@smthrs/control 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/WebCryptoCipher.js

@@ -0,0 +1,123 @@
+/**
+ * AES-256-GCM credential encryption over the Web Crypto API.
+ *
+ * One adapter serves both hosts the project supports: `globalThis.crypto.subtle`
+ * is the browser's own API and has been Node's since v19, so this module
+ * imports nothing from `node:*` and still runs unmodified on the server. A host
+ * without Web Crypto, such as an old runtime or a locked-down worker, fails
+ * with the typed `Unavailable`, never a defect. A key that is not 32
+ * base64-encoded bytes fails with `InvalidInput`. A record that does not open
+ * fails with `PersistenceError` on operation `credential.open`, which names
+ * whether the stored nonce was malformed or the ciphertext failed
+ * authentication (a different key, changed metadata, or tampered bytes).
+ *
+ * The key is host-managed and supplied at layer construction. It is held as a
+ * non-extractable `CryptoKey`, so it cannot be read back out of the cipher, and
+ * it never reaches `CredentialStore`.
+ *
+ * @since 0.1.0
+ */
+import { canonicalize } from "@smthrs/canonical";
+import { Effect, Layer, Redacted } from "effect";
+import { InvalidInput, PersistenceError } from "./ControlError.js";
+import * as CredentialCipher from "./CredentialCipher.js";
+const algorithm = "AES-GCM";
+const nonceBytes = 12;
+const contextFormatVersion = 1;
+const toBase64 = (bytes) => {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+};
+const fromBase64 = (value) => {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index++)
+        bytes[index] = binary.charCodeAt(index);
+    return bytes;
+};
+const subtle = () => Effect.suspend(() => {
+    const available = globalThis.crypto;
+    return available?.subtle === undefined
+        ? Effect.fail(CredentialCipher.unavailable())
+        : Effect.succeed(available.subtle);
+});
+const randomNonce = () => Effect.suspend(() => {
+    const available = globalThis.crypto;
+    return available?.getRandomValues === undefined
+        ? Effect.fail(CredentialCipher.unavailable())
+        : Effect.succeed(available.getRandomValues(new Uint8Array(nonceBytes)));
+});
+const encodeContext = (context) => Effect.try({
+    try: () => {
+        // Canonical JSON names and escapes each field, so embedded delimiters
+        // cannot make two metadata tuples authenticate as the same bytes. The
+        // explicit format version makes a future byte contract distinguishable.
+        const document = canonicalize({
+            formatVersion: contextFormatVersion,
+            id: context.id,
+            name: context.name,
+            version: context.version
+        });
+        return new TextEncoder().encode(document);
+    },
+    catch: CredentialCipher.unavailable
+});
+const invalidKey = () => new InvalidInput({ issue: "Credential key must be 32 base64-encoded bytes" });
+const unopenable = (reason, cause) => new PersistenceError({
+    operation: "credential.open",
+    message: reason === "malformed_nonce"
+        ? "Stored credential nonce is malformed"
+        : "Credential failed authentication: a different key, changed metadata, or tampered ciphertext",
+    cause
+});
+/**
+ * Imports the host key and constructs the cipher.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const make = (options) => Effect.gen(function* () {
+    const crypto = yield* subtle();
+    const raw = yield* Effect.try({
+        try: () => fromBase64(Redacted.value(options.key)),
+        catch: invalidKey
+    });
+    if (raw.length !== 32)
+        return yield* Effect.fail(invalidKey());
+    const key = yield* Effect.tryPromise({
+        try: () => crypto.importKey("raw", raw, algorithm, false, ["encrypt", "decrypt"]),
+        catch: CredentialCipher.unavailable
+    });
+    return CredentialCipher.make({
+        seal: Effect.fn("WebCryptoCipher.seal")(function* (plaintext, context) {
+            const additionalData = yield* encodeContext(context);
+            const nonce = yield* randomNonce();
+            const ciphertext = yield* Effect.tryPromise({
+                try: () => crypto.encrypt({ name: algorithm, iv: nonce, additionalData: additionalData }, key, new TextEncoder().encode(Redacted.value(plaintext))),
+                catch: CredentialCipher.unavailable
+            });
+            return { ciphertext: toBase64(new Uint8Array(ciphertext)), nonce: toBase64(nonce) };
+        }),
+        open: Effect.fn("WebCryptoCipher.open")(function* (sealed, context) {
+            const additionalData = yield* encodeContext(context);
+            const plaintext = yield* Effect.try({
+                try: () => fromBase64(sealed.nonce),
+                catch: (cause) => unopenable("malformed_nonce", cause)
+            }).pipe(Effect.flatMap((nonce) => Effect.tryPromise({
+                try: () => crypto.decrypt({ name: algorithm, iv: nonce, additionalData: additionalData }, key, fromBase64(sealed.ciphertext)),
+                catch: (cause) => unopenable("authentication_failed", cause)
