@yielded/auth 0.1.0-beta.1

package/dist/http/session-contract.d.mts

@@ -0,0 +1,303 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../operations/errors.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConflict, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication } from "../sessions/errors.mjs";
+import "../Operations.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import "../Sessions.mjs";
+import { Context, Schema, Types } from "effect";
+import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
+import { HttpRouter } from "effect/unstable/http";
+//#region src/http/session-contract.d.ts
+/** Existing domain failures with HTTP statuses, without changing their wire values. */
+declare const sessionHttpErrors: (Schema.decodeTo<Schema.declareConstructor<AssuranceRequired, {
+  readonly _tag: "AssuranceRequired";
+}, readonly [Schema.TaggedStruct<"AssuranceRequired", {}>], {
+  readonly _tag: "AssuranceRequired";
+}>, Schema.TaggedStruct<"AssuranceRequired", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<AuthenticationRequired, {
+  readonly _tag: "AuthenticationRequired";
+}, readonly [Schema.TaggedStruct<"AuthenticationRequired", {}>], {
+  readonly _tag: "AuthenticationRequired";
+}>, Schema.TaggedStruct<"AuthenticationRequired", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<HookDenied, {
+  readonly _tag: "HookDenied";
+  readonly reason: "policy" | "unavailable";
+}, readonly [Schema.TaggedStruct<"HookDenied", {
+  readonly reason: Schema.Literals<readonly ["policy", "unavailable"]>;
+}>], {
+  readonly _tag: "HookDenied";
+  readonly reason: "policy" | "unavailable";
+}>, Schema.TaggedStruct<"HookDenied", {
+  readonly reason: Schema.Literals<readonly ["policy", "unavailable"]>;
+}>, never, never> | Schema.decodeTo<Schema.declareConstructor<InvalidOperationInput, {
+  readonly _tag: "InvalidOperationInput";
+}, readonly [Schema.TaggedStruct<"InvalidOperationInput", {}>], {
+  readonly _tag: "InvalidOperationInput";
+}>, Schema.TaggedStruct<"InvalidOperationInput", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<OperationForbidden, {
+  readonly _tag: "OperationForbidden";
+}, readonly [Schema.TaggedStruct<"OperationForbidden", {}>], {
+  readonly _tag: "OperationForbidden";
+}>, Schema.TaggedStruct<"OperationForbidden", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<OperationPrivateOutputUnsupported, {
+  readonly _tag: "OperationPrivateOutputUnsupported";
+}, readonly [Schema.TaggedStruct<"OperationPrivateOutputUnsupported", {}>], {
+  readonly _tag: "OperationPrivateOutputUnsupported";
+}>, Schema.TaggedStruct<"OperationPrivateOutputUnsupported", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<PendingAuthenticationInvalid, {
+  readonly _tag: "PendingAuthenticationInvalid";
+}, readonly [Schema.TaggedStruct<"PendingAuthenticationInvalid", {}>], {
+  readonly _tag: "PendingAuthenticationInvalid";
+}>, Schema.TaggedStruct<"PendingAuthenticationInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionCapabilityUnsupported, {
+  readonly _tag: "SessionCapabilityUnsupported";
+  readonly capability: string;
+}, readonly [Schema.TaggedStruct<"SessionCapabilityUnsupported", {
+  readonly capability: Schema.NonEmptyString;
+}>], {
+  readonly _tag: "SessionCapabilityUnsupported";
+  readonly capability: string;
+}>, Schema.TaggedStruct<"SessionCapabilityUnsupported", {
+  readonly capability: Schema.NonEmptyString;
+}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionConflict, {
+  readonly _tag: "SessionConflict";
+}, readonly [Schema.TaggedStruct<"SessionConflict", {}>], {
+  readonly _tag: "SessionConflict";
+}>, Schema.TaggedStruct<"SessionConflict", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionInvalid, {
+  readonly _tag: "SessionInvalid";
+}, readonly [Schema.TaggedStruct<"SessionInvalid", {}>], {
+  readonly _tag: "SessionInvalid";
+}>, Schema.TaggedStruct<"SessionInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionRenewalTooEarly, {
+  readonly _tag: "SessionRenewalTooEarly";
+  readonly retryAt: number;
+}, readonly [Schema.TaggedStruct<"SessionRenewalTooEarly", {
+  readonly retryAt: Schema.DateTimeUtcFromMillis;
+}>], {
+  readonly _tag: "SessionRenewalTooEarly";
+  readonly retryAt: import("effect/DateTime").Utc;
+}>, Schema.TaggedStruct<"SessionRenewalTooEarly", {
+  readonly retryAt: Schema.DateTimeUtcFromMillis;
+}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionSignOutUnavailable, {
+  readonly _tag: "SessionSignOutUnavailable";
+  readonly clearCredential: true;
+}, readonly [Schema.TaggedStruct<"SessionSignOutUnavailable", {
+  readonly clearCredential: Schema.Literal<true>;
+}>], {
+  readonly _tag: "SessionSignOutUnavailable";
+  readonly clearCredential: true;
+}>, Schema.TaggedStruct<"SessionSignOutUnavailable", {
+  readonly clearCredential: Schema.Literal<true>;
+}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionStepUpInvalid, {
+  readonly _tag: "SessionStepUpInvalid";
+}, readonly [Schema.TaggedStruct<"SessionStepUpInvalid", {}>], {
+  readonly _tag: "SessionStepUpInvalid";
+}>, Schema.TaggedStruct<"SessionStepUpInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionUnavailable, {
+  readonly _tag: "SessionUnavailable";
+}, readonly [Schema.TaggedStruct<"SessionUnavailable", {}>], {
+  readonly _tag: "SessionUnavailable";
+}>, Schema.TaggedStruct<"SessionUnavailable", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<StaleAuthentication, {
+  readonly _tag: "StaleAuthentication";
+}, readonly [Schema.TaggedStruct<"StaleAuthentication", {}>], {
+  readonly _tag: "StaleAuthentication";
+}>, Schema.TaggedStruct<"StaleAuthentication", {}>, never, never>)[];
+interface SessionHttpService<Id extends string, Kind extends string, Session> {
+  readonly namespace: Id;
+  readonly kind: Kind;
+  readonly session: Types.Invariant<Session>;
+}
+type SessionHttpAuthorization<Id extends string, Session> = SessionHttpService<Id, "require", Session> & { readonly [Key in keyof HttpApiMiddleware.AnyId]: {
