@smthrs/kernel 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/HttpClient.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Permission-aware outgoing HTTP requests.
+ *
+ * There is no kernel `HttpClient` interface and no kernel `HttpClient` tag.
+ * Effect owns both, and its tag fixes the error channel to `HttpClientError`,
+ * so this module is only the middleware: a `Layer` over Effect's own tag that
+ * reads the raw client out of context and returns a guarded one in its place.
+ * Permission failures are projected into `HttpClientError` by
+ * {@link toHttpClientError}, which keeps the structured kernel failure on the
+ * transport reason's `cause` so {@link fromHttpClientError} can hand it back.
+ *
+ * **Redirects.** A redirect is a second network destination, so it needs a
+ * second grant check. Two halves guarantee that:
+ *
+ *  1. The client below this layer must **not** follow redirects on its own.
+ *     That is a precondition on the host: Undici without a redirect
+ *     interceptor, or Effect's fetch layer with `redirect: "manual"`. This
+ *     layer also forces `RequestInit { redirect: "manual" }` over the ambient
+ *     value for every request it executes, so a plain `FetchHttpClient.layer`,
+ *     which follows redirects by default, cannot walk to another origin below
+ *     the guard either. A custom client that ignores `RequestInit` must meet
+ *     the precondition itself.
+ *  2. This layer composes Effect's own `HttpClient.followRedirects` *above*
+ *     the guard. That combinator re-enters `postprocess` for every hop, and
+ *     `postprocess` is the guarded one, so hop *n* is checked exactly like hop
+ *     zero and an authorized origin cannot lend its grant to another.
+ *     A caller that sets `FetchHttpClient.RequestInit.redirect` to `manual`
+ *     receives one guarded hop and owns any further redirect requests itself.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md`,
+ * `docs/specs/Concepts/Effect Taxonomy.md`, and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { type PermissionError, type PermissionErrorPayload } from "@smthrs/capability/Permission";
+import { Context, Effect, Layer, Option } from "effect";
+import * as EffectHttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { GrantStore } from "./GrantStore.ts";
+/**
+ * Effect's own outgoing HTTP client tag, unchanged. Re-exported so the kernel
+ * namespace stays one-stop; it is the *same* tag, never a second one.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export { HttpClient } from "effect/unstable/http/HttpClient";
+/**
+ * Constructs a client from a low-level request runner, keeping Effect's own
+ * URL construction, tracing, header redaction, and interruption behavior.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { make } from "effect/unstable/http/HttpClient";
+/**
+ * The model identity an outgoing request is made on behalf of, if any.
+ *
+ * A model call is not a general `net:*` effect: the same host answers many
+ * models, and a grant for one must not be a grant for the rest. Effect's tag
+ * has no room for an extra method, so the intent rides on a `Context`
+ * reference instead — set it with {@link withModelCall} and the decorator asks
+ * for `model:call` rather than `net:get`/`net:post`.
+ *
+ * @category references
+ * @since 1.0.0-rc.0
+ */
+export declare const ModelCall: Context.Reference<string | undefined>;
+/**
+ * Runs `effect` with every outgoing request in it checked as a `model:call` on
+ * `modelId` instead of as plain network access.
+ *
+ * @category references
+ * @since 1.0.0-rc.0
+ */
+export declare const withModelCall: (modelId: string) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+/**
+ * Projects a permission failure into the error channel Effect's `HttpClient`
+ * tag fixes.
+ *
+ * Nothing is lost: the reason is always a `TransportError` — the request did
+ * not leave the host because the capability kernel refused, suspended, or
+ * could not decide it — `description` carries the human rendering from
+ * `Permission.formatError`, and `cause` carries the structured failure itself,
+ * so {@link fromHttpClientError} hands the attended surface back the original
+ * `capability`, `tier`, `requestId`, and `reason`.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const toHttpClientError: (options: {
+    readonly request: HttpClientRequest.HttpClientRequest;
+    readonly error: PermissionError;
+}) => HttpClientError.HttpClientError;
+/**
+ * Recovers the structured permission failure a {@link toHttpClientError}
+ * projection carries, so an attended surface can still reply to the request
+ * and an unattended report can still name the capability.
+ *
+ * Recovery validates data fields and the transport reason tag, not origin or
+ * class operations. Establish producer or request identity separately across
+ * a trust boundary.
+ *
+ * @category refinements
+ * @since 1.0.0-rc.0
+ */
+export declare const fromHttpClientError: (error: HttpClientError.HttpClientError) => Option.Option<PermissionErrorPayload>;
+/**
+ * Constructs an unavailable HTTP client stub.
+ *
+ * Every request reports the missing host as a `TransportError` naming the
+ * request, so an unconfigured capability answers rather than vanishing.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const makeNoop: () => EffectHttpClient.HttpClient;
+/**
+ * Provides an unavailable HTTP client stub.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerNoop: () => Layer.Layer<EffectHttpClient.HttpClient>;
+/**
+ * Authorizes a request before a caller performs network preflight work such as
+ * DNS. The guarded transport consumes the same admission once, so a one-shot
+ * grant is not spent twice. Admissions match both store identity and the exact
+ * capability; redirects and retries require their own authorization.
+ *
+ * @category authorization
+ * @since 1.0.0
+ */
+export declare const authorizePreflight: <A, E, R>(request: HttpClientRequest.HttpClientRequest, effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | HttpClientError.HttpClientError, R | GrantStore>;
+/**
+ * Decorates the HTTP client in place with a `net:get`/`net:post`/`model:call`
+ * capability check, then follows redirects *through* that check.
