@gjermundgaraba/clankerauth-sdk 0.4.0

package/dist/browser.js

@@ -0,0 +1,303 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { Clock, Effect, Exit, Redacted, Result, Schema } from "effect";
+import * as oauth from "oauth4webapi";
+import { Cookies, HttpClient } from "effect/unstable/http";
+import { ConfigurationError, Forbidden, InvalidRequest, ProviderUnavailable, Unauthorized, } from "./errors.js";
+import { SessionStore } from "./store.js";
+import { protocolTransport, TransportFailure } from "./transport.js";
+import * as Coordination from "./coordination.js";
+const Credentials = Schema.Struct({
+    accessToken: Schema.String,
+    refreshToken: Schema.optionalKey(Schema.String),
+    accessExpires: Schema.Finite,
+    subject: Schema.String,
+    refreshBlocked: Schema.Boolean,
+});
+const Login = Schema.Struct({
+    verifier: Schema.String,
+    state: Schema.String,
+    nonce: Schema.String,
+    returnTo: Schema.String,
+});
+export const transactionLifetime = 600;
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const random = () => randomBytes(32).toString("base64url");
+const unauthorized = (cause) => new Unauthorized({ message: "Sign in required", cause });
+const pkceChallenge = Effect.fn("BrowserSession.pkceChallenge")((verifier) => Effect.promise(() => oauth.calculatePKCECodeChallenge(verifier)));
+/** Domain/session capability. Cookies and HTTP response mapping live in BrowserActions. */
+export const make = Effect.fn("BrowserSession.make")(function* (options) {
+    const store = yield* SessionStore;
+    const locked = yield* Coordination.make;
+    const parsed = yield* Effect.try({
+        try: () => {
+            const callback = new URL(options.callbackUrl);
+            if (!["http:", "https:"].includes(callback.protocol) ||
+                callback.username ||
+                callback.password ||
+                options.callbackUrl.includes("#"))
+                throw new Error("Callback must be an HTTP(S) URL without credentials or fragment");
+            return { callback, issuer: new URL(options.issuer) };
+        },
+        catch: () => new ConfigurationError({ message: "Invalid browser callback URL or issuer" }),
+    });
+    if (Redacted.value(options.secret).length < 32)
+        return yield* new ConfigurationError({ message: "Browser session secret needs 32 characters" });
+    if (["session", "login"].some((suffix) => Result.isFailure(Cookies.makeCookie(`${options.cookie.name}_${suffix}`, ""))))
+        return yield* new ConfigurationError({ message: "Invalid cookie name" });
+    const { callback: callbackUrl, issuer } = parsed;
+    const origin = callbackUrl.origin;
+    const lifetime = options.cookie.lifetime ?? 30 * 24 * 60 * 60;
+    if (!Number.isSafeInteger(lifetime) || lifetime <= 0)
+        return yield* new ConfigurationError({ message: "Invalid cookie lifetime" });
+    const redirectUri = options.callbackUrl;
+    const key = createHash("sha256").update(Redacted.value(options.secret)).digest();
+    const client = { client_id: options.clientId };
+    const clientAuth = oauth.ClientSecretBasic(Redacted.value(options.clientSecret));
+    const seal = (value) => {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", key, iv);
+        const bytes = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
+        return Buffer.concat([iv, cipher.getAuthTag(), bytes]).toString("base64url");
+    };
+    const open = Effect.fn("BrowserSession.open")(function* (payload) {
+        return yield* Effect.try({
+            try: () => {
+                const bytes = Buffer.from(payload, "base64url");
+                const cipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, 12));
+                cipher.setAuthTag(bytes.subarray(12, 28));
+                return Buffer.concat([cipher.update(bytes.subarray(28)), cipher.final()]).toString("utf8");
+            },
+            catch: unauthorized,
+        });
+    });
+    const decodeCredentials = (payload) => open(payload).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Credentials))), Effect.mapError(unauthorized));
+    const decodeLogin = (payload) => open(payload).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Login))), Effect.mapError(unauthorized));
+    const read = Effect.fn("BrowserSession.read")(function* (id) {
+        const row = yield* store.get(id);
+        if (!row)
+            return yield* unauthorized();
+        if (row.expires <= (yield* Clock.currentTimeMillis)) {
+            yield* store.delete(id);
+            return yield* unauthorized();
+        }
+        return row;
+    });
+    const write = (id, value, expires) => Effect.suspend(() => store.put(id, seal(value), expires));
+    // Library calls are the only Promise boundary. Transport and cancellation remain Effect-owned.
+    const transportClient = yield* HttpClient.HttpClient;
+    const protocol = (operation, call) => Effect.gen(function* () {
+        const fetch = yield* protocolTransport().pipe(Effect.provideService(HttpClient.HttpClient, transportClient));
+        return yield* Effect.tryPromise({
+            try: (signal) => call({
+                signal,
+                [oauth.customFetch]: fetch,
+                [oauth.allowInsecureRequests]: issuer.protocol === "http:" &&
+                    ["localhost", "127.0.0.1", "[::1]"].includes(issuer.hostname),
+            }),
+            catch: (cause) => {
