@gettersethya/mira 0.1.0-alpha.2 → 0.1.0-alpha.21

package/dist/src/http/auth.d.ts

@@ -1,4 +1,5 @@
 import { Context, Effect } from "effect";
+import * as jose from "jose";
 export type JwtPayload = {
     sub: string;
     col: string;
@@ -15,7 +16,7 @@ export declare class AuthError extends AuthError_base<{
     reason: string;
 }> {
 }
-declare const AuthService_base: Context.TagClass<AuthService, "AuthService", {
+declare const AuthService_base: Context.ServiceClass<AuthService, "AuthService", {
     hashPassword(plain: string): Effect.Effect<string>;
     verifyPassword(plain: string, stored: string): Effect.Effect<boolean>;
 }>;
@@ -34,5 +35,6 @@ export declare function verifyJwt(token: string, secret: string): Effect.Effect<
     sub: string;
     col: string;
 }, AuthError, never>;
+export declare function verifyAnyJwt(token: string, secret: string): Effect.Effect<jose.JWTVerifyResult<jose.JWTPayload>, AuthError, never>;
 export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/http/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/http/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE9C,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,MAAM,MAAM,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;;;;AAE5E,qBAAa,SAAU,SAAQ,eAA8B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;;wBAK3D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;0BAC5B,MAAM,UAAU,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;;AAJzE,qBAAa,WAAY,SAAQ,gBAM9B;CAAG;AAEN,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,8CAAoE,CAAA;AAE9G,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,+CACe,CAAA;AAE3E,wBAAgB,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,2CAY1D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,2CAYtE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;qBAe5D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;qBActD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,MAAM,MAAM,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;;;;AAE5E,qBAAa,SAAU,SAAQ,eAA8B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;;wBAK3D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;0BAC5B,MAAM,UAAU,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;;AAJzE,qBAAa,WAAY,SAAQ,gBAMf;CAAG;AAErB,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,8CAAoE,CAAA;AAE9G,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,+CACe,CAAA;AAE3E,wBAAgB,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,2CAY1D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,2CAYtE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;qBAe5D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;qBActD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,0EASzD"}

package/dist/src/http/auth.js

@@ -1,8 +1,8 @@
-import * as jose from "jose";
 import { Context, Data, Effect } from "effect";
+import * as jose from "jose";
 export class AuthError extends Data.TaggedError("AuthError") {
 }
-export class AuthService extends Context.Tag("AuthService")() {
+export class AuthService extends Context.Service()("AuthService") {
 }
 export const hashPassword = (plain) => Effect.flatMap(AuthService, (auth) => auth.hashPassword(plain));
 export const verifyPassword = (plain, stored) => Effect.flatMap(AuthService, (auth) => auth.verifyPassword(plain, stored));
@@ -63,4 +63,14 @@ export function verifyJwt(token, secret) {
         catch: (e) => new AuthError({ reason: String(e) })
     });
 }
+export function verifyAnyJwt(token, secret) {
+    return Effect.tryPromise({
+        try: async () => {
+            const encoder = new TextEncoder();
+            const result = await jose.jwtVerify(token, encoder.encode(secret));
+            return result;
+        },
+        catch: (e) => new AuthError({ reason: String(e) })
+    });
+}
 //# sourceMappingURL=auth.js.map

package/dist/src/http/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAK9C,MAAM,OAAO,SAAU,SAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAAqB;CAAG;AAEnF,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAMxD;CAAG;AAEN,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3E,MAAM,UAAU,OAAO,CAAC,OAAmB,EAAE,MAAc;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;iBAClE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,KAAK,CAAC;iBACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAyB,EAAE,MAAc;IACrE,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;iBAC5F,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc;IAC3D,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;QAC9B,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YAC9C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAK5B,MAAM,OAAO,SAAU,SAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAAqB;CAAG;AAEnF,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAM7C,CAAC,aAAa,CAAC;CAAG;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3E,MAAM,UAAU,OAAO,CAAC,OAAmB,EAAE,MAAc;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;iBAClE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,KAAK,CAAC;iBACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAyB,EAAE,MAAc;IACrE,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;iBAC5F,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc;IAC3D,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;QAC9B,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YAC9C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YAClE,OAAO,MAAM,CAAA;QACf,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/http/cors.d.ts

