@smthrs/kernel 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/HttpClient.js

@@ -0,0 +1,217 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var HttpClient_exports = {};
+__export(HttpClient_exports, {
+  Destination: () => Destination,
+  HttpClient: () => import_HttpClient.HttpClient,
+  ModelCall: () => ModelCall,
+  authorizePreflight: () => authorizePreflight,
+  fromHttpClientError: () => fromHttpClientError,
+  layer: () => layer,
+  layerNoop: () => layerNoop,
+  make: () => import_HttpClient2.make,
+  makeNoop: () => makeNoop,
+  supportsDestinationPinning: () => supportsDestinationPinning,
+  toHttpClientError: () => toHttpClientError,
+  withDestinationPinning: () => withDestinationPinning,
+  withModelCall: () => withModelCall
+});
+module.exports = __toCommonJS(HttpClient_exports);
+var import_Permission = require("@smthrs/capability/Permission");
+var import_effect = require("effect");
+var FetchHttpClient = __toESM(require("effect/unstable/http/FetchHttpClient"), 1);
+var Headers = __toESM(require("effect/unstable/http/Headers"), 1);
+var HttpBody = __toESM(require("effect/unstable/http/HttpBody"), 1);
+var EffectHttpClient = __toESM(require("effect/unstable/http/HttpClient"), 1);
+var HttpClientError = __toESM(require("effect/unstable/http/HttpClientError"), 1);
+var HttpClientRequest = __toESM(require("effect/unstable/http/HttpClientRequest"), 1);
+var UrlParams = __toESM(require("effect/unstable/http/UrlParams"), 1);
+var import_GrantStore = require("./GrantStore.js");
+var import_makeCapability = require("./internal/makeCapability.js");
+var import_HttpClient = require("effect/unstable/http/HttpClient");
+var import_HttpClient2 = require("effect/unstable/http/HttpClient");
+const snapshotRawBody = (value) => {
+  if (value instanceof globalThis.Uint8Array) return value.slice();
+  if (value instanceof ArrayBuffer) return value.slice(0);
+  if (value instanceof URLSearchParams) {
+    return new URLSearchParams(value);
+  }
+  if (value instanceof Blob) return value;
+  if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return value;
+  }
+  throw new TypeError("raw HTTP bodies must be immutable or copyable");
+};
+const snapshotBody = (body) => {
+  switch (body._tag) {
+    case "Empty":
+      return HttpBody.empty;
+    case "Raw":
+      return HttpBody.raw(snapshotRawBody(body.body), {
+        contentType: body.contentType,
+        contentLength: body.contentLength
+      });
+    case "Uint8Array":
+      return HttpBody.uint8Array(body.body.slice(), body.contentType);
+    case "FormData": {
+      const formData = new globalThis.FormData();
+      for (const [name, value] of body.formData.entries()) formData.append(name, value);
+      return HttpBody.formData(formData);
+    }
+    case "Stream":
+      return HttpBody.stream(body.stream, body.contentType, body.contentLength);
+  }
+};
+const snapshotRequest = (request) => HttpClientRequest.makeWith(
+  request.method,
+  request.url,
+  UrlParams.make(
+    Object.freeze(request.urlParams.params.map(([name, value]) => Object.freeze([name, value])))
+  ),
+  import_effect.Option.map(request.hash, (value) => value),
+  Headers.fromInput(request.headers),
+  snapshotBody(request.body)
+);
+const invalidRequest = (request) => new HttpClientError.HttpClientError({
+  reason: new HttpClientError.TransportError({
+    request,
+    description: "HTTP request must be an immutable supported request description"
+  })
+});
+const ModelCall = import_effect.Context.Reference(
+  "@smthrs/kernel/HttpClient/ModelCall",
+  { defaultValue: () => void 0 }
+);
+const withModelCall = (modelId) => (effect) => import_effect.Effect.provideService(effect, ModelCall, modelId);
+const toHttpClientError = (options) => new HttpClientError.HttpClientError({
+  reason: new HttpClientError.TransportError({
+    request: options.request,
+    description: (0, import_Permission.formatError)(options.error),
+    cause: options.error
+  })
+});
+const fromHttpClientError = (error) => error.reason._tag === "TransportError" && (0, import_Permission.isPermissionError)(error.reason.cause) ? import_effect.Option.some(error.reason.cause) : import_effect.Option.none();
+const makeNoop = () => EffectHttpClient.make(
+  (request) => import_effect.Effect.fail(
+    new HttpClientError.HttpClientError({
+      reason: new HttpClientError.TransportError({
+        request,
+        cause: new Error("HTTP is unavailable on this host")
+      })
+    })
+  )
+);
+const layerNoop = () => import_effect.Layer.succeed(EffectHttpClient.HttpClient)(makeNoop());
+const capabilityFor = (request, modelId) => {
+  const action = modelId === void 0 ? request.method === "GET" || request.method === "HEAD" ? "net:get" : "net:post" : "model:call";
+  let url;
+  try {
+    url = new URL(request.url);
+  } catch {
+    return (0, import_makeCapability.makeCapability)(action, request.url).pipe(
+      import_effect.Effect.flatMap(
+        (capability) => import_effect.Effect.fail(
+          new import_Permission.PermissionDenied({
+            code: "permission_denied",
+            capability,
+            reason: "HTTP capability checks require an absolute, parseable URL"
+          })
+        )
+      )
+    );
+  }
+  const host = url.host.toLowerCase();
+  const resource = url.protocol === "https:" ? host : `${url.protocol}//${host}`;
+  return (0, import_makeCapability.makeCapability)(action, modelId === void 0 ? resource : `${resource}/${modelId}`);
+};
+const Admission = import_effect.Context.Reference("@smthrs/kernel/HttpClient/Admission", {
+  defaultValue: () => void 0
+});
+const authorizePreflight = (request, effect) => import_effect.Effect.gen(function* () {
+  const store = yield* import_GrantStore.GrantStore;
+  const capability = yield* import_effect.Effect.withFiber((fiber) => capabilityFor(request, fiber.getRef(ModelCall))).pipe(
+    import_effect.Effect.tap((capability2) => store.check(capability2)),
+    import_effect.Effect.mapError((error) => toHttpClientError({ request, error }))
+  );
+  return yield* import_effect.Effect.provideService(effect, Admission, { store, capability, consumed: false });
+});
+const manualRedirects = (context) => import_effect.Context.add(context, FetchHttpClient.RequestInit, {
+  ...import_effect.Context.getOrUndefined(context, FetchHttpClient.RequestInit),
+  redirect: "manual"
+});
+const layer = import_effect.Layer.effect(
+  EffectHttpClient.HttpClient,
+  import_effect.Effect.gen(function* () {
+    const client = yield* EffectHttpClient.HttpClient;
+    const grants = yield* import_GrantStore.GrantStore;
+    const snapshotted = EffectHttpClient.mapRequestEffect(
+      client,
+      (request) => import_effect.Effect.try({
+        try: () => snapshotRequest(request),
+        catch: () => invalidRequest(request)
+      })
+    );
+    const guarded = EffectHttpClient.transform(
+      snapshotted,
+      (execute, request) => import_effect.Effect.withFiber(
+        (fiber) => capabilityFor(request, fiber.getRef(ModelCall)).pipe(
+          import_effect.Effect.flatMap((capability) => {
+            const admission = fiber.getRef(Admission);
+            if (admission !== void 0 && !admission.consumed && admission.store === grants && admission.capability.action === capability.action && admission.capability.resource === capability.resource) {
+              admission.consumed = true;
+              return import_effect.Effect.void;
+            }
+            return grants.check(capability);
+          }),
+          import_effect.Effect.mapError((error) => toHttpClientError({ request, error })),
+          import_effect.Effect.andThen(import_effect.Effect.updateContext(execute, manualRedirects))
+        )
+      )
+    );
+    const followed = EffectHttpClient.followRedirects(guarded);
+    const result = EffectHttpClient.makeWith(
+      (request) => import_effect.Effect.withFiber(
+        (fiber) => (
+          // Read caller policy before the guard forces manual transport.
