@gettersethya/mira 0.1.0-alpha.2

package/dist/src/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA"}

package/dist/src/config/index.js

@@ -0,0 +1,2 @@
+export { AppConfig, AppConfigLive } from "./config.js";
+//# sourceMappingURL=index.js.map

package/dist/src/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}

package/dist/src/config/types.d.ts

@@ -0,0 +1,29 @@
+import type { Option, Redacted } from "effect";
+/**
+ * Optional S3 storage configuration.
+ * Only loaded when `useS3` is true in AppConfig.
+ *
+ * @see AppConfig.useS3 — whether S3 is enabled
+ * @see AppConfig.s3Config — the Option<S3Config>
+ */
+export interface S3Config {
+    readonly endpoint: Redacted.Redacted<string>;
+    readonly bucketName: string;
+    readonly regionName: string;
+    readonly accessKey: Redacted.Redacted<string>;
+    readonly secret: Redacted.Redacted<string>;
+}
+/**
+ * Shape of the application configuration stored in the `_config` DB table.
+ *
+ * @see AppConfig — the Context.Tag that provides this
+ */
+export interface AppConfigShape {
+    readonly appName: string;
+    readonly port: number;
+    readonly applicationUrl: string;
+    readonly jwtSecret: Redacted.Redacted<string>;
+    readonly useS3: boolean;
+    readonly s3Config: Option.Option<S3Config>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC3C"}

package/dist/src/config/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":""}

package/dist/src/crypto/crypto.d.ts

@@ -0,0 +1,11 @@
+import { Context, Effect } from "effect";
+declare const CryptoService_base: Context.TagClass<CryptoService, "CryptoService", {
+    /** Synchronous variant — for use in callbacks that cannot yield an Effect. */
+    randomBytesSync(size: number): Uint8Array;
+    randomBytes(size: number): Effect.Effect<Uint8Array>;
+    randomUUID(): Effect.Effect<string>;
+}>;
+export declare class CryptoService extends CryptoService_base {
+}
+export {};
+//# sourceMappingURL=crypto.d.ts.map

package/dist/src/crypto/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/crypto/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;;IAKpC,8EAA8E;0BACxD,MAAM,GAAG,UAAU;sBACvB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;kBACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;AANvC,qBAAa,aAAc,SAAQ,kBAQhC;CAAG"}

package/dist/src/crypto/crypto.js

@@ -0,0 +1,4 @@
+import { Context } from "effect";
+export class CryptoService extends Context.Tag("CryptoService")() {
+}
+//# sourceMappingURL=crypto.js.map

package/dist/src/crypto/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/crypto/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,MAAM,QAAQ,CAAA;AAExC,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAQ5D;CAAG"}

package/dist/src/crypto/index.d.ts

@@ -0,0 +1,3 @@
+export { CryptoService } from "./crypto.js";
+export { NodeCryptoLayer } from "./node.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/src/crypto/index.js

@@ -0,0 +1,3 @@
+export { CryptoService } from "./crypto.js";
+export { NodeCryptoLayer } from "./node.js";
+//# sourceMappingURL=index.js.map

package/dist/src/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/src/crypto/node.d.ts

@@ -0,0 +1,4 @@
+import { Layer } from "effect";
+import { CryptoService } from "./crypto.js";
+export declare const NodeCryptoLayer: Layer.Layer<CryptoService, never, never>;
+//# sourceMappingURL=node.d.ts.map

package/dist/src/crypto/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../src/crypto/node.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,eAAO,MAAM,eAAe,0CAO3B,CAAA"}

package/dist/src/crypto/node.js

@@ -0,0 +1,9 @@
+import * as nodeCrypto from "node:crypto";
+import { Effect, Layer } from "effect";
+import { CryptoService } from "./crypto.js";
+export const NodeCryptoLayer = Layer.succeed(CryptoService, CryptoService.of({
+    randomBytesSync: (size) => nodeCrypto.randomBytes(size),
+    randomBytes: (size) => Effect.sync(() => nodeCrypto.randomBytes(size)),
+    randomUUID: () => Effect.sync(() => nodeCrypto.randomUUID())
+}));
+//# sourceMappingURL=node.js.map

package/dist/src/crypto/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../../src/crypto/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAC1C,aAAa,EACb,aAAa,CAAC,EAAE,CAAC;IACf,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;IACvD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;CAC7D,CAAC,CACH,CAAA"}

package/dist/src/databases/index.d.ts

@@ -0,0 +1,2 @@
+export { SqliteDatabase } from "./sqlite.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/databases/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/databases/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/src/databases/index.js

