@shivaedev/server 0.2.0 → 0.3.1

package/src/AppHostInput.ts

@@ -2,6 +2,7 @@ import type { Effect, Layer } from "effect";
 import type { Rpc } from "effect/rpc";
 import type { SessionShape } from "@shivaedev/identity/server/session.ts";
 import type { AppDatabaseOptions, AppHostOptions, AppHttpHostOptions, AppLocalHostOptions } from "#appHost.ts";
+import type { HostRouteRequirements } from "#hostOptions.ts";
 
 export type HostPreflight<TServices = never, TError = never, TRequirements = never> =
 	| { readonly preflight: Layer.Layer<TServices, TError, TRequirements> }
@@ -22,11 +23,27 @@ export type AppHostInput<
 	TPreflight = never,
 	TPreflightError = never,
 	TPreflightRequirements = never,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 > = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
 	(
 		| (AppDatabaseOptions<TMigrations> & {
 				readonly application: Effect.Effect<
-					AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+					AppHttpHostOptions<
+						TRpcs,
+						THandlers,
+						THandlerError,
+						THandlerRequirements,
+						TServices,
+						TServiceError,
+						TServiceRequirements,
+						TSession,
+						never,
+						never,
+						never,
+						TRouteError,
+						TRouteRequirements
+					>,
 					TApplicationError,
 					TApplicationRequirements
 				>;
@@ -43,7 +60,9 @@ export type AppHostInput<
 				TSession,
 				TPreflight,
 				TPreflightError,
-				TPreflightRequirements
+				TPreflightRequirements,
+				TRouteError,
+				TRouteRequirements
 		  >
 		| AppLocalHostOptions<
 				TRpcs,
@@ -56,7 +75,9 @@ export type AppHostInput<
 				TMigrations,
 				TPreflight,
 				TPreflightError,
-				TPreflightRequirements
+				TPreflightRequirements,
+				TRouteError,
+				TRouteRequirements
 		  >
 		| AppHttpHostOptions<
 				TRpcs,
@@ -69,6 +90,8 @@ export type AppHostInput<
 				TSession,
 				TPreflight,
 				TPreflightError,
-				TPreflightRequirements
+				TPreflightRequirements,
+				TRouteError,
+				TRouteRequirements
 		  >
 	);

package/src/appHost.ts

@@ -1,3 +1,4 @@
+import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
 import { Context, type Effect, Layer } from "effect";
 import type { Rpc } from "effect/rpc";
 import type { makeLiveServer } from "@shivaedev/contract/makeLiveServer.ts";
@@ -6,7 +7,7 @@ import type { AppHostFactory } from "#AppHostFactory.ts";
 import type { AppHostInput, HostPreflight } from "#AppHostInput.ts";
 import { appHostHttp, deferredHost, migratedHost } from "#appHostHttp.ts";
 import { type DatabaseConfig, databaseLayer } from "#databaseLayer.ts";
-import type { HostOptions, HostPolicy } from "#hostOptions.ts";
+import type { HostCoreOptions, HostPolicy, HostRouteRequirements, HostRoutes } from "#hostOptions.ts";
 import type { MigrationOptions } from "#MigrationOptions.ts";
 
