@gjermundgaraba/clankerauth-sdk 0.4.0 → 0.5.0

package/README.md

@@ -1,6 +1,6 @@
 # @gjermundgaraba/clankerauth-sdk
 
-Effect-native [Clanker Auth](https://github.com/gjermundgaraba/clankerauth) verification and browser sessions. Verifies JWT access tokens and API keys and runs browser login with encrypted server-held credentials. Optional **effect-actions** integration provides request-scoped identity and OAuth discovery.
+Effect-native [Clanker Auth](https://github.com/gjermundgaraba/clankerauth) verification. Verifies JWT access tokens and API keys, including the tokens a reverse proxy obtains through the issuer's forward auth for browser sessions. Optional **effect-actions** integration provides request-scoped identity and OAuth discovery.
 
 ## Install
 
@@ -37,7 +37,7 @@ const makeVerifier = Verifier.make({
 Install the optional peer dependency and import the integration subpath:
 
 ```sh
-vp add @gjermundgaraba/effect-actions@0.1.0
+vp add @gjermundgaraba/effect-actions@0.2.0
 ```
 
 Core and integration declarations both type-check without `skipLibCheck`.
@@ -107,72 +107,16 @@ JWTs are checked against issuer, audience, EdDSA signature, token type, required
 
 The bundled issuer does not configure automatic signing-key rotation. Immediate-use rotation is supported, but tokens signed by a new key can be rejected during the thirty-second cooldown after a successful lookup. Publish-before-use avoids that short window; it is not mandatory.
 
-## Browser sessions
+## Browser applications
 
-Register a confidential client with the exact `callbackUrl` supplied to the session. It must be an absolute HTTP(S) URL without credentials or a fragment; query parameters are allowed. The session derives its browser origin and secure-cookie policy from this URL.
-
-Provide a `SessionStore` layer implementing Effect operations:
-
-- `get(id)` → `{ payload, expires } | undefined`
-- `put(id, payload, expires)`
-- `delete(id)`
-- `sweep(now)`: remove rows expiring at or before `now`
-
-Map expected database failures to `StoreError({ operation, cause })` at your persistence adapter. Do not put SQL, secrets, credentials or provider payloads in public errors. The store owns persistence, not encryption or session policy. **Run one process per store and acquire one shared browser-session capability per cookie/store configuration.**
-
-```ts
-import { Effect, Layer, Redacted } from "effect";
-import { BrowserSession } from "@gjermundgaraba/clankerauth-sdk";
-import { BrowserActions, Resource } from "@gjermundgaraba/clankerauth-sdk/effect-actions";
-
-// Inside application construction, with HttpClient and SessionStore provided:
-const browser =
-  yield *
-  BrowserSession.make({
-    issuer: "https://auth.internal/api/auth",
-    resource: "https://notes.internal/api",
-    callbackUrl: "https://notes.internal/workspace/auth/callback",
-    clientId,
-    clientSecret: Redacted.make(clientSecret),
-    secret: Redacted.make(sessionSecret), // at least 32 characters; retain across restarts
-    scopes: ["notes:read", "notes:write"],
-    cookie: { name: "notes" },
-    verifyToken: api.verifier.verifyToken,
-  });
-
-const browserRoutes = Layer.mergeAll(
-  BrowserActions.layer(browser),
-  Http.layer(app).pipe(Layer.provide(Resource.middleware(api, { browser }).layer)),
-);
-```
-
-This example's construction fragment belongs inside `Effect.gen`. Supply configuration and secrets at your composition root; the SDK does not read environment variables or start its own runtime.
-
-`BrowserActions.layer` registers:
-
-- `POST /auth/browser/login`: accepts `{ returnTo: "/path" }`, returns `{ url }`.
-- `GET <callback pathname>`: consumes the one-time transaction and redirects (`/workspace/auth/callback` above).
-- `POST /auth/browser/session`: returns the subject, scopes and issuer, or `Unauthorized`.
-- `POST /auth/browser/logout`: ends the local session and attempts provider revocation.
-
-Login, session and logout are effect-actions, with JSON bodies (`{}` for session and logout). Browser clients import the pure `Http` contract from `@gjermundgaraba/clankerauth-sdk/browser-api`. Only the OAuth callback is an ordinary HTTP endpoint. The callback uses the exact configured URL; action routes live under `/auth/browser`. Callback failures redirect to the origin root with an `auth_error` query parameter; a root-mounted callback returns the sanitized HTTP error to avoid a redirect loop. Login destinations must be same-origin paths other than the callback pathname. The host sets request-body limits, for example `HttpIncomingMessage.MaxBodySize` on Effect's Node server (Clanker Auth's own adapter uses 64 KiB). Responses are non-cacheable and use `Referrer-Policy: no-referrer`.
-
-Tokens always remain in the server-side session store, never in browser JavaScript.
-
-Pass `browser` only for HTTP routes the application's own pages call. A request with an Authorization header is always verified as a bearer token; without one, the session cookie authenticates it and Origin is checked on unsafe methods. **Never pass `browser` for MCP.**
-
-The session capability does not accept incoming HTTP requests: `login(returnTo)`, `callback(url, transactionCookie)`, `session(sessionCookie)`, `accessToken(sessionCookie)`, and `logout(sessionCookie)` are Effects. HTTP handlers own cookie extraction and presentation.
-
-Cookies are HttpOnly, SameSite=Lax and Secure on HTTPS. Login uses S256 PKCE, state, nonce, exact issuer validation and signed ID-token checks. Stored payloads remain AES-256-GCM sealed under the configured secret with hashed cookie identifiers.
-
-Refreshes and logout serialize per session. A durable no-replay marker is written before refresh; interruptions, ambiguous outcomes and restarts cannot reuse that refresh token. Discovery failure before the marker remains retryable. Operational refresh failures return 503 and invalidate the session; subsequent access requires login. Local logout remains authoritative if provider revocation fails, with a sanitized Effect warning.
+Browser apps do not use this package. Put them behind a reverse proxy with the issuer's forward auth, described in the Clanker Auth README; the proxy adds an `Authorization` header the same verifier above accepts.
 
 ## Errors and observability
 
-Schema-tagged errors: `Unauthorized` (401), `Forbidden` (403), `RateLimited` (429), `ProviderUnavailable` and `StoreError` (503). Browser input errors use `InvalidRequest` (400). Invalid construction fails with `ConfigurationError`.
+Schema-tagged errors: `Unauthorized` (401), `Forbidden` (403), `RateLimited` (429) and `ProviderUnavailable` (503). Invalid construction fails with `ConfigurationError`.
 
