@gjermundgaraba/effect-actions 0.11.0 → 0.12.0

package/examples/kitchen-sink/src/attachments/download.ts

@@ -0,0 +1,49 @@
+import { Effect, Layer } from "effect";
+import { HttpRouter, HttpServerResponse } from "effect/http";
+import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
+import { authorize } from "../identity/authorize.js";
+import { CurrentMember, Session } from "../identity/Identity.js";
+import { GetAttachment } from "./Attachments.js";
+import { AttachmentStore } from "./store.js";
+
+// A route of the host's own: `GET /attachments/<id>` answers the image's bytes, for an `<img>`
+// of the web app, which no action can (an action answers JSON). A descriptor covers action
+// routes alone, so this one takes `Authentication.protect(Session)`: router middleware that
+// verifies the page's cookie with the provider the web app's rpcs use, provides
+// `CurrentMember`, and answers a refusal the route fails with as an action's is answered. A
+// token holder has no use for it: `getAttachment` gives an API client the same image.
+export const download = Layer.unwrap(
+  Effect.map(AttachmentStore, (store) =>
+    HttpRouter.add(
+      "GET",
+      "/attachments/:id",
+      Effect.gen(function* () {
+        // The route states its own authorization. It reuses the rule of the action it mirrors.
+        yield* authorize(GetAttachment);
+
+        const member = yield* CurrentMember;
+        const { id = "" } = yield* HttpRouter.params;
+        const { image } = yield* store.get(member.workspace, id);
+
+        // Authentication marks what it covers `no-store` unless the route states its own
+        // caching. An attachment never changes, but it is one workspace's: `private`.
+        return HttpServerResponse.uint8Array(image.data, {
+          contentType: image.mimeType,
+          headers: {
+            "cache-control": "private, max-age=31536000, immutable",
+            // What a member uploaded is served from the application's own origin, and an image
+            // can be a document: an SVG opened by its URL, not in an `<img>`, runs its scripts
+            // as the member reading it. `sandbox` gives it no origin and no scripts, and
+            // `nosniff` keeps the browser to the type stated.
+            "content-security-policy": "sandbox",
+            "x-content-type-options": "nosniff",
+          },
+        });
+      }).pipe(
+        Effect.catchTag("AttachmentNotFound", () =>
+          Effect.succeed(HttpServerResponse.empty({ status: 404 })),
+        ),
+      ),
+    ).pipe(Layer.provide(Authentication.protect(Session).layer)),
+  ),
+);

package/examples/kitchen-sink/src/attachments/handlers.ts

@@ -0,0 +1,38 @@
+import { Effect } from "effect";
+import * as Action from "@gjermundgaraba/effect-actions/Action";
+import { authorize } from "../identity/authorize.js";
+import { CurrentMember } from "../identity/Identity.js";
+import { writeLimit } from "../issues/write-limit.js";
+import { Attachments } from "./Attachments.js";
+import { AttachmentStore } from "./store.js";
+
+export const attachments = Action.implement(
+  Attachments,
+  Effect.gen(function* () {
+    const store = yield* AttachmentStore;
+    // The issues' write limit: an attachment counts against the same ten writes a minute.
+    const limited = yield* writeLimit;
+
+    return {
+      attachImage: ({ issue, name, image }) =>
+        Effect.gen(function* () {
+          // Input that decodes but cannot be served is the built-in `InvalidInput`, which
+          // every surface declares: no second error for bad input. Its `issues` name the
+          // field, as the library's own do for input that does not decode.
+          if (!image.mimeType.startsWith("image/")) {
+            const message = `Expected an image, got ${image.mimeType}.`;
+
+            return yield* new Action.InvalidInput({
+              message,
+              issues: [{ path: ["image", "mimeType"], message }],
+            });
+          }
+
+          return yield* limited((member) => store.add(member.workspace, issue, name, image));
+        }),
+      getAttachment: ({ id }) =>
+        Effect.flatMap(CurrentMember, (member) => store.get(member.workspace, id)),
+    };
+  }),
+  { authorize },
+);

