@yielded/auth 0.1.0-beta.1

package/dist/http/auth-contract.mjs

@@ -0,0 +1,75 @@
+import { OperationHttpConfigurationError } from "../http-operation/errors.mjs";
+import { RevealWire } from "../http-operation/private.mjs";
+import { Context, Option, Schema, SchemaAST } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+//#region src/http/auth-contract.ts
+const transportFailure = (status, reasons) => Schema.TaggedStruct("TransportFailure", { reason: Schema.Literals(reasons) }).annotate({ httpApiStatus: status });
+const transportErrors = [
+	transportFailure(400, [
+		"request",
+		"credentials",
+		"response",
+		"network",
+		"stale-response",
+		"private-output"
+	]),
+	transportFailure(403, ["origin", "csrf"]),
+	transportFailure(404, ["not-found"]),
+	transportFailure(405, ["method"]),
+	transportFailure(413, ["too-large"]),
+	transportFailure(503, ["unavailable"])
+];
+var EndpointContract = class extends Context.Service()("effect-auth/http/EndpointContract") {};
+/** Only middleware and annotations may wrap the generated endpoint contract. */
+const matchesEndpoint = (actual, action) => {
+	const metadata = Context.getOption(actual.annotations, EndpointContract);
+	if (Option.isNone(metadata) || metadata.value.action !== action) return false;
+	const expected = metadata.value.original;
+	return actual.path === expected.path && actual.method === expected.method && actual.params === expected.params && actual.query === expected.query && actual.headers === expected.headers && actual.payload === expected.payload && actual.success === expected.success && actual.error === expected.error;
+};
+const endpoint = (name, action) => {
+	const rpc = action.route.operation.rpc;
+	const encodedPayload = Schema.toEncoded(rpc.payloadSchema);
+	const encodedSuccess = Schema.toEncoded(rpc.successSchema);
+	const noPayload = SchemaAST.isVoid(encodedPayload.ast) || SchemaAST.isUndefined(encodedPayload.ast);
+	const optionalPayload = Schema.is(encodedPayload)(void 0);
+	const noValue = SchemaAST.isVoid(encodedSuccess.ast) || SchemaAST.isUndefined(encodedSuccess.ast);
+	const optionalValue = Schema.is(encodedSuccess)(void 0);
+	const payload = noPayload ? Schema.Struct({}) : optionalPayload ? Schema.Struct({ payload: Schema.optionalKey(encodedPayload) }) : Schema.Struct({ payload: encodedPayload });
+	const privateOutput = Schema.optionalKey(Schema.Array(RevealWire));
+	const success = noValue ? action.route.reveals.length === 0 ? Schema.TaggedStruct("Success", {}) : Schema.TaggedStruct("Success", { private: privateOutput }) : optionalValue ? action.route.reveals.length === 0 ? Schema.TaggedStruct("Success", { value: Schema.optionalKey(encodedSuccess) }) : Schema.TaggedStruct("Success", {
+		value: Schema.optionalKey(encodedSuccess),
+		private: privateOutput
+	}) : action.route.reveals.length === 0 ? Schema.TaggedStruct("Success", { value: encodedSuccess }) : Schema.TaggedStruct("Success", {
+		value: encodedSuccess,
+		private: privateOutput
+	});
+	const failure = Schema.TaggedStruct("Failure", { error: Schema.toEncoded(rpc.errorSchema) }).annotate({ httpApiStatus: 400 });
+	const definition = action.route.method === "GET" ? HttpApiEndpoint.get(name, action.route.path, {
+		success,
+		error: [failure, ...transportErrors]
+	}) : HttpApiEndpoint.post(name, action.route.path, {
+		payload: Schema.toEncoded(payload),
+		success: Schema.toEncoded(success),
+		error: [Schema.toEncoded(failure), ...transportErrors]
+	});
+	return definition.annotate(EndpointContract, {
+		action,
+		original: definition
+	});
+};
+/** Native HttpApi projection of the named transport. Public envelopes are exact;
+* private credentials remain cookies/headers, and private reveals retain their envelope.
+* Server handlers use the same bounded operation decoder before schema projection.
+*/
+const httpGroup = (contract, options) => {
+	const name = options?.name ?? "auth";
+	const endpoints = Object.entries(contract.actions).map(([name, action]) => endpoint(name, action));
+	const first = endpoints[0];
+	if (first === void 0) throw OperationHttpConfigurationError.make({ reason: "route" });
+	return HttpApiGroup.make(name).add(first, ...endpoints.slice(1));
+};
+//#endregion
+export { httpGroup, matchesEndpoint };
+
+//# sourceMappingURL=auth-contract.mjs.map