@@ -0,0 +1,94 @@
+/**
+ * CORS configuration for the Mira HTTP server.
+ *
+ * Applied as `HttpMiddleware.cors(...)` in `MiraApp.buildLayer()`, alongside
+ * the IP annotation middleware. Covers all routes (including error responses —
+ * the middleware stamps headers via a pre-response handler, which also runs on
+ * the failure path) and answers `OPTIONS` preflights with a `204`.
+ *
+ * When `cors()` is never called on the builder, the server uses
+ * `defaultCorsConfig`, which reflects every requesting origin and allows
+ * credentials — so a separately-hosted frontend with cookie sessions works
+ * with zero configuration in development.
+ *
+ * @see defaultCorsConfig — the permissive default
+ * @see makeCorsMiddleware — maps this config onto `HttpMiddleware.cors`
+ * @see MiraBuilder.cors — where this config is set
+ */
+export interface CorsConfig {
+    /**
+     * Origins allowed to access the API.
+     *
+     * - Omitted or `[]` → `Access-Control-Allow-Origin: *` (all origins).
+     * - One origin → that origin is always echoed with `Vary: Origin`.
+     * - Several origins → the request origin is echoed only when listed,
+     *   otherwise no `Access-Control-Allow-Origin` header is sent.
+     * - Predicate → the request origin is echoed only when it returns true.
+     *
+     * A literal `"*"` entry combined with `credentials: true` is rejected by
+     * `assertValidCorsConfig` — browsers forbid wildcard + credentials.
+     */
+    readonly allowedOrigins?: ReadonlyArray<string> | ((origin: string) => boolean);
+    /**
+     * Value of the `Access-Control-Allow-Methods` preflight header.
+     * Defaults to `["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"]`.
+     */
+    readonly allowedMethods?: ReadonlyArray<string>;
+    /**
+     * Value of the `Access-Control-Allow-Headers` preflight header.
+     * Defaults to reflecting the request's `Access-Control-Request-Headers`,
+     * which always covers every header the client SDK sends.
+     */
+    readonly allowedHeaders?: ReadonlyArray<string>;
+    /**
+     * Value of the `Access-Control-Expose-Headers` header.
+     * Unset by default (no headers exposed).
+     */
+    readonly exposedHeaders?: ReadonlyArray<string>;
+    /**
+     * Value of the `Access-Control-Max-Age` preflight header, in seconds.
+     * Unset by default (preflights are not cached).
+     */
+    readonly maxAge?: number;
+    /**
+     * Whether to send `Access-Control-Allow-Credentials: true`.
+     * Requires explicit `allowedOrigins` — wildcard + credentials throws.
+     * Defaults to false.
+     */
+    readonly credentials?: boolean;
+}
+/**
+ * The default CORS configuration: reflects every requesting origin and sends
+ * `Access-Control-Allow-Credentials: true`, so a frontend on another origin
+ * works with zero configuration **including cookie-based auth**.
+ *
+ * A literal `Access-Control-Allow-Origin: *` cannot be combined with
+ * credentials (browsers reject it), so the default uses a predicate that
+ * accepts any present origin and lets the middleware echo the request's
+ * `Origin` back instead. Requests without an `Origin` header (same-origin,
+ * non-browser clients) simply receive no CORS header.
+ *
+ * This is a development-first default: any website can issue credentialed
+ * requests with the user's cookie. Lock it down with `Mira.builder().cors()`
+ * for production.
+ *
+ * @see CorsConfig
+ */
+export declare const defaultCorsConfig: CorsConfig;
+/**
+ * Rejects CORS configurations that browsers refuse to honor: `credentials`
+ * combined with a wildcard origin (omitted, empty, or containing `"*"`).
+ * A predicate origin check cannot be inspected statically and is always
+ * allowed — it echoes only origins it accepts, which is safe.
+ *
+ * @throws If the config combines `credentials: true` with a wildcard origin.
+ */
+export declare function assertValidCorsConfig(config: CorsConfig): void;
+/**
+ * Maps a `CorsConfig` onto Effect's `HttpMiddleware.cors` middleware.
+ * Validates first, so misconfiguration fails at boot, not per request.
+ *
+ * @see CorsConfig
+ */
+export declare const makeCorsMiddleware: (config: CorsConfig) => <E, R>(httpApp: import("effect/Effect").Effect<import("effect/http/HttpServerResponse").HttpServerResponse, E, R>) => import("effect/Effect").Effect<import("effect/http/HttpServerResponse").HttpServerResponse, E, R | import("effect/http/HttpServerRequest").HttpServerRequest>;
+//# sourceMappingURL=cors.d.ts.map

package/dist/src/http/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/http/cors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAA;IAC/E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAG/B,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,QASvD;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,UAAU,wRAUpD,CAAA"}