 export class AppChanges extends Context.Service<AppChanges, Effect.Success<typeof makeLiveServer>>()("@shivaedev/server/AppChanges") {}
@@ -32,8 +33,11 @@ export type AppHostOptions<
 	TPreflight = never,
 	TPreflightError = never,
 	TPreflightRequirements = never,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 > = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
-	HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & {
+	HostCoreOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
+	HostRoutes<TRouteError, TRouteRequirements> & {
 		readonly migrations: AppDatabaseOptions<TMigrations>["migrations"];
 		readonly policy?: undefined;
 		readonly sessions: SessionPolicy<TSession>;
@@ -51,8 +55,11 @@ export type AppLocalHostOptions<
 	TPreflight = never,
 	TPreflightError = never,
 	TPreflightRequirements = never,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 > = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
-	HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & {
+	HostCoreOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
+	HostRoutes<TRouteError, TRouteRequirements> & {
 		readonly migrations: AppDatabaseOptions<TMigrations>["migrations"];
 		readonly policy: "loopback";
 		readonly sessions?: never;
@@ -70,8 +77,11 @@ export type AppHttpHostOptions<
 	TPreflight = never,
 	TPreflightError = never,
 	TPreflightRequirements = never,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 > = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
-	HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
+	HostCoreOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
+	HostRoutes<TRouteError, TRouteRequirements> &
 	HostPolicy<TSession> & { readonly migrations?: undefined };
 export const appHost: AppHostFactory = <
 	TRpcs extends Rpc.Any,
@@ -88,6 +98,8 @@ export const appHost: AppHostFactory = <
 	TPreflight = never,
 	TPreflightError = never,
 	TPreflightRequirements = never,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 >(
 	options: AppHostInput<
 		TRpcs,
@@ -103,15 +115,21 @@ export const appHost: AppHostFactory = <
 		TApplicationRequirements,
 		TPreflight,
 		TPreflightError,
-		TPreflightRequirements
+		TPreflightRequirements,
+		TRouteError,
+		TRouteRequirements
 	>,
 ) => {
 	if ("application" in options) {
-		return deferredHost(options.application, appDatabase(options), AppChanges).pipe(Layer.provideMerge(options.preflight ?? Layer.empty));
+		return deferredHost(options.application, appDatabase(options), AppChanges).pipe(
+			Layer.provideMerge(options.preflight ?? Layer.empty),
+			Layer.provide(NodeCrypto.layer),
+		);
 	}
 	return options.migrations === undefined
-		? appHostHttp(options, AppChanges).pipe(Layer.provideMerge(options.preflight ?? Layer.empty))
+		? appHostHttp(options, AppChanges).pipe(Layer.provideMerge(options.preflight ?? Layer.empty), Layer.provide(NodeCrypto.layer))
 		: migratedHost({ ...options, migrations: options.migrations }, appDatabase({ ...options, migrations: options.migrations }), AppChanges).pipe(
 				Layer.provideMerge(options.preflight ?? Layer.empty),
+				Layer.provide(NodeCrypto.layer),
 			);
 };

package/src/appHostHttp.ts

@@ -1,30 +1,22 @@
-import { createServer } from "node:http";
-import { NodeHttpServer, NodeServices } from "@effect/platform-node";
-import { ByteSize, Config, Effect, Layer } from "effect";
-import { HttpEffect, HttpIncomingMessage, HttpRouter, HttpServerRequest, HttpServerResponse, HttpStaticServer } from "effect/http";
-import { type Rpc, RpcSerialization, RpcServer } from "effect/rpc";
-import type { Authenticated, MaybeAuthenticated, RequestTracing } from "@shivaedev/identity/middleware.ts";
-import { localRpcGuard } from "@shivaedev/identity/server/local.ts";
-import { authenticatedLayer, maybeAuthenticatedLayer, type SessionShape } from "@shivaedev/identity/server/session.ts";
-import { requestTracingLayer } from "@shivaedev/identity/server/tracing.ts";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { Effect, Layer } from "effect";
+import { HttpRouter, HttpServer, HttpStaticServer } from "effect/http";
+import type { Rpc } from "effect/rpc";
+import type { SessionShape } from "@shivaedev/identity/server/session.ts";
 import type { AppChanges, AppHttpHostOptions } from "#appHost.ts";
-import { boundedRpcRequest } from "#boundedRpcRequest.ts";
 import type { databaseLayer } from "#databaseLayer.ts";
 import { healthRoute } from "#healthRoute.ts";
-import { hostChanges } from "#hostChanges.ts";
-import type { HostOptions, HostPolicy } from "#hostOptions.ts";
+import { hostApplicationRoutes } from "#hostApplicationRoutes.ts";
+import type { HostOptions, HostPolicy, HostRouteRequirements } from "#hostOptions.ts";
+import { hostRpcRoutes } from "#hostRpcRoutes.ts";
 import { hostTransport } from "#hostTransport.ts";
 import type { MigrationOptions } from "#MigrationOptions.ts";
 import { nativeClientOrigins } from "#nativeClientOrigins.ts";
+import { nodeHttpServer } from "#nodeHttpServer.ts";
 import { otlpTracing } from "#otlpTracing.ts";
 import { RedactionPolicy } from "#RedactionPolicy.ts";
 import { redactingDiagnostics } from "#redactingDiagnostics.ts";
-import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
 import { schemaSensitiveKeys } from "#schemaSensitiveKeys.ts";
-import { tracedGroup } from "#tracedGroup.ts";
-
-const rpcCacheControl: HttpEffect.PreResponseHandler = (_, response) =>
-	Effect.succeed(HttpServerResponse.setHeader(response, "cache-control", "private, no-store"));
 