-The SDK Resource adapter owns authentication error encoding and challenge headers; effect-actions supplies request-scoped identity and the no-store response policy. Browser actions use their declared error schemas; the callback handles redirects. Defects and interruption are not relabeled as authentication rejection. Named effects supply tracing boundaries; application logging/tracing layers remain caller-owned. No `onFailure` callbacks or hidden runtime.
+The SDK Resource adapter owns authentication error encoding and challenge headers; effect-actions supplies request-scoped identity and the no-store response policy. Defects and interruption are not relabeled as authentication rejection. Named effects supply tracing boundaries; application logging/tracing layers remain caller-owned. No `onFailure` callbacks or hidden runtime.
 
-Operational failures retain their underlying `cause` for application-side Effect error handling. `ProviderUnavailable`, `StoreError`, and `Unauthorized` keep this diagnostic field outside their public schemas; BrowserActions and effect-actions serialize only those schemas. Causes may contain sensitive transport or provider details: inspect selectively, never serialize them into responses or log them indiscriminately.
+Operational failures retain their underlying `cause` for application-side Effect error handling. `ProviderUnavailable` and `Unauthorized` keep this diagnostic field outside their public schemas; effect-actions serializes only those schemas. Causes may contain sensitive transport or provider details: inspect selectively, never serialize them into responses or log them indiscriminately.
 
 MIT licensed.

package/dist/effect-actions.d.ts

@@ -1,3 +1,2 @@
 export * as Resource from "./resource.ts";
 export { CurrentPrincipal } from "./resource.ts";
-export * as BrowserActions from "./browser-actions.ts";

package/dist/effect-actions.js

@@ -1,3 +1,2 @@
 export * as Resource from "./resource.js";
 export { CurrentPrincipal } from "./resource.js";
-export * as BrowserActions from "./browser-actions.js";

package/dist/errors.d.ts

@@ -31,28 +31,13 @@ export declare class ProviderUnavailable extends ProviderUnavailable_base {
         readonly cause?: unknown;
     });
 }
-declare const StoreError_base: Schema.Class<StoreError, Schema.TaggedStruct<"StoreError", {
-    readonly operation: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-export declare class StoreError extends StoreError_base {
-    readonly cause?: unknown;
-    constructor(options: {
-        readonly operation: string;
-        readonly cause?: unknown;
-    });
-}
-declare const InvalidRequest_base: Schema.Class<InvalidRequest, Schema.TaggedStruct<"InvalidRequest", {
-    readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-export declare class InvalidRequest extends InvalidRequest_base {
-}
 declare const ConfigurationError_base: Schema.Class<ConfigurationError, Schema.TaggedStruct<"ConfigurationError", {
     readonly message: Schema.String;
 }>, import("effect/Cause").YieldableError>;
 export declare class ConfigurationError extends ConfigurationError_base {
 }
-export declare const authenticationErrors: readonly [typeof Unauthorized, typeof Forbidden, typeof RateLimited, typeof ProviderUnavailable, typeof StoreError];
-export type AuthenticationError = Unauthorized | Forbidden | RateLimited | ProviderUnavailable | StoreError;
+export declare const authenticationErrors: readonly [typeof Unauthorized, typeof Forbidden, typeof RateLimited, typeof ProviderUnavailable];
+export type AuthenticationError = Unauthorized | Forbidden | RateLimited | ProviderUnavailable;
 /** Encode one of the declared schemas as JSON with its `httpApiStatus`. Undeclared errors are defects. */
 export declare const encodeError: <const Schemas extends ReadonlyArray<Schema.Top>>(schemas: Schemas) => (error: Schemas[number]["Type"], headers?: Headers.Input) => Effect.Effect<HttpServerResponse.HttpServerResponse, never, { [K in keyof Schemas]: Schemas[K]["EncodingServices"]; }[number]>;
 export {};

package/dist/errors.js

@@ -17,14 +17,6 @@ export class ProviderUnavailable extends Schema.TaggedError()("ProviderUnavailab
         Object.defineProperty(this, "cause", { value: options.cause });
     }
 }
-export class StoreError extends Schema.TaggedError()("StoreError", { operation: Schema.String }, { httpApiStatus: 503 }) {
-    constructor(options) {
-        super({ operation: options.operation });
-        Object.defineProperty(this, "cause", { value: options.cause });
-    }
-}
-export class InvalidRequest extends Schema.TaggedError()("InvalidRequest", { message: Schema.String }, { httpApiStatus: 400 }) {
-}
 export class ConfigurationError extends Schema.TaggedError()("ConfigurationError", { message: Schema.String }) {
 }
 export const authenticationErrors = [
@@ -32,7 +24,6 @@ export const authenticationErrors = [
     Forbidden,
     RateLimited,
     ProviderUnavailable,
-    StoreError,
 ];
 /** Encode one of the declared schemas as JSON with its `httpApiStatus`. Undeclared errors are defects. */
 export const encodeError = (schemas) => {

package/dist/index.d.ts

@@ -1,5 +1,3 @@
 export * as Verifier from "./verify.ts";
-export * as BrowserSession from "./browser.ts";
-export { SessionStore, type Row } from "./store.ts";
 export type { Principal } from "./verify.ts";
-export { Unauthorized, Forbidden, RateLimited, ProviderUnavailable, StoreError, InvalidRequest, ConfigurationError, type AuthenticationError, } from "./errors.ts";
+export { Unauthorized, Forbidden, RateLimited, ProviderUnavailable, ConfigurationError, type AuthenticationError, } from "./errors.ts";

package/dist/index.js

@@ -1,4 +1,2 @@
 export * as Verifier from "./verify.js";
-export * as BrowserSession from "./browser.js";
-export { SessionStore } from "./store.js";
-export { Unauthorized, Forbidden, RateLimited, ProviderUnavailable, StoreError, InvalidRequest, ConfigurationError, } from "./errors.js";
+export { Unauthorized, Forbidden, RateLimited, ProviderUnavailable, ConfigurationError, } from "./errors.js";