package/dist/http/auth-contract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contract.mjs","names":[],"sources":["../../src/http/auth-contract.ts"],"sourcesContent":["import { Context, Option, Schema, SchemaAST } from \"effect\";\nimport { HttpApiEndpoint, HttpApiGroup } from \"effect/unstable/httpapi\";\n\nimport { OperationHttpConfigurationError } from \"../http-operation/errors\";\nimport { RevealWire } from \"../http-operation/private\";\nimport type { AnyAuthAction, AuthActions } from \"../operations/actions\";\n\nconst transportFailure = <const Reasons extends readonly [string, ...string[]]>(\n  status: number,\n  reasons: Reasons,\n) =>\n  Schema.TaggedStruct(\"TransportFailure\", { reason: Schema.Literals(reasons) }).annotate({\n    httpApiStatus: status,\n  });\n\nconst transportErrors = [\n  transportFailure(400, [\n    \"request\",\n    \"credentials\",\n    \"response\",\n    \"network\",\n    \"stale-response\",\n    \"private-output\",\n  ]),\n  transportFailure(403, [\"origin\", \"csrf\"]),\n  transportFailure(404, [\"not-found\"]),\n  transportFailure(405, [\"method\"]),\n  transportFailure(413, [\"too-large\"]),\n  transportFailure(503, [\"unavailable\"]),\n] as const;\n\nclass EndpointContract extends Context.Service<\n  EndpointContract,\n  {\n    readonly action: AnyAuthAction;\n    readonly original: Pick<\n      HttpApiEndpoint.Top,\n      \"path\" | \"method\" | \"params\" | \"query\" | \"headers\" | \"payload\" | \"success\" | \"error\"\n    >;\n  }\n>()(\"effect-auth/http/EndpointContract\") {}\n\n/** Only middleware and annotations may wrap the generated endpoint contract. */\nexport const matchesEndpoint = (actual: HttpApiEndpoint.Top, action: AnyAuthAction): boolean => {\n  const metadata = Context.getOption(actual.annotations, EndpointContract);\n\n  if (Option.isNone(metadata) || metadata.value.action !== action) return false;\n  const expected = metadata.value.original;\n\n  return (\n    actual.path === expected.path &&\n    actual.method === expected.method &&\n    actual.params === expected.params &&\n    actual.query === expected.query &&\n    actual.headers === expected.headers &&\n    actual.payload === expected.payload &&\n    actual.success === expected.success &&\n    actual.error === expected.error\n  );\n};\n\nconst endpoint = <const Name extends string, A extends AnyAuthAction>(name: Name, action: A) => {\n  const rpc = action.route.operation.rpc;\n\n  const encodedPayload = Schema.toEncoded<A[\"route\"][\"operation\"][\"rpc\"][\"payloadSchema\"]>(\n    rpc.payloadSchema,\n  );\n\n  const encodedSuccess = Schema.toEncoded<A[\"route\"][\"operation\"][\"rpc\"][\"successSchema\"]>(\n    rpc.successSchema,\n  );\n\n  const noPayload =\n    SchemaAST.isVoid(encodedPayload.ast) || SchemaAST.isUndefined(encodedPayload.ast);\n\n  const optionalPayload = Schema.is(encodedPayload)(undefined);\n  const noValue = SchemaAST.isVoid(encodedSuccess.ast) || SchemaAST.isUndefined(encodedSuccess.ast);\n  const optionalValue = Schema.is(encodedSuccess)(undefined);\n\n  const payload = noPayload\n    ? Schema.Struct({})\n    : optionalPayload\n      ? Schema.Struct({ payload: Schema.optionalKey(encodedPayload) })\n      : Schema.Struct({ payload: encodedPayload });\n\n  const privateOutput = Schema.optionalKey(Schema.Array(RevealWire));\n\n  const success = noValue\n    ? action.route.reveals.length === 0\n      ? Schema.TaggedStruct(\"Success\", {})\n      : Schema.TaggedStruct(\"Success\", { private: privateOutput })\n    : optionalValue\n      ? action.route.reveals.length === 0\n        ? Schema.TaggedStruct(\"Success\", { value: Schema.optionalKey(encodedSuccess) })\n        : Schema.TaggedStruct(\"Success\", {\n            value: Schema.optionalKey(encodedSuccess),\n            private: privateOutput,\n          })\n      : action.route.reveals.length === 0\n        ? Schema.TaggedStruct(\"Success\", { value: encodedSuccess })\n        : Schema.TaggedStruct(\"Success\", { value: encodedSuccess, private: privateOutput });\n\n  const failure = Schema.TaggedStruct(\"Failure\", {\n    error: Schema.toEncoded<A[\"route\"][\"operation\"][\"rpc\"][\"errorSchema\"]>(rpc.errorSchema),\n  }).annotate({ httpApiStatus: 400 });\n\n  const definition =\n    action.route.method === \"GET\"\n      ? HttpApiEndpoint.get(name, action.route.path, {\n          success,\n          error: [failure, ...transportErrors],\n        })\n      : HttpApiEndpoint.post(name, action.route.path, {\n          payload: Schema.toEncoded(payload),\n          success: Schema.toEncoded(success),\n          error: [Schema.toEncoded(failure), ...transportErrors],\n        });\n\n  return definition.annotate(EndpointContract, { action, original: definition });\n};\n\ntype Endpoints<Actions extends AuthActions> = {\n  readonly [Name in keyof Actions]: ReturnType<\n    typeof endpoint<Extract<Name, string>, Actions[Name]>\n  >;\n}[keyof Actions];\n\n/** Native HttpApi projection of the named transport. Public envelopes are exact;\n * private credentials remain cookies/headers, and private reveals retain their envelope.\n * Server handlers use the same bounded operation decoder before schema projection.\n */\nexport const httpGroup = <Actions extends AuthActions, const Name extends string = \"auth\">(\n  contract: { readonly actions: Actions },\n  options?: { readonly name?: Name },\n) => {\n  const name = (options?.name ?? \"auth\") as Name;\n\n  // Entries preserve each descriptor's name/schema pairing; iteration erases that relationship.\n  const endpoints = Object.entries(contract.actions).map(([name, action]) =>\n    endpoint(name, action),\n  ) as Endpoints<Actions>[];\n\n  const first = endpoints[0];\n\n  if (first === undefined) throw OperationHttpConfigurationError.make({ reason: \"route\" });\n\n  return HttpApiGroup.make(name).add(first, ...endpoints.slice(1));\n};\n"],"mappings":";;;;;AAOA,MAAM,oBACJ,QACA,YAEA,OAAO,aAAa,oBAAoB,EAAE,QAAQ,OAAO,SAAS,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EACrF,eAAe,OACjB,CAAC;AAEH,MAAM,kBAAkB;CACtB,iBAAiB,KAAK;EACpB;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,iBAAiB,KAAK,CAAC,UAAU,MAAM,CAAC;CACxC,iBAAiB,KAAK,CAAC,WAAW,CAAC;CACnC,iBAAiB,KAAK,CAAC,QAAQ,CAAC;CAChC,iBAAiB,KAAK,CAAC,WAAW,CAAC;CACnC,iBAAiB,KAAK,CAAC,aAAa,CAAC;AACvC;AAEA,IAAM,mBAAN,cAA+B,QAAQ,QASrC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC;;AAG1C,MAAa,mBAAmB,QAA6B,WAAmC;CAC9F,MAAM,WAAW,QAAQ,UAAU,OAAO,aAAa,gBAAgB;CAEvE,IAAI,OAAO,OAAO,QAAQ,KAAK,SAAS,MAAM,WAAW,QAAQ,OAAO;CACxE,MAAM,WAAW,SAAS,MAAM;CAEhC,OACE,OAAO,SAAS,SAAS,QACzB,OAAO,WAAW,SAAS,UAC3B,OAAO,WAAW,SAAS,UAC3B,OAAO,UAAU,SAAS,SAC1B,OAAO,YAAY,SAAS,WAC5B,OAAO,YAAY,SAAS,WAC5B,OAAO,YAAY,SAAS,WAC5B,OAAO,UAAU,SAAS;AAE9B;AAEA,MAAM,YAAgE,MAAY,WAAc;CAC9F,MAAM,MAAM,OAAO,MAAM,UAAU;CAEnC,MAAM,iBAAiB,OAAO,UAC5B,IAAI,aACN;CAEA,MAAM,iBAAiB,OAAO,UAC5B,IAAI,aACN;CAEA,MAAM,YACJ,UAAU,OAAO,eAAe,GAAG,KAAK,UAAU,YAAY,eAAe,GAAG;CAElF,MAAM,kBAAkB,OAAO,GAAG,cAAc,CAAC,CAAC,KAAA,CAAS;CAC3D,MAAM,UAAU,UAAU,OAAO,eAAe,GAAG,KAAK,UAAU,YAAY,eAAe,GAAG;CAChG,MAAM,gBAAgB,OAAO,GAAG,cAAc,CAAC,CAAC,KAAA,CAAS;CAEzD,MAAM,UAAU,YACZ,OAAO,OAAO,CAAC,CAAC,IAChB,kBACE,OAAO,OAAO,EAAE,SAAS,OAAO,YAAY,cAAc,EAAE,CAAC,IAC7D,OAAO,OAAO,EAAE,SAAS,eAAe,CAAC;CAE/C,MAAM,gBAAgB,OAAO,YAAY,OAAO,MAAM,UAAU,CAAC;CAEjE,MAAM,UAAU,UACZ,OAAO,MAAM,QAAQ,WAAW,IAC9B,OAAO,aAAa,WAAW,CAAC,CAAC,IACjC,OAAO,aAAa,WAAW,EAAE,SAAS,cAAc,CAAC,IAC3D,gBACE,OAAO,MAAM,QAAQ,WAAW,IAC9B,OAAO,aAAa,WAAW,EAAE,OAAO,OAAO,YAAY,cAAc,EAAE,CAAC,IAC5E,OAAO,aAAa,WAAW;EAC7B,OAAO,OAAO,YAAY,cAAc;EACxC,SAAS;CACX,CAAC,IACH,OAAO,MAAM,QAAQ,WAAW,IAC9B,OAAO,aAAa,WAAW,EAAE,OAAO,eAAe,CAAC,IACxD,OAAO,aAAa,WAAW;EAAE,OAAO;EAAgB,SAAS;CAAc,CAAC;CAExF,MAAM,UAAU,OAAO,aAAa,WAAW,EAC7C,OAAO,OAAO,UAAyD,IAAI,WAAW,EACxF,CAAC,CAAC,CAAC,SAAS,EAAE,eAAe,IAAI,CAAC;CAElC,MAAM,aACJ,OAAO,MAAM,WAAW,QACpB,gBAAgB,IAAI,MAAM,OAAO,MAAM,MAAM;EAC3C;EACA,OAAO,CAAC,SAAS,GAAG,eAAe;CACrC,CAAC,IACD,gBAAgB,KAAK,MAAM,OAAO,MAAM,MAAM;EAC5C,SAAS,OAAO,UAAU,OAAO;EACjC,SAAS,OAAO,UAAU,OAAO;EACjC,OAAO,CAAC,OAAO,UAAU,OAAO,GAAG,GAAG,eAAe;CACvD,CAAC;CAEP,OAAO,WAAW,SAAS,kBAAkB;EAAE;EAAQ,UAAU;CAAW,CAAC;AAC/E;;;;;AAYA,MAAa,aACX,UACA,YACG;CACH,MAAM,OAAQ,SAAS,QAAQ;CAG/B,MAAM,YAAY,OAAO,QAAQ,SAAS,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,YAC7D,SAAS,MAAM,MAAM,CACvB;CAEA,MAAM,QAAQ,UAAU;CAExB,IAAI,UAAU,KAAA,GAAW,MAAM,gCAAgC,KAAK,EAAE,QAAQ,QAAQ,CAAC;CAEvF,OAAO,aAAa,KAAK,IAAI,CAAC,CAAC,IAAI,OAAO,GAAG,UAAU,MAAM,CAAC,CAAC;AACjE"}