package/examples/kitchen-sink/src/attachments/store.ts

@@ -0,0 +1,58 @@
+import { Context, Effect, Layer } from "effect";
+import type * as Action from "@gjermundgaraba/effect-actions/Action";
+import type { IssueNotFound } from "../issues/Issues.js";
+import { IssueStore } from "../issues/store.js";
+import { type Attachment, AttachmentNotFound } from "./Attachments.js";
+
+type Image = typeof Action.Image.Type;
+
+interface Stored {
+  readonly attachment: Attachment;
+  readonly image: Image;
+}
+
+/** Images attached to issues, each in its issue's workspace, as `IssueStore` keeps issues. */
+export class AttachmentStore extends Context.Service<
+  AttachmentStore,
+  {
+    readonly add: (
+      workspace: string,
+      issue: string,
+      name: string,
+      image: Image,
+    ) => Effect.Effect<Attachment, IssueNotFound>;
+    readonly get: (workspace: string, id: string) => Effect.Effect<Stored, AttachmentNotFound>;
+  }
+>()("tracker/AttachmentStore") {
+  // DEMO ONLY: memory. A service captures what it depends on when it is built, here the issue
+  // store, so its methods require nothing.
+  static readonly layerMemory = Layer.effect(
+    AttachmentStore,
+    Effect.gen(function* () {
+      const issues = yield* IssueStore;
+      const stored = new Map<string, Stored>();
+
+      return AttachmentStore.of({
+        add: Effect.fn("AttachmentStore.add")(function* (workspace, issue, name, image) {
+          yield* issues.get(workspace, issue);
+
+          const attachment = {
+            id: crypto.randomUUID(),
+            issue,
+            name,
+            mimeType: image.mimeType,
+            size: image.data.byteLength,
+          };
+
+          stored.set(`${workspace}/${attachment.id}`, { attachment, image });
+
+          return attachment;
+        }),
+        get: (workspace, id) =>
+          Effect.fromNullishOr(stored.get(`${workspace}/${id}`)).pipe(
+            Effect.mapError(() => new AttachmentNotFound({ id })),
+          ),
+      });
+    }),
+  );
+}

package/examples/kitchen-sink/src/browser.ts

@@ -0,0 +1,33 @@
+import { Effect, Layer } from "effect";
+import { RpcClient, RpcSerialization } from "effect/rpc";
+import { Socket } from "effect/socket";
+import * as ActionRpc from "@gjermundgaraba/effect-actions/ActionRpc";
+import { Rpc } from "./Rpc.js";
+
+// Entrypoint of the web app, an Effect program in a page. It imports the RPC binding and
+// nothing of the server. Its client has the methods of `ActionHttp.client`, over one socket.
+export const board = Effect.gen(function* () {
+  const tracker = yield* ActionRpc.client(Rpc);
+
+  const me = yield* tracker.whoAmI();
+  const { issues } = yield* tracker.listIssues({ status: "open", limit: 50 });
+
+  return { me, issues };
+});
+
+// Effect's own client protocol: a WebSocket speaking the server's JSON. The page sends no
+// credential itself: the browser attaches the session cookie to the upgrade, and the server
+// authenticates every message with it. A client that cannot rely on a cookie, such as a script,
+// sends a header on each message instead, with `RpcClient.withHeaders`.
+export const protocol = (url: string) =>
+  RpcClient.layerProtocolSocket().pipe(
+    Layer.provide(Socket.layerWebSocket(url)),
+    Layer.provide([RpcSerialization.layerJson, Socket.layerWebSocketConstructorGlobal]),
+  );
+
+// `open("wss://tracker.example.com/rpc")`: one run on a socket of its own. The socket belongs
+// to the Layer providing the protocol: it opens when that Layer is built, and closes when this
+// `Effect.provide` ends. `Effect.scoped` only holds the client. A page that stays connected
+// builds the Layer once, such as in a `ManagedRuntime`, and runs its programs in it.
+export const open = (url: string) =>
+  Effect.runPromise(board.pipe(Effect.scoped, Effect.provide(protocol(url))));

