@yielded/auth 0.1.0-beta.1

package/src/http-operation/client.ts

@@ -0,0 +1,453 @@
+import { DateTime, Effect, Redacted, Schema, Semaphore } from "effect";
+
+import type { AuthCredentialCommand, CredentialSlot } from "../operations/credentials";
+import { snapshotRevealCommands, type AuthRevealCommandCollector } from "../operations/reveals";
+import { headerName } from "./configuration-schema";
+import {
+  type AnyRoute,
+  HttpRequestBody,
+  type RouteFailure,
+  type RouteInput,
+  type RouteSuccess,
+} from "./contract";
+import { OperationHttpError } from "./errors";
+import type { HttpCredentials } from "./models";
+import { CredentialWire, RevealWire, credentialSlots, decodeRevealWire } from "./private";
+
+export interface OperationFetchOptions {
+  readonly baseUrl: string;
+  readonly csrfHeader: string;
+  readonly csrfValue: string;
+  readonly maximumResponseBytes?: number;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly privateOutput?: AuthRevealCommandCollector & { readonly clear: Effect.Effect<void> };
+  readonly native?: {
+    readonly modeHeader: string;
+    readonly requestHeaders: Readonly<Record<CredentialSlot, string>>;
+    readonly responseHeaders: Readonly<Record<CredentialSlot, string>>;
+    readonly read: Effect.Effect<HttpCredentials, OperationHttpError>;
+    readonly accept: (
+      commands: ReadonlyArray<AuthCredentialCommand>,
+    ) => Effect.Effect<void, OperationHttpError>;
+  };
+}
+
+export interface OperationCallOptions<Success = unknown> {
+  readonly replaceSubject?: boolean | ((success: Success) => boolean);
+  /** Runs inside credential admission after fencing old responses. The callback
+   * must not call this client's transition or start another credential call. */
+  readonly onTransition?: Effect.Effect<void>;
+}
+
+export interface OperationFetchClient {
+  readonly call: <R extends AnyRoute>(
+    route: R,
+    input: RouteInput<R>,
+    options?: OperationCallOptions<RouteSuccess<R>>,
+  ) => Effect.Effect<
+    RouteSuccess<R>,
+    RouteFailure<R> | OperationHttpError,
+    | R["operation"]["rpc"]["successSchema"]["DecodingServices"]
+    | R["operation"]["rpc"]["errorSchema"]["DecodingServices"]
+  >;
+  /** Wait for admitted credential responses, then fence old queries and clear reveals.
+   * All authenticated subject changes for this client must pass this boundary. */
+  readonly transition: Effect.Effect<void>;
+  readonly generation: Effect.Effect<number>;
+}
+
+/** Complete an authentication operation and publish its subject while its
+ * credential response remains admitted. Undefined preserves a pending flow. */
+export interface OperationAuthenticationCompletion {
+  <R extends AnyRoute>(
+    route: R,
+    input: RouteInput<R>,
+    fromSuccess: (success: RouteSuccess<R>) => string | null | undefined,
+    options?: { readonly onTransition?: Effect.Effect<void> },
+  ): Effect.Effect<
+    RouteSuccess<R>,
+    RouteFailure<R> | OperationHttpError,
+    | R["operation"]["rpc"]["successSchema"]["DecodingServices"]
+    | R["operation"]["rpc"]["errorSchema"]["DecodingServices"]
+  >;
+}
+
+/** The caller owns the lifecycle gate and publisher. Publishers must not call
+ * the transport: they run under credential admission, before reveal acceptance. */
+export const makeAuthenticationCompletion = (
+  client: OperationFetchClient,
+  gate: Semaphore.Semaphore,
+  publishSubject: (subject: string | null) => Effect.Effect<void>,
+): OperationAuthenticationCompletion =>
+  Effect.fn("OperationHttpClient.completeAuthentication")(function* <R extends AnyRoute>(
+    route: R,
+    input: RouteInput<R>,
+    fromSuccess: (success: RouteSuccess<R>) => string | null | undefined,
+    options?: { readonly onTransition?: Effect.Effect<void> },
+  ) {
+    const started = yield* client.generation;
+
+    return yield* gate.withPermits(1)(
+      Effect.gen(function* () {
+        if ((yield* client.generation) !== started)
+          return yield* OperationHttpError.make({ reason: "stale-response" });
+
+        return yield* Effect.uninterruptible(
+          Effect.gen(function* () {
+            let nextSubject: string | null | undefined;
+
+            return yield* client.call(route, input, {
+              replaceSubject: (value) => {
+                nextSubject = fromSuccess(value);
+
+                return nextSubject !== undefined;
+              },
+              onTransition: Effect.suspend(() =>
+                nextSubject === undefined
+                  ? Effect.void
+                  : publishSubject(nextSubject).pipe(
+                      Effect.andThen(options?.onTransition ?? Effect.void),
+                    ),
+              ),
+            });
+          }).pipe(
+            // A failed response can follow a cookie already accepted by the
+            // browser. Remove the old account state without replaying the call.