+ *
+ * The layer provides the tag it also requires: compose it over a host client
+ * layer with `Layer.provide` and a consumer that never heard of the kernel is
+ * guarded too. Because every hop re-enters the guarded `postprocess`, an
+ * authorized first URL that redirects to an unauthorized one is denied at the
+ * second hop instead of being fetched.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: Layer.Layer<EffectHttpClient.HttpClient, never, EffectHttpClient.HttpClient | GrantStore>;
+/**
+ * Address snapshot authorized for one web request. Host transports must reject
+ * a different origin and use only these addresses for every connection attempt.
+ * Ordinary model traffic leaves this reference unset.
+ * @category references
+ * @since 1.0.0
+ */
+export declare const Destination: Context.Reference<{
+    readonly origin: string;
+    readonly addresses: ReadonlyArray<string>;
+} | undefined>;
+/**
+ * Marks a trusted transport that enforces Destination on every connection.
+ * The assertion belongs to this client instance, not ambient context. A
+ * replacement client must establish its own transport guarantee.
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const withDestinationPinning: <A extends EffectHttpClient.HttpClient>(client: A) => A;
+/**
+ * Whether this exact client implements the Destination transport contract.
+ * @category predicates
+ * @since 1.0.0
+ */
+export declare const supportsDestinationPinning: (client: EffectHttpClient.HttpClient) => boolean;
+//# sourceMappingURL=HttpClient.d.ts.map

package/dist/esm/HttpClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpClient.d.ts","sourceRoot":"","sources":["../../src/HttpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAIvD,OAAO,KAAK,gBAAgB,MAAM,iCAAiC,CAAA;AACnE,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAA;AACvE,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAE3E,OAAO,EAAE,UAAU,EAAgC,MAAM,iBAAiB,CAAA;AAyD1E;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAE5D;;;;;;GAMG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAG3D,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAC/D,CAAA;AAEnD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS;IACzC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAA;IACrD,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAChC,KAAG,eAAe,CAAC,eAOhB,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC9B,OAAO,eAAe,CAAC,eAAe,KACrC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAGpB,CAAA;AAEnB;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,QAAO,gBAAgB,CAAC,UAU1C,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,SAAS,QAAO,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CACZ,CAAA;AA6CxD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACxC,SAAS,iBAAiB,CAAC,iBAAiB,EAC5C,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,eAAe,EAAE,CAAC,GAAG,UAAU,CAQnE,CAAA;AAYJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAC7B,gBAAgB,CAAC,UAAU,EAC3B,KAAK,EACL,gBAAgB,CAAC,UAAU,GAAG,UAAU,CAiDzC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;qBAEH,MAAM;wBACH,aAAa,CAAC,MAAM,CAAC;cAEgC,CAAA;AAI7E;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAG,CAGzF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,QAAQ,gBAAgB,CAAC,UAAU,KAAG,OAAoC,CAAA"}

package/dist/esm/HttpClient.js

@@ -0,0 +1,299 @@
+/**
+ * Permission-aware outgoing HTTP requests.
+ *
+ * There is no kernel `HttpClient` interface and no kernel `HttpClient` tag.
+ * Effect owns both, and its tag fixes the error channel to `HttpClientError`,
+ * so this module is only the middleware: a `Layer` over Effect's own tag that
+ * reads the raw client out of context and returns a guarded one in its place.
+ * Permission failures are projected into `HttpClientError` by
+ * {@link toHttpClientError}, which keeps the structured kernel failure on the
+ * transport reason's `cause` so {@link fromHttpClientError} can hand it back.
+ *
+ * **Redirects.** A redirect is a second network destination, so it needs a
+ * second grant check. Two halves guarantee that:
+ *
+ *  1. The client below this layer must **not** follow redirects on its own.
+ *     That is a precondition on the host: Undici without a redirect
+ *     interceptor, or Effect's fetch layer with `redirect: "manual"`. This
+ *     layer also forces `RequestInit { redirect: "manual" }` over the ambient
+ *     value for every request it executes, so a plain `FetchHttpClient.layer`,
+ *     which follows redirects by default, cannot walk to another origin below
+ *     the guard either. A custom client that ignores `RequestInit` must meet
+ *     the precondition itself.
+ *  2. This layer composes Effect's own `HttpClient.followRedirects` *above*
+ *     the guard. That combinator re-enters `postprocess` for every hop, and
+ *     `postprocess` is the guarded one, so hop *n* is checked exactly like hop
+ *     zero and an authorized origin cannot lend its grant to another.