+                if (cause instanceof TransportFailure)
+                    return cause;
+                if (cause instanceof oauth.AuthorizationResponseError ||
+                    (cause instanceof oauth.OperationProcessingError &&
+                        (cause.code === oauth.JWT_TIMESTAMP_CHECK ||
+                            cause.code === oauth.JWT_CLAIM_COMPARISON)) ||
+                    (cause instanceof oauth.ResponseBodyError && cause.error === "invalid_grant"))
+                    return unauthorized(cause);
+                return new ProviderUnavailable({ operation, cause });
+            },
+        }).pipe(Effect.catch((error) => error instanceof TransportFailure
+            ? Effect.failCause(error.effectCause).pipe(Effect.mapError((cause) => cause instanceof ProviderUnavailable
+                ? cause
+                : new ProviderUnavailable({ operation, cause })))
+            : Effect.fail(error)));
+    }).pipe(Effect.timeoutOrElse({
+        duration: "5 seconds",
+        orElse: () => Effect.fail(new ProviderUnavailable({ operation })),
+    }));
+    const provider = yield* Effect.cachedWithTTL(protocol("browser.discovery", async (opts) => {
+        const metadata = await oauth.processDiscoveryResponse(issuer, await oauth.discoveryRequest(issuer, opts));
+        if (!metadata.authorization_endpoint)
+            throw new Error("Missing authorization endpoint");
+        const endpoint = new URL(metadata.authorization_endpoint);
+        if (endpoint.protocol !== "https:" &&
+            !(endpoint.protocol === "http:" &&
+                ["localhost", "127.0.0.1", "[::1]"].includes(endpoint.hostname)))
+            throw new Error("Authorization endpoint must use HTTPS or loopback HTTP");
+        return { ...metadata, authorization_endpoint: endpoint.href };
+    }), (exit) => (Exit.isSuccess(exit) ? Infinity : 0));
+    const credentials = Effect.fn("BrowserSession.credentials")(function* (result, old) {
+        if (result.token_type !== "bearer" || !result.expires_in)
+            return yield* unauthorized();
+        const verified = yield* options.verifyToken(result.access_token);
+        if (old && old.subject !== verified.subject)
+            return yield* unauthorized();
+        const refreshToken = result.refresh_token ?? old?.refreshToken;
+        const next = {
+            accessToken: result.access_token,
+            accessExpires: (yield* Clock.currentTimeMillis) + result.expires_in * 1000,
+            subject: verified.subject,
+            refreshBlocked: false,
+        };
+        return refreshToken ? { ...next, refreshToken } : next;
+    });
+    const accessToken = Effect.fn("BrowserSession.accessToken")(function* (raw) {
+        if (!raw)
+            return yield* unauthorized();
+        const id = `session:${hash(raw)}`;
+        return yield* locked(id, Effect.gen(function* () {
+            const row = yield* read(id);
+            const saved = yield* decodeCredentials(row.payload);
+            // A persisted in-flight refresh always requires reauthentication, even if its access token is fresh.
+            if (saved.refreshBlocked) {
+                yield* store.delete(id);
+                return yield* unauthorized();
+            }
+            if (saved.accessExpires > (yield* Clock.currentTimeMillis) + 30_000)
+                return saved.accessToken;
+            if (!saved.refreshToken) {
+                yield* store.delete(id);
+                return yield* unauthorized();
+            }
+            const refreshToken = saved.refreshToken;
+            const as = yield* provider;
+            // Commit before the network call. Interruption/restart leaves a durable no-replay marker.
+            yield* write(id, { ...saved, refreshBlocked: true }, row.expires).pipe(Effect.uninterruptible);
+            const refresh = Effect.gen(function* () {
+                const result = yield* protocol("browser.refresh", async (opts) => {
+                    const response = await oauth.refreshTokenGrantRequest(as, client, clientAuth, refreshToken, {
+                        ...opts,
+                        additionalParameters: { resource: options.resource },
+                    });
+                    const result = await oauth.processRefreshTokenResponse(as, client, response);
+                    if (result.id_token)
+                        await oauth.validateApplicationLevelSignature(as, response, opts);
+                    return result;
+                });
+                const next = yield* credentials(result, saved);
+                const identity = oauth.getValidatedIdTokenClaims(result);
+                if (identity && identity.sub !== next.subject)
+                    return yield* unauthorized();
+                yield* write(id, next, row.expires).pipe(Effect.uninterruptible);
+                return next.accessToken;
+            });
+            // Typed failures invalidate locally. Interruption leaves the marker; defects are not auth failures.
+            return yield* refresh.pipe(Effect.tapError(() => store.delete(id)));
+        }));
+    });
+    const login = Effect.fn("BrowserSession.login")(function* (returnTo) {
+        const target = yield* Effect.try({
+            try: () => new URL(returnTo, origin),
+            catch: () => new InvalidRequest({ message: "Invalid return destination" }),
+        });
+        if (!returnTo.startsWith("/") ||