package/examples/kitchen-sink/src/cli.ts

@@ -0,0 +1,85 @@
+import { NodeHttpClient, NodeRuntime, NodeServices } from "@effect/platform-node";
+import { Config, Effect, flow, Option } from "effect";
+import { Command } from "effect/cli";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import * as ActionCli from "@gjermundgaraba/effect-actions/ActionCli";
+import { Http } from "./Api.js";
+
+// Entrypoint: `node --import tsx examples/kitchen-sink/src/cli.ts list-issues`.
+// The members' CLI: a command per action of the binding, a flag per input field, each calling
+// the server over HTTP. It imports the binding alone and runs nothing locally: the server
+// authenticates and authorizes, as for any client.
+const tracker = ActionCli.remote(Http, {
+  name: "tracker",
+  // Each command's options, keyed by its action's name and typed by that action.
+  commands: {
+    // `tracker list-issues -n 5 -s open`: short flags, and text instead of JSON (`--json` gives
+    // the JSON back).
+    listIssues: {
+      aliases: { limit: "n", status: "s" },
+      render: ({ issues }) =>
+        issues.map(({ id, status, title }) => `${id}  ${status}  ${title}`).join("\n"),
+    },
+    // `tracker get-issue ACME-1`: the id is an argument, not a flag.
+    getIssue: {
+      positional: ["id"],
+      render: (issue) =>
+        [
+          `# ${issue.id} ${issue.title} (${issue.status})`,
+          issue.body,
+          ...issue.comments.map(({ author, text }) => `- ${author}: ${text}`),
+        ].join("\n"),
+    },
+    // `tracker create-issue --title Crash < report.md`: the body is piped in.
+    createIssue: { stdin: "body" },
+    commentOnIssue: { name: "comment", positional: ["id"], stdin: "text" },
+    closeIssue: { name: "close", positional: ["id"] },
+    // `render` receives the decoded success, the image's bytes a `Uint8Array`.
+    getAttachment: {
+      positional: ["id"],
+      render: ({ attachment, image }) =>
+        `${attachment.name}: ${image.mimeType}, ${image.data.byteLength} bytes`,
+    },
+  },
+}).pipe(
+  // The connection is read from `Config` when a command runs, so `--help` needs none of it.
+  // It is provided on this command, so it reaches these commands' requests and no others.
+  // The token and the workspace are optional: `tracker get-status` is public and needs neither,
+  // and any other command without them gets the server's 401.
+  Command.provideEffect(
+    HttpClient.HttpClient,
+    Effect.gen(function* () {
+      const url = yield* Config.String("TRACKER_URL").pipe(
+        Config.withDefault("http://127.0.0.1:3000"),
+      );
+
+      const token = yield* Config.option(Config.Redacted("TRACKER_TOKEN"));
+      const workspace = yield* Config.option(Config.String("TRACKER_WORKSPACE"));
+
+      const unchanged = (request: HttpClientRequest.HttpClientRequest) => request;
+
+      return HttpClient.mapRequest(
+        yield* HttpClient.HttpClient,
+        flow(
+          HttpClientRequest.prependUrl(url),
+          Option.match(token, {
+            onNone: () => unchanged,
+            onSome: (value) => HttpClientRequest.bearerToken(value),
+          }),
+          Option.match(workspace, {
+            onNone: () => unchanged,
+            onSome: (slug) => HttpClientRequest.setHeader("x-workspace", slug),
+          }),
+        ),
+      );
+    }),
+  ),
+);
+
+// A result is printed on stdout. A failure goes to stderr, under an `ERROR` heading, as the JSON
+// HTTP sends, such as `{"_tag":"IssueNotFound","id":"ACME-9"}`, and the command exits 1.
+Command.run(tracker, { version: "1.0.0" }).pipe(
+  Effect.provide([NodeHttpClient.layerUndici, NodeServices.layer]),
+  ActionCli.logToStderr,
+  NodeRuntime.runMain,
+);

package/examples/kitchen-sink/src/config.ts

@@ -0,0 +1,18 @@
+import { Config } from "effect";
+
+// What a deployment sets. A `Config` is only a description: each is read where a layer is
+// built, so importing this file reads nothing, and a test runs on the defaults.
+
+/** Where callers reach the public port: the OAuth resource, and a Host the server answers to. */
+export const publicUrl = Config.String("PUBLIC_URL").pipe(
+  Config.withDefault("http://localhost:3000"),
+);
+
+/**
+ * The origins whose pages may call the public port: the web app's, which is the server's own,
+ * and one other, a browser MCP client's.
+ */
+export const allowedOrigins = Config.all([
+  publicUrl,
+  Config.String("MCP_ORIGIN").pipe(Config.withDefault("http://localhost:6274")),
+]).pipe(Config.map(([url, mcp]) => [new URL(url).origin, mcp]));