+  readonly provides: SessionHttpService<Id, "session", Session>;
+  readonly requires: HttpRouter.Request.From<"Requires", AuthRequest>;
+  readonly error: typeof sessionHttpErrors;
+  readonly clientError: never;
+  readonly requiredForClient: false;
+}; };
+/** Shared HttpApi security metadata and authenticated session service.
+ * The server implementation requires the validated request supplied by AuthHttp.middleware.
+ * Keep this declaration beside the application's shared API, outside server setup.
+ */
+declare const makeSessionHttpContract: <const Id extends string, S extends Schema.Top>(id: Id, session: S, options: {
+  readonly cookieName: string;
+}) => Readonly<{
+  id: Id;
+  CurrentSession: Context.Service<SessionHttpService<Id, "session", S["Type"]>, S["Type"]>;
+  RequireSession: HttpApiMiddleware.ServiceClass<SessionHttpAuthorization<Id, S["Type"]>, `${Id}/RequireSession`, {
+    requires: HttpRouter.Request<"Requires", AuthRequest>;
+    provides: SessionHttpService<Id, "session", S["Type"]>;
+    error: (Schema.decodeTo<Schema.declareConstructor<AssuranceRequired, {
+      readonly _tag: "AssuranceRequired";
+    }, readonly [Schema.TaggedStruct<"AssuranceRequired", {}>], {
+      readonly _tag: "AssuranceRequired";
+    }>, Schema.TaggedStruct<"AssuranceRequired", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<AuthenticationRequired, {
+      readonly _tag: "AuthenticationRequired";
+    }, readonly [Schema.TaggedStruct<"AuthenticationRequired", {}>], {
+      readonly _tag: "AuthenticationRequired";
+    }>, Schema.TaggedStruct<"AuthenticationRequired", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<HookDenied, {
+      readonly _tag: "HookDenied";
+      readonly reason: "policy" | "unavailable";
+    }, readonly [Schema.TaggedStruct<"HookDenied", {
+      readonly reason: Schema.Literals<readonly ["policy", "unavailable"]>;
+    }>], {
+      readonly _tag: "HookDenied";
+      readonly reason: "policy" | "unavailable";
+    }>, Schema.TaggedStruct<"HookDenied", {
+      readonly reason: Schema.Literals<readonly ["policy", "unavailable"]>;
+    }>, never, never> | Schema.decodeTo<Schema.declareConstructor<InvalidOperationInput, {
+      readonly _tag: "InvalidOperationInput";
+    }, readonly [Schema.TaggedStruct<"InvalidOperationInput", {}>], {
+      readonly _tag: "InvalidOperationInput";
+    }>, Schema.TaggedStruct<"InvalidOperationInput", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<OperationForbidden, {
+      readonly _tag: "OperationForbidden";
+    }, readonly [Schema.TaggedStruct<"OperationForbidden", {}>], {
+      readonly _tag: "OperationForbidden";
+    }>, Schema.TaggedStruct<"OperationForbidden", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<OperationPrivateOutputUnsupported, {
+      readonly _tag: "OperationPrivateOutputUnsupported";
+    }, readonly [Schema.TaggedStruct<"OperationPrivateOutputUnsupported", {}>], {
+      readonly _tag: "OperationPrivateOutputUnsupported";
+    }>, Schema.TaggedStruct<"OperationPrivateOutputUnsupported", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<PendingAuthenticationInvalid, {
+      readonly _tag: "PendingAuthenticationInvalid";
+    }, readonly [Schema.TaggedStruct<"PendingAuthenticationInvalid", {}>], {
+      readonly _tag: "PendingAuthenticationInvalid";
+    }>, Schema.TaggedStruct<"PendingAuthenticationInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionCapabilityUnsupported, {
+      readonly _tag: "SessionCapabilityUnsupported";
+      readonly capability: string;
+    }, readonly [Schema.TaggedStruct<"SessionCapabilityUnsupported", {
+      readonly capability: Schema.NonEmptyString;
+    }>], {
+      readonly _tag: "SessionCapabilityUnsupported";
+      readonly capability: string;
+    }>, Schema.TaggedStruct<"SessionCapabilityUnsupported", {
+      readonly capability: Schema.NonEmptyString;
+    }>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionConflict, {
+      readonly _tag: "SessionConflict";
+    }, readonly [Schema.TaggedStruct<"SessionConflict", {}>], {
+      readonly _tag: "SessionConflict";
+    }>, Schema.TaggedStruct<"SessionConflict", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionInvalid, {
+      readonly _tag: "SessionInvalid";
+    }, readonly [Schema.TaggedStruct<"SessionInvalid", {}>], {
+      readonly _tag: "SessionInvalid";
+    }>, Schema.TaggedStruct<"SessionInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionRenewalTooEarly, {
+      readonly _tag: "SessionRenewalTooEarly";
+      readonly retryAt: number;
+    }, readonly [Schema.TaggedStruct<"SessionRenewalTooEarly", {
+      readonly retryAt: Schema.DateTimeUtcFromMillis;
+    }>], {
+      readonly _tag: "SessionRenewalTooEarly";
+      readonly retryAt: import("effect/DateTime").Utc;
+    }>, Schema.TaggedStruct<"SessionRenewalTooEarly", {
+      readonly retryAt: Schema.DateTimeUtcFromMillis;
+    }>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionSignOutUnavailable, {
+      readonly _tag: "SessionSignOutUnavailable";
+      readonly clearCredential: true;
+    }, readonly [Schema.TaggedStruct<"SessionSignOutUnavailable", {
+      readonly clearCredential: Schema.Literal<true>;
+    }>], {
+      readonly _tag: "SessionSignOutUnavailable";
+      readonly clearCredential: true;
+    }>, Schema.TaggedStruct<"SessionSignOutUnavailable", {
+      readonly clearCredential: Schema.Literal<true>;
+    }>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionStepUpInvalid, {
+      readonly _tag: "SessionStepUpInvalid";
+    }, readonly [Schema.TaggedStruct<"SessionStepUpInvalid", {}>], {
+      readonly _tag: "SessionStepUpInvalid";
+    }>, Schema.TaggedStruct<"SessionStepUpInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionUnavailable, {
+      readonly _tag: "SessionUnavailable";
+    }, readonly [Schema.TaggedStruct<"SessionUnavailable", {}>], {
+      readonly _tag: "SessionUnavailable";