+            })), Effect.tapError((error) => Effect.logWarning({ message: error.message, operation: error.operation, credentialId: context.id })));
+            return Redacted.make(new TextDecoder().decode(plaintext));
+        })
+    });
+});
+/**
+ * Provides AES-256-GCM credential encryption under a host-managed key.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layer = (options) => Layer.effect(CredentialCipher.CredentialCipher)(make(options));
+//# sourceMappingURL=WebCryptoCipher.js.map

package/dist/esm/WebCryptoCipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoCipher.js","sourceRoot":"","sources":["../../src/WebCryptoCipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAA;AACpF,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AAEzD,MAAM,SAAS,GAAG,SAAS,CAAA;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAE9B,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAA2B,EAAE;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,GAA6C,EAAE,CAC5D,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM,SAAS,GAAG,UAAU,CAAC,MAA4B,CAAA;IACzD,OAAO,SAAS,EAAE,MAAM,KAAK,SAAS;QACpC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AACtC,CAAC,CAAC,CAAA;AAEJ,MAAM,WAAW,GAAG,GAAwD,EAAE,CAC5E,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM,SAAS,GAAG,UAAU,CAAC,MAA4B,CAAA;IACzD,OAAO,SAAS,EAAE,eAAe,KAAK,SAAS;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;AAC3E,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CAAC,OAAiC,EAAuD,EAAE,CAC/G,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE;QACR,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,aAAa,EAAE,oBAAoB;YACnC,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;QACF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC3C,CAAC;IACD,KAAK,EAAE,gBAAgB,CAAC,WAAW;CACpC,CAAC,CAAA;AAEJ,MAAM,UAAU,GAAG,GAAiB,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAA;AAEpH,MAAM,UAAU,GAAG,CAAC,MAAmD,EAAE,KAAc,EAAoB,EAAE,CAC3G,IAAI,gBAAgB,CAAC;IACnB,SAAS,EAAE,iBAAiB;IAC5B,OAAO,EAAE,MAAM,KAAK,iBAAiB;QACnC,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,6FAA6F;IACjG,KAAK;CACN,CAAC,CAAA;AAeJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAuE,EAAE,CAC5G,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,KAAK,EAAE,UAAU;KAClB,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjF,KAAK,EAAE,gBAAgB,CAAC,WAAW;KACpC,CAAC,CAAA;IAEF,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAC,SAAS,EAAE,OAAO;YAClE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;YAClC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC1C,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC,OAAO,CACZ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,EAC9D,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACpD;gBACH,KAAK,EAAE,gBAAgB,CAAC,WAAW;aACpC,CAAC,CAAA;YACF,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;QACrF,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAC,MAAM,EAAE,OAAO;YAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YACpD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAClC,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACvD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,UAAU,CAAC;gBAChB,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC,OAAO,CACZ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,EAC9D,GAAG,EACH,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAC9B;gBACH,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,KAAK,CAAC;aAC7D,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CACpG,CACF,CAAA;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3D,CAAC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,OAAgB,EAC4D,EAAE,CAC9E,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA","sourcesContent":["/**\n * AES-256-GCM credential encryption over the Web Crypto API.\n *\n * One adapter serves both hosts the project supports: `globalThis.crypto.subtle`\n * is the browser's own API and has been Node's since v19, so this module\n * imports nothing from `node:*` and still runs unmodified on the server. A host\n * without Web Crypto, such as an old runtime or a locked-down worker, fails\n * with the typed `Unavailable`, never a defect. A key that is not 32\n * base64-encoded bytes fails with `InvalidInput`. A record that does not open\n * fails with `PersistenceError` on operation `credential.open`, which names\n * whether the stored nonce was malformed or the ciphertext failed\n * authentication (a different key, changed metadata, or tampered bytes).\n *\n * The key is host-managed and supplied at layer construction. It is held as a\n * non-extractable `CryptoKey`, so it cannot be read back out of the cipher, and\n * it never reaches `CredentialStore`.