package/dist/http/auth-http.d.mts

@@ -0,0 +1,216 @@
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { OperationHttpConfigurationError, OperationHttpError } from "../http-operation/errors.mjs";
+import { SessionMetadata } from "../sessions/models.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { SessionApi } from "../auth/session.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import { ActionSuccess, AuthActions } from "../operations/actions.mjs";
+import { SessionHttpAuthorization, makeSessionHttpContract } from "./session-contract.mjs";
+import { OperationHttpInvocation } from "../http-operation/OperationHttpInvocation.mjs";
+import { OperationHttpServerConfig } from "../http-operation/OperationHttpServerConfig.mjs";
+import { Context, Effect, Layer, Schema, Scope, Unify } from "effect";
+import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+//#region src/http/auth-http.d.ts
+/** Browser transport policy. Insecure cookies require an explicit development override. */
+interface AuthHttpOptions {
+  readonly origin: string;
+  readonly maximumBodyBytes?: number;
+  readonly maximumUrlBytes?: number;
+  readonly cookie?: {
+    readonly prefix?: string;
+    readonly name?: string;
+    readonly secure?: boolean;
+    readonly sameSite?: "lax" | "strict";
+  };
+  readonly csrf?: {
+    readonly header: string;
+    readonly value: string;
+  };
+}
+/** Bind an Auth definition to shared browser actions and neutral request middleware.
+ * Mutation admission checks Origin and CSRF before effects. Generated operation
+ * handlers independently require JSON; custom protected workflows choose their encoding.
+ * The application owns session policy, persistence and profile lookup.
+ */
+declare const make: <I, S extends SessionMetadata, RE, Api extends SessionApi<S, unknown>, Actions extends AuthActions>(auth: Omit<Context.Key<I, Api>, typeof Unify.unifySymbol> & {
+  readonly sessions: {
+    readonly Session: Schema.Codec<S, unknown, unknown, RE>;
+  };
+  readonly contract: {
+    readonly actions: Actions;
+  };
+}, options: AuthHttpOptions) => {
+  routes: () => Layer.Layer<never, OperationHttpConfigurationError, import("effect/FileSystem").FileSystem | import("effect/unstable/http/Etag").Generator | import("effect/unstable/http/HttpPlatform").HttpPlatform | HttpRouter.HttpRouter | import("effect/Path").Path | Exclude<Exclude<I, Scope.Scope>, Scope.Scope> | Exclude<Exclude<Exclude<{ readonly [Name in keyof Actions]: Omit<Actions[Name]["route"], "operation"> & {
+    readonly operation: Omit<Actions[Name]["route"]["operation"], "invokeUnknown"> & {
+      readonly invokeUnknown: (invocation: unknown, input: unknown) => Effect.Effect<ActionSuccess<Actions[Name]>, Effect.Error<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>, I | Effect.Services<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>>;
+    };
+  }; }[keyof Actions]["operation"]["rpc"]["errorSchema"]["EncodingServices"], AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope>, OperationHttpInvocation | OperationHttpServerConfig>, Scope.Scope> | Exclude<Exclude<Exclude<{ readonly [Name in keyof Actions]: Omit<Actions[Name]["route"], "operation"> & {
+    readonly operation: Omit<Actions[Name]["route"]["operation"], "invokeUnknown"> & {
+      readonly invokeUnknown: (invocation: unknown, input: unknown) => Effect.Effect<ActionSuccess<Actions[Name]>, Effect.Error<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>, I | Effect.Services<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>>;
+    };
+  }; }[keyof Actions]["operation"]["rpc"]["successSchema"]["EncodingServices"], AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope>, OperationHttpInvocation | OperationHttpServerConfig>, Scope.Scope> | Exclude<Exclude<Exclude<Effect.Services<ReturnType<{ readonly [Name in keyof Actions]: Omit<Actions[Name]["route"], "operation"> & {
+    readonly operation: Omit<Actions[Name]["route"]["operation"], "invokeUnknown"> & {
+      readonly invokeUnknown: (invocation: unknown, input: unknown) => Effect.Effect<ActionSuccess<Actions[Name]>, Effect.Error<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>, I | Effect.Services<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>>;
+    };
+  }; }[keyof Actions]["operation"]["invokeUnknown"]>>, AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope>, OperationHttpInvocation | OperationHttpServerConfig>, Scope.Scope> | Exclude<{ readonly [Name in keyof Actions]: HttpApiEndpoint.HttpApiEndpoint<Extract<Name, string>, "GET", `/${string}`, never, never, never, never, Schema.toCodecJson<Schema.TaggedStruct<"Success", {}> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.optionalKey<Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+    readonly private: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.Literals<readonly ["totp-enrollment", "recovery-codes"]>;
+      readonly revealId: Schema.NonEmptyString;
+      readonly expiresAtMillis: Schema.Int;
+      readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    }>>>;
+  }>>, Schema.toCodecJson<Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["request", "credentials", "response", "network", "stale-response", "private-output"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["origin", "csrf"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["not-found"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["method"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["too-large"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["unavailable"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"Failure">;
+    readonly error: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["errorSchema"]>;
+  }>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<Extract<Name, string>, "POST", `/${string}`, never, never, Schema.toCodecJson<Schema.toEncoded<Schema.Struct<{}>>>, never, Schema.toCodecJson<Schema.toEncoded<Schema.TaggedStruct<"Success", {}> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.optionalKey<Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+    readonly private: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.Literals<readonly ["totp-enrollment", "recovery-codes"]>;
+      readonly revealId: Schema.NonEmptyString;
+      readonly expiresAtMillis: Schema.Int;
+      readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    }>>>;
+  }>>>, Schema.toCodecJson<Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["request", "credentials", "response", "network", "stale-response", "private-output"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["origin", "csrf"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["not-found"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["method"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["too-large"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["unavailable"]>;
+  }> | Schema.toEncoded<Schema.Struct<{
+    readonly _tag: Schema.tag<"Failure">;
+    readonly error: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["errorSchema"]>;
+  }>>>, never, never>; }[keyof Actions] extends (infer T_1) ? T_1 extends { readonly [Name in keyof Actions]: HttpApiEndpoint.HttpApiEndpoint<Extract<Name, string>, "GET", `/${string}`, never, never, never, never, Schema.toCodecJson<Schema.TaggedStruct<"Success", {}> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.optionalKey<Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+    readonly private: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.Literals<readonly ["totp-enrollment", "recovery-codes"]>;
+      readonly revealId: Schema.NonEmptyString;
+      readonly expiresAtMillis: Schema.Int;
+      readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    }>>>;
+  }>>, Schema.toCodecJson<Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["request", "credentials", "response", "network", "stale-response", "private-output"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["origin", "csrf"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["not-found"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["method"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["too-large"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["unavailable"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"Failure">;
+    readonly error: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["errorSchema"]>;
+  }>>, never, never> | HttpApiEndpoint.HttpApiEndpoint<Extract<Name, string>, "POST", `/${string}`, never, never, Schema.toCodecJson<Schema.toEncoded<Schema.Struct<{}>>>, never, Schema.toCodecJson<Schema.toEncoded<Schema.TaggedStruct<"Success", {}> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.optionalKey<Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+  }> | Schema.TaggedStruct<"Success", {
+    readonly value: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["successSchema"]>;
+    readonly private: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly kind: Schema.Literals<readonly ["totp-enrollment", "recovery-codes"]>;
+      readonly revealId: Schema.NonEmptyString;
+      readonly expiresAtMillis: Schema.Int;
+      readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    }>>>;
+  }>>>, Schema.toCodecJson<Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["request", "credentials", "response", "network", "stale-response", "private-output"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["origin", "csrf"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["not-found"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["method"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["too-large"]>;
+  }> | Schema.Struct<{
+    readonly _tag: Schema.tag<"TransportFailure">;
+    readonly reason: Schema.Literals<readonly ["unavailable"]>;
+  }> | Schema.toEncoded<Schema.Struct<{
+    readonly _tag: Schema.tag<"Failure">;
+    readonly error: Schema.toEncoded<Actions[Name]["route"]["operation"]["rpc"]["errorSchema"]>;
+  }>>>, never, never>; }[keyof Actions] ? T_1 extends HttpApiEndpoint.Constraint ? HttpRouter.Request.From<"Requires", Exclude<HttpServerRequest.HttpServerRequest, import("effect/unstable/httpapi/HttpApiMiddleware").Provides<HttpApiEndpoint.Middleware<T_1>> | HttpRouter.Provided>> | HttpRouter.Request.From<"Requires", Exclude<HttpApiEndpoint.ServerServices<T_1>, import("effect/unstable/httpapi/HttpApiMiddleware").Provides<HttpApiEndpoint.Middleware<T_1>> | HttpRouter.Provided>> | HttpApiEndpoint.Middleware<T_1> | HttpApiEndpoint.MiddlewareServices<T_1> : never : never : never, Scope.Scope>>;
+  handlers: <ApiId extends string, Groups extends HttpApiGroup.Constraint, const Name extends HttpApiGroup.Identifier<Groups> = Extract<HttpApiGroup.Identifier<Groups>, "auth">>(api: HttpApi.HttpApi<ApiId, Groups>, options?: {
+    readonly name?: Name;
+  }) => Layer.Layer<HttpApiGroup.Service<ApiId, Name>, OperationHttpConfigurationError, Exclude<Exclude<I, Scope.Scope>, Scope.Scope> | Exclude<Exclude<Exclude<{ readonly [Name in keyof Actions]: Omit<Actions[Name]["route"], "operation"> & {
+    readonly operation: Omit<Actions[Name]["route"]["operation"], "invokeUnknown"> & {
+      readonly invokeUnknown: (invocation: unknown, input: unknown) => Effect.Effect<ActionSuccess<Actions[Name]>, Effect.Error<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>, I | Effect.Services<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>>;
+    };
+  }; }[keyof Actions]["operation"]["rpc"]["errorSchema"]["EncodingServices"], AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope>, OperationHttpInvocation | OperationHttpServerConfig>, Scope.Scope> | Exclude<Exclude<Exclude<{ readonly [Name in keyof Actions]: Omit<Actions[Name]["route"], "operation"> & {
+    readonly operation: Omit<Actions[Name]["route"]["operation"], "invokeUnknown"> & {
+      readonly invokeUnknown: (invocation: unknown, input: unknown) => Effect.Effect<ActionSuccess<Actions[Name]>, Effect.Error<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>, I | Effect.Services<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>>;
+    };
+  }; }[keyof Actions]["operation"]["rpc"]["successSchema"]["EncodingServices"], AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope>, OperationHttpInvocation | OperationHttpServerConfig>, Scope.Scope> | Exclude<Exclude<Exclude<Effect.Services<ReturnType<{ readonly [Name in keyof Actions]: Omit<Actions[Name]["route"], "operation"> & {
+    readonly operation: Omit<Actions[Name]["route"]["operation"], "invokeUnknown"> & {
+      readonly invokeUnknown: (invocation: unknown, input: unknown) => Effect.Effect<ActionSuccess<Actions[Name]>, Effect.Error<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>, I | Effect.Services<ReturnType<Extract<Api[Extract<keyof Actions, keyof Api>], (...args: never[]) => Effect.Effect<unknown, unknown, unknown>>>>>;
+    };
+  }; }[keyof Actions]["operation"]["invokeUnknown"]>>, AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope>, OperationHttpInvocation | OperationHttpServerConfig>, Scope.Scope> | Exclude<HttpApiGroup.Endpoints<Extract<Groups, {
+    readonly identifier: Name;
+  }>> extends (infer T_1) ? T_1 extends HttpApiGroup.Endpoints<Extract<Groups, {
+    readonly identifier: Name;
+  }>> ? T_1 extends HttpApiEndpoint.Constraint ? HttpRouter.Request.From<"Requires", Exclude<HttpServerRequest.HttpServerRequest, import("effect/unstable/httpapi/HttpApiMiddleware").Provides<HttpApiEndpoint.Middleware<T_1>> | HttpRouter.Provided>> | HttpRouter.Request.From<"Requires", Exclude<HttpApiEndpoint.ServerServices<T_1>, import("effect/unstable/httpapi/HttpApiMiddleware").Provides<HttpApiEndpoint.Middleware<T_1>> | HttpRouter.Provided>> | HttpApiEndpoint.Middleware<T_1> | HttpApiEndpoint.MiddlewareServices<T_1> : never : never : never, Scope.Scope>>;
+  middleware: <RIn2, E2, ROut2>(self: Layer.Layer<ROut2, E2, RIn2>) => Layer.Layer<ROut2, E2 | OperationHttpConfigurationError, Exclude<RIn2, HttpRouter.Request<"Requires", AuthRequest> | HttpRouter.Request.From<"Requires", I>> | Exclude<Exclude<I, Scope.Scope>, OperationHttpServerConfig>>;
+  withRequest: <E, R>(effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse, E | OperationHttpConfigurationError | OperationHttpError, HttpServerRequest.HttpServerRequest | Exclude<I, OperationHttpServerConfig> | Exclude<Exclude<Exclude<R, I>, AuthRequest>, OperationHttpServerConfig>>;
+  operationLayer: Layer.Layer<OperationHttpInvocation | OperationHttpServerConfig, OperationHttpConfigurationError, Exclude<I, Scope.Scope>>;
+  securityLayer: <const Id extends string, ContractSchema extends Schema.Codec<S, unknown, unknown, RE>>(contract: ReturnType<typeof makeSessionHttpContract<Id, ContractSchema>>) => Layer.Layer<SessionHttpAuthorization<Id, ContractSchema["Type"]>, OperationHttpConfigurationError, Exclude<I, Scope.Scope> | Exclude<Exclude<Effect.Services<ReturnType<Api["requireSession"]>>, AuthRequest>, Scope.Scope>>;
+  protect: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | HookDenied, AuthRequest | Exclude<Exclude<R, AuthCredentialCommandCollector>, AuthRevealCommandCollectorService>>;
+};
+//#endregion
+export { AuthHttpOptions, make };
+//# sourceMappingURL=auth-http.d.mts.map