+    }>, Schema.TaggedStruct<"SessionUnavailable", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<StaleAuthentication, {
+      readonly _tag: "StaleAuthentication";
+    }, readonly [Schema.TaggedStruct<"StaleAuthentication", {}>], {
+      readonly _tag: "StaleAuthentication";
+    }>, Schema.TaggedStruct<"StaleAuthentication", {}>, never, never>)[];
+    clientError: never;
+    requiredForClient: false;
+    security: {
+      readonly session: HttpApiSecurity.ApiKey;
+    };
+  }, HttpApiMiddleware.HttpApiMiddlewareSecurity<{
+    readonly session: HttpApiSecurity.ApiKey;
+  }, SessionHttpService<Id, "session", S["Type"]>, (Schema.decodeTo<Schema.declareConstructor<AssuranceRequired, {
+    readonly _tag: "AssuranceRequired";
+  }, readonly [Schema.TaggedStruct<"AssuranceRequired", {}>], {
+    readonly _tag: "AssuranceRequired";
+  }>, Schema.TaggedStruct<"AssuranceRequired", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<AuthenticationRequired, {
+    readonly _tag: "AuthenticationRequired";
+  }, readonly [Schema.TaggedStruct<"AuthenticationRequired", {}>], {
+    readonly _tag: "AuthenticationRequired";
+  }>, Schema.TaggedStruct<"AuthenticationRequired", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<HookDenied, {
+    readonly _tag: "HookDenied";
+    readonly reason: "policy" | "unavailable";
+  }, readonly [Schema.TaggedStruct<"HookDenied", {
+    readonly reason: Schema.Literals<readonly ["policy", "unavailable"]>;
+  }>], {
+    readonly _tag: "HookDenied";
+    readonly reason: "policy" | "unavailable";
+  }>, Schema.TaggedStruct<"HookDenied", {
+    readonly reason: Schema.Literals<readonly ["policy", "unavailable"]>;
+  }>, never, never> | Schema.decodeTo<Schema.declareConstructor<InvalidOperationInput, {
+    readonly _tag: "InvalidOperationInput";
+  }, readonly [Schema.TaggedStruct<"InvalidOperationInput", {}>], {
+    readonly _tag: "InvalidOperationInput";
+  }>, Schema.TaggedStruct<"InvalidOperationInput", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<OperationForbidden, {
+    readonly _tag: "OperationForbidden";
+  }, readonly [Schema.TaggedStruct<"OperationForbidden", {}>], {
+    readonly _tag: "OperationForbidden";
+  }>, Schema.TaggedStruct<"OperationForbidden", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<OperationPrivateOutputUnsupported, {
+    readonly _tag: "OperationPrivateOutputUnsupported";
+  }, readonly [Schema.TaggedStruct<"OperationPrivateOutputUnsupported", {}>], {
+    readonly _tag: "OperationPrivateOutputUnsupported";
+  }>, Schema.TaggedStruct<"OperationPrivateOutputUnsupported", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<PendingAuthenticationInvalid, {
+    readonly _tag: "PendingAuthenticationInvalid";
+  }, readonly [Schema.TaggedStruct<"PendingAuthenticationInvalid", {}>], {
+    readonly _tag: "PendingAuthenticationInvalid";
+  }>, Schema.TaggedStruct<"PendingAuthenticationInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionCapabilityUnsupported, {
+    readonly _tag: "SessionCapabilityUnsupported";
+    readonly capability: string;
+  }, readonly [Schema.TaggedStruct<"SessionCapabilityUnsupported", {
+    readonly capability: Schema.NonEmptyString;
+  }>], {
+    readonly _tag: "SessionCapabilityUnsupported";
+    readonly capability: string;
+  }>, Schema.TaggedStruct<"SessionCapabilityUnsupported", {
+    readonly capability: Schema.NonEmptyString;
+  }>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionConflict, {
+    readonly _tag: "SessionConflict";
+  }, readonly [Schema.TaggedStruct<"SessionConflict", {}>], {
+    readonly _tag: "SessionConflict";
+  }>, Schema.TaggedStruct<"SessionConflict", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionInvalid, {
+    readonly _tag: "SessionInvalid";
+  }, readonly [Schema.TaggedStruct<"SessionInvalid", {}>], {
+    readonly _tag: "SessionInvalid";
+  }>, Schema.TaggedStruct<"SessionInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionRenewalTooEarly, {
+    readonly _tag: "SessionRenewalTooEarly";
+    readonly retryAt: number;
+  }, readonly [Schema.TaggedStruct<"SessionRenewalTooEarly", {
+    readonly retryAt: Schema.DateTimeUtcFromMillis;
+  }>], {
+    readonly _tag: "SessionRenewalTooEarly";
+    readonly retryAt: import("effect/DateTime").Utc;
+  }>, Schema.TaggedStruct<"SessionRenewalTooEarly", {
+    readonly retryAt: Schema.DateTimeUtcFromMillis;
+  }>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionSignOutUnavailable, {
+    readonly _tag: "SessionSignOutUnavailable";
+    readonly clearCredential: true;
+  }, readonly [Schema.TaggedStruct<"SessionSignOutUnavailable", {
+    readonly clearCredential: Schema.Literal<true>;
+  }>], {
+    readonly _tag: "SessionSignOutUnavailable";
+    readonly clearCredential: true;
+  }>, Schema.TaggedStruct<"SessionSignOutUnavailable", {
+    readonly clearCredential: Schema.Literal<true>;
+  }>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionStepUpInvalid, {
+    readonly _tag: "SessionStepUpInvalid";
+  }, readonly [Schema.TaggedStruct<"SessionStepUpInvalid", {}>], {
+    readonly _tag: "SessionStepUpInvalid";
+  }>, Schema.TaggedStruct<"SessionStepUpInvalid", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<SessionUnavailable, {
+    readonly _tag: "SessionUnavailable";
+  }, readonly [Schema.TaggedStruct<"SessionUnavailable", {}>], {
+    readonly _tag: "SessionUnavailable";
+  }>, Schema.TaggedStruct<"SessionUnavailable", {}>, never, never> | Schema.decodeTo<Schema.declareConstructor<StaleAuthentication, {
+    readonly _tag: "StaleAuthentication";
+  }, readonly [Schema.TaggedStruct<"StaleAuthentication", {}>], {
+    readonly _tag: "StaleAuthentication";
+  }>, Schema.TaggedStruct<"StaleAuthentication", {}>, never, never>)[], HttpRouter.Request<"Requires", AuthRequest>>>;
+  session: S;
+  cookieName: string;
+}>;
+//#endregion
+export { SessionHttpAuthorization, SessionHttpService, makeSessionHttpContract };
+//# sourceMappingURL=session-contract.d.mts.map

