@knpkv/jcf-web 0.2.0 → 0.4.0

package/dist/main.js

@@ -5,25 +5,27 @@
  * @module
  */
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { loopbackOrigin } from "@knpkv/browser-pairing/owner-session";
 import { Deferred, Effect, Fiber, Layer, Option } from "effect";
 import * as Stdio from "effect/Stdio";
 import * as Stream from "effect/Stream";
-import { makeOwnerSessionSecrets, ownerSessionOrigin, ownerSessionUrl } from "./server/OwnerSession.js";
+import { makeOwnerSession } from "./server/OwnerSession.js";
 import { makeServer, Port, PublicOrigin } from "./server/Server.js";
 const run = Effect.gen(function* () {
     const stdio = yield* Stdio.Stdio;
     const port = yield* Port.pipe(Effect.orDie);
     const configuredOrigin = yield* PublicOrigin.pipe(Effect.orDie);
-    const authorityOrigin = ownerSessionOrigin("127.0.0.1", port);
+    const authorityOrigin = loopbackOrigin("127.0.0.1", port);
     // One origin decision: the URL that gets printed is the same origin every request is checked
     // against, so a dev proxy in front of the server cannot be advertised and then rejected.
-    const security = yield* makeOwnerSessionSecrets(authorityOrigin, Option.getOrUndefined(configuredOrigin)).pipe(Effect.orDie);
+    const security = yield* makeOwnerSession(authorityOrigin, Option.getOrUndefined(configuredOrigin)).pipe(Effect.orDie);
     const ready = yield* Deferred.make();
     const server = yield* Layer.launch(makeServer({ port, ready, security })).pipe(Effect.forkChild({ startImmediately: true }));
-    yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(server));
+    // The server only ends this race by failing; until it is listening there is no link to print.
+    const url = yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(server).pipe(Effect.andThen(Effect.never)));
     // On stdout and nowhere else: this line is the credential. It is not logged, so it cannot end up
     // in a log file that outlives the process that minted it.
-    yield* Stream.make(`jcf week view: ${ownerSessionUrl(security.browserOrigin, security)}\n`).pipe(Stream.run(stdio.stdout()));
+    yield* Stream.make(`jcf week view: ${url}\n`).pipe(Stream.run(stdio.stdout()));
     return yield* Fiber.join(server);
 });
 // Executable entry point: the host platform is provided once for this process.

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AACvG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/D,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAE7D,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAC7C,eAAe,EACf,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CACxC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,iGAAiG;IACjG,0DAA0D;IAC1D,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,eAAe,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAC9F,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC,CAAC,CAAA;AAEF,+EAA+E;AAC/E,wDAAwD;AACxD,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/D,MAAM,eAAe,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAEzD,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB,CACtC,eAAe,EACf,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CACxC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAU,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;IACD,8FAA8F;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjH,iGAAiG;IACjG,0DAA0D;IAC1D,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC,CAAC,CAAA;AAEF,+EAA+E;AAC/E,wDAAwD;AACxD,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA"}

package/dist/server/Api.d.ts

@@ -468,17 +468,23 @@ declare const JcfWebApi_base: HttpApi.HttpApi<"JcfWebApi", HttpApiGroup.HttpApiG
         readonly endMs: Schema.Number;
         readonly description: Schema.NullOr<Schema.String>;
     }>;
-}>>, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError | typeof ProposalRejectedError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"rows", HttpApiEndpoint.HttpApiEndpoint<"confirm", "POST", "/api/rows/confirm", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly blocks: Schema.optional<Schema.$Array<Schema.Number>>;
-    readonly note: Schema.optional<Schema.String>;
+}>>, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError | typeof ProposalRejectedError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"rows", HttpApiEndpoint.HttpApiEndpoint<"describe", "POST", "/api/rows/describe", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly planId: Schema.String;
+    readonly rowId: Schema.String;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly planId: Schema.String;
