@yielded/auth 0.1.0-beta.1

package/dist/operations/operation.d.mts

@@ -0,0 +1,124 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationBoundaryError, OperationForbidden, OperationPrivateOutputUnsupported } from "./errors.mjs";
+import { AuthInvocation } from "./context.mjs";
+import { AuthRevealCommandCollector, AuthRevealKind } from "./reveals.mjs";
+import { AuthCredentialCommandCollector, AuthCredentialCommandSink, AuthOperationResult, AuthRevealCommandCollectorService } from "./credentials.mjs";
+import { Effect, Layer, Schema, Types } from "effect";
+import { Rpc, RpcGroup } from "effect/unstable/rpc";
+//#region src/operations/operation.d.ts
+/** Equal operation names only satisfy handlers with the same decoded contract. */
+interface OperationHandler<Tag extends string, Payload, Success, Error> {
+  readonly _tag: "effect-auth/OperationHandler";
+  readonly operation: Tag;
+  readonly contract: Types.Invariant<readonly [Payload, Success, Error]>;
+}
+type OperationAccess = "any" | "authenticated" | "system";
+type OperationExposure = "public" | "internal";
+/** Metadata documents the handler's durable guarantee; it does not implement deduplication. */
+type OperationReplay = "read-only" | "idempotent" | "single-use" | "non-idempotent";
+interface OperationOptions<Payload extends Schema.Top, Success extends Schema.Top, Error extends Schema.Top, PolicyServices> {
+  readonly payload: Payload;
+  readonly success: Success;
+  readonly error: Error;
+  readonly access: OperationAccess;
+  readonly exposure?: OperationExposure;
+  readonly replay: OperationReplay;
+  readonly authorize?: (payload: Payload["Type"], context: AuthInvocation) => Effect.Effect<void, Error["Type"] | OperationBoundaryError, PolicyServices>;
+}
+type OptionProperty<Options, Key extends PropertyKey> = Key extends keyof Options ? Options[Key] : never;
+type CredentialRequirement<Credentials> = true extends Credentials ? AuthCredentialCommandCollector : never;
+type RevealValue<Reveals> = Exclude<Reveals, undefined>;
+type RevealRequirement<Reveals> = [RevealValue<Reveals>] extends [never] ? never : RevealValue<Reveals> extends ReadonlyArray<AuthRevealKind> ? AuthRevealCommandCollectorService : never;
+declare const credentialCollectorProvenance: unique symbol;
+declare const revealCollectorProvenance: unique symbol;
+interface CredentialCollectorProvenance {
+  readonly [credentialCollectorProvenance]: never;
+}
+interface RevealCollectorProvenance {
+  readonly [revealCollectorProvenance]: never;
+}
+type PrivateCollectorProvenance = CredentialCollectorProvenance | RevealCollectorProvenance;
+type PrivateRequirements<Credentials, Reveals> = CredentialRequirement<Credentials> | RevealRequirement<Reveals>;
+type ResolvedCollectorServices<Credentials, Reveals> = ([Credentials] extends [true] ? CredentialRequirement<Credentials> : never) | ([Reveals] extends [ReadonlyArray<AuthRevealKind>] ? RevealRequirement<Reveals> : never);
+type PrivateResolvedCall<Credentials, Reveals> = {
+  readonly invocation: AuthInvocation;
+} & ([CredentialRequirement<Credentials>] extends [never] ? {} : {
+  readonly credentialCommandSink: AuthCredentialCommandSink;
+}) & ([RevealRequirement<Reveals>] extends [never] ? {} : {
+  readonly revealCommandCollector: AuthRevealCommandCollector;
+});
+type ResolverResult<Credentials, Reveals> = [PrivateRequirements<Credentials, Reveals>] extends [never] ? AuthInvocation : PrivateResolvedCall<Credentials, Reveals>;
+type WithPrivateRequirements<Method, Credentials, Reveals> = Method extends ((...args: infer Args) => Effect.Effect<infer A, infer E, infer R>) ? (...args: Args) => Effect.Effect<A, E, Exclude<R, PrivateCollectorProvenance> | PrivateRequirements<Credentials, Reveals>> : never;
+/**
+ * Define a unary auth operation once. `authorize` runs after validation and access
+ * checks, before the logical handler, on all supported invocation paths.
+ */
+declare const buildOperation: <const Tag extends string, Payload extends Schema.Top, Success extends Schema.Top, Error extends Schema.Top, PolicyServices = never, const Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {
+  /** Require private credential acceptance before the logical handler can mutate. */
+  readonly credentials?: true;
+  /** Required even when an exact-command replay returns only metadata. */
+  readonly reveals?: ReadonlyArray<AuthRevealKind>;
+} = OperationOptions<Payload, Success, Error, PolicyServices>>(tag: Tag, options: OperationOptions<Payload, Success, Error, PolicyServices> & Options) => Omit<Readonly<{
+  rpc: Rpc.Rpc<Tag, Payload extends Schema.Struct.Fields ? Schema.Struct<Payload> : Payload, Success, Schema.Union<readonly [Error, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>;
+  access: OperationAccess;
+  exposure: OperationExposure;
+  replay: OperationReplay;
+  credentials: boolean;
+  reveals: readonly ("recovery-codes" | "totp-enrollment")[];
+  handlerLayer: <R>(handler: (payload: Payload["Type"], context: AuthInvocation) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], R>) => Layer.Layer<OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]>, never, Exclude<R, import("effect/Scope").Scope>>;
+  credentialHandlerLayer: <R>(handler: (payload: Payload["Type"], context: AuthInvocation) => Effect.Effect<AuthOperationResult<Success["Type"]>, AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], R>) => Layer.Layer<OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]>, never, Exclude<R, import("effect/Scope").Scope>>;
+  privateHandlerLayer: <R>(handler: (payload: Payload["Type"], context: AuthInvocation) => Effect.Effect<AuthOperationResult<Success["Type"]>, AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], R>) => Layer.Layer<OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]>, never, Exclude<R, import("effect/Scope").Scope>>;
+  invoke: (context: AuthInvocation, input: Payload["Encoded"]) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], PolicyServices | CredentialCollectorProvenance | OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]> | RevealCollectorProvenance | Payload["DecodingServices"]>;
+  invokeUnknown: (context: AuthInvocation, input: unknown) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], PolicyServices | CredentialCollectorProvenance | OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]> | RevealCollectorProvenance | Payload["DecodingServices"]>;
+  invokeDecoded: (context: AuthInvocation, input: Payload["Type"]) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], PolicyServices | CredentialCollectorProvenance | OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]> | RevealCollectorProvenance>;
+  rpcHandler: <R>(resolveContext: (options: Parameters<Rpc.ToHandlerFn<Rpc.Rpc<Tag, Payload extends Schema.Struct.Fields ? Schema.Struct<Payload> : Payload, Success, Schema.Union<readonly [Error, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>, any>>[1]) => Effect.Effect<ResolverResult<OptionProperty<Options, "credentials">, OptionProperty<Options, "reveals">>, AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], R>) => (input: Payload["Type"], transport: Parameters<Rpc.ToHandlerFn<Rpc.Rpc<Tag, Payload extends Schema.Struct.Fields ? Schema.Struct<Payload> : Payload, Success, Schema.Union<readonly [Error, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>, any>>[1]) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], R | Exclude<PolicyServices, PrivateCollectorProvenance | ResolvedCollectorServices<OptionProperty<Options, "credentials">, OptionProperty<Options, "reveals">>> | Exclude<OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]>, PrivateCollectorProvenance | ResolvedCollectorServices<OptionProperty<Options, "credentials">, OptionProperty<Options, "reveals">>>>;
+}>, "invoke" | "invokeUnknown" | "invokeDecoded"> & {
+  readonly invoke: WithPrivateRequirements<(context: AuthInvocation, input: Payload["Encoded"]) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], PolicyServices | CredentialCollectorProvenance | OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]> | RevealCollectorProvenance | Payload["DecodingServices"]>, OptionProperty<Options, "credentials">, OptionProperty<Options, "reveals">>;