package/dist/http/auth-http.mjs

@@ -0,0 +1,184 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { guest } from "../operations/context.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import { OperationHttpConfigurationError, OperationHttpError } from "../http-operation/errors.mjs";
+import { httpGroup, matchesEndpoint } from "./auth-contract.mjs";
+import { OperationHttpInvocation, invocationLayer } from "../http-operation/OperationHttpInvocation.mjs";
+import { OperationHttpServerConfig, configurationLayer, cookieConfiguration } from "../http-operation/OperationHttpServerConfig.mjs";
+import { mutationSecurity, requestSecurity } from "../http-operation/security.mjs";
+import { make as make$1 } from "../http-operation/server.mjs";
+import { Context, DateTime, Duration, Effect, Layer, Redacted, Scope } from "effect";
+import { HttpApi, HttpApiBuilder } from "effect/unstable/httpapi";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+//#region src/http/auth-http.ts
+/** Bind an Auth definition to shared browser actions and neutral request middleware.
+* Mutation admission checks Origin and CSRF before effects. Generated operation
+* handlers independently require JSON; custom protected workflows choose their encoding.
+* The application owns session policy, persistence and profile lookup.
+*/
+const make = (auth, options) => {
+	const secure = options.cookie?.secure ?? true;
+	const cookies = cookieConfiguration({
+		prefix: options.cookie?.prefix ?? (secure ? "__Host-effect-auth-" : "effect-auth-"),
+		secure,
+		sameSite: options.cookie?.sameSite ?? "lax"
+	});
+	const sessionCookieName = options.cookie?.name ?? cookies.session.name;
+	const configuration = configurationLayer({
+		publicOrigin: options.origin,
+		trustedOrigins: [options.origin],
+		cookies: {
+			...cookies,
+			session: {
+				...cookies.session,
+				name: sessionCookieName
+			}
+		},
+		csrfHeader: options.csrf?.header ?? "x-effect-auth-csrf",
+		csrfValue: options.csrf?.value ?? "1",
+		maximumBodyBytes: options.maximumBodyBytes ?? 65536,
+		maximumUrlBytes: options.maximumUrlBytes ?? 8192
+	});
+	const resolve = (api, credential) => credential === void 0 ? Effect.succeed(guest) : api.verifySession(credential).pipe(Effect.map((session) => ({
+		_tag: "Authenticated",
+		subjectId: session.subjectId,
+		sessionId: session.sessionId,
+		assurance: session.assurance
+	})), Effect.catchTag("SessionInvalid", () => Effect.succeed(guest)));
+	/** Existing operation contracts retain private predecode injection and their wire format. */
+	const operationLayer = Layer.merge(configuration, invocationLayer(Effect.fn("AuthHttp.invocation")(function* (_request, credentials) {
+		const api = yield* auth;
+		return yield* resolve(api, credentials.session).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "unavailable" })));
+	})));
+	/** Implement shared HttpApi session security using the validated outer request context. */
+	const securityLayer = (contract) => Layer.effect(contract.RequireSession, Effect.gen(function* () {
+		if (contract.cookieName !== sessionCookieName) return yield* OperationHttpConfigurationError.make({ reason: "cookies" });
+		const api = yield* auth;
+		const services = (yield* Effect.context()).pipe(Context.omit(AuthRequest, Scope.Scope, AuthCredentialCommandCollector, AuthRevealCommandCollectorService));
+		return contract.RequireSession.of({ session: Effect.fn("AuthHttp.requireSession")(function* (httpEffect) {
+			const session = yield* api.requireSession().pipe(Effect.provide(services));
+			return yield* Effect.provideService(httpEffect, contract.CurrentSession, session);
+		}) });
+	}));
+	const wrap = (api, config) => Effect.fn("AuthHttp.request")(function* (effect) {
+		const incoming = yield* HttpServerRequest.HttpServerRequest;
+		const request = yield* HttpServerRequest.toWeb(incoming).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "request" })));
+		if (new TextEncoder().encode(request.url).byteLength > config.maximumUrlBytes) return yield* OperationHttpError.make({ reason: "too-large" });
+		const security = yield* requestSecurity(request, "request").pipe(Effect.provideService(OperationHttpServerConfig, config));
+		const commands = [];
+		let mutationAdmitted = false;
+		const beforeMutation = mutationSecurity(request).pipe(Effect.provideService(OperationHttpServerConfig, config), Effect.mapError(() => HookDenied.make({ reason: "policy" })), Effect.tap(() => Effect.sync(() => {
+			mutationAdmitted = true;
+		})));
+		const sink = (values) => Effect.sync(() => {
+			if (!mutationAdmitted) throw new Error("Credential delivery requires an admitted mutation");
+			commands.push(...values);
+		});
+		const resolveInvocation = resolve(api, security.credentials.session);
+		let response = yield* effect.pipe(Effect.provideService(auth, api), Effect.provideService(AuthRequest, {
+			invocation: guest,
+			credentials: security.credentials,
+			resolveInvocation,
+			beforeMutation,
+			credentialCommandSink: sink
+		}));
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		for (const command of commands) {
+			const cookie = config.cookies[command.slot];
+			response = yield* HttpServerResponse.setCookie(response, cookie.name, command._tag === "Issue" ? Redacted.value(command.credential) : "", {
+				...cookie,
+				httpOnly: true,
+				maxAge: Duration.millis(command._tag === "Issue" ? Math.max(0, command.expiresAtMillis - now) : 0)
+			}).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "response" })));
+		}
+		return HttpServerResponse.setHeader(response, "cache-control", "no-store");
+	});
+	const requestLayer = HttpRouter.middleware()(Effect.gen(function* () {
+		const api = yield* auth;
+		const config = yield* OperationHttpServerConfig;
+		return (effect) => wrap(api, config)(effect).pipe(Effect.catchTag("OperationHttpError", (error) => HttpServerResponse.schemaJson(OperationHttpError)(error, {
+			status: error.reason === "origin" || error.reason === "csrf" ? 403 : error.reason === "too-large" ? 413 : 400,
+			headers: { "cache-control": "no-store" }
+		}).pipe(Effect.orDie)));
+	})).layer.pipe(Layer.provide(configuration));
+	/** Apply to raw HttpRouter or HttpApi route Layers. Authentication is explicit in handlers. */
+	const middleware = Layer.provide(requestLayer);
+	/** Admit a custom mutation before it runs; body encoding remains application-owned. */
+	const protect = (effect) => Effect.gen(function* () {
+		const request = yield* AuthRequest;
+		if (request.beforeMutation !== void 0) yield* request.beforeMutation;
+		return yield* effect.pipe(Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink), Effect.provideService(AuthRevealCommandCollectorService, {
+			supportedKinds: [],
+			accept: () => Effect.die(/* @__PURE__ */ new Error("Private reveals require an explicit operation route"))
+		}));
+	});
+	/** Wrap a custom response workflow, keeping all credential delivery request-local. */
+	const withRequest = (effect) => Effect.gen(function* () {
+		const api = yield* auth;
+		const config = yield* OperationHttpServerConfig;
+		return yield* wrap(api, config)(effect);
+	}).pipe(Effect.provide(configuration));
+	/** Mount the shared contract. Each route calls the same local method, and
+	* request credentials are installed before that method executes. Paths belong
+	* to the contract so server and client cannot configure them independently. */
+	const makeServer = () => {
+		const table = Object.fromEntries(Object.entries(auth.contract.actions).map(([name, action]) => [name, {
+			...action.route,
+			operation: {
+				...action.route.operation,
+				invokeUnknown: (_invocation, input) => Effect.gen(function* () {
+					const invoke = (yield* auth)[name];
+					return yield* invoke(input);
+				})
+			}
+		}]));
+		const requestInvocation = Layer.effect(OperationHttpInvocation, Effect.gen(function* () {
+			const api = yield* auth;
+			return {
+				resolve: () => Effect.succeed(guest),
+				request: (_request, credentials) => resolve(api, credentials.session)
+			};
+		}));
+		return make$1({ routes: table }).pipe(Effect.provide([configuration, requestInvocation]));
+	};
+	/** Implement the AuthContract.httpGroup mounted in the consumer's HttpApi.
+	* Raw handlers preserve private input rejection and bounded decoding before
+	* any schema can project away unknown fields. There is one transport engine.
+	*/
+	const handlers = (api, options) => {
+		const name = options?.name ?? "auth";
+		return HttpApiBuilder.group(api, name, Effect.fn("AuthHttp.handlers")(function* (handlers) {
+			const mounted = Object.values(api.groups).find((candidate) => candidate.identifier === name);
+			if (mounted === void 0 || Object.keys(mounted.endpoints).length !== Object.keys(auth.contract.actions).length) return yield* OperationHttpConfigurationError.make({ reason: "route" });
+			for (const [name, action] of Object.entries(auth.contract.actions)) {
+				const actual = mounted.endpoints[name];
+				if (actual === void 0 || !matchesEndpoint(actual, action)) return yield* OperationHttpConfigurationError.make({ reason: "route" });
+			}
+			const server = yield* makeServer();
+			for (const name of Object.keys(auth.contract.actions)) handlers.handleRaw(name, () => Effect.gen(function* () {
+				const request = yield* HttpServerRequest.toWeb(yield* HttpServerRequest.HttpServerRequest).pipe(Effect.orDie);
+				return HttpServerResponse.fromWeb(yield* server.handle(request));
+			}));
+			return handlers;
+		}));
+	};
+	/** Standalone mounting uses the same generated HttpApi group and handlers. */
+	const routes = () => {
+		const api = HttpApi.make(`${auth.key}/http`).add(httpGroup(auth.contract));
+		return HttpApiBuilder.layer(api).pipe(Layer.provide(handlers(api)));
+	};
+	return {
+		routes,
+		handlers,
+		middleware,
+		withRequest,
+		operationLayer,
+		securityLayer,
+		protect
+	};
+};
+//#endregion
+export { make };
+
+//# sourceMappingURL=auth-http.mjs.map