@@ -0,0 +1,2 @@
+export { SqliteDatabase } from "./sqlite.js";
+//# sourceMappingURL=index.js.map

package/dist/src/databases/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/databases/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/src/databases/sqlite.d.ts

@@ -0,0 +1,24 @@
+import type { MiraDatabase } from "../app/types.js";
+/**
+ * SQLite database preset using `@effect/sql-sqlite-node`.
+ *
+ * Creates a `MiraDatabase` that provides both the SQLite `SqlClient`
+ * and the `Dialect` (for schema generation). The layer uses `Layer.orDie`
+ * to convert `ConfigError` into a runtime panic — if the config is wrong,
+ * the server should not start.
+ *
+ * @param config.filename - Path to the SQLite database file (use `":memory:"` for testing)
+ * @returns A MiraDatabase preset
+ *
+ * @example
+ * Mira.builder()
+ *   .database(SqliteDatabase({ filename: "data.db" }))
+ *   // or for testing:
+ *   .database(SqliteDatabase({ filename: ":memory:" }))
+ *
+ * @see MiraDatabase — the interface SqliteDatabase implements
+ */
+export declare const SqliteDatabase: (config: {
+    filename: string;
+}) => MiraDatabase;
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/src/databases/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../../src/databases/sqlite.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,KAAG,YAK5D,CAAA"}

package/dist/src/databases/sqlite.js

@@ -0,0 +1,27 @@
+import { SqliteClient } from "@effect/sql-sqlite-node";
+import { Layer } from "effect";
+import { Dialect } from "../migrator/dialect.js";
+import { sqliteDialect } from "../migrator/dialect-sqlite.js";
+/**
+ * SQLite database preset using `@effect/sql-sqlite-node`.
+ *
+ * Creates a `MiraDatabase` that provides both the SQLite `SqlClient`
+ * and the `Dialect` (for schema generation). The layer uses `Layer.orDie`
+ * to convert `ConfigError` into a runtime panic — if the config is wrong,
+ * the server should not start.
+ *
+ * @param config.filename - Path to the SQLite database file (use `":memory:"` for testing)
+ * @returns A MiraDatabase preset
+ *
+ * @example
+ * Mira.builder()
+ *   .database(SqliteDatabase({ filename: "data.db" }))
+ *   // or for testing:
+ *   .database(SqliteDatabase({ filename: ":memory:" }))
+ *
+ * @see MiraDatabase — the interface SqliteDatabase implements
+ */
+export const SqliteDatabase = (config) => ({
+    layer: Layer.mergeAll(SqliteClient.layer({ filename: config.filename }).pipe(Layer.orDie), Layer.succeed(Dialect, sqliteDialect)),
+});
+//# sourceMappingURL=sqlite.js.map

package/dist/src/databases/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../../src/databases/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAG5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAA4B,EAAgB,EAAE,CAAC,CAAC;IAC7E,KAAK,EAAE,KAAK,CAAC,QAAQ,CACnB,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACnE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CACtC;CACF,CAAC,CAAA"}

package/dist/src/http/auth-node.d.ts

@@ -0,0 +1,4 @@
+import { Layer } from "effect";
+import { AuthService } from "./auth.js";
+export declare const NodeAuthServiceLayer: Layer.Layer<AuthService, never, never>;
+//# sourceMappingURL=auth-node.d.ts.map