+          import_effect.Context.getOrUndefined(fiber.context, FetchHttpClient.RequestInit)?.redirect === "manual" ? guarded.postprocess(request) : followed.postprocess(request)
+        )
+      ),
+      guarded.preprocess
+    );
+    return supportsDestinationPinning(client) ? withDestinationPinning(result) : result;
+  })
+);
+const Destination = import_effect.Context.Reference("@smthrs/kernel/HttpClient/Destination", { defaultValue: () => void 0 });
+const pinnedClients = /* @__PURE__ */ new WeakSet();
+const withDestinationPinning = (client) => {
+  pinnedClients.add(client);
+  return client;
+};
+const supportsDestinationPinning = (client) => pinnedClients.has(client);
+//# sourceMappingURL=HttpClient.js.map

package/dist/cjs/HttpClient.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/HttpClient.ts"],
+  "sourcesContent": ["/**\n * Permission-aware outgoing HTTP requests.\n *\n * There is no kernel `HttpClient` interface and no kernel `HttpClient` tag.\n * Effect owns both, and its tag fixes the error channel to `HttpClientError`,\n * so this module is only the middleware: a `Layer` over Effect's own tag that\n * reads the raw client out of context and returns a guarded one in its place.\n * Permission failures are projected into `HttpClientError` by\n * {@link toHttpClientError}, which keeps the structured kernel failure on the\n * transport reason's `cause` so {@link fromHttpClientError} can hand it back.\n *\n * **Redirects.** A redirect is a second network destination, so it needs a\n * second grant check. Two halves guarantee that:\n *\n *  1. The client below this layer must **not** follow redirects on its own.\n *     That is a precondition on the host: Undici without a redirect\n *     interceptor, or Effect's fetch layer with `redirect: \"manual\"`. This\n *     layer also forces `RequestInit { redirect: \"manual\" }` over the ambient\n *     value for every request it executes, so a plain `FetchHttpClient.layer`,\n *     which follows redirects by default, cannot walk to another origin below\n *     the guard either. A custom client that ignores `RequestInit` must meet\n *     the precondition itself.\n *  2. This layer composes Effect's own `HttpClient.followRedirects` *above*\n *     the guard. That combinator re-enters `postprocess` for every hop, and\n *     `postprocess` is the guarded one, so hop *n* is checked exactly like hop\n *     zero and an authorized origin cannot lend its grant to another.\n *     A caller that sets `FetchHttpClient.RequestInit.redirect` to `manual`\n *     receives one guarded hop and owns any further redirect requests itself.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md`,\n * `docs/specs/Concepts/Effect Taxonomy.md`, and\n * `docs/specs/Concepts/Host Adapters.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport type { Capability } from \"@smthrs/capability/Capability\"\nimport {\n  formatError,\n  isPermissionError,\n  PermissionDenied,\n  type PermissionError,\n  type PermissionErrorPayload\n} from \"@smthrs/capability/Permission\"\nimport { Context, Effect, Layer, Option } from \"effect\"\nimport * as FetchHttpClient from \"effect/unstable/http/FetchHttpClient\"\nimport * as Headers from \"effect/unstable/http/Headers\"\nimport * as HttpBody from \"effect/unstable/http/HttpBody\"\nimport * as EffectHttpClient from \"effect/unstable/http/HttpClient\"\nimport * as HttpClientError from \"effect/unstable/http/HttpClientError\"\nimport * as HttpClientRequest from \"effect/unstable/http/HttpClientRequest\"\nimport * as UrlParams from \"effect/unstable/http/UrlParams\"\nimport { GrantStore, type Service as GrantService } from \"./GrantStore.ts\"\nimport { makeCapability } from \"./internal/makeCapability.ts\"\n\nconst snapshotRawBody = (value: unknown): unknown => {\n  if (value instanceof globalThis.Uint8Array) return value.slice()\n  if (value instanceof ArrayBuffer) return value.slice(0)\n  if (value instanceof URLSearchParams) {\n    return new URLSearchParams(value)\n  }\n  if (value instanceof Blob) return value\n  if (value === null || typeof value === \"string\" || typeof value === \"number\" || typeof value === \"boolean\") {\n    return value\n  }\n  throw new TypeError(\"raw HTTP bodies must be immutable or copyable\")\n}\n\nconst snapshotBody = (body: HttpBody.HttpBody): HttpBody.HttpBody => {\n  switch (body._tag) {\n    case \"Empty\":\n      return HttpBody.empty\n    case \"Raw\":\n      return HttpBody.raw(snapshotRawBody(body.body), {\n        contentType: body.contentType,\n        contentLength: body.contentLength\n      })\n    case \"Uint8Array\":\n      return HttpBody.uint8Array(body.body.slice(), body.contentType)\n    case \"FormData\": {\n      const formData = new globalThis.FormData()\n      for (const [name, value] of body.formData.entries()) formData.append(name, value)\n      return HttpBody.formData(formData)\n    }\n    case \"Stream\":\n      return HttpBody.stream(body.stream, body.contentType, body.contentLength)\n  }\n}\n\nconst snapshotRequest = (request: HttpClientRequest.HttpClientRequest): HttpClientRequest.HttpClientRequest =>\n  HttpClientRequest.makeWith(\n    request.method,\n    request.url,\n    UrlParams.make(\n      Object.freeze(request.urlParams.params.map(([name, value]) => Object.freeze([name, value] as const)))\n    ),\n    Option.map(request.hash, (value) => value),\n    Headers.fromInput(request.headers),\n    snapshotBody(request.body)\n  )\n\nconst invalidRequest = (request: HttpClientRequest.HttpClientRequest): HttpClientError.HttpClientError =>\n  new HttpClientError.HttpClientError({\n    reason: new HttpClientError.TransportError({\n      request,\n      description: \"HTTP request must be an immutable supported request description\"\n    })\n  })\n\n/**\n * Effect's own outgoing HTTP client tag, unchanged. Re-exported so the kernel\n * namespace stays one-stop; it is the *same* tag, never a second one.