+            target.origin !== origin ||
+            target.pathname === callbackUrl.pathname)
+            return yield* new InvalidRequest({ message: "Invalid return destination" });
+        const as = yield* provider;
+        const raw = random();
+        const transaction = {
+            verifier: oauth.generateRandomCodeVerifier(),
+            state: oauth.generateRandomState(),
+            nonce: oauth.generateRandomNonce(),
+            returnTo: target.pathname + target.search + target.hash,
+        };
+        const challenge = yield* pkceChallenge(transaction.verifier);
+        const authorization = new URL(as.authorization_endpoint);
+        authorization.search = new URLSearchParams({
+            client_id: options.clientId,
+            redirect_uri: redirectUri,
+            response_type: "code",
+            scope: ["openid", "offline_access", ...options.scopes].join(" "),
+            resource: options.resource,
+            state: transaction.state,
+            nonce: transaction.nonce,
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+        }).toString();
+        const now = yield* Clock.currentTimeMillis;
+        yield* store.sweep(now);
+        yield* write(`login:${hash(raw)}`, transaction, now + transactionLifetime * 1000);
+        return { url: authorization.href, transaction: raw };
+    });
+    const callback = Effect.fn("BrowserSession.callback")(function* (url, raw) {
+        if (url.searchParams.getAll("iss").length !== 1 ||
+            url.searchParams.get("iss") !== options.issuer ||
+            !raw)
+            return yield* unauthorized();
+        const id = `login:${hash(raw)}`;
+        return yield* locked(id, Effect.gen(function* () {
+            const row = yield* read(id);
+            // One-shot consume precedes every code exchange, including retries after interruption.
+            yield* store.delete(id).pipe(Effect.uninterruptible);
+            const transaction = yield* decodeLogin(row.payload);
+            const as = yield* provider;
+            const parameters = yield* Effect.try({
+                try: () => oauth.validateAuthResponse(as, client, url, transaction.state),
+                catch: unauthorized,
+            });
+            const result = yield* protocol("browser.callback", async (opts) => {
+                const response = await oauth.authorizationCodeGrantRequest(as, client, clientAuth, parameters, redirectUri, transaction.verifier, { ...opts, additionalParameters: { resource: options.resource } });
+                const result = await oauth.processAuthorizationCodeResponse(as, client, response, {
+                    expectedNonce: transaction.nonce,
+                    requireIdToken: true,
+                });
+                await oauth.validateApplicationLevelSignature(as, response, opts);
+                return result;
+            });
+            const saved = yield* credentials(result);
+            if (oauth.getValidatedIdTokenClaims(result)?.sub !== saved.subject)
+                return yield* unauthorized();
+            const session = random();
+            yield* write(`session:${hash(session)}`, saved, (yield* Clock.currentTimeMillis) + lifetime * 1000);
+            return { session, location: origin + transaction.returnTo };
+        }));
+    });
+    const session = Effect.fn("BrowserSession.session")(function* (raw) {
+        const token = yield* accessToken(raw);
+        const principal = yield* options.verifyToken(token);
+        return {
+            subject: principal.subject,
+            scopes: principal.scopes,
+            issuer: options.issuer,
+        };
+    });
+    const logout = Effect.fn("BrowserSession.logout")(function* (raw) {
+        if (!raw)
+            return;
+        const id = `session:${hash(raw)}`;
+        yield* locked(id, Effect.gen(function* () {
+            const row = yield* store.get(id);
+            yield* store.delete(id).pipe(Effect.uninterruptible);
+            if (!row)
+                return;
+            const saved = yield* decodeCredentials(row.payload);
+            if (!saved.refreshToken)
+                return;
+            const token = saved.refreshToken;
+            // Local deletion is authoritative. Provider revocation is deliberately best effort.
+            yield* Effect.gen(function* () {
+                const as = yield* provider;
+                yield* protocol("browser.revoke", async (opts) => oauth.processRevocationResponse(await oauth.revocationRequest(as, client, clientAuth, token, {
+                    ...opts,
+                    additionalParameters: { token_type_hint: "refresh_token" },
+                })));
+            }).pipe(Effect.catch(() => Effect.logWarning("Browser session ended locally; provider revocation failed")));
+        }));
+    });
+    return {
+        login,
+        callback,
+        session,
+        logout,
+        accessToken,
+        origin,
+        // SAFETY: the validated HTTP(S) URL has an absolute pathname beginning with "/".
+        callbackPath: callbackUrl.pathname,
+        resource: options.resource,
+        issuer: options.issuer,
+        cookie: { name: options.cookie.name, lifetime, secure: callbackUrl.protocol === "https:" },
+        checkOrigin: (value) => value === origin
+            ? Effect.void
+            : Effect.fail(new Forbidden({ message: "Cross-origin request rejected" })),
+    };
+});