     readonly rowId: Schema.String;
+    readonly note: Schema.NullOr<Schema.String>;
+}>>, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"manual", "POST", "/api/rows/manual", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly day: Schema.String;
+    readonly note: Schema.optional<Schema.String>;
+    readonly seconds: Schema.Number;
     readonly targets: Schema.optional<Schema.Struct<{
         readonly clockify: Schema.Boolean;
         readonly jira: Schema.Boolean;
     }>>;
-    readonly seconds: Schema.optional<Schema.Number>;
-    readonly ticketKey: Schema.optional<Schema.String>;
+    readonly startClock: Schema.optional<Schema.String>;
+    readonly ticketKey: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly clockify: Schema.Union<readonly [Schema.TaggedStruct<"Written", {
         readonly seconds: Schema.Number;
@@ -518,23 +524,17 @@ declare const JcfWebApi_base: HttpApi.HttpApi<"JcfWebApi", HttpApiGroup.HttpApiG
         readonly message: Schema.String;
     }>, Schema.TaggedStruct<"NotLoggedIn", {}>]>;
     readonly lines: Schema.$Array<Schema.String>;
-}>>, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError | typeof ProposalRejectedError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"describe", "POST", "/api/rows/describe", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly planId: Schema.String;
-    readonly rowId: Schema.String;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof ApiError | typeof ProposalRejectedError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"confirm", "POST", "/api/rows/confirm", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly blocks: Schema.optional<Schema.$Array<Schema.Number>>;
+    readonly note: Schema.optional<Schema.String>;
     readonly planId: Schema.String;
     readonly rowId: Schema.String;
-    readonly note: Schema.NullOr<Schema.String>;
-}>>, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"manual", "POST", "/api/rows/manual", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly day: Schema.String;
-    readonly note: Schema.optional<Schema.String>;
-    readonly seconds: Schema.Number;
     readonly targets: Schema.optional<Schema.Struct<{
         readonly clockify: Schema.Boolean;
         readonly jira: Schema.Boolean;
     }>>;
-    readonly startClock: Schema.optional<Schema.String>;
-    readonly ticketKey: Schema.String;
+    readonly seconds: Schema.optional<Schema.Number>;
+    readonly ticketKey: Schema.optional<Schema.String>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly clockify: Schema.Union<readonly [Schema.TaggedStruct<"Written", {
         readonly seconds: Schema.Number;
@@ -574,7 +574,110 @@ declare const JcfWebApi_base: HttpApi.HttpApi<"JcfWebApi", HttpApiGroup.HttpApiG
         readonly message: Schema.String;
     }>, Schema.TaggedStruct<"NotLoggedIn", {}>]>;
     readonly lines: Schema.$Array<Schema.String>;
-}>>, Schema.toCodecJson<typeof ApiError | typeof ProposalRejectedError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"week", HttpApiEndpoint.HttpApiEndpoint<"read", "GET", "/api/week/", never, Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError | typeof ProposalRejectedError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"week", HttpApiEndpoint.HttpApiEndpoint<"saved", "GET", "/api/week/saved", never, Schema.toCodecStringTree<Schema.Struct<{
+    readonly monday: Schema.optional<Schema.String>;
+    readonly only: Schema.optional<Schema.Literals<readonly ["both", "clockify", "jira"]>>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly monday: Schema.String;
+    readonly scope: Schema.Literals<readonly ["both", "clockify", "jira"]>;
+    readonly plan: Schema.NullOr<Schema.Struct<{
+        readonly attributorAvailable: Schema.Boolean;
+        readonly attributorCalls: Schema.Number;
+        readonly days: Schema.$Array<Schema.String>;
+        readonly excludedDays: Schema.$Array<Schema.Struct<{
+            readonly day: Schema.String;
+            readonly reason: Schema.String;
+        }>>;
+        readonly monday: Schema.String;
+        readonly planId: Schema.String;
+        readonly rows: Schema.$Array<Schema.Struct<{
+            readonly clockifyDescription: Schema.NullOr<Schema.String>;
+            readonly clockifySeconds: Schema.Number;
+            readonly day: Schema.String;
+            readonly intervals: Schema.$Array<Schema.Struct<{
+                readonly entry: Schema.optionalKey<Schema.Struct<{
+                    readonly revision: Schema.String;
+                    readonly id: Schema.String;