package/dist/http/auth-http.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-http.mjs","names":["makeOperationServer"],"sources":["../../src/http/auth-http.ts"],"sourcesContent":["import {\n  type Schema,\n  Context,\n  type Types,\n  type Unify,\n  DateTime,\n  Duration,\n  Effect,\n  Layer,\n  Redacted,\n  Scope,\n} from \"effect\";\nimport { HttpRouter, HttpServerRequest, HttpServerResponse } from \"effect/unstable/http\";\nimport {\n  HttpApi,\n  HttpApiBuilder,\n  type HttpApiGroup,\n  type HttpApiEndpoint,\n} from \"effect/unstable/httpapi\";\n\nimport { AuthRequest } from \"../auth/AuthRequest\";\nimport type { SessionApi, SessionApiError } from \"../auth/session\";\nimport { HookDenied } from \"../hooks/models\";\nimport { OperationHttpConfigurationError, OperationHttpError } from \"../http-operation/errors\";\nimport type { HttpCredentials, OperationHttpConfiguration } from \"../http-operation/models\";\nimport {\n  invocationLayer,\n  OperationHttpInvocation,\n} from \"../http-operation/OperationHttpInvocation\";\nimport {\n  configurationLayer,\n  cookieConfiguration,\n  OperationHttpServerConfig,\n} from \"../http-operation/OperationHttpServerConfig\";\nimport { mutationSecurity, requestSecurity } from \"../http-operation/security\";\nimport { make as makeOperationServer } from \"../http-operation/server\";\nimport type { ActionSuccess, AuthActions } from \"../operations/actions\";\nimport { guest } from \"../operations/context\";\nimport {\n  type AuthCredentialCommand,\n  AuthCredentialCommandCollector,\n  AuthRevealCommandCollectorService,\n} from \"../operations/credentials\";\nimport type { SessionMetadata } from \"../sessions/models\";\nimport { httpGroup, matchesEndpoint } from \"./auth-contract\";\nimport type { makeSessionHttpContract } from \"./session-contract\";\n\n/** Browser transport policy. Insecure cookies require an explicit development override. */\nexport interface AuthHttpOptions {\n  readonly origin: string;\n  readonly maximumBodyBytes?: number;\n  readonly maximumUrlBytes?: number;\n  readonly cookie?: {\n    readonly prefix?: string;\n    readonly name?: string;\n    readonly secure?: boolean;\n    readonly sameSite?: \"lax\" | \"strict\";\n  };\n  readonly csrf?: { readonly header: string; readonly value: string };\n}\n\n/** Bind an Auth definition to shared browser actions and neutral request middleware.\n * Mutation admission checks Origin and CSRF before effects. Generated operation\n * handlers independently require JSON; custom protected workflows choose their encoding.\n * The application owns session policy, persistence and profile lookup.\n */\nexport const make = <\n  I,\n  S extends SessionMetadata,\n  RE,\n  Api extends SessionApi<S, unknown>,\n  Actions extends AuthActions,\n>(\n  auth: Omit<Context.Key<I, Api>, typeof Unify.unifySymbol> & {\n    readonly sessions: { readonly Session: Schema.Codec<S, unknown, unknown, RE> };\n    readonly contract: { readonly actions: Actions };\n  },\n  options: AuthHttpOptions,\n) => {\n  const secure = options.cookie?.secure ?? true;\n\n  const cookies = cookieConfiguration({\n    prefix: options.cookie?.prefix ?? (secure ? \"__Host-effect-auth-\" : \"effect-auth-\"),\n    secure,\n    sameSite: options.cookie?.sameSite ?? \"lax\",\n  });\n\n  const sessionCookieName = options.cookie?.name ?? cookies.session.name;\n\n  const configuration = configurationLayer({\n    publicOrigin: options.origin,\n    trustedOrigins: [options.origin],\n    cookies: {\n      ...cookies,\n      session: { ...cookies.session, name: sessionCookieName },\n    },\n    csrfHeader: options.csrf?.header ?? \"x-effect-auth-csrf\",\n    csrfValue: options.csrf?.value ?? \"1\",\n    maximumBodyBytes: options.maximumBodyBytes ?? 65536,\n    maximumUrlBytes: options.maximumUrlBytes ?? 8192,\n  });\n\n  const resolve = (\n    api: Pick<SessionApi<S>, \"verifySession\">,\n    credential: Redacted.Redacted<string> | undefined,\n  ) =>\n    credential === undefined\n      ? Effect.succeed(guest)\n      : api.verifySession(credential).pipe(\n          Effect.map((session) => ({\n            _tag: \"Authenticated\" as const,\n            subjectId: session.subjectId,\n            sessionId: session.sessionId,\n            assurance: session.assurance,\n          })),\n          Effect.catchTag(\"SessionInvalid\", () => Effect.succeed(guest)),\n        );\n\n  /** Existing operation contracts retain private predecode injection and their wire format. */\n  const operationLayer = Layer.merge(\n    configuration,\n    invocationLayer(\n      Effect.fn(\"AuthHttp.invocation\")(function* (_request, credentials) {\n        const api = yield* auth;\n\n        return yield* resolve(api, credentials.session).pipe(\n          Effect.mapError(() => OperationHttpError.make({ reason: \"unavailable\" })),\n        );\n      }),\n    ),\n  );\n\n  /** Implement shared HttpApi session security using the validated outer request context. */\n  const securityLayer = <\n    const Id extends string,\n    ContractSchema extends Schema.Codec<S, unknown, unknown, RE>,\n  >(\n    contract: ReturnType<typeof makeSessionHttpContract<Id, ContractSchema>>,\n  ) =>\n    Layer.effect(\n      contract.RequireSession,\n      Effect.gen(function* () {\n        if (contract.cookieName !== sessionCookieName) {\n          return yield* OperationHttpConfigurationError.make({ reason: \"cookies\" });\n        }\n        const api = yield* auth;\n\n        const services = (yield* Effect.context<\n          Exclude<Effect.Services<ReturnType<Api[\"requireSession\"]>>, AuthRequest>\n        >()).pipe(\n          Context.omit(\n            AuthRequest,\n            Scope.Scope,\n            AuthCredentialCommandCollector,\n            AuthRevealCommandCollectorService,\n          ),\n        );\n\n        return contract.RequireSession.of({\n          session: Effect.fn(\"AuthHttp.requireSession\")(function* (httpEffect) {\n            // HttpApiBuilder treats middleware.requires as a construction dependency.\n            // This exact Effect runs only inside the request security handler, so\n            // expose its AuthRequest requirement through the router request marker.\n            const required = api\n              .requireSession()\n              .pipe(Effect.provide(services)) as unknown as Effect.Effect<\n              S,\n              SessionApiError,\n              HttpRouter.Request.From<\"Requires\", AuthRequest>\n            >;\n\n            const session = yield* required;\n\n            return yield* Effect.provideService(httpEffect, contract.CurrentSession, session);\n          }),\n        });\n      }),\n    );\n\n  const wrap = (api: Api, config: OperationHttpConfiguration) =>\n    Effect.fn(\"AuthHttp.request\")(function* <E, R>(\n      effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>,\n    ) {\n      const incoming = yield* HttpServerRequest.HttpServerRequest;\n\n      const request = yield* HttpServerRequest.toWeb(incoming).pipe(\n        Effect.mapError(() => OperationHttpError.make({ reason: \"request\" })),\n      );\n\n      if (new TextEncoder().encode(request.url).byteLength > config.maximumUrlBytes) {\n        return yield* OperationHttpError.make({ reason: \"too-large\" });\n      }\n\n      const security = yield* requestSecurity(request, \"request\").pipe(\n        Effect.provideService(OperationHttpServerConfig, config),\n      );\n\n      const commands: AuthCredentialCommand[] = [];\n      let mutationAdmitted = false;\n\n      const beforeMutation = mutationSecurity(request).pipe(\n        