\n *\n * @since 0.1.0\n */\n\nimport { canonicalize } from \"@smthrs/canonical\"\nimport { Effect, Layer, Redacted } from \"effect\"\nimport { InvalidInput, PersistenceError, type Unavailable } from \"./ControlError.ts\"\nimport * as CredentialCipher from \"./CredentialCipher.ts\"\n\nconst algorithm = \"AES-GCM\"\nconst nonceBytes = 12\nconst contextFormatVersion = 1\n\nconst toBase64 = (bytes: Uint8Array): string => {\n  let binary = \"\"\n  for (const byte of bytes) binary += String.fromCharCode(byte)\n  return btoa(binary)\n}\n\nconst fromBase64 = (value: string): Uint8Array<ArrayBuffer> => {\n  const binary = atob(value)\n  const bytes = new Uint8Array(binary.length)\n  for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index)\n  return bytes\n}\n\nconst subtle = (): Effect.Effect<SubtleCrypto, Unavailable> =>\n  Effect.suspend(() => {\n    const available = globalThis.crypto as Crypto | undefined\n    return available?.subtle === undefined\n      ? Effect.fail(CredentialCipher.unavailable())\n      : Effect.succeed(available.subtle)\n  })\n\nconst randomNonce = (): Effect.Effect<Uint8Array<ArrayBuffer>, Unavailable> =>\n  Effect.suspend(() => {\n    const available = globalThis.crypto as Crypto | undefined\n    return available?.getRandomValues === undefined\n      ? Effect.fail(CredentialCipher.unavailable())\n      : Effect.succeed(available.getRandomValues(new Uint8Array(nonceBytes)))\n  })\n\nconst encodeContext = (context: CredentialCipher.Context): Effect.Effect<Uint8Array<ArrayBuffer>, Unavailable> =>\n  Effect.try({\n    try: () => {\n      // Canonical JSON names and escapes each field, so embedded delimiters\n      // cannot make two metadata tuples authenticate as the same bytes. The\n      // explicit format version makes a future byte contract distinguishable.\n      const document = canonicalize({\n        formatVersion: contextFormatVersion,\n        id: context.id,\n        name: context.name,\n        version: context.version\n      })\n      return new TextEncoder().encode(document)\n    },\n    catch: CredentialCipher.unavailable\n  })\n\nconst invalidKey = (): InvalidInput => new InvalidInput({ issue: \"Credential key must be 32 base64-encoded bytes\" })\n\nconst unopenable = (reason: \"malformed_nonce\" | \"authentication_failed\", cause: unknown): PersistenceError =>\n  new PersistenceError({\n    operation: \"credential.open\",\n    message: reason === \"malformed_nonce\"\n      ? \"Stored credential nonce is malformed\"\n      : \"Credential failed authentication: a different key, changed metadata, or tampered ciphertext\",\n    cause\n  })\n\n/**\n * Host-managed key material for the cipher.\n *\n * `key` is 32 raw bytes, base64-encoded, held redacted so it cannot be printed\n * or serialized by accident.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Options {\n  readonly key: Redacted.Redacted<string>\n}\n\n/**\n * Imports the host key and constructs the cipher.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = (options: Options): Effect.Effect<CredentialCipher.Service, Unavailable | InvalidInput> =>\n  Effect.gen(function*() {\n    const crypto = yield* subtle()\n    const raw = yield* Effect.try({\n      try: () => fromBase64(Redacted.value(options.key)),\n      catch: invalidKey\n    })\n    if (raw.length !== 32) return yield* Effect.fail(invalidKey())\n    const key = yield* Effect.tryPromise({\n      try: () => crypto.importKey(\"raw\", raw, algorithm, false, [\"encrypt\", \"decrypt\"]),\n      catch: CredentialCipher.unavailable\n    })\n\n    return CredentialCipher.make({\n      seal: Effect.fn(\"WebCryptoCipher.seal\")(function*(plaintext, context) {\n        const additionalData = yield* encodeContext(context)\n        const nonce = yield* randomNonce()\n        const ciphertext = yield* Effect.tryPromise({\n          try: () =>\n            crypto.encrypt(\n              { name: algorithm, iv: nonce, additionalData: additionalData },\n              key,\n              new TextEncoder().encode(Redacted.value(plaintext))\n            ),\n          catch: CredentialCipher.unavailable\n        })\n        return { ciphertext: toBase64(new Uint8Array(ciphertext)), nonce: toBase64(nonce) }\n      }),\n      open: Effect.fn(\"WebCryptoCipher.open\")(function*(sealed, context) {\n        const additionalData = yield* encodeContext(context)\n        const plaintext = yield* Effect.try({\n          try: () => fromBase64(sealed.nonce),\n          catch: (cause) => unopenable(\"malformed_nonce\", cause)\n        }).pipe(\n          Effect.flatMap((nonce) =>\n            Effect.tryPromise({\n              try: () =>\n                crypto.decrypt(\n                  { name: algorithm, iv: nonce, additionalData: additionalData },\n                  key,\n                  fromBase64(sealed.ciphertext)\n                ),\n              catch: (cause) => unopenable(\"authentication_failed\", cause)\n            })\n          ),\n          Effect.tapError((error) =>\n            Effect.logWarning({ message: error.message, operation: error.operation, credentialId: context.id })\n          )\n        )\n        return Redacted.make(new TextDecoder().decode(plaintext))\n      })\n    })\n  })\n\n/**\n * Provides AES-256-GCM credential encryption under a host-managed key.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer = (\n  options: Options\n): Layer.Layer<CredentialCipher.CredentialCipher, Unavailable | InvalidInput> =>\n  Layer.effect(CredentialCipher.CredentialCipher)(make(options))\n"]}

package/dist/esm/WebhookChannel.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Webhook channel construction over Effect's transport-neutral HTTP request.