package/dist/src/http/auth-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-node.d.ts","sourceRoot":"","sources":["../../../src/http/auth-node.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAcvC,eAAO,MAAM,oBAAoB,wCAoBhC,CAAA"}

package/dist/src/http/auth-node.js

@@ -0,0 +1,34 @@
+import * as nodeCrypto from "node:crypto";
+import { Effect, Layer } from "effect";
+import { AuthService } from "./auth.js";
+function scryptHash(plain, salt) {
+    return Effect.async((resume) => {
+        nodeCrypto.scrypt(plain, salt, 64, (err, key) => {
+            if (err) {
+                resume(Effect.die(err));
+            }
+            else {
+                resume(Effect.succeed(key));
+            }
+        });
+    }).pipe(Effect.map((key) => key.toString("hex")));
+}
+export const NodeAuthServiceLayer = Layer.succeed(AuthService, AuthService.of({
+    hashPassword: (plain) => Effect.gen(function* () {
+        const salt = nodeCrypto.randomBytes(16).toString("hex");
+        const hash = yield* scryptHash(plain, salt);
+        return `scrypt$${salt}$${hash}`;
+    }),
+    verifyPassword: (plain, stored) => Effect.gen(function* () {
+        const parts = stored.split("$");
+        if (parts.length !== 3 || parts[0] !== "scrypt")
+            return false;
+        const salt = parts[1];
+        const expected = parts[2];
+        if (salt === undefined || expected === undefined)
+            return false;
+        const hash = yield* scryptHash(plain, salt);
+        return hash === expected;
+    })
+}));
+//# sourceMappingURL=auth-node.js.map

package/dist/src/http/auth-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-node.js","sourceRoot":"","sources":["../../../src/http/auth-node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAgB,CAAC,MAAM,EAAE,EAAE;QAC5C,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAC/C,WAAW,EACX,WAAW,CAAC,EAAE,CAAC;IACb,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3C,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAA;IACjC,CAAC,CAAC;IACJ,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3C,OAAO,IAAI,KAAK,QAAQ,CAAA;IAC1B,CAAC,CAAC;CACL,CAAC,CACH,CAAA"}

package/dist/src/http/auth.d.ts

@@ -0,0 +1,38 @@
+import { Context, Effect } from "effect";
+export type JwtPayload = {
+    sub: string;
+    col: string;
+};
+export type FileTokenPayload = {
+    sub: string;
+    col: string;
+    filecol: string;
+};
+declare const AuthError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthError";
+} & Readonly<A>;
+export declare class AuthError extends AuthError_base<{
+    reason: string;
+}> {
+}
+declare const AuthService_base: Context.TagClass<AuthService, "AuthService", {
+    hashPassword(plain: string): Effect.Effect<string>;
+    verifyPassword(plain: string, stored: string): Effect.Effect<boolean>;
+}>;
+export declare class AuthService extends AuthService_base {
+}
+export declare const hashPassword: (plain: string) => Effect.Effect<string, never, AuthService>;
+export declare const verifyPassword: (plain: string, stored: string) => Effect.Effect<boolean, never, AuthService>;
+export declare function signJwt(payload: JwtPayload, secret: string): Effect.Effect<string, AuthError, never>;
+export declare function signFileToken(payload: FileTokenPayload, secret: string): Effect.Effect<string, AuthError, never>;
+export declare function verifyFileToken(token: string, secret: string): Effect.Effect<{
+    sub: string;
+    col: string;
+    filecol: string;
+}, AuthError, never>;
+export declare function verifyJwt(token: string, secret: string): Effect.Effect<{
+    sub: string;
+    col: string;
+}, AuthError, never>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/http/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/http/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE9C,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,MAAM,MAAM,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;;;;AAE5E,qBAAa,SAAU,SAAQ,eAA8B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;;wBAK3D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;0BAC5B,MAAM,UAAU,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;;AAJzE,qBAAa,WAAY,SAAQ,gBAM9B;CAAG;AAEN,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,8CAAoE,CAAA;AAE9G,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,+CACe,CAAA;AAE3E,wBAAgB,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,2CAY1D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,2CAYtE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;qBAe5D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;qBActD"}

