIC,GACD,OAAO,MAAMC,oBAAoB,qCAAqC;AAEtE;;;CAGC,GACD,OAAO,MAAMC,eAAe;QAC1BC;YAAAA,oCAAAA,QAAQC,GAAG,CAACC,oBAAoB,YAAhCF,oCAAoCF;EAAkB;AAExD,6EAA6E,GAC7E,MAAMK,UAAU,CAACC;IACf,IAAIA,aAAaC,WAAW,OAAO;IACnC,MAAMC,OAAOC,OAAOC,IAAI,CAACJ;IACzB,MAAMK,QAAQF,OAAOC,IAAI,CAACT;IAC1B,6EAA6E;IAC7E,iEAAiE;IACjE,OAAOO,KAAKI,MAAM,KAAKD,MAAMC,MAAM,IAAIjB,gBAAgBa,MAAMG;AAC/D;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAME,sBAAsB,CAAUC,QAC3C,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,yEAAyE;IACzE,4EAA4E;IAC5EhB,OAAOiB,GAAG,CAAC;QACT,MAAMC,UAAU,OAAOpB,kBAAkBA,iBAAiB;QAE1D,IAAI,CAACS,QAAQW,QAAQC,OAAO,CAAClB,qBAAqB,GAAG;YACnD,OAAO,OAAOF,mBAAmBqB,IAAI,CACnC;gBAAEC,OAAO;gBAAmBC,MAAM;YAAkB,GACpD;gBAAEC,QAAQ;YAAI;QAElB;QAEA,OAAO,OAAOP;IAChB,GAAG"}
+{"version":3,"sources":["../../src/auth/service-token.ts"],"sourcesContent":["import { timingSafeEqual } from 'node:crypto';\n\nimport { Effect } from 'effect';\nimport { HttpServerRequest, HttpServerResponse } from 'effect/http';\n\n/** The header a caller of config-service's fleet lookup presents. */\nexport const SERVICE_TOKEN_HEADER = 'x-service-token';\n\n/**\n * Local-dev default, so `pnpm run back-office:dev` stays zero-config. Same\n * convention as the seeded `jwt.secret`: obviously a placeholder, replaced per\n * environment through `CONFIG_SERVICE_TOKEN`.\n */\nexport const DEV_SERVICE_TOKEN = 'dev-config-service-token-change-me';\n\n/**\n * The expected token, read from the environment on each call rather than captured\n * at module load — so a test can set it without re-importing the module.\n */\nexport const serviceToken = (): string =>\n  process.env.CONFIG_SERVICE_TOKEN ?? DEV_SERVICE_TOKEN;\n\n/** Constant-time comparison, so the token cannot be recovered byte by byte. */\nconst matches = (provided: string | undefined): boolean => {\n  if (provided === undefined) return false;\n  const left = Buffer.from(provided);\n  const right = Buffer.from(serviceToken());\n  // `timingSafeEqual` throws on a length mismatch, so the lengths are compared\n  // first — the length of a shared secret is not what protects it.\n  return left.length === right.length && timingSafeEqual(left, right);\n};\n\n/**\n * Guards config-service's fleet configuration lookup.\n *\n * `GET /api/config/:service` hands out `jwt.secret`, `mongo.uri`, `redis.uri` and\n * `rabbitmq.uri` in plaintext, because that is exactly what a booting service\n * needs — the values cannot be redacted here without breaking the boot the route\n * exists to serve. So the route is gated on a shared token instead, which closes\n * the drive-by read that being merely \"cluster-internal\" did not.\n *\n * This is deliberately **not** service identity: every caller presents the same\n * token, so it proves fleet membership and nothing more. Per-service credentials,\n * with the response scoped to the service that asked, are separate work; this is\n * the cheap step that stops the port from being self-serve.\n *\n * It lives here beside {@link loadRemoteConfiguration}, the client half of the\n * same protocol, so the header and the token cannot drift apart.\n *\n * Health endpoints are **not** guarded — a probe must answer without credentials,\n * or a readiness check becomes an authentication problem.\n */\nexport const requireServiceToken = <A, E, R>(route: Effect.Effect<A, E, R>) =>\n  // The return type is inferred rather than written out: `HttpServerResponse.json`\n  // contributes an `HttpBodyError` to the failure channel, and spelling the type\n  // out while omitting it is what makes `tsc` refuse the declaration emit — which\n  // `@nx/js:swc` hides, leaving a green build with no `.d.ts` and a TS6305\n  // cascade in every consumer. `requirePrincipal` infers for the same reason.\n  Effect.gen(function* () {\n    const request = yield* HttpServerRequest.HttpServerRequest;\n\n    if (!matches(request.headers[SERVICE_TOKEN_HEADER])) {\n      return yield* HttpServerResponse.json(\n        { error: 'unauthenticated', code: 'unauthenticated' },\n        { status: 401 },\n      );\n    }\n\n    return yield* route;\n  });\n"],"names":["timingSafeEqual","Effect","HttpServerRequest","HttpServerResponse","SERVICE_TOKEN_HEADER","DEV_SERVICE_TOKEN","serviceToken","process","env","CONFIG_SERVICE_TOKEN","matches","provided","undefined","left","Buffer","from","right","length","requireServiceToken","route","gen","request","headers","json","error","code","status"],"mappings":"AAAA,SAASA,eAAe,QAAQ,cAAc;AAE9C,SAASC,MAAM,QAAQ,SAAS;AAChC,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,cAAc;AAEpE,mEAAmE,GACnE,OAAO,MAAMC,uBAAuB,kBAAkB;AAEtD;;;;CAIC,GACD,OAAO,MAAMC,oBAAoB,qCAAqC;AAEtE;;;CAGC,GACD,OAAO,MAAMC,eAAe;QAC1BC;YAAAA,oCAAAA,QAAQC,GAAG,CAACC,oBAAoB,YAAhCF,oCAAoCF;EAAkB;AAExD,6EAA6E,GAC7E,MAAMK,UAAU,CAACC;IACf,IAAIA,aAAaC,WAAW,OAAO;IACnC,MAAMC,OAAOC,OAAOC,IAAI,CAACJ;IACzB,MAAMK,QAAQF,OAAOC,IAAI,CAACT;IAC1B,6EAA6E;IAC7E,iEAAiE;IACjE,OAAOO,KAAKI,MAAM,KAAKD,MAAMC,MAAM,IAAIjB,gBAAgBa,MAAMG;AAC/D;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAME,sBAAsB,CAAUC,QAC3C,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,yEAAyE;IACzE,4EAA4E;IAC5ElB,OAAOmB,GAAG,CAAC;QACT,MAAMC,UAAU,OAAOnB,kBAAkBA,iBAAiB;QAE1D,IAAI,CAACQ,QAAQW,QAAQC,OAAO,CAAClB,qBAAqB,GAAG;YACnD,OAAO,OAAOD,mBAAmBoB,IAAI,CACnC;gBAAEC,OAAO;gBAAmBC,MAAM;YAAkB,GACpD;gBAAEC,QAAQ;YAAI;QAElB;QAEA,OAAO,OAAOP;IAChB,GAAG"}