package/examples/kitchen-sink/src/identity/Identity.ts

@@ -0,0 +1,61 @@
+import { Context, Schema } from "effect";
+import { HttpApiSecurity } from "effect/http-api";
+import * as Action from "@gjermundgaraba/effect-actions/Action";
+import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
+
+export const scopes = { read: "issues:read", write: "issues:write" } as const;
+
+export const Scope = Schema.Literals([scopes.read, scopes.write]);
+
+/** A person acting in one workspace, with the scopes their credential holds there. */
+export interface Member {
+  readonly id: string;
+  readonly workspace: string;
+  readonly scopes: ReadonlyArray<typeof Scope.Type>;
+}
+
+/**
+ * Who is calling. A protected action declares it, `caller: CurrentMember`; authentication
+ * provides it per request, and a local host (stdio, the assistant, a test) provides it itself.
+ */
+export class CurrentMember extends Context.Service<CurrentMember, Member>()(
+  "tracker/CurrentMember",
+) {}
+
+// What a verifier may fail with besides a refusal. It is not the caller's fault, so it is no
+// 401: signing in again cannot help. Every protected route declares it, so clients decode it.
+export class IssuerUnavailable extends Schema.TaggedError<IssuerUnavailable>()(
+  "IssuerUnavailable",
+  { retryAfterSeconds: Schema.Finite },
+  { httpApiStatus: 503 },
+) {}
+
+// How an API client, the CLI and an MCP client prove they are CurrentMember: a bearer token,
+// the default scheme, and the only one that speaks OAuth (discovery, challenges, step-up).
+export const Login = Authentication.make("tracker.Login", CurrentMember, {
+  error: IssuerUnavailable,
+});
+
+// How the web app proves the same identity: the session cookie its sign-in page set. A
+// descriptor names one scheme, so a host accepting two credentials has two descriptors, each
+// named by what accepts it: here `Rpc`, the web app's socket, and the route its pages load an
+// attachment's image from.
+export const Session = Authentication.make("tracker.Session", CurrentMember, {
+  security: HttpApiSecurity.apiKey({ in: "cookie", key: "tracker_session" }),
+});
+
+// What the API's request quota answers with. It is the bindings' error, not an action's:
+// middleware sends it before any action is chosen, and only HTTP and RPC have that middleware.
+export class QuotaExceeded extends Schema.TaggedError<QuotaExceeded>()(
+  "QuotaExceeded",
+  { retryAfterSeconds: Schema.Finite },
+  { httpApiStatus: 429 },
+) {}
+
+// An action without input: its client method takes no argument, its command no flag.
+export const WhoAmI = Action.make("whoAmI", {
+  description: "Show who the credential identifies, in which workspace, with which scopes.",
+  success: { id: Schema.String, workspace: Schema.String, scopes: Schema.Array(Scope) },
+  readOnly: true,
+  caller: CurrentMember,
+});

package/examples/kitchen-sink/src/identity/authenticate.ts

@@ -0,0 +1,87 @@
+import { Array, Effect, Option, type Redacted } from "effect";
+import * as Action from "@gjermundgaraba/effect-actions/Action";
+import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
+import { publicUrl } from "../config.js";
+import { WorkspaceRegistry } from "../workspaces/registry.js";
+import { Tenant } from "../workspaces/tenant.js";
+import { Directory } from "./directory.js";
+import { Login, type Member, scopes, Session } from "./Identity.js";
+
+// What both verifiers check once a credential has named a member: an operator may have
+// suspended the workspace. Checked here, it holds on every remote surface.
+const inService = Effect.gen(function* () {
+  const registry = yield* WorkspaceRegistry;
+
+  return Effect.fn("inService")(function* (member: Member) {
+    const suspended = yield* registry.get(member.workspace).pipe(
+      Effect.map((workspace) => workspace.suspended),
+      Effect.orElseSucceed(() => true),
+    );
+
+    // No scopes named: signing in again grants nothing, so this is a plain 403, never a
+    // challenge sending an OAuth client back to its authorization server.
+    if (suspended) return yield* new Action.Forbidden({ message: "This workspace is suspended." });
+
+    return member;
+  });
+});
+
+// As an OAuth protected resource the provider publishes discovery (RFC 9728) and names it in
+// every challenge, so an MCP client that gets a 401 finds where to sign in, asking for the read
+// scope first. The resource is the public URL, known only to the deployment: an Effect, read
+// when the provider is built.
+const protectedResource = Effect.map(
+  publicUrl,
+  (url) =>
+    ({
+      resource: `${url}/mcp`,
+      // DEMO ONLY: no server is there. Yours is your authorization server's issuer.
+      authorizationServers: ["https://auth.example.com"],
+      scopesSupported: [scopes.read, scopes.write],
+      scopesRequired: [scopes.read],
+      resourceName: "Tracker",
+    }) satisfies Authentication.ProtectedResource,
+);
+
+// Server only: `Login`'s provider. The Effect is a builder, as `Action.implement` takes one:
+// it yields the startup services once, and returns the verifier, which runs per request and
+// may read request services, here the `Tenant` router middleware provides.
+export const authenticateBearer = Authentication.layer(
+  Login,
+  Effect.gen(function* () {
+    const directory = yield* Directory;
+    const admit = yield* inService;
+
+    return (token: Redacted.Redacted<string>) =>
+      Effect.gen(function* () {
+        const memberships = yield* directory.ofToken(token);
+
+        const member = Option.flatMap(yield* Tenant, (slug) =>
+          Array.findFirst(memberships, ({ workspace }) => workspace === slug),
+        );
+
+        if (Option.isNone(member)) {
+          return yield* new Action.Forbidden({
+            message: "Name a workspace you belong to in the X-Workspace header.",
+          });
+        }
+
+        return yield* admit(member.value);
+      });
+  }),
+  { protectedResource },
+);
+
+// `Session`'s provider: the same identity from another credential. Its verifier receives what
+// its scheme decodes, the cookie's value. A session belongs to one workspace, so it reads no
+// `Tenant`, and under a scheme other than Bearer there is no discovery and no step-up.
+export const authenticateSession = Authentication.layer(
+  Session,
+  Effect.gen(function* () {
+    const directory = yield* Directory;
+    const admit = yield* inService;
+
+    return (session: Redacted.Redacted<string>) =>
+      Effect.flatMap(directory.ofSession(session), admit);
+  }),
+);