\n *\n * @category services\n * @since 1.0.0-rc.0\n */\nexport { HttpClient } from \"effect/unstable/http/HttpClient\"\n\n/**\n * Constructs a client from a low-level request runner, keeping Effect's own\n * URL construction, tracing, header redaction, and interruption behavior.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport { make } from \"effect/unstable/http/HttpClient\"\n\n/**\n * The model identity an outgoing request is made on behalf of, if any.\n *\n * A model call is not a general `net:*` effect: the same host answers many\n * models, and a grant for one must not be a grant for the rest. Effect's tag\n * has no room for an extra method, so the intent rides on a `Context`\n * reference instead \u2014 set it with {@link withModelCall} and the decorator asks\n * for `model:call` rather than `net:get`/`net:post`.\n *\n * @category references\n * @since 1.0.0-rc.0\n */\nexport const ModelCall: Context.Reference<string | undefined> = Context.Reference<string | undefined>(\n  \"@smthrs/kernel/HttpClient/ModelCall\",\n  { defaultValue: (): string | undefined => undefined }\n)\n\n/**\n * Runs `effect` with every outgoing request in it checked as a `model:call` on\n * `modelId` instead of as plain network access.\n *\n * @category references\n * @since 1.0.0-rc.0\n */\nexport const withModelCall = (modelId: string) => <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n  Effect.provideService(effect, ModelCall, modelId)\n\n/**\n * Projects a permission failure into the error channel Effect's `HttpClient`\n * tag fixes.\n *\n * Nothing is lost: the reason is always a `TransportError` \u2014 the request did\n * not leave the host because the capability kernel refused, suspended, or\n * could not decide it \u2014 `description` carries the human rendering from\n * `Permission.formatError`, and `cause` carries the structured failure itself,\n * so {@link fromHttpClientError} hands the attended surface back the original\n * `capability`, `tier`, `requestId`, and `reason`.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const toHttpClientError = (options: {\n  readonly request: HttpClientRequest.HttpClientRequest\n  readonly error: PermissionError\n}): HttpClientError.HttpClientError =>\n  new HttpClientError.HttpClientError({\n    reason: new HttpClientError.TransportError({\n      request: options.request,\n      description: formatError(options.error),\n      cause: options.error\n    })\n  })\n\n/**\n * Recovers the structured permission failure a {@link toHttpClientError}\n * projection carries, so an attended surface can still reply to the request\n * and an unattended report can still name the capability.\n *\n * Recovery validates data fields and the transport reason tag, not origin or\n * class operations. Establish producer or request identity separately across\n * a trust boundary.\n *\n * @category refinements\n * @since 1.0.0-rc.0\n */\nexport const fromHttpClientError = (\n  error: HttpClientError.HttpClientError\n): Option.Option<PermissionErrorPayload> =>\n  error.reason._tag === \"TransportError\" && isPermissionError(error.reason.cause)\n    ? Option.some(error.reason.cause)\n    : Option.none()\n\n/**\n * Constructs an unavailable HTTP client stub.\n *\n * Every request reports the missing host as a `TransportError` naming the\n * request, so an unconfigured capability answers rather than vanishing.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const makeNoop = (): EffectHttpClient.HttpClient =>\n  EffectHttpClient.make((request) =>\n    Effect.fail(\n      new HttpClientError.HttpClientError({\n        reason: new HttpClientError.TransportError({\n          request,\n          cause: new Error(\"HTTP is unavailable on this host\")\n        })\n      })\n    )\n  )\n\n/**\n * Provides an unavailable HTTP client stub.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerNoop = (): Layer.Layer<EffectHttpClient.HttpClient> =>\n  Layer.succeed(EffectHttpClient.HttpClient)(makeNoop())\n\n/**\n * Keeps HTTPS resources host-only so existing grants remain valid. Every\n * other scheme is explicit, which prevents an HTTPS grant from authorizing a\n * cleartext or otherwise different transport.\n */\nconst capabilityFor = (\n  request: HttpClientRequest.HttpClientRequest,\n  modelId: string | undefined\n): Effect.Effect<Capability, PermissionError> => {\n  const action = modelId === undefined\n    ? request.method === \"GET\" || request.method === \"HEAD\" ? \"net:get\" : \"net:post\"\n    : \"model:call\"\n  let url: URL\n  try {\n    url = new URL(request.url)\n  } catch {\n    return makeCapability(action, request.url).pipe(\n      Effect.flatMap((capability) =>\n        Effect.fail(\n          new PermissionDenied({\n            code: \"permission_denied\",\n            capability,\n            reason: \"HTTP capability checks require an absolute, parseable URL\"\n          })\n        )\n      )\n    )\n  }\n  const host = url.host.toLowerCase()\n  const resource = url.protocol === \"https:\" ? host : `${url.protocol}//${host}`\n  return makeCapability(action, modelId === undefined ? resource : `${resource}/${modelId}`)\n}\n\ninterface PreflightAdmission {\n  readonly store: GrantService\n  readonly capability: Capability\n  consumed: boolean\n}\n\nconst Admission = Context.Reference<PreflightAdmission | undefined>(\"@smthrs/kernel/HttpClient/Admission\", {\n  defaultValue: () => undefined\n})\n\n/**\n * Authorizes a request before a caller performs network preflight work such as\n * DNS. The guarded transport consumes the same admission once, so a one-shot\n * grant is not spent twice. Admissions match both store identity and the exact\n * capability; redirects and retries require their own authorization.