package/dist/entity-metadata-route.d.ts

@@ -1,7 +1,7 @@
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { PolicyDecisionTag } from '@entifix/authz';
 import { type Entity, type EntityConstructor } from '@entifix/core';
 import { Effect } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 /**
  * `GET /api/<entity>/$metadata` — what this caller may do with one entity.
  *
@@ -21,5 +21,5 @@ import { Effect } from 'effect';
  * database handle here would leave a vendor with no active organization unable
  * to see their own affordances.
  */
-export declare const entityMetadataRoute: <TEntity extends Entity>(entityConstructor: EntityConstructor<TEntity>) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("@effect/platform/HttpBody").HttpBodyError, PolicyDecisionTag | import("@entifix/business").TokenServiceTag | HttpServerRequest.HttpServerRequest>;
+export declare const entityMetadataRoute: <TEntity extends Entity>(entityConstructor: EntityConstructor<TEntity>) => Effect.Effect<HttpServerResponse.HttpServerResponse, import("effect/http/HttpBody").HttpBodyError, PolicyDecisionTag | import("@entifix/business").TokenServiceTag | HttpServerRequest.HttpServerRequest>;
 //# sourceMappingURL=entity-metadata-route.d.ts.map

package/dist/entity-metadata-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-metadata-route.d.ts","sourceRoot":"","sources":["../src/entity-metadata-route.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAKL,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,KAAK,MAAM,EAEX,KAAK,iBAAiB,EAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,SAAS,MAAM,EACxD,mBAAmB,iBAAiB,CAAC,OAAO,CAAC,mNA0D5C,CAAC"}
+{"version":3,"file":"entity-metadata-route.d.ts","sourceRoot":"","sources":["../src/entity-metadata-route.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,KAAK,MAAM,EAEX,KAAK,iBAAiB,EAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAIpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,SAAS,MAAM,EACxD,mBAAmB,iBAAiB,CAAC,OAAO,CAAC,8MA0D5C,CAAC"}

package/dist/entity-metadata-route.js

@@ -1,8 +1,8 @@
 import { createHash } from 'node:crypto';
-import { HttpServerRequest, HttpServerResponse } from '@effect/platform';
 import { parsePermission, permissionForEntity, permissionForUseCase, PolicyDecisionTag } from '@entifix/authz';
 import { describeEntityUseCases, ENTITY_ACTIONS, extractMetaEntity, makeEntityMetadataEnvelope } from '@entifix/core';
 import { Effect } from 'effect';
+import { HttpServerRequest, HttpServerResponse } from 'effect/http';
 import { requirePrincipal } from './auth/index.js';
 /**
  * `GET /api/<entity>/$metadata` — what this caller may do with one entity.