package/dist/http/session-contract.mjs

@@ -0,0 +1,38 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { AssuranceRequired, AuthenticationRequired, OperationBoundaryError, OperationForbidden } from "../operations/errors.mjs";
+import { SessionError, SessionInvalid, SessionSignOutUnavailable, SessionUnavailable } from "../sessions/errors.mjs";
+import { Context } from "effect";
+import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
+//#region src/http/session-contract.ts
+/** Existing domain failures with HTTP statuses, without changing their wire values. */
+const sessionHttpErrors = [
+	...SessionError.members.map((member) => member.annotate({ httpApiStatus: member === SessionInvalid ? 401 : member === SessionUnavailable || member === SessionSignOutUnavailable ? 503 : 400 })),
+	...OperationBoundaryError.members.map((member) => member.annotate({ httpApiStatus: member === AuthenticationRequired ? 401 : member === OperationForbidden || member === AssuranceRequired ? 403 : 400 })),
+	HookDenied.annotate({ httpApiStatus: 403 })
+];
+/** Shared HttpApi security metadata and authenticated session service.
+* The server implementation requires the validated request supplied by AuthHttp.middleware.
+* Keep this declaration beside the application's shared API, outside server setup.
+*/
+const makeSessionHttpContract = (id, session, options) => {
+	const cookieName = options.cookieName;
+	const CurrentSession = Context.Service(`${id}/CurrentSession`);
+	const RequireSession = HttpApiMiddleware.Service()(`${id}/RequireSession`, {
+		security: { session: HttpApiSecurity.apiKey({
+			in: "cookie",
+			key: cookieName
+		}) },
+		error: sessionHttpErrors
+	});
+	return Object.freeze({
+		id,
+		CurrentSession,
+		RequireSession,
+		session,
+		cookieName
+	});
+};
+//#endregion
+export { makeSessionHttpContract };
+
+//# sourceMappingURL=session-contract.mjs.map

package/dist/http/session-contract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-contract.mjs","names":[],"sources":["../../src/http/session-contract.ts"],"sourcesContent":["import { Context, type Schema, type Types } from \"effect\";\nimport type { HttpRouter } from \"effect/unstable/http\";\nimport { HttpApiMiddleware, HttpApiSecurity } from \"effect/unstable/httpapi\";\n\nimport type { AuthRequest } from \"../auth/AuthRequest\";\nimport { HookDenied } from \"../hooks/models\";\nimport {\n  AuthenticationRequired,\n  AssuranceRequired,\n  OperationBoundaryError,\n  OperationForbidden,\n} from \"../operations/errors\";\nimport {\n  SessionError,\n  SessionInvalid,\n  SessionSignOutUnavailable,\n  SessionUnavailable,\n} from \"../sessions/errors\";\n\n/** Existing domain failures with HTTP statuses, without changing their wire values. */\nconst sessionHttpErrors = [\n  ...SessionError.members.map((member) =>\n    member.annotate({\n      httpApiStatus:\n        member === SessionInvalid\n          ? 401\n          : member === SessionUnavailable || member === SessionSignOutUnavailable\n            ? 503\n            : 400,\n    }),\n  ),\n  ...OperationBoundaryError.members.map((member) =>\n    member.annotate({\n      httpApiStatus:\n        member === AuthenticationRequired\n          ? 401\n          : member === OperationForbidden || member === AssuranceRequired\n            ? 403\n            : 400,\n    }),\n  ),\n  HookDenied.annotate({ httpApiStatus: 403 }),\n];\n\nexport interface SessionHttpService<Id extends string, Kind extends string, Session> {\n  readonly namespace: Id;\n  readonly kind: Kind;\n  readonly session: Types.Invariant<Session>;\n}\n\nexport type SessionHttpAuthorization<Id extends string, Session> = SessionHttpService<\n  Id,\n  \"require\",\n  Session\n> & {\n  readonly [Key in keyof HttpApiMiddleware.AnyId]: {\n    readonly provides: SessionHttpService<Id, \"session\", Session>;\n    readonly requires: HttpRouter.Request.From<\"Requires\", AuthRequest>;\n    readonly error: typeof sessionHttpErrors;\n    readonly clientError: never;\n    readonly requiredForClient: false;\n  };\n};\n\n/** Shared HttpApi security metadata and authenticated session service.\n * The server implementation requires the validated request supplied by AuthHttp.middleware.\n * Keep this declaration beside the application's shared API, outside server setup.\n */\nexport const makeSessionHttpContract = <const Id extends string, S extends Schema.Top>(\n  id: Id,\n  session: S,\n  options: { readonly cookieName: string },\n) => {\n  const cookieName = options.cookieName;\n\n  const CurrentSession = Context.Service<SessionHttpService<Id, \"session\", S[\"Type\"]>, S[\"Type\"]>(\n    `${id}/CurrentSession`,\n  );\n\n  const RequireSession = HttpApiMiddleware.Service<\n    SessionHttpAuthorization<Id, S[\"Type\"]>,\n    {\n      provides: SessionHttpService<Id, \"session\", S[\"Type\"]>;\n      requires: HttpRouter.Request.From<\"Requires\", AuthRequest>;\n    }\n  >()(`${id}/RequireSession`, {\n    security: { session: HttpApiSecurity.apiKey({ in: \"cookie\", key: cookieName }) },\n    error: sessionHttpErrors,\n  });\n\n  return Object.freeze({ id, CurrentSession, RequireSession, session, cookieName });\n};\n"],"mappings":";;;;;;;AAoBA,MAAM,oBAAoB;CACxB,GAAG,aAAa,QAAQ,KAAK,WAC3B,OAAO,SAAS,EACd,eACE,WAAW,iBACP,MACA,WAAW,sBAAsB,WAAW,4BAC1C,MACA,IACV,CAAC,CACH;CACA,GAAG,uBAAuB,QAAQ,KAAK,WACrC,OAAO,SAAS,EACd,eACE,WAAW,yBACP,MACA,WAAW,sBAAsB,WAAW,oBAC1C,MACA,IACV,CAAC,CACH;CACA,WAAW,SAAS,EAAE,eAAe,IAAI,CAAC;AAC5C;;;;;AA0BA,MAAa,2BACX,IACA,SACA,YACG;CACH,MAAM,aAAa,QAAQ;CAE3B,MAAM,iBAAiB,QAAQ,QAC7B,GAAG,GAAG,gBACR;CAEA,MAAM,iBAAiB,kBAAkB,QAMvC,CAAC,CAAC,GAAG,GAAG,kBAAkB;EAC1B,UAAU,EAAE,SAAS,gBAAgB,OAAO;GAAE,IAAI;GAAU,KAAK;EAAW,CAAC,EAAE;EAC/E,OAAO;CACT,CAAC;CAED,OAAO,OAAO,OAAO;EAAE;EAAI;EAAgB;EAAgB;EAAS;CAAW,CAAC;AAClF"}