+ *
+ * @since 0.1.0
+ */
+import { Effect, type Redacted, Schema } from "effect";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import { type Channel, Channels, type InboundResult, type RawInbound } from "./Channels.ts";
+import { InvalidInput, type Unauthorized } from "./ControlError.ts";
+import type { IdempotencyKey } from "./ControlSchema.ts";
+import type { CredentialRef } from "./Credential.ts";
+/**
+ * Signature verifier injected by a webhook transport.
+ *
+ * The credential is intentionally a redacted reference. Resolution belongs at
+ * the host adapter boundary, never in webhook input or its persisted record.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type SignatureVerifier = (raw: RawInbound, credential: Redacted.Redacted<CredentialRef>) => Effect.Effect<void, Unauthorized>;
+/**
+ * Configuration for a schema-declared webhook channel.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Config<A> {
+    readonly name: string;
+    readonly schema: Schema.Schema<A>;
+    readonly credential: Redacted.Redacted<CredentialRef>;
+    readonly fingerprintHeaders?: Channel<A>["fingerprintHeaders"];
+    readonly verify: SignatureVerifier;
+    readonly map: (payload: A) => Effect.Effect<InboundResult, InvalidInput>;
+    readonly project: Channel<A>["project"];
+}
+/**
+ * Largest webhook request body one mount reads by default, in bytes.
+ *
+ * A webhook is the one control-plane ingress a bearer holder reaches with an
+ * arbitrary payload, and `handler` used to materialize whatever arrived before
+ * anything looked at its size. The default is deliberately smaller than the
+ * 4 MiB mutation-identity budget in `internal/mutationBoundary.ts`: a body that
+ * cannot become a durable mutation is refused at the door rather than copied,
+ * decoded, and refused later.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumBodyBytes: number;
+/**
+ * Per-mount overrides for the webhook request handler.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface HandlerOptions {
+    /** Body ceiling for this mount. Defaults to `maximumBodyBytes`. */
+    readonly maximumBodyBytes?: number | undefined;
+}
+/**
+ * Builds a webhook channel. Verification receives raw bytes and headers before
+ * JSON parsing and schema decoding.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const make: <A>(config: Config<A>) => Channel<A>;
+/**
+ * Reads an abstract Effect HTTP request and dispatches it through Channels.
+ * This is mountable by any Effect HTTP host; it contains no Node transport
+ * dependencies.
+ *
+ * The body is bounded twice. A `content-length` over the limit is refused
+ * before the body is read at all, so a declared flood costs nothing; the
+ * measured length is checked before retaining each streamed chunk. Reading
+ * stops at the first chunk exceeding the limit, including when the caller
+ * understates or omits the length. Both refusals are `InvalidInput` naming the
+ * two byte counts and no body content.