+  readonly invokeUnknown: WithPrivateRequirements<(context: AuthInvocation, input: unknown) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], PolicyServices | CredentialCollectorProvenance | OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]> | RevealCollectorProvenance | Payload["DecodingServices"]>, OptionProperty<Options, "credentials">, OptionProperty<Options, "reveals">>;
+  readonly invokeDecoded: WithPrivateRequirements<(context: AuthInvocation, input: Payload["Type"]) => Effect.Effect<Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"], PolicyServices | CredentialCollectorProvenance | OperationHandler<Tag, Payload["Type"], Success["Type"], AssuranceRequired | AuthenticationRequired | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | Error["Type"]> | RevealCollectorProvenance>, OptionProperty<Options, "credentials">, OptionProperty<Options, "reveals">>;
+};
+/** Named operation contract keeps inferred consumer declarations portable and compact. */
+type OperationImplementation<Tag extends string, Payload extends Schema.Top, Success extends Schema.Top, Error extends Schema.Top, PolicyServices = never, Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {
+  /** Require private credential acceptance before the logical handler can mutate. */
+  readonly credentials?: true;
+  /** Required even when an exact-command replay returns only metadata. */
+  readonly reveals?: ReadonlyArray<AuthRevealKind>;
+} = OperationOptions<Payload, Success, Error, PolicyServices>> = ReturnType<typeof buildOperation<Tag, Payload, Success, Error, PolicyServices, Options>>;
+interface AuthOperation<Tag extends string, Payload extends Schema.Top, Success extends Schema.Top, Error extends Schema.Top, PolicyServices = never, Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {
+  /** Require private credential acceptance before the logical handler can mutate. */
+  readonly credentials?: true;
+  /** Required even when an exact-command replay returns only metadata. */
+  readonly reveals?: ReadonlyArray<AuthRevealKind>;
+} = OperationOptions<Payload, Success, Error, PolicyServices>> {
+  readonly rpc: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["rpc"];
+  readonly access: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["access"];
+  readonly exposure: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["exposure"];
+  readonly replay: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["replay"];
+  readonly credentials: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["credentials"];
+  readonly reveals: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["reveals"];
+  readonly handlerLayer: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["handlerLayer"];
+  readonly credentialHandlerLayer: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["credentialHandlerLayer"];
+  readonly privateHandlerLayer: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["privateHandlerLayer"];
+  readonly invoke: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["invoke"];
+  readonly invokeUnknown: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["invokeUnknown"];
+  readonly invokeDecoded: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["invokeDecoded"];
+  readonly rpcHandler: OperationImplementation<Tag, Payload, Success, Error, PolicyServices, Options>["rpcHandler"];
+}
+declare const makeOperation: <const Tag extends string, Payload extends Schema.Top, Success extends Schema.Top, Error extends Schema.Top, PolicyServices = never, const Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {
+  /** Require private credential acceptance before the logical handler can mutate. */
+  readonly credentials?: true;
+  /** Required even when an exact-command replay returns only metadata. */
+  readonly reveals?: ReadonlyArray<AuthRevealKind>;
+} = OperationOptions<Payload, Success, Error, PolicyServices>>(tag: Tag, options: OperationOptions<Payload, Success, Error, PolicyServices> & Options) => AuthOperation<Tag, Payload, Success, Error, PolicyServices, Options>;
+interface AnyOperation {
+  readonly rpc: Rpc.Any;
+  readonly exposure: OperationExposure;
+}
+/** Compose available contracts independently of their network exposure. */
+declare const operationGroup: <const Operations extends ReadonlyArray<AnyOperation>>(...operations: Operations) => RpcGroup.RpcGroup<Operations[number]["rpc"]>;
+/** Explicitly select network operations; internal operations require an additional opt-in. */
+declare const remoteGroup: <const Operations extends ReadonlyArray<AnyOperation>>(operations: Operations, options?: {
+  readonly allowInternal?: true;
+}) => RpcGroup.RpcGroup<Operations[number]["rpc"]>;
+//#endregion
+export { AnyOperation, AuthOperation, CredentialCollectorProvenance, OperationAccess, OperationExposure, OperationHandler, OperationReplay, RevealCollectorProvenance, makeOperation, operationGroup, remoteGroup };
+//# sourceMappingURL=operation.d.mts.map

package/dist/operations/operation.mjs

@@ -0,0 +1,220 @@
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService, snapshotCredentialCommands, validateCredentialCommands } from "./credentials.mjs";
+import { AuthenticationRequired, InvalidOperationInput, OperationBoundaryError, OperationConfigurationError, OperationForbidden, OperationPrivateOutputUnsupported } from "./errors.mjs";
+import { snapshotRevealCommands, snapshotRevealKinds } from "./reveals.mjs";
+import { Cause, Context, DateTime, Effect, Layer, Predicate, Schema, SchemaGetter } from "effect";
+import { Rpc, RpcGroup } from "effect/unstable/rpc";
+//#region src/operations/operation.ts
+const operationDefect = Schema.Json.pipe(Schema.decodeTo(Schema.Unknown, {
+	decode: SchemaGetter.transform(() => new globalThis.Error("Auth operation failed")),
+	encode: SchemaGetter.transform(() => ({ message: "Auth operation failed" }))
+}));
+/** Identifies an already reported defect without retaining its private cause. */
+var ReportedOperationDefect = class extends globalThis.Error {
+	constructor() {
+		super("Auth operation failed");
+	}
+};
+const operationFailure = Effect.fn("AuthOperation.failure")(function* (stage, cause) {
+	if (Cause.hasInterruptsOnly(cause)) return yield* Effect.failCause(Cause.fromReasons(cause.reasons.filter(Cause.isInterruptReason)));
+	const unreported = Cause.fromReasons(cause.reasons.filter((reason) => !(Cause.isDieReason(reason) && reason.defect instanceof ReportedOperationDefect)));
+	yield* reportAuthFailure(stage, unreported);
+	return yield* Effect.die(new ReportedOperationDefect());
+});
+const sanitizeOperationDefects = (stage) => (effect) => effect.pipe(Effect.catchCause((cause) => Cause.hasDies(cause) ? operationFailure(stage, cause) : Effect.failCause(cause)));
+/** Reconstruct declared fields and class instances without replaying wire transformations. */
+const projectType = (schema, stage) => {
+	const codec = Schema.toCodecIso(schema);
+	const encode = Schema.encodeEffect(codec);
+	const decode = Schema.decodeEffect(codec);
+	return (value) => encode(value).pipe(Effect.flatMap(decode), Effect.catchCause((cause) => operationFailure(stage, cause)));
+};
+const credentialCollector = AuthCredentialCommandCollector;
+const revealCollector = AuthRevealCommandCollectorService;
+/**
+* Define a unary auth operation once. `authorize` runs after validation and access
+* checks, before the logical handler, on all supported invocation paths.
+*/
+const buildOperation = (tag, options) => {
+	options = Object.freeze({ ...options });
+	const reveals = (() => {
+		try {
+			if (options.reveals === void 0) return Object.freeze([]);
+			const captured = snapshotRevealKinds(options.reveals);
+			if (captured.length === 0) throw new globalThis.Error();
+			return captured;
+		} catch {
+			throw OperationConfigurationError.make({
+				reason: "reveal-configuration",
+				operation: tag
+			});
+		}
+	})();
+	const hasReveals = reveals.length > 0;
+	const rpc = Rpc.make(tag, {
+		payload: options.payload,
+		success: options.success,
+		error: Schema.Union([options.error, OperationBoundaryError]),
+		defect: operationDefect
+	});
+	const HandlerService = Context.Service(`effect-auth/operations/${tag}`);
+	const decode = Schema.decodeEffect(options.payload);