package/dist/coordination.d.ts

@@ -0,0 +1,3 @@
+import { Effect } from "effect";
+/** Reference counts include waiters, so an interrupted waiter cannot split a live lock. */
+export declare const make: Effect.Effect<<A, E, R>(id: string, action: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>, never, never>;

package/dist/coordination.js

@@ -0,0 +1,18 @@
+import { Effect, Semaphore } from "effect";
+/** Reference counts include waiters, so an interrupted waiter cannot split a live lock. */
+export const make = Effect.sync(() => {
+    const entries = new Map();
+    return (id, action) => Effect.acquireUseRelease(Effect.sync(() => {
+        let entry = entries.get(id);
+        if (!entry) {
+            entry = { semaphore: Semaphore.makeUnsafe(1), users: 0 };
+            entries.set(id, entry);
+        }
+        entry.users++;
+        return entry;
+    }), (entry) => entry.semaphore.withPermit(action), (entry) => Effect.sync(() => {
+        entry.users--;
+        if (entry.users === 0)
+            entries.delete(id);
+    }));
+});

package/dist/effect-actions.d.ts

@@ -0,0 +1,3 @@
+export * as Resource from "./resource.ts";
+export { CurrentPrincipal } from "./resource.ts";
+export * as BrowserActions from "./browser-actions.ts";

package/dist/effect-actions.js

@@ -0,0 +1,3 @@
+export * as Resource from "./resource.js";
+export { CurrentPrincipal } from "./resource.js";
+export * as BrowserActions from "./browser-actions.js";