+ *     A caller that sets `FetchHttpClient.RequestInit.redirect` to `manual`
+ *     receives one guarded hop and owns any further redirect requests itself.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md`,
+ * `docs/specs/Concepts/Effect Taxonomy.md`, and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { formatError, isPermissionError, PermissionDenied } from "@smthrs/capability/Permission";
+import { Context, Effect, Layer, Option } from "effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Headers from "effect/unstable/http/Headers";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as EffectHttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as UrlParams from "effect/unstable/http/UrlParams";
+import { GrantStore } from "./GrantStore.js";
+import { makeCapability } from "./internal/makeCapability.js";
+const snapshotRawBody = (value) => {
+    if (value instanceof globalThis.Uint8Array)
+        return value.slice();
+    if (value instanceof ArrayBuffer)
+        return value.slice(0);
+    if (value instanceof URLSearchParams) {
+        return new URLSearchParams(value);
+    }
+    if (value instanceof Blob)
+        return value;
+    if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+        return value;
+    }
+    throw new TypeError("raw HTTP bodies must be immutable or copyable");
+};
+const snapshotBody = (body) => {
+    switch (body._tag) {
+        case "Empty":
+            return HttpBody.empty;
+        case "Raw":
+            return HttpBody.raw(snapshotRawBody(body.body), {
+                contentType: body.contentType,
+                contentLength: body.contentLength
+            });
+        case "Uint8Array":
+            return HttpBody.uint8Array(body.body.slice(), body.contentType);
+        case "FormData": {
+            const formData = new globalThis.FormData();
+            for (const [name, value] of body.formData.entries())
+                formData.append(name, value);
+            return HttpBody.formData(formData);
+        }
+        case "Stream":
+            return HttpBody.stream(body.stream, body.contentType, body.contentLength);
+    }
+};
+const snapshotRequest = (request) => HttpClientRequest.makeWith(request.method, request.url, UrlParams.make(Object.freeze(request.urlParams.params.map(([name, value]) => Object.freeze([name, value])))), Option.map(request.hash, (value) => value), Headers.fromInput(request.headers), snapshotBody(request.body));
+const invalidRequest = (request) => new HttpClientError.HttpClientError({
+    reason: new HttpClientError.TransportError({
+        request,
+        description: "HTTP request must be an immutable supported request description"
+    })
+});
+/**
+ * Effect's own outgoing HTTP client tag, unchanged. Re-exported so the kernel
+ * namespace stays one-stop; it is the *same* tag, never a second one.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export { HttpClient } from "effect/unstable/http/HttpClient";
+/**
+ * Constructs a client from a low-level request runner, keeping Effect's own
+ * URL construction, tracing, header redaction, and interruption behavior.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { make } from "effect/unstable/http/HttpClient";
+/**
+ * The model identity an outgoing request is made on behalf of, if any.
+ *
+ * A model call is not a general `net:*` effect: the same host answers many
+ * models, and a grant for one must not be a grant for the rest. Effect's tag
+ * has no room for an extra method, so the intent rides on a `Context`
+ * reference instead — set it with {@link withModelCall} and the decorator asks
+ * for `model:call` rather than `net:get`/`net:post`.
+ *
+ * @category references
+ * @since 1.0.0-rc.0
+ */
+export const ModelCall = Context.Reference("@smthrs/kernel/HttpClient/ModelCall", { defaultValue: () => undefined });
+/**
+ * Runs `effect` with every outgoing request in it checked as a `model:call` on
+ * `modelId` instead of as plain network access.
+ *
+ * @category references
+ * @since 1.0.0-rc.0
+ */
+export const withModelCall = (modelId) => (effect) => Effect.provideService(effect, ModelCall, modelId);
+/**
+ * Projects a permission failure into the error channel Effect's `HttpClient`
+ * tag fixes.
+ *
+ * Nothing is lost: the reason is always a `TransportError` — the request did
+ * not leave the host because the capability kernel refused, suspended, or
+ * could not decide it — `description` carries the human rendering from
+ * `Permission.formatError`, and `cause` carries the structured failure itself,
+ * so {@link fromHttpClientError} hands the attended surface back the original
+ * `capability`, `tier`, `requestId`, and `reason`.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export const toHttpClientError = (options) => new HttpClientError.HttpClientError({
+    reason: new HttpClientError.TransportError({
+        request: options.request,
+        description: formatError(options.error),
+        cause: options.error
+    })
+});
+/**
+ * Recovers the structured permission failure a {@link toHttpClientError}
+ * projection carries, so an attended surface can still reply to the request
+ * and an unattended report can still name the capability.
+ *
+ * Recovery validates data fields and the transport reason tag, not origin or
+ * class operations. Establish producer or request identity separately across
+ * a trust boundary.
+ *
+ * @category refinements
+ * @since 1.0.0-rc.0
+ */
+export const fromHttpClientError = (error) => error.reason._tag === "TransportError" && isPermissionError(error.reason.cause)
+    ? Option.some(error.reason.cause)
+    : Option.none();
+/**
+ * Constructs an unavailable HTTP client stub.
+ *
+ * Every request reports the missing host as a `TransportError` naming the
+ * request, so an unconfigured capability answers rather than vanishing.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export const makeNoop = () => EffectHttpClient.make((request) => Effect.fail(new HttpClientError.HttpClientError({
+    reason: new HttpClientError.TransportError({
+        request,
+        cause: new Error("HTTP is unavailable on this host")
+    })
+})));
+/**
+ * Provides an unavailable HTTP client stub.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export const layerNoop = () => Layer.succeed(EffectHttpClient.HttpClient)(makeNoop());
+/**
+ * Keeps HTTPS resources host-only so existing grants remain valid. Every
+ * other scheme is explicit, which prevents an HTTPS grant from authorizing a
+ * cleartext or otherwise different transport.