+	const decodeUnknown = Schema.decodeUnknownEffect(options.payload);
+	const validate = Schema.decodeEffect(Schema.toType(options.payload));
+	const projectSuccess = projectType(options.success, "success-projection");
+	const projectFailure = projectType(rpc.errorSchema, "error-projection");
+	const fail = (error) => projectFailure(error).pipe(Effect.flatMap(Effect.fail));
+	const execute = Effect.fn(`AuthOperation.${tag}`)(function* (context, payload) {
+		if (options.access === "authenticated" && context._tag !== "Authenticated") return yield* AuthenticationRequired.make({});
+		if (options.access === "system" && context._tag !== "System") return yield* OperationForbidden.make({});
+		let sink;
+		const reveal = hasReveals ? yield* revealCollector : void 0;
+		if (hasReveals && options.credentials === true) sink = yield* credentialCollector;
+		const collectors = hasReveals ? yield* Effect.try({
+			try: () => {
+				const collector = reveal;
+				const accept = collector?.accept;
+				if (collector === void 0 || !Predicate.isFunction(accept) || options.credentials === true && !Predicate.isFunction(sink)) throw new globalThis.Error();
+				const supported = snapshotRevealKinds(collector.supportedKinds);
+				if (!reveals.every((kind) => supported.includes(kind))) throw new globalThis.Error();
+				return {
+					sink,
+					accept
+				};
+			},
+			catch: () => OperationPrivateOutputUnsupported.make({})
+		}) : void 0;
+		if (options.authorize !== void 0) yield* options.authorize(payload, context);
+		if (!hasReveals && options.credentials === true) sink = yield* credentialCollector;
+		if (options.credentials === true && !Predicate.isFunction(sink)) return yield* Effect.die(new globalThis.Error("Auth credential collector required"));
+		const result = yield* (yield* HandlerService).run(payload, context);
+		if (collectors !== void 0) {
+			const staged = yield* Effect.sync(() => {
+				const value = result.value;
+				const commands = snapshotCredentialCommands(result.credentialCommands);
+				const privateCommands = snapshotRevealCommands(result.revealCommands, reveals);
+				if (commands.length > 0 && options.credentials !== true) throw new globalThis.Error("Auth operation failed");
+				return {
+					value,
+					commands,
+					privateCommands
+				};
+			});
+			const value = yield* projectSuccess(staged.value);
+			const now = DateTime.toEpochMillis(yield* DateTime.now);
+			if (staged.privateCommands.some((command) => command.expiresAtMillis <= now || command.expiresAtMillis > now + 3e5)) return yield* Effect.die(new globalThis.Error("Auth operation failed"));
+			if (staged.commands.length > 0) {
+				if (!Predicate.isFunction(sink)) return yield* Effect.die(new globalThis.Error("Auth operation failed"));
+				yield* sink(staged.commands);
+			}
+			if (staged.privateCommands.length > 0) {
+				const accept = collectors.accept;
+				yield* accept(staged.privateCommands);
+			}
+			return value;
+		}
+		const value = yield* projectSuccess(result.value);
+		const commands = yield* validateCredentialCommands(result.credentialCommands);
+		yield* Effect.sync(() => snapshotRevealCommands(result.revealCommands, reveals));
+		if (commands.length > 0) {
+			if (!Predicate.isFunction(sink)) return yield* Effect.die(new globalThis.Error("Auth credential collector required"));
+			yield* sink(commands);
+		}
+		return value;
+	}, Effect.catch(fail), (effect) => hasReveals ? effect.pipe(sanitizeOperationDefects("private-output")) : effect);
+	const invoke = Effect.fn(`AuthOperation.${tag}.invoke`)(function* (context, input) {
+		const payload = yield* decode(input).pipe(Effect.mapError(() => InvalidOperationInput.make({})));
+		return yield* execute(context, payload);
+	}, sanitizeOperationDefects("local"));
+	const invokeUnknown = Effect.fn(`AuthOperation.${tag}.invokeUnknown`)(function* (context, input) {
+		const payload = yield* decodeUnknown(input).pipe(Effect.mapError(() => InvalidOperationInput.make({})));
+		return yield* execute(context, payload);
+	}, sanitizeOperationDefects("local"));
+	/** Validate decoded input without replaying its wire transformations. */
+	const invokeDecoded = Effect.fn(`AuthOperation.${tag}.invokeDecoded`)(function* (context, input) {
+		const payload = yield* validate(input).pipe(Effect.mapError(() => InvalidOperationInput.make({})));
+		return yield* execute(context, payload);
+	}, sanitizeOperationDefects("local"));
+	/** Capture capabilities at Layer construction, with the caller still an explicit argument. */
+	const installHandler = (handler) => Layer.effect(HandlerService, Effect.gen(function* () {
+		const services = yield* Effect.context();
+		return { run: (payload, context) => handler(payload, context).pipe(Effect.provide(services)) };
+	}));
+	const credentialHandlerLayer = (handler) => {
+		if (options.credentials !== true) throw OperationConfigurationError.make({
+			reason: "credential-handler",
+			operation: tag
+		});
+		return installHandler(handler);
+	};
+	const privateHandlerLayer = (handler) => {
+		if (options.credentials !== true && !hasReveals) throw OperationConfigurationError.make({
+			reason: "private-handler",
+			operation: tag
+		});
+		return installHandler(handler);
+	};
+	const handlerLayer = (handler) => installHandler((payload, context) => handler(payload, context).pipe(Effect.map((value) => ({
+		value,
+		credentialCommands: []
+	}))));
+	function provideResolvedCollectors(effect, call) {
+		if (hasReveals) {
+			const withReveal = effect.pipe(Effect.provideService(AuthRevealCommandCollectorService, call?.revealCommandCollector));
+			if (options.credentials === true) return withReveal.pipe(Effect.provideService(AuthCredentialCommandCollector, call?.credentialCommandSink));
+			return withReveal;
+		}
+		if (options.credentials === true) return effect.pipe(Effect.provideService(AuthCredentialCommandCollector, call?.credentialCommandSink));
+		return effect;
+	}
+	/**
+	* RPC has decoded the payload already. Validate its Type without replaying its
+	* transformations. The resolver runs once for each call, outside the wire payload.
+	*/
+	const rpcHandler = (resolveContext) => Effect.fn(`AuthOperation.${tag}.rpc`)(function* (input, transport) {
+		const resolved = yield* resolveContext(transport).pipe(Effect.catch(fail));
+		const call = "invocation" in resolved ? resolved : void 0;
+		const context = call === void 0 ? resolved : call.invocation;
+		return yield* provideResolvedCollectors(invokeDecoded(context, input), call);
+	}, sanitizeOperationDefects("rpc"));
+	return Object.freeze({
+		rpc,
+		access: options.access,
+		exposure: options.exposure ?? "internal",
+		replay: options.replay,
+		credentials: options.credentials === true,
+		reveals,
+		handlerLayer,
+		credentialHandlerLayer,
+		privateHandlerLayer,
+		invoke,
+		invokeUnknown,
+		invokeDecoded,
+		rpcHandler
+	});
+};
+const makeOperation = buildOperation;
+/** Compose available contracts independently of their network exposure. */
+const operationGroup = (...operations) => {
+	const tags = /* @__PURE__ */ new Set();
+	for (const operation of operations) {
+		if (tags.has(operation.rpc._tag)) throw OperationConfigurationError.make({
+			reason: "duplicate-operation",
+			operation: operation.rpc._tag
+		});
+		tags.add(operation.rpc._tag);
+	}
+	return RpcGroup.make(...operations.map((operation) => operation.rpc));
+};
+/** Explicitly select network operations; internal operations require an additional opt-in. */
+const remoteGroup = (operations, options) => {
+	for (const operation of operations) if (operation.exposure === "internal" && options?.allowInternal !== true) throw OperationConfigurationError.make({
+		reason: "internal-exposure",
+		operation: operation.rpc._tag
+	});
+	return operationGroup(...operations);
+};
+//#endregion
+export { makeOperation, operationGroup, remoteGroup };
+
+//# sourceMappingURL=operation.mjs.map