+                    readonly source: Schema.Literals<readonly ["jira", "clockify"]>;
+                    readonly ticketKey: Schema.NullOr<Schema.String>;
+                    readonly startMs: Schema.Number;
+                    readonly endMs: Schema.Number;
+                    readonly description: Schema.NullOr<Schema.String>;
+                }>>;
+                readonly endMs: Schema.Number;
+                readonly source: Schema.Literals<readonly ["clockify", "jira"]>;
+                readonly startMs: Schema.Number;
+            }>>;
+            readonly jiraSeconds: Schema.Number;
+            readonly proposal: Schema.optional<Schema.Struct<{
+                readonly activeSeconds: Schema.Number;
+                readonly blocks: Schema.$Array<Schema.Struct<{
+                    readonly consumed: Schema.Struct<{
+                        readonly clockify: Schema.Number;
+                        readonly jira: Schema.Number;
+                    }>;
+                    readonly clockifyRefusal: Schema.optionalKey<Schema.Literal<"unlinked-overlap">>;
+                    readonly endMs: Schema.Number;
+                    readonly seconds: Schema.Number;
+                    readonly startMs: Schema.Number;
+                    readonly sourceStartMs: Schema.optional<Schema.Number>;
+                }>>;
+                readonly clockifyDelta: Schema.Number;
+                readonly confidence: Schema.NullOr<Schema.Number>;
+                readonly jiraDelta: Schema.Number;
+                readonly maxSeconds: Schema.Number;
+                readonly sessionCount: Schema.Number;
+                readonly signal: Schema.Literals<readonly ["branch", "path", "standing", "agent", "none"]>;
+            }>>;
+            readonly rowId: Schema.String;
+            readonly ticketKey: Schema.String;
+            readonly ticketTitle: Schema.NullOr<Schema.String>;
+        }>>;
+        readonly unlinkedClockify: Schema.$Array<Schema.Struct<{
+            readonly entry: Schema.optionalKey<Schema.Struct<{
+                readonly revision: Schema.String;
+                readonly id: Schema.String;
+                readonly source: Schema.Literals<readonly ["jira", "clockify"]>;
+                readonly ticketKey: Schema.NullOr<Schema.String>;
+                readonly startMs: Schema.Number;
+                readonly endMs: Schema.Number;
+                readonly description: Schema.NullOr<Schema.String>;
+            }>>;
+            readonly day: Schema.String;
+            readonly seconds: Schema.Number;
+            readonly description: Schema.NullOr<Schema.String>;
+            readonly startMs: Schema.Number;
+            readonly endMs: Schema.Number;
+        }>>;
+        readonly sessionCount: Schema.Number;
+        readonly sessionScanAvailable: Schema.optional<Schema.Boolean>;
+        readonly scope: Schema.Literals<readonly ["both", "clockify", "jira"]>;
+        readonly sessionRootCount: Schema.Number;
+        readonly notMine: Schema.$Array<Schema.Struct<{
+            readonly assignee: Schema.NullOr<Schema.String>;
+            readonly day: Schema.String;
+            readonly seconds: Schema.Number;
+            readonly signal: Schema.Literals<readonly ["branch", "path", "standing", "agent", "none"]>;
+            readonly ticketKey: Schema.String;
+            readonly ticketTitle: Schema.NullOr<Schema.String>;
+        }>>;
+        readonly ownershipChecked: Schema.Boolean;
+        readonly ownership: Schema.Literals<readonly ["assigned", "any"]>;
+        readonly unattributed: Schema.$Array<Schema.Struct<{
+            readonly cwds: Schema.$Array<Schema.String>;
+            readonly day: Schema.String;
+            readonly seconds: Schema.Number;
+            readonly sessionCount: Schema.Number;
+        }>>;
+        readonly withheld: Schema.$Array<Schema.Struct<{
+            readonly confidence: Schema.NullOr<Schema.Number>;
+            readonly day: Schema.String;
+            readonly seconds: Schema.Number;
+            readonly ticketKey: Schema.String;
+            readonly ticketTitle: Schema.NullOr<Schema.String>;
+        }>>;
+    }>>;
+}>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"read", "GET", "/api/week/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly monday: Schema.optional<Schema.String>;
     readonly only: Schema.optional<Schema.Literals<readonly ["both", "clockify", "jira"]>>;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -678,110 +781,7 @@ declare const JcfWebApi_base: HttpApi.HttpApi<"JcfWebApi", HttpApiGroup.HttpApiG