\n *\n * @category authorization\n * @since 1.0.0\n */\nexport const authorizePreflight = <A, E, R>(\n  request: HttpClientRequest.HttpClientRequest,\n  effect: Effect.Effect<A, E, R>\n): Effect.Effect<A, E | HttpClientError.HttpClientError, R | GrantStore> =>\n  Effect.gen(function*() {\n    const store = yield* GrantStore\n    const capability = yield* Effect.withFiber((fiber) => capabilityFor(request, fiber.getRef(ModelCall))).pipe(\n      Effect.tap((capability) => store.check(capability)),\n      Effect.mapError((error) => toHttpClientError({ request, error }))\n    )\n    return yield* Effect.provideService(effect, Admission, { store, capability, consumed: false })\n  })\n\n/**\n * Forces `redirect: \"manual\"` on the fetch options a fetch-backed client reads\n * at execute time, keeping every other ambient field.\n */\nconst manualRedirects = (context: Context.Context<never>): Context.Context<never> =>\n  Context.add(context, FetchHttpClient.RequestInit, {\n    ...Context.getOrUndefined(context, FetchHttpClient.RequestInit),\n    redirect: \"manual\"\n  })\n\n/**\n * Decorates the HTTP client in place with a `net:get`/`net:post`/`model:call`\n * capability check, then follows redirects *through* that check.\n *\n * The layer provides the tag it also requires: compose it over a host client\n * layer with `Layer.provide` and a consumer that never heard of the kernel is\n * guarded too. Because every hop re-enters the guarded `postprocess`, an\n * authorized first URL that redirects to an unauthorized one is denied at the\n * second hop instead of being fetched.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer: Layer.Layer<\n  EffectHttpClient.HttpClient,\n  never,\n  EffectHttpClient.HttpClient | GrantStore\n> = Layer.effect(\n  EffectHttpClient.HttpClient,\n  Effect.gen(function*() {\n    const client = yield* EffectHttpClient.HttpClient\n    const grants = yield* GrantStore\n    const snapshotted = EffectHttpClient.mapRequestEffect(\n      client,\n      (request) =>\n        Effect.try({\n          try: () => snapshotRequest(request),\n          catch: () => invalidRequest(request)\n        })\n    )\n    const guarded = EffectHttpClient.transform(\n      snapshotted,\n      (execute, request) =>\n        Effect.withFiber((fiber) =>\n          capabilityFor(request, fiber.getRef(ModelCall)).pipe(\n            Effect.flatMap((capability) => {\n              const admission = fiber.getRef(Admission)\n              if (\n                admission !== undefined && !admission.consumed && admission.store === grants\n                && admission.capability.action === capability.action &&\n                admission.capability.resource === capability.resource\n              ) {\n                admission.consumed = true\n                return Effect.void\n              }\n              return grants.check(capability)\n            }),\n            Effect.mapError((error: PermissionError) => toHttpClientError({ request, error })),\n            Effect.andThen(Effect.updateContext(execute, manualRedirects))\n          )\n        )\n    )\n    const followed = EffectHttpClient.followRedirects(guarded)\n    const result = EffectHttpClient.makeWith(\n      (request) =>\n        Effect.withFiber((fiber) =>\n          // Read caller policy before the guard forces manual transport.\n          Context.getOrUndefined(fiber.context, FetchHttpClient.RequestInit)?.redirect === \"manual\"\n            ? guarded.postprocess(request)\n            : followed.postprocess(request)\n        ),\n      guarded.preprocess\n    )\n    return supportsDestinationPinning(client) ? withDestinationPinning(result) : result\n  })\n)\n\n/**\n * Address snapshot authorized for one web request. Host transports must reject\n * a different origin and use only these addresses for every connection attempt.\n * Ordinary model traffic leaves this reference unset.\n * @category references\n * @since 1.0.0\n */\nexport const Destination = Context.Reference<\n  {\n    readonly origin: string\n    readonly addresses: ReadonlyArray<string>\n  } | undefined\n>(\"@smthrs/kernel/HttpClient/Destination\", { defaultValue: () => undefined })\n\nconst pinnedClients = new WeakSet<EffectHttpClient.HttpClient>()\n\n/**\n * Marks a trusted transport that enforces Destination on every connection.\n * The assertion belongs to this client instance, not ambient context. A\n * replacement client must establish its own transport guarantee.\n * @category constructors\n * @since 1.0.0\n */\nexport const withDestinationPinning = <A extends EffectHttpClient.HttpClient>(client: A): A => {\n  pinnedClients.add(client)\n  return client\n}\n\n/**\n * Whether this exact client implements the Destination transport contract.