package/dist/operations/operation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation.mjs","names":[],"sources":["../../src/operations/operation.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  DateTime,\n  Effect,\n  Layer,\n  Predicate,\n  Schema,\n  SchemaGetter,\n  type Types,\n} from \"effect\";\nimport { Rpc, RpcGroup } from \"effect/unstable/rpc\";\n\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport type { AuthInvocation } from \"./context\";\nimport {\n  AuthCredentialCommandCollector,\n  type AuthCredentialCommandSink,\n  type AuthOperationResult,\n  AuthRevealCommandCollectorService,\n  snapshotCredentialCommands,\n  validateCredentialCommands,\n} from \"./credentials\";\nimport {\n  InvalidOperationInput,\n  OperationBoundaryError,\n  OperationForbidden,\n  AuthenticationRequired,\n  OperationConfigurationError,\n  OperationPrivateOutputUnsupported,\n} from \"./errors\";\nimport {\n  type AuthRevealCommandCollector,\n  type AuthRevealKind,\n  snapshotRevealCommands,\n  snapshotRevealKinds,\n} from \"./reveals\";\n\nconst operationDefect = Schema.Json.pipe(\n  Schema.decodeTo(Schema.Unknown, {\n    decode: SchemaGetter.transform(() => new globalThis.Error(\"Auth operation failed\")),\n    encode: SchemaGetter.transform(() => ({ message: \"Auth operation failed\" })),\n  }),\n);\n\n/** Identifies an already reported defect without retaining its private cause. */\nclass ReportedOperationDefect extends globalThis.Error {\n  constructor() {\n    super(\"Auth operation failed\");\n  }\n}\n\nconst operationFailure = Effect.fn(\"AuthOperation.failure\")(function* <E>(\n  stage: \"local\" | \"rpc\" | \"success-projection\" | \"error-projection\" | \"private-output\",\n  cause: Cause.Cause<E>,\n): Effect.fn.Return<never> {\n  if (Cause.hasInterruptsOnly(cause)) {\n    return yield* Effect.failCause(\n      Cause.fromReasons<never>(cause.reasons.filter(Cause.isInterruptReason)),\n    );\n  }\n\n  const unreported = Cause.fromReasons(\n    cause.reasons.filter(\n      (reason) => !(Cause.isDieReason(reason) && reason.defect instanceof ReportedOperationDefect),\n    ),\n  );\n\n  yield* reportAuthFailure(stage, unreported);\n\n  return yield* Effect.die(new ReportedOperationDefect());\n});\n\nconst sanitizeOperationDefects =\n  (stage: \"local\" | \"rpc\" | \"private-output\") =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    effect.pipe(\n      Effect.catchCause((cause) =>\n        Cause.hasDies(cause) ? operationFailure(stage, cause) : Effect.failCause(cause),\n      ),\n    );\n\n/** Reconstruct declared fields and class instances without replaying wire transformations. */\nconst projectType = <S extends Schema.Top>(\n  schema: S,\n  stage: \"success-projection\" | \"error-projection\",\n) => {\n  const codec = Schema.toCodecIso(schema);\n  const encode = Schema.encodeEffect(codec);\n  const decode = Schema.decodeEffect(codec);\n\n  return (value: S[\"Type\"]) =>\n    encode(value).pipe(\n      Effect.flatMap(decode),\n      Effect.catchCause((cause) => operationFailure(stage, cause)),\n    );\n};\n\n/** Equal operation names only satisfy handlers with the same decoded contract. */\nexport interface OperationHandler<Tag extends string, Payload, Success, Error> {\n  readonly _tag: \"effect-auth/OperationHandler\";\n  readonly operation: Tag;\n  readonly contract: Types.Invariant<readonly [Payload, Success, Error]>;\n}\n\nexport type OperationAccess = \"any\" | \"authenticated\" | \"system\";\nexport type OperationExposure = \"public\" | \"internal\";\n/** Metadata documents the handler's durable guarantee; it does not implement deduplication. */\nexport type OperationReplay = \"read-only\" | \"idempotent\" | \"single-use\" | \"non-idempotent\";\n\ninterface OperationOptions<\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Error extends Schema.Top,\n  PolicyServices,\n> {\n  readonly payload: Payload;\n  readonly success: Success;\n  readonly error: Error;\n  readonly access: OperationAccess;\n  readonly exposure?: OperationExposure;\n  readonly replay: OperationReplay;\n  readonly authorize?: (\n    payload: Payload[\"Type\"],\n    context: AuthInvocation,\n  ) => Effect.Effect<void, Error[\"Type\"] | OperationBoundaryError, PolicyServices>;\n}\n\ntype OptionProperty<Options, Key extends PropertyKey> = Key extends keyof Options\n  ? Options[Key]\n  : never;\n\ntype CredentialRequirement<Credentials> = true extends Credentials\n  ? AuthCredentialCommandCollector\n  : never;\ntype RevealValue<Reveals> = Exclude<Reveals, undefined>;\ntype RevealRequirement<Reveals> = [RevealValue<Reveals>] extends [never]\n  ? never\n  : RevealValue<Reveals> extends ReadonlyArray<AuthRevealKind>\n    ? AuthRevealCommandCollectorService\n    : never;\ndeclare const credentialCollectorProvenance: unique symbol;\ndeclare const revealCollectorProvenance: unique symbol;\n\nexport interface CredentialCollectorProvenance {\n  readonly [credentialCollectorProvenance]: never;\n}\n\nexport interface RevealCollectorProvenance {\n  readonly [revealCollectorProvenance]: never;\n}\n\ntype PrivateCollectorProvenance = CredentialCollectorProvenance | RevealCollectorProvenance;\n\n// These casts retain the public service identities at runtime while distinguishing\n// their operation-owned requirements from identical requirements in policy/schema code.\nconst credentialCollector = AuthCredentialCommandCollector as unknown as Effect.Effect<\n  AuthCredentialCommandSink,\n  never,\n  CredentialCollectorProvenance\n>;\n\nconst revealCollector = AuthRevealCommandCollectorService as unknown as Effect.Effect<\n  AuthRevealCommandCollector,\n  never,\n  RevealCollectorProvenance\n>;\n\ntype PrivateRequirements<Credentials, Reveals> =\n  | CredentialRequirement<Credentials>\n  | RevealRequirement<Reveals>;\ntype ResolvedCollectorServices<Credentials, Reveals> =\n  | ([Credentials] extends [true] ? CredentialRequirement<Credentials> : never)\n  | ([Reveals] extends [ReadonlyArray<AuthRevealKind>] ? RevealRequirement<Reveals> : never);\ntype PrivateResolvedCall<Credentials, Reveals> = {\n  readonly invocation: AuthInvocation;\n} & ([CredentialRequirement<Credentials>] extends [never]\n  ? {}\n  : { readonly credentialCommandSink: AuthCredentialCommandSink }) &\n  ([RevealRequirement<Reveals>] extends [never]\n    ? {}\n    : { readonly revealCommandCollector: AuthRevealCommandCollector });\ntype ResolverResult<Credentials, Reveals> = [PrivateRequirements<Credentials, Reveals>] extends [\n  never,\n]\n  ? AuthInvocation\n  : PrivateResolvedCall<Credentials, Reveals>;\ntype WithPrivateRequirements<Method, Credentials, Reveals> = Method extends (\n  ...args: infer Args\n) => Effect.Effect<infer A, infer E, infer R>\n  ? (\n      ...args: Args\n    ) => Effect.Effect<\n      A,\n      E,\n      Exclude<R, PrivateCollectorProvenance> | PrivateRequirements<Credentials, Reveals>\n    >\n  : never;\n\n/**\n * Define a unary auth operation once. `authorize` runs after validation and access\n * checks, before the logical handler, on all supported invocation paths.\n */\nconst buildOperation = <\n  const Tag extends string,\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Error extends Schema.Top,\n  PolicyServices = never,\n  const Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {\n    /** Require private credential acceptance before the logical handler can mutate. */\n    readonly credentials?: true;\n    /** Required even when an exact-command replay returns only metadata. */\n    readonly reveals?: ReadonlyArray<AuthRevealKind>;\n  } = OperationOptions<Payload, Success, Error, PolicyServices>,\n>(\n  tag: Tag,\n  options: OperationOptions<Payload, Success, Error, PolicyServices> & Options,\n) => {\n  type Credentials = OptionProperty<Options, \"credentials\">;\n  type Reveals = OptionProperty<Options, \"reveals\">;\n  options = Object.freeze({ ...options });\n\n  const reveals = (() => {\n    try {\n      if (options.reveals === undefined) return Object.freeze([] as AuthRevealKind[]);\n      const captured = snapshotRevealKinds(options.reveals);\n\n      if (captured.length === 0) throw new globalThis.Error();\n\n      return captured;\n    } catch {\n      throw OperationConfigurationError.make({ reason: \"reveal-configuration\", operation: tag });\n    }\n  })();\n\n  const hasReveals = reveals.length > 0;\n\n  const rpc = Rpc.make(tag, {\n    payload: options.payload,\n    success: options.success,\n    error: Schema.Union([options.error, OperationBoundaryError]),\n    defect: operationDefect,\n  });\n\n  type Failure = Error[\"Type\"] | OperationBoundaryError;\n  type Handler<R = never> = (\n    payload: Payload[\"Type\"],\n    context: AuthInvocation,\n  ) => Effect.Effect<Success[\"Type\"], Failure, R>;\n  type CredentialHandler<R = never> = (\n    payload: Payload[\"Type\"],\n    context: AuthInvocation,\n  ) => Effect.Effect<AuthOperationResult<Success[\"Type\"]>, Failure, R>;\n\n  const HandlerService = Context.Service<\n    OperationHandler<Tag, Payload[\"Type\"], Success[\"Type\"], Failure>,\n    { readonly run: CredentialHandler }\n  >(`effect-auth/operations/${tag}`);\n\n  const decode = Schema.decodeEffect(options.payload);\n  // oxlint-disable-next-line no-restricted-properties -- invokeUnknown is the explicit boundary for untyped local callers.