 }>>, never, never, HttpApiSchema.StreamUint8Array, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"recordedOnly", "GET", "/api/week/recorded-only", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly monday: Schema.optional<Schema.String>;
     readonly only: Schema.optional<Schema.Literals<readonly ["both", "clockify", "jira"]>>;
-}>>, never, never, HttpApiSchema.StreamUint8Array, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"saved", "GET", "/api/week/saved", never, Schema.toCodecStringTree<Schema.Struct<{
-    readonly monday: Schema.optional<Schema.String>;
-    readonly only: Schema.optional<Schema.Literals<readonly ["both", "clockify", "jira"]>>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly monday: Schema.String;
-    readonly scope: Schema.Literals<readonly ["both", "clockify", "jira"]>;
-    readonly plan: Schema.NullOr<Schema.Struct<{
-        readonly attributorAvailable: Schema.Boolean;
-        readonly attributorCalls: Schema.Number;
-        readonly days: Schema.$Array<Schema.String>;
-        readonly excludedDays: Schema.$Array<Schema.Struct<{
-            readonly day: Schema.String;
-            readonly reason: Schema.String;
-        }>>;
-        readonly monday: Schema.String;
-        readonly planId: Schema.String;
-        readonly rows: Schema.$Array<Schema.Struct<{
-            readonly clockifyDescription: Schema.NullOr<Schema.String>;
-            readonly clockifySeconds: Schema.Number;
-            readonly day: Schema.String;
-            readonly intervals: Schema.$Array<Schema.Struct<{
-                readonly entry: Schema.optionalKey<Schema.Struct<{
-                    readonly revision: Schema.String;
-                    readonly id: Schema.String;
-                    readonly source: Schema.Literals<readonly ["jira", "clockify"]>;
-                    readonly ticketKey: Schema.NullOr<Schema.String>;
-                    readonly startMs: Schema.Number;
-                    readonly endMs: Schema.Number;
-                    readonly description: Schema.NullOr<Schema.String>;
-                }>>;
-                readonly endMs: Schema.Number;
-                readonly source: Schema.Literals<readonly ["clockify", "jira"]>;
-                readonly startMs: Schema.Number;
-            }>>;
-            readonly jiraSeconds: Schema.Number;
-            readonly proposal: Schema.optional<Schema.Struct<{
-                readonly activeSeconds: Schema.Number;
-                readonly blocks: Schema.$Array<Schema.Struct<{
-                    readonly consumed: Schema.Struct<{
-                        readonly clockify: Schema.Number;
-                        readonly jira: Schema.Number;
-                    }>;
-                    readonly clockifyRefusal: Schema.optionalKey<Schema.Literal<"unlinked-overlap">>;
-                    readonly endMs: Schema.Number;
-                    readonly seconds: Schema.Number;
-                    readonly startMs: Schema.Number;
-                    readonly sourceStartMs: Schema.optional<Schema.Number>;
-                }>>;
-                readonly clockifyDelta: Schema.Number;
-                readonly confidence: Schema.NullOr<Schema.Number>;
-                readonly jiraDelta: Schema.Number;
-                readonly maxSeconds: Schema.Number;
-                readonly sessionCount: Schema.Number;
-                readonly signal: Schema.Literals<readonly ["branch", "path", "standing", "agent", "none"]>;
-            }>>;
-            readonly rowId: Schema.String;
-            readonly ticketKey: Schema.String;
-            readonly ticketTitle: Schema.NullOr<Schema.String>;
-        }>>;
-        readonly unlinkedClockify: Schema.$Array<Schema.Struct<{
-            readonly entry: Schema.optionalKey<Schema.Struct<{
-                readonly revision: Schema.String;
-                readonly id: Schema.String;
-                readonly source: Schema.Literals<readonly ["jira", "clockify"]>;
-                readonly ticketKey: Schema.NullOr<Schema.String>;
-                readonly startMs: Schema.Number;
-                readonly endMs: Schema.Number;
-                readonly description: Schema.NullOr<Schema.String>;
-            }>>;
-            readonly day: Schema.String;
-            readonly seconds: Schema.Number;
-            readonly description: Schema.NullOr<Schema.String>;
-            readonly startMs: Schema.Number;
-            readonly endMs: Schema.Number;
-        }>>;
-        readonly sessionCount: Schema.Number;
-        readonly sessionScanAvailable: Schema.optional<Schema.Boolean>;