+ *
+ * @category handlers
+ * @since 0.1.0
+ */
+export declare const handler: (channel: string, idempotencyKey: IdempotencyKey, options?: HandlerOptions | undefined) => Effect.Effect<{
+    readonly _tag: "Accepted";
+    readonly receiptId: string;
+    readonly runId?: string | undefined;
+    readonly inputConsumed?: boolean | undefined;
+    readonly inputBody?: string | undefined;
+    readonly handedTo?: {
+        readonly hostId: string;
+        readonly pid: number;
+    } | undefined;
+} | {
+    readonly _tag: "AlreadyApplied";
+    readonly receiptId: string;
+    readonly runId?: string | undefined;
+    readonly inputConsumed?: boolean | undefined;
+    readonly inputBody?: string | undefined;
+} | {
+    readonly _tag: "Parked";
+    readonly receiptId: string;
+    readonly planId: string;
+    readonly status: "waiting-approval";
+} | {
+    readonly _tag: "Conflict";
+    readonly message: string;
+} | {
+    readonly _tag: "Terminal";
+    readonly runId: string;
+    readonly status: "running" | "completed" | "failed" | "cancelled" | "accepted" | "parked" | "waiting-approval";
+}, import("@smthrs/notifications/NotificationQueue").NotificationError | import("./ControlError.ts").RunNotFound | import("./ControlError.ts").PlanNotFound | import("./ControlError.ts").PlanDenied | import("./ControlError.ts").FlowNotFound | import("./ControlError.ts").PlanDigestMismatch | import("./ControlError.ts").EnvelopeMismatch | import("./ControlError.ts").ClaimLost | import("./ControlError.ts").CodeDrift | import("./ControlError.ts").AlreadyResolved | InvalidInput | Unauthorized | import("./ControlError.ts").Unavailable | import("./ControlError.ts").TransportError | import("./ControlError.ts").PersistenceError | import("./ControlError.ts").LaunchFailed | import("./ControlError.ts").NoMatchingWait | import("./ControlError.ts").CredentialConflict | import("effect/unstable/http/HttpServerError").HttpServerError, Channels | HttpServerRequest.HttpServerRequest>;
+//# sourceMappingURL=WebhookChannel.d.ts.map

package/dist/esm/WebhookChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookChannel.d.ts","sourceRoot":"","sources":["../../src/WebhookChannel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,KAAK,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;IACrD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;IAC9D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;CACxC;AAID;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/C;AAoBD;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAmBpD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO,GAClB,SAAS,MAAM,EACf,gBAAgB,cAAc,EAC9B,UAAU,cAAc,GAAG,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;42BA8BlC,CAAA"}

package/dist/esm/WebhookChannel.js

@@ -0,0 +1,109 @@
+/**
+ * Webhook channel construction over Effect's transport-neutral HTTP request.
+ *
+ * @since 0.1.0
+ */
+import { Effect, Schema, Stream } from "effect";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import { Channels } from "./Channels.js";
+import { InvalidInput } from "./ControlError.js";
+const invalidInput = (issue) => new InvalidInput({ issue });
+/**
+ * Largest webhook request body one mount reads by default, in bytes.
+ *
+ * A webhook is the one control-plane ingress a bearer holder reaches with an
+ * arbitrary payload, and `handler` used to materialize whatever arrived before
+ * anything looked at its size. The default is deliberately smaller than the
+ * 4 MiB mutation-identity budget in `internal/mutationBoundary.ts`: a body that
+ * cannot become a durable mutation is refused at the door rather than copied,
+ * decoded, and refused later.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const maximumBodyBytes = 1024 * 1024;
+/**
+ * The declared body length, when the caller stated one this host can trust.
+ *
+ * Header names arrive lower-cased from Effect's HTTP layer, but a hand-built
+ * request is not obliged to, so the lookup folds case itself. An absent,
+ * non-numeric, fractional, or negative declaration is not evidence of
+ * anything: it falls through to the streaming measurement rather than being
+ * treated as zero.
+ */
+const declaredLength = (headers) => {
+    for (const [name, value] of Object.entries(headers)) {
+        if (name.toLowerCase() !== "content-length" || value === undefined)
+            continue;
+        const parsed = Number(value.trim());
+        return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : undefined;
+    }
+    return undefined;
+};
+/**
+ * Builds a webhook channel. Verification receives raw bytes and headers before
+ * JSON parsing and schema decoding.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const make = (config) => {
+    const decode = Schema.decodeUnknownEffect(config.schema);
+    return {
+        name: config.name,
+        schema: config.schema,
+        ...(config.fingerprintHeaders === undefined ? {} : { fingerprintHeaders: config.fingerprintHeaders }),
+        verify: Effect.fn("WebhookChannel.verify")((raw) => config.verify(raw, config.credential)),
+        decode: Effect.fn("WebhookChannel.decode")((raw) => Effect.try({
+            try: () => JSON.parse(new TextDecoder().decode(raw.body)),
+            catch: () => invalidInput("invalid webhook JSON")
+        }).pipe(Effect.flatMap((json) => decode(json)), Effect.mapError((cause) => cause instanceof InvalidInput ? cause : invalidInput(String(cause))))),
+        map: Effect.fn("WebhookChannel.map")((payload) => config.map(payload)),
+        project: config.project
+    };
+};
+/**
+ * Reads an abstract Effect HTTP request and dispatches it through Channels.
+ * This is mountable by any Effect HTTP host; it contains no Node transport
+ * dependencies.
+ *
+ * The body is bounded twice. A `content-length` over the limit is refused
+ * before the body is read at all, so a declared flood costs nothing; the
+ * measured length is checked before retaining each streamed chunk. Reading
+ * stops at the first chunk exceeding the limit, including when the caller
+ * understates or omits the length. Both refusals are `InvalidInput` naming the
+ * two byte counts and no body content.