package/dist/src/http/auth.js

@@ -0,0 +1,66 @@
+import * as jose from "jose";
+import { Context, Data, Effect } from "effect";
+export class AuthError extends Data.TaggedError("AuthError") {
+}
+export class AuthService extends Context.Tag("AuthService")() {
+}
+export const hashPassword = (plain) => Effect.flatMap(AuthService, (auth) => auth.hashPassword(plain));
+export const verifyPassword = (plain, stored) => Effect.flatMap(AuthService, (auth) => auth.verifyPassword(plain, stored));
+export function signJwt(payload, secret) {
+    return Effect.tryPromise({
+        try: async () => {
+            const encoder = new TextEncoder();
+            return await new jose.SignJWT({ sub: payload.sub, col: payload.col })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuedAt()
+                .setExpirationTime("72h")
+                .sign(encoder.encode(secret));
+        },
+        catch: (e) => new AuthError({ reason: String(e) })
+    });
+}
+export function signFileToken(payload, secret) {
+    return Effect.tryPromise({
+        try: async () => {
+            const encoder = new TextEncoder();
+            return await new jose.SignJWT({ sub: payload.sub, col: payload.col, filecol: payload.filecol })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuedAt()
+                .setExpirationTime("5m")
+                .sign(encoder.encode(secret));
+        },
+        catch: (e) => new AuthError({ reason: String(e) })
+    });
+}
+export function verifyFileToken(token, secret) {
+    return Effect.tryPromise({
+        try: async () => {
+            const encoder = new TextEncoder();
+            const { payload } = await jose.jwtVerify(token, encoder.encode(secret));
+            const sub = payload.sub;
+            const col = payload["col"];
+            const filecol = payload["filecol"];
+            if (typeof sub !== "string" || typeof col !== "string" || typeof filecol !== "string") {
+                throw new Error("Missing sub, col, or filecol in file token");
+            }
+            return { sub, col, filecol };
+        },
+        catch: (e) => new AuthError({ reason: String(e) })
+    });
+}
+export function verifyJwt(token, secret) {
+    return Effect.tryPromise({
+        try: async () => {
+            const encoder = new TextEncoder();
+            const { payload } = await jose.jwtVerify(token, encoder.encode(secret));
+            const sub = payload.sub;
+            const col = payload["col"];
+            if (typeof sub !== "string" || typeof col !== "string") {
+                throw new Error("Missing sub or col in JWT");
+            }
+            return { sub, col };
+        },
+        catch: (e) => new AuthError({ reason: String(e) })
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/http/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAK9C,MAAM,OAAO,SAAU,SAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAAqB;CAAG;AAEnF,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAMxD;CAAG;AAEN,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3E,MAAM,UAAU,OAAO,CAAC,OAAmB,EAAE,MAAc;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;iBAClE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,KAAK,CAAC;iBACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAyB,EAAE,MAAc;IACrE,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;iBAC5F,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc;IAC3D,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;QAC9B,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YAC9C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/http/errors.d.ts

@@ -0,0 +1,31 @@
+import { HttpServerResponse } from "@effect/platform";
+import { Effect } from "effect";
+import type { CollectionError } from "../collection-service/errors.js";
+import type { FileStorageError } from "../storage/storage.js";
+/**
+ * Effect error handler that maps `CollectionError` and `FileStorageError` variants
+ * to HTTP response objects with appropriate status codes.
+ *
+ * | Error | HTTP Status |
+ * |---|---|
+ * | `NotFoundError` | 404 |
+ * | `ForbiddenError` | 403 |
+ * | `ValidationError` | 422 |
+ * | `ReadOnlyError` | 405 |
+ * | `FileStorageError` | 502 |
+ * | `SqlError` | 500 |
+ *
+ * Use this as a final `.pipe()` call in route handlers to convert domain errors
+ * to HTTP responses.
+ *
+ * @example
+ * import { catchCollectionErrors } from "@gettersethya/mira"
+ *
+ * const handler = Effect.gen(function* () { ... }).pipe(
+ *   catchCollectionErrors
+ * )
+ *
+ * @see CollectionError — the union type this handler catches
+ */
+export declare const catchCollectionErrors: <A, R>(eff: Effect.Effect<A, CollectionError | FileStorageError, R>) => Effect.Effect<A, HttpServerResponse.HttpServerResponse, R>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/http/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,CAAC,EACxC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,eAAe,GAAG,gBAAgB,EAAE,CAAC,CAAC,KAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,CAmCxD,CAAA"}