+ */
+const capabilityFor = (request, modelId) => {
+    const action = modelId === undefined
+        ? request.method === "GET" || request.method === "HEAD" ? "net:get" : "net:post"
+        : "model:call";
+    let url;
+    try {
+        url = new URL(request.url);
+    }
+    catch {
+        return makeCapability(action, request.url).pipe(Effect.flatMap((capability) => Effect.fail(new PermissionDenied({
+            code: "permission_denied",
+            capability,
+            reason: "HTTP capability checks require an absolute, parseable URL"
+        }))));
+    }
+    const host = url.host.toLowerCase();
+    const resource = url.protocol === "https:" ? host : `${url.protocol}//${host}`;
+    return makeCapability(action, modelId === undefined ? resource : `${resource}/${modelId}`);
+};
+const Admission = Context.Reference("@smthrs/kernel/HttpClient/Admission", {
+    defaultValue: () => undefined
+});
+/**
+ * Authorizes a request before a caller performs network preflight work such as
+ * DNS. The guarded transport consumes the same admission once, so a one-shot
+ * grant is not spent twice. Admissions match both store identity and the exact
+ * capability; redirects and retries require their own authorization.
+ *
+ * @category authorization
+ * @since 1.0.0
+ */
+export const authorizePreflight = (request, effect) => Effect.gen(function* () {
+    const store = yield* GrantStore;
+    const capability = yield* Effect.withFiber((fiber) => capabilityFor(request, fiber.getRef(ModelCall))).pipe(Effect.tap((capability) => store.check(capability)), Effect.mapError((error) => toHttpClientError({ request, error })));
+    return yield* Effect.provideService(effect, Admission, { store, capability, consumed: false });
+});
+/**
+ * Forces `redirect: "manual"` on the fetch options a fetch-backed client reads
+ * at execute time, keeping every other ambient field.
+ */
+const manualRedirects = (context) => Context.add(context, FetchHttpClient.RequestInit, {
+    ...Context.getOrUndefined(context, FetchHttpClient.RequestInit),
+    redirect: "manual"
+});
+/**
+ * Decorates the HTTP client in place with a `net:get`/`net:post`/`model:call`
+ * capability check, then follows redirects *through* that check.
+ *
+ * The layer provides the tag it also requires: compose it over a host client
+ * layer with `Layer.provide` and a consumer that never heard of the kernel is
+ * guarded too. Because every hop re-enters the guarded `postprocess`, an
+ * authorized first URL that redirects to an unauthorized one is denied at the
+ * second hop instead of being fetched.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export const layer = Layer.effect(EffectHttpClient.HttpClient, Effect.gen(function* () {
+    const client = yield* EffectHttpClient.HttpClient;
+    const grants = yield* GrantStore;
+    const snapshotted = EffectHttpClient.mapRequestEffect(client, (request) => Effect.try({
+        try: () => snapshotRequest(request),
+        catch: () => invalidRequest(request)
+    }));
+    const guarded = EffectHttpClient.transform(snapshotted, (execute, request) => Effect.withFiber((fiber) => capabilityFor(request, fiber.getRef(ModelCall)).pipe(Effect.flatMap((capability) => {
+        const admission = fiber.getRef(Admission);
+        if (admission !== undefined && !admission.consumed && admission.store === grants
+            && admission.capability.action === capability.action &&
+            admission.capability.resource === capability.resource) {
+            admission.consumed = true;
+            return Effect.void;
+        }
+        return grants.check(capability);
+    }), Effect.mapError((error) => toHttpClientError({ request, error })), Effect.andThen(Effect.updateContext(execute, manualRedirects)))));
+    const followed = EffectHttpClient.followRedirects(guarded);
+    const result = EffectHttpClient.makeWith((request) => Effect.withFiber((fiber) => 
+    // Read caller policy before the guard forces manual transport.
+    Context.getOrUndefined(fiber.context, FetchHttpClient.RequestInit)?.redirect === "manual"
+        ? guarded.postprocess(request)
+        : followed.postprocess(request)), guarded.preprocess);
+    return supportsDestinationPinning(client) ? withDestinationPinning(result) : result;
+}));
+/**
+ * Address snapshot authorized for one web request. Host transports must reject
+ * a different origin and use only these addresses for every connection attempt.
+ * Ordinary model traffic leaves this reference unset.
+ * @category references
+ * @since 1.0.0
+ */
+export const Destination = Context.Reference("@smthrs/kernel/HttpClient/Destination", { defaultValue: () => undefined });
+const pinnedClients = new WeakSet();
+/**
+ * Marks a trusted transport that enforces Destination on every connection.
+ * The assertion belongs to this client instance, not ambient context. A
+ * replacement client must establish its own transport guarantee.
+ * @category constructors
+ * @since 1.0.0
+ */
+export const withDestinationPinning = (client) => {
+    pinnedClients.add(client);
+    return client;
+};
+/**
+ * Whether this exact client implements the Destination transport contract.