package/dist/http-operation/OperationHttpInvocation.d.mts

@@ -0,0 +1,16 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { OperationHttpError } from "./errors.mjs";
+import { HttpCredentials } from "./models.mjs";
+import { SessionApiError } from "../auth/session.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/http-operation/OperationHttpInvocation.d.ts
+declare const OperationHttpInvocation_base: Context.ServiceClass<OperationHttpInvocation, "effect-auth/OperationHttpInvocation", {
+  /** A public action resolves caller identity only when its local method needs it. */
+  readonly request?: (request: Request, credentials: HttpCredentials) => Effect.Effect<AuthInvocation, SessionApiError>;
+  readonly resolve: (request: Request, credentials: HttpCredentials) => Effect.Effect<AuthInvocation, OperationHttpError>;
+}>;
+declare class OperationHttpInvocation extends OperationHttpInvocation_base {}
+declare const invocationLayer: <R>(resolve: (request: Request, credentials: HttpCredentials) => Effect.Effect<AuthInvocation, OperationHttpError, R>) => Layer.Layer<OperationHttpInvocation, never, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { OperationHttpInvocation, invocationLayer };
+//# sourceMappingURL=OperationHttpInvocation.d.mts.map

package/dist/http-operation/OperationHttpInvocation.mjs

@@ -0,0 +1,11 @@
+import { Context, Effect, Layer } from "effect";
+//#region src/http-operation/OperationHttpInvocation.ts
+var OperationHttpInvocation = class extends Context.Service()("effect-auth/OperationHttpInvocation") {};
+const invocationLayer = (resolve) => Layer.effect(OperationHttpInvocation, Effect.gen(function* () {
+	const services = yield* Effect.context();
+	return { resolve: (request, credentials) => resolve(request, credentials).pipe(Effect.provide(services)) };
+}));
+//#endregion
+export { OperationHttpInvocation, invocationLayer };
+
+//# sourceMappingURL=OperationHttpInvocation.mjs.map

package/dist/http-operation/OperationHttpInvocation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperationHttpInvocation.mjs","names":[],"sources":["../../src/http-operation/OperationHttpInvocation.ts"],"sourcesContent":["import { Context, Effect, Layer } from \"effect\";\n\nimport type { SessionApiError } from \"../auth/session\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { OperationHttpError } from \"./errors\";\nimport type { HttpCredentials } from \"./models\";\n\nexport class OperationHttpInvocation extends Context.Service<\n  OperationHttpInvocation,\n  {\n    /** A public action resolves caller identity only when its local method needs it. */\n    readonly request?: (\n      request: Request,\n      credentials: HttpCredentials,\n    ) => Effect.Effect<AuthInvocation, SessionApiError>;\n    readonly resolve: (\n      request: Request,\n      credentials: HttpCredentials,\n    ) => Effect.Effect<AuthInvocation, OperationHttpError>;\n  }\n>()(\"effect-auth/OperationHttpInvocation\") {}\n\nexport const invocationLayer = <R>(\n  resolve: (\n    request: Request,\n    credentials: HttpCredentials,\n  ) => Effect.Effect<AuthInvocation, OperationHttpError, R>,\n) =>\n  Layer.effect(\n    OperationHttpInvocation,\n    Effect.gen(function* () {\n      const services = yield* Effect.context<R>();\n\n      return {\n        resolve: (request: Request, credentials: HttpCredentials) =>\n          resolve(request, credentials).pipe(Effect.provide(services)),\n      };\n    }),\n  );\n"],"mappings":";;AAOA,IAAa,0BAAb,cAA6C,QAAQ,QAanD,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;AAE5C,MAAa,mBACX,YAKA,MAAM,OACJ,yBACA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO,OAAO,QAAW;CAE1C,OAAO,EACL,UAAU,SAAkB,gBAC1B,QAAQ,SAAS,WAAW,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC,EAC/D;AACF,CAAC,CACH"}

package/dist/http-operation/OperationHttpServerConfig.d.mts

@@ -0,0 +1,18 @@
+import { CredentialSlot } from "../operations/credentials.mjs";
+import { OperationHttpConfigurationError } from "./errors.mjs";
+import { OperationCookie, OperationHttpConfiguration } from "./models.mjs";
+import { Context, Layer } from "effect";
+//#region src/http-operation/OperationHttpServerConfig.d.ts
+declare const OperationHttpServerConfig_base: Context.ServiceClass<OperationHttpServerConfig, "effect-auth/OperationHttpServerConfig", OperationHttpConfiguration>;
+declare class OperationHttpServerConfig extends OperationHttpServerConfig_base {}
+declare const configurationLayer: (input: OperationHttpConfiguration) => Layer.Layer<OperationHttpServerConfig, OperationHttpConfigurationError, never>;
+declare const cookieConfiguration: (input: {
+  readonly prefix: string;
+  readonly secure: boolean;
+  readonly path?: string;
+  readonly sameSite?: OperationCookie["sameSite"];
+}) => OperationHttpConfiguration["cookies"];
+declare const headerConfiguration: (prefix: string) => Readonly<Record<CredentialSlot, string>>;
+//#endregion
+export { OperationHttpServerConfig, configurationLayer, cookieConfiguration, headerConfiguration };
+//# sourceMappingURL=OperationHttpServerConfig.d.mts.map