Effect.provideService(OperationHttpServerConfig, config),\n        Effect.mapError(() => HookDenied.make({ reason: \"policy\" })),\n        Effect.tap(() =>\n          Effect.sync(() => {\n            mutationAdmitted = true;\n          }),\n        ),\n      );\n\n      const sink = (values: ReadonlyArray<AuthCredentialCommand>) =>\n        Effect.sync(() => {\n          if (!mutationAdmitted)\n            throw new Error(\"Credential delivery requires an admitted mutation\");\n          commands.push(...values);\n        });\n\n      const resolveInvocation = resolve(api, security.credentials.session);\n\n      let response = yield* effect.pipe(\n        Effect.provideService(auth, api),\n        Effect.provideService(AuthRequest, {\n          invocation: guest,\n          credentials: security.credentials,\n          resolveInvocation,\n          beforeMutation,\n          credentialCommandSink: sink,\n        }),\n      );\n\n      const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n      for (const command of commands) {\n        const cookie = config.cookies[command.slot];\n\n        response = yield* HttpServerResponse.setCookie(\n          response,\n          cookie.name,\n          command._tag === \"Issue\" ? Redacted.value(command.credential) : \"\",\n          {\n            ...cookie,\n            httpOnly: true,\n            maxAge: Duration.millis(\n              command._tag === \"Issue\" ? Math.max(0, command.expiresAtMillis - now) : 0,\n            ),\n          },\n        ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: \"response\" })));\n      }\n\n      return HttpServerResponse.setHeader(response, \"cache-control\", \"no-store\");\n    });\n\n  const requestLayer = HttpRouter.middleware<{\n    provides: I | AuthRequest;\n  }>()(\n    Effect.gen(function* () {\n      const api = yield* auth;\n      const config = yield* OperationHttpServerConfig;\n\n      return (\n        effect,\n      ): Effect.Effect<\n        HttpServerResponse.HttpServerResponse,\n        Types.unhandled,\n        HttpServerRequest.HttpServerRequest\n      > =>\n        wrap(\n          api,\n          config,\n        )(effect).pipe(\n          Effect.catchTag(\"OperationHttpError\", (error) =>\n            HttpServerResponse.schemaJson(OperationHttpError)(error, {\n              status:\n                error.reason === \"origin\" || error.reason === \"csrf\"\n                  ? 403\n                  : error.reason === \"too-large\"\n                    ? 413\n                    : 400,\n              headers: { \"cache-control\": \"no-store\" },\n            }).pipe(Effect.orDie),\n          ),\n        );\n    }),\n  ).layer.pipe(Layer.provide(configuration));\n\n  /** Apply to raw HttpRouter or HttpApi route Layers. Authentication is explicit in handlers. */\n  const middleware = Layer.provide(requestLayer);\n\n  /** Admit a custom mutation before it runs; body encoding remains application-owned. */\n  const protect = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    Effect.gen(function* () {\n      const request = yield* AuthRequest;\n\n      if (request.beforeMutation !== undefined) yield* request.beforeMutation;\n\n      return yield* effect.pipe(\n        Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink),\n        Effect.provideService(AuthRevealCommandCollectorService, {\n          supportedKinds: [],\n          accept: () =>\n            Effect.die(new Error(\"Private reveals require an explicit operation route\")),\n        }),\n      );\n    });\n\n  /** Wrap a custom response workflow, keeping all credential delivery request-local. */\n  const withRequest = <E, R>(effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>) =>\n    Effect.gen(function* () {\n      const api = yield* auth;\n      const config = yield* OperationHttpServerConfig;\n\n      return yield* wrap(api, config)(effect);\n    }).pipe(Effect.provide(configuration));\n\n  /** Mount the shared contract. Each route calls the same local method, and\n   * request credentials are installed before that method executes. Paths belong\n   * to the contract so server and client cannot configure them independently. */\n  const makeServer = () => {\n    type Call = Extract<\n      Api[Extract<keyof Actions, keyof Api>],\n      (...args: never[]) => Effect.Effect<unknown, unknown, unknown>\n    >;\n    type Result = ReturnType<Call>;\n    type Mounted = {\n      readonly [Name in keyof Actions]: Omit<Actions[Name][\"route\"], \"operation\"> & {\n        readonly operation: Omit<Actions[Name][\"route\"][\"operation\"], \"invokeUnknown\"> & {\n          readonly invokeUnknown: (\n            invocation: unknown,\n            input: unknown,\n          ) => Effect.Effect<\n            ActionSuccess<Actions[Name]>,\n            Effect.Error<Result>,\n            I | Effect.Services<Result>\n          >;\n        };\n      };\n    };\n\n    const table = Object.fromEntries(\n      Object.entries(auth.contract.actions).map(([name, action]) => [\n        name,\n        {\n          ...action.route,\n          operation: {\n            ...action.route.operation,\n            invokeUnknown: (_invocation: unknown, input: unknown) =>\n              Effect.gen(function* () {\n                const api = yield* auth;\n\n                // This table contains the exact methods bound from auth.contract.\n                const invoke = api[name as keyof Api] as (\n                  input: unknown,\n                ) => Effect.Effect<\n                  Effect.Success<Result>,\n                  Effect.Error<Result>,\n                  Effect.Services<Result>\n                >;\n\n                return yield* invoke(input);\n              }),\n          },\n        },\n      ]),\n    ) as Mounted;\n\n    const requestInvocation = Layer.effect(\n      OperationHttpInvocation,\n      Effect.gen(function* () {\n        const api = yield* auth;\n\n        return {\n          resolve: () => Effect.succeed(guest),\n          request: (_request: Request, credentials: HttpCredentials) =>\n            resolve(api, credentials.session),\n        };\n      }),\n    );\n\n    return makeOperationServer({ routes: table }).pipe(\n      Effect.provide([configuration, requestInvocation]),\n    );\n  };\n\n  /** Implement the AuthContract.httpGroup mounted in the consumer's HttpApi.\n   * Raw handlers preserve private input rejection and bounded decoding before\n   * any schema can project away unknown fields. There is one transport engine.\n   */\n  const handlers = <\n    ApiId extends string,\n    Groups extends HttpApiGroup.Constraint,\n    const Name extends HttpApiGroup.Identifier<Groups> = Extract<\n      HttpApiGroup.Identifier<Groups>,\n      \"auth\"\n    >,\n  >(\n    api: HttpApi.HttpApi<ApiId, Groups>,\n    options?: { readonly name?: Name },\n  ) => {\n    const name = (options?.name ?? \"auth\") as Name;\n\n    type Mounted = HttpApiGroup.WithIdentifier<Groups, Name>;\n    type Endpoint = HttpApiGroup.Endpoints<Mounted>;\n    type Requirements<E extends HttpApiEndpoint.Constraint> = E extends HttpApiEndpoint.Constraint\n      ?\n          | HttpApiEndpoint.Middleware<E>\n          | HttpApiEndpoint.MiddlewareServices<E>\n          | HttpRouter.Request.From<\n              \"Requires\",\n              HttpApiEndpoint.ExcludeProvided<\n                E,\n                HttpApiEndpoint.ServerServices<E> | HttpServerRequest.HttpServerRequest\n              >\n            >\n      : never;\n\n    return HttpApiBuilder.group(\n      api,\n      name,\n      Effect.fn(\"AuthHttp.handlers\")(function* (handlers) {\n        const mounted = (Object.values(api.groups) as HttpApiGroup.Top[]).find(\n          (candidate) => candidate.identifier === name,\n        );\n\n        if (\n          mounted === undefined ||\n          Object.keys(mounted.endpoints).length !