package/dist/errors.d.ts

@@ -0,0 +1,58 @@
+import { Effect, Schema } from "effect";
+import { type Headers, HttpServerResponse } from "effect/unstable/http";
+declare const Unauthorized_base: Schema.Class<Unauthorized, Schema.TaggedStruct<"Unauthorized", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Schemas define public responses. Diagnostic causes are internal, non-enumerable fields. */
+export declare class Unauthorized extends Unauthorized_base {
+    readonly cause?: unknown;
+    constructor(options: {
+        readonly message: string;
+        readonly cause?: unknown;
+    });
+}
+declare const Forbidden_base: Schema.Class<Forbidden, Schema.TaggedStruct<"Forbidden", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class Forbidden extends Forbidden_base {
+}
+declare const RateLimited_base: Schema.Class<RateLimited, Schema.TaggedStruct<"RateLimited", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class RateLimited extends RateLimited_base {
+}
+declare const ProviderUnavailable_base: Schema.Class<ProviderUnavailable, Schema.TaggedStruct<"ProviderUnavailable", {
+    readonly operation: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ProviderUnavailable extends ProviderUnavailable_base {
+    readonly cause?: unknown;
+    constructor(options: {
+        readonly operation: string;
+        readonly cause?: unknown;
+    });
+}
+declare const StoreError_base: Schema.Class<StoreError, Schema.TaggedStruct<"StoreError", {
+    readonly operation: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class StoreError extends StoreError_base {
+    readonly cause?: unknown;
+    constructor(options: {
+        readonly operation: string;
+        readonly cause?: unknown;
+    });
+}
+declare const InvalidRequest_base: Schema.Class<InvalidRequest, Schema.TaggedStruct<"InvalidRequest", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class InvalidRequest extends InvalidRequest_base {
+}
+declare const ConfigurationError_base: Schema.Class<ConfigurationError, Schema.TaggedStruct<"ConfigurationError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConfigurationError extends ConfigurationError_base {
+}
+export declare const authenticationErrors: readonly [typeof Unauthorized, typeof Forbidden, typeof RateLimited, typeof ProviderUnavailable, typeof StoreError];
+export type AuthenticationError = Unauthorized | Forbidden | RateLimited | ProviderUnavailable | StoreError;
+/** Encode one of the declared schemas as JSON with its `httpApiStatus`. Undeclared errors are defects. */
+export declare const encodeError: <const Schemas extends ReadonlyArray<Schema.Top>>(schemas: Schemas) => (error: Schemas[number]["Type"], headers?: Headers.Input) => Effect.Effect<HttpServerResponse.HttpServerResponse, never, { [K in keyof Schemas]: Schemas[K]["EncodingServices"]; }[number]>;
+export {};

package/dist/errors.js

@@ -0,0 +1,49 @@
+import { Effect, Schema, SchemaAST } from "effect";
+import { HttpServerResponse } from "effect/unstable/http";
+/** Schemas define public responses. Diagnostic causes are internal, non-enumerable fields. */
+export class Unauthorized extends Schema.TaggedError()("Unauthorized", { message: Schema.String }, { httpApiStatus: 401 }) {
+    constructor(options) {
+        super({ message: options.message });
+        Object.defineProperty(this, "cause", { value: options.cause });
+    }
+}
+export class Forbidden extends Schema.TaggedError()("Forbidden", { message: Schema.String }, { httpApiStatus: 403 }) {
+}
+export class RateLimited extends Schema.TaggedError()("RateLimited", { message: Schema.String }, { httpApiStatus: 429 }) {
+}
+export class ProviderUnavailable extends Schema.TaggedError()("ProviderUnavailable", { operation: Schema.String }, { httpApiStatus: 503 }) {
+    constructor(options) {
+        super({ operation: options.operation });
+        Object.defineProperty(this, "cause", { value: options.cause });
+    }
+}
+export class StoreError extends Schema.TaggedError()("StoreError", { operation: Schema.String }, { httpApiStatus: 503 }) {
+    constructor(options) {
+        super({ operation: options.operation });
+        Object.defineProperty(this, "cause", { value: options.cause });
+    }
+}
+export class InvalidRequest extends Schema.TaggedError()("InvalidRequest", { message: Schema.String }, { httpApiStatus: 400 }) {
+}
+export class ConfigurationError extends Schema.TaggedError()("ConfigurationError", { message: Schema.String }) {
+}
+export const authenticationErrors = [
+    Unauthorized,
+    Forbidden,
+    RateLimited,
+    ProviderUnavailable,
+    StoreError,
+];
+/** Encode one of the declared schemas as JSON with its `httpApiStatus`. Undeclared errors are defects. */
+export const encodeError = (schemas) => {
+    const encode = HttpServerResponse.schemaJson(Schema.Union(schemas));
+    return (error, headers) => {
+        const schema = schemas.find((schema) => Schema.is(schema)(error));
+        if (schema === undefined)
+            return Effect.die(new Error("Undeclared error"));
+        return encode(error, {
+            status: SchemaAST.resolveAt("httpApiStatus")(schema.ast) ?? 500,
+            headers,
+        }).pipe(Effect.orDie);
+    };
+};