+ *
+ * @category handlers
+ * @since 0.1.0
+ */
+export const handler = (channel, idempotencyKey, options) => Effect.gen(function* () {
+    const limit = options?.maximumBodyBytes ?? maximumBodyBytes;
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const declared = declaredLength(request.headers);
+    if (declared !== undefined && declared > limit) {
+        return yield* invalidInput(`webhook body: declared ${declared} bytes exceeds the ${limit} byte limit`);
+    }
+    const chunks = [];
+    let size = 0;
+    yield* Stream.runForEach(request.stream, (chunk) => Effect.gen(function* () {
+        size += chunk.byteLength;
+        if (size > limit) {
+            return yield* invalidInput(`webhook body: ${size} bytes exceeds the ${limit} byte limit`);
+        }
+        if (chunk.byteLength > 0)
+            chunks.push(chunk.slice());
+    }));
+    const body = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    const channels = yield* Channels;
+    return yield* channels.ingest({
+        channel,
+        raw: { body, headers: request.headers, idempotencyKey }
+    });
+});
+//# sourceMappingURL=WebhookChannel.js.map

package/dist/esm/WebhookChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookChannel.js","sourceRoot":"","sources":["../../src/WebhookChannel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAiB,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAgB,QAAQ,EAAuC,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAqB,MAAM,mBAAmB,CAAA;AAkCnE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAgB,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAA;AAa3C;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,CAAC,OAAqD,EAAsB,EAAE;IACnG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACnC,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAI,MAAiB,EAAc,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACrG,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1F,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,MAAM,CAAC,GAAG,CAAC;YACT,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzD,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,sBAAsB,CAAC;SAClD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EACtC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC9D,CACpC;QACD,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,OAAe,EACf,cAA8B,EAC9B,OAAoC,EACpC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,OAAO,EAAE,gBAAgB,IAAI,gBAAgB,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,0BAA0B,QAAQ,sBAAsB,KAAK,aAAa,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAA;QACxB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB,IAAI,sBAAsB,KAAK,aAAa,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;IACtD,CAAC,CAAC,CAAC,CAAA;IACL,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACvB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAA;IAChC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,OAAO;QACP,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE;KACxD,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Webhook channel construction over Effect's transport-neutral HTTP request.\n *\n * @since 0.1.0\n */\n\nimport { Effect, type Redacted, Schema, Stream } from \"effect\"\nimport * as HttpServerRequest from \"effect/unstable/http/HttpServerRequest\"\nimport { type Channel, Channels, type InboundResult, type RawInbound } from \"./Channels.ts\"\nimport { InvalidInput, type Unauthorized } from \"./ControlError.ts\"\nimport type { IdempotencyKey } from \"./ControlSchema.ts\"\nimport type { CredentialRef } from \"./Credential.ts\"\n\n/**\n * Signature verifier injected by a webhook transport.\n *\n * The credential is intentionally a redacted reference. Resolution belongs at\n * the host adapter boundary, never in webhook input or its persisted record.\n *\n * @category models\n * @since 0.1.0\n */\nexport type SignatureVerifier = (\n  raw: RawInbound,\n  credential: Redacted.Redacted<CredentialRef>\n) => Effect.Effect<void, Unauthorized>\n\n/**\n * Configuration for a schema-declared webhook channel.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Config<A> {\n  readonly name: string\n  readonly schema: Schema.Schema<A>\n  readonly credential: Redacted.Redacted<CredentialRef>\n  readonly fingerprintHeaders?: Channel<A>[\"fingerprintHeaders\"]\n  readonly verify: SignatureVerifier\n  readonly map: (payload: A) => Effect.Effect<InboundResult, InvalidInput>\n  readonly project: Channel<A>[\"project\"]\n}\n\nconst invalidInput = (issue: string): InvalidInput => new InvalidInput({ issue })\n\n/**\n * Largest webhook request body one mount reads by default, in bytes.\n *\n * A webhook is the one control-plane ingress a bearer holder reaches with an\n * arbitrary payload, and `handler` used to materialize whatever arrived before\n * anything looked at its size. The default is deliberately smaller than the\n * 4 MiB mutation-identity budget in `internal/mutationBoundary.ts`: a body that\n * cannot become a durable mutation is refused at the door rather than copied,\n * decoded, and refused later.