package/dist/src/http/cors.js

@@ -0,0 +1,57 @@
+import { HttpMiddleware } from "effect/http";
+/**
+ * The default CORS configuration: reflects every requesting origin and sends
+ * `Access-Control-Allow-Credentials: true`, so a frontend on another origin
+ * works with zero configuration **including cookie-based auth**.
+ *
+ * A literal `Access-Control-Allow-Origin: *` cannot be combined with
+ * credentials (browsers reject it), so the default uses a predicate that
+ * accepts any present origin and lets the middleware echo the request's
+ * `Origin` back instead. Requests without an `Origin` header (same-origin,
+ * non-browser clients) simply receive no CORS header.
+ *
+ * This is a development-first default: any website can issue credentialed
+ * requests with the user's cookie. Lock it down with `Mira.builder().cors()`
+ * for production.
+ *
+ * @see CorsConfig
+ */
+export const defaultCorsConfig = {
+    allowedOrigins: (origin) => typeof origin === "string" && origin.length > 0,
+    credentials: true
+};
+/**
+ * Rejects CORS configurations that browsers refuse to honor: `credentials`
+ * combined with a wildcard origin (omitted, empty, or containing `"*"`).
+ * A predicate origin check cannot be inspected statically and is always
+ * allowed — it echoes only origins it accepts, which is safe.
+ *
+ * @throws If the config combines `credentials: true` with a wildcard origin.
+ */
+export function assertValidCorsConfig(config) {
+    if (config.credentials !== true)
+        return;
+    const origins = config.allowedOrigins;
+    if (origins === undefined || (Array.isArray(origins) && (origins.length === 0 || origins.includes("*")))) {
+        throw new Error("Invalid CORS config: credentials: true requires explicit allowedOrigins. " +
+            'Browsers reject Access-Control-Allow-Origin: "*" with credentials — list the allowed origins explicitly or use a predicate.');
+    }
+}
+/**
+ * Maps a `CorsConfig` onto Effect's `HttpMiddleware.cors` middleware.
+ * Validates first, so misconfiguration fails at boot, not per request.
+ *
+ * @see CorsConfig
+ */
+export const makeCorsMiddleware = (config) => {
+    assertValidCorsConfig(config);
+    return HttpMiddleware.cors({
+        allowedOrigins: config.allowedOrigins,
+        allowedMethods: config.allowedMethods,
+        allowedHeaders: config.allowedHeaders,
+        exposedHeaders: config.exposedHeaders,
+        maxAge: config.maxAge,
+        credentials: config.credentials
+    });
+};
+//# sourceMappingURL=cors.js.map

package/dist/src/http/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/http/cors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AA8D5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;IAC3E,WAAW,EAAE,IAAI;CAClB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI;QAAE,OAAM;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAA;IACrC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,6HAA6H,CAChI,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAkB,EAAE,EAAE;IACvD,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,OAAO,cAAc,CAAC,IAAI,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/src/http/errors.d.ts

@@ -1,5 +1,5 @@
-import { HttpServerResponse } from "@effect/platform";
 import { Effect } from "effect";
+import { HttpServerResponse } from "effect/http";
 import type { CollectionError } from "../collection-service/errors.js";
 import type { FileStorageError } from "../storage/storage.js";
 /**

package/dist/src/http/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,CAAC,EACxC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,eAAe,GAAG,gBAAgB,EAAE,CAAC,CAAC,KAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,CAmCxD,CAAA"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,CAAC,EACxC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,eAAe,GAAG,gBAAgB,EAAE,CAAC,CAAC,KAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,CAmCxD,CAAA"}

package/dist/src/http/errors.js

@@ -1,5 +1,5 @@
-import { HttpServerResponse } from "@effect/platform";
 import { Effect } from "effect";
+import { HttpServerResponse } from "effect/http";
 /**
  * Effect error handler that maps `CollectionError` and `FileStorageError` variants
  * to HTTP response objects with appropriate status codes.
@@ -26,11 +26,11 @@ import { Effect } from "effect";
  * @see CollectionError — the union type this handler catches
  */
 export const catchCollectionErrors = (eff) => Effect.catchTags(eff, {
-    NotFoundError: (e) => Effect.fail(HttpServerResponse.unsafeJson({ error: "not_found", message: `Record not found in "${e.collection}"` }, { status: 404 })),
-    ForbiddenError: () => Effect.fail(HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 })),
-    ValidationError: (e) => Effect.fail(HttpServerResponse.unsafeJson({ error: "validation_failed", issues: e.issues }, { status: 422 })),
-    ReadOnlyError: () => Effect.fail(HttpServerResponse.unsafeJson({ error: "read_only" }, { status: 405 })),
-    FileStorageError: (e) => Effect.fail(HttpServerResponse.unsafeJson({ error: "storage_error", reason: e.reason }, { status: 502 })),
-    SqlError: () => Effect.fail(HttpServerResponse.unsafeJson({ error: "internal_error" }, { status: 500 })),
+    NotFoundError: (e) => Effect.fail(HttpServerResponse.jsonUnsafe({ error: "not_found", message: `Record not found in "${e.collection}"` }, { status: 404 })),
+    ForbiddenError: () => Effect.fail(HttpServerResponse.jsonUnsafe({ error: "forbidden" }, { status: 403 })),
+    ValidationError: (e) => Effect.fail(HttpServerResponse.jsonUnsafe({ error: "validation_failed", issues: e.issues }, { status: 422 })),
+    ReadOnlyError: () => Effect.fail(HttpServerResponse.jsonUnsafe({ error: "read_only" }, { status: 405 })),
+    FileStorageError: (e) => Effect.fail(HttpServerResponse.jsonUnsafe({ error: "storage_error", reason: e.reason }, { status: 502 })),
+    SqlError: () => Effect.fail(HttpServerResponse.jsonUnsafe({ error: "internal_error" }, { status: 500 })),
 });
 //# sourceMappingURL=errors.js.map