package/dist/src/http/errors.js

@@ -0,0 +1,36 @@
+import { HttpServerResponse } from "@effect/platform";
+import { Effect } from "effect";
+/**
+ * Effect error handler that maps `CollectionError` and `FileStorageError` variants
+ * to HTTP response objects with appropriate status codes.
+ *
+ * | Error | HTTP Status |
+ * |---|---|
+ * | `NotFoundError` | 404 |
+ * | `ForbiddenError` | 403 |
+ * | `ValidationError` | 422 |
+ * | `ReadOnlyError` | 405 |
+ * | `FileStorageError` | 502 |
+ * | `SqlError` | 500 |
+ *
+ * Use this as a final `.pipe()` call in route handlers to convert domain errors
+ * to HTTP responses.
+ *
+ * @example
+ * import { catchCollectionErrors } from "@gettersethya/mira"
+ *
+ * const handler = Effect.gen(function* () { ... }).pipe(
+ *   catchCollectionErrors
+ * )
+ *
+ * @see CollectionError — the union type this handler catches
+ */
+export const catchCollectionErrors = (eff) => Effect.catchTags(eff, {
+    NotFoundError: (e) => Effect.fail(HttpServerResponse.unsafeJson({ error: "not_found", message: `Record not found in "${e.collection}"` }, { status: 404 })),
+    ForbiddenError: () => Effect.fail(HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 })),
+    ValidationError: (e) => Effect.fail(HttpServerResponse.unsafeJson({ error: "validation_failed", issues: e.issues }, { status: 422 })),
+    ReadOnlyError: () => Effect.fail(HttpServerResponse.unsafeJson({ error: "read_only" }, { status: 405 })),
+    FileStorageError: (e) => Effect.fail(HttpServerResponse.unsafeJson({ error: "storage_error", reason: e.reason }, { status: 502 })),
+    SqlError: () => Effect.fail(HttpServerResponse.unsafeJson({ error: "internal_error" }, { status: 500 })),
+});
+//# sourceMappingURL=errors.js.map

package/dist/src/http/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAI/B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,GAA4D,EACA,EAAE,CAC9D,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CACnB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC,UAAU,GAAG,EAAE,EACxE,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,cAAc,EAAE,GAAG,EAAE,CACnB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CAChF;IACH,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CACrB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAChD,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,aAAa,EAAE,GAAG,EAAE,CAClB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CAChF;IACH,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAC3B,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAC5C,EAAE,MAAM,EAAE,GAAY,EAAE,CACzB,CACF;IACH,QAAQ,EAAE,GAAG,EAAE,CACb,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAY,EAAE,CAAC,CACrF;CACJ,CAAC,CAAA"}

package/dist/src/http/file-serve.d.ts

@@ -0,0 +1,10 @@
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "@effect/platform";
+import { Effect } from "effect";
+import type { AnyCollectionDef } from "@gettersethya/mira-client";
+import { Repository } from "../repository/repository.js";
+import { FileStorage } from "../storage/storage.js";
+import { ThumbnailService } from "../thumbnail/types.js";
+import { AppConfig } from "../config/index.js";
+export type FileServeServices = Repository | FileStorage | ThumbnailService | AppConfig;
+export declare function makeFileServeRoute(collections: ReadonlyArray<AnyCollectionDef>): Effect.Effect<HttpServerResponse.HttpServerResponse, never, FileServeServices | HttpServerRequest.HttpServerRequest | HttpRouter.RouteContext>;
+//# sourceMappingURL=file-serve.d.ts.map