package/dist/entity-metadata-route.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/entity-metadata-route.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nimport { HttpServerRequest, HttpServerResponse } from '@effect/platform';\nimport {\n  parsePermission,\n  type Permission,\n  permissionForEntity,\n  permissionForUseCase,\n  PolicyDecisionTag,\n} from '@entifix/authz';\nimport {\n  describeEntityUseCases,\n  type Entity,\n  ENTITY_ACTIONS,\n  type EntityConstructor,\n  type EntityMetadataDocument,\n  extractMetaEntity,\n  makeEntityMetadataEnvelope,\n} from '@entifix/core';\nimport { Effect } from 'effect';\n\nimport { requirePrincipal } from './auth/index.js';\n\n/**\n * `GET /api/<entity>/$metadata` — what this caller may do with one entity.\n *\n * Mounted **per entity, at a literal path**, not as a `/api/:entity/$metadata`\n * wildcard. `HttpRouter` resolves through `find-my-way-ts`, where a static\n * segment beats a parametric one and there is no backtracking once the\n * parametric branch has matched: alongside an existing `/api/<entity>/:id`, a\n * wildcard `$metadata` route never runs at all — the by-id handler wins with\n * `id === \"$metadata\"`, misses, and answers its own `404`. The endpoint would\n * read as \"this entity has no metadata\" while appearing mounted. A literal wins\n * regardless of registration order, which is why the base exports a route for\n * one entity and each service registers it for each of its own\n * ([ADR 0026](../../../../../docs/adr/0026-the-use-case-descriptor-and-served-entity-metadata.md)).\n *\n * Deliberately **not** behind `requireOrganization`, even on a tenant-plane\n * service: the document describes the model, not tenant data, and resolving a\n * database handle here would leave a vendor with no active organization unable\n * to see their own affordances.\n */\nexport const entityMetadataRoute = <TEntity extends Entity>(\n  entityConstructor: EntityConstructor<TEntity>,\n) =>\n  requirePrincipal(principal =>\n    Effect.gen(function* () {\n      const policy = yield* PolicyDecisionTag;\n      const allows = (permission: Permission): boolean => {\n        const { resource, action } = parsePermission(permission);\n        return policy.decide({\n          subject: { roles: principal.roles },\n          resource,\n          action,\n        });\n      };\n\n      // SECURITY BOUNDARY. The document names domains, entity keys and verbs —\n      // it is a map of the model — so an entity the caller may not read answers\n      // exactly as one this service does not host. A `403` here would make the\n      // endpoint an oracle: walk it and learn the shape of everything you are\n      // not allowed to see. Same category as `redactConfiguration`, not\n      // diagnostics polish.\n      if (!allows(permissionForEntity(entityConstructor, 'read'))) {\n        return yield* notFound(entityConstructor);\n      }\n\n      const document: EntityMetadataDocument = {\n        actions: ENTITY_ACTIONS.filter(action =>\n          allows(permissionForEntity(entityConstructor, action)),\n        ),\n        useCases: describeEntityUseCases(entityConstructor).filter(descriptor =>\n          allows(permissionForUseCase(entityConstructor, descriptor.key)),\n        ),\n      };\n\n      // The ETag hashes the *computed* document, not the descriptor set the\n      // deployment declares. Two principals with different grants get different\n      // documents from the same model, so a hash of the model would `304` one\n      // caller onto another's affordances. Hashing the permission set instead\n      // would read `ROLE_PERMISSIONS` directly and go around `PolicyDecisionTag`,\n      // so an injected ABAC policy could change affordances without changing the\n      // tag. Computing first costs a metadata read and a handful of pure\n      // `decide` calls — no IO.\n      const body = JSON.stringify(\n        makeEntityMetadataEnvelope(entityConstructor, document),\n      );\n      const etag = `\"${createHash('sha256').update(body).digest('hex')}\"`;\n\n      const request = yield* HttpServerRequest.HttpServerRequest;\n      if (request.headers['if-none-match'] === etag) {\n        return HttpServerResponse.empty({ status: 304 }).pipe(\n          HttpServerResponse.setHeaders(cacheHeaders(etag)),\n        );\n      }\n\n      return HttpServerResponse.text(body, {\n        contentType: 'application/json',\n        headers: cacheHeaders(etag),\n      });\n    }),\n  );\n\n/**\n * The response varies by principal, so it must never land in a shared cache.\n * `Vary` names **both** credential carriers because the shell reads the access\n * token from the `entifix_at` cookie *or* an `Authorization: Bearer` header, and a\n * cache keyed on only one of them would serve across the other.\n */\nconst cacheHeaders = (etag: string) => ({\n  etag,\n  'cache-control': 'private, no-cache',\n  vary: 'Cookie, Authorization',\n});\n\n/** Indistinguishable from the `404` a service gives for an entity it does not host. */\nconst notFound = <TEntity extends Entity>(\n  entityConstructor: EntityConstructor<TEntity>,\n) =>\n  HttpServerResponse.json(\n    {\n      message: 'not found',\n      code: 'notFound',\n      entity: extractMetaEntity(entityConstructor).key,\n    },\n    { status: 404 },\n  );\n"],"names":["createHash","HttpServerRequest","HttpServerResponse","parsePermission","permissionForEntity","permissionForUseCase","PolicyDecisionTag","describeEntityUseCases","ENTITY_ACTIONS","extractMetaEntity","makeEntityMetadataEnvelope","Effect","requirePrincipal","entityMetadataRoute","entityConstructor","principal","gen","policy","allows","permission","resource","action","decide","subject","roles","notFound","document","actions","filter","useCases","descriptor","key","body","JSON","stringify","etag","update","digest","request","headers","empty","status","pipe","setHeaders","cacheHeaders","text","contentType","vary","json","message","code","entity"],"mappings":"AAAA,SAASA,UAAU,QAAQ,cAAc;AAEzC,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,mBAAmB;AACzE,SACEC,eAAe,EAEfC,mBAAmB,EACnBC,oBAAoB,EACpBC,iBAAiB,QACZ,iBAAiB;AACxB,SACEC,sBAAsB,EAEtBC,cAAc,EAGdC,iBAAiB,EACjBC,0BAA0B,QACrB,gBAAgB;AACvB,SAASC,MAAM,QAAQ,SAAS;AAEhC,SAASC,gBAAgB,QAAQ,kBAAkB;AAEnD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,oBAEAF,iBAAiBG,CAAAA,YACfJ,OAAOK,GAAG,CAAC;YACT,MAAMC,SAAS,OAAOX;YACtB,MAAMY,SAAS,CAACC;gBACd,MAAM,EAAEC,QAAQ,EAAEC,MAAM,EAAE,GAAGlB,gBAAgBgB;gBAC7C,OAAOF,OAAOK,MAAM,CAAC;oBACnBC,SAAS;wBAAEC,OAAOT,UAAUS,KAAK;oBAAC;oBAClCJ;oBACAC;gBACF;YACF;YAEA,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,kEAAkE;YAClE,sBAAsB;YACtB,IAAI,CAACH,OAAOd,oBAAoBU,mBAAmB,UAAU;gBAC3D,OAAO,OAAOW,SAASX;YACzB;YAEA,MAAMY,WAAmC;gBACvCC,SAASnB,eAAeoB,MAAM,CAACP,CAAAA,SAC7BH,OAAOd,oBAAoBU,mBAAmBO;gBAEhDQ,UAAUtB,uBAAuBO,mBAAmBc,MAAM,CAACE,CAAAA,aACzDZ,OAAOb,qBAAqBS,mBAAmBgB,WAAWC,GAAG;YAEjE;YAEA,sEAAsE;YACtE,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,4EAA4E;YAC5E,2EAA2E;YAC3E,mEAAmE;YACnE,0BAA0B;YAC1B,MAAMC,OAAOC,KAAKC,SAAS,CACzBxB,2BAA2BI,mBAAmBY;YAEhD,MAAMS,OAAO,CAAC,CAAC,EAAEnC,WAAW,UAAUoC,MAAM,CAACJ,MAAMK,MAAM,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAMC,UAAU,OAAOrC,kBAAkBA,iBAAiB;YAC1D,IAAIqC,QAAQC,OAAO,CAAC,gBAAgB,KAAKJ,MAAM;gBAC7C,OAAOjC,mBAAmBsC,KAAK,CAAC;oBAAEC,QAAQ;gBAAI,GAAGC,IAAI,CACnDxC,mBAAmByC,UAAU,CAACC,aAAaT;YAE/C;YAEA,OAAOjC,mBAAmB2C,IAAI,CAACb,MAAM;gBACnCc,aAAa;gBACbP,SAASK,aAAaT;YACxB;QACF,IACA;AAEJ;;;;;CAKC,GACD,MAAMS,eAAe,CAACT,OAAkB,CAAA;QACtCA;QACA,iBAAiB;QACjBY,MAAM;IACR,CAAA;AAEA,qFAAqF,GACrF,MAAMtB,WAAW,CACfX,oBAEAZ,mBAAmB8C,IAAI,CACrB;QACEC,SAAS;QACTC,MAAM;QACNC,QAAQ1C,kBAAkBK,mBAAmBiB,GAAG;IAClD,GACA;QAAEU,QAAQ;IAAI"}