+            Effect.onError(() =>
+              Effect.gen(function* () {
+                yield* client.transition;
+                yield* publishSubject(null);
+                yield* options?.onTransition ?? Effect.void;
+              }),
+            ),
+          ),
+        );
+      }),
+    );
+  });
+
+const responseCodec = Schema.fromJsonString(
+  Schema.Union([
+    Schema.TaggedStruct("Success", {
+      value: Schema.optionalKey(Schema.Json),
+      private: Schema.optionalKey(Schema.Array(RevealWire)),
+    }),
+    Schema.TaggedStruct("Failure", { error: Schema.Json }),
+    Schema.TaggedStruct("TransportFailure", { reason: Schema.String }),
+  ]),
+);
+
+const credentialCodec = Schema.fromJsonString(CredentialWire);
+const requestCodec = Schema.fromJsonString(HttpRequestBody);
+
+const readBody = (response: Response, maximum: number) =>
+  Effect.tryPromise({
+    try: async (signal) => {
+      if (response.body === null) return "";
+      const reader = response.body.getReader();
+      const chunks: Uint8Array[] = [];
+      let size = 0;
+
+      const abort = () => {
+        void reader.cancel();
+      };
+
+      signal.addEventListener("abort", abort, { once: true });
+      try {
+        while (true) {
+          const part = await reader.read();
+
+          if (part.done) break;
+          size += part.value.length;
+          if (size > maximum) {
+            await reader.cancel();
+            throw new Error();
+          }
+          chunks.push(part.value);
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+
+        for (const chunk of chunks) {
+          bytes.set(chunk, offset);
+          offset += chunk.length;
+        }
+
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      } finally {
+        signal.removeEventListener("abort", abort);
+        reader.releaseLock();
+      }
+    },
+    catch: () => OperationHttpError.make({ reason: "response" }),
+  });
+
+/** One instance owns credential ordering and stale-result fencing. Share it within
+ * a browser authentication lifetime; mutations are never automatically retried. */
+export const make = Effect.fn("OperationHttpClient.make")(function* (
+  options: OperationFetchOptions,
+): Effect.fn.Return<OperationFetchClient, OperationHttpError> {
+  const base = yield* Effect.try({
+    try: () => new URL(options.baseUrl),
+    catch: () => OperationHttpError.make({ reason: "request" }),
+  });
+
+  if (
+    !Number.isSafeInteger(options.maximumResponseBytes ?? 1048576) ||
+    (options.maximumResponseBytes ?? 1048576) < 1 ||
+    (options.maximumResponseBytes ?? 1048576) > 1048576 ||
+    !/^x-[a-z0-9-]{1,61}$/.test(options.csrfHeader) ||
+    options.csrfValue.length < 1 ||
+    options.csrfValue.length > 128 ||
+    !["https:", "http:"].includes(base.protocol) ||
+    base.username !== "" ||
+    base.password !== "" ||
+    base.search !== "" ||
+    base.hash !== ""
+  )
+    return yield* OperationHttpError.make({ reason: "request" });
+  if (options.native !== undefined) {
+    const names = [
+      options.native.modeHeader,
+      ...credentialSlots.map((slot) => options.native!.requestHeaders[slot]),
+    ];
+
+    const response = credentialSlots.map((slot) => options.native!.responseHeaders[slot]);
+
+    if (
+      [...names, ...response].some((name) => !Schema.is(headerName)(name)) ||
+      new Set(names).size !== names.length ||
+      new Set(response).size !== response.length ||
+      names.includes(options.csrfHeader)
+    )
+      return yield* OperationHttpError.make({ reason: "request" });
+  }
+  const gate = yield* Semaphore.make(1);