 export function appHostHttp<
 	TRpcs extends Rpc.Any,
@@ -35,71 +27,45 @@ export function appHostHttp<
 	TServiceError,
 	TServiceRequirements,
 	TSession extends SessionShape,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 >(
-	options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & HostPolicy<TSession>,
+	options: HostOptions<
+		TRpcs,
+		THandlers,
+		THandlerError,
+		THandlerRequirements,
+		TServices,
+		TServiceError,
+		TServiceRequirements,
+		TRouteError,
+		TRouteRequirements
+	> &
+		HostPolicy<TSession>,
 	changesService: typeof AppChanges,
 ) {
 	const sensitive = schemaSensitiveKeys(options.group, options.config?.sensitiveKeys);
 	return Layer.unwrap(
 		Effect.gen(function* () {
-			const { bodySize, host, trustedProxy, nativeOrigins } = yield* hostTransport(options);
-			const middleware: Layer.Layer<RequestTracing> | Layer.Layer<Authenticated | MaybeAuthenticated | RequestTracing> =
-				options.policy === "loopback"
-					? requestTracingLayer({ sensitive })
-					: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer({ sensitive }));
-			const routes = HttpRouter.use((router) =>
-				Effect.gen(function* () {
-					const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
-					const handler = yield* RpcServer.toHttpEffect(tracedGroup(options.group)).pipe(
-						Effect.provideService(RpcSerialization.RpcSerialization, wire),
-					);
-					const guarded = localRpcGuard(handler, trustedProxy, nativeOrigins);
-					if (nativeOrigins.length > 0) {
-						yield* router.add("OPTIONS", options.rpcPath ?? "/rpc", HttpServerResponse.text("Local same-origin requests only", { status: 403 }));
-					}
-					yield* router.add("POST", options.rpcPath ?? "/rpc", (request) => {
-						HttpEffect.appendPreResponseHandlerUnsafe(request, rpcCacheControl);
-						return guarded.pipe(
-							Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize)),
-							Effect.provideService(HttpServerRequest.HttpServerRequest, boundedRpcRequest(request)),
-							Effect.provideService(RpcSerialization.RpcSerialization, wire),
-						);
-					});
-				}),
-			).pipe(
-				Layer.provide(Layer.merge(middleware, hostChanges(options.group, changesService).pipe(Layer.provideMerge(options.handlers)))),
-				Layer.provide(RpcSerialization.layerNdjson),
-				Layer.provide(nativeClientOrigins(nativeOrigins, trustedProxy)),
-			);
+			const transport = yield* hostTransport(options);
+			const { bodySize, host, trustedProxy, nativeOrigins } = transport;
+			const routes = hostRpcRoutes(options, changesService, transport, sensitive);
 			const assets =
 				options.assets === undefined
 					? Layer.empty
 					: HttpStaticServer.layer(typeof options.assets === "string" ? { root: options.assets } : options.assets);
 			const application = Layer.mergeAll(options.services ?? Layer.empty);
-			const server = Layer.unwrap(
-				Effect.gen(function* () {
-					const port = options.config?.port ?? (yield* Config.Int("PORT").pipe(Config.withDefault(3000)));
-					return NodeHttpServer.layer(createServer, {
-						gracefulShutdownTimeout: options.config?.gracefulShutdownTimeout,
-						host,
-						port,
-						...(options.config?.disablePreemptiveShutdown === undefined
-							? {}
-							: { disablePreemptiveShutdown: options.config.disablePreemptiveShutdown }),
-					});
-				}),
+			const server = nodeHttpServer(host, options.config);
+			const applicationRoutes = hostApplicationRoutes(options.routes, bodySize);
+			const httpRoutes = Layer.mergeAll(routes, healthRoute, assets, applicationRoutes).pipe(
+				Layer.provide(nativeClientOrigins(nativeOrigins, trustedProxy, false, options.rpcPath)),
+				Layer.provide(nativeClientOrigins(nativeOrigins, trustedProxy, options.nativeOrigins === undefined ? "preflight" : true)),
 			);
-			const applicationRoutes = (options.routes ?? Layer.empty).pipe(
-				Layer.provide(
-					HttpRouter.middleware((effect) => Effect.provideService(effect, HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize))).layer,
+			return Layer.unwrap(
+				HttpRouter.toHttpEffect(httpRoutes).pipe(
+					Effect.map((handler) => HttpServer.serve(handler).pipe(HttpServer.withLogAddress, Layer.provideMerge(server))),
 				),
-				Layer.provide(options.nativeOrigins === undefined ? Layer.empty : nativeClientOrigins(nativeOrigins, trustedProxy, true)),
-			);
-			return HttpRouter.serve(Layer.mergeAll(routes, healthRoute, assets, applicationRoutes), { disableLogger: true }).pipe(
-				Layer.provideMerge(application),
-				Layer.provideMerge(server),
-				Layer.provide(NodeServices.layer),
-			);
+			).pipe(Layer.provideMerge(application), Layer.provideMerge(NodeHttpServer.layerHttpServices));
 		}),
 	).pipe(Layer.provide(redactingDiagnostics(sensitive)), Layer.provide(otlpTracing), Layer.provide(Layer.succeed(RedactionPolicy, sensitive)));
 }
@@ -114,9 +80,23 @@ export function migratedHost<
 	TServiceRequirements,
 	TMigrations,
 	TSession extends SessionShape,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 >(
-	options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
-		HostPolicy<TSession> & { readonly migrations: MigrationOptions<TMigrations> },
+	options: HostOptions<
+		TRpcs,
+		THandlers,
+		THandlerError,
+		THandlerRequirements,
+		TServices,
+		TServiceError,
+		TServiceRequirements,
+		TRouteError,
+		TRouteRequirements
+	> &
+		HostPolicy<TSession> & {
+			readonly migrations: MigrationOptions<TMigrations>;
+		},
 	database: ReturnType<typeof databaseLayer<TMigrations>>,
 	changesService: typeof AppChanges,
 ) {
@@ -136,9 +116,25 @@ export function deferredHost<
 	TSession extends SessionShape,
 	TApplicationError,
 	TApplicationRequirements,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
 >(
 	application: Effect.Effect<
-		AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+		AppHttpHostOptions<
+			TRpcs,
+			THandlers,
+			THandlerError,
+			THandlerRequirements,
+			TServices,
+			TServiceError,
+			TServiceRequirements,
+			TSession,
+			never,
+			never,
+			never,
+			TRouteError,
+			TRouteRequirements
+		>,
 		TApplicationError,
 		TApplicationRequirements
 	>,