+{"version":3,"sources":["../src/entity-metadata-route.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nimport {\n  parsePermission,\n  type Permission,\n  permissionForEntity,\n  permissionForUseCase,\n  PolicyDecisionTag,\n} from '@entifix/authz';\nimport {\n  describeEntityUseCases,\n  type Entity,\n  ENTITY_ACTIONS,\n  type EntityConstructor,\n  type EntityMetadataDocument,\n  extractMetaEntity,\n  makeEntityMetadataEnvelope,\n} from '@entifix/core';\nimport { Effect } from 'effect';\nimport { HttpServerRequest, HttpServerResponse } from 'effect/http';\n\nimport { requirePrincipal } from './auth/index.js';\n\n/**\n * `GET /api/<entity>/$metadata` — what this caller may do with one entity.\n *\n * Mounted **per entity, at a literal path**, not as a `/api/:entity/$metadata`\n * wildcard. `HttpRouter` resolves through `find-my-way-ts`, where a static\n * segment beats a parametric one and there is no backtracking once the\n * parametric branch has matched: alongside an existing `/api/<entity>/:id`, a\n * wildcard `$metadata` route never runs at all — the by-id handler wins with\n * `id === \"$metadata\"`, misses, and answers its own `404`. The endpoint would\n * read as \"this entity has no metadata\" while appearing mounted. A literal wins\n * regardless of registration order, which is why the base exports a route for\n * one entity and each service registers it for each of its own\n * ([ADR 0026](../../../../../docs/adr/0026-the-use-case-descriptor-and-served-entity-metadata.md)).\n *\n * Deliberately **not** behind `requireOrganization`, even on a tenant-plane\n * service: the document describes the model, not tenant data, and resolving a\n * database handle here would leave a vendor with no active organization unable\n * to see their own affordances.\n */\nexport const entityMetadataRoute = <TEntity extends Entity>(\n  entityConstructor: EntityConstructor<TEntity>,\n) =>\n  requirePrincipal(principal =>\n    Effect.gen(function* () {\n      const policy = yield* PolicyDecisionTag;\n      const allows = (permission: Permission): boolean => {\n        const { resource, action } = parsePermission(permission);\n        return policy.decide({\n          subject: { roles: principal.roles },\n          resource,\n          action,\n        });\n      };\n\n      // SECURITY BOUNDARY. The document names domains, entity keys and verbs —\n      // it is a map of the model — so an entity the caller may not read answers\n      // exactly as one this service does not host. A `403` here would make the\n      // endpoint an oracle: walk it and learn the shape of everything you are\n      // not allowed to see. Same category as `redactConfiguration`, not\n      // diagnostics polish.\n      if (!allows(permissionForEntity(entityConstructor, 'read'))) {\n        return yield* notFound(entityConstructor);\n      }\n\n      const document: EntityMetadataDocument = {\n        actions: ENTITY_ACTIONS.filter(action =>\n          allows(permissionForEntity(entityConstructor, action)),\n        ),\n        useCases: describeEntityUseCases(entityConstructor).filter(descriptor =>\n          allows(permissionForUseCase(entityConstructor, descriptor.key)),\n        ),\n      };\n\n      // The ETag hashes the *computed* document, not the descriptor set the\n      // deployment declares. Two principals with different grants get different\n      // documents from the same model, so a hash of the model would `304` one\n      // caller onto another's affordances. Hashing the permission set instead\n      // would read `ROLE_PERMISSIONS` directly and go around `PolicyDecisionTag`,\n      // so an injected ABAC policy could change affordances without changing the\n      // tag. Computing first costs a metadata read and a handful of pure\n      // `decide` calls — no IO.\n      const body = JSON.stringify(\n        makeEntityMetadataEnvelope(entityConstructor, document),\n      );\n      const etag = `\"${createHash('sha256').update(body).digest('hex')}\"`;\n\n      const request = yield* HttpServerRequest.HttpServerRequest;\n      if (request.headers['if-none-match'] === etag) {\n        return HttpServerResponse.empty({ status: 304 }).pipe(\n          HttpServerResponse.setHeaders(cacheHeaders(etag)),\n        );\n      }\n\n      return HttpServerResponse.text(body, {\n        contentType: 'application/json',\n        headers: cacheHeaders(etag),\n      });\n    }),\n  );\n\n/**\n * The response varies by principal, so it must never land in a shared cache.\n * `Vary` names **both** credential carriers because the shell reads the access\n * token from the `entifix_at` cookie *or* an `Authorization: Bearer` header, and a\n * cache keyed on only one of them would serve across the other.\n */\nconst cacheHeaders = (etag: string) => ({\n  etag,\n  'cache-control': 'private, no-cache',\n  vary: 'Cookie, Authorization',\n});\n\n/** Indistinguishable from the `404` a service gives for an entity it does not host. */\nconst notFound = <TEntity extends Entity>(\n  entityConstructor: EntityConstructor<TEntity>,\n) =>\n  HttpServerResponse.json(\n    {\n      message: 'not found',\n      code: 'notFound',\n      entity: extractMetaEntity(entityConstructor).key,\n    },\n    { status: 404 },\n  );\n"],"names":["createHash","parsePermission","permissionForEntity","permissionForUseCase","PolicyDecisionTag","describeEntityUseCases","ENTITY_ACTIONS","extractMetaEntity","makeEntityMetadataEnvelope","Effect","HttpServerRequest","HttpServerResponse","requirePrincipal","entityMetadataRoute","entityConstructor","principal","gen","policy","allows","permission","resource","action","decide","subject","roles","notFound","document","actions","filter","useCases","descriptor","key","body","JSON","stringify","etag","update","digest","request","headers","empty","status","pipe","setHeaders","cacheHeaders","text","contentType","vary","json","message","code","entity"],"mappings":"AAAA,SAASA,UAAU,QAAQ,cAAc;AAEzC,SACEC,eAAe,EAEfC,mBAAmB,EACnBC,oBAAoB,EACpBC,iBAAiB,QACZ,iBAAiB;AACxB,SACEC,sBAAsB,EAEtBC,cAAc,EAGdC,iBAAiB,EACjBC,0BAA0B,QACrB,gBAAgB;AACvB,SAASC,MAAM,QAAQ,SAAS;AAChC,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,cAAc;AAEpE,SAASC,gBAAgB,QAAQ,kBAAkB;AAEnD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,oBAEAF,iBAAiBG,CAAAA,YACfN,OAAOO,GAAG,CAAC;YACT,MAAMC,SAAS,OAAOb;YACtB,MAAMc,SAAS,CAACC;gBACd,MAAM,EAAEC,QAAQ,EAAEC,MAAM,EAAE,GAAGpB,gBAAgBkB;gBAC7C,OAAOF,OAAOK,MAAM,CAAC;oBACnBC,SAAS;wBAAEC,OAAOT,UAAUS,KAAK;oBAAC;oBAClCJ;oBACAC;gBACF;YACF;YAEA,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,kEAAkE;YAClE,sBAAsB;YACtB,IAAI,CAACH,OAAOhB,oBAAoBY,mBAAmB,UAAU;gBAC3D,OAAO,OAAOW,SAASX;YACzB;YAEA,MAAMY,WAAmC;gBACvCC,SAASrB,eAAesB,MAAM,CAACP,CAAAA,SAC7BH,OAAOhB,oBAAoBY,mBAAmBO;gBAEhDQ,UAAUxB,uBAAuBS,mBAAmBc,MAAM,CAACE,CAAAA,aACzDZ,OAAOf,qBAAqBW,mBAAmBgB,WAAWC,GAAG;YAEjE;YAEA,sEAAsE;YACtE,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,4EAA4E;YAC5E,2EAA2E;YAC3E,mEAAmE;YACnE,0BAA0B;YAC1B,MAAMC,OAAOC,KAAKC,SAAS,CACzB1B,2BAA2BM,mBAAmBY;YAEhD,MAAMS,OAAO,CAAC,CAAC,EAAEnC,WAAW,UAAUoC,MAAM,CAACJ,MAAMK,MAAM,CAAC,OAAO,CAAC,CAAC;YAEnE,MAAMC,UAAU,OAAO5B,kBAAkBA,iBAAiB;YAC1D,IAAI4B,QAAQC,OAAO,CAAC,gBAAgB,KAAKJ,MAAM;gBAC7C,OAAOxB,mBAAmB6B,KAAK,CAAC;oBAAEC,QAAQ;gBAAI,GAAGC,IAAI,CACnD/B,mBAAmBgC,UAAU,CAACC,aAAaT;YAE/C;YAEA,OAAOxB,mBAAmBkC,IAAI,CAACb,MAAM;gBACnCc,aAAa;gBACbP,SAASK,aAAaT;YACxB;QACF,IACA;AAEJ;;;;;CAKC,GACD,MAAMS,eAAe,CAACT,OAAkB,CAAA;QACtCA;QACA,iBAAiB;QACjBY,MAAM;IACR,CAAA;AAEA,qFAAqF,GACrF,MAAMtB,WAAW,CACfX,oBAEAH,mBAAmBqC,IAAI,CACrB;QACEC,SAAS;QACTC,MAAM;QACNC,QAAQ5C,kBAAkBO,mBAAmBiB,GAAG;IAClD,GACA;QAAEU,QAAQ;IAAI"}