\n * @category predicates\n * @since 1.0.0\n */\nexport const supportsDestinationPinning = (client: EffectHttpClient.HttpClient): boolean => pinnedClients.has(client)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsCA,wBAMO;AACP,oBAA+C;AAC/C,sBAAiC;AACjC,cAAyB;AACzB,eAA0B;AAC1B,uBAAkC;AAClC,sBAAiC;AACjC,wBAAmC;AACnC,gBAA2B;AAC3B,wBAAyD;AACzD,4BAA+B;AA+D/B,wBAA2B;AAS3B,IAAAA,qBAAqB;AAtErB,MAAM,kBAAkB,CAAC,UAA4B;AACnD,MAAI,iBAAiB,WAAW,WAAY,QAAO,MAAM,MAAM;AAC/D,MAAI,iBAAiB,YAAa,QAAO,MAAM,MAAM,CAAC;AACtD,MAAI,iBAAiB,iBAAiB;AACpC,WAAO,IAAI,gBAAgB,KAAK;AAAA,EAClC;AACA,MAAI,iBAAiB,KAAM,QAAO;AAClC,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW;AAC1G,WAAO;AAAA,EACT;AACA,QAAM,IAAI,UAAU,+CAA+C;AACrE;AAEA,MAAM,eAAe,CAAC,SAA+C;AACnE,UAAQ,KAAK,MAAM;AAAA,IACjB,KAAK;AACH,aAAO,SAAS;AAAA,IAClB,KAAK;AACH,aAAO,SAAS,IAAI,gBAAgB,KAAK,IAAI,GAAG;AAAA,QAC9C,aAAa,KAAK;AAAA,QAClB,eAAe,KAAK;AAAA,MACtB,CAAC;AAAA,IACH,KAAK;AACH,aAAO,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG,KAAK,WAAW;AAAA,IAChE,KAAK,YAAY;AACf,YAAM,WAAW,IAAI,WAAW,SAAS;AACzC,iBAAW,CAAC,MAAM,KAAK,KAAK,KAAK,SAAS,QAAQ,EAAG,UAAS,OAAO,MAAM,KAAK;AAChF,aAAO,SAAS,SAAS,QAAQ;AAAA,IACnC;AAAA,IACA,KAAK;AACH,aAAO,SAAS,OAAO,KAAK,QAAQ,KAAK,aAAa,KAAK,aAAa;AAAA,EAC5E;AACF;AAEA,MAAM,kBAAkB,CAAC,YACvB,kBAAkB;AAAA,EAChB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAU;AAAA,IACR,OAAO,OAAO,QAAQ,UAAU,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,OAAO,OAAO,CAAC,MAAM,KAAK,CAAU,CAAC,CAAC;AAAA,EACtG;AAAA,EACA,qBAAO,IAAI,QAAQ,MAAM,CAAC,UAAU,KAAK;AAAA,EACzC,QAAQ,UAAU,QAAQ,OAAO;AAAA,EACjC,aAAa,QAAQ,IAAI;AAC3B;AAEF,MAAM,iBAAiB,CAAC,YACtB,IAAI,gBAAgB,gBAAgB;AAAA,EAClC,QAAQ,IAAI,gBAAgB,eAAe;AAAA,IACzC;AAAA,IACA,aAAa;AAAA,EACf,CAAC;AACH,CAAC;AAgCI,MAAM,YAAmD,sBAAQ;AAAA,EACtE;AAAA,EACA,EAAE,cAAc,MAA0B,OAAU;AACtD;AASO,MAAM,gBAAgB,CAAC,YAAoB,CAAU,WAC1D,qBAAO,eAAe,QAAQ,WAAW,OAAO;AAgB3C,MAAM,oBAAoB,CAAC,YAIhC,IAAI,gBAAgB,gBAAgB;AAAA,EAClC,QAAQ,IAAI,gBAAgB,eAAe;AAAA,IACzC,SAAS,QAAQ;AAAA,IACjB,iBAAa,+BAAY,QAAQ,KAAK;AAAA,IACtC,OAAO,QAAQ;AAAA,EACjB,CAAC;AACH,CAAC;AAcI,MAAM,sBAAsB,CACjC,UAEA,MAAM,OAAO,SAAS,wBAAoB,qCAAkB,MAAM,OAAO,KAAK,IAC1E,qBAAO,KAAK,MAAM,OAAO,KAAK,IAC9B,qBAAO,KAAK;AAWX,MAAM,WAAW,MACtB,iBAAiB;AAAA,EAAK,CAAC,YACrB,qBAAO;AAAA,IACL,IAAI,gBAAgB,gBAAgB;AAAA,MAClC,QAAQ,IAAI,gBAAgB,eAAe;AAAA,QACzC;AAAA,QACA,OAAO,IAAI,MAAM,kCAAkC;AAAA,MACrD,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF;AAQK,MAAM,YAAY,MACvB,oBAAM,QAAQ,iBAAiB,UAAU,EAAE,SAAS,CAAC;AAOvD,MAAM,gBAAgB,CACpB,SACA,YAC+C;AAC/C,QAAM,SAAS,YAAY,SACvB,QAAQ,WAAW,SAAS,QAAQ,WAAW,SAAS,YAAY,aACpE;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC3B,QAAQ;AACN,eAAO,sCAAe,QAAQ,QAAQ,GAAG,EAAE;AAAA,MACzC,qBAAO;AAAA,QAAQ,CAAC,eACd,qBAAO;AAAA,UACL,IAAI,mCAAiB;AAAA,YACnB,MAAM;AAAA,YACN;AAAA,YACA,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,IAAI,KAAK,YAAY;AAClC,QAAM,WAAW,IAAI,aAAa,WAAW,OAAO,GAAG,IAAI,QAAQ,KAAK,IAAI;AAC5E,aAAO,sCAAe,QAAQ,YAAY,SAAY,WAAW,GAAG,QAAQ,IAAI,OAAO,EAAE;AAC3F;AAQA,MAAM,YAAY,sBAAQ,UAA0C,uCAAuC;AAAA,EACzG,cAAc,MAAM;AACtB,CAAC;AAWM,MAAM,qBAAqB,CAChC,SACA,WAEA,qBAAO,IAAI,aAAY;AACrB,QAAM,QAAQ,OAAO;AACrB,QAAM,aAAa,OAAO,qBAAO,UAAU,CAAC,UAAU,cAAc,SAAS,MAAM,OAAO,SAAS,CAAC,CAAC,EAAE;AAAA,IACrG,qBAAO,IAAI,CAACC,gBAAe,MAAM,MAAMA,WAAU,CAAC;AAAA,IAClD,qBAAO,SAAS,CAAC,UAAU,kBAAkB,EAAE,SAAS,MAAM,CAAC,CAAC;AAAA,EAClE;AACA,SAAO,OAAO,qBAAO,eAAe,QAAQ,WAAW,EAAE,OAAO,YAAY,UAAU,MAAM,CAAC;AAC/F,CAAC;AAMH,MAAM,kBAAkB,CAAC,YACvB,sBAAQ,IAAI,SAAS,gBAAgB,aAAa;AAAA,EAChD,GAAG,sBAAQ,eAAe,SAAS,gBAAgB,WAAW;AAAA,EAC9D,UAAU;AACZ,CAAC;AAeI,MAAM,QAIT,oBAAM;AAAA,EACR,iBAAiB;AAAA,EACjB,qBAAO,IAAI,aAAY;AACrB,UAAM,SAAS,OAAO,iBAAiB;AACvC,UAAM,SAAS,OAAO;AACtB,UAAM,cAAc,iBAAiB;AAAA,MACnC;AAAA,MACA,CAAC,YACC,qBAAO,IAAI;AAAA,QACT,KAAK,MAAM,gBAAgB,OAAO;AAAA,QAClC,OAAO,MAAM,eAAe,OAAO;AAAA,MACrC,CAAC;AAAA,IACL;AACA,UAAM,UAAU,iBAAiB;AAAA,MAC/B;AAAA,MACA,CAAC,SAAS,YACR,qBAAO;AAAA,QAAU,CAAC,UAChB,cAAc,SAAS,MAAM,OAAO,SAAS,CAAC,EAAE;AAAA,UAC9C,qBAAO,QAAQ,CAAC,eAAe;AAC7B,kBAAM,YAAY,MAAM,OAAO,SAAS;AACxC,gBACE,cAAc,UAAa,CAAC,UAAU,YAAY,UAAU,UAAU,UACnE,UAAU,WAAW,WAAW,WAAW,UAC9C,UAAU,WAAW,aAAa,WAAW,UAC7C;AACA,wBAAU,WAAW;AACrB,qBAAO,qBAAO;AAAA,YAChB;AACA,mBAAO,OAAO,MAAM,UAAU;AAAA,UAChC,CAAC;AAAA,UACD,qBAAO,SAAS,CAAC,UAA2B,kBAAkB,EAAE,SAAS,MAAM,CAAC,CAAC;AAAA,UACjF,qBAAO,QAAQ,qBAAO,cAAc,SAAS,eAAe,CAAC;AAAA,QAC/D;AAAA,MACF;AAAA,IACJ;AACA,UAAM,WAAW,iBAAiB,gBAAgB,OAAO;AACzD,UAAM,SAAS,iBAAiB;AAAA,MAC9B,CAAC,YACC,qBAAO;AAAA,QAAU,CAAC;AAAA;AAAA,UAEhB,sBAAQ,eAAe,MAAM,SAAS,gBAAgB,WAAW,GAAG,aAAa,WAC7E,QAAQ,YAAY,OAAO,IAC3B,SAAS,YAAY,OAAO;AAAA;AAAA,MAClC;AAAA,MACF,QAAQ;AAAA,IACV;AACA,WAAO,2BAA2B,MAAM,IAAI,uBAAuB,MAAM,IAAI;AAAA,EAC/E,CAAC;AACH;AASO,MAAM,cAAc,sBAAQ,UAKjC,yCAAyC,EAAE,cAAc,MAAM,OAAU,CAAC;AAE5E,MAAM,gBAAgB,oBAAI,QAAqC;AASxD,MAAM,yBAAyB,CAAwC,WAAiB;AAC7F,gBAAc,IAAI,MAAM;AACxB,SAAO;AACT;AAOO,MAAM,6BAA6B,CAAC,WAAiD,cAAc,IAAI,MAAM;",
+  "names": ["import_HttpClient", "capability"]
+}

package/dist/cjs/Jj.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Permission-aware Jujutsu version-control operations.
+ *
+ * There is no kernel `Jj` interface and no kernel `Jj` tag. `@smthrs/jj` owns
+ * both, and its error channel already names the failures the kernel adds, so
+ * this module is only the middleware: a `Layer` over the same tag that reads
+ * the raw service out of context and returns a guarded one in its place.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md`,
+ * `docs/specs/Concepts/Effect Taxonomy.md`, and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Jj } from "@smthrs/jj";
+import { FileSystem as EffectFileSystem, Layer, Path as EffectPath } from "effect";
+import { GrantStore } from "./GrantStore.ts";
+import { Workspace } from "./Workspace.ts";
+/**
+ * `@smthrs/jj`'s own Jujutsu tag, unchanged. Re-exported so the kernel
+ * namespace stays one-stop; it is the *same* tag, never a second one.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export { Jj } from "@smthrs/jj";
+/**
+ * Provides an unavailable Jujutsu stub.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export { layerNoop } from "@smthrs/jj";
+/**
+ * Constructs a Jujutsu service from an implementation.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { make } from "@smthrs/jj";
+/**
+ * Constructs an unavailable Jujutsu stub.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { makeNoop } from "@smthrs/jj";
+/**
+ * Decorates the Jujutsu service in place with operation-specific capability
+ * checks.