+  let generation = 0;
+
+  const advance = Effect.gen(function* () {
+    generation++;
+    if (options.privateOutput !== undefined) yield* options.privateOutput.clear;
+  });
+
+  const call = Effect.fn("OperationHttpClient.call")(function* <R extends AnyRoute>(
+    route: R,
+    input: RouteInput<R>,
+    callOptions?: OperationCallOptions<RouteSuccess<R>>,
+  ): Effect.fn.Return<
+    RouteSuccess<R>,
+    RouteFailure<R> | OperationHttpError,
+    | R["operation"]["rpc"]["successSchema"]["DecodingServices"]
+    | R["operation"]["rpc"]["errorSchema"]["DecodingServices"]
+  > {
+    const started = generation;
+
+    const services = yield* Effect.context<
+      | R["operation"]["rpc"]["successSchema"]["DecodingServices"]
+      | R["operation"]["rpc"]["errorSchema"]["DecodingServices"]
+    >();
+
+    type DecoderServices =
+      | R["operation"]["rpc"]["successSchema"]["DecodingServices"]
+      | R["operation"]["rpc"]["errorSchema"]["DecodingServices"];
+
+    // The route generic retains the exact schemas while heterogeneous property
+    // access widens them to Rpc.AnyWithProps. Restore that relationship locally.
+    const successSchema = route.operation.rpc.successSchema as Schema.Codec<
+      RouteSuccess<R>,
+      unknown,
+      DecoderServices,
+      unknown
+    >;
+
+    const errorSchema = route.operation.rpc.errorSchema as Schema.Codec<
+      RouteFailure<R>,
+      unknown,
+      DecoderServices,
+      unknown
+    >;
+
+    if (
+      route.operation.reveals.some(
+        (kind) =>
+          options.privateOutput === undefined ||
+          !options.privateOutput.supportedKinds.includes(kind) ||
+          !route.reveals.includes(kind),
+      )
+    )
+      return yield* OperationHttpError.make({ reason: "private-output" });
+
+    const work = Effect.gen(function* () {
+      if (started !== generation)
+        return yield* OperationHttpError.make({ reason: "stale-response" });
+
+      const payload =
+        input === undefined
+          ? undefined
+          : // oxlint-disable-next-line no-restricted-properties -- untyped input is validated for JSON transport compatibility.
+            yield* Schema.decodeUnknownEffect(Schema.Json)(input).pipe(
+              Effect.mapError(() => OperationHttpError.make({ reason: "request" })),
+            );
+
+      const body = yield* Schema.encodeEffect(requestCodec)(
+        payload === undefined ? {} : { payload },
+      ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "request" })));
+
+      if (route.method === "GET" && input !== undefined)
+        return yield* OperationHttpError.make({ reason: "request" });
+
+      const headers = new Headers(
+        route.method === "GET"
+          ? {}
+          : {
+              "content-type": "application/json",
+              [options.csrfHeader]: options.csrfValue,
+            },
+      );
+
+      if (options.native !== undefined) {
+        headers.set(options.native.modeHeader, "native");
+        const credentials = yield* options.native.read;
+
+        for (const slot of credentialSlots)
+          if (credentials[slot] !== undefined)
+            headers.set(options.native.requestHeaders[slot], Redacted.value(credentials[slot]!));
+      }
+      const destination = new URL(route.path, base);
+
+      const response = yield* Effect.tryPromise({
+        try: (signal) => {
+          // Native credential reads and schema services may suspend. Admission
+          // and fetch dispatch share this synchronous check so an old workflow
+          // cannot send a write with a newly installed subject's credentials.