\n  const decodeUnknown = Schema.decodeUnknownEffect(options.payload);\n  const validate = Schema.decodeEffect(Schema.toType(options.payload));\n  const projectSuccess = projectType(options.success, \"success-projection\");\n  const projectFailure = projectType(rpc.errorSchema, \"error-projection\");\n  const fail = (error: Failure) => projectFailure(error).pipe(Effect.flatMap(Effect.fail));\n\n  const execute = Effect.fn(`AuthOperation.${tag}`)(\n    function* (context: AuthInvocation, payload: Payload[\"Type\"]) {\n      if (options.access === \"authenticated\" && context._tag !== \"Authenticated\") {\n        return yield* AuthenticationRequired.make({});\n      }\n      if (options.access === \"system\" && context._tag !== \"System\") {\n        return yield* OperationForbidden.make({});\n      }\n      let sink: AuthCredentialCommandSink | undefined;\n      const reveal = hasReveals ? yield* revealCollector : undefined;\n\n      if (hasReveals && options.credentials === true) {\n        sink = yield* credentialCollector;\n      }\n\n      const collectors = hasReveals\n        ? yield* Effect.try({\n            try: () => {\n              const collector = reveal;\n              const accept = collector?.accept;\n\n              if (\n                collector === undefined ||\n                !Predicate.isFunction(accept) ||\n                (options.credentials === true && !Predicate.isFunction(sink))\n              )\n                throw new globalThis.Error();\n              const supported = snapshotRevealKinds(collector.supportedKinds);\n\n              if (!reveals.every((kind) => supported.includes(kind))) throw new globalThis.Error();\n\n              return { sink, accept };\n            },\n            catch: () => OperationPrivateOutputUnsupported.make({}),\n          })\n        : undefined;\n\n      if (options.authorize !== undefined) {\n        yield* options.authorize(payload, context);\n      }\n      // The no-reveal branch deliberately retains its historical authorize-before-sink order.\n      if (!hasReveals && options.credentials === true) {\n        sink = yield* credentialCollector;\n      }\n\n      if (options.credentials === true && !Predicate.isFunction(sink)) {\n        return yield* Effect.die(new globalThis.Error(\"Auth credential collector required\"));\n      }\n      const handler = yield* HandlerService;\n      const result = yield* handler.run(payload, context);\n\n      if (collectors !== undefined) {\n        const staged = yield* Effect.sync(() => {\n          const value = result.value;\n          const commands = snapshotCredentialCommands(result.credentialCommands);\n          const privateCommands = snapshotRevealCommands(result.revealCommands, reveals);\n\n          if (commands.length > 0 && options.credentials !== true)\n            throw new globalThis.Error(\"Auth operation failed\");\n\n          return { value, commands, privateCommands };\n        });\n\n        const value = yield* projectSuccess(staged.value);\n        const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n        if (\n          staged.privateCommands.some(\n            (command) => command.expiresAtMillis <= now || command.expiresAtMillis > now + 300_000,\n          )\n        )\n          return yield* Effect.die(new globalThis.Error(\"Auth operation failed\"));\n        // These are two memory acceptances, not an atomic physical delivery.\n        if (staged.commands.length > 0) {\n          if (!Predicate.isFunction(sink))\n            return yield* Effect.die(new globalThis.Error(\"Auth operation failed\"));\n          yield* sink(staged.commands);\n        }\n        if (staged.privateCommands.length > 0) {\n          const accept = collectors.accept;\n\n          yield* accept(staged.privateCommands);\n        }\n\n        return value;\n      }\n\n      // Projection excludes undeclared properties even on existing Schema.Class instances.\n      const value = yield* projectSuccess(result.value);\n      const commands = yield* validateCredentialCommands(result.credentialCommands);\n\n      yield* Effect.sync(() => snapshotRevealCommands(result.revealCommands, reveals));\n\n      if (commands.length > 0) {\n        if (!Predicate.isFunction(sink))\n          return yield* Effect.die(new globalThis.Error(\"Auth credential collector required\"));\n        yield* sink(commands);\n      }\n\n      return value;\n    },\n    Effect.catch(fail),\n    (effect) => (hasReveals ? effect.pipe(sanitizeOperationDefects(\"private-output\")) : effect),\n  );\n\n  const invoke = Effect.fn(`AuthOperation.${tag}.invoke`)(function* (\n    context: AuthInvocation,\n    input: Payload[\"Encoded\"],\n  ) {\n    const payload = yield* decode(input).pipe(\n      Effect.mapError(() => InvalidOperationInput.make({})),\n    );\n\n    return yield* execute(context, payload);\n  }, sanitizeOperationDefects(\"local\"));\n\n  const invokeUnknown = Effect.fn(`AuthOperation.${tag}.invokeUnknown`)(function* (\n    context: AuthInvocation,\n    input: unknown,\n  ) {\n    const payload = yield* decodeUnknown(input).pipe(\n      Effect.mapError(() => InvalidOperationInput.make({})),\n    );\n\n    return yield* execute(context, payload);\n  }, sanitizeOperationDefects(\"local\"));\n\n  /** Validate decoded input without replaying its wire transformations. */\n  const invokeDecoded = Effect.fn(`AuthOperation.${tag}.invokeDecoded`)(function* (\n    context: AuthInvocation,\n    input: Payload[\"Type\"],\n  ) {\n    const payload = yield* validate(input).pipe(\n      Effect.mapError(() => InvalidOperationInput.make({})),\n    );\n\n    return yield* execute(context, payload);\n  }, sanitizeOperationDefects(\"local\"));\n\n  /** Capture capabilities at Layer construction, with the caller still an explicit argument. */\n  const installHandler = <R>(handler: CredentialHandler<R>) =>\n    Layer.effect(\n      HandlerService,\n      Effect.gen(function* () {\n        const services = yield* Effect.context<R>();\n\n        return {\n          run: (payload: Payload[\"Type\"], context: AuthInvocation) =>\n            handler(payload, context).pipe(Effect.provide(services)),\n        };\n      }),\n    );\n\n  const credentialHandlerLayer = <R>(handler: CredentialHandler<R>) => {\n    if (options.credentials !== true)\n      throw OperationConfigurationError.make({ reason: \"credential-handler\", operation: tag });\n\n    return installHandler(handler);\n  };\n\n  const privateHandlerLayer = <R>(handler: CredentialHandler<R>) => {\n    if (options.credentials !