package/dist/src/http/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAI/B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,GAA4D,EACA,EAAE,CAC9D,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CACnB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC,UAAU,GAAG,EAAE,EACxE,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,cAAc,EAAE,GAAG,EAAE,CACnB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CAChF;IACH,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CACrB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAChD,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,aAAa,EAAE,GAAG,EAAE,CAClB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CAChF;IACH,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAC5C,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,QAAQ,EAAE,GAAG,EAAE,CACb,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CACrF;CACJ,CAAC,CAAA"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAKhD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,GAA4D,EACA,EAAE,CAC9D,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CACnB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC,UAAU,GAAG,EAAE,EACxE,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,cAAc,EAAE,GAAG,EAAE,CACnB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CAChF;IACH,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CACrB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAChD,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,aAAa,EAAE,GAAG,EAAE,CAClB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CAChF;IACH,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAC5C,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,QAAQ,EAAE,GAAG,EAAE,CACb,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CACrF;CACJ,CAAC,CAAA"}

package/dist/src/http/file-serve.d.ts

@@ -1,10 +1,10 @@
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "@effect/platform";
-import { Effect } from "effect";
 import type { AnyCollectionDef } from "@gettersethya/mira-client";
+import { Effect } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { AppConfig } from "../config/index.js";
 import { Repository } from "../repository/repository.js";
 import { FileStorage } from "../storage/storage.js";
 import { ThumbnailService } from "../thumbnail/types.js";
-import { AppConfig } from "../config/index.js";
 export type FileServeServices = Repository | FileStorage | ThumbnailService | AppConfig;
-export declare function makeFileServeRoute(collections: ReadonlyArray<AnyCollectionDef>): Effect.Effect<HttpServerResponse.HttpServerResponse, never, FileServeServices | HttpServerRequest.HttpServerRequest | HttpRouter.RouteContext>;
+export declare function makeFileServeRoute(collections: ReadonlyArray<AnyCollectionDef>, adminCollections?: ReadonlyArray<string>): Effect.Effect<HttpServerResponse.HttpServerResponse, never, FileServeServices | HttpServerRequest.HttpServerRequest | HttpRouter.RouteContext>;
 //# sourceMappingURL=file-serve.d.ts.map

package/dist/src/http/file-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-serve.d.ts","sourceRoot":"","sources":["../../../src/http/file-serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAS,MAAM,EAAoB,MAAM,QAAQ,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAGjE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAkB,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAI7C,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,CAAA;AAmCvF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAC3C,MAAM,CAAC,MAAM,CACd,kBAAkB,CAAC,kBAAkB,EACrC,KAAK,EACL,iBAAiB,GAAG,iBAAiB,CAAC,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAClF,CA+BA"}
+{"version":3,"file":"file-serve.d.ts","sourceRoot":"","sources":["../../../src/http/file-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,MAAM,EAAoB,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAI/E,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAiB,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAItE,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,CAAA;AAmCvF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,EAC5C,gBAAgB,GAAE,aAAa,CAAC,MAAM,CAAM,GAC3C,MAAM,CAAC,MAAM,CACd,kBAAkB,CAAC,kBAAkB,EACrC,KAAK,EACL,iBAAiB,GAAG,iBAAiB,CAAC,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAClF,CAgCA"}