package/dist/http-operation/OperationHttpServerConfig.mjs

@@ -0,0 +1,72 @@
+import { OperationHttpConfigurationError } from "./errors.mjs";
+import { credentialSlots } from "./models.mjs";
+import { headerName, origin } from "./configuration-schema.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+import { Cookies } from "effect/unstable/http";
+//#region src/http-operation/OperationHttpServerConfig.ts
+var OperationHttpServerConfig = class extends Context.Service()("effect-auth/OperationHttpServerConfig") {};
+const cookie = Schema.Struct({
+	name: Schema.NonEmptyString,
+	path: Schema.String.check(Schema.isStartsWith("/")),
+	secure: Schema.Boolean,
+	sameSite: Schema.Literals([
+		"lax",
+		"strict",
+		"none"
+	]),
+	domain: Schema.optionalKey(Schema.String)
+});
+const configurationLayer = (input) => Layer.effect(OperationHttpServerConfig, Effect.try({
+	try: () => {
+		if (input.trustedOrigins.length === 0 || !input.trustedOrigins.every(Schema.is(origin)) || !Schema.is(headerName)(input.csrfHeader) || input.csrfValue.length < 1 || input.csrfValue.length > 128 || !Number.isSafeInteger(input.maximumBodyBytes) || input.maximumBodyBytes < 1 || input.maximumBodyBytes > 1048576 || !Number.isSafeInteger(input.maximumUrlBytes) || input.maximumUrlBytes < 1 || input.maximumUrlBytes > 16384) throw new Error();
+		if (typeof input.publicOrigin === "string" && !Schema.is(origin)(input.publicOrigin)) throw new Error();
+		const names = /* @__PURE__ */ new Set();
+		const cookies = Object.fromEntries(credentialSlots.map((slot) => {
+			const value = Schema.decodeSync(cookie)(input.cookies[slot]);
+			if (names.has(value.name) || value.sameSite === "none" && !value.secure || value.name.startsWith("__Secure-") && !value.secure || value.name.startsWith("__Host-") && (!value.secure || value.path !== "/" || value.domain !== void 0)) throw new Error();
+			names.add(value.name);
+			Cookies.makeCookieUnsafe(value.name, "probe", {
+				...value,
+				httpOnly: true
+			});
+			return [slot, Object.freeze(value)];
+		}));
+		if (input.native !== void 0) {
+			const native = input.native;
+			const request = [native.modeHeader, ...credentialSlots.map((slot) => native.requestHeaders[slot])];
+			const response = credentialSlots.map((slot) => native.responseHeaders[slot]);
+			if ([...request, ...response].some((name) => !Schema.is(headerName)(name)) || new Set(request).size !== request.length || new Set(response).size !== response.length || request.some((name) => [
+				"origin",
+				"cookie",
+				"host",
+				input.csrfHeader
+			].includes(name)) || response.some((name) => [
+				"set-cookie",
+				"location",
+				"content-type"
+			].includes(name))) throw new Error();
+		}
+		return Object.freeze({
+			...input,
+			cookies,
+			trustedOrigins: Object.freeze([...input.trustedOrigins]),
+			...input.native === void 0 ? {} : { native: Object.freeze({
+				...input.native,
+				requestHeaders: Object.freeze({ ...input.native.requestHeaders }),
+				responseHeaders: Object.freeze({ ...input.native.responseHeaders })
+			}) }
+		});
+	},
+	catch: () => OperationHttpConfigurationError.make({ reason: "cookies" })
+}));
+const cookieConfiguration = (input) => Object.fromEntries(credentialSlots.map((slot) => [slot, {
+	name: `${input.prefix}${slot}`,
+	path: input.path ?? "/",
+	secure: input.secure,
+	sameSite: input.sameSite ?? "lax"
+}]));
+const headerConfiguration = (prefix) => Object.fromEntries(credentialSlots.map((slot) => [slot, `${prefix}${slot}`]));
+//#endregion
+export { OperationHttpServerConfig, configurationLayer, cookieConfiguration, headerConfiguration };
+
+//# sourceMappingURL=OperationHttpServerConfig.mjs.map