== true && !hasReveals)\n      throw OperationConfigurationError.make({ reason: \"private-handler\", operation: tag });\n\n    return installHandler(handler);\n  };\n\n  const handlerLayer = <R>(handler: Handler<R>) =>\n    installHandler((payload, context) =>\n      handler(payload, context).pipe(Effect.map((value) => ({ value, credentialCommands: [] }))),\n    );\n\n  type RpcOptions = Parameters<Rpc.ToHandlerFn<typeof rpc>>[1];\n\n  function provideResolvedCollectors<A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    call:\n      | {\n          readonly credentialCommandSink?: AuthCredentialCommandSink;\n          readonly revealCommandCollector?: AuthRevealCommandCollector;\n        }\n      | undefined,\n  ): Effect.Effect<\n    A,\n    E,\n    Exclude<R, PrivateCollectorProvenance | ResolvedCollectorServices<Credentials, Reveals>>\n  >;\n  function provideResolvedCollectors<A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    call:\n      | {\n          readonly credentialCommandSink?: AuthCredentialCommandSink;\n          readonly revealCommandCollector?: AuthRevealCommandCollector;\n        }\n      | undefined,\n  ) {\n    if (hasReveals) {\n      const withReveal = effect.pipe(\n        Effect.provideService(\n          AuthRevealCommandCollectorService,\n          call?.revealCommandCollector as AuthRevealCommandCollector,\n        ),\n      );\n\n      if (options.credentials === true) {\n        return withReveal.pipe(\n          Effect.provideService(\n            AuthCredentialCommandCollector,\n            call?.credentialCommandSink as AuthCredentialCommandSink,\n          ),\n        );\n      }\n\n      return withReveal;\n    }\n    if (options.credentials === true) {\n      return effect.pipe(\n        Effect.provideService(\n          AuthCredentialCommandCollector,\n          call?.credentialCommandSink as AuthCredentialCommandSink,\n        ),\n      );\n    }\n\n    return effect;\n  }\n\n  /**\n   * RPC has decoded the payload already. Validate its Type without replaying its\n   * transformations. The resolver runs once for each call, outside the wire payload.\n   */\n  const rpcHandler = <R>(\n    resolveContext: (\n      options: RpcOptions,\n    ) => Effect.Effect<ResolverResult<Credentials, Reveals>, Failure, R>,\n  ) =>\n    Effect.fn(`AuthOperation.${tag}.rpc`)(\n      function* (input: Payload[\"Type\"], transport: RpcOptions) {\n        const resolved = yield* resolveContext(transport).pipe(Effect.catch(fail));\n\n        const call =\n          \"invocation\" in resolved\n            ? (resolved as {\n                readonly invocation: AuthInvocation;\n                readonly credentialCommandSink?: AuthCredentialCommandSink;\n                readonly revealCommandCollector?: AuthRevealCommandCollector;\n              })\n            : undefined;\n\n        const context = call === undefined ? (resolved as AuthInvocation) : call.invocation;\n\n        return yield* provideResolvedCollectors(invokeDecoded(context, input), call);\n      },\n      // Fatal RPC defects bypass the operation's defect codec in the default server mode.\n      sanitizeOperationDefects(\"rpc\"),\n    );\n\n  const operation = Object.freeze({\n    rpc,\n    access: options.access,\n    exposure: options.exposure ?? \"internal\",\n    replay: options.replay,\n    credentials: options.credentials === true,\n    reveals,\n    handlerLayer,\n    credentialHandlerLayer,\n    privateHandlerLayer,\n    invoke,\n    invokeUnknown,\n    invokeDecoded,\n    rpcHandler,\n  });\n\n  // Runtime configuration selects the matching request-local requirements above.\n  return operation as Omit<typeof operation, \"invoke\" | \"invokeUnknown\" | \"invokeDecoded\"> & {\n    readonly invoke: WithPrivateRequirements<typeof invoke, Credentials, Reveals>;\n    readonly invokeUnknown: WithPrivateRequirements<typeof invokeUnknown, Credentials, Reveals>;\n    readonly invokeDecoded: WithPrivateRequirements<typeof invokeDecoded, Credentials, Reveals>;\n  };\n};\n\n/** Named operation contract keeps inferred consumer declarations portable and compact. */\ntype OperationImplementation<\n  Tag extends string,\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Error extends Schema.Top,\n  PolicyServices = never,\n  Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {\n    /** Require private credential acceptance before the logical handler can mutate. */\n    readonly credentials?: true;\n    /** Required even when an exact-command replay returns only metadata. */\n    readonly reveals?: ReadonlyArray<AuthRevealKind>;\n  } = OperationOptions<Payload, Success, Error, PolicyServices>,\n> = ReturnType<typeof buildOperation<Tag, Payload, Success, Error, PolicyServices, Options>>;\n\nexport interface AuthOperation<\n  Tag extends string,\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Error extends Schema.Top,\n  PolicyServices = never,\n  Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {\n    /** Require private credential acceptance before the logical handler can mutate. */\n    readonly credentials?: true;\n    /** Required even when an exact-command replay returns only metadata. */\n    readonly reveals?: ReadonlyArray<AuthRevealKind>;\n  } = OperationOptions<Payload, Success, Error, PolicyServices>,\n> {\n  readonly rpc: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"rpc\"];\n  readonly access: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"access\"];\n  readonly exposure: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"exposure\"];\n  readonly replay: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"replay\"];\n  readonly credentials: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"credentials\"];\n  readonly reveals: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"reveals\"];\n  readonly handlerLayer: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"handlerLayer\"];\n  readonly credentialHandlerLayer: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"credentialHandlerLayer\"];\n  readonly privateHandlerLayer: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"privateHandlerLayer\"];\n  readonly invoke: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"invoke\"];\n  readonly invokeUnknown: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"invokeUnknown\"];\n  readonly invokeDecoded: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"invokeDecoded\"];\n  readonly rpcHandler: OperationImplementation<\n    Tag,\n    Payload,\n    Success,\n    Error,\n    PolicyServices,\n    Options\n  >[\"rpcHandler\"];\n}\n\nexport const makeOperation: <\n  const Tag extends string,\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Error extends Schema.Top,\n  PolicyServices = never,\n  const Options extends OperationOptions<Payload, Success, Error, PolicyServices> & {\n    /** Require private credential acceptance before the logical handler can mutate. */\n    readonly credentials?: true;\n    /** Required even when an exact-command replay returns only metadata. */\n    readonly reveals?: ReadonlyArray<AuthRevealKind>;\n  } = OperationOptions<Payload, Success, Error, PolicyServices>,\n>(\n  tag: Tag,\n  options: OperationOptions<Payload, Success, Error, PolicyServices> & Options,\n) => AuthOperation<Tag, Payload, Success, Error, PolicyServices, Options> = buildOperation;\n\nexport interface AnyOperation {\n  readonly rpc: Rpc.Any;\n  readonly exposure: OperationExposure;\n}\n\n/** Compose available contracts independently of their network exposure. */\nexport const operationGroup = <const Operations extends ReadonlyArray<AnyOperation>>(\n  ...operations: Operations\n): RpcGroup.RpcGroup<Operations[number][\"rpc\"]> => {\n  const tags = new Set<string>();\n\n  for (const operation of operations) {\n    if (tags.has(operation.rpc._tag)) {\n      throw OperationConfigurationError.make({\n        reason: \"duplicate-operation\",\n        operation: operation.rpc._tag,\n      });\n    }\n    tags.add(operation.rpc._tag);\n  }\n\n  return RpcGroup.make(...operations.map((operation) => operation.rpc));\n};\n\n/** Explicitly select network operations; internal operations require an additional opt-in. */\nexport const remoteGroup = <const Operations extends ReadonlyArray<AnyOperation>>(\n  operations: Operations,\n  options?: { readonly allowInternal?: true },\n): RpcGroup.RpcGroup<Operations[number][\"rpc\"]> => {\n  for (const operation of operations) {\n    if (operation.exposure === \"internal\" && options?.allowInternal !