+          if (started !== generation) throw OperationHttpError.make({ reason: "stale-response" });
+
+          return (options.fetch ?? globalThis.fetch)(destination, {
+            method: route.method,
+            headers,
+            ...(route.method === "GET" ? {} : { body }),
+            credentials: options.native === undefined ? "include" : "omit",
+            redirect: "error",
+            signal,
+          });
+        },
+        catch: (error) =>
+          Schema.is(OperationHttpError)(error)
+            ? error
+            : OperationHttpError.make({ reason: "network" }),
+      });
+
+      if (
+        response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !==
+        "application/json"
+      )
+        return yield* OperationHttpError.make({ reason: "response" });
+
+      const envelope = yield* Schema.decodeEffect(responseCodec)(
+        yield* readBody(response, options.maximumResponseBytes ?? 1048576),
+      ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "response" })));
+
+      if (started !== generation)
+        return yield* OperationHttpError.make({ reason: "stale-response" });
+      if (envelope._tag === "TransportFailure")
+        return yield* OperationHttpError.make({
+          reason:
+            envelope.reason === "origin" ||
+            envelope.reason === "csrf" ||
+            envelope.reason === "credentials" ||
+            envelope.reason === "private-output"
+              ? envelope.reason
+              : "response",
+        });
+      if (envelope._tag === "Failure") {
+        const failure = yield* Schema.decodeEffect(errorSchema)(envelope.error).pipe(
+          Effect.provide(services),
+          Effect.mapError(() => OperationHttpError.make({ reason: "response" })),
+        );
+
+        return yield* Effect.fail(failure as RouteFailure<R>);
+      }
+      if (!response.ok) return yield* OperationHttpError.make({ reason: "response" });
+
+      const value = yield* Schema.decodeEffect(successSchema)(envelope.value).pipe(
+        Effect.provide(services),
+        Effect.mapError(() => OperationHttpError.make({ reason: "response" })),
+      );
+
+      if (started !== generation)
+        return yield* OperationHttpError.make({ reason: "stale-response" });
+
+      const privateCommands = yield* Effect.try({
+        try: () =>
+          snapshotRevealCommands((envelope.private ?? []).map(decodeRevealWire), route.reveals),
+        catch: () => OperationHttpError.make({ reason: "private-output" }),
+      });
+
+      const now = DateTime.toEpochMillis(yield* DateTime.now);
+
+      if (
+        privateCommands.some(
+          (command) => command.expiresAtMillis <= now || command.expiresAtMillis > now + 300_000,
+        )
+      )
+        return yield* OperationHttpError.make({ reason: "private-output" });
+      if (privateCommands.length > 0 && options.privateOutput === undefined)
+        return yield* OperationHttpError.make({ reason: "private-output" });
+      if (options.native !== undefined) {
+        const commands: AuthCredentialCommand[] = [];
+
+        for (const slot of credentialSlots) {
+          const raw = response.headers.get(options.native.responseHeaders[slot]);
+
+          if (raw === null) continue;
+          if (!route.operation.credentials)
+            return yield* OperationHttpError.make({ reason: "credentials" });
+
+          const command = yield* Schema.decodeEffect(credentialCodec)(raw).pipe(
+            Effect.mapError(() => OperationHttpError.make({ reason: "response" })),
+          );
+
+          if (command._tag === "Issue" && command.expiresAtMillis <= now)
+            return yield* OperationHttpError.make({ reason: "credentials" });
+          commands.push(
+            command._tag === "Clear"
+              ? { _tag: "Clear", slot }
+              : { ...command, slot, credential: Redacted.make(command.credential) },
+          );
+        }
+        if (commands.length > 0) yield* options.native.accept(commands);
+      }
+      const projectSubject = callOptions?.replaceSubject;
+
+      const replaceSubject =
+        typeof projectSubject === "function"
+          ? yield* Effect.try({
+              try: () => projectSubject(value as RouteSuccess<R>),
+              catch: () => OperationHttpError.make({ reason: "response" }),
+            })
+          : projectSubject === true;
+
+      if (replaceSubject) {
+        yield* advance;
+        if (callOptions?.onTransition !== undefined) yield* callOptions.onTransition;
+      }
+      if (privateCommands.length > 0) yield* options.privateOutput!.accept(privateCommands);
+
+      return value as RouteSuccess<R>;
+    });
+
+    // Once a credential response is admitted it must settle before the lifetime
+    // advances: browsers apply Set-Cookie before JavaScript can inspect a response.