package/examples/kitchen-sink/src/identity/authorize.ts

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+import * as Action from "@gjermundgaraba/effect-actions/Action";
+import { CurrentMember, scopes } from "./Identity.js";
+
+// The members' rule, read from each contract: a read needs the read scope, anything else the
+// write scope. Every implementation of the members' actions states it, so every surface runs
+// it before the handler: HTTP, MCP, RPC, stdio, the assistant's tools and a test alike.
+// Naming the missing scope turns the 403 into the challenge an OAuth client re-authorizes on.
+export const authorize = Effect.fn("authorize")(function* (action: Action.Any) {
+  const scope = action.readOnly ? scopes.read : scopes.write;
+  const member = yield* CurrentMember;
+
+  if (!member.scopes.includes(scope)) {
+    return yield* new Action.Forbidden({ message: `Requires ${scope}.`, scopes: [scope] });
+  }
+});

package/examples/kitchen-sink/src/identity/directory.ts

@@ -0,0 +1,52 @@
+import { Context, Effect, Layer, Redacted } from "effect";
+import * as Action from "@gjermundgaraba/effect-actions/Action";
+import type { IssuerUnavailable, Member } from "./Identity.js";
+import { members } from "./members.js";
+
+/**
+ * Who a credential names. It is a startup service: the verifiers yield it once, when their
+ * layer is built, and call it per request.
+ */
+export class Directory extends Context.Service<
+  Directory,
+  {
+    /** Every membership of the account an access token was issued to. */
+    readonly ofToken: (
+      token: Redacted.Redacted<string>,
+    ) => Effect.Effect<ReadonlyArray<Member>, Action.Unauthenticated | IssuerUnavailable>;
+    /** The member a web session was opened for: a session belongs to one workspace. */
+    readonly ofSession: (
+      session: Redacted.Redacted<string>,
+    ) => Effect.Effect<Member, Action.Unauthenticated>;
+  }
+>()("tracker/Directory") {
+  // DEMO ONLY: a token is an account's name (`ada`, `linus`, `kay`, `grace`) and a session a fixed
+  // string. A real directory checks a signed token with the authorization server's library,
+  // its audience included, failing with `IssuerUnavailable` when it cannot reach its keys, and
+  // reads sessions from their store.
+  static readonly layerDemo = Layer.sync(Directory, () => {
+    const accounts = new Map<string, ReadonlyArray<Member>>([
+      ["ada", [members.ada, members.adaAtGlobex]],
+      ["linus", [members.linus]],
+      ["kay", [members.kay]],
+      ["grace", [members.grace]],
+    ]);
+
+    const sessions = new Map<string, Member>([
+      ["ada-at-acme", members.ada],
+      ["kay-at-acme", members.kay],
+      ["grace-at-globex", members.grace],
+    ]);
+
+    return Directory.of({
+      ofToken: (token) =>
+        Effect.fromNullishOr(accounts.get(Redacted.value(token))).pipe(
+          Effect.mapError(() => new Action.Unauthenticated({ message: "Unknown demo token." })),
+        ),
+      ofSession: (session) =>
+        Effect.fromNullishOr(sessions.get(Redacted.value(session))).pipe(
+          Effect.mapError(() => new Action.Unauthenticated({ message: "Unknown demo session." })),
+        ),
+    });
+  });
+}