+ * @category predicates
+ * @since 1.0.0
+ */
+export const supportsDestinationPinning = (client) => pinnedClients.has(client);
+//# sourceMappingURL=HttpClient.js.map

package/dist/esm/HttpClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpClient.js","sourceRoot":"","sources":["../../src/HttpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAGjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvD,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAA;AACvE,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,+BAA+B,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,iCAAiC,CAAA;AACnE,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAA;AACvE,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,KAAK,SAAS,MAAM,gCAAgC,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAgC,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAE7D,MAAM,eAAe,GAAG,CAAC,KAAc,EAAW,EAAE;IAClD,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAA;IAChE,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3G,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,IAAuB,EAAqB,EAAE;IAClE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,KAAK,CAAA;QACvB,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAA;QACJ,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QACjE,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAA;YAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACjF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,OAA4C,EAAuC,EAAE,CAC5G,iBAAiB,CAAC,QAAQ,CACxB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,EACX,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC,CAAC,CAAC,CACtG,EACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAC1C,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAClC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAC3B,CAAA;AAEH,MAAM,cAAc,GAAG,CAAC,OAA4C,EAAmC,EAAE,CACvG,IAAI,eAAe,CAAC,eAAe,CAAC;IAClC,MAAM,EAAE,IAAI,eAAe,CAAC,cAAc,CAAC;QACzC,OAAO;QACP,WAAW,EAAE,iEAAiE;KAC/E,CAAC;CACH,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAE5D;;;;;;GAMG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAA0C,OAAO,CAAC,SAAS,CAC/E,qCAAqC,EACrC,EAAE,YAAY,EAAE,GAAuB,EAAE,CAAC,SAAS,EAAE,CACtD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAU,MAA8B,EAA0B,EAAE,CACpH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAGjC,EAAmC,EAAE,CACpC,IAAI,eAAe,CAAC,eAAe,CAAC;IAClC,MAAM,EAAE,IAAI,eAAe,CAAC,cAAc,CAAC;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;CACH,CAAC,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,KAAsC,EACC,EAAE,CACzC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7E,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;AAEnB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAgC,EAAE,CACxD,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAChC,MAAM,CAAC,IAAI,CACT,IAAI,eAAe,CAAC,eAAe,CAAC;IAClC,MAAM,EAAE,IAAI,eAAe,CAAC,cAAc,CAAC;QACzC,OAAO;QACP,KAAK,EAAE,IAAI,KAAK,CAAC,kCAAkC,CAAC;KACrD,CAAC;CACH,CAAC,CACH,CACF,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAA6C,EAAE,CACtE,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;AAExD;;;;GAIG;AACH,MAAM,aAAa,GAAG,CACpB,OAA4C,EAC5C,OAA2B,EACiB,EAAE;IAC9C,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS;QAClC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAChF,CAAC,CAAC,YAAY,CAAA;IAChB,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5B,MAAM,CAAC,IAAI,CACT,IAAI,gBAAgB,CAAC;YACnB,IAAI,EAAE,mBAAmB;YACzB,UAAU;YACV,MAAM,EAAE,2DAA2D;SACpE,CAAC,CACH,CACF,CACF,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAA;IAC9E,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAA;AAC5F,CAAC,CAAA;AAQD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAiC,qCAAqC,EAAE;IACzG,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS;CAC9B,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAA4C,EAC5C,MAA8B,EACyC,EAAE,CACzE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAA;IAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CACzG,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAClE,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;AAChG,CAAC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAA+B,EAA0B,EAAE,CAClF,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE;IAChD,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,WAAW,CAAC;IAC/D,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAA;AAEJ;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,KAAK,GAId,KAAK,CAAC,MAAM,CACd,gBAAgB,CAAC,UAAU,EAC3B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAA;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAA;IAChC,MAAM,WAAW,GAAG,gBAAgB,CAAC,gBAAgB,CACnD,MAAM,EACN,CAAC,OAAO,EAAE,EAAE,CACV,MAAM,CAAC,GAAG,CAAC;QACT,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC;QACnC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;KACrC,CAAC,CACL,CAAA;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACxC,WAAW,EACX,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CACnB,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACzC,IACE,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM;eACzE,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACpD,SAAS,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EACrD,CAAC;YACD,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAA;YACzB,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACjC,CAAC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAsB,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAClF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAC/D,CACF,CACJ,CAAA;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CACtC,CAAC,OAAO,EAAE,EAAE,CACV,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;IACzB,+DAA+D;IAC/D,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,QAAQ,KAAK,QAAQ;QACvF,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAClC,EACH,OAAO,CAAC,UAAU,CACnB,CAAA;IACD,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACrF,CAAC,CAAC,CACH,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAK1C,uCAAuC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;AAE7E,MAAM,aAAa,GAAG,IAAI,OAAO,EAA+B,CAAA;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAwC,MAAS,EAAK,EAAE;IAC5F,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzB,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,MAAmC,EAAW,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA","sourcesContent":["/**\n * Permission-aware outgoing HTTP requests.