package/dist/resource.d.ts

@@ -3,7 +3,6 @@ import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
 import { ConfigurationError, Forbidden, RateLimited, Unauthorized } from "./errors.ts";
 import type { AuthenticationError } from "./errors.ts";
 import * as Verifier from "./verify.ts";
-import type { BrowserSession } from "./browser.ts";
 declare const CurrentPrincipal_base: Context.ServiceClass<CurrentPrincipal, "@clankerauth/CurrentPrincipal", Verifier.Principal>;
 export declare class CurrentPrincipal extends CurrentPrincipal_base {
 }
@@ -63,16 +62,8 @@ export declare const make: (options: Options) => Effect.Effect<{
     issuer: string;
 }, ConfigurationError, import("effect/unstable/http/HttpClient").HttpClient>;
 export type Resource = Effect.Success<ReturnType<typeof make>>;
-export interface MiddlewareOptions {
-    /** Authenticate requests without an Authorization header by session cookie. Never for MCP. */
-    readonly browser?: BrowserSession;
-}
-/**
- * Bearer authentication providing `CurrentPrincipal`. With `browser`, a request
- * without an Authorization header is authenticated by the session cookie instead,
- * with Origin checked on unsafe methods.
- */
-export declare const middleware: (resource: Resource, options?: MiddlewareOptions) => import("effect/unstable/http/HttpRouter").Middleware<{
+/** Bearer authentication providing `CurrentPrincipal`. */
+export declare const middleware: (resource: Resource) => import("effect/unstable/http/HttpRouter").Middleware<{
     provides: CurrentPrincipal;
     handles: never;
     error: never;

package/dist/resource.js

@@ -40,20 +40,10 @@ export const make = Effect.fn("Resource.make")(function* (options) {
         issuer: options.issuer,
     };
 });
-/**
- * Bearer authentication providing `CurrentPrincipal`. With `browser`, a request
- * without an Authorization header is authenticated by the session cookie instead,
- * with Origin checked on unsafe methods.
- */
-export const middleware = (resource, options = {}) => Authentication.middleware(CurrentPrincipal, Effect.gen(function* () {
+/** Bearer authentication providing `CurrentPrincipal`. */
+export const middleware = (resource) => Authentication.middleware(CurrentPrincipal, Effect.gen(function* () {
     const request = yield* HttpServerRequest.HttpServerRequest;
-    const { browser } = options;
-    if (browser === undefined || request.headers.authorization !== undefined)
-        return yield* resource.verifier.verify(request.headers.authorization);
-    const session = request.cookies[`${browser.cookie.name}_session`];
-    if (session !== undefined && !["GET", "HEAD", "OPTIONS"].includes(request.method))
-        yield* browser.checkOrigin(request.headers.origin);
-    return yield* resource.verifier.verifyToken(yield* browser.accessToken(session));
+    return yield* resource.verifier.verify(request.headers.authorization);
 }).pipe(Effect.catch((error) => Effect.gen(function* () {
     const request = yield* HttpServerRequest.HttpServerRequest;
     // RFC 6750 §3.1: a request that carried no credentials gets no error code.

package/dist/transport.d.ts

@@ -1,16 +1,4 @@
-import { Cause, Effect } from "effect";
+import { Effect } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/unstable/http";
-import type { HttpClientError } from "effect/unstable/http/HttpClientError";
 import { ProviderUnavailable } from "./errors.ts";
-/** Preserve Effect causes while crossing the foreign library's Promise callback boundary. */
-export declare class TransportFailure extends Error {
-    readonly effectCause: Cause.Cause<ProviderUnavailable | HttpClientError>;
-    constructor(effectCause: Cause.Cause<ProviderUnavailable | HttpClientError>);
-}
-/**
- * The only Effect -> Promise bridge: the third-party OAuth library requires Fetch.
- * Capture the calling fiber's context per invocation, and propagate its AbortSignal.
- * Buffer small protocol responses so no response resource outlives the adapter effect.
- */
-export declare const protocolTransport: () => Effect.Effect<(url: string, init: RequestInit) => Promise<Response>, never, HttpClient.HttpClient>;
 export declare const execute: (client: HttpClient.HttpClient, request: HttpClientRequest.HttpClientRequest) => Effect.Effect<import("effect/unstable/http/HttpClientResponse").HttpClientResponse, ProviderUnavailable, import("effect/Scope").Scope>;

package/dist/transport.js

@@ -1,46 +1,6 @@
-import { Cause, Context, Effect, Exit } from "effect";
+import { Context, Effect } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
 import { ProviderUnavailable } from "./errors.js";
-/** Preserve Effect causes while crossing the foreign library's Promise callback boundary. */
-export class TransportFailure extends Error {
-    effectCause;
-    constructor(effectCause) {
-        super("Protocol transport failed");
-        this.effectCause = effectCause;
-    }
-}
-/**
- * The only Effect -> Promise bridge: the third-party OAuth library requires Fetch.
- * Capture the calling fiber's context per invocation, and propagate its AbortSignal.
- * Buffer small protocol responses so no response resource outlives the adapter effect.
- */
-export const protocolTransport = Effect.fn("Auth.protocolTransport")(function* () {
-    const client = yield* HttpClient.HttpClient;
-    const context = yield* Effect.context();
-    return (url, init) => Effect.runPromiseExitWith(context)(Effect.gen(function* () {
-        const request = yield* Effect.try({
-            try: () => HttpClientRequest.fromWeb(new Request(url, init)),
-            catch: (cause) => new ProviderUnavailable({ operation: "request", cause }),
-        });
-        const response = yield* execute(client, request);
-        if (response.status >= 300 && response.status < 400)
-            return yield* new ProviderUnavailable({
-                operation: "redirect",
-                cause: { status: response.status },
-            });
-        const body = yield* response.arrayBuffer;
-        return new Response(response.status === 204 || response.status === 205 || response.status === 304
-            ? null
-            : body, {
-            status: response.status,
-            headers: response.headers,
-        });
-    }).pipe(Effect.scoped), { signal: init.signal ?? undefined }).then((exit) => {
-        if (Exit.isFailure(exit))
-            throw new TransportFailure(exit.cause);
-        return exit.value;
-    });
-});
 // Node transports do not follow redirects by default. Also pin FetchHttpClient's policy;
 // forwarding credentials through a redirect is not an authentication fallback.
 export const execute = (client, request) => Effect.contextWith((context) => HttpClient.withScope(client)