== Object.keys(auth.contract.actions).length\n        )\n          return yield* OperationHttpConfigurationError.make({ reason: \"route\" });\n        for (const [name, action] of Object.entries(auth.contract.actions)) {\n          const actual = mounted.endpoints[name];\n\n          if (actual === undefined || !matchesEndpoint(actual, action))\n            return yield* OperationHttpConfigurationError.make({ reason: \"route\" });\n        }\n        const server = yield* makeServer();\n\n        for (const name of Object.keys(auth.contract.actions)) {\n          handlers.handleRaw(name as Parameters<typeof handlers.handleRaw>[0], () =>\n            Effect.gen(function* () {\n              const request = yield* HttpServerRequest.toWeb(\n                yield* HttpServerRequest.HttpServerRequest,\n              ).pipe(Effect.orDie);\n\n              return HttpServerResponse.fromWeb(yield* server.handle(request));\n            }),\n          );\n        }\n\n        // handleRaw registers in place; the loop covers every named endpoint.\n        return handlers as HttpApiBuilder.Handlers<\n          Requirements<Endpoint>,\n          Mounted[\"endpoints\"],\n          keyof Mounted[\"endpoints\"]\n        >;\n      }),\n    );\n  };\n\n  /** Standalone mounting uses the same generated HttpApi group and handlers. */\n  const routes = () => {\n    const api = HttpApi.make(`${auth.key}/http`).add(httpGroup(auth.contract));\n\n    return HttpApiBuilder.layer(api).pipe(Layer.provide(handlers(api)));\n  };\n\n  return { routes, handlers, middleware, withRequest, operationLayer, securityLayer, protect };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkEA,MAAa,QAOX,MAIA,YACG;CACH,MAAM,SAAS,QAAQ,QAAQ,UAAU;CAEzC,MAAM,UAAU,oBAAoB;EAClC,QAAQ,QAAQ,QAAQ,WAAW,SAAS,wBAAwB;EACpE;EACA,UAAU,QAAQ,QAAQ,YAAY;CACxC,CAAC;CAED,MAAM,oBAAoB,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;CAElE,MAAM,gBAAgB,mBAAmB;EACvC,cAAc,QAAQ;EACtB,gBAAgB,CAAC,QAAQ,MAAM;EAC/B,SAAS;GACP,GAAG;GACH,SAAS;IAAE,GAAG,QAAQ;IAAS,MAAM;GAAkB;EACzD;EACA,YAAY,QAAQ,MAAM,UAAU;EACpC,WAAW,QAAQ,MAAM,SAAS;EAClC,kBAAkB,QAAQ,oBAAoB;EAC9C,iBAAiB,QAAQ,mBAAmB;CAC9C,CAAC;CAED,MAAM,WACJ,KACA,eAEA,eAAe,KAAA,IACX,OAAO,QAAQ,KAAK,IACpB,IAAI,cAAc,UAAU,CAAC,CAAC,KAC5B,OAAO,KAAK,aAAa;EACvB,MAAM;EACN,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,WAAW,QAAQ;CACrB,EAAE,GACF,OAAO,SAAS,wBAAwB,OAAO,QAAQ,KAAK,CAAC,CAC/D;;CAGN,MAAM,iBAAiB,MAAM,MAC3B,eACA,gBACE,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,UAAU,aAAa;EACjE,MAAM,MAAM,OAAO;EAEnB,OAAO,OAAO,QAAQ,KAAK,YAAY,OAAO,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC,CAAC,CAC1E;CACF,CAAC,CACH,CACF;;CAGA,MAAM,iBAIJ,aAEA,MAAM,OACJ,SAAS,gBACT,OAAO,IAAI,aAAa;EACtB,IAAI,SAAS,eAAe,mBAC1B,OAAO,OAAO,gCAAgC,KAAK,EAAE,QAAQ,UAAU,CAAC;EAE1E,MAAM,MAAM,OAAO;EAEnB,MAAM,YAAY,OAAO,OAAO,QAE9B,EAAA,CAAG,KACH,QAAQ,KACN,aACA,MAAM,OACN,gCACA,iCACF,CACF;EAEA,OAAO,SAAS,eAAe,GAAG,EAChC,SAAS,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,YAAY;GAYnE,MAAM,UAAU,OARC,IACd,eAAe,CAAC,CAChB,KAAK,OAAO,QAAQ,QAAQ,CAMD;GAE9B,OAAO,OAAO,OAAO,eAAe,YAAY,SAAS,gBAAgB,OAAO;EAClF,CAAC,EACH,CAAC;CACH,CAAC,CACH;CAEF,MAAM,QAAQ,KAAU,WACtB,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAC5B,QACA;EACA,MAAM,WAAW,OAAO,kBAAkB;EAE1C,MAAM,UAAU,OAAO,kBAAkB,MAAM,QAAQ,CAAC,CAAC,KACvD,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC,CACtE;EAEA,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,GAAG,CAAC,CAAC,aAAa,OAAO,iBAC5D,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,YAAY,CAAC;EAG/D,MAAM,WAAW,OAAO,gBAAgB,SAAS,SAAS,CAAC,CAAC,KAC1D,OAAO,eAAe,2BAA2B,MAAM,CACzD;EAEA,MAAM,WAAoC,CAAC;EAC3C,IAAI,mBAAmB;EAEvB,MAAM,iBAAiB,iBAAiB,OAAO,CAAC,CAAC,KAC/C,OAAO,eAAe,2BAA2B,MAAM,GACvD,OAAO,eAAe,WAAW,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC,GAC3D,OAAO,UACL,OAAO,WAAW;GAChB,mBAAmB;EACrB,CAAC,CACH,CACF;EAEA,MAAM,QAAQ,WACZ,OAAO,WAAW;GAChB,IAAI,CAAC,kBACH,MAAM,IAAI,MAAM,mDAAmD;GACrE,SAAS,KAAK,GAAG,MAAM;EACzB,CAAC;EAEH,MAAM,oBAAoB,QAAQ,KAAK,SAAS,YAAY,OAAO;EAEnE,IAAI,WAAW,OAAO,OAAO,KAC3B,OAAO,eAAe,MAAM,GAAG,GAC/B,OAAO,eAAe,aAAa;GACjC,YAAY;GACZ,aAAa,SAAS;GACtB;GACA;GACA,uBAAuB;EACzB,CAAC,CACH;EAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EAEtD,KAAK,MAAM,WAAW,UAAU;GAC9B,MAAM,SAAS,OAAO,QAAQ,QAAQ;GAEtC,WAAW,OAAO,mBAAmB,UACnC,UACA,OAAO,MACP,QAAQ,SAAS,UAAU,SAAS,MAAM,QAAQ,UAAU,IAAI,IAChE;IACE,GAAG;IACH,UAAU;IACV,QAAQ,SAAS,OACf,QAAQ,SAAS,UAAU,KAAK,IAAI,GAAG,QAAQ,kBAAkB,GAAG,IAAI,CAC1E;GACF,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CAAC;EAC/E;EAEA,OAAO,mBAAmB,UAAU,UAAU,iBAAiB,UAAU;CAC3E,CAAC;CAEH,MAAM,eAAe,WAAW,WAE7B,CAAC,CACF,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO;EACnB,MAAM,SAAS,OAAO;EAEtB,QACE,WAMA,KACE,KACA,MACF,CAAC,CAAC,MAAM,CAAC,CAAC,KACR,OAAO,SAAS,uBAAuB,UACrC,mBAAmB,WAAW,kBAAkB,CAAC,CAAC,OAAO;GACvD,QACE,MAAM,WAAW,YAAY,MAAM,WAAW,SAC1C,MACA,MAAM,WAAW,cACf,MACA;GACR,SAAS,EAAE,iBAAiB,WAAW;EACzC,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,CACtB,CACF;CACJ,CAAC,CACH,CAAC,CAAC,MAAM,KAAK,MAAM,QAAQ,aAAa,CAAC;;CAGzC,MAAM,aAAa,MAAM,QAAQ,YAAY;;CAG7C,MAAM,WAAoB,WACxB,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EAEvB,IAAI,QAAQ,mBAAmB,KAAA,GAAW,OAAO,QAAQ;EAEzD,OAAO,OAAO,OAAO,KACnB,OAAO,eAAe,gCAAgC,QAAQ,qBAAqB,GACnF,OAAO,eAAe,mCAAmC;GACvD,gBAAgB,CAAC;GACjB,cACE,OAAO,oBAAI,IAAI,MAAM,qDAAqD,CAAC;EAC/E,CAAC,CACH;CACF,CAAC;;CAGH,MAAM,eAAqB,WACzB,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO;EACnB,MAAM,SAAS,OAAO;EAEtB,OAAO,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM;CACxC,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,aAAa,CAAC;;;;CAKvC,MAAM,mBAAmB;EAqBvB,MAAM,QAAQ,OAAO,YACnB,OAAO,QAAQ,KAAK,SAAS,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAC5D,MACA;GACE,GAAG,OAAO;GACV,WAAW;IACT,GAAG,OAAO,MAAM;IAChB,gBAAgB,aAAsB,UACpC,OAAO,IAAI,aAAa;KAItB,MAAM,UAAS,OAHI,KAAA,CAGA;KAQnB,OAAO,OAAO,OAAO,KAAK;IAC5B,CAAC;GACL;EACF,CACF,CAAC,CACH;EAEA,MAAM,oBAAoB,MAAM,OAC9B,yBACA,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,OAAO;GAEnB,OAAO;IACL,eAAe,OAAO,QAAQ,KAAK;IACnC,UAAU,UAAmB,gBAC3B,QAAQ,KAAK,YAAY,OAAO;GACpC;EACF,CAAC,CACH;EAEA,OAAOA,OAAoB,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,KAC5C,OAAO,QAAQ,CAAC,eAAe,iBAAiB,CAAC,CACnD;CACF;;;;;CAMA,MAAM,YAQJ,KACA,YACG;EACH,MAAM,OAAQ,SAAS,QAAQ;EAiB/B,OAAO,eAAe,MACpB,KACA,MACA,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,UAAU;GAClD,MAAM,UAAW,OAAO,OAAO,IAAI,MAAM,CAAC,CAAwB,MAC/D,cAAc,UAAU,eAAe,IAC1C;GAEA,IACE,YAAY,KAAA,KACZ,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,WAAW,OAAO,KAAK,KAAK,SAAS,OAAO,CAAC,CAAC,QAE7E,OAAO,OAAO,gCAAgC,KAAK,EAAE,QAAQ,QAAQ,CAAC;GACxE,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,KAAK,SAAS,OAAO,GAAG;IAClE,MAAM,SAAS,QAAQ,UAAU;IAEjC,IAAI,WAAW,KAAA,KAAa,CAAC,gBAAgB,QAAQ,MAAM,GACzD,OAAO,OAAO,gCAAgC,KAAK,EAAE,QAAQ,QAAQ,CAAC;GAC1E;GACA,MAAM,SAAS,OAAO,WAAW;GAEjC,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,SAAS,OAAO,GAClD,SAAS,UAAU,YACjB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,kBAAkB,MACvC,OAAO,kBAAkB,iBAC3B,CAAC,CAAC,KAAK,OAAO,KAAK;IAEnB,OAAO,mBAAmB,QAAQ,OAAO,OAAO,OAAO,OAAO,CAAC;GACjE,CAAC,CACH;GAIF,OAAO;EAKT,CAAC,CACH;CACF;;CAGA,MAAM,eAAe;EACnB,MAAM,MAAM,QAAQ,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,CAAC,IAAI,UAAU,KAAK,QAAQ,CAAC;EAEzE,OAAO,eAAe,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,QAAQ,SAAS,GAAG,CAAC,CAAC;CACpE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAY;EAAa;EAAgB;EAAe;CAAQ;AAC7F"}