\n *\n * There is no kernel `HttpClient` interface and no kernel `HttpClient` tag.\n * Effect owns both, and its tag fixes the error channel to `HttpClientError`,\n * so this module is only the middleware: a `Layer` over Effect's own tag that\n * reads the raw client out of context and returns a guarded one in its place.\n * Permission failures are projected into `HttpClientError` by\n * {@link toHttpClientError}, which keeps the structured kernel failure on the\n * transport reason's `cause` so {@link fromHttpClientError} can hand it back.\n *\n * **Redirects.** A redirect is a second network destination, so it needs a\n * second grant check. Two halves guarantee that:\n *\n *  1. The client below this layer must **not** follow redirects on its own.\n *     That is a precondition on the host: Undici without a redirect\n *     interceptor, or Effect's fetch layer with `redirect: \"manual\"`. This\n *     layer also forces `RequestInit { redirect: \"manual\" }` over the ambient\n *     value for every request it executes, so a plain `FetchHttpClient.layer`,\n *     which follows redirects by default, cannot walk to another origin below\n *     the guard either. A custom client that ignores `RequestInit` must meet\n *     the precondition itself.\n *  2. This layer composes Effect's own `HttpClient.followRedirects` *above*\n *     the guard. That combinator re-enters `postprocess` for every hop, and\n *     `postprocess` is the guarded one, so hop *n* is checked exactly like hop\n *     zero and an authorized origin cannot lend its grant to another.\n *     A caller that sets `FetchHttpClient.RequestInit.redirect` to `manual`\n *     receives one guarded hop and owns any further redirect requests itself.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md`,\n * `docs/specs/Concepts/Effect Taxonomy.md`, and\n * `docs/specs/Concepts/Host Adapters.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport type { Capability } from \"@smthrs/capability/Capability\"\nimport {\n  formatError,\n  isPermissionError,\n  PermissionDenied,\n  type PermissionError,\n  type PermissionErrorPayload\n} from \"@smthrs/capability/Permission\"\nimport { Context, Effect, Layer, Option } from \"effect\"\nimport * as FetchHttpClient from \"effect/unstable/http/FetchHttpClient\"\nimport * as Headers from \"effect/unstable/http/Headers\"\nimport * as HttpBody from \"effect/unstable/http/HttpBody\"\nimport * as EffectHttpClient from \"effect/unstable/http/HttpClient\"\nimport * as HttpClientError from \"effect/unstable/http/HttpClientError\"\nimport * as HttpClientRequest from \"effect/unstable/http/HttpClientRequest\"\nimport * as UrlParams from \"effect/unstable/http/UrlParams\"\nimport { GrantStore, type Service as GrantService } from \"./GrantStore.ts\"\nimport { makeCapability } from \"./internal/makeCapability.ts\"\n\nconst snapshotRawBody = (value: unknown): unknown => {\n  if (value instanceof globalThis.Uint8Array) return value.slice()\n  if (value instanceof ArrayBuffer) return value.slice(0)\n  if (value instanceof URLSearchParams) {\n    return new URLSearchParams(value)\n  }\n  if (value instanceof Blob) return value\n  if (value === null || typeof value === \"string\" || typeof value === \"number\" || typeof value === \"boolean\") {\n    return value\n  }\n  throw new TypeError(\"raw HTTP bodies must be immutable or copyable\")\n}\n\nconst snapshotBody = (body: HttpBody.HttpBody): HttpBody.HttpBody => {\n  switch (body._tag) {\n    case \"Empty\":\n      return HttpBody.empty\n    case \"Raw\":\n      return HttpBody.raw(snapshotRawBody(body.body), {\n        contentType: body.contentType,\n        contentLength: body.contentLength\n      })\n    case \"Uint8Array\":\n      return HttpBody.uint8Array(body.body.slice(), body.contentType)\n    case \"FormData\": {\n      const formData = new globalThis.FormData()\n      for (const [name, value] of body.formData.entries()) formData.append(name, value)\n      return HttpBody.formData(formData)\n    }\n    case \"Stream\":\n      return HttpBody.stream(body.stream, body.contentType, body.contentLength)\n  }\n}\n\nconst snapshotRequest = (request: HttpClientRequest.HttpClientRequest): HttpClientRequest.HttpClientRequest =>\n  HttpClientRequest.makeWith(\n    request.method,\n    request.url,\n    UrlParams.make(\n      Object.freeze(request.urlParams.params.map(([name, value]) => Object.freeze([name, value] as const)))\n    ),\n    Option.map(request.hash, (value) => value),\n    Headers.fromInput(request.headers),\n    snapshotBody(request.body)\n  )\n\nconst invalidRequest = (request: HttpClientRequest.HttpClientRequest): HttpClientError.HttpClientError =>\n  new HttpClientError.HttpClientError({\n    reason: new HttpClientError.TransportError({\n      request,\n      description: \"HTTP request must be an immutable supported request description\"\n    })\n  })\n\n/**\n * Effect's own outgoing HTTP client tag, unchanged. Re-exported so the kernel\n * namespace stays one-stop; it is the *same* tag, never a second one.\n *\n * @category services\n * @since 1.0.0-rc.0\n */\nexport { HttpClient } from \"effect/unstable/http/HttpClient\"\n\n/**\n * Constructs a client from a low-level request runner, keeping Effect's own\n * URL construction, tracing, header redaction, and interruption behavior.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport { make } from \"effect/unstable/http/HttpClient\"\n\n/**\n * The model identity an outgoing request is made on behalf of, if any.\n *\n * A model call is not a general `net:*` effect: the same host answers many\n * models, and a grant for one must not be a grant for the rest. Effect's tag\n * has no room for an extra method, so the intent rides on a `Context`\n * reference instead — set it with {@link withModelCall} and the decorator asks\n * for `model:call` rather than `net:get`/`net:post`.\n *\n * @category references\n * @since 1.0.0-rc.0\n */\nexport const ModelCall: Context.Reference<string | undefined> = Context.Reference<string | undefined>(\n  \"@smthrs/kernel/HttpClient/ModelCall\",\n  { defaultValue: (): string | undefined => undefined }\n)\n\n/**\n * Runs `effect` with every outgoing request in it checked as a `model:call` on\n * `modelId` instead of as plain network access.