package/dist/verify.js

@@ -1,5 +1,5 @@
 import { Clock, Effect, Exit, Schema, Semaphore } from "effect";
-import { createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
+import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
 import { ConfigurationError, Forbidden, ProviderUnavailable, RateLimited, Unauthorized, } from "./errors.js";
 import { execute } from "./transport.js";
@@ -26,16 +26,6 @@ const KeyResponse = Schema.Struct({
     scopes: Schema.Array(Schema.NonEmptyString),
     expiresAt: Schema.NullOr(Schema.String),
 });
-const credentialErrors = [
-    errors.JWTExpired,
-    errors.JWTClaimValidationFailed,
-    errors.JWSSignatureVerificationFailed,
-    errors.JWSInvalid,
-    errors.JWTInvalid,
-    errors.JOSENotSupported,
-    errors.JOSEAlgNotAllowed,
-    errors.JWKSNoMatchingKey,
-];
 const unauthorized = () => new Unauthorized({ message: "Authentication required" });
 /** Acquire once per resource; transport is selected by the application, not the SDK. */
 export const make = Effect.fn("Verifier.make")(function* (options) {
@@ -67,9 +57,8 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
     let keys = yield* makeCachedKeys;
     const resolveKey = (resolve, header) => Effect.tryPromise({
         try: () => resolve(header),
-        catch: (cause) => cause instanceof errors.JWKSNoMatchingKey
-            ? unauthorized()
-            : new ProviderUnavailable({ operation: "jwks.resolve", cause }),
+        // Selecting from fetched keys does no I/O: every failure is the credential's.
+        catch: unauthorized,
     });
     const signingKey = Effect.fn("Verifier.signingKey")(function* (header) {
         const resolve = yield* keys;
@@ -97,8 +86,9 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
             try: () => decodeProtectedHeader(token),
             catch: unauthorized,
         });
-        // Reject unsupported algorithms before doing provider I/O; JOSE still enforces its allowlist.
-        if (header.alg !== "EdDSA")
+        // The issuer always names its key, so key selection is never ambiguous. Reject other
+        // tokens before doing provider I/O; JOSE still enforces its algorithm allowlist.
+        if (header.alg !== "EdDSA" || header.kid === undefined)
             return yield* unauthorized();
         const key = yield* signingKey(header);
         const now = yield* Clock.currentTimeMillis;
@@ -111,9 +101,8 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
                 requiredClaims: ["sub", "client_id", "scope", "iat", "exp"],
                 currentDate: new Date(now),
             }),
-            catch: (cause) => credentialErrors.some((kind) => cause instanceof kind)
-                ? unauthorized()
-                : new ProviderUnavailable({ operation: "jwt.verify", cause }),
+            // Verification against a resolved key does no I/O either.
+            catch: unauthorized,
         });
         if (payload.cnf !== undefined)
             return yield* unauthorized();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gjermundgaraba/clankerauth-sdk",
-  "version": "0.4.0",
-  "description": "Effect-native Clanker Auth verification and browser sessions, with optional effect-actions integration",
+  "version": "0.5.0",
+  "description": "Effect-native Clanker Auth access-token and API-key verification, with optional effect-actions integration",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,10 +20,6 @@
     "./effect-actions": {
       "types": "./dist/effect-actions.d.ts",
       "import": "./dist/effect-actions.js"
-    },
-    "./browser-api": {
-      "types": "./dist/browser-api.d.ts",
-      "import": "./dist/browser-api.js"
     }
   },
   "publishConfig": {
@@ -31,18 +27,17 @@
   },
   "dependencies": {
     "effect": "4.0.0-rc.116",
-    "jose": "6.2.12",
-    "oauth4webapi": "3.8.8"
+    "jose": "6.2.12"
   },
   "devDependencies": {
-    "@gjermundgaraba/effect-actions": "0.1.0",
+    "@gjermundgaraba/effect-actions": "0.2.0",
     "@types/node": "26.6.2",
     "typescript": "7.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.3",
     "vite-plus": "0.3.3"
   },
   "peerDependencies": {
-    "@gjermundgaraba/effect-actions": "0.1.0"
+    "@gjermundgaraba/effect-actions": "0.2.0"
   },
   "peerDependenciesMeta": {
     "@gjermundgaraba/effect-actions": {

package/dist/browser-actions.d.ts

@@ -1,5 +0,0 @@
-import { Layer } from "effect";
-import { HttpRouter, HttpServerRequest } from "effect/unstable/http";
-import { type BrowserSession } from "./browser.ts";
-/** Login, session and logout actions under `/auth/browser`, plus the OAuth callback route. */
-export declare const layer: (browser: BrowserSession) => Layer.Layer<never, never, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | HttpRouter.Request<"Requires", HttpServerRequest.HttpServerRequest>>;

package/dist/browser-actions.js

@@ -1,54 +0,0 @@
-import { Actions, Http } from "./browser-api.js";
-import { Duration, Effect, Layer } from "effect";
-import { HttpEffect, HttpRouter, HttpServerRequest, HttpServerResponse, } from "effect/unstable/http";
-import { transactionLifetime } from "./browser.js";
-import { authenticationErrors, encodeError, InvalidRequest } from "./errors.js";
-const encode = encodeError([...authenticationErrors, InvalidRequest]);
-/** Login, session and logout actions under `/auth/browser`, plus the OAuth callback route. */
-export const layer = (browser) => {
-    const cookie = (suffix, value, age) => HttpServerResponse.setCookieUnsafe(`${browser.cookie.name}_${suffix}`, value, {
-        path: "/",
-        httpOnly: true,
-        sameSite: "lax",
-        secure: browser.cookie.secure,
-        maxAge: Duration.seconds(age),
-    });
-    const setCookie = (suffix, value, age) => HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(cookie(suffix, value, age)(response)));
-    const sameOrigin = Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) => browser.checkOrigin(request.headers.origin));
-    const sessionCookie = Effect.map(HttpServerRequest.HttpServerRequest, (request) => request.cookies[`${browser.cookie.name}_session`]);
-    const actions = Actions.implement({
-        login: ({ returnTo }) => Effect.gen(function* () {
-            yield* sameOrigin;
-            const result = yield* browser.login(returnTo);
-            yield* setCookie("login", result.transaction, transactionLifetime);
-            return { url: result.url };
-        }),
-        session: () => Effect.gen(function* () {
-            yield* sameOrigin;
-            return yield* browser.session(yield* sessionCookie);
-        }),
-        logout: () => Effect.gen(function* () {
-            yield* sameOrigin;
-            yield* browser.logout(yield* sessionCookie);
-            yield* setCookie("session", "", 0);
-            return {};
-        }),
-    });
-    const callback = Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        const url = yield* Effect.try({
-            try: () => new URL(request.originalUrl, browser.origin),
-            catch: () => new InvalidRequest({ message: "Invalid callback URL" }),
-        });
-        const result = yield* browser.callback(url, request.cookies[`${browser.cookie.name}_login`]);
-        return HttpServerResponse.redirect(result.location, { status: 302 }).pipe(cookie("session", result.session, browser.cookie.lifetime), cookie("login", "", 0));
-    }).pipe(Effect.catch((error) => encode(error).pipe(Effect.map((response) => 
-    // A root-mounted callback must report its error directly to avoid a redirect loop.
-    browser.callbackPath === "/"
-        ? response
-        : HttpServerResponse.redirect(`${browser.origin}/?auth_error=${response.status === 503 ? "unavailable" : "login_failed"}`, { status: 302 })), Effect.map(cookie("login", "", 0)))));
-    return Layer.mergeAll(Http.layer(actions), HttpRouter.add("GET", browser.callbackPath, callback)).pipe(Layer.provide(HttpRouter.middleware((effect) => HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(HttpServerResponse.setHeaders(response, {
-        "cache-control": "no-store",
-        "referrer-policy": "no-referrer",
-    }))).pipe(Effect.andThen(effect))).layer));
-};