package/dist/health-routes.d.ts

@@ -1,7 +1,7 @@
-import { HttpRouter } from '@effect/platform';
 import { HealthRegistryTag, ShutdownRegistryTag } from '@entifix/business';
+import { HttpRouter } from 'effect/http';
 /**
- * Mount the probe endpoints on a router.
+ * The probe endpoints, as a route layer to merge beside a service's own.
  *
  * - `GET /api/health` — the original endpoint, unchanged. Kept because
  *   Playwright's `readyPath` and existing tooling point at it.
@@ -20,5 +20,5 @@ import { HealthRegistryTag, ShutdownRegistryTag } from '@entifix/business';
  * The failing list carries probe **names** only — never a URI, host, or driver
  * message. This endpoint answers anyone who can reach the port.
  */
-export declare const withHealthRoutes: <E, R>(router: HttpRouter.HttpRouter<E, R>, serviceName: string) => HttpRouter.HttpRouter<import("@effect/platform/HttpBody").HttpBodyError | E, HealthRegistryTag | ShutdownRegistryTag | R>;
+export declare const healthRoutes: (serviceName: string) => import("effect/Layer").Layer<never, never, HttpRouter.HttpRouter | HttpRouter.Request<"Requires", HealthRegistryTag> | HttpRouter.Request<"Requires", ShutdownRegistryTag> | HttpRouter.Request<"Error", import("effect/http/HttpBody").HttpBodyError>>;
 //# sourceMappingURL=health-routes.d.ts.map

package/dist/health-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAgB3E;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,EACnC,QAAQ,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EACnC,aAAa,MAAM,8HAsDpB,CAAC"}
+{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAe7D;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,eAAO,MAAM,YAAY,GAAI,aAAa,MAAM,4PAwD/C,CAAC"}