\n *\n * @category references\n * @since 1.0.0-rc.0\n */\nexport const withModelCall = (modelId: string) => <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n  Effect.provideService(effect, ModelCall, modelId)\n\n/**\n * Projects a permission failure into the error channel Effect's `HttpClient`\n * tag fixes.\n *\n * Nothing is lost: the reason is always a `TransportError` — the request did\n * not leave the host because the capability kernel refused, suspended, or\n * could not decide it — `description` carries the human rendering from\n * `Permission.formatError`, and `cause` carries the structured failure itself,\n * so {@link fromHttpClientError} hands the attended surface back the original\n * `capability`, `tier`, `requestId`, and `reason`.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const toHttpClientError = (options: {\n  readonly request: HttpClientRequest.HttpClientRequest\n  readonly error: PermissionError\n}): HttpClientError.HttpClientError =>\n  new HttpClientError.HttpClientError({\n    reason: new HttpClientError.TransportError({\n      request: options.request,\n      description: formatError(options.error),\n      cause: options.error\n    })\n  })\n\n/**\n * Recovers the structured permission failure a {@link toHttpClientError}\n * projection carries, so an attended surface can still reply to the request\n * and an unattended report can still name the capability.\n *\n * Recovery validates data fields and the transport reason tag, not origin or\n * class operations. Establish producer or request identity separately across\n * a trust boundary.\n *\n * @category refinements\n * @since 1.0.0-rc.0\n */\nexport const fromHttpClientError = (\n  error: HttpClientError.HttpClientError\n): Option.Option<PermissionErrorPayload> =>\n  error.reason._tag === \"TransportError\" && isPermissionError(error.reason.cause)\n    ? Option.some(error.reason.cause)\n    : Option.none()\n\n/**\n * Constructs an unavailable HTTP client stub.\n *\n * Every request reports the missing host as a `TransportError` naming the\n * request, so an unconfigured capability answers rather than vanishing.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const makeNoop = (): EffectHttpClient.HttpClient =>\n  EffectHttpClient.make((request) =>\n    Effect.fail(\n      new HttpClientError.HttpClientError({\n        reason: new HttpClientError.TransportError({\n          request,\n          cause: new Error(\"HTTP is unavailable on this host\")\n        })\n      })\n    )\n  )\n\n/**\n * Provides an unavailable HTTP client stub.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerNoop = (): Layer.Layer<EffectHttpClient.HttpClient> =>\n  Layer.succeed(EffectHttpClient.HttpClient)(makeNoop())\n\n/**\n * Keeps HTTPS resources host-only so existing grants remain valid. Every\n * other scheme is explicit, which prevents an HTTPS grant from authorizing a\n * cleartext or otherwise different transport.\n */\nconst capabilityFor = (\n  request: HttpClientRequest.HttpClientRequest,\n  modelId: string | undefined\n): Effect.Effect<Capability, PermissionError> => {\n  const action = modelId === undefined\n    ? request.method === \"GET\" || request.method === \"HEAD\" ? \"net:get\" : \"net:post\"\n    : \"model:call\"\n  let url: URL\n  try {\n    url = new URL(request.url)\n  } catch {\n    return makeCapability(action, request.url).pipe(\n      Effect.flatMap((capability) =>\n        Effect.fail(\n          new PermissionDenied({\n            code: \"permission_denied\",\n            capability,\n            reason: \"HTTP capability checks require an absolute, parseable URL\"\n          })\n        )\n      )\n    )\n  }\n  const host = url.host.toLowerCase()\n  const resource = url.protocol === \"https:\" ? host : `${url.protocol}//${host}`\n  return makeCapability(action, modelId === undefined ? resource : `${resource}/${modelId}`)\n}\n\ninterface PreflightAdmission {\n  readonly store: GrantService\n  readonly capability: Capability\n  consumed: boolean\n}\n\nconst Admission = Context.Reference<PreflightAdmission | undefined>(\"@smthrs/kernel/HttpClient/Admission\", {\n  defaultValue: () => undefined\n})\n\n/**\n * Authorizes a request before a caller performs network preflight work such as\n * DNS. The guarded transport consumes the same admission once, so a one-shot\n * grant is not spent twice. Admissions match both store identity and the exact\n * capability; redirects and retries require their own authorization.\n *\n * @category authorization\n * @since 1.0.0\n */\nexport const authorizePreflight = <A, E, R>(\n  request: HttpClientRequest.HttpClientRequest,\n  effect: Effect.Effect<A, E, R>\n): Effect.Effect<A, E | HttpClientError.HttpClientError, R | GrantStore> =>\n  Effect.gen(function*() {\n    const store = yield* GrantStore\n    const capability = yield* Effect.withFiber((fiber) => capabilityFor(request, fiber.getRef(ModelCall))).pipe(\n      Effect.tap((capability) => store.check(capability)),\n      Effect.mapError((error) => toHttpClientError({ request, error }))\n    )\n    return yield* Effect.provideService(effect, Admission, { store, capability, consumed: false })\n  })\n\n/**\n * Forces `redirect: \"manual\"` on the fetch options a fetch-backed client reads\n * at execute time, keeping every other ambient field.\n */\nconst manualRedirects = (context: Context.Context<never>): Context.Context<never> =>\n  Context.add(context, FetchHttpClient.RequestInit, {\n    ...Context.getOrUndefined(context, FetchHttpClient.RequestInit),\n    redirect: \"manual\"\n  })\n\n/**\n * Decorates the HTTP client in place with a `net:get`/`net:post`/`model:call`\n * capability check, then follows redirects *through* that check.\n *\n * The layer provides the tag it also requires: compose it over a host client\n * layer with `Layer.provide` and a consumer that never heard of the kernel is\n * guarded too. Because every hop re-enters the guarded `postprocess`, an\n * authorized first URL that redirects to an unauthorized one is denied at the\n * second hop instead of being fetched.