-        readonly scope: Schema.Literals<readonly ["both", "clockify", "jira"]>;
-        readonly sessionRootCount: Schema.Number;
-        readonly notMine: Schema.$Array<Schema.Struct<{
-            readonly assignee: Schema.NullOr<Schema.String>;
-            readonly day: Schema.String;
-            readonly seconds: Schema.Number;
-            readonly signal: Schema.Literals<readonly ["branch", "path", "standing", "agent", "none"]>;
-            readonly ticketKey: Schema.String;
-            readonly ticketTitle: Schema.NullOr<Schema.String>;
-        }>>;
-        readonly ownershipChecked: Schema.Boolean;
-        readonly ownership: Schema.Literals<readonly ["assigned", "any"]>;
-        readonly unattributed: Schema.$Array<Schema.Struct<{
-            readonly cwds: Schema.$Array<Schema.String>;
-            readonly day: Schema.String;
-            readonly seconds: Schema.Number;
-            readonly sessionCount: Schema.Number;
-        }>>;
-        readonly withheld: Schema.$Array<Schema.Struct<{
-            readonly confidence: Schema.NullOr<Schema.Number>;
-            readonly day: Schema.String;
-            readonly seconds: Schema.Number;
-            readonly ticketKey: Schema.String;
-            readonly ticketTitle: Schema.NullOr<Schema.String>;
-        }>>;
-    }>>;
-}>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"stream", "GET", "/api/week/stream", never, Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, never, HttpApiSchema.StreamUint8Array, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"stream", "GET", "/api/week/stream", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly monday: Schema.optional<Schema.String>;
     readonly only: Schema.optional<Schema.Literals<readonly ["both", "clockify", "jira"]>>;
 }>>, never, never, HttpApiSchema.StreamUint8Array, Schema.toCodecJson<typeof ApiError | typeof PlanExpiredError>, OwnerSessionAuth, never>, false>>;

package/dist/server/HttpApplication.d.ts

@@ -1,7 +1,18 @@
 /** The same authenticated routes, bootstrap exchange and static client in production and tests. */
-import { FileSystem, Layer, Path } from "effect";
-import { HttpRouter } from "effect/http";
-/** True only when `candidate` is `root` itself or one of its path-segment descendants. */
-export declare const isWithinDirectory: (path: Path.Path, root: string, candidate: string) => boolean;
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
+import { Layer, Path } from "effect";
+/**
+ * Serves the built client at `root`, from the same origin as the API so the session cookie applies to
+ * both. Extensionless HTML navigations fall back to `index.html`; `no-cache` makes the browser
+ * revalidate, so a rebuilt `index.html` never points at hashed assets that no longer exist.
+ */
+export declare const staticClient: (root: string) => Layer.Layer<never, import("effect/PlatformError").PlatformError, import("effect/FileSystem").FileSystem | import("effect/http/HttpPlatform").HttpPlatform | import("effect/http/HttpRouter").HttpRouter | Path.Path>;
+/**
+ * The client `vite build` writes next to the compiled server. It reads host files, so give it the
+ * host's FileSystem even where the engine runs on another one.
+ */
+export declare const StaticRouter: Layer.Layer<never, import("effect/PlatformError").BadArgument | import("effect/PlatformError").PlatformError, import("effect/FileSystem").FileSystem | import("effect/http/HttpPlatform").HttpPlatform | import("effect/http/HttpRouter").HttpRouter | Path.Path>;
+/** The authenticated API and the bootstrap exchange: everything that runs on the engine's services. */
+export declare const apiApplication: Layer.Layer<never, never, import("@knpkv/jira-clockify/services/ConfigService.js").ConfigService | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("effect/http/HttpRouter").HttpRouter | import("@knpkv/jira-clockify/services/IssueFacts.js").IssueFacts | import("@knpkv/jira-api-client").JiraApiClient | import("@knpkv/jira-cli/JiraAuth").JiraAuth | OwnerSession.OwnerSession | Path.Path | import("@knpkv/jira-clockify/services/ReconcileService.js").ReconcileService | import("effect/http/HttpRouter").Request<"Error", import("effect/http/HttpBody").HttpBodyError> | import("@knpkv/jira-clockify/services/SavedEntries.js").SavedEntries | import("@knpkv/jira-clockify/services/SessionAttributor.js").SessionAttributor>;
 /** Supply engine services and owner secrets; listener and platform belong to the executable. */