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const maximumBodyBytes = 1024 * 1024\n\n/**\n * Per-mount overrides for the webhook request handler.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface HandlerOptions {\n  /** Body ceiling for this mount. Defaults to `maximumBodyBytes`. */\n  readonly maximumBodyBytes?: number | undefined\n}\n\n/**\n * The declared body length, when the caller stated one this host can trust.\n *\n * Header names arrive lower-cased from Effect's HTTP layer, but a hand-built\n * request is not obliged to, so the lookup folds case itself. An absent,\n * non-numeric, fractional, or negative declaration is not evidence of\n * anything: it falls through to the streaming measurement rather than being\n * treated as zero.\n */\nconst declaredLength = (headers: Readonly<Record<string, string | undefined>>): number | undefined => {\n  for (const [name, value] of Object.entries(headers)) {\n    if (name.toLowerCase() !== \"content-length\" || value === undefined) continue\n    const parsed = Number(value.trim())\n    return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : undefined\n  }\n  return undefined\n}\n\n/**\n * Builds a webhook channel. Verification receives raw bytes and headers before\n * JSON parsing and schema decoding.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = <A>(config: Config<A>): Channel<A> => {\n  const decode = Schema.decodeUnknownEffect(config.schema)\n  return {\n    name: config.name,\n    schema: config.schema,\n    ...(config.fingerprintHeaders === undefined ? {} : { fingerprintHeaders: config.fingerprintHeaders }),\n    verify: Effect.fn(\"WebhookChannel.verify\")((raw) => config.verify(raw, config.credential)),\n    decode: Effect.fn(\"WebhookChannel.decode\")((raw) =>\n      Effect.try({\n        try: () => JSON.parse(new TextDecoder().decode(raw.body)),\n        catch: () => invalidInput(\"invalid webhook JSON\")\n      }).pipe(\n        Effect.flatMap((json) => decode(json)),\n        Effect.mapError((cause) => cause instanceof InvalidInput ? cause : invalidInput(String(cause)))\n      ) as Effect.Effect<A, InvalidInput>\n    ),\n    map: Effect.fn(\"WebhookChannel.map\")((payload) => config.map(payload)),\n    project: config.project\n  }\n}\n\n/**\n * Reads an abstract Effect HTTP request and dispatches it through Channels.\n * This is mountable by any Effect HTTP host; it contains no Node transport\n * dependencies.\n *\n * The body is bounded twice. A `content-length` over the limit is refused\n * before the body is read at all, so a declared flood costs nothing; the\n * measured length is checked before retaining each streamed chunk. Reading\n * stops at the first chunk exceeding the limit, including when the caller\n * understates or omits the length. Both refusals are `InvalidInput` naming the\n * two byte counts and no body content.\n *\n * @category handlers\n * @since 0.1.0\n */\nexport const handler = (\n  channel: string,\n  idempotencyKey: IdempotencyKey,\n  options?: HandlerOptions | undefined\n) =>\n  Effect.gen(function*() {\n    const limit = options?.maximumBodyBytes ?? maximumBodyBytes\n    const request = yield* HttpServerRequest.HttpServerRequest\n    const declared = declaredLength(request.headers)\n    if (declared !== undefined && declared > limit) {\n      return yield* invalidInput(`webhook body: declared ${declared} bytes exceeds the ${limit} byte limit`)\n    }\n    const chunks: Array<Uint8Array> = []\n    let size = 0\n    yield* Stream.runForEach(request.stream, (chunk) =>\n      Effect.gen(function*() {\n        size += chunk.byteLength\n        if (size > limit) {\n          return yield* invalidInput(`webhook body: ${size} bytes exceeds the ${limit} byte limit`)\n        }\n        if (chunk.byteLength > 0) chunks.push(chunk.slice())\n      }))\n    const body = new Uint8Array(size)\n    let offset = 0\n    for (const chunk of chunks) {\n      body.set(chunk, offset)\n      offset += chunk.byteLength\n    }\n    const channels = yield* Channels\n    return yield* channels.ingest({\n      channel,\n      raw: { body, headers: request.headers, idempotencyKey }\n    })\n  })\n"]}

package/dist/esm/index.d.ts

@@ -0,0 +1,160 @@
+/**
+ * Control-plane contracts and projections for the Smithers harness.
+ *
+ * This is the public surface of the control plane: the transport-independent
+ * `Control` service, the `ControlRuntime` port it writes through, the
+ * projections it reads back, and the durable adapter that binds both to a real
+ * database.
+ *
+ * `Control` is authority, not execution. Every mutation it accepts is
+ * idempotent, principal-stamped, and recorded in the journal beside the state
+ * change it caused, so "who asked for this, and when did it take effect?" is
+ * answered from persisted evidence rather than from a log line.