+    return yield* route.operation.credentials ||
+    route.operation.reveals.length > 0 ||
+    (callOptions?.replaceSubject !== undefined && callOptions.replaceSubject !== false)
+      ? gate.withPermits(1)(Effect.uninterruptible(work))
+      : work;
+  });
+
+  return {
+    call,
+    transition: gate.withPermits(1)(advance),
+    generation: Effect.sync(() => generation),
+  };
+});

package/src/http-operation/configuration-schema.ts

@@ -0,0 +1,19 @@
+import { Schema } from "effect";
+
+export const headerName = Schema.String.check(Schema.isPattern(/^x-[a-z0-9-]{1,61}$/));
+
+export const origin = Schema.String.check(
+  Schema.makeFilter((value) => {
+    try {
+      const url = new URL(value);
+
+      return (
+        url.origin === value &&
+        (url.protocol === "https:" ||
+          (url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+      );
+    } catch {
+      return false;
+    }
+  }),
+);

package/src/http-operation/contract.ts

@@ -0,0 +1,116 @@
+import type { Effect } from "effect";
+import { Schema } from "effect";
+import type { Rpc } from "effect/unstable/rpc";
+
+import type { AuthInvocation } from "../operations/context";
+import type { CredentialSlot } from "../operations/credentials";
+import type { OperationExposure, OperationReplay } from "../operations/operation";
+import type { AuthRevealKind } from "../operations/reveals";
+import { OperationHttpConfigurationError } from "./errors";
+
+export interface HttpOperation {
+  readonly rpc: Rpc.AnyWithProps;
+  readonly exposure: OperationExposure;
+  readonly replay: OperationReplay;
+  readonly credentials: boolean;
+  readonly reveals: ReadonlyArray<AuthRevealKind>;
+  readonly invokeUnknown: (
+    invocation: AuthInvocation,
+    input: unknown,
+  ) => Effect.Effect<unknown, unknown, unknown>;
+}
+
+export type CredentialFields<O extends HttpOperation> = Readonly<
+  Partial<Record<Extract<keyof O["rpc"]["payloadSchema"]["Encoded"], string>, CredentialSlot>>
+>;
+
+export interface OperationHttpRoute<
+  O extends HttpOperation,
+  Fields extends Readonly<Record<string, CredentialSlot>> = Record<never, never>,
+  Method extends "POST" | "GET" = "POST",
+> {
+  readonly operation: O;
+  readonly path: string;
+  readonly method: Method;
+  readonly credentials: Fields;
+  readonly reveals: ReadonlyArray<AuthRevealKind>;
+}
+
+export const route = <
+  O extends HttpOperation,
+  const Fields extends Readonly<Record<string, CredentialSlot>> = Record<never, never>,
+>(
+  operation: O,
+  options: {
+    readonly path: string;
+    readonly credentials?: Fields &
+      Record<
+        Exclude<keyof Fields, Extract<keyof O["rpc"]["payloadSchema"]["Encoded"], string>>,
+        never
+      >;
+    readonly allowInternal?: true;
+    readonly reveals?: ReadonlyArray<AuthRevealKind>;
+  },
+): OperationHttpRoute<O, NoInfer<Fields>> => {
+  if (!Schema.is(Schema.String.check(Schema.isPattern(/^\/(?:[A-Za-z0-9_-]+\/?)*$/)))(options.path))
+    throw OperationHttpConfigurationError.make({ reason: "route" });
+  if (operation.exposure !== "public" && options.allowInternal !== true)
+    throw OperationHttpConfigurationError.make({ reason: "internal-operation" });
+  const reveals = [...(options.reveals ?? [])];
+
+  if (
+    new Set(reveals).size !== reveals.length ||
+    reveals.some((kind) => !operation.reveals.includes(kind))
+  )
+    throw OperationHttpConfigurationError.make({ reason: "credentials" });
+
+  return Object.freeze({
+    operation,
+    path: options.path,
+    method: "POST",
+    credentials: Object.freeze({ ...options.credentials }) as Fields,
+    reveals: Object.freeze(reveals),
+  });
+};
+
+export type AnyRoute = OperationHttpRoute<
+  HttpOperation,
+  Readonly<Record<string, CredentialSlot>>,
+  "POST" | "GET"
+>;
+
+export type RouteInput<R extends AnyRoute> = keyof R["credentials"] extends never
+  ? R["operation"]["rpc"]["payloadSchema"]["Encoded"]