== true) {\n      throw OperationConfigurationError.make({\n        reason: \"internal-exposure\",\n        operation: operation.rpc._tag,\n      });\n    }\n  }\n\n  return operationGroup(...operations);\n};\n"],"mappings":";;;;;;;AAsCA,MAAM,kBAAkB,OAAO,KAAK,KAClC,OAAO,SAAS,OAAO,SAAS;CAC9B,QAAQ,aAAa,gBAAgB,IAAI,WAAW,MAAM,uBAAuB,CAAC;CAClF,QAAQ,aAAa,iBAAiB,EAAE,SAAS,wBAAwB,EAAE;AAC7E,CAAC,CACH;;AAGA,IAAM,0BAAN,cAAsC,WAAW,MAAM;CACrD,cAAc;EACZ,MAAM,uBAAuB;CAC/B;AACF;AAEA,MAAM,mBAAmB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAC1D,OACA,OACyB;CACzB,IAAI,MAAM,kBAAkB,KAAK,GAC/B,OAAO,OAAO,OAAO,UACnB,MAAM,YAAmB,MAAM,QAAQ,OAAO,MAAM,iBAAiB,CAAC,CACxE;CAGF,MAAM,aAAa,MAAM,YACvB,MAAM,QAAQ,QACX,WAAW,EAAE,MAAM,YAAY,MAAM,KAAK,OAAO,kBAAkB,wBACtE,CACF;CAEA,OAAO,kBAAkB,OAAO,UAAU;CAE1C,OAAO,OAAO,OAAO,IAAI,IAAI,wBAAwB,CAAC;AACxD,CAAC;AAED,MAAM,4BACH,WACS,WACR,OAAO,KACL,OAAO,YAAY,UACjB,MAAM,QAAQ,KAAK,IAAI,iBAAiB,OAAO,KAAK,IAAI,OAAO,UAAU,KAAK,CAChF,CACF;;AAGJ,MAAM,eACJ,QACA,UACG;CACH,MAAM,QAAQ,OAAO,WAAW,MAAM;CACtC,MAAM,SAAS,OAAO,aAAa,KAAK;CACxC,MAAM,SAAS,OAAO,aAAa,KAAK;CAExC,QAAQ,UACN,OAAO,KAAK,CAAC,CAAC,KACZ,OAAO,QAAQ,MAAM,GACrB,OAAO,YAAY,UAAU,iBAAiB,OAAO,KAAK,CAAC,CAC7D;AACJ;AA4DA,MAAM,sBAAsB;AAM5B,MAAM,kBAAkB;;;;;AAyCxB,MAAM,kBAaJ,KACA,YACG;CAGH,UAAU,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;CAEtC,MAAM,iBAAiB;EACrB,IAAI;GACF,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,OAAO,OAAO,CAAC,CAAqB;GAC9E,MAAM,WAAW,oBAAoB,QAAQ,OAAO;GAEpD,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,WAAW,MAAM;GAEtD,OAAO;EACT,QAAQ;GACN,MAAM,4BAA4B,KAAK;IAAE,QAAQ;IAAwB,WAAW;GAAI,CAAC;EAC3F;CACF,EAAA,CAAG;CAEH,MAAM,aAAa,QAAQ,SAAS;CAEpC,MAAM,MAAM,IAAI,KAAK,KAAK;EACxB,SAAS,QAAQ;EACjB,SAAS,QAAQ;EACjB,OAAO,OAAO,MAAM,CAAC,QAAQ,OAAO,sBAAsB,CAAC;EAC3D,QAAQ;CACV,CAAC;CAYD,MAAM,iBAAiB,QAAQ,QAG7B,0BAA0B,KAAK;CAEjC,MAAM,SAAS,OAAO,aAAa,QAAQ,OAAO;CAElD,MAAM,gBAAgB,OAAO,oBAAoB,QAAQ,OAAO;CAChE,MAAM,WAAW,OAAO,aAAa,OAAO,OAAO,QAAQ,OAAO,CAAC;CACnE,MAAM,iBAAiB,YAAY,QAAQ,SAAS,oBAAoB;CACxE,MAAM,iBAAiB,YAAY,IAAI,aAAa,kBAAkB;CACtE,MAAM,QAAQ,UAAmB,eAAe,KAAK,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,IAAI,CAAC;CAEvF,MAAM,UAAU,OAAO,GAAG,iBAAiB,KAAK,CAAC,CAC/C,WAAW,SAAyB,SAA0B;EAC5D,IAAI,QAAQ,WAAW,mBAAmB,QAAQ,SAAS,iBACzD,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;EAE9C,IAAI,QAAQ,WAAW,YAAY,QAAQ,SAAS,UAClD,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;EAE1C,IAAI;EACJ,MAAM,SAAS,aAAa,OAAO,kBAAkB,KAAA;EAErD,IAAI,cAAc,QAAQ,gBAAgB,MACxC,OAAO,OAAO;EAGhB,MAAM,aAAa,aACf,OAAO,OAAO,IAAI;GAChB,WAAW;IACT,MAAM,YAAY;IAClB,MAAM,SAAS,WAAW;IAE1B,IACE,cAAc,KAAA,KACd,CAAC,UAAU,WAAW,MAAM,KAC3B,QAAQ,gBAAgB,QAAQ,CAAC,UAAU,WAAW,IAAI,GAE3D,MAAM,IAAI,WAAW,MAAM;IAC7B,MAAM,YAAY,oBAAoB,UAAU,cAAc;IAE9D,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU,SAAS,IAAI,CAAC,GAAG,MAAM,IAAI,WAAW,MAAM;IAEnF,OAAO;KAAE;KAAM;IAAO;GACxB;GACA,aAAa,kCAAkC,KAAK,CAAC,CAAC;EACxD,CAAC,IACD,KAAA;EAEJ,IAAI,QAAQ,cAAc,KAAA,GACxB,OAAO,QAAQ,UAAU,SAAS,OAAO;EAG3C,IAAI,CAAC,cAAc,QAAQ,gBAAgB,MACzC,OAAO,OAAO;EAGhB,IAAI,QAAQ,gBAAgB,QAAQ,CAAC,UAAU,WAAW,IAAI,GAC5D,OAAO,OAAO,OAAO,IAAI,IAAI,WAAW,MAAM,oCAAoC,CAAC;EAGrF,MAAM,SAAS,QAAO,OADC,eAAA,CACO,IAAI,SAAS,OAAO;EAElD,IAAI,eAAe,KAAA,GAAW;GAC5B,MAAM,SAAS,OAAO,OAAO,WAAW;IACtC,MAAM,QAAQ,OAAO;IACrB,MAAM,WAAW,2BAA2B,OAAO,kBAAkB;IACrE,MAAM,kBAAkB,uBAAuB,OAAO,gBAAgB,OAAO;IAE7E,IAAI,SAAS,SAAS,KAAK,QAAQ,gBAAgB,MACjD,MAAM,IAAI,WAAW,MAAM,uBAAuB;IAEpD,OAAO;KAAE;KAAO;KAAU;IAAgB;GAC5C,CAAC;GAED,MAAM,QAAQ,OAAO,eAAe,OAAO,KAAK;GAChD,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;GAEtD,IACE,OAAO,gBAAgB,MACpB,YAAY,QAAQ,mBAAmB,OAAO,QAAQ,kBAAkB,MAAM,GACjF,GAEA,OAAO,OAAO,OAAO,IAAI,IAAI,WAAW,MAAM,uBAAuB,CAAC;GAExE,IAAI,OAAO,SAAS,SAAS,GAAG;IAC9B,IAAI,CAAC,UAAU,WAAW,IAAI,GAC5B,OAAO,OAAO,OAAO,IAAI,IAAI,WAAW,MAAM,uBAAuB,CAAC;IACxE,OAAO,KAAK,OAAO,QAAQ;GAC7B;GACA,IAAI,OAAO,gBAAgB,SAAS,GAAG;IACrC,MAAM,SAAS,WAAW;IAE1B,OAAO,OAAO,OAAO,eAAe;GACtC;GAEA,OAAO;EACT;EAGA,MAAM,QAAQ,OAAO,eAAe,OAAO,KAAK;EAChD,MAAM,WAAW,OAAO,2BAA2B,OAAO,kBAAkB;EAE5E,OAAO,OAAO,WAAW,uBAAuB,OAAO,gBAAgB,OAAO,CAAC;EAE/E,IAAI,SAAS,SAAS,GAAG;GACvB,IAAI,CAAC,UAAU,WAAW,IAAI,GAC5B,OAAO,OAAO,OAAO,IAAI,IAAI,WAAW,MAAM,oCAAoC,CAAC;GACrF,OAAO,KAAK,QAAQ;EACtB;EAEA,OAAO;CACT,GACA,OAAO,MAAM,IAAI,IAChB,WAAY,aAAa,OAAO,KAAK,yBAAyB,gBAAgB,CAAC,IAAI,MACtF;CAEA,MAAM,SAAS,OAAO,GAAG,iBAAiB,IAAI,QAAQ,CAAC,CAAC,WACtD,SACA,OACA;EACA,MAAM,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,KACnC,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CACtD;EAEA,OAAO,OAAO,QAAQ,SAAS,OAAO;CACxC,GAAG,yBAAyB,OAAO,CAAC;CAEpC,MAAM,gBAAgB,OAAO,GAAG,iBAAiB,IAAI,eAAe,CAAC,CAAC,WACpE,SACA,OACA;EACA,MAAM,UAAU,OAAO,cAAc,KAAK,CAAC,CAAC,KAC1C,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CACtD;EAEA,OAAO,OAAO,QAAQ,SAAS,OAAO;CACxC,GAAG,yBAAyB,OAAO,CAAC;;CAGpC,MAAM,gBAAgB,OAAO,GAAG,iBAAiB,IAAI,eAAe,CAAC,CAAC,WACpE,SACA,OACA;EACA,MAAM,UAAU,OAAO,SAAS,KAAK,CAAC,CAAC,KACrC,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CACtD;EAEA,OAAO,OAAO,QAAQ,SAAS,OAAO;CACxC,GAAG,yBAAyB,OAAO,CAAC;;CAGpC,MAAM,kBAAqB,YACzB,MAAM,OACJ,gBACA,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,QAAW;EAE1C,OAAO,EACL,MAAM,SAA0B,YAC9B,QAAQ,SAAS,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC,EAC3D;CACF,CAAC,CACH;CAEF,MAAM,0BAA6B,YAAkC;EACnE,IAAI,QAAQ,gBAAgB,MAC1B,MAAM,4BAA4B,KAAK;GAAE,QAAQ;GAAsB,WAAW;EAAI,CAAC;EAEzF,OAAO,eAAe,OAAO;CAC/B;CAEA,MAAM,uBAA0B,YAAkC;EAChE,IAAI,QAAQ,gBAAgB,QAAQ,CAAC,YACnC,MAAM,4BAA4B,KAAK;GAAE,QAAQ;GAAmB,WAAW;EAAI,CAAC;EAEtF,OAAO,eAAe,OAAO;CAC/B;CAEA,MAAM,gBAAmB,YACvB,gBAAgB,SAAS,YACvB,QAAQ,SAAS,OAAO,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW;EAAE;EAAO,oBAAoB,CAAC;CAAE,EAAE,CAAC,CAC3F;CAiBF,SAAS,0BACP,QACA,MAMA;EACA,IAAI,YAAY;GACd,MAAM,aAAa,OAAO,KACxB,OAAO,eACL,mCACA,MAAM,sBACR,CACF;GAEA,IAAI,QAAQ,gBAAgB,MAC1B,OAAO,WAAW,KAChB,OAAO,eACL,gCACA,MAAM,qBACR,CACF;GAGF,OAAO;EACT;EACA,IAAI,QAAQ,gBAAgB,MAC1B,OAAO,OAAO,KACZ,OAAO,eACL,gCACA,MAAM,qBACR,CACF;EAGF,OAAO;CACT;;;;;CAMA,MAAM,cACJ,mBAIA,OAAO,GAAG,iBAAiB,IAAI,KAAK,CAAC,CACnC,WAAW,OAAwB,WAAuB;EACxD,MAAM,WAAW,OAAO,eAAe,SAAS,CAAC,CAAC,KAAK,OAAO,MAAM,IAAI,CAAC;EAEzE,MAAM,OACJ,gBAAgB,WACX,WAKD,KAAA;EAEN,MAAM,UAAU,SAAS,KAAA,IAAa,WAA8B,KAAK;EAEzE,OAAO,OAAO,0BAA0B,cAAc,SAAS,KAAK,GAAG,IAAI;CAC7E,GAEA,yBAAyB,KAAK,CAChC;CAmBF,OAjBkB,OAAO,OAAO;EAC9B;EACA,QAAQ,QAAQ;EAChB,UAAU,QAAQ,YAAY;EAC9B,QAAQ,QAAQ;EAChB,aAAa,QAAQ,gBAAgB;EACrC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAGe;AAKjB;AAwIA,MAAa,gBAe+D;;AAQ5E,MAAa,kBACX,GAAG,eAC8C;CACjD,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,aAAa,YAAY;EAClC,IAAI,KAAK,IAAI,UAAU,IAAI,IAAI,GAC7B,MAAM,4BAA4B,KAAK;GACrC,QAAQ;GACR,WAAW,UAAU,IAAI;EAC3B,CAAC;EAEH,KAAK,IAAI,UAAU,IAAI,IAAI;CAC7B;CAEA,OAAO,SAAS,KAAK,GAAG,WAAW,KAAK,cAAc,UAAU,GAAG,CAAC;AACtE;;AAGA,MAAa,eACX,YACA,YACiD;CACjD,KAAK,MAAM,aAAa,YACtB,IAAI,UAAU,aAAa,cAAc,SAAS,kBAAkB,MAClE,MAAM,4BAA4B,KAAK;EACrC,QAAQ;EACR,WAAW,UAAU,IAAI;CAC3B,CAAC;CAIL,OAAO,eAAe,GAAG,UAAU;AACrC"}

package/dist/operations/requestBinding.d.mts

@@ -0,0 +1,46 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthOperationResult } from "./credentials.mjs";
+import { SubtleCrypto } from "../WebCrypto.mjs";
+import { SessionSigningKeyring } from "../sessions/crypto.mjs";
+import { RequestBindingConfig } from "./RequestBindingConfig.mjs";
+import { RequestBindingCredential, RequestBindingFlowId, RequestBindingPublic } from "./requestBindingModels.mjs";
+import { Context, Crypto, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/operations/requestBinding.d.ts
+declare const RequestBindingInvalid_base: Schema.Class<RequestBindingInvalid, Schema.TaggedStruct<"RequestBindingInvalid", {}>, import("effect/Cause").YieldableError>;
+declare class RequestBindingInvalid extends RequestBindingInvalid_base {}
+declare const RequestBindingUnavailable_base: Schema.Class<RequestBindingUnavailable, Schema.TaggedStruct<"RequestBindingUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class RequestBindingUnavailable extends RequestBindingUnavailable_base {}
+declare const RequestBindingConfigurationError_base: Schema.Class<RequestBindingConfigurationError, Schema.TaggedStruct<"RequestBindingConfigurationError", {}>, import("effect/Cause").YieldableError>;
+declare class RequestBindingConfigurationError extends RequestBindingConfigurationError_base {}
+interface VerifiedRequestBinding {
+  /** Internal correlation only; never an accepted substitute for the credential. */
+  readonly verifier: TokenDigest;
+  readonly expiresAtMillis: number;
+}
+interface RequestBindingConfiguration {
+  readonly lifetimeMillis: number;
+  readonly generation: number;
+  /** Dedicated binding keys; no implicit reuse of session signing keys. */
+  readonly keyring: SessionSigningKeyring;
+}
+interface BindingModule<Id extends string, Purpose extends string> {
+  readonly moduleId: Id;
+  readonly purpose: Purpose;
+}
+/** The scalar private slot supports one standard browser flow at a time. Native
+ * consumers may explicitly retain credentials by flow in their own secure store.