package/dist/src/http/file-serve.js

@@ -1,11 +1,11 @@
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "@effect/platform";
-import { Chunk, Effect, Redacted, Stream } from "effect";
+import { Effect, Redacted, Stream } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { andWhere, idClause, resolveCtxPlaceholders } from "../collection-service/where.js";
-import { Repository } from "../repository/repository.js";
-import { FileStorage } from "../storage/storage.js";
-import { ThumbnailService, parseThumbSpec } from "../thumbnail/types.js";
 import { AppConfig } from "../config/index.js";
+import { Repository } from "../repository/repository.js";
 import { enforcerForAction } from "../rule/enforcer.js";
+import { FileStorage } from "../storage/storage.js";
+import { parseThumbSpec, ThumbnailService } from "../thumbnail/types.js";
 import { verifyFileToken } from "./auth.js";
 const MIME_MAP = {
     jpg: "image/jpeg",
@@ -34,23 +34,24 @@ function getQueryParam(req, name) {
     const queryStr = req.url.includes("?") ? req.url.split("?")[1] : "";
     return new URLSearchParams(queryStr).get(name) ?? undefined;
 }
-export function makeFileServeRoute(collections) {
+export function makeFileServeRoute(collections, adminCollections = []) {
     const collectionMap = new Map(collections.map((c) => [c.name, c]));
+    const adminSet = new Set(adminCollections);
     return Effect.flatMap(HttpRouter.RouteContext, (routeCtx) => {
         const colName = routeCtx.params["collection"];
         const recordId = routeCtx.params["id"];
         const filename = routeCtx.params["filename"];
         if (colName === undefined || recordId === undefined || filename === undefined) {
-            return Effect.succeed(HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 }));
+            return Effect.succeed(HttpServerResponse.jsonUnsafe({ error: "not_found" }, { status: 404 }));
         }
         const collection = collectionMap.get(colName);
         if (collection === undefined) {
-            return Effect.succeed(HttpServerResponse.unsafeJson({ error: "not_found", message: `Unknown collection "${colName}"` }, { status: 404 }));
+            return Effect.succeed(HttpServerResponse.jsonUnsafe({ error: "not_found", message: `Unknown collection "${colName}"` }, { status: 404 }));
         }
-        return Effect.flatMap(HttpServerRequest.HttpServerRequest, (req) => Effect.catchAllCause(serveFile(collection, recordId, filename, req), () => Effect.succeed(HttpServerResponse.unsafeJson({ error: "internal" }, { status: 500 }))));
+        return Effect.flatMap(HttpServerRequest.HttpServerRequest, (req) => Effect.catchCause(serveFile(collection, recordId, filename, req, adminSet), () => Effect.succeed(HttpServerResponse.jsonUnsafe({ error: "internal" }, { status: 500 }))));
     });
 }
-function serveFile(collection, recordId, filename, req) {
+function serveFile(collection, recordId, filename, req, adminSet) {
     return Effect.gen(function* () {
         const config = yield* AppConfig;
         const jwtSecret = Redacted.value(config.jwtSecret);
@@ -62,7 +63,7 @@ function serveFile(collection, recordId, filename, req) {
             .viewFilter(collection.name, { where: idClause(recordId) })
             .pipe(Effect.orElseSucceed(() => []));
         if (rows.length === 0) {
-            return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+            return HttpServerResponse.jsonUnsafe({ error: "not_found" }, { status: 404 });
         }
         const record = rows[0];
         // Step 3: find the file field whose stored value equals `filename`
@@ -76,44 +77,48 @@ function serveFile(collection, recordId, filename, req) {
             }
         }
         if (fieldName === undefined || fieldProp === undefined) {
-            return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+            return HttpServerResponse.jsonUnsafe({ error: "not_found" }, { status: 404 });
         }
         // Step 4: protected field — verify token and enforce view rule
         if (fieldProp["x-protected"] === true) {
             const tokenParam = getQueryParam(req, "token");
             if (tokenParam === undefined) {
-                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+                return HttpServerResponse.jsonUnsafe({ error: "forbidden" }, { status: 403 });
             }
             const tokenPayload = yield* verifyFileToken(tokenParam, jwtSecret).pipe(Effect.orElseSucceed(() => null));
             if (tokenPayload === null || tokenPayload.filecol !== collection.name) {
-                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+                return HttpServerResponse.jsonUnsafe({ error: "forbidden" }, { status: 403 });
             }
             // Reconstruct auth context from file token sub + col
             const authRows = yield* repo
                 .viewFilter(tokenPayload.col, { where: idClause(tokenPayload.sub) })
                 .pipe(Effect.orElseSucceed(() => []));
             if (authRows.length === 0) {
-                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+                return HttpServerResponse.jsonUnsafe({ error: "forbidden" }, { status: 403 });
             }
             const ctx = {
                 auth: { collection: tokenPayload.col, record: authRows[0] },
                 headers: {},
                 query: {}
             };
-            // Enforce the collection's view rule against the specific record
-            const ruleResult = enforcerForAction(collection.schema, "view");
-            if (ruleResult === null) {
-                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
-            }
-            const ruleWhere = yield* resolveCtxPlaceholders(ruleResult, ctx, collection.name, "view").pipe(Effect.catchTag("ForbiddenError", () => Effect.succeed(null)));
-            if (ruleWhere === null) {
-                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
-            }
-            const allowed = yield* repo
-                .viewFilter(collection.name, { where: andWhere(ruleWhere, idClause(recordId)) })
-                .pipe(Effect.orElseSucceed(() => []));
-            if (allowed.length === 0) {
-                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+            // Admin tokens (declared by an admin plugin, e.g. the dashboard) bypass
+            // the per-collection view rule for protected file downloads.
+            if (!adminSet.has(tokenPayload.col)) {
+                // Enforce the collection's view rule against the specific record
+                const ruleResult = enforcerForAction(collection.schema, "view");
+                if (ruleResult === null) {
+                    return HttpServerResponse.jsonUnsafe({ error: "forbidden" }, { status: 403 });
+                }
+                const ruleWhere = yield* resolveCtxPlaceholders(ruleResult, ctx, collection.name, "view").pipe(Effect.catchTag("ForbiddenError", () => Effect.succeed(null)));
+                if (ruleWhere === null) {
+                    return HttpServerResponse.jsonUnsafe({ error: "forbidden" }, { status: 403 });
+                }
+                const allowed = yield* repo
+                    .viewFilter(collection.name, { where: andWhere(ruleWhere, idClause(recordId)) })
+                    .pipe(Effect.orElseSucceed(() => []));
+                if (allowed.length === 0) {
+                    return HttpServerResponse.jsonUnsafe({ error: "forbidden" }, { status: 403 });
+                }
             }
         }
         // Steps 5-8: derive MIME, handle thumbnail with persistent cache, serve bytes
@@ -130,23 +135,23 @@ function serveFile(collection, recordId, filename, req) {
             else {
                 const original = yield* fileStorage.read(filename).pipe(Effect.catchTag("FileStorageNotFound", () => Effect.succeed(null)), Effect.orDie);
                 if (original === null) {
-                    return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+                    return HttpServerResponse.jsonUnsafe({ error: "not_found" }, { status: 404 });
                 }
                 // On thumb error fall back to original rather than returning an error
                 const resized = yield* thumbSvc
                     .resize(original, mimeType, thumbSpec)
-                    .pipe(Effect.orElse(() => Effect.succeed(original)));
+                    .pipe(Effect.catch(() => Effect.succeed(original)));
                 // Best-effort: persist the thumbnail for future requests
                 yield* fileStorage
-                    .upload(cacheKey, Stream.fromChunk(Chunk.of(resized)), mimeType)
-                    .pipe(Effect.orElse(() => Effect.void));
+                    .upload(cacheKey, Stream.fromArray([resized]), mimeType)
+                    .pipe(Effect.catch(() => Effect.void));
                 bytes = resized;
             }
         }
         else {
             const result = yield* fileStorage.read(filename).pipe(Effect.catchTag("FileStorageNotFound", () => Effect.succeed(null)), Effect.orDie);
             if (result === null) {
-                return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+                return HttpServerResponse.jsonUnsafe({ error: "not_found" }, { status: 404 });
             }
             bytes = result;
         }