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * as Verifier from "./verify.ts";
+export * as BrowserSession from "./browser.ts";
+export { SessionStore, type Row } from "./store.ts";
+export type { Principal } from "./verify.ts";
+export { Unauthorized, Forbidden, RateLimited, ProviderUnavailable, StoreError, InvalidRequest, ConfigurationError, type AuthenticationError, } from "./errors.ts";

package/dist/index.js

@@ -0,0 +1,4 @@
+export * as Verifier from "./verify.js";
+export * as BrowserSession from "./browser.js";
+export { SessionStore } from "./store.js";
+export { Unauthorized, Forbidden, RateLimited, ProviderUnavailable, StoreError, InvalidRequest, ConfigurationError, } from "./errors.js";

package/dist/resource.d.ts

@@ -0,0 +1,83 @@
+import { Context, Effect } from "effect";
+import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
+import { ConfigurationError, Forbidden, RateLimited, Unauthorized } from "./errors.ts";
+import type { AuthenticationError } from "./errors.ts";
+import * as Verifier from "./verify.ts";
+import type { BrowserSession } from "./browser.ts";
+declare const CurrentPrincipal_base: Context.ServiceClass<CurrentPrincipal, "@clankerauth/CurrentPrincipal", Verifier.Principal>;
+export declare class CurrentPrincipal extends CurrentPrincipal_base {
+}
+export interface Options extends Verifier.Options {
+    readonly scopes: readonly string[];
+}
+/** One resource: its verifier and discovery. Acquire once per protected audience. */
+export declare const make: (options: Options) => Effect.Effect<{
+    verifier: {
+        verifyToken: (token: string) => Effect.Effect<{
+            subject: string;
+            scopes: string[];
+            actor: {
+                kind: "client";
+                clientId: string;
+            };
+        } | {
+            subject: string;
+            scopes: readonly string[];
+            actor: {
+                kind: "key";
+                keyId: string;
+            };
+        }, Forbidden | import("./errors.ts").ProviderUnavailable | RateLimited | Unauthorized, never>;
+        verify: (authorization: string | null | undefined) => Effect.Effect<{
+            subject: string;
+            scopes: string[];
+            actor: {
+                kind: "client";
+                clientId: string;
+            };
+        } | {
+            subject: string;
+            scopes: readonly string[];
+            actor: {
+                kind: "key";
+                keyId: string;
+            };
+        }, Forbidden | import("./errors.ts").ProviderUnavailable | RateLimited | Unauthorized, never>;
+    };
+    discovery: {
+        layer: import("effect/Layer").Layer<never, never, import("effect/unstable/http/HttpRouter").HttpRouter>;
+        metadataUrl: string;
+        challenge: (challenge?: Authentication.BearerChallengeOptions) => string;
+    };
+    challenge: (error?: "invalid_token" | "insufficient_scope") => {
+        "www-authenticate": string;
+    };
+    headers: (error: AuthenticationError) => {
+        "www-authenticate": string;
+    } | {
+        "retry-after": string;
+    } | {
+        "retry-after"?: undefined;
+    };
+    resource: string;
+    issuer: string;
+}, ConfigurationError, import("effect/unstable/http/HttpClient").HttpClient>;
+export type Resource = Effect.Success<ReturnType<typeof make>>;
+export interface MiddlewareOptions {
+    /** Authenticate requests without an Authorization header by session cookie. Never for MCP. */
+    readonly browser?: BrowserSession;
+}
+/**
+ * Bearer authentication providing `CurrentPrincipal`. With `browser`, a request
+ * without an Authorization header is authenticated by the session cookie instead,
+ * with Origin checked on unsafe methods.
+ */
+export declare const middleware: (resource: Resource, options?: MiddlewareOptions) => import("effect/unstable/http/HttpRouter").Middleware<{
+    provides: CurrentPrincipal;
+    handles: never;
+    error: never;
+    requires: never;
+    layerError: never;
+    layerRequires: never;
+}>;
+export {};