package/dist/http-operation/OperationHttpServerConfig.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperationHttpServerConfig.mjs","names":[],"sources":["../../src/http-operation/OperationHttpServerConfig.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema } from \"effect\";\nimport { Cookies } from \"effect/unstable/http\";\n\nimport type { CredentialSlot } from \"../operations/credentials\";\nimport { headerName, origin } from \"./configuration-schema\";\nimport { OperationHttpConfigurationError } from \"./errors\";\nimport { credentialSlots, type OperationCookie, type OperationHttpConfiguration } from \"./models\";\n\nexport class OperationHttpServerConfig extends Context.Service<\n  OperationHttpServerConfig,\n  OperationHttpConfiguration\n>()(\"effect-auth/OperationHttpServerConfig\") {}\n\nconst cookie = Schema.Struct({\n  name: Schema.NonEmptyString,\n  path: Schema.String.check(Schema.isStartsWith(\"/\")),\n  secure: Schema.Boolean,\n  sameSite: Schema.Literals([\"lax\", \"strict\", \"none\"]),\n  domain: Schema.optionalKey(Schema.String),\n});\n\nexport const configurationLayer = (input: OperationHttpConfiguration) =>\n  Layer.effect(\n    OperationHttpServerConfig,\n    Effect.try({\n      try: () => {\n        if (\n          input.trustedOrigins.length === 0 ||\n          !input.trustedOrigins.every(Schema.is(origin)) ||\n          !Schema.is(headerName)(input.csrfHeader) ||\n          input.csrfValue.length < 1 ||\n          input.csrfValue.length > 128 ||\n          !Number.isSafeInteger(input.maximumBodyBytes) ||\n          input.maximumBodyBytes < 1 ||\n          input.maximumBodyBytes > 1048576 ||\n          !Number.isSafeInteger(input.maximumUrlBytes) ||\n          input.maximumUrlBytes < 1 ||\n          input.maximumUrlBytes > 16384\n        )\n          throw new Error();\n        if (typeof input.publicOrigin === \"string\" && !Schema.is(origin)(input.publicOrigin))\n          throw new Error();\n        const names = new Set<string>();\n\n        const cookies = Object.fromEntries(\n          credentialSlots.map((slot) => {\n            const value = Schema.decodeSync(cookie)(input.cookies[slot]);\n\n            if (\n              names.has(value.name) ||\n              (value.sameSite === \"none\" && !value.secure) ||\n              (value.name.startsWith(\"__Secure-\") && !value.secure) ||\n              (value.name.startsWith(\"__Host-\") &&\n                (!value.secure || value.path !== \"/\" || value.domain !== undefined))\n            )\n              throw new Error();\n            names.add(value.name);\n            Cookies.makeCookieUnsafe(value.name, \"probe\", { ...value, httpOnly: true });\n\n            return [slot, Object.freeze(value)];\n          }),\n        ) as unknown as OperationHttpConfiguration[\"cookies\"];\n\n        if (input.native !== undefined) {\n          const native = input.native;\n\n          const request = [\n            native.modeHeader,\n            ...credentialSlots.map((slot) => native.requestHeaders[slot]),\n          ];\n\n          const response = credentialSlots.map((slot) => native.responseHeaders[slot]);\n\n          if (\n            [...request, ...response].some((name) => !Schema.is(headerName)(name)) ||\n            new Set(request).size !== request.length ||\n            new Set(response).size !== response.length ||\n            request.some((name) => [\"origin\", \"cookie\", \"host\", input.csrfHeader].includes(name)) ||\n            response.some((name) => [\"set-cookie\", \"location\", \"content-type\"].includes(name))\n          )\n            throw new Error();\n        }\n\n        return Object.freeze({\n          ...input,\n          cookies,\n          trustedOrigins: Object.freeze([...input.trustedOrigins]),\n          ...(input.native === undefined\n            ? {}\n            : {\n                native: Object.freeze({\n                  ...input.native,\n                  requestHeaders: Object.freeze({ ...input.native.requestHeaders }),\n                  responseHeaders: Object.freeze({ ...input.native.responseHeaders }),\n                }),\n              }),\n        });\n      },\n      catch: () => OperationHttpConfigurationError.make({ reason: \"cookies\" }),\n    }),\n  );\n\nexport const cookieConfiguration = (input: {\n  readonly prefix: string;\n  readonly secure: boolean;\n  readonly path?: string;\n  readonly sameSite?: OperationCookie[\"sameSite\"];\n}): OperationHttpConfiguration[\"cookies\"] =>\n  Object.fromEntries(\n    credentialSlots.map((slot) => [\n      slot,\n      {\n        name: `${input.prefix}${slot}`,\n        path: input.path ?? \"/\",\n        secure: input.secure,\n        sameSite: input.sameSite ?? \"lax\",\n      },\n    ]),\n  ) as unknown as OperationHttpConfiguration[\"cookies\"];\n\nexport const headerConfiguration = (prefix: string): Readonly<Record<CredentialSlot, string>> =>\n  Object.fromEntries(credentialSlots.map((slot) => [slot, `${prefix}${slot}`])) as Readonly<\n    Record<CredentialSlot, string>\n  >;\n"],"mappings":";;;;;;AAQA,IAAa,4BAAb,cAA+C,QAAQ,QAGrD,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC;AAE9C,MAAM,SAAS,OAAO,OAAO;CAC3B,MAAM,OAAO;CACb,MAAM,OAAO,OAAO,MAAM,OAAO,aAAa,GAAG,CAAC;CAClD,QAAQ,OAAO;CACf,UAAU,OAAO,SAAS;EAAC;EAAO;EAAU;CAAM,CAAC;CACnD,QAAQ,OAAO,YAAY,OAAO,MAAM;AAC1C,CAAC;AAED,MAAa,sBAAsB,UACjC,MAAM,OACJ,2BACA,OAAO,IAAI;CACT,WAAW;EACT,IACE,MAAM,eAAe,WAAW,KAChC,CAAC,MAAM,eAAe,MAAM,OAAO,GAAG,MAAM,CAAC,KAC7C,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC,MAAM,UAAU,KACvC,MAAM,UAAU,SAAS,KACzB,MAAM,UAAU,SAAS,OACzB,CAAC,OAAO,cAAc,MAAM,gBAAgB,KAC5C,MAAM,mBAAmB,KACzB,MAAM,mBAAmB,WACzB,CAAC,OAAO,cAAc,MAAM,eAAe,KAC3C,MAAM,kBAAkB,KACxB,MAAM,kBAAkB,OAExB,MAAM,IAAI,MAAM;EAClB,IAAI,OAAO,MAAM,iBAAiB,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,YAAY,GACjF,MAAM,IAAI,MAAM;EAClB,MAAM,wBAAQ,IAAI,IAAY;EAE9B,MAAM,UAAU,OAAO,YACrB,gBAAgB,KAAK,SAAS;GAC5B,MAAM,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC,MAAM,QAAQ,KAAK;GAE3D,IACE,MAAM,IAAI,MAAM,IAAI,KACnB,MAAM,aAAa,UAAU,CAAC,MAAM,UACpC,MAAM,KAAK,WAAW,WAAW,KAAK,CAAC,MAAM,UAC7C,MAAM,KAAK,WAAW,SAAS,MAC7B,CAAC,MAAM,UAAU,MAAM,SAAS,OAAO,MAAM,WAAW,KAAA,IAE3D,MAAM,IAAI,MAAM;GAClB,MAAM,IAAI,MAAM,IAAI;GACpB,QAAQ,iBAAiB,MAAM,MAAM,SAAS;IAAE,GAAG;IAAO,UAAU;GAAK,CAAC;GAE1E,OAAO,CAAC,MAAM,OAAO,OAAO,KAAK,CAAC;EACpC,CAAC,CACH;EAEA,IAAI,MAAM,WAAW,KAAA,GAAW;GAC9B,MAAM,SAAS,MAAM;GAErB,MAAM,UAAU,CACd,OAAO,YACP,GAAG,gBAAgB,KAAK,SAAS,OAAO,eAAe,KAAK,CAC9D;GAEA,MAAM,WAAW,gBAAgB,KAAK,SAAS,OAAO,gBAAgB,KAAK;GAE3E,IACE,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,KACrE,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,QAAQ,UAClC,IAAI,IAAI,QAAQ,CAAC,CAAC,SAAS,SAAS,UACpC,QAAQ,MAAM,SAAS;IAAC;IAAU;IAAU;IAAQ,MAAM;GAAU,CAAC,CAAC,SAAS,IAAI,CAAC,KACpF,SAAS,MAAM,SAAS;IAAC;IAAc;IAAY;GAAc,CAAC,CAAC,SAAS,IAAI,CAAC,GAEjF,MAAM,IAAI,MAAM;EACpB;EAEA,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,gBAAgB,OAAO,OAAO,CAAC,GAAG,MAAM,cAAc,CAAC;GACvD,GAAI,MAAM,WAAW,KAAA,IACjB,CAAC,IACD,EACE,QAAQ,OAAO,OAAO;IACpB,GAAG,MAAM;IACT,gBAAgB,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,eAAe,CAAC;IAChE,iBAAiB,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,gBAAgB,CAAC;GACpE,CAAC,EACH;EACN,CAAC;CACH;CACA,aAAa,gCAAgC,KAAK,EAAE,QAAQ,UAAU,CAAC;AACzE,CAAC,CACH;AAEF,MAAa,uBAAuB,UAMlC,OAAO,YACL,gBAAgB,KAAK,SAAS,CAC5B,MACA;CACE,MAAM,GAAG,MAAM,SAAS;CACxB,MAAM,MAAM,QAAQ;CACpB,QAAQ,MAAM;CACd,UAAU,MAAM,YAAY;AAC9B,CACF,CAAC,CACH;AAEF,MAAa,uBAAuB,WAClC,OAAO,YAAY,gBAAgB,KAAK,SAAS,CAAC,MAAM,GAAG,SAAS,MAAM,CAAC,CAAC"}