package/src/development.ts

@@ -1,5 +1,6 @@
 import process from "node:process";
-import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import * as NodeServices from "@effect/platform-node/NodeServices";
 import { Effect } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 

package/src/healthRoute.ts

@@ -1,5 +1,6 @@
 import { Effect, Fiber, Option } from "effect";
 import { HttpRouter, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import { SqlClient } from "effect/sql";
 
 export const healthRoute = HttpRouter.use((router) =>
@@ -8,14 +9,14 @@ export const healthRoute = HttpRouter.use((router) =>
 		const scope = yield* Effect.scope;
 		const probe = Effect.gen(function* () {
 			if (Option.isNone(database)) {
-				return 503;
+				return HttpStatus.fromLiteral("ServiceUnavailable");
 			}
 			const query = yield* database.value`select 1`.pipe(Effect.forkIn(scope));
 			return yield* Fiber.join(query).pipe(
 				Effect.timeout("2 seconds"),
 				// Driver cancellation may need network I/O; keep cleanup in the host scope without delaying the response.
 				Effect.ensuring(Fiber.interrupt(query).pipe(Effect.forkIn(scope), Effect.asVoid)),
-				Effect.match({ onFailure: () => 503, onSuccess: () => 200 }),
+				Effect.match({ onFailure: () => HttpStatus.fromLiteral("ServiceUnavailable"), onSuccess: () => HttpStatus.fromLiteral("OK") }),
 			);
 		});
 		yield* router.add(