package/dist/src/http/file-serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-serve.js","sourceRoot":"","sources":["../../../src/http/file-serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAE1F,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAI3C,MAAM,QAAQ,GAA2B;IACvC,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,UAAU;IACf,EAAE,EAAE,wBAAwB;IAC5B,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,0BAA0B;CAChC,CAAA;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAA;AACpD,CAAC;AAED,SAAS,aAAa,CACpB,GAAwC,EACxC,IAAY;IAEZ,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAA4C;IAM5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAElE,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAE5C,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO,MAAM,CAAC,OAAO,CACnB,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACvE,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,OAAO,CACnB,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,GAAG,EAAE,EAClE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CACF,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CACjE,MAAM,CAAC,aAAa,CAClB,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,EAC9C,GAAG,EAAE,CACH,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CACxF,CACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,UAA4B,EAC5B,QAAgB,EAChB,QAAgB,EAChB,GAAwC;IAExC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;QAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAA;QAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAA;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAA;QAExC,0DAA0D;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI;aACrB,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAEvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAEtB,mEAAmE;QACnE,IAAI,SAA6B,CAAA;QACjC,IAAI,SAAoE,CAAA;QACxE,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxD,SAAS,GAAG,CAAC,CAAA;gBACb,SAAS,GAAG,IAAI,CAAA;gBAChB,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,+DAA+D;QAC/D,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAC9C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,CACrE,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACjC,CAAA;YACD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBACtE,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,qDAAqD;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI;iBACzB,UAAU,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;iBACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;YAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,GAAG,GAAe;gBACtB,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE;gBAC3D,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,EAAE;aACV,CAAA;YAED,iEAAiE;YACjE,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC/D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAC7C,UAAU,EACV,GAAG,EACH,UAAU,CAAC,IAAI,EACf,MAAM,CACP,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAErE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI;iBACxB,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;iBAC/E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;YAEvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAE1E,IAAI,KAAiB,CAAA;QAErB,IAAI,SAAS,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,QAAQ,EAAE,CAAA;YAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;YAEvF,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAClE,MAAM,CAAC,KAAK,CACb,CAAA;gBACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC/E,CAAC;gBAED,sEAAsE;gBACtE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ;qBAC5B,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;qBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;gBAEtD,yDAAyD;gBACzD,KAAK,CAAC,CAAC,WAAW;qBACf,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC;qBAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;gBAEzC,KAAK,GAAG,OAAO,CAAA;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAClE,MAAM,CAAC,KAAK,CACb,CAAA;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,GAAG,MAAM,CAAA;QAChB,CAAC;QAED,OAAO,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE;YAC1C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE;SACtC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC"}
+{"version":3,"file":"file-serve.js","sourceRoot":"","sources":["../../../src/http/file-serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAG/E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAC,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAI3C,MAAM,QAAQ,GAA2B;IACvC,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,UAAU;IACf,EAAE,EAAE,wBAAwB;IAC5B,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,0BAA0B;CAChC,CAAA;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAA;AACpD,CAAC;AAED,SAAS,aAAa,CACpB,GAAwC,EACxC,IAAY;IAEZ,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAA4C,EAC5C,mBAA0C,EAAE;IAM5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAE1C,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAE5C,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO,MAAM,CAAC,OAAO,CACnB,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACvE,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,OAAO,CACnB,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,GAAG,EAAE,EAClE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CACF,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CACjE,MAAM,CAAC,UAAU,CACf,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,EACxD,GAAG,EAAE,CACH,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CACxF,CACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,UAA4B,EAC5B,QAAgB,EAChB,QAAgB,EAChB,GAAwC,EACxC,QAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;QAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAA;QAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAA;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAA;QAExC,0DAA0D;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI;aACrB,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAEvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAEtB,mEAAmE;QACnE,IAAI,SAA6B,CAAA;QACjC,IAAI,SAAoE,CAAA;QACxE,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxD,SAAS,GAAG,CAAC,CAAA;gBACb,SAAS,GAAG,IAAI,CAAA;gBAChB,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,+DAA+D;QAC/D,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAC9C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,CACrE,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACjC,CAAA;YACD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBACtE,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,qDAAqD;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI;iBACzB,UAAU,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;iBACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;YAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,GAAG,GAAe;gBACtB,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE;gBAC3D,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,EAAE;aACV,CAAA;YAED,wEAAwE;YACxE,6DAA6D;YAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,iEAAiE;gBACjE,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAC/D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACxB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC/E,CAAC;gBAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAC7C,UAAU,EACV,GAAG,EACH,UAAU,CAAC,IAAI,EACf,MAAM,CACP,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAErE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC/E,CAAC;gBAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI;qBACxB,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;qBAC/E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;gBAEvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAE1E,IAAI,KAAiB,CAAA;QAErB,IAAI,SAAS,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,QAAQ,EAAE,CAAA;YAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;YAEvF,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAClE,MAAM,CAAC,KAAK,CACb,CAAA;gBACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC/E,CAAC;gBAED,sEAAsE;gBACtE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ;qBAC5B,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;qBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;gBAErD,yDAAyD;gBACzD,KAAK,CAAC,CAAC,WAAW;qBACf,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC;qBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;gBAExC,KAAK,GAAG,OAAO,CAAA;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAClE,MAAM,CAAC,KAAK,CACb,CAAA;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,GAAG,MAAM,CAAA;QAChB,CAAC;QAED,OAAO,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE;YAC1C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE;SACtC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC"}