+ *
+ * The layer provides the tag it also requires: compose it over a host jj layer
+ * with `Layer.provide` and every consumer of `Jj` — including one that never
+ * heard of the kernel — resolves the guarded implementation.
+ *
+ * `workspaceAdd` canonicalizes its destination and `root` canonicalizes its
+ * starting directory through the *raw* filesystem before asking for
+ * `jj:workspace-add` and `fs:write`, or for `jj:root`, so an existing symlink
+ * cannot turn an inside-workspace grant into outside authority or separate the
+ * authorized path from the directory jj is run in.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: Layer.Layer<Jj, never, Jj | EffectFileSystem.FileSystem | EffectPath.Path | Workspace | GrantStore>;
+//# sourceMappingURL=Jj.d.ts.map

package/dist/cjs/Jj.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jj.d.ts","sourceRoot":"","sources":["../../src/Jj.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,EAAE,EAAmC,MAAM,YAAY,CAAA;AAChE,OAAO,EAAU,UAAU,IAAI,gBAAgB,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE1F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;;GAMG;AACH,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAE/B;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEjC;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAC7B,EAAE,EACF,KAAK,EACL,EAAE,GAAG,gBAAgB,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,GAAG,SAAS,GAAG,UAAU,CAgF5E,CAAA"}

package/dist/cjs/Jj.js

@@ -0,0 +1,118 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Jj_exports = {};
+__export(Jj_exports, {
+  Jj: () => import_jj2.Jj,
+  layer: () => layer,
+  layerNoop: () => import_jj3.layerNoop,
+  make: () => import_jj4.make,
+  makeNoop: () => import_jj5.makeNoop
+});
+module.exports = __toCommonJS(Jj_exports);
+var import_Permission = require("@smthrs/capability/Permission");
+var import_jj = require("@smthrs/jj");
+var import_effect = require("effect");
+var import_FileSystem = require("./FileSystem.js");
+var import_GrantStore = require("./GrantStore.js");
+var import_makeCapability = require("./internal/makeCapability.js");
+var import_Workspace = require("./Workspace.js");
+var import_jj2 = require("@smthrs/jj");
+var import_jj3 = require("@smthrs/jj");
+var import_jj4 = require("@smthrs/jj");
+var import_jj5 = require("@smthrs/jj");
+const layer = import_effect.Layer.effect(
+  import_jj.Jj,
+  import_effect.Effect.gen(function* () {
+    const jj = yield* import_jj.Jj;
+    const jjRoot = jj.root;
+    const jjRevert = jj.revert;
+    const jjOpRestore = jj.opRestore;
+    const fileSystem = yield* import_effect.FileSystem.FileSystem;
+    const path = yield* import_effect.Path.Path;
+    const workspace = yield* import_Workspace.Workspace;
+    const grants = yield* import_GrantStore.GrantStore;
+    const check = (action, resource) => (0, import_makeCapability.makeCapability)(action, resource).pipe(import_effect.Effect.flatMap((capability) => grants.check(capability)));
+    return import_jj.Jj.of({
+      status: import_effect.Effect.fn("Jj.status")(() => check("jj:status", ".").pipe(import_effect.Effect.andThen(jj.status()))),
+      diff: import_effect.Effect.fn("Jj.diff")(
+        (from, to) => check("jj:diff", `${from}:${to}`).pipe(import_effect.Effect.andThen(jj.diff(from, to)))
+      ),
+      snapshot: import_effect.Effect.fn("Jj.snapshot")(
+        (message) => check("jj:snapshot", message ?? "").pipe(import_effect.Effect.andThen(jj.snapshot(message)))
+      ),
+      restore: import_effect.Effect.fn("Jj.restore")(
+        (revision) => check("jj:restore", revision).pipe(import_effect.Effect.andThen(jj.restore(revision)))
+      ),
+      workspaceAdd: import_effect.Effect.fn("Jj.workspaceAdd")(
+        (name, destination, revision) => (0, import_FileSystem.canonicalResource)(fileSystem, path, workspace.root, destination).pipe(
+          import_effect.Effect.flatMap(
+            (resource) => check("jj:workspace-add", resource).pipe(
+              import_effect.Effect.andThen(check("fs:write", resource)),
+              import_effect.Effect.andThen((0, import_FileSystem.canonicalResource)(fileSystem, path, workspace.root, destination)),
+              import_effect.Effect.flatMap(
+                (settled) => settled === resource ? jj.workspaceAdd(name, resource, revision) : (0, import_makeCapability.makeCapability)("jj:workspace-add", resource).pipe(
+                  import_effect.Effect.flatMap(
+                    (capability) => import_effect.Effect.fail((0, import_Permission.permissionDenied)(
+                      capability,
+                      "workspace destination no longer names the resource that was authorized"
+                    ))
+                  )
+                )
+              )
+            )
+          )
+        )
+      ),
+      workspaceForget: import_effect.Effect.fn("Jj.workspaceForget")(
+        (name) => check("jj:workspace-forget", name).pipe(import_effect.Effect.andThen(jj.workspaceForget(name)))
+      ),
+      // `root`, `revert`, and `opRestore` are optional on the service, so the decorator
+      // forwards the ABSENCE too. A backend that cannot revert must keep
+      // reading as a backend that cannot revert: replacing it with a guarded
+      // method that fails on call would turn "this host has no revert" into
+      // "your revert was refused", which is a different answer to a caller
+      // deciding what it can offer.
+      ...jjRoot === void 0 ? {} : {
+        root: import_effect.Effect.fn("Jj.root")(
+          (from) => (
+            // Canonicalized BEFORE the check, and the canonical path is what jj
+            // is then run in. Checking the caller's spelling and inspecting a
+            // different directory is the whole symlink-alias problem: an
+            // authorized name would decide the answer for a repository the grant
+            // never mentioned.