package/dist/health-routes.js

@@ -1,6 +1,6 @@
-import { HttpRouter, HttpServerResponse } from '@effect/platform';
 import { HealthRegistryTag, ShutdownRegistryTag } from '@entifix/business';
 import { Effect, Ref } from 'effect';
+import { HttpRouter, HttpServerResponse } from 'effect/http';
 /**
  * How long a readiness result is reused. These endpoints are unauthenticated by
  * necessity (a probe cannot hold a session), so without a cache every request
@@ -8,7 +8,7 @@ import { Effect, Ref } from 'effect';
  * noise in the datastore's own metrics.
  */ const READY_CACHE_MS = 1000;
 /**
- * Mount the probe endpoints on a router.
+ * The probe endpoints, as a route layer to merge beside a service's own.
  *
  * - `GET /api/health` — the original endpoint, unchanged. Kept because
  *   Playwright's `readyPath` and existing tooling point at it.
@@ -27,12 +27,12 @@ import { Effect, Ref } from 'effect';
  * The failing list carries probe **names** only — never a URI, host, or driver
  * message. This endpoint answers anyone who can reach the port.
  */ // The return type is inferred rather than annotated: `HttpServerResponse.json`
-// widens the router's error channel with `HttpBodyError`, and spelling that out
+// widens the routes' error channel with `HttpBodyError`, and spelling that out
 // here would only duplicate what the platform types already say.
-export const withHealthRoutes = (router, serviceName)=>{
+export const healthRoutes = (serviceName)=>{
     // One cache per server instance (the e2e mock profile boots services
     // in-process, so a module-level cache would leak across them).
-    const cache = Ref.unsafeMake(null);
+    const cache = Ref.makeUnsafe(null);
     const cachedReport = Effect.gen(function*() {
         const now = Date.now();
         const entry = yield* Ref.get(cache);
@@ -45,37 +45,41 @@ export const withHealthRoutes = (router, serviceName)=>{
         });
         return report;
     });
-    return router.pipe(HttpRouter.get('/api/health', HttpServerResponse.json({
-        status: 'ok',
-        service: serviceName
-    })), HttpRouter.get('/api/health/live', HttpServerResponse.json({
-        status: 'live',
-        service: serviceName
-    })), HttpRouter.get('/api/health/ready', Effect.gen(function*() {
-        const shutdown = yield* ShutdownRegistryTag;
-        // Ahead of the cache, deliberately: a report cached a moment before the
-        // signal landed would go on answering `200` for up to READY_CACHE_MS,
-        // which is precisely the window a rolling restart lives in.
-        if (yield* shutdown.terminating) {
-            return yield* HttpServerResponse.json({
-                status: 'terminating',
+    return HttpRouter.addAll([
+        HttpRouter.route('GET', '/api/health', HttpServerResponse.json({
+            status: 'ok',
+            service: serviceName
+        })),
+        HttpRouter.route('GET', '/api/health/live', HttpServerResponse.json({
+            status: 'live',
+            service: serviceName
+        })),
+        HttpRouter.route('GET', '/api/health/ready', Effect.gen(function*() {
+            const shutdown = yield* ShutdownRegistryTag;
+            // Ahead of the cache, deliberately: a report cached a moment before the
+            // signal landed would go on answering `200` for up to READY_CACHE_MS,
+            // which is precisely the window a rolling restart lives in.
+            if (yield* shutdown.terminating) {
+                return yield* HttpServerResponse.json({
+                    status: 'terminating',
+                    service: serviceName
+                }, {
+                    status: 503
+                });
+            }
+            const report = yield* cachedReport;
+            return yield* HttpServerResponse.json(report.ready ? {
+                status: 'ready',
                 service: serviceName
+            } : {
+                status: 'degraded',
+                service: serviceName,
+                failing: report.failing
             }, {
-                status: 503
+                status: report.ready ? 200 : 503
             });
-        }
-        const report = yield* cachedReport;
-        return yield* HttpServerResponse.json(report.ready ? {
-            status: 'ready',
-            service: serviceName
-        } : {
-            status: 'degraded',
-            service: serviceName,
-            failing: report.failing
-        }, {
-            status: report.ready ? 200 : 503
-        });
-    })));
+        }))
+    ]);
 };
 