-export declare const application: Layer.Layer<never, never, import("@knpkv/jira-clockify/services/ConfigService.js").ConfigService | import("effect/Crypto").Crypto | FileSystem.FileSystem | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("@knpkv/jira-clockify/services/IssueFacts.js").IssueFacts | import("@knpkv/jira-api-client").JiraApiClient | import("@knpkv/jira-cli/JiraAuth").JiraAuth | import("./OwnerSession.js").OwnerSessionSecrets | Path.Path | import("@knpkv/jira-clockify/services/ReconcileService.js").ReconcileService | HttpRouter.Request<"Error", import("effect/PlatformError").BadArgument> | HttpRouter.Request<"Error", import("effect/http/HttpBody").HttpBodyError> | HttpRouter.Request<"Error", import("effect/PlatformError").PlatformError> | HttpRouter.Request<"Requires", FileSystem.FileSystem> | HttpRouter.Request<"Requires", import("./OwnerSession.js").OwnerSessionSecrets> | HttpRouter.Request<"Requires", Path.Path> | import("@knpkv/jira-clockify/services/SavedEntries.js").SavedEntries | import("@knpkv/jira-clockify/services/SessionAttributor.js").SessionAttributor>;
+export declare const application: Layer.Layer<never, never, import("@knpkv/jira-clockify/services/ConfigService.js").ConfigService | import("effect/Crypto").Crypto | import("effect/FileSystem").FileSystem | import("effect/http/Etag").Generator | import("effect/http/HttpPlatform").HttpPlatform | import("effect/http/HttpRouter").HttpRouter | import("@knpkv/jira-clockify/services/IssueFacts.js").IssueFacts | import("@knpkv/jira-api-client").JiraApiClient | import("@knpkv/jira-cli/JiraAuth").JiraAuth | OwnerSession.OwnerSession | Path.Path | import("@knpkv/jira-clockify/services/ReconcileService.js").ReconcileService | import("effect/http/HttpRouter").Request<"Error", import("effect/http/HttpBody").HttpBodyError> | import("@knpkv/jira-clockify/services/SavedEntries.js").SavedEntries | import("@knpkv/jira-clockify/services/SessionAttributor.js").SessionAttributor>;

package/dist/server/HttpApplication.js

@@ -1,62 +1,29 @@
 /** The same authenticated routes, bootstrap exchange and static client in production and tests. */
-import { Effect, FileSystem, Layer, Path } from "effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
+import { Effect, Layer, Path } from "effect";
+import { HttpStaticServer } from "effect/http";
 import { HttpApiBuilder } from "effect/http-api";
 import { JcfWebApi } from "./Api.js";
 import { ConfigLive, EntriesLive, RowsLive, WeekLive } from "./Handlers.js";
-import { ownerSessionAuthLayer, OwnerSessionBootstrapRouter } from "./OwnerSession.js";
+import { ownerSessionAuthLayer } from "./OwnerSession.js";
 import { layer as weekPlansLayer } from "./WeekPlans.js";
-const mimeTypes = new Map([
-    [".css", "text/css"],
-    [".html", "text/html"],
-    [".ico", "image/x-icon"],
-    [".js", "application/javascript"],
-    [".json", "application/json"],
-    [".map", "application/json"],
-    [".svg", "image/svg+xml"],
-    [".woff2", "font/woff2"]
-]);
-/** True only when `candidate` is `root` itself or one of its path-segment descendants. */
-export const isWithinDirectory = (path, root, candidate) => {
-    const relative = path.relative(root, candidate);
-    return relative === "" || (!path.isAbsolute(relative) && relative !== ".." &&
-        !relative.startsWith(`..${path.sep}`));
-};
-/** The built client, served from the same origin so the session cookie applies to both. */
-const serveStatic = Effect.gen(function* () {
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const fileSystem = yield* FileSystem.FileSystem;
+/**
+ * Serves the built client at `root`, from the same origin as the API so the session cookie applies to
+ * both. Extensionless HTML navigations fall back to `index.html`; `no-cache` makes the browser
+ * revalidate, so a rebuilt `index.html` never points at hashed assets that no longer exist.
+ */
+export const staticClient = (root) => HttpStaticServer.layer({ cacheControl: "no-cache", root, spa: true });
+/**
+ * The client `vite build` writes next to the compiled server. It reads host files, so give it the
+ * host's FileSystem even where the engine runs on another one.
+ */
+export const StaticRouter = Layer.unwrap(Effect.gen(function* () {
     const path = yield* Path.Path;
-    const requested = decodeURIComponent(new URL(request.url, "http://localhost").pathname).replace(/^\/+/u, "");
-    const here = yield* path.fromFileUrl(new URL(".", import.meta.url));
-    const staticDirectory = path.resolve(here, "../../dist/client");
-    const resolved = path.resolve(staticDirectory, requested === "" ? "index.html" : requested);
-    // A resolved path that escaped the directory is a traversal attempt, not a missing file.