package/dist/src/http/file-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-serve.d.ts","sourceRoot":"","sources":["../../../src/http/file-serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAS,MAAM,EAAoB,MAAM,QAAQ,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAGjE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAkB,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAI7C,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,CAAA;AAmCvF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAC3C,MAAM,CAAC,MAAM,CACd,kBAAkB,CAAC,kBAAkB,EACrC,KAAK,EACL,iBAAiB,GAAG,iBAAiB,CAAC,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAClF,CA+BA"}

package/dist/src/http/file-serve.js

@@ -0,0 +1,159 @@
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "@effect/platform";
+import { Chunk, Effect, Redacted, Stream } from "effect";
+import { andWhere, idClause, resolveCtxPlaceholders } from "../collection-service/where.js";
+import { Repository } from "../repository/repository.js";
+import { FileStorage } from "../storage/storage.js";
+import { ThumbnailService, parseThumbSpec } from "../thumbnail/types.js";
+import { AppConfig } from "../config/index.js";
+import { enforcerForAction } from "../rule/enforcer.js";
+import { verifyFileToken } from "./auth.js";
+const MIME_MAP = {
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    png: "image/png",
+    gif: "image/gif",
+    webp: "image/webp",
+    avif: "image/avif",
+    svg: "image/svg+xml",
+    pdf: "application/pdf",
+    txt: "text/plain",
+    html: "text/html",
+    css: "text/css",
+    js: "application/javascript",
+    json: "application/json",
+    mp4: "video/mp4",
+    mp3: "audio/mpeg",
+    wav: "audio/wav",
+    bin: "application/octet-stream"
+};
+function mimeFromKey(key) {
+    const ext = key.split(".").pop()?.toLowerCase() ?? "";
+    return MIME_MAP[ext] ?? "application/octet-stream";
+}
+function getQueryParam(req, name) {
+    const queryStr = req.url.includes("?") ? req.url.split("?")[1] : "";
+    return new URLSearchParams(queryStr).get(name) ?? undefined;
+}
+export function makeFileServeRoute(collections) {
+    const collectionMap = new Map(collections.map((c) => [c.name, c]));
+    return Effect.flatMap(HttpRouter.RouteContext, (routeCtx) => {
+        const colName = routeCtx.params["collection"];
+        const recordId = routeCtx.params["id"];
+        const filename = routeCtx.params["filename"];
+        if (colName === undefined || recordId === undefined || filename === undefined) {
+            return Effect.succeed(HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 }));
+        }
+        const collection = collectionMap.get(colName);
+        if (collection === undefined) {
+            return Effect.succeed(HttpServerResponse.unsafeJson({ error: "not_found", message: `Unknown collection "${colName}"` }, { status: 404 }));
+        }
+        return Effect.flatMap(HttpServerRequest.HttpServerRequest, (req) => Effect.catchAllCause(serveFile(collection, recordId, filename, req), () => Effect.succeed(HttpServerResponse.unsafeJson({ error: "internal" }, { status: 500 }))));
+    });
+}
+function serveFile(collection, recordId, filename, req) {
+    return Effect.gen(function* () {
+        const config = yield* AppConfig;
+        const jwtSecret = Redacted.value(config.jwtSecret);
+        const repo = yield* Repository;
+        const fileStorage = yield* FileStorage;
+        const thumbSvc = yield* ThumbnailService;
+        // Step 2: fetch record directly (no rule enforcement yet)
+        const rows = yield* repo
+            .viewFilter(collection.name, { where: idClause(recordId) })
+            .pipe(Effect.orElseSucceed(() => []));
+        if (rows.length === 0) {
+            return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+        }
+        const record = rows[0];
+        // Step 3: find the file field whose stored value equals `filename`
+        let fieldName;
+        let fieldProp;
+        for (const [k, prop] of Object.entries(collection.schema.properties)) {
+            if (prop["x-kind"] === "file" && record[k] === filename) {
+                fieldName = k;
+                fieldProp = prop;
+                break;
+            }
+        }
+        if (fieldName === undefined || fieldProp === undefined) {