package/src/hostApplicationRoutes.ts

@@ -0,0 +1,8 @@
+import { ByteSize, Effect, Layer } from "effect";
+import { HttpIncomingMessage, HttpRouter } from "effect/http";
+
+export function hostApplicationRoutes<TError, TRequirements>(routes: Layer.Layer<never, TError, TRequirements> | undefined, bodySize: number) {
+	return (routes ?? Layer.empty).pipe(
+		Layer.provide(HttpRouter.middleware((effect) => Effect.provideService(effect, HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize))).layer),
+	);
+}

package/src/hostChanges.ts

@@ -21,8 +21,8 @@ export function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, chan
 				}
 				function handler({ queries }: { readonly queries: readonly QueryReference[] }) {
 					return Stream.unwrap(
-						Effect.map(resolveChanges(rpc, queries), ({ keys, context }) =>
-							Option.isSome(changes) ? changes.value.stream(keys, context) : Stream.never,
+						Effect.map(resolveChanges(rpc, queries), ({ subscription, context }) =>
+							Option.isSome(changes) ? changes.value.subscribe(subscription, context) : Stream.never,
 						),
 					);
 				}

package/src/hostOptions.ts

@@ -4,7 +4,9 @@ import type { Rpc, RpcGroup } from "effect/rpc";
 import type { SessionPolicy, SessionShape } from "@shivaedev/identity/server/session.ts";
 import type { AppDatabaseOptions } from "./appHost.ts";
 
-export type HostOptions<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> = {
+export type HostRouteRequirements = HttpRouter.HttpRouter | HttpRouter.Request<"Error", unknown>;
+
+export type HostCoreOptions<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> = {
 	readonly assets?: string | Parameters<typeof HttpStaticServer.layer>[0];
 	readonly config?: AppDatabaseOptions["config"] & {
 		readonly port?: number;
@@ -18,13 +20,29 @@ export type HostOptions<TRpcs extends Rpc.Any, THandlers, THandlerError, THandle
 	readonly group: RpcGroup.RpcGroup<TRpcs>;
 	readonly handlers: Layer.Layer<THandlers, THandlerError, THandlerRequirements>;
 	readonly nativeOrigins?: readonly string[];
-	readonly routes?: Layer.Layer<never, never, HttpRouter.HttpRouter | HttpRouter.Request<"Error", unknown>>;
 	readonly rpcPath?: HttpRouter.PathInput;
 } & (
 	| { readonly services: Layer.Layer<TServices, TServiceError, TServiceRequirements> }
 	| ([TServices | TServiceError | TServiceRequirements] extends [never] ? { readonly services?: never } : never)
 );
 
+export interface HostRoutes<TRouteError = never, TRouteRequirements = HostRouteRequirements> {
+	readonly routes?: Layer.Layer<never, TRouteError, TRouteRequirements>;
+}
+
+export type HostOptions<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices,
+	TServiceError,
+	TServiceRequirements,
+	TRouteError = never,
+	TRouteRequirements = HostRouteRequirements,
+> = HostCoreOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
+	HostRoutes<TRouteError, TRouteRequirements>;
+
 export type HostPolicy<TSession extends SessionShape> =
 	| { readonly policy?: undefined; readonly sessions: SessionPolicy<TSession> }
 	| { readonly policy: "loopback"; readonly sessions?: never };