package/dist/src/http/file-token.d.ts

@@ -1,7 +1,8 @@
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "@effect/platform";
-import { Effect } from "effect";
 import type { AnyCollectionDef } from "@gettersethya/mira-client";
-import { Repository } from "../repository/repository.js";
+import { Effect } from "effect";
+import type { HttpRouter } from "effect/http";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
 import { AppConfig } from "../config/index.js";
+import { Repository } from "../repository/repository.js";
 export declare function makeFileTokenRoute(collections: ReadonlyArray<AnyCollectionDef>): Effect.Effect<HttpServerResponse.HttpServerResponse, never, Repository | AppConfig | HttpServerRequest.HttpServerRequest | HttpRouter.RouteContext>;
 //# sourceMappingURL=file-token.d.ts.map

package/dist/src/http/file-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-token.d.ts","sourceRoot":"","sources":["../../../src/http/file-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAE,MAAM,EAAoB,MAAM,QAAQ,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAgB7C,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAC3C,MAAM,CAAC,MAAM,CACd,kBAAkB,CAAC,kBAAkB,EACrC,KAAK,EACL,UAAU,GAAG,SAAS,GAAG,iBAAiB,CAAC,iBAAiB,GAAG,UAAU,CAAC,YAAY,CACvF,CAUA"}
+{"version":3,"file":"file-token.d.ts","sourceRoot":"","sources":["../../../src/http/file-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,MAAM,EAAoB,MAAM,QAAQ,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAC,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAmBvD,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAC3C,MAAM,CAAC,MAAM,CACd,kBAAkB,CAAC,kBAAkB,EACrC,KAAK,EACL,UAAU,GAAG,SAAS,GAAG,iBAAiB,CAAC,iBAAiB,GAAG,UAAU,CAAC,YAAY,CACvF,CAUA"}