-    if (!isWithinDirectory(path, staticDirectory, resolved)) {
-        return HttpServerResponse.text("Forbidden", { status: 403 });
-    }
-    if (yield* fileSystem.exists(resolved)) {
-        const info = yield* fileSystem.stat(resolved);
-        if (info.type === "File") {
-            return HttpServerResponse.uint8Array(yield* fileSystem.readFile(resolved), {
-                headers: { "content-type": mimeTypes.get(path.extname(resolved)) ?? "application/octet-stream" },
-                status: 200
-            });
-        }
-    }
-    const index = path.join(staticDirectory, "index.html");
-    if (yield* fileSystem.exists(index)) {
-        return HttpServerResponse.uint8Array(yield* fileSystem.readFile(index), {
-            headers: { "content-type": "text/html" },
-            status: 200
-        });
-    }
-    return HttpServerResponse.text("The client has not been built. Run: pnpm --filter @knpkv/jcf-web build", {
-        status: 404
-    });
-});
-const StaticRouter = HttpRouter.use((router) => router.add("GET", "/*", serveStatic));
+    return staticClient(yield* path.fromFileUrl(new URL("../../dist/client", import.meta.url)));
+}));
 const ApiRoutes = HttpApiBuilder.layer(JcfWebApi).pipe(Layer.provide(Layer.mergeAll(WeekLive, RowsLive, ConfigLive, EntriesLive)), Layer.provide(ownerSessionAuthLayer), Layer.provide(weekPlansLayer));
+/** The authenticated API and the bootstrap exchange: everything that runs on the engine's services. */
+export const apiApplication = Layer.mergeAll(ApiRoutes, OwnerSession.BootstrapRouter).pipe(Layer.orDie);
 /** Supply engine services and owner secrets; listener and platform belong to the executable. */
-export const application = Layer.mergeAll(ApiRoutes, OwnerSessionBootstrapRouter, StaticRouter).pipe(Layer.orDie);
+export const application = Layer.mergeAll(apiApplication, StaticRouter).pipe(Layer.orDie);
 //# sourceMappingURL=HttpApplication.js.map

package/dist/server/HttpApplication.js.map

@@ -1 +1 @@
-{"version":3,"file":"HttpApplication.js","sourceRoot":"","sources":["../../src/server/HttpApplication.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAA;AACtF,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAExD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,CAAC,MAAM,EAAE,UAAU,CAAC;IACpB,CAAC,OAAO,EAAE,WAAW,CAAC;IACtB,CAAC,MAAM,EAAE,cAAc,CAAC;IACxB,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACjC,CAAC,OAAO,EAAE,kBAAkB,CAAC;IAC7B,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC5B,CAAC,MAAM,EAAE,eAAe,CAAC;IACzB,CAAC,QAAQ,EAAE,YAAY,CAAC;CACzB,CAAC,CAAA;AAEF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAe,EAAE,IAAY,EAAE,SAAiB,EAAW,EAAE;IAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC/C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI;QACxE,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAC1C,CAAC,CAAA;AAED,2FAA2F;AAC3F,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAE7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IAC5G,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACnE,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE3F,yFAAyF;IACzF,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACzE,OAAO,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,0BAA0B,EAAE;gBAChG,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;IACtD,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACtE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;YACxC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,wEAAwE,EAAE;QACvG,MAAM,EAAE,GAAG;KACZ,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;AAErF,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CACpD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,EAC1E,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAC9B,CAAA;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,2BAA2B,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA"}
+{"version":3,"file":"HttpApplication.js","sourceRoot":"","sources":["../../src/server/HttpApplication.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AAEnH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAC,CAAC,CAAA;AAEH,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CACpD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,EAC1E,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAC9B,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AAEvG,gGAAgG;AAChG,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA"}

package/dist/server/OwnerSession.d.ts

@@ -1,62 +1,17 @@
-import type { CsrfToken, PairingCode, SessionToken } from "@knpkv/browser-pairing/schema";
-import { Context, Effect, Layer, Redacted, Ref, Schema } from "effect";
-import { HttpRouter } from "effect/http";
-import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "./Api.js";
-export interface BootstrapAttemptState {
-    readonly failedAttempts: number;
-    readonly inFlight: number;
-}
-export interface OwnerSessionSecretsContract {
-    /** The origin this server considers itself to be. A request's Host header is never authoritative. */
-    readonly authorityOrigin: string;
-    /**
-     * The origin the browser is expected to present. Same as the authority in production; the Vite
-     * dev server when it proxies in front of it, because that is the origin the page runs on.