package/examples/kitchen-sink/src/identity/handlers.ts

@@ -0,0 +1,9 @@
+import * as Action from "@gjermundgaraba/effect-actions/Action";
+import { CurrentMember, WhoAmI } from "./Identity.js";
+
+// `Action.allowAll`: verification is the whole policy here. Any authenticated member may ask
+// who they are, whatever their scopes, so there is no rule to state. It must still be said:
+// an implementation of a protected action without `authorize` does not compile.
+export const identity = Action.implement(WhoAmI, () => CurrentMember, {
+  authorize: Action.allowAll,
+});

package/examples/kitchen-sink/src/identity/members.ts

@@ -0,0 +1,13 @@
+import { type Member, scopes } from "./Identity.js";
+
+// DEMO ONLY: the people of the demo, each a member of one workspace. A real application has no
+// such table: its directory reads a member from a signed token or a stored session. A local
+// host names its caller with one of these, and so does a test.
+export const members = {
+  ada: { id: "ada", workspace: "acme", scopes: [scopes.read, scopes.write] },
+  adaAtGlobex: { id: "ada", workspace: "globex", scopes: [scopes.read] },
+  linus: { id: "linus", workspace: "acme", scopes: [scopes.read] },
+  // Invited to acme, granted nothing yet.
+  kay: { id: "kay", workspace: "acme", scopes: [] },
+  grace: { id: "grace", workspace: "globex", scopes: [scopes.read, scopes.write] },
+} as const satisfies Readonly<Record<string, Member>>;

package/examples/kitchen-sink/src/identity/quota.ts

@@ -0,0 +1,62 @@
+import { Duration, Effect, Layer } from "effect";
+import { HttpApiMiddleware } from "effect/http-api";
+import { RateLimiter } from "effect/persistence";
+import { RpcMiddleware } from "effect/rpc";
+import { CurrentMember, QuotaExceeded } from "./Identity.js";
+
+// The API's request quota: 60 requests a minute per member. It is a surface's own middleware,
+// not a handler's check, because it must count before the input is decoded: a request whose
+// body does not decode counts too. It runs inside authentication, so it may require the
+// caller. HTTP and RPC each have their native middleware; an MCP endpoint takes none.
+
+/** Listed in `ActionHttp.layer`'s `middleware`. It fails only with an error the binding declares. */
+export class HttpQuota extends HttpApiMiddleware.Service<HttpQuota, { requires: CurrentMember }>()(
+  "tracker/HttpQuota",
+  { error: QuotaExceeded },
+) {}
+
+/** Listed in `ActionRpc.layer`'s `middleware`: the same quota, counted per message. */
+export class RpcQuota extends RpcMiddleware.Service<RpcQuota, { requires: CurrentMember }>()(
+  "tracker/RpcQuota",
+  { error: QuotaExceeded },
+) {}
+
+// What both middleware do before a call. Each middleware's layer builds this for itself, so it
+// runs twice; the count is one all the same, because both yield the one `RateLimiter` the
+// entrypoint provides and spend under the same key.
+const spend = Effect.gen(function* () {
+  const limiter = yield* RateLimiter.RateLimiter;
+
+  return Effect.gen(function* () {
+    const member = yield* CurrentMember;
+
+    yield* limiter
+      .consume({
+        key: JSON.stringify(["requests", member.workspace, member.id]),
+        limit: 60,
+        window: "1 minute",
+        onExceeded: "fail",
+      })
+      .pipe(
+        Effect.catchReason(
+          "RateLimiterError",
+          "RateLimitExceeded",
+          ({ retryAfter }) =>
+            Effect.fail(new QuotaExceeded({ retryAfterSeconds: Duration.toSeconds(retryAfter) })),
+          // Any other reason is the limiter's store failing: a defect, an empty 500.
+          Effect.die,
+        ),
+      );
+  });
+});
+
+export const quota = Layer.merge(
+  Layer.effect(
+    HttpQuota,
+    Effect.map(spend, (spent) => (route) => Effect.andThen(spent, route)),
+  ),
+  Layer.effect(
+    RpcQuota,
+    Effect.map(spend, (spent) => (rpc) => Effect.andThen(spent, rpc)),
+  ),
+);