 //# sourceMappingURL=health-routes.js.map

package/dist/health-routes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/health-routes.ts"],"sourcesContent":["import { HttpRouter, HttpServerResponse } from '@effect/platform';\nimport type { HealthReport } from '@entifix/business';\nimport { HealthRegistryTag, ShutdownRegistryTag } from '@entifix/business';\nimport { Effect, Ref } from 'effect';\n\n/**\n * How long a readiness result is reused. These endpoints are unauthenticated by\n * necessity (a probe cannot hold a session), so without a cache every request\n * would reach Mongo — a cheap lever for anyone who can reach the port, and\n * noise in the datastore's own metrics.\n */\nconst READY_CACHE_MS = 1_000;\n\ninterface CacheEntry {\n  readonly at: number;\n  readonly report: HealthReport;\n}\n\n/**\n * Mount the probe endpoints on a router.\n *\n * - `GET /api/health` — the original endpoint, unchanged. Kept because\n *   Playwright's `readyPath` and existing tooling point at it.\n * - `GET /api/health/live` — **liveness**. Answers from the process alone: no\n *   datastore, no config-service, no session. This is deliberate and load\n *   bearing. A liveness probe that checks dependencies turns a Mongo blip into\n *   \"Kubernetes restarts every replica\", which is an outage the probe caused.\n * - `GET /api/health/ready` — **readiness**: `200` when every registered probe\n *   passes, `503 {status:'degraded', failing:[…]}` otherwise. Kubernetes pulls\n *   a not-ready pod out of the load balancer without killing it, which is what\n *   a reconnecting client wants. A process that has begun terminating answers\n *   `503 {status:'terminating'}` instead, **before** any probe runs: nothing is\n *   failing, and running the probes would ask a closing pool a question whose\n *   answer changes nothing.\n *\n * The failing list carries probe **names** only — never a URI, host, or driver\n * message. This endpoint answers anyone who can reach the port.\n */\n// The return type is inferred rather than annotated: `HttpServerResponse.json`\n// widens the router's error channel with `HttpBodyError`, and spelling that out\n// here would only duplicate what the platform types already say.\nexport const withHealthRoutes = <E, R>(\n  router: HttpRouter.HttpRouter<E, R>,\n  serviceName: string,\n) => {\n  // One cache per server instance (the e2e mock profile boots services\n  // in-process, so a module-level cache would leak across them).\n  const cache = Ref.unsafeMake<CacheEntry | null>(null);\n\n  const cachedReport = Effect.gen(function* () {\n    const now = Date.now();\n    const entry = yield* Ref.get(cache);\n    if (entry !== null && now - entry.at < READY_CACHE_MS) return entry.report;\n\n    const registry = yield* HealthRegistryTag;\n    const report = yield* registry.report;\n    yield* Ref.set(cache, { at: now, report });\n    return report;\n  });\n\n  return router.pipe(\n    HttpRouter.get(\n      '/api/health',\n      HttpServerResponse.json({ status: 'ok', service: serviceName }),\n    ),\n    HttpRouter.get(\n      '/api/health/live',\n      HttpServerResponse.json({ status: 'live', service: serviceName }),\n    ),\n    HttpRouter.get(\n      '/api/health/ready',\n      Effect.gen(function* () {\n        const shutdown = yield* ShutdownRegistryTag;\n        // Ahead of the cache, deliberately: a report cached a moment before the\n        // signal landed would go on answering `200` for up to READY_CACHE_MS,\n        // which is precisely the window a rolling restart lives in.\n        if (yield* shutdown.terminating) {\n          return yield* HttpServerResponse.json(\n            { status: 'terminating', service: serviceName },\n            { status: 503 },\n          );\n        }\n\n        const report = yield* cachedReport;\n        return yield* HttpServerResponse.json(\n          report.ready\n            ? { status: 'ready', service: serviceName }\n            : {\n                status: 'degraded',\n                service: serviceName,\n                failing: report.failing,\n              },\n          { status: report.ready ? 200 : 503 },\n        );\n      }),\n    ),\n  );\n};\n"],"names":["HttpRouter","HttpServerResponse","HealthRegistryTag","ShutdownRegistryTag","Effect","Ref","READY_CACHE_MS","withHealthRoutes","router","serviceName","cache","unsafeMake","cachedReport","gen","now","Date","entry","get","at","report","registry","set","pipe","json","status","service","shutdown","terminating","ready","failing"],"mappings":"AAAA,SAASA,UAAU,EAAEC,kBAAkB,QAAQ,mBAAmB;AAElE,SAASC,iBAAiB,EAAEC,mBAAmB,QAAQ,oBAAoB;AAC3E,SAASC,MAAM,EAAEC,GAAG,QAAQ,SAAS;AAErC;;;;;CAKC,GACD,MAAMC,iBAAiB;AAOvB;;;;;;;;;;;;;;;;;;;CAmBC,GACD,+EAA+E;AAC/E,gFAAgF;AAChF,iEAAiE;AACjE,OAAO,MAAMC,mBAAmB,CAC9BC,QACAC;IAEA,qEAAqE;IACrE,+DAA+D;IAC/D,MAAMC,QAAQL,IAAIM,UAAU,CAAoB;IAEhD,MAAMC,eAAeR,OAAOS,GAAG,CAAC;QAC9B,MAAMC,MAAMC,KAAKD,GAAG;QACpB,MAAME,QAAQ,OAAOX,IAAIY,GAAG,CAACP;QAC7B,IAAIM,UAAU,QAAQF,MAAME,MAAME,EAAE,GAAGZ,gBAAgB,OAAOU,MAAMG,MAAM;QAE1E,MAAMC,WAAW,OAAOlB;QACxB,MAAMiB,SAAS,OAAOC,SAASD,MAAM;QACrC,OAAOd,IAAIgB,GAAG,CAACX,OAAO;YAAEQ,IAAIJ;YAAKK;QAAO;QACxC,OAAOA;IACT;IAEA,OAAOX,OAAOc,IAAI,CAChBtB,WAAWiB,GAAG,CACZ,eACAhB,mBAAmBsB,IAAI,CAAC;QAAEC,QAAQ;QAAMC,SAAShB;IAAY,KAE/DT,WAAWiB,GAAG,CACZ,oBACAhB,mBAAmBsB,IAAI,CAAC;QAAEC,QAAQ;QAAQC,SAAShB;IAAY,KAEjET,WAAWiB,GAAG,CACZ,qBACAb,OAAOS,GAAG,CAAC;QACT,MAAMa,WAAW,OAAOvB;QACxB,wEAAwE;QACxE,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,OAAOuB,SAASC,WAAW,EAAE;YAC/B,OAAO,OAAO1B,mBAAmBsB,IAAI,CACnC;gBAAEC,QAAQ;gBAAeC,SAAShB;YAAY,GAC9C;gBAAEe,QAAQ;YAAI;QAElB;QAEA,MAAML,SAAS,OAAOP;QACtB,OAAO,OAAOX,mBAAmBsB,IAAI,CACnCJ,OAAOS,KAAK,GACR;YAAEJ,QAAQ;YAASC,SAAShB;QAAY,IACxC;YACEe,QAAQ;YACRC,SAAShB;YACToB,SAASV,OAAOU,OAAO;QACzB,GACJ;YAAEL,QAAQL,OAAOS,KAAK,GAAG,MAAM;QAAI;IAEvC;AAGN,EAAE"}