package/src/hostRpc.ts

@@ -0,0 +1,26 @@
+import { Effect, Schema } from "effect";
+import { type HttpEffect, HttpServerResponse } from "effect/http";
+import { type Rpc, type RpcGroup, RpcMiddleware, RpcServer } from "effect/rpc";
+import { authorizeReads, CurrentViewer } from "@shivaedev/contract/readPolicy.ts";
+import { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
+import { tracedGroup } from "#tracedGroup.ts";
+
+class HostedReadPolicy extends RpcMiddleware.Service<HostedReadPolicy>()("@shivaedev/server/HostedReadPolicy", {
+	error: Schema.Union([MissingReadPolicy, QueryReadDenied]),
+}) {}
+
+export type { HostedReadPolicy };
+
+export const rpcCacheControl: HttpEffect.PreResponseHandler = (_, response) =>
+	Effect.succeed(HttpServerResponse.setHeader(response, "cache-control", "private, no-store"));
+
+export const hostRpc = Effect.fnUntraced(function* <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>) {
+	const guarded = group.middleware(HostedReadPolicy);
+	// Keep the policy inside identity middleware so it sees the request's viewer.
+	for (const rpc of guarded.requests.values()) {
+		Object.assign(rpc, { middlewares: new Set([HostedReadPolicy, ...rpc.middlewares]) });
+	}
+	return yield* RpcServer.toHttpEffect(tracedGroup(guarded)).pipe(
+		Effect.provideService(HostedReadPolicy, (effect, request) => Effect.flatMap(CurrentViewer, (viewer) => authorizeReads(effect, request, viewer))),
+	);
+});

package/src/hostRpcRoutes.ts

@@ -0,0 +1,57 @@
+import { ByteSize, Effect, Layer } from "effect";
+import { HttpEffect, HttpIncomingMessage, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
+import { type Rpc, type RpcGroup, RpcSerialization } from "effect/rpc";
+import type { Authenticated, MaybeAuthenticated, RequestTracing } from "@shivaedev/identity/middleware.ts";
+import { localRpcGuard } from "@shivaedev/identity/server/local.ts";
+import { authenticatedLayer, maybeAuthenticatedLayer, type SessionShape } from "@shivaedev/identity/server/session.ts";
+import { requestTracingLayer } from "@shivaedev/identity/server/tracing.ts";
+import type { AppChanges } from "#appHost.ts";
+import { boundedRpcRequest } from "#boundedRpcRequest.ts";
+import { hostChanges } from "#hostChanges.ts";
+import type { HostPolicy } from "#hostOptions.ts";
+import { hostRpc, rpcCacheControl } from "#hostRpc.ts";
+import type { hostTransport } from "#hostTransport.ts";
+import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
+import type { schemaSensitiveKeys } from "#schemaSensitiveKeys.ts";
+
+export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequirements, TSession extends SessionShape>(
+	options: {
+		readonly group: RpcGroup.RpcGroup<TRpcs>;
+		readonly handlers: Layer.Layer<THandlers, TError, TRequirements>;
+		readonly rpcPath?: HttpRouter.PathInput;
+	} & HostPolicy<TSession>,
+	changesService: typeof AppChanges,
+	{ bodySize, trustedProxy, nativeOrigins }: Effect.Success<ReturnType<typeof hostTransport>>,
+	sensitive: ReturnType<typeof schemaSensitiveKeys>,
+) {
+	const middleware: Layer.Layer<RequestTracing> | Layer.Layer<Authenticated | MaybeAuthenticated | RequestTracing> =
+		options.policy === "loopback"
+			? requestTracingLayer({ sensitive })
+			: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer({ sensitive }));
+	return HttpRouter.use((router) =>
+		Effect.gen(function* () {
+			const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
+			const handler = yield* hostRpc(options.group).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
+			const guarded = localRpcGuard(handler, trustedProxy, nativeOrigins);
+			yield* router.add(
+				"OPTIONS",
+				options.rpcPath ?? "/rpc",
+				HttpServerResponse.text("Local same-origin requests only", {
+					status: HttpStatus.fromLiteral("Forbidden"),
+				}),
+			);
+			yield* router.add("POST", options.rpcPath ?? "/rpc", (request) => {
+				HttpEffect.appendPreResponseHandlerUnsafe(request, rpcCacheControl);
+				return guarded.pipe(
+					Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize)),
+					Effect.provideService(HttpServerRequest.HttpServerRequest, boundedRpcRequest(request)),
+					Effect.provideService(RpcSerialization.RpcSerialization, wire),
+				);
+			});
+		}),
+	).pipe(
+		Layer.provide(Layer.merge(middleware, hostChanges(options.group, changesService).pipe(Layer.provideMerge(options.handlers)))),
+		Layer.provide(RpcSerialization.layerNdjson),
+	);
+}