package/dist/http/endpoints/get-session.d.mts

@@ -0,0 +1,8 @@
+import { AuthUnavailable } from "../../Errors.mjs";
+import { SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired } from "../models.mjs";
+import { HttpApiEndpoint } from "effect/unstable/httpapi";
+//#region src/http/endpoints/get-session.d.ts
+declare const GetSessionEndpoint: HttpApiEndpoint.HttpApiEndpoint<"getSession", "GET", "/auth/session", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [typeof SessionStateAnonymous, typeof SessionStateRegistrationRequired, typeof SessionStateAuthenticated]>>, import("effect/Schema").toCodecJson<typeof AuthUnavailable>, never, never>;
+//#endregion
+export { GetSessionEndpoint };
+//# sourceMappingURL=get-session.d.mts.map

package/dist/http/endpoints/get-session.mjs

@@ -0,0 +1,12 @@
+import { AuthUnavailable } from "../../Errors.mjs";
+import { SessionState } from "../models.mjs";
+import { HttpApiEndpoint } from "effect/unstable/httpapi";
+//#region src/http/endpoints/get-session.ts
+const GetSessionEndpoint = HttpApiEndpoint.get("getSession", "/auth/session", {
+	success: SessionState,
+	error: AuthUnavailable
+});
+//#endregion
+export { GetSessionEndpoint };
+
+//# sourceMappingURL=get-session.mjs.map

package/dist/http/endpoints/get-session.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-session.mjs","names":[],"sources":["../../../src/http/endpoints/get-session.ts"],"sourcesContent":["import { HttpApiEndpoint } from \"effect/unstable/httpapi\";\n\nimport { AuthUnavailable } from \"../../Errors\";\nimport { SessionState } from \"../models\";\n\nexport const GetSessionEndpoint = HttpApiEndpoint.get(\"getSession\", \"/auth/session\", {\n  success: SessionState,\n  error: AuthUnavailable,\n});\n"],"mappings":";;;;AAKA,MAAa,qBAAqB,gBAAgB,IAAI,cAAc,iBAAiB;CACnF,SAAS;CACT,OAAO;AACT,CAAC"}

package/dist/http/endpoints/password-sign-in.d.mts

@@ -0,0 +1,8 @@
+import { AuthRateLimited, AuthUnavailable, InvalidAuthRequest, InvalidCredentials } from "../../Errors.mjs";
+import { PasswordSignInPayload, SessionStateAuthenticated } from "../models.mjs";
+import { HttpApiEndpoint } from "effect/unstable/httpapi";
+//#region src/http/endpoints/password-sign-in.d.ts
+declare const PasswordSignInEndpoint: HttpApiEndpoint.HttpApiEndpoint<"passwordSignIn", "POST", "/auth/password/sign-in", never, never, import("effect/Schema").toCodecJson<typeof PasswordSignInPayload>, never, import("effect/Schema").toCodecJson<typeof SessionStateAuthenticated>, import("effect/Schema").toCodecJson<typeof InvalidCredentials | typeof InvalidAuthRequest | typeof AuthRateLimited | typeof AuthUnavailable>, never, never>;
+//#endregion
+export { PasswordSignInEndpoint };
+//# sourceMappingURL=password-sign-in.d.mts.map

package/dist/http/endpoints/password-sign-in.mjs

@@ -0,0 +1,18 @@
+import { AuthRateLimited, AuthUnavailable, InvalidAuthRequest, InvalidCredentials } from "../../Errors.mjs";
+import { PasswordSignInPayload, SessionStateAuthenticated } from "../models.mjs";
+import { HttpApiEndpoint } from "effect/unstable/httpapi";
+//#region src/http/endpoints/password-sign-in.ts
+const PasswordSignInEndpoint = HttpApiEndpoint.post("passwordSignIn", "/auth/password/sign-in", {
+	payload: PasswordSignInPayload,
+	success: SessionStateAuthenticated,
+	error: [
+		InvalidAuthRequest,
+		InvalidCredentials,
+		AuthRateLimited,
+		AuthUnavailable
+	]
+});
+//#endregion
+export { PasswordSignInEndpoint };
+
+//# sourceMappingURL=password-sign-in.mjs.map

package/dist/http/endpoints/password-sign-in.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-sign-in.mjs","names":[],"sources":["../../../src/http/endpoints/password-sign-in.ts"],"sourcesContent":["import { HttpApiEndpoint } from \"effect/unstable/httpapi\";\n\nimport {\n  AuthRateLimited,\n  AuthUnavailable,\n  InvalidAuthRequest,\n  InvalidCredentials,\n} from \"../../Errors\";\nimport { PasswordSignInPayload, SessionStateAuthenticated } from \"../models\";\n\nexport const PasswordSignInEndpoint = HttpApiEndpoint.post(\n  \"passwordSignIn\",\n  \"/auth/password/sign-in\",\n  {\n    payload: PasswordSignInPayload,\n    success: SessionStateAuthenticated,\n    error: [InvalidAuthRequest, InvalidCredentials, AuthRateLimited, AuthUnavailable],\n  },\n);\n"],"mappings":";;;;AAUA,MAAa,yBAAyB,gBAAgB,KACpD,kBACA,0BACA;CACE,SAAS;CACT,SAAS;CACT,OAAO;EAAC;EAAoB;EAAoB;EAAiB;CAAe;AAClF,CACF"}