package/dist/src/http/file-token.js

@@ -1,35 +1,37 @@
-import { HttpServerRequest, HttpServerResponse } from "@effect/platform";
 import { Effect, Redacted, Schema } from "effect";
-import { Repository } from "../repository/repository.js";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
 import { idClause } from "../collection-service/where.js";
 import { AppConfig } from "../config/index.js";
+import { Repository } from "../repository/repository.js";
 import { signFileToken, verifyJwt } from "./auth.js";
 const TokenRequestSchema = Schema.Struct({
     collection: Schema.String
 });
-function extractBearerToken(req) {
+function extractToken(req) {
     const auth = req.headers["authorization"];
-    if (typeof auth !== "string")
-        return null;
-    const m = auth.match(/^Bearer\s+(.+)$/i);
-    return m === null ? null : m[1];
+    if (typeof auth === "string") {
+        const m = auth.match(/^Bearer\s+(.+)$/i);
+        if (m !== null)
+            return m[1];
+    }
+    return req.cookies["mira_token"] ?? null;
 }
 export function makeFileTokenRoute(collections) {
     const collectionMap = new Map(collections.map((c) => [c.name, c]));
-    return Effect.flatMap(HttpServerRequest.HttpServerRequest, (req) => Effect.catchAllCause(issueToken(req, collectionMap), () => Effect.succeed(HttpServerResponse.unsafeJson({ error: "internal" }, { status: 500 }))));
+    return Effect.flatMap(HttpServerRequest.HttpServerRequest, (req) => Effect.catchCause(issueToken(req, collectionMap), () => Effect.succeed(HttpServerResponse.jsonUnsafe({ error: "internal" }, { status: 500 }))));
 }
 function issueToken(req, collectionMap) {
     return Effect.gen(function* () {
         const config = yield* AppConfig;
         const jwtSecret = Redacted.value(config.jwtSecret);
-        // Require Bearer auth token
-        const rawToken = extractBearerToken(req);
+        // Require auth token from Bearer header or mira_token cookie
+        const rawToken = extractToken(req);
         if (rawToken === null) {
-            return HttpServerResponse.unsafeJson({ error: "unauthorized" }, { status: 401 });
+            return HttpServerResponse.jsonUnsafe({ error: "unauthorized" }, { status: 401 });
         }
         const authPayload = yield* verifyJwt(rawToken, jwtSecret).pipe(Effect.orElseSucceed(() => null));
         if (authPayload === null) {
-            return HttpServerResponse.unsafeJson({ error: "unauthorized" }, { status: 401 });
+            return HttpServerResponse.jsonUnsafe({ error: "unauthorized" }, { status: 401 });
         }
         // Verify the auth user still exists
         const repo = yield* Repository;
@@ -37,19 +39,19 @@ function issueToken(req, collectionMap) {
             .viewFilter(authPayload.col, { where: idClause(authPayload.sub) })
             .pipe(Effect.orElseSucceed(() => []));
         if (authRows.length === 0) {
-            return HttpServerResponse.unsafeJson({ error: "unauthorized" }, { status: 401 });
+            return HttpServerResponse.jsonUnsafe({ error: "unauthorized" }, { status: 401 });
         }
         // Parse body for target collection
-        const body = yield* req.json.pipe(Effect.flatMap(Schema.decodeUnknown(TokenRequestSchema)), Effect.orElseSucceed(() => null));
+        const body = yield* req.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(TokenRequestSchema)), Effect.orElseSucceed(() => null));
         if (body === null) {
-            return HttpServerResponse.unsafeJson({ error: "validation_failed", issues: ["collection is required"] }, { status: 422 });
+            return HttpServerResponse.jsonUnsafe({ error: "validation_failed", issues: ["collection is required"] }, { status: 422 });
         }
         if (!collectionMap.has(body.collection)) {
-            return HttpServerResponse.unsafeJson({ error: "not_found", message: `Unknown collection "${body.collection}"` }, { status: 404 });
+            return HttpServerResponse.jsonUnsafe({ error: "not_found", message: `Unknown collection "${body.collection}"` }, { status: 404 });
         }
         const fileToken = yield* signFileToken({ sub: authPayload.sub, col: authPayload.col, filecol: body.collection }, jwtSecret).pipe(Effect.orDie);
         const expiresAt = Date.now() + 5 * 60 * 1000;
-        return HttpServerResponse.unsafeJson({ token: fileToken, expiresAt }, { status: 200 });
+        return HttpServerResponse.jsonUnsafe({ token: fileToken, expiresAt }, { status: 200 });
     }).pipe(Effect.orDie);
 }
 //# sourceMappingURL=file-token.js.map