-     */
-    readonly browserOrigin: string;
-    readonly bootstrapAvailable: Ref.Ref<boolean>;
-    readonly bootstrapAttemptState: Ref.Ref<BootstrapAttemptState>;
-    readonly bootstrapExpiresAtMillis: Ref.Ref<number | undefined>;
-    readonly bootstrapToken: Redacted.Redacted<PairingCode>;
-    readonly csrfToken: Redacted.Redacted<CsrfToken>;
-    readonly ownerToken: Redacted.Redacted<SessionToken>;
-}
-declare const OwnerSessionSecrets_base: Context.ServiceClass<OwnerSessionSecrets, "@knpkv/jcf-web/OwnerSessionSecrets", OwnerSessionSecretsContract>;
-export declare class OwnerSessionSecrets extends OwnerSessionSecrets_base {
-}
-declare const UnsafeServerOriginError_base: Schema.Class<UnsafeServerOriginError, Schema.TaggedStruct<"UnsafeServerOriginError", {
-    readonly message: Schema.String;
-    readonly origin: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-export declare class UnsafeServerOriginError extends UnsafeServerOriginError_base {
-}
-export declare const isLoopbackHostname: (hostname: string) => boolean;
-export declare const ownerSessionOrigin: (hostname: string, port: number) => string;
-export declare const requireLoopbackOrigin: (origin: string) => Effect.Effect<string, UnsafeServerOriginError, never>;
-/** The advertised origin: the bound server, or the dev server that proxies to it. */
-export declare const resolvePublicOrigin: (configuredOrigin: string | undefined, authorityOrigin: string) => Effect.Effect<string, UnsafeServerOriginError, never>;
-export declare const makeOwnerSessionSecrets: (authorityOrigin: string, configuredPublicOrigin?: string | undefined) => Effect.Effect<OwnerSessionSecretsContract, import("@knpkv/browser-pairing").BrowserPairingError | UnsafeServerOriginError, import("effect/Crypto").Crypto>;
-/** Start the bootstrap clock. Called once the server is actually listening, never before. */
-export declare const activateOwnerSessionBootstrap: (secrets: OwnerSessionSecretsContract) => Effect.Effect<void, import("@knpkv/browser-pairing").BrowserPairingError, never>;
 /**
- * The URL to open. The code rides in the fragment, which browsers do not send to servers and
- * proxies do not log, and the page strips it from the address bar once it has been spent.
+ * jcf-web's Owner Session: the shared `@knpkv/browser-pairing/owner-session` policy, with writes.
+ *
+ * The page saves timesheet entries, so writes need the CSRF token the bootstrap exchange returns. The
+ * Vite dev server keeps its own Origin when it proxies, so the configured public origin is also the
+ * origin every browser request is checked against: the URL that gets printed cannot be advertised and
+ * then rejected.
+ *
+ * @module
  */
-export declare const ownerSessionUrl: (publicOrigin: string, secrets: Pick<OwnerSessionSecretsContract, "bootstrapToken">) => string;
-export declare const ownerSessionCookie: (secrets: Pick<OwnerSessionSecretsContract, "ownerToken">) => string;
-interface OwnerRequest {
-    readonly credential: string;
-    readonly csrfToken: string | undefined;
-    readonly fetchSite: string | undefined;
-    readonly method: string;
-    readonly origin: string | undefined;
-}
-export declare const authorizeOwnerRequest: (request: OwnerRequest, secrets: OwnerSessionSecretsContract) => Effect.Effect<undefined, ForbiddenApiError | UnauthorizedApiError, never>;
-export declare const authorizeBootstrapRequest: (request: {
-    readonly authorization: string | undefined;
-    readonly origin: string | undefined;
-}, secrets: OwnerSessionSecretsContract) => Effect.Effect<undefined, ForbiddenApiError | UnauthorizedApiError, never>;
-export declare const ownerSessionAuthLayer: Layer.Layer<OwnerSessionAuth, never, OwnerSessionSecrets>;
-/** The one route outside the authenticated API: spending the printed code for a session. */
-export declare const OwnerSessionBootstrapRouter: Layer.Layer<never, never, HttpRouter.HttpRouter | HttpRouter.Request<"Error", import("effect/http/HttpBody").HttpBodyError> | HttpRouter.Request<"Requires", OwnerSessionSecrets>>;
-export {};
+import type { BrowserPairingError, CredentialCookieError } from "@knpkv/browser-pairing";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
+import { type Crypto, Effect, Layer } from "effect";
+import { OwnerSessionAuth } from "./Api.js";
+/** Build the session for a server bound at `authorityOrigin`, advertised at `configuredPublicOrigin`. */
+export declare const makeOwnerSession: (authorityOrigin: string, configuredPublicOrigin?: string | undefined) => Effect.Effect<OwnerSession.OwnerSessionService, BrowserPairingError | CredentialCookieError | OwnerSession.UnsafeLoopbackAddressError, Crypto.Crypto>;
+export declare const ownerSessionAuthLayer: Layer.Layer<OwnerSessionAuth, never, OwnerSession.OwnerSession>;