+ *
+ * @since 0.1.0
+ */
+/**
+ * @category services
+ * @since 0.1.0
+ */
+export * as Control from "./Control.ts";
+/**
+ * @category services
+ * @since 1.0.0
+ */
+export * as ApprovalAuthority from "./ApprovalAuthority.ts";
+/**
+ * @category errors
+ * @since 0.1.0
+ */
+export * as ControlError from "./ControlError.ts";
+/**
+ * @category models
+ * @since 0.1.0
+ */
+export * as ControlSchema from "./ControlSchema.ts";
+/**
+ * @category projections
+ * @since 0.1.0
+ */
+export * as Cancellation from "./Cancellation.ts";
+/**
+ * @category projections
+ * @since 0.1.0
+ */
+export * as Lineage from "./Lineage.ts";
+/**
+ * @category projections
+ * @since 0.1.0
+ */
+export * as Monitor from "./Monitor.ts";
+/**
+ * @category projections
+ * @since 0.1.0
+ */
+export * as Steering from "./Steering.ts";
+/**
+ * @category services
+ * @since 0.1.0
+ */
+export * as ControlRuntime from "./ControlRuntime.ts";
+/**
+ * @category services
+ * @since 0.1.0
+ */
+export * as ControlExecutor from "./ControlExecutor.ts";
+/**
+ * @category services
+ * @since 1.0.0
+ */
+export * as DispatchReader from "./DispatchReader.ts";
+/**
+ * @category layers
+ * @since 0.1.0
+ */
+export * as ControlLive from "./ControlLive.ts";
+/**
+ * @category models
+ * @since 0.1.0
+ */
+export * as SystemFlows from "./SystemFlows.ts";
+/**
+ * @category rpc
+ * @since 0.1.0
+ */
+export * as ControlRpcs from "./ControlRpcs.ts";
+/**
+ * @category layers
+ * @since 0.1.0
+ */
+export * as ControlServer from "./ControlServer.ts";
+/**
+ * @category layers
+ * @since 0.1.0
+ */
+export * as ControlClient from "./ControlClient.ts";
+/**
+ * @category services
+ * @since 0.1.0
+ */
+export * as Channels from "./Channels.ts";
+/**
+ * @category channels
+ * @since 0.1.0
+ */
+export * as WebhookChannel from "./WebhookChannel.ts";
+/**
+ * @category services
+ * @since 0.1.0
+ */
+export * as Credential from "./Credential.ts";
+/**
+ * @category services
+ * @since 0.1.0
+ */
+export * as CredentialCipher from "./CredentialCipher.ts";
+/**
+ * @category services
+ * @since 0.1.0
+ */
+export * as CredentialStore from "./CredentialStore.ts";
+/**
+ * @category layers
+ * @since 0.1.0
+ */
+export * as SqlCredentialStore from "./SqlCredentialStore.ts";
+/**
+ * @category layers
+ * @since 0.1.0
+ */
+export * as WebCryptoCipher from "./WebCryptoCipher.ts";
+/**
+ * @category layers
+ * @since 0.1.0
+ */
+export * as SqlControlRuntime from "./SqlControlRuntime.ts";
+/**
+ * @category authentication
+ * @since 1.0.0
+ */
+export * as ScopedToken from "./ScopedToken.ts";
+/**
+ * @category migrations
+ * @since 0.1.0
+ */
+export * as Migrations from "./Migrations.ts";
+/**
+ * Observational health contracts.
+ * @category health
+ * @since 1.0.0
+ */
+export * as Health from "./Health.ts";
+/**
+ * The Jev-decided session checker a host binds as `jev.session`.
+ * @category health
+ * @since 1.0.0
+ */
+export * as JevSessionChecker from "./JevSessionChecker.ts";
+/** Versioned control lifecycle producer and projection contract. */
+export * as ControlFacts from "./ControlFacts.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AACH,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AAEvC;;;GAGG;AACH,OAAO,KAAK,iBAAiB,MAAM,wBAAwB,CAAA;AAE3D;;;GAGG;AACH,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AAEjD;;;GAGG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;GAGG;AACH,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AAEjD;;;GAGG;AACH,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AAEvC;;;GAGG;AACH,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AAEvC;;;GAGG;AACH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAEzC;;;GAGG;AACH,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAErD;;;GAGG;AACH,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AAEvD;;;GAGG;AACH,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAErD;;;GAGG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;;GAGG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;;GAGG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;;GAGG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;GAGG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;GAGG;AACH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAEzC;;;GAGG;AACH,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAErD;;;GAGG;AACH,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;;GAGG;AACH,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AAEzD;;;GAGG;AACH,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AAEvD;;;GAGG;AACH,OAAO,KAAK,kBAAkB,MAAM,yBAAyB,CAAA;AAE7D;;;GAGG;AACH,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AAEvD;;;GAGG;AACH,OAAO,KAAK,iBAAiB,MAAM,wBAAwB,CAAA;AAE3D;;;GAGG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;;GAGG;AACH,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC;;;;GAIG;AACH,OAAO,KAAK,iBAAiB,MAAM,wBAAwB,CAAA;AAE3D,oEAAoE;AACpE,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA"}