+{"version":3,"sources":["../src/health-routes.ts"],"sourcesContent":["import type { HealthReport } from '@entifix/business';\nimport { HealthRegistryTag, ShutdownRegistryTag } from '@entifix/business';\nimport { Effect, Ref } from 'effect';\nimport { HttpRouter, HttpServerResponse } from 'effect/http';\n\n/**\n * How long a readiness result is reused. These endpoints are unauthenticated by\n * necessity (a probe cannot hold a session), so without a cache every request\n * would reach Mongo — a cheap lever for anyone who can reach the port, and\n * noise in the datastore's own metrics.\n */\nconst READY_CACHE_MS = 1_000;\n\ninterface CacheEntry {\n  readonly at: number;\n  readonly report: HealthReport;\n}\n\n/**\n * The probe endpoints, as a route layer to merge beside a service's own.\n *\n * - `GET /api/health` — the original endpoint, unchanged. Kept because\n *   Playwright's `readyPath` and existing tooling point at it.\n * - `GET /api/health/live` — **liveness**. Answers from the process alone: no\n *   datastore, no config-service, no session. This is deliberate and load\n *   bearing. A liveness probe that checks dependencies turns a Mongo blip into\n *   \"Kubernetes restarts every replica\", which is an outage the probe caused.\n * - `GET /api/health/ready` — **readiness**: `200` when every registered probe\n *   passes, `503 {status:'degraded', failing:[…]}` otherwise. Kubernetes pulls\n *   a not-ready pod out of the load balancer without killing it, which is what\n *   a reconnecting client wants. A process that has begun terminating answers\n *   `503 {status:'terminating'}` instead, **before** any probe runs: nothing is\n *   failing, and running the probes would ask a closing pool a question whose\n *   answer changes nothing.\n *\n * The failing list carries probe **names** only — never a URI, host, or driver\n * message. This endpoint answers anyone who can reach the port.\n */\n// The return type is inferred rather than annotated: `HttpServerResponse.json`\n// widens the routes' error channel with `HttpBodyError`, and spelling that out\n// here would only duplicate what the platform types already say.\nexport const healthRoutes = (serviceName: string) => {\n  // One cache per server instance (the e2e mock profile boots services\n  // in-process, so a module-level cache would leak across them).\n  const cache = Ref.makeUnsafe<CacheEntry | null>(null);\n\n  const cachedReport = Effect.gen(function* () {\n    const now = Date.now();\n    const entry = yield* Ref.get(cache);\n    if (entry !== null && now - entry.at < READY_CACHE_MS) return entry.report;\n\n    const registry = yield* HealthRegistryTag;\n    const report = yield* registry.report;\n    yield* Ref.set(cache, { at: now, report });\n    return report;\n  });\n\n  return HttpRouter.addAll([\n    HttpRouter.route(\n      'GET',\n      '/api/health',\n      HttpServerResponse.json({ status: 'ok', service: serviceName }),\n    ),\n    HttpRouter.route(\n      'GET',\n      '/api/health/live',\n      HttpServerResponse.json({ status: 'live', service: serviceName }),\n    ),\n    HttpRouter.route(\n      'GET',\n      '/api/health/ready',\n      Effect.gen(function* () {\n        const shutdown = yield* ShutdownRegistryTag;\n        // Ahead of the cache, deliberately: a report cached a moment before the\n        // signal landed would go on answering `200` for up to READY_CACHE_MS,\n        // which is precisely the window a rolling restart lives in.\n        if (yield* shutdown.terminating) {\n          return yield* HttpServerResponse.json(\n            { status: 'terminating', service: serviceName },\n            { status: 503 },\n          );\n        }\n\n        const report = yield* cachedReport;\n        return yield* HttpServerResponse.json(\n          report.ready\n            ? { status: 'ready', service: serviceName }\n            : {\n                status: 'degraded',\n                service: serviceName,\n                failing: report.failing,\n              },\n          { status: report.ready ? 200 : 503 },\n        );\n      }),\n    ),\n  ]);\n};\n"],"names":["HealthRegistryTag","ShutdownRegistryTag","Effect","Ref","HttpRouter","HttpServerResponse","READY_CACHE_MS","healthRoutes","serviceName","cache","makeUnsafe","cachedReport","gen","now","Date","entry","get","at","report","registry","set","addAll","route","json","status","service","shutdown","terminating","ready","failing"],"mappings":"AACA,SAASA,iBAAiB,EAAEC,mBAAmB,QAAQ,oBAAoB;AAC3E,SAASC,MAAM,EAAEC,GAAG,QAAQ,SAAS;AACrC,SAASC,UAAU,EAAEC,kBAAkB,QAAQ,cAAc;AAE7D;;;;;CAKC,GACD,MAAMC,iBAAiB;AAOvB;;;;;;;;;;;;;;;;;;;CAmBC,GACD,+EAA+E;AAC/E,+EAA+E;AAC/E,iEAAiE;AACjE,OAAO,MAAMC,eAAe,CAACC;IAC3B,qEAAqE;IACrE,+DAA+D;IAC/D,MAAMC,QAAQN,IAAIO,UAAU,CAAoB;IAEhD,MAAMC,eAAeT,OAAOU,GAAG,CAAC;QAC9B,MAAMC,MAAMC,KAAKD,GAAG;QACpB,MAAME,QAAQ,OAAOZ,IAAIa,GAAG,CAACP;QAC7B,IAAIM,UAAU,QAAQF,MAAME,MAAME,EAAE,GAAGX,gBAAgB,OAAOS,MAAMG,MAAM;QAE1E,MAAMC,WAAW,OAAOnB;QACxB,MAAMkB,SAAS,OAAOC,SAASD,MAAM;QACrC,OAAOf,IAAIiB,GAAG,CAACX,OAAO;YAAEQ,IAAIJ;YAAKK;QAAO;QACxC,OAAOA;IACT;IAEA,OAAOd,WAAWiB,MAAM,CAAC;QACvBjB,WAAWkB,KAAK,CACd,OACA,eACAjB,mBAAmBkB,IAAI,CAAC;YAAEC,QAAQ;YAAMC,SAASjB;QAAY;QAE/DJ,WAAWkB,KAAK,CACd,OACA,oBACAjB,mBAAmBkB,IAAI,CAAC;YAAEC,QAAQ;YAAQC,SAASjB;QAAY;QAEjEJ,WAAWkB,KAAK,CACd,OACA,qBACApB,OAAOU,GAAG,CAAC;YACT,MAAMc,WAAW,OAAOzB;YACxB,wEAAwE;YACxE,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,OAAOyB,SAASC,WAAW,EAAE;gBAC/B,OAAO,OAAOtB,mBAAmBkB,IAAI,CACnC;oBAAEC,QAAQ;oBAAeC,SAASjB;gBAAY,GAC9C;oBAAEgB,QAAQ;gBAAI;YAElB;YAEA,MAAMN,SAAS,OAAOP;YACtB,OAAO,OAAON,mBAAmBkB,IAAI,CACnCL,OAAOU,KAAK,GACR;gBAAEJ,QAAQ;gBAASC,SAASjB;YAAY,IACxC;gBACEgB,QAAQ;gBACRC,SAASjB;gBACTqB,SAASX,OAAOW,OAAO;YACzB,GACJ;gBAAEL,QAAQN,OAAOU,KAAK,GAAG,MAAM;YAAI;QAEvC;KAEH;AACH,EAAE"}

package/dist/load-remote-configuration.d.ts

@@ -1,6 +1,6 @@
 import { ConfigurationClientInMemory, ConfigurationPlain, EntifixConnError } from '@entifix/core';
 import { Context, Effect, Schedule } from 'effect';
-declare const LoadedConfigurationTag_base: Context.TagClass<LoadedConfigurationTag, "LoadedConfigurationTag", ConfigurationPlain>;
+declare const LoadedConfigurationTag_base: Context.ServiceClass<LoadedConfigurationTag, "LoadedConfigurationTag", ConfigurationPlain>;
 /**
  * DI tag carrying the raw {@link ConfigurationPlain} a service loaded at boot,
  * so a `GET /api/config` introspection route can expose it (redacted).