package/src/nativeClientOrigins.ts

@@ -1,5 +1,6 @@
 import { Effect, Schema } from "effect";
 import { Headers, HttpMiddleware, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import { localTransport } from "@shivaedev/identity/server/local.ts";
 
 export const NativeOrigins = Schema.Array(
@@ -16,7 +17,13 @@ export const NativeOrigins = Schema.Array(
 	),
 );
 
-export function nativeClientOrigins(origins: readonly string[], trustedProxy: string | undefined, auth = false) {
+export function nativeClientOrigins(
+	origins: readonly string[],
+	trustedProxy: string | undefined,
+	auth: boolean | "preflight" = false,
+	rpcPath: HttpRouter.PathInput = "/rpc",
+) {
+	const matchesPath = auth ? (path: string) => path === "/api/auth" || path.startsWith("/api/auth/") : (path: string) => path === rpcPath;
 	const allowed = localTransport(trustedProxy, origins);
 	const cors = HttpMiddleware.cors({
 		allowedHeaders: ["Authorization", "Content-Type"],
@@ -28,16 +35,20 @@ export function nativeClientOrigins(origins: readonly string[], trustedProxy: st
 	return HttpRouter.middleware((effect) =>
 		Effect.gen(function* () {
 			const request = yield* HttpServerRequest.HttpServerRequest;
-			if (auth && !request.url.split("?")[0]?.startsWith("/api/auth/")) {
+			if (!matchesPath(request.url.split("?")[0] ?? "")) {
 				return yield* effect;
 			}
-			if ((auth || request.method === "OPTIONS") && !allowed(request)) {
-				return HttpServerResponse.text("Local same-origin requests only", { status: 403 });
+			if ((auth === true || request.method === "OPTIONS") && !allowed(request)) {
+				return HttpServerResponse.text("Local same-origin requests only", {
+					status: HttpStatus.fromLiteral("Forbidden"),
+				});
 			}
 			if (!origins.includes(request.headers.origin ?? "")) {
 				return yield* effect;
 			}
-			const native = request.modify({ headers: Headers.remove(request.headers, "cookie") });
+			const native = request.modify({
+				headers: Headers.remove(request.headers, "cookie"),
+			});
 			return yield* cors(effect).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, native));
 		}),
 	).layer;

package/src/nodeHttpServer.ts

@@ -0,0 +1,24 @@
+import { createServer } from "node:http";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { Config, type Duration, Effect, Layer } from "effect";
+
+export function nodeHttpServer(
+	host: string,
+	config?: {
+		readonly port?: number;
+		readonly gracefulShutdownTimeout?: Duration.Input;
+		readonly disablePreemptiveShutdown?: boolean;
+	},
+) {
+	return Layer.unwrap(
+		Effect.gen(function* () {
+			const port = config?.port ?? (yield* Config.Int("PORT").pipe(Config.withDefault(3000)));
+			return NodeHttpServer.layer(createServer, {
+				gracefulShutdownTimeout: config?.gracefulShutdownTimeout,
+				host,
+				port,
+				...(config?.disablePreemptiveShutdown === undefined ? {} : { disablePreemptiveShutdown: config.disablePreemptiveShutdown }),
+			});
+		}),
+	);
+}

package/src/otlpHttpClient.ts

@@ -1,5 +1,6 @@
 import { Effect, Layer } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientError, type HttpClientRequest } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import { RedactionPolicy } from "#RedactionPolicy.ts";
 import { redactOtlpText } from "#safeOtlpSerialization.ts";
 
@@ -36,7 +37,7 @@ export function otlpHttpClient(timeout = 10_000) {
 					),
 				),
 				HttpClient.tap((response) => {
-					if (response.status >= 200 && response.status < 300) {
+					if (response.status >= HttpStatus.fromLiteral("OK") && response.status < HttpStatus.fromLiteral("MultipleChoices")) {
 						warned = false;
 						return Effect.void;
 					}