+            (0, import_FileSystem.canonicalResource)(fileSystem, path, workspace.root, from).pipe(
+              import_effect.Effect.flatMap((resource) => check("jj:root", resource).pipe(import_effect.Effect.andThen(jjRoot(resource))))
+            )
+          )
+        )
+      },
+      ...jjRevert === void 0 ? {} : {
+        revert: import_effect.Effect.fn("Jj.revert")(
+          (revision) => check("jj:revert", revision).pipe(import_effect.Effect.andThen(jjRevert(revision)))
+        )
+      },
+      ...jjOpRestore === void 0 ? {} : {
+        opRestore: import_effect.Effect.fn("Jj.opRestore")(
+          (operationId) => check("jj:op-restore", operationId).pipe(import_effect.Effect.andThen(jjOpRestore(operationId)))
+        )
+      }
+    });
+  })
+);
+//# sourceMappingURL=Jj.js.map

package/dist/cjs/Jj.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Jj.ts"],
+  "sourcesContent": ["/**\n * Permission-aware Jujutsu version-control operations.\n *\n * There is no kernel `Jj` interface and no kernel `Jj` tag. `@smthrs/jj` owns\n * both, and its error channel already names the failures the kernel adds, so\n * this module is only the middleware: a `Layer` over the same tag that reads\n * the raw service out of context and returns a guarded one in its place.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md`,\n * `docs/specs/Concepts/Effect Taxonomy.md`, and\n * `docs/specs/Concepts/Host Adapters.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport type { Action } from \"@smthrs/capability/Capability\"\nimport { permissionDenied } from \"@smthrs/capability/Permission\"\nimport { Jj, type OperationId, type Revision } from \"@smthrs/jj\"\nimport { Effect, FileSystem as EffectFileSystem, Layer, Path as EffectPath } from \"effect\"\nimport { canonicalResource } from \"./FileSystem.ts\"\nimport { GrantStore } from \"./GrantStore.ts\"\nimport { makeCapability } from \"./internal/makeCapability.ts\"\nimport { Workspace } from \"./Workspace.ts\"\n\n/**\n * `@smthrs/jj`'s own Jujutsu tag, unchanged. Re-exported so the kernel\n * namespace stays one-stop; it is the *same* tag, never a second one.\n *\n * @category services\n * @since 1.0.0-rc.0\n */\nexport { Jj } from \"@smthrs/jj\"\n\n/**\n * Provides an unavailable Jujutsu stub.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport { layerNoop } from \"@smthrs/jj\"\n\n/**\n * Constructs a Jujutsu service from an implementation.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport { make } from \"@smthrs/jj\"\n\n/**\n * Constructs an unavailable Jujutsu stub.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport { makeNoop } from \"@smthrs/jj\"\n\n/**\n * Decorates the Jujutsu service in place with operation-specific capability\n * checks.\n *\n * The layer provides the tag it also requires: compose it over a host jj layer\n * with `Layer.provide` and every consumer of `Jj` \u2014 including one that never\n * heard of the kernel \u2014 resolves the guarded implementation.\n *\n * `workspaceAdd` canonicalizes its destination and `root` canonicalizes its\n * starting directory through the *raw* filesystem before asking for\n * `jj:workspace-add` and `fs:write`, or for `jj:root`, so an existing symlink\n * cannot turn an inside-workspace grant into outside authority or separate the\n * authorized path from the directory jj is run in.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer: Layer.Layer<\n  Jj,\n  never,\n  Jj | EffectFileSystem.FileSystem | EffectPath.Path | Workspace | GrantStore\n> = Layer.effect(\n  Jj,\n  Effect.gen(function*() {\n    const jj = yield* Jj\n    const jjRoot = jj.root\n    const jjRevert = jj.revert\n    const jjOpRestore = jj.opRestore\n    const fileSystem = yield* EffectFileSystem.FileSystem\n    const path = yield* EffectPath.Path\n    const workspace = yield* Workspace\n    const grants = yield* GrantStore\n    const check = (action: Action, resource: string) =>\n      makeCapability(action, resource).pipe(Effect.flatMap((capability) => grants.check(capability)))\n    return Jj.of({\n      status: Effect.fn(\"Jj.status\")(() => check(\"jj:status\", \".\").pipe(Effect.andThen(jj.status()))),\n      diff: Effect.fn(\"Jj.diff\")((from, to) =>\n        check(\"jj:diff\", `${from}:${to}`).pipe(Effect.andThen(jj.diff(from, to)))\n      ),\n      snapshot: Effect.fn(\"Jj.snapshot\")((message) =>\n        check(\"jj:snapshot\", message ?? \"\").pipe(Effect.andThen(jj.snapshot(message)))\n      ),\n      restore: Effect.fn(\"Jj.restore\")((revision) =>\n        check(\"jj:restore\", revision).pipe(Effect.andThen(jj.restore(revision)))\n      ),\n      workspaceAdd: Effect.fn(\"Jj.workspaceAdd\")((name, destination, revision) =>\n        canonicalResource(fileSystem, path, workspace.root, destination).pipe(\n          Effect.flatMap((resource) =>\n            check(\"jj:workspace-add\", resource).pipe(\n              Effect.andThen(check(\"fs:write\", resource)),\n              Effect.andThen(canonicalResource(fileSystem, path, workspace.root, destination)),\n              Effect.flatMap((settled) =>\n                settled === resource\n                  ? jj.workspaceAdd(name, resource, revision)\n                  : makeCapability(\"jj:workspace-add\", resource).pipe(\n                    Effect.flatMap((capability) =>\n                      Effect.fail(permissionDenied(\n                        capability,\n                        \"workspace destination no longer names the resource that was authorized\"\n                      ))\n                    )\n                  )\n              )\n            )\n          )\n        )\n      ),\n      workspaceForget: Effect.fn(\"Jj.workspaceForget\")((name) =>\n        check(\"jj:workspace-forget\", name).pipe(Effect.andThen(jj.workspaceForget(name)))\n      ),\n      // `root`, `revert`, and `opRestore` are optional on the service, so the decorator\n      // forwards the ABSENCE too. A backend that cannot revert must keep\n      // reading as a backend that cannot revert: replacing it with a guarded\n      // method that fails on call would turn \"this host has no revert\" into\n      // \"your revert was refused\", which is a different answer to a caller\n      // deciding what it can offer.\n      ...jjRoot === undefined ? {} : {\n        root: Effect.fn(\"Jj.root\")((from: string) =>\n          // Canonicalized BEFORE the check, and the canonical path is what jj\n          // is then run in. Checking the caller's spelling and inspecting a\n          // different directory is the whole symlink-alias problem: an\n          // authorized name would decide the answer for a repository the grant\n          // never mentioned.