package/dist/resource.js

@@ -0,0 +1,64 @@
+import { Context, Effect } from "effect";
+import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
+import { HttpServerRequest } from "effect/unstable/http";
+import { authenticationErrors, ConfigurationError, encodeError, Forbidden, RateLimited, Unauthorized, } from "./errors.js";
+import * as Verifier from "./verify.js";
+const encode = encodeError(authenticationErrors);
+export class CurrentPrincipal extends Context.Service()("@clankerauth/CurrentPrincipal") {
+}
+/** One resource: its verifier and discovery. Acquire once per protected audience. */
+export const make = Effect.fn("Resource.make")(function* (options) {
+    const discovery = yield* Effect.try({
+        try: () => Authentication.protectedResource({
+            resource: options.resource,
+            authorizationServers: [options.issuer],
+            scopesSupported: options.scopes,
+        }),
+        catch: () => new ConfigurationError({ message: "Invalid resource metadata configuration" }),
+    });
+    const verifier = yield* Verifier.make(options);
+    const scope = options.requiredScopes?.length ? options.requiredScopes.join(" ") : undefined;
+    /** Bearer challenge for this resource; no error code when the request carried no credentials. */
+    const challenge = (error) => ({
+        "www-authenticate": discovery.challenge({ error, scope }),
+    });
+    const headers = (error) => {
+        if (error instanceof RateLimited)
+            return { "retry-after": "60" };
+        if (error instanceof Forbidden)
+            return challenge("insufficient_scope");
+        if (error instanceof Unauthorized)
+            return challenge("invalid_token");
+        return {};
+    };
+    return {
+        verifier,
+        discovery,
+        challenge,
+        headers,
+        resource: options.resource,
+        issuer: options.issuer,
+    };
+});
+/**
+ * Bearer authentication providing `CurrentPrincipal`. With `browser`, a request
+ * without an Authorization header is authenticated by the session cookie instead,
+ * with Origin checked on unsafe methods.
+ */
+export const middleware = (resource, options = {}) => Authentication.middleware(CurrentPrincipal, Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const { browser } = options;
+    if (browser === undefined || request.headers.authorization !== undefined)
+        return yield* resource.verifier.verify(request.headers.authorization);
+    const session = request.cookies[`${browser.cookie.name}_session`];
+    if (session !== undefined && !["GET", "HEAD", "OPTIONS"].includes(request.method))
+        yield* browser.checkOrigin(request.headers.origin);
+    return yield* resource.verifier.verifyToken(yield* browser.accessToken(session));
+}).pipe(Effect.catch((error) => Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    // RFC 6750 §3.1: a request that carried no credentials gets no error code.
+    const headers = error instanceof Unauthorized && request.headers.authorization === undefined
+        ? resource.challenge()
+        : resource.headers(error);
+    return yield* Effect.flatMap(encode(error, headers), Effect.fail);
+}))));

package/dist/store.d.ts

@@ -0,0 +1,16 @@
+import { Context, Effect } from "effect";
+import type { StoreError } from "./errors.ts";
+export interface Row {
+    readonly payload: string;
+    readonly expires: number;
+}
+declare const SessionStore_base: Context.ServiceClass<SessionStore, "@clankerauth/SessionStore", {
+    readonly get: (id: string) => Effect.Effect<Row | undefined, StoreError>;
+    readonly put: (id: string, payload: string, expires: number) => Effect.Effect<void, StoreError>;
+    readonly delete: (id: string) => Effect.Effect<void, StoreError>;
+    readonly sweep: (now: number) => Effect.Effect<void, StoreError>;
+}>;
+/** Sealed rows. One process owns a store; the session capability serializes work per id. */
+export declare class SessionStore extends SessionStore_base {
+}
+export {};

package/dist/store.js

@@ -0,0 +1,4 @@
+import { Context, Effect } from "effect";
+/** Sealed rows. One process owns a store; the session capability serializes work per id. */
+export class SessionStore extends Context.Service()("@clankerauth/SessionStore") {
+}

package/dist/transport.d.ts

@@ -0,0 +1,16 @@
+import { Cause, Effect } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
+import type { HttpClientError } from "effect/unstable/http/HttpClientError";
+import { ProviderUnavailable } from "./errors.ts";
+/** Preserve Effect causes while crossing the foreign library's Promise callback boundary. */
+export declare class TransportFailure extends Error {
+    readonly effectCause: Cause.Cause<ProviderUnavailable | HttpClientError>;
+    constructor(effectCause: Cause.Cause<ProviderUnavailable | HttpClientError>);
+}
+/**
+ * The only Effect -> Promise bridge: the third-party OAuth library requires Fetch.
+ * Capture the calling fiber's context per invocation, and propagate its AbortSignal.
+ * Buffer small protocol responses so no response resource outlives the adapter effect.
+ */
+export declare const protocolTransport: () => Effect.Effect<(url: string, init: RequestInit) => Promise<Response>, never, HttpClient.HttpClient>;
+export declare const execute: (client: HttpClient.HttpClient, request: HttpClientRequest.HttpClientRequest) => Effect.Effect<import("effect/unstable/http/HttpClientResponse").HttpClientResponse, ProviderUnavailable, import("effect/Scope").Scope>;