package/dist/browser-api.d.ts

@@ -1,23 +0,0 @@
-import { Schema } from "effect";
-import * as Action from "@gjermundgaraba/effect-actions/Action";
-import * as ActionGroup from "@gjermundgaraba/effect-actions/ActionGroup";
-import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
-import { InvalidRequest } from "./errors.ts";
-export declare const Actions: ActionGroup.Group<"browser", readonly [Action.Action<"login", Schema.Struct<{
-    readonly returnTo: Schema.String;
-}>, Schema.Struct<{
-    readonly url: Schema.String;
-}>, readonly [typeof import("./errors.ts").Unauthorized, typeof import("./errors.ts").Forbidden, typeof import("./errors.ts").RateLimited, typeof import("./errors.ts").ProviderUnavailable, typeof import("./errors.ts").StoreError, typeof InvalidRequest], true, false>, Action.Action<"session", Schema.$Record<Schema.String, Schema.Never>, Schema.Struct<{
-    readonly subject: Schema.String;
-    readonly scopes: Schema.$Array<Schema.String>;
-    readonly issuer: Schema.String;
-}>, readonly [typeof import("./errors.ts").Unauthorized, typeof import("./errors.ts").Forbidden, typeof import("./errors.ts").RateLimited, typeof import("./errors.ts").ProviderUnavailable, typeof import("./errors.ts").StoreError, typeof InvalidRequest], true, false>, Action.Action<"logout", Schema.$Record<Schema.String, Schema.Never>, Schema.Struct<{}>, readonly [typeof import("./errors.ts").Unauthorized, typeof import("./errors.ts").Forbidden, typeof import("./errors.ts").RateLimited, typeof import("./errors.ts").ProviderUnavailable, typeof import("./errors.ts").StoreError, typeof InvalidRequest], true, false>], []>;
-export declare const Http: ActionHttp.Http<readonly [ActionGroup.Group<"browser", readonly [Action.Action<"login", Schema.Struct<{
-    readonly returnTo: Schema.String;
-}>, Schema.Struct<{
-    readonly url: Schema.String;
-}>, readonly [typeof import("./errors.ts").Unauthorized, typeof import("./errors.ts").Forbidden, typeof import("./errors.ts").RateLimited, typeof import("./errors.ts").ProviderUnavailable, typeof import("./errors.ts").StoreError, typeof InvalidRequest], true, false>, Action.Action<"session", Schema.$Record<Schema.String, Schema.Never>, Schema.Struct<{
-    readonly subject: Schema.String;
-    readonly scopes: Schema.$Array<Schema.String>;
-    readonly issuer: Schema.String;
-}>, readonly [typeof import("./errors.ts").Unauthorized, typeof import("./errors.ts").Forbidden, typeof import("./errors.ts").RateLimited, typeof import("./errors.ts").ProviderUnavailable, typeof import("./errors.ts").StoreError, typeof InvalidRequest], true, false>, Action.Action<"logout", Schema.$Record<Schema.String, Schema.Never>, Schema.Struct<{}>, readonly [typeof import("./errors.ts").Unauthorized, typeof import("./errors.ts").Forbidden, typeof import("./errors.ts").RateLimited, typeof import("./errors.ts").ProviderUnavailable, typeof import("./errors.ts").StoreError, typeof InvalidRequest], true, false>], []>]>;

package/dist/browser-api.js

@@ -1,24 +0,0 @@
-import { Schema } from "effect";
-import * as Action from "@gjermundgaraba/effect-actions/Action";
-import * as ActionGroup from "@gjermundgaraba/effect-actions/ActionGroup";
-import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
-import { authenticationErrors, InvalidRequest } from "./errors.js";
-export const Actions = ActionGroup.make({ name: "browser", errors: [...authenticationErrors, InvalidRequest] }, Action.make("login", {
-    description: "Start an OAuth authorization-code flow with PKCE.",
-    input: Schema.Struct({ returnTo: Schema.String }),
-    success: Schema.Struct({ url: Schema.String }),
-    mcp: false,
-}), Action.make("session", {
-    description: "Read the current application session.",
-    success: Schema.Struct({
-        subject: Schema.String,
-        scopes: Schema.Array(Schema.String),
-        issuer: Schema.String,
-    }),
-    mcp: false,
-}), Action.make("logout", {
-    description: "End this application session and revoke its refresh token.",
-    success: Schema.Struct({}),
-    mcp: false,
-}));
-export const Http = ActionHttp.make({ apiPath: "/auth" }, Actions);