\n          canonicalResource(fileSystem, path, workspace.root, from).pipe(\n            Effect.flatMap((resource) => check(\"jj:root\", resource).pipe(Effect.andThen(jjRoot(resource))))\n          )\n        )\n      },\n      ...jjRevert === undefined ? {} : {\n        revert: Effect.fn(\"Jj.revert\")((revision: Revision) =>\n          check(\"jj:revert\", revision).pipe(Effect.andThen(jjRevert(revision)))\n        )\n      },\n      ...jjOpRestore === undefined ? {} : {\n        opRestore: Effect.fn(\"Jj.opRestore\")((operationId: OperationId) =>\n          check(\"jj:op-restore\", operationId).pipe(Effect.andThen(jjOpRestore(operationId)))\n        )\n      }\n    })\n  })\n)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,wBAAiC;AACjC,gBAAoD;AACpD,oBAAkF;AAClF,wBAAkC;AAClC,wBAA2B;AAC3B,4BAA+B;AAC/B,uBAA0B;AAS1B,IAAAA,aAAmB;AAQnB,IAAAA,aAA0B;AAQ1B,IAAAA,aAAqB;AAQrB,IAAAA,aAAyB;AAmBlB,MAAM,QAIT,oBAAM;AAAA,EACR;AAAA,EACA,qBAAO,IAAI,aAAY;AACrB,UAAM,KAAK,OAAO;AAClB,UAAM,SAAS,GAAG;AAClB,UAAM,WAAW,GAAG;AACpB,UAAM,cAAc,GAAG;AACvB,UAAM,aAAa,OAAO,cAAAC,WAAiB;AAC3C,UAAM,OAAO,OAAO,cAAAC,KAAW;AAC/B,UAAM,YAAY,OAAO;AACzB,UAAM,SAAS,OAAO;AACtB,UAAM,QAAQ,CAAC,QAAgB,iBAC7B,sCAAe,QAAQ,QAAQ,EAAE,KAAK,qBAAO,QAAQ,CAAC,eAAe,OAAO,MAAM,UAAU,CAAC,CAAC;AAChG,WAAO,aAAG,GAAG;AAAA,MACX,QAAQ,qBAAO,GAAG,WAAW,EAAE,MAAM,MAAM,aAAa,GAAG,EAAE,KAAK,qBAAO,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;AAAA,MAC9F,MAAM,qBAAO,GAAG,SAAS;AAAA,QAAE,CAAC,MAAM,OAChC,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,qBAAO,QAAQ,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC;AAAA,MAC1E;AAAA,MACA,UAAU,qBAAO,GAAG,aAAa;AAAA,QAAE,CAAC,YAClC,MAAM,eAAe,WAAW,EAAE,EAAE,KAAK,qBAAO,QAAQ,GAAG,SAAS,OAAO,CAAC,CAAC;AAAA,MAC/E;AAAA,MACA,SAAS,qBAAO,GAAG,YAAY;AAAA,QAAE,CAAC,aAChC,MAAM,cAAc,QAAQ,EAAE,KAAK,qBAAO,QAAQ,GAAG,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACzE;AAAA,MACA,cAAc,qBAAO,GAAG,iBAAiB;AAAA,QAAE,CAAC,MAAM,aAAa,iBAC7D,qCAAkB,YAAY,MAAM,UAAU,MAAM,WAAW,EAAE;AAAA,UAC/D,qBAAO;AAAA,YAAQ,CAAC,aACd,MAAM,oBAAoB,QAAQ,EAAE;AAAA,cAClC,qBAAO,QAAQ,MAAM,YAAY,QAAQ,CAAC;AAAA,cAC1C,qBAAO,YAAQ,qCAAkB,YAAY,MAAM,UAAU,MAAM,WAAW,CAAC;AAAA,cAC/E,qBAAO;AAAA,gBAAQ,CAAC,YACd,YAAY,WACR,GAAG,aAAa,MAAM,UAAU,QAAQ,QACxC,sCAAe,oBAAoB,QAAQ,EAAE;AAAA,kBAC7C,qBAAO;AAAA,oBAAQ,CAAC,eACd,qBAAO,SAAK;AAAA,sBACV;AAAA,sBACA;AAAA,oBACF,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,cACJ;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,iBAAiB,qBAAO,GAAG,oBAAoB;AAAA,QAAE,CAAC,SAChD,MAAM,uBAAuB,IAAI,EAAE,KAAK,qBAAO,QAAQ,GAAG,gBAAgB,IAAI,CAAC,CAAC;AAAA,MAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,GAAG,WAAW,SAAY,CAAC,IAAI;AAAA,QAC7B,MAAM,qBAAO,GAAG,SAAS;AAAA,UAAE,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAM1B,qCAAkB,YAAY,MAAM,UAAU,MAAM,IAAI,EAAE;AAAA,cACxD,qBAAO,QAAQ,CAAC,aAAa,MAAM,WAAW,QAAQ,EAAE,KAAK,qBAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,CAAC;AAAA,YAChG;AAAA;AAAA,QACF;AAAA,MACF;AAAA,MACA,GAAG,aAAa,SAAY,CAAC,IAAI;AAAA,QAC/B,QAAQ,qBAAO,GAAG,WAAW;AAAA,UAAE,CAAC,aAC9B,MAAM,aAAa,QAAQ,EAAE,KAAK,qBAAO,QAAQ,SAAS,QAAQ,CAAC,CAAC;AAAA,QACtE;AAAA,MACF;AAAA,MACA,GAAG,gBAAgB,SAAY,CAAC,IAAI;AAAA,QAClC,WAAW,qBAAO,GAAG,cAAc;AAAA,UAAE,CAAC,gBACpC,MAAM,iBAAiB,WAAW,EAAE,KAAK,qBAAO,QAAQ,YAAY,WAAW,CAAC,CAAC;AAAA,QACnF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;",
+  "names": ["import_jj", "EffectFileSystem", "EffectPath"]
+}

package/dist/cjs/JournalGrantStore.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Journal-backed persistence and replay for capability decisions.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Journal Queue.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Capability from "@smthrs/capability/Capability";
+import { GrantStoreError, Rule } from "@smthrs/capability/Permission";
+import * as JournalModule from "@smthrs/journal/Journal";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as GrantStore from "./GrantStore.ts";
+import { Workspace } from "./Workspace.ts";
+/**
+ * Configuration for a journal-backed grant store.
+ *
+ * `policyRunId` is a deliberately dedicated run containing remembered-policy
+ * events. The journal has no global grant projection, so callers that want
+ * remembered grants to span operational runs must keep this id stable.
+ * `planDigest` binds run grants and envelopes to the exact active plan.
+ * `sourceId` is also checked during replay; events from other producers cannot
+ * activate kernel authority.
+ *
+ * The journal is authoritative permission storage: SqlJournal must use the
+ * `reject` overflow policy. Drop-capable overflow policies are unsupported,
+ * because a dropped grant decision cannot safely be treated as persisted.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface JournalGrantStoreOptions {
+    readonly runId: string;
+    readonly policyRunId: string;
+    readonly sourceId: string;
+    readonly planDigest: string;
+    readonly attended?: boolean;
+    readonly rules?: ReadonlyArray<ReadonlyArray<Rule>>;
+    readonly envelope?: {
+        readonly patterns: ReadonlyArray<Capability.CapabilityPattern>;
+        readonly scope?: "run" | "remembered" | undefined;
+    };
+}
+/**
+ * Makes a grant store that replays remembered policy from, and writes decisions
+ * to, the supplied journal.
+ *
+ * `emitDurable` commits before `GrantStore` activates a remembered or
+ * run-scoped rule (or resolves a denial). Any journal failure is mapped to
+ * `journal_failed`, so permission decisions fail closed.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const make: (options: JournalGrantStoreOptions) => Effect.Effect<GrantStore.Service, GrantStoreError, import("effect/Scope").Scope | Workspace | JournalModule.Journal>;
+/**
+ * Provides a journal-backed `GrantStore`.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: (options: JournalGrantStoreOptions) => Layer.Layer<GrantStore.GrantStore, GrantStoreError, Workspace | JournalModule.Journal>;
+//# sourceMappingURL=JournalGrantStore.d.ts.map

package/dist/cjs/JournalGrantStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JournalGrantStore.d.ts","sourceRoot":"","sources":["../../src/JournalGrantStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AAExD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAIrC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;QAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,CAAA;KAClD,CAAA;CACF;AAoPD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,GAAI,SAAS,wBAAwB,yHAmJlD,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAAI,SAAS,wBAAwB,2FAAuD,CAAA"}