package/dist/http-operation/auth-client.d.mts

@@ -0,0 +1,75 @@
+import { RouteFailure, RouteInput, RouteSuccess } from "./contract.mjs";
+import { OperationHttpError } from "./errors.mjs";
+import { OperationAuthenticationCompletion, OperationFetchClient, OperationFetchOptions } from "./client.mjs";
+import { AnyAuthAction, AuthActions } from "../operations/actions.mjs";
+import { Context, Effect, Layer, Scope } from "effect";
+//#region src/http-operation/auth-client.d.ts
+type ClientOptions = Omit<OperationFetchOptions, "csrfHeader" | "csrfValue"> & {
+  readonly csrf?: {
+    readonly header: string;
+    readonly value: string;
+  };
+};
+type ActionDecodeServices<Action extends AnyAuthAction> = Action["route"]["operation"]["rpc"]["successSchema"]["DecodingServices"] | Action["route"]["operation"]["rpc"]["errorSchema"]["DecodingServices"];
+type ActionArguments<Action extends AnyAuthAction> = undefined extends RouteInput<Action["route"]> ? readonly [input?: RouteInput<Action["route"]>] : readonly [input: RouteInput<Action["route"]>];
+interface AuthClientState {
+  readonly subject: string | null;
+  readonly generation: number;
+}
+type AuthClientEvent = {
+  readonly _tag: "Transition";
+  readonly state: AuthClientState;
+  readonly action?: string;
+  readonly origin?: object;
+} | {
+  readonly _tag: "Mutation";
+  readonly name: string;
+};
+/** Internal bridge shared with Atom. Subscriptions belong to their host Scope;
+ * transition listeners only dispose and publish state, never call the client. */
+interface AuthClientController<Actions extends AuthActions> {
+  readonly actions: Actions;
+  readonly transport: OperationFetchClient;
+  readonly state: Effect.Effect<AuthClientState>;
+  readonly subscribe: (listener: (event: AuthClientEvent) => Effect.Effect<void>) => Effect.Effect<void, never, Scope.Scope>;
+  readonly replaceSubject: (subject: string | null) => Effect.Effect<void>;
+  readonly completeAuthentication: OperationAuthenticationCompletion;
+  readonly call: <Name extends keyof Actions>(name: Name, input: RouteInput<Actions[Name]["route"]>, options?: {
+    readonly notifyMutation?: boolean;
+    readonly origin?: object;
+  }) => Effect.Effect<RouteSuccess<Actions[Name]["route"]>, RouteFailure<Actions[Name]["route"]> | OperationHttpError, ActionDecodeServices<Actions[Name]>>;
+}
+declare const AuthClientTypeId: unique symbol;
+/** Named calls return Effects; request credentials and private reveals remain
+ * in the configured transport capabilities, outside operation results. */
+type AuthClient<Actions extends AuthActions> = { readonly [Name in keyof Actions]: (...args: ActionArguments<Actions[Name]>) => Effect.Effect<RouteSuccess<Actions[Name]["route"]>, RouteFailure<Actions[Name]["route"]> | OperationHttpError, ActionDecodeServices<Actions[Name]>>; } & {
+  readonly [AuthClientTypeId]: AuthClientController<Actions>;
+};
+/** Identifier for a configured client service, separate from the server service. */
+interface ClientService<Id extends string, Actions extends AuthActions> {
+  readonly namespace: Id;
+  readonly actions: Actions;
+  readonly _client: unique symbol;
+}
+interface ClientDefinition<Id extends string, Actions extends AuthActions> extends Context.Service<ClientService<Id, Actions>, {
+  readonly auth: AuthClient<Actions>;
+}> {
+  readonly contract: {
+    readonly namespace: Id;
+    readonly actions: Actions;
+  };
+  readonly make: Effect.Effect<{
+    readonly auth: AuthClient<Actions>;
+  }, OperationHttpError, Scope.Scope>;
+  readonly layer: Layer.Layer<ClientService<Id, Actions>, OperationHttpError>;
+}
+/** Define a yieldable client without acquiring resources. Provide its layer once
+ * in the application Scope, or yield its make Effect for direct acquisition.
+ * Every instance owns its credential settlement and scoped Atom subscriptions. */
+declare const make: <const Id extends string, Actions extends AuthActions>(contract: {
+  readonly namespace: Id;
+  readonly actions: Actions;
+}, options: ClientOptions) => ClientDefinition<Id, Actions>;
+//#endregion
+export { ActionArguments, ActionDecodeServices, AuthClient, AuthClientController, AuthClientEvent, AuthClientState, AuthClientTypeId, ClientDefinition, ClientOptions, ClientService, make };
+//# sourceMappingURL=auth-client.d.mts.map