package/dist/browser.d.ts

@@ -1,49 +0,0 @@
-import { Effect, Redacted } from "effect";
-import { HttpClient } from "effect/unstable/http";
-import { ConfigurationError, Forbidden, InvalidRequest, ProviderUnavailable, Unauthorized } from "./errors.ts";
-import { SessionStore } from "./store.ts";
-import type { Verifier } from "./verify.ts";
-export interface Options {
-    readonly issuer: string;
-    readonly clientId: string;
-    readonly clientSecret: Redacted.Redacted<string>;
-    readonly callbackUrl: string;
-    readonly resource: string;
-    readonly scopes: readonly string[];
-    readonly secret: Redacted.Redacted<string>;
-    readonly cookie: {
-        readonly name: string;
-        readonly lifetime?: number;
-    };
-    readonly verifyToken: Verifier["verifyToken"];
-}
-export declare const transactionLifetime = 600;
-/** Domain/session capability. Cookies and HTTP response mapping live in BrowserActions. */
-export declare const make: (options: Options) => Effect.Effect<{
-    login: (returnTo: string) => Effect.Effect<{
-        url: string;
-        transaction: string;
-    }, InvalidRequest | ProviderUnavailable | import("./errors.ts").StoreError | Unauthorized, never>;
-    callback: (url: URL, raw: string | undefined) => Effect.Effect<{
-        session: string;
-        location: string;
-    }, import("./errors.ts").StoreError | import("./verify.ts").VerificationError, never>;
-    session: (raw: string | undefined) => Effect.Effect<{
-        subject: string;
-        scopes: readonly string[];
-        issuer: string;
-    }, import("./errors.ts").StoreError | import("./verify.ts").VerificationError, never>;
-    logout: (raw: string | undefined) => Effect.Effect<void, import("./errors.ts").StoreError | Unauthorized, never>;
-    accessToken: (raw: string | undefined) => Effect.Effect<string, import("./errors.ts").StoreError | import("./verify.ts").VerificationError, never>;
-    origin: string;
-    callbackPath: `/${string}`;
-    resource: string;
-    issuer: string;
-    cookie: {
-        name: string;
-        lifetime: number;
-        secure: boolean;
-    };
-    checkOrigin: (value: string | undefined) => Effect.Effect<void, never, never> | Effect.Effect<never, Forbidden, never>;
-}, ConfigurationError, HttpClient.HttpClient | SessionStore>;
-export type BrowserSession = Effect.Success<ReturnType<typeof make>>;