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer: Layer.Layer<\n  EffectHttpClient.HttpClient,\n  never,\n  EffectHttpClient.HttpClient | GrantStore\n> = Layer.effect(\n  EffectHttpClient.HttpClient,\n  Effect.gen(function*() {\n    const client = yield* EffectHttpClient.HttpClient\n    const grants = yield* GrantStore\n    const snapshotted = EffectHttpClient.mapRequestEffect(\n      client,\n      (request) =>\n        Effect.try({\n          try: () => snapshotRequest(request),\n          catch: () => invalidRequest(request)\n        })\n    )\n    const guarded = EffectHttpClient.transform(\n      snapshotted,\n      (execute, request) =>\n        Effect.withFiber((fiber) =>\n          capabilityFor(request, fiber.getRef(ModelCall)).pipe(\n            Effect.flatMap((capability) => {\n              const admission = fiber.getRef(Admission)\n              if (\n                admission !== undefined && !admission.consumed && admission.store === grants\n                && admission.capability.action === capability.action &&\n                admission.capability.resource === capability.resource\n              ) {\n                admission.consumed = true\n                return Effect.void\n              }\n              return grants.check(capability)\n            }),\n            Effect.mapError((error: PermissionError) => toHttpClientError({ request, error })),\n            Effect.andThen(Effect.updateContext(execute, manualRedirects))\n          )\n        )\n    )\n    const followed = EffectHttpClient.followRedirects(guarded)\n    const result = EffectHttpClient.makeWith(\n      (request) =>\n        Effect.withFiber((fiber) =>\n          // Read caller policy before the guard forces manual transport.\n          Context.getOrUndefined(fiber.context, FetchHttpClient.RequestInit)?.redirect === \"manual\"\n            ? guarded.postprocess(request)\n            : followed.postprocess(request)\n        ),\n      guarded.preprocess\n    )\n    return supportsDestinationPinning(client) ? withDestinationPinning(result) : result\n  })\n)\n\n/**\n * Address snapshot authorized for one web request. Host transports must reject\n * a different origin and use only these addresses for every connection attempt.\n * Ordinary model traffic leaves this reference unset.\n * @category references\n * @since 1.0.0\n */\nexport const Destination = Context.Reference<\n  {\n    readonly origin: string\n    readonly addresses: ReadonlyArray<string>\n  } | undefined\n>(\"@smthrs/kernel/HttpClient/Destination\", { defaultValue: () => undefined })\n\nconst pinnedClients = new WeakSet<EffectHttpClient.HttpClient>()\n\n/**\n * Marks a trusted transport that enforces Destination on every connection.\n * The assertion belongs to this client instance, not ambient context. A\n * replacement client must establish its own transport guarantee.\n * @category constructors\n * @since 1.0.0\n */\nexport const withDestinationPinning = <A extends EffectHttpClient.HttpClient>(client: A): A => {\n  pinnedClients.add(client)\n  return client\n}\n\n/**\n * Whether this exact client implements the Destination transport contract.\n * @category predicates\n * @since 1.0.0\n */\nexport const supportsDestinationPinning = (client: EffectHttpClient.HttpClient): boolean => pinnedClients.has(client)\n"]}

package/dist/esm/Jj.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Permission-aware Jujutsu version-control operations.
+ *
+ * There is no kernel `Jj` interface and no kernel `Jj` tag. `@smthrs/jj` owns
+ * both, and its error channel already names the failures the kernel adds, so
+ * this module is only the middleware: a `Layer` over the same tag that reads
+ * the raw service out of context and returns a guarded one in its place.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md`,
+ * `docs/specs/Concepts/Effect Taxonomy.md`, and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Jj } from "@smthrs/jj";
+import { FileSystem as EffectFileSystem, Layer, Path as EffectPath } from "effect";
+import { GrantStore } from "./GrantStore.ts";
+import { Workspace } from "./Workspace.ts";
+/**
+ * `@smthrs/jj`'s own Jujutsu tag, unchanged. Re-exported so the kernel
+ * namespace stays one-stop; it is the *same* tag, never a second one.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export { Jj } from "@smthrs/jj";
+/**
+ * Provides an unavailable Jujutsu stub.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export { layerNoop } from "@smthrs/jj";
+/**
+ * Constructs a Jujutsu service from an implementation.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { make } from "@smthrs/jj";
+/**
+ * Constructs an unavailable Jujutsu stub.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { makeNoop } from "@smthrs/jj";
+/**
+ * Decorates the Jujutsu service in place with operation-specific capability
+ * checks.
+ *
+ * The layer provides the tag it also requires: compose it over a host jj layer
+ * with `Layer.provide` and every consumer of `Jj` — including one that never
+ * heard of the kernel — resolves the guarded implementation.
+ *
+ * `workspaceAdd` canonicalizes its destination and `root` canonicalizes its
+ * starting directory through the *raw* filesystem before asking for
+ * `jj:workspace-add` and `fs:write`, or for `jj:root`, so an existing symlink
+ * cannot turn an inside-workspace grant into outside authority or separate the
+ * authorized path from the directory jj is run in.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: Layer.Layer<Jj, never, Jj | EffectFileSystem.FileSystem | EffectPath.Path | Workspace | GrantStore>;
+//# sourceMappingURL=Jj.d.ts.map

package/dist/esm/Jj.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jj.d.ts","sourceRoot":"","sources":["../../src/Jj.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,EAAE,EAAmC,MAAM,YAAY,CAAA;AAChE,OAAO,EAAU,UAAU,IAAI,gBAAgB,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE1F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;;GAMG;AACH,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAE/B;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEjC;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAC7B,EAAE,EACF,KAAK,EACL,EAAE,GAAG,gBAAgB,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,GAAG,SAAS,GAAG,UAAU,CAgF5E,CAAA"}