+ * Browser adapters inject this credential from private storage and reject URL/body
+ * overrides. Every binding-bearing mutation, including issuance, requires CSRF
+ * protection. GET/preview routes neither begin nor consume an authentication flow.
+ */
+declare const makeRequestBinding: <const Id extends string, const Purpose extends string>(moduleId: Id, purpose: Purpose) => Readonly<{
+  RequestBinding: Context.Service<BindingModule<Id, Purpose>, {
+    readonly issue: (flowId: RequestBindingFlowId) => Effect.Effect<AuthOperationResult<RequestBindingPublic>, RequestBindingUnavailable | RequestBindingInvalid>;
+    readonly verify: (flowId: RequestBindingFlowId, credential: Redacted.Redacted<string>) => Effect.Effect<VerifiedRequestBinding, RequestBindingInvalid | RequestBindingUnavailable>;
+  }>;
+  signedLayer: (configuration: RequestBindingConfiguration) => Layer.Layer<BindingModule<Id, Purpose>, RequestBindingConfigurationError, Crypto.Crypto | SubtleCrypto>;
+  layer: Layer.Layer<BindingModule<Id, Purpose>, RequestBindingConfigurationError, Crypto.Crypto | RequestBindingConfig | SubtleCrypto>;
+}>;
+//#endregion
+export { BindingModule, RequestBindingConfiguration, RequestBindingConfigurationError, RequestBindingCredential, RequestBindingFlowId, RequestBindingInvalid, RequestBindingPublic, RequestBindingUnavailable, VerifiedRequestBinding, makeRequestBinding };
+//# sourceMappingURL=requestBinding.d.mts.map

package/dist/operations/requestBinding.mjs

@@ -0,0 +1,130 @@
+import { TokenDigest } from "../Schema.mjs";
+import { makeSessionSigningCodec } from "../sessions/crypto.mjs";
+import { RequestBindingConfig } from "./RequestBindingConfig.mjs";
+import { RequestBindingCredential, RequestBindingFlowId, RequestBindingPublic } from "./requestBindingModels.mjs";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Redacted, Schema } from "effect";
+//#region src/operations/requestBinding.ts
+var RequestBindingInvalid = class extends Schema.TaggedError()("RequestBindingInvalid", {}) {};
+var RequestBindingUnavailable = class extends Schema.TaggedError()("RequestBindingUnavailable", {}) {};
+var RequestBindingConfigurationError = class extends Schema.TaggedError()("RequestBindingConfigurationError", {}) {};
+const configurationSchema = Schema.Struct({
+	lifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 18e5
+	})),
+	generation: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	})),
+	keyring: Schema.Struct({
+		activeKeyId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/)),
+		keys: Schema.Array(Schema.Struct({
+			id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/)),
+			material: Schema.Redacted(Schema.String.check(Schema.isMaxLength(172)))
+		})).check(Schema.isMinLength(1), Schema.isMaxLength(8))
+	})
+});
+const label = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._:/-]{1,128}$/));
+const envelope = Schema.Struct({
+	namespace: Schema.Literal("effect-auth/request-binding/v1"),
+	moduleId: label,
+	purpose: label,
+	flowId: RequestBindingFlowId,
+	generation: Schema.Int,
+	nonce: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),
+	issuedAtMillis: Schema.Int,
+	expiresAtMillis: Schema.Int
+});
+const verifierMessage = Schema.fromJsonString(Schema.Tuple([
+	Schema.Literal("effect-auth/request-binding-verifier/v1"),
+	label,
+	label,
+	Schema.String
+]));
+/** The scalar private slot supports one standard browser flow at a time. Native
+* consumers may explicitly retain credentials by flow in their own secure store.
+* Browser adapters inject this credential from private storage and reject URL/body
+* overrides. Every binding-bearing mutation, including issuance, requires CSRF
+* protection. GET/preview routes neither begin nor consume an authentication flow.
+*/
+const makeRequestBinding = (moduleId, purpose) => {
+	const RequestBinding = Context.Service(`effect-auth/operations/RequestBinding/${moduleId.length}:${moduleId}/${purpose.length}:${purpose}`);
+	const signedLayer = (configuration) => {
+		if (!Schema.is(configurationSchema)(configuration)) return Layer.effect(RequestBinding, Effect.fail(RequestBindingConfigurationError.make({})));
+		const input = Object.freeze({
+			lifetimeMillis: configuration.lifetimeMillis,
+			generation: configuration.generation,
+			keyring: Object.freeze({
+				activeKeyId: configuration.keyring.activeKeyId,
+				keys: Object.freeze(configuration.keyring.keys.map((entry) => Object.freeze({
+					id: entry.id,
+					material: entry.material
+				})))
+			})
+		});
+		return Layer.effect(RequestBinding, Effect.gen(function* () {
+			yield* Schema.decodeEffect(label)(moduleId).pipe(Effect.mapError(() => RequestBindingConfigurationError.make({})));
+			yield* Schema.decodeEffect(label)(purpose).pipe(Effect.mapError(() => RequestBindingConfigurationError.make({})));
+			const policy = yield* Schema.decodeEffect(configurationSchema)(input).pipe(Effect.mapError(() => RequestBindingConfigurationError.make({})));
+			const signer = yield* makeSessionSigningCodec(envelope, policy.keyring, 2048).pipe(Effect.mapError(() => RequestBindingConfigurationError.make({})));
+			const crypto = yield* Crypto.Crypto;
+			return RequestBinding.of({
+				issue: Effect.fn("RequestBinding.issue")(function* (flowId) {
+					yield* Schema.decodeEffect(RequestBindingFlowId)(flowId).pipe(Effect.mapError(() => RequestBindingInvalid.make({})));
+					const now = DateTime.toEpochMillis(yield* DateTime.now);
+					const nonce = yield* crypto.randomBytes(32).pipe(Effect.mapError(() => RequestBindingUnavailable.make({})));
+					const expiresAtMillis = now + policy.lifetimeMillis;
+					const credential = yield* signer.encode({
+						namespace: "effect-auth/request-binding/v1",
+						moduleId,
+						purpose,
+						flowId,
+						generation: policy.generation,
+						nonce: Encoding.encodeBase64Url(nonce),
+						issuedAtMillis: now,
+						expiresAtMillis
+					}).pipe(Effect.mapError(() => RequestBindingUnavailable.make({})));
+					return {
+						value: {
+							flowId,
+							expiresAtMillis
+						},
+						credentialCommands: [{
+							_tag: "Issue",
+							slot: "request-binding",
+							credential,
+							expiresAtMillis
+						}]
+					};
+				}),
+				verify: Effect.fn("RequestBinding.verify")(function* (flowId, credential) {
+					yield* Schema.decodeEffect(RequestBindingFlowId)(flowId).pipe(Effect.mapError(() => RequestBindingInvalid.make({})));
+					const value = yield* signer.decode(credential).pipe(Effect.mapError((error) => error._tag === "SessionUnavailable" ? RequestBindingUnavailable.make({}) : RequestBindingInvalid.make({})));
+					const now = DateTime.toEpochMillis(yield* DateTime.now);
+					if (value.moduleId !== moduleId || value.purpose !== purpose || value.flowId !== flowId || value.generation !== policy.generation || value.issuedAtMillis > now || value.expiresAtMillis <= now || value.expiresAtMillis <= value.issuedAtMillis || value.expiresAtMillis - value.issuedAtMillis > policy.lifetimeMillis) return yield* RequestBindingInvalid.make({});
+					const message = yield* Schema.encodeEffect(verifierMessage)([
+						"effect-auth/request-binding-verifier/v1",
+						moduleId,
+						purpose,
+						Redacted.value(credential)
+					]).pipe(Effect.mapError(() => RequestBindingInvalid.make({})));
+					const digest = yield* crypto.digest("SHA-256", new TextEncoder().encode(message)).pipe(Effect.mapError(() => RequestBindingUnavailable.make({})));
+					return Object.freeze({
+						verifier: TokenDigest.make(Encoding.encodeBase64Url(digest)),
+						expiresAtMillis: value.expiresAtMillis
+					});
+				})
+			});
+		}));
+	};
+	const layer = Layer.unwrap(Effect.map(RequestBindingConfig, signedLayer));
+	return Object.freeze({
+		RequestBinding,
+		signedLayer,
+		layer
+	});
+};
+//#endregion
+export { RequestBindingConfigurationError, RequestBindingCredential, RequestBindingFlowId, RequestBindingInvalid, RequestBindingPublic, RequestBindingUnavailable, makeRequestBinding };
+
+//# sourceMappingURL=requestBinding.mjs.map