package/dist/browser.js

@@ -1,303 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
-import { Clock, Effect, Exit, Redacted, Result, Schema } from "effect";
-import * as oauth from "oauth4webapi";
-import { Cookies, HttpClient } from "effect/unstable/http";
-import { ConfigurationError, Forbidden, InvalidRequest, ProviderUnavailable, Unauthorized, } from "./errors.js";
-import { SessionStore } from "./store.js";
-import { protocolTransport, TransportFailure } from "./transport.js";
-import * as Coordination from "./coordination.js";
-const Credentials = Schema.Struct({
-    accessToken: Schema.String,
-    refreshToken: Schema.optionalKey(Schema.String),
-    accessExpires: Schema.Finite,
-    subject: Schema.String,
-    refreshBlocked: Schema.Boolean,
-});
-const Login = Schema.Struct({
-    verifier: Schema.String,
-    state: Schema.String,
-    nonce: Schema.String,
-    returnTo: Schema.String,
-});
-export const transactionLifetime = 600;
-const hash = (value) => createHash("sha256").update(value).digest("hex");
-const random = () => randomBytes(32).toString("base64url");
-const unauthorized = (cause) => new Unauthorized({ message: "Sign in required", cause });
-const pkceChallenge = Effect.fn("BrowserSession.pkceChallenge")((verifier) => Effect.promise(() => oauth.calculatePKCECodeChallenge(verifier)));
-/** Domain/session capability. Cookies and HTTP response mapping live in BrowserActions. */
-export const make = Effect.fn("BrowserSession.make")(function* (options) {
-    const store = yield* SessionStore;
-    const locked = yield* Coordination.make;
-    const parsed = yield* Effect.try({
-        try: () => {
-            const callback = new URL(options.callbackUrl);
-            if (!["http:", "https:"].includes(callback.protocol) ||
-                callback.username ||
-                callback.password ||
-                options.callbackUrl.includes("#"))
-                throw new Error("Callback must be an HTTP(S) URL without credentials or fragment");
-            return { callback, issuer: new URL(options.issuer) };
-        },
-        catch: () => new ConfigurationError({ message: "Invalid browser callback URL or issuer" }),
-    });
-    if (Redacted.value(options.secret).length < 32)
-        return yield* new ConfigurationError({ message: "Browser session secret needs 32 characters" });
-    if (["session", "login"].some((suffix) => Result.isFailure(Cookies.makeCookie(`${options.cookie.name}_${suffix}`, ""))))
-        return yield* new ConfigurationError({ message: "Invalid cookie name" });
-    const { callback: callbackUrl, issuer } = parsed;
-    const origin = callbackUrl.origin;
-    const lifetime = options.cookie.lifetime ?? 30 * 24 * 60 * 60;
-    if (!Number.isSafeInteger(lifetime) || lifetime <= 0)
-        return yield* new ConfigurationError({ message: "Invalid cookie lifetime" });
-    const redirectUri = options.callbackUrl;
-    const key = createHash("sha256").update(Redacted.value(options.secret)).digest();
-    const client = { client_id: options.clientId };
-    const clientAuth = oauth.ClientSecretBasic(Redacted.value(options.clientSecret));
-    const seal = (value) => {
-        const iv = randomBytes(12);
-        const cipher = createCipheriv("aes-256-gcm", key, iv);
-        const bytes = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
-        return Buffer.concat([iv, cipher.getAuthTag(), bytes]).toString("base64url");
-    };
-    const open = Effect.fn("BrowserSession.open")(function* (payload) {
-        return yield* Effect.try({
-            try: () => {
-                const bytes = Buffer.from(payload, "base64url");
-                const cipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, 12));
-                cipher.setAuthTag(bytes.subarray(12, 28));
-                return Buffer.concat([cipher.update(bytes.subarray(28)), cipher.final()]).toString("utf8");
-            },
-            catch: unauthorized,
-        });
-    });
-    const decodeCredentials = (payload) => open(payload).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Credentials))), Effect.mapError(unauthorized));
-    const decodeLogin = (payload) => open(payload).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Login))), Effect.mapError(unauthorized));
-    const read = Effect.fn("BrowserSession.read")(function* (id) {
-        const row = yield* store.get(id);
-        if (!row)
-            return yield* unauthorized();
-        if (row.expires <= (yield* Clock.currentTimeMillis)) {
-            yield* store.delete(id);
-            return yield* unauthorized();
-        }
-        return row;
-    });
-    const write = (id, value, expires) => Effect.suspend(() => store.put(id, seal(value), expires));
-    // Library calls are the only Promise boundary. Transport and cancellation remain Effect-owned.
-    const transportClient = yield* HttpClient.HttpClient;
-    const protocol = (operation, call) => Effect.gen(function* () {
-        const fetch = yield* protocolTransport().pipe(Effect.provideService(HttpClient.HttpClient, transportClient));
-        return yield* Effect.tryPromise({
-            try: (signal) => call({
-                signal,
-                [oauth.customFetch]: fetch,
-                [oauth.allowInsecureRequests]: issuer.protocol === "http:" &&
-                    ["localhost", "127.0.0.1", "[::1]"].includes(issuer.hostname),
-            }),
-            catch: (cause) => {
-                if (cause instanceof TransportFailure)
-                    return cause;
-                if (cause instanceof oauth.AuthorizationResponseError ||
-                    (cause instanceof oauth.OperationProcessingError &&
-                        (cause.code === oauth.JWT_TIMESTAMP_CHECK ||
-                            cause.code === oauth.JWT_CLAIM_COMPARISON)) ||
-                    (cause instanceof oauth.ResponseBodyError && cause.error === "invalid_grant"))
-                    return unauthorized(cause);
-                return new ProviderUnavailable({ operation, cause });
-            },
-        }).pipe(Effect.catch((error) => error instanceof TransportFailure
-            ? Effect.failCause(error.effectCause).pipe(Effect.mapError((cause) => cause instanceof ProviderUnavailable
-                ? cause
-                : new ProviderUnavailable({ operation, cause })))
-            : Effect.fail(error)));
-    }).pipe(Effect.timeoutOrElse({
-        duration: "5 seconds",
-        orElse: () => Effect.fail(new ProviderUnavailable({ operation })),
-    }));
-    const provider = yield* Effect.cachedWithTTL(protocol("browser.discovery", async (opts) => {
-        const metadata = await oauth.processDiscoveryResponse(issuer, await oauth.discoveryRequest(issuer, opts));
-        if (!metadata.authorization_endpoint)
-            throw new Error("Missing authorization endpoint");
-        const endpoint = new URL(metadata.authorization_endpoint);
-        if (endpoint.protocol !== "https:" &&
-            !(endpoint.protocol === "http:" &&
-                ["localhost", "127.0.0.1", "[::1]"].includes(endpoint.hostname)))
-            throw new Error("Authorization endpoint must use HTTPS or loopback HTTP");
-        return { ...metadata, authorization_endpoint: endpoint.href };
-    }), (exit) => (Exit.isSuccess(exit) ? Infinity : 0));
-    const credentials = Effect.fn("BrowserSession.credentials")(function* (result, old) {
-        if (result.token_type !== "bearer" || !result.expires_in)
-            return yield* unauthorized();
-        const verified = yield* options.verifyToken(result.access_token);
-        if (old && old.subject !== verified.subject)
-            return yield* unauthorized();
-        const refreshToken = result.refresh_token ?? old?.refreshToken;
-        const next = {
-            accessToken: result.access_token,
-            accessExpires: (yield* Clock.currentTimeMillis) + result.expires_in * 1000,
-            subject: verified.subject,
-            refreshBlocked: false,
-        };
-        return refreshToken ? { ...next, refreshToken } : next;
-    });
-    const accessToken = Effect.fn("BrowserSession.accessToken")(function* (raw) {
-        if (!raw)
-            return yield* unauthorized();
-        const id = `session:${hash(raw)}`;
-        return yield* locked(id, Effect.gen(function* () {
-            const row = yield* read(id);
-            const saved = yield* decodeCredentials(row.payload);
-            // A persisted in-flight refresh always requires reauthentication, even if its access token is fresh.
-            if (saved.refreshBlocked) {
-                yield* store.delete(id);
-                return yield* unauthorized();
-            }
-            if (saved.accessExpires > (yield* Clock.currentTimeMillis) + 30_000)
-                return saved.accessToken;
-            if (!saved.refreshToken) {
-                yield* store.delete(id);
-                return yield* unauthorized();
-            }
-            const refreshToken = saved.refreshToken;
-            const as = yield* provider;
-            // Commit before the network call. Interruption/restart leaves a durable no-replay marker.
-            yield* write(id, { ...saved, refreshBlocked: true }, row.expires).pipe(Effect.uninterruptible);
-            const refresh = Effect.gen(function* () {
-                const result = yield* protocol("browser.refresh", async (opts) => {
-                    const response = await oauth.refreshTokenGrantRequest(as, client, clientAuth, refreshToken, {
-                        ...opts,
-                        additionalParameters: { resource: options.resource },
-                    });
-                    const result = await oauth.processRefreshTokenResponse(as, client, response);
-                    if (result.id_token)
-                        await oauth.validateApplicationLevelSignature(as, response, opts);
-                    return result;
-                });
-                const next = yield* credentials(result, saved);
-                const identity = oauth.getValidatedIdTokenClaims(result);
-                if (identity && identity.sub !== next.subject)
-                    return yield* unauthorized();
-                yield* write(id, next, row.expires).pipe(Effect.uninterruptible);
-                return next.accessToken;
-            });
-            // Typed failures invalidate locally. Interruption leaves the marker; defects are not auth failures.
-            return yield* refresh.pipe(Effect.tapError(() => store.delete(id)));
-        }));
-    });
-    const login = Effect.fn("BrowserSession.login")(function* (returnTo) {
-        const target = yield* Effect.try({
-            try: () => new URL(returnTo, origin),
-            catch: () => new InvalidRequest({ message: "Invalid return destination" }),
-        });
-        if (!returnTo.startsWith("/") ||
-            target.origin !== origin ||
-            target.pathname === callbackUrl.pathname)
-            return yield* new InvalidRequest({ message: "Invalid return destination" });
-        const as = yield* provider;
-        const raw = random();
-        const transaction = {
-            verifier: oauth.generateRandomCodeVerifier(),
-            state: oauth.generateRandomState(),
-            nonce: oauth.generateRandomNonce(),
-            returnTo: target.pathname + target.search + target.hash,
-        };
-        const challenge = yield* pkceChallenge(transaction.verifier);
-        const authorization = new URL(as.authorization_endpoint);
-        authorization.search = new URLSearchParams({
-            client_id: options.clientId,
-            redirect_uri: redirectUri,
-            response_type: "code",
-            scope: ["openid", "offline_access", ...options.scopes].join(" "),
-            resource: options.resource,
-            state: transaction.state,
-            nonce: transaction.nonce,
-            code_challenge: challenge,
-            code_challenge_method: "S256",
-        }).toString();
-        const now = yield* Clock.currentTimeMillis;
-        yield* store.sweep(now);
-        yield* write(`login:${hash(raw)}`, transaction, now + transactionLifetime * 1000);
-        return { url: authorization.href, transaction: raw };
-    });
-    const callback = Effect.fn("BrowserSession.callback")(function* (url, raw) {
-        if (url.searchParams.getAll("iss").length !== 1 ||
-            url.searchParams.get("iss") !== options.issuer ||
-            !raw)
-            return yield* unauthorized();
-        const id = `login:${hash(raw)}`;
-        return yield* locked(id, Effect.gen(function* () {
-            const row = yield* read(id);
-            // One-shot consume precedes every code exchange, including retries after interruption.
-            yield* store.delete(id).pipe(Effect.uninterruptible);
-            const transaction = yield* decodeLogin(row.payload);
-            const as = yield* provider;
-            const parameters = yield* Effect.try({
-                try: () => oauth.validateAuthResponse(as, client, url, transaction.state),
-                catch: unauthorized,
-            });
-            const result = yield* protocol("browser.callback", async (opts) => {
-                const response = await oauth.authorizationCodeGrantRequest(as, client, clientAuth, parameters, redirectUri, transaction.verifier, { ...opts, additionalParameters: { resource: options.resource } });
-                const result = await oauth.processAuthorizationCodeResponse(as, client, response, {
-                    expectedNonce: transaction.nonce,
-                    requireIdToken: true,
-                });
-                await oauth.validateApplicationLevelSignature(as, response, opts);
-                return result;
-            });
-            const saved = yield* credentials(result);
-            if (oauth.getValidatedIdTokenClaims(result)?.sub !== saved.subject)
-                return yield* unauthorized();
-            const session = random();
-            yield* write(`session:${hash(session)}`, saved, (yield* Clock.currentTimeMillis) + lifetime * 1000);
-            return { session, location: origin + transaction.returnTo };
-        }));
-    });
-    const session = Effect.fn("BrowserSession.session")(function* (raw) {
-        const token = yield* accessToken(raw);
-        const principal = yield* options.verifyToken(token);
-        return {
-            subject: principal.subject,
-            scopes: principal.scopes,
-            issuer: options.issuer,
-        };
-    });
-    const logout = Effect.fn("BrowserSession.logout")(function* (raw) {
-        if (!raw)
-            return;
-        const id = `session:${hash(raw)}`;
-        yield* locked(id, Effect.gen(function* () {
-            const row = yield* store.get(id);
-            yield* store.delete(id).pipe(Effect.uninterruptible);
-            if (!row)
-                return;
-            const saved = yield* decodeCredentials(row.payload);
-            if (!saved.refreshToken)
-                return;
-            const token = saved.refreshToken;
-            // Local deletion is authoritative. Provider revocation is deliberately best effort.
-            yield* Effect.gen(function* () {
-                const as = yield* provider;
-                yield* protocol("browser.revoke", async (opts) => oauth.processRevocationResponse(await oauth.revocationRequest(as, client, clientAuth, token, {
-                    ...opts,
-                    additionalParameters: { token_type_hint: "refresh_token" },
-                })));
-            }).pipe(Effect.catch(() => Effect.logWarning("Browser session ended locally; provider revocation failed")));
-        }));
-    });
-    return {
-        login,
-        callback,
-        session,
-        logout,
-        accessToken,
-        origin,
-        // SAFETY: the validated HTTP(S) URL has an absolute pathname beginning with "/".
-        callbackPath: callbackUrl.pathname,
-        resource: options.resource,
-        issuer: options.issuer,
-        cookie: { name: options.cookie.name, lifetime, secure: callbackUrl.protocol === "https:" },
-        checkOrigin: (value) => value === origin
-            ? Effect.void
-            : Effect.fail(new Forbidden({ message: "Cross-origin request rejected" })),
-    };
-});