+            return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+        }
+        // Step 4: protected field — verify token and enforce view rule
+        if (fieldProp["x-protected"] === true) {
+            const tokenParam = getQueryParam(req, "token");
+            if (tokenParam === undefined) {
+                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+            }
+            const tokenPayload = yield* verifyFileToken(tokenParam, jwtSecret).pipe(Effect.orElseSucceed(() => null));
+            if (tokenPayload === null || tokenPayload.filecol !== collection.name) {
+                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+            }
+            // Reconstruct auth context from file token sub + col
+            const authRows = yield* repo
+                .viewFilter(tokenPayload.col, { where: idClause(tokenPayload.sub) })
+                .pipe(Effect.orElseSucceed(() => []));
+            if (authRows.length === 0) {
+                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+            }
+            const ctx = {
+                auth: { collection: tokenPayload.col, record: authRows[0] },
+                headers: {},
+                query: {}
+            };
+            // Enforce the collection's view rule against the specific record
+            const ruleResult = enforcerForAction(collection.schema, "view");
+            if (ruleResult === null) {
+                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+            }
+            const ruleWhere = yield* resolveCtxPlaceholders(ruleResult, ctx, collection.name, "view").pipe(Effect.catchTag("ForbiddenError", () => Effect.succeed(null)));
+            if (ruleWhere === null) {
+                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+            }
+            const allowed = yield* repo
+                .viewFilter(collection.name, { where: andWhere(ruleWhere, idClause(recordId)) })
+                .pipe(Effect.orElseSucceed(() => []));
+            if (allowed.length === 0) {
+                return HttpServerResponse.unsafeJson({ error: "forbidden" }, { status: 403 });
+            }
+        }
+        // Steps 5-8: derive MIME, handle thumbnail with persistent cache, serve bytes
+        const mimeType = mimeFromKey(filename);
+        const rawThumb = getQueryParam(req, "thumb");
+        const thumbSpec = rawThumb !== undefined ? parseThumbSpec(rawThumb) : null;
+        let bytes;
+        if (thumbSpec !== null && rawThumb !== undefined && thumbSvc.supported(mimeType)) {
+            const cacheKey = `_thumbs/${filename}/${rawThumb}`;
+            const hit = yield* fileStorage.exists(cacheKey).pipe(Effect.orElseSucceed(() => false));
+            if (hit) {
+                bytes = yield* fileStorage.read(cacheKey).pipe(Effect.orDie);
+            }
+            else {
+                const original = yield* fileStorage.read(filename).pipe(Effect.catchTag("FileStorageNotFound", () => Effect.succeed(null)), Effect.orDie);
+                if (original === null) {
+                    return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+                }
+                // On thumb error fall back to original rather than returning an error
+                const resized = yield* thumbSvc
+                    .resize(original, mimeType, thumbSpec)
+                    .pipe(Effect.orElse(() => Effect.succeed(original)));
+                // Best-effort: persist the thumbnail for future requests
+                yield* fileStorage
+                    .upload(cacheKey, Stream.fromChunk(Chunk.of(resized)), mimeType)
+                    .pipe(Effect.orElse(() => Effect.void));
+                bytes = resized;
+            }
+        }
+        else {
+            const result = yield* fileStorage.read(filename).pipe(Effect.catchTag("FileStorageNotFound", () => Effect.succeed(null)), Effect.orDie);
+            if (result === null) {
+                return HttpServerResponse.unsafeJson({ error: "not_found" }, { status: 404 });
+            }
+            bytes = result;
+        }
+        return HttpServerResponse.uint8Array(bytes, {
+            status: 200,
+            headers: { "content-type": mimeType }
+        });
+    }).pipe(Effect.orDie);
+}
+//# sourceMappingURL=file-serve.js.map