+  : Omit<R["operation"]["rpc"]["payloadSchema"]["Encoded"], keyof R["credentials"]>;
+
+export type RouteSuccess<R extends AnyRoute> = R["operation"]["rpc"]["successSchema"]["Type"];
+export type RouteFailure<R extends AnyRoute> = R["operation"]["rpc"]["errorSchema"]["Type"];
+
+export type RouteRequirements<R extends AnyRoute> =
+  | Effect.Services<ReturnType<R["operation"]["invokeUnknown"]>>
+  | R["operation"]["rpc"]["successSchema"]["EncodingServices"]
+  | R["operation"]["rpc"]["errorSchema"]["EncodingServices"];
+
+export const make = <const Routes extends Readonly<Record<string, AnyRoute>>>(routes: Routes) => {
+  const paths = new Set<string>();
+  const tags = new Set<string>();
+
+  for (const value of Object.values(routes)) {
+    if (paths.has(value.path))
+      throw OperationHttpConfigurationError.make({ reason: "duplicate-route" });
+    if (tags.has(value.operation.rpc._tag))
+      throw OperationHttpConfigurationError.make({ reason: "duplicate-operation" });
+    paths.add(value.path);
+    tags.add(value.operation.rpc._tag);
+  }
+
+  return Object.freeze({ routes: Object.freeze({ ...routes }) as Routes });
+};
+
+export const HttpRequestBody = Schema.Struct({ payload: Schema.optionalKey(Schema.Json) });
+
+export const HttpResponseBody = Schema.Union([
+  Schema.TaggedStruct("Success", { value: Schema.optionalKey(Schema.Json) }),
+  Schema.TaggedStruct("Failure", { error: Schema.Json }),
+  Schema.TaggedStruct("TransportFailure", { reason: Schema.String }),
+]);

package/src/http-operation/errors.ts

@@ -0,0 +1,38 @@
+import { Schema } from "effect";
+
+export class OperationHttpConfigurationError extends Schema.TaggedError<OperationHttpConfigurationError>()(
+  "OperationHttpConfigurationError",
+  {
+    reason: Schema.Literals([
+      "route",
+      "duplicate-route",
+      "duplicate-operation",
+      "internal-operation",
+      "credentials",
+      "cookies",
+      "origin",
+      "callback",
+      "redirect",
+    ]),
+  },
+) {}
+
+export class OperationHttpError extends Schema.TaggedError<OperationHttpError>()(
+  "OperationHttpError",
+  {
+    reason: Schema.Literals([
+      "request",
+      "not-found",
+      "method",
+      "origin",
+      "csrf",
+      "credentials",
+      "too-large",
+      "response",
+      "network",
+      "stale-response",
+      "private-output",
+      "unavailable",
+    ]),
+  },
+) {}

package/src/http-operation/models.ts

@@ -0,0 +1,42 @@
+import type { Effect, Redacted } from "effect";
+
+import type { CredentialSlot } from "../operations/credentials";
+import type { OperationHttpError } from "./errors";
+
+export const credentialSlots = [
+  "session",
+  "pending-proof",
+  "proof-continuation",
+  "registration",
+  "request-binding",
+  "session-step-up",
+  "password-intent",
+] as const;
+
+export type HttpCredentials = Readonly<Partial<Record<CredentialSlot, Redacted.Redacted<string>>>>;
+
+export interface OperationCookie {
+  readonly name: string;
+  readonly path: string;
+  readonly secure: boolean;
+  readonly sameSite: "lax" | "strict" | "none";
+  readonly domain?: string;
+}
+
+export interface OperationHttpConfiguration {
+  readonly cookies: Readonly<Record<CredentialSlot, OperationCookie>>;
+  readonly trustedOrigins: ReadonlyArray<string>;
+  readonly csrfHeader: string;
+  readonly csrfValue: string;
+  readonly maximumBodyBytes: number;
+  readonly maximumUrlBytes: number;
+  /** The host decides its public origin. Forwarded headers have no authority by default. */
+  readonly publicOrigin: string | ((request: Request) => Effect.Effect<string, OperationHttpError>);
+  readonly native?: {
+    readonly modeHeader: string;
+    readonly requestHeaders: Readonly<Record<CredentialSlot, string>>;
+    readonly responseHeaders: Readonly<Record<CredentialSlot, string>>;
+    /** Explicit host admission; absence of Origin alone is not native authorization. */
+    readonly authorize: (request: Request) => Effect.Effect<void, OperationHttpError>;
+  };
+}