package/dist/coordination.d.ts

@@ -1,3 +0,0 @@
-import { Effect } from "effect";
-/** Reference counts include waiters, so an interrupted waiter cannot split a live lock. */
-export declare const make: Effect.Effect<<A, E, R>(id: string, action: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>, never, never>;

package/dist/coordination.js

@@ -1,18 +0,0 @@
-import { Effect, Semaphore } from "effect";
-/** Reference counts include waiters, so an interrupted waiter cannot split a live lock. */
-export const make = Effect.sync(() => {
-    const entries = new Map();
-    return (id, action) => Effect.acquireUseRelease(Effect.sync(() => {
-        let entry = entries.get(id);
-        if (!entry) {
-            entry = { semaphore: Semaphore.makeUnsafe(1), users: 0 };
-            entries.set(id, entry);
-        }
-        entry.users++;
-        return entry;
-    }), (entry) => entry.semaphore.withPermit(action), (entry) => Effect.sync(() => {
-        entry.users--;
-        if (entry.users === 0)
-            entries.delete(id);
-    }));
-});

package/dist/store.d.ts

@@ -1,16 +0,0 @@
-import { Context, Effect } from "effect";
-import type { StoreError } from "./errors.ts";
-export interface Row {
-    readonly payload: string;
-    readonly expires: number;
-}
-declare const SessionStore_base: Context.ServiceClass<SessionStore, "@clankerauth/SessionStore", {
-    readonly get: (id: string) => Effect.Effect<Row | undefined, StoreError>;
-    readonly put: (id: string, payload: string, expires: number) => Effect.Effect<void, StoreError>;
-    readonly delete: (id: string) => Effect.Effect<void, StoreError>;
-    readonly sweep: (now: number) => Effect.Effect<void, StoreError>;
-}>;
-/** Sealed rows. One process owns a store; the session capability serializes work per id. */
-export declare class SessionStore extends SessionStore_base {
-}
-export {};

package/dist/store.js

@@ -1,4 +0,0 @@
-import { Context, Effect } from "effect";
-/** Sealed rows. One process owns a store; the session capability serializes work per id. */
-export class SessionStore extends Context.Service()("@clankerauth/SessionStore") {
-}