@yielded/auth 0.1.0-beta.1

package/dist/http-operation/models.d.mts

@@ -0,0 +1,32 @@
+import { CredentialSlot } from "../operations/credentials.mjs";
+import { OperationHttpError } from "./errors.mjs";
+import { Effect, Redacted } from "effect";
+//#region src/http-operation/models.d.ts
+type HttpCredentials = Readonly<Partial<Record<CredentialSlot, Redacted.Redacted<string>>>>;
+interface OperationCookie {
+  readonly name: string;
+  readonly path: string;
+  readonly secure: boolean;
+  readonly sameSite: "lax" | "strict" | "none";
+  readonly domain?: string;
+}
+interface OperationHttpConfiguration {
+  readonly cookies: Readonly<Record<CredentialSlot, OperationCookie>>;
+  readonly trustedOrigins: ReadonlyArray<string>;
+  readonly csrfHeader: string;
+  readonly csrfValue: string;
+  readonly maximumBodyBytes: number;
+  readonly maximumUrlBytes: number;
+  /** The host decides its public origin. Forwarded headers have no authority by default. */
+  readonly publicOrigin: string | ((request: Request) => Effect.Effect<string, OperationHttpError>);
+  readonly native?: {
+    readonly modeHeader: string;
+    readonly requestHeaders: Readonly<Record<CredentialSlot, string>>;
+    readonly responseHeaders: Readonly<Record<CredentialSlot, string>>;
+    /** Explicit host admission; absence of Origin alone is not native authorization. */
+    readonly authorize: (request: Request) => Effect.Effect<void, OperationHttpError>;
+  };
+}
+//#endregion
+export { HttpCredentials, OperationCookie, OperationHttpConfiguration };
+//# sourceMappingURL=models.d.mts.map

package/dist/http-operation/models.mjs

@@ -0,0 +1,14 @@
+//#region src/http-operation/models.ts
+const credentialSlots = [
+	"session",
+	"pending-proof",
+	"proof-continuation",
+	"registration",
+	"request-binding",
+	"session-step-up",
+	"password-intent"
+];
+//#endregion
+export { credentialSlots };
+
+//# sourceMappingURL=models.mjs.map

package/dist/http-operation/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/http-operation/models.ts"],"sourcesContent":["import type { Effect, Redacted } from \"effect\";\n\nimport type { CredentialSlot } from \"../operations/credentials\";\nimport type { OperationHttpError } from \"./errors\";\n\nexport const credentialSlots = [\n  \"session\",\n  \"pending-proof\",\n  \"proof-continuation\",\n  \"registration\",\n  \"request-binding\",\n  \"session-step-up\",\n  \"password-intent\",\n] as const;\n\nexport type HttpCredentials = Readonly<Partial<Record<CredentialSlot, Redacted.Redacted<string>>>>;\n\nexport interface OperationCookie {\n  readonly name: string;\n  readonly path: string;\n  readonly secure: boolean;\n  readonly sameSite: \"lax\" | \"strict\" | \"none\";\n  readonly domain?: string;\n}\n\nexport interface OperationHttpConfiguration {\n  readonly cookies: Readonly<Record<CredentialSlot, OperationCookie>>;\n  readonly trustedOrigins: ReadonlyArray<string>;\n  readonly csrfHeader: string;\n  readonly csrfValue: string;\n  readonly maximumBodyBytes: number;\n  readonly maximumUrlBytes: number;\n  /** The host decides its public origin. Forwarded headers have no authority by default. */\n  readonly publicOrigin: string | ((request: Request) => Effect.Effect<string, OperationHttpError>);\n  readonly native?: {\n    readonly modeHeader: string;\n    readonly requestHeaders: Readonly<Record<CredentialSlot, string>>;\n    readonly responseHeaders: Readonly<Record<CredentialSlot, string>>;\n    /** Explicit host admission; absence of Origin alone is not native authorization. */\n    readonly authorize: (request: Request) => Effect.Effect<void, OperationHttpError>;\n  };\n}\n"],"mappings":";AAKA,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/http-operation/private.mjs

@@ -0,0 +1,35 @@
+import { AuthRevealCommand } from "../operations/reveals.mjs";
+import { credentialSlots } from "./models.mjs";
+import { Redacted, Schema } from "effect";
+//#region src/http-operation/private.ts
+const CredentialWire = Schema.Union([Schema.TaggedStruct("Clear", {}), Schema.TaggedStruct("Issue", {
+	credential: Schema.NonEmptyString.check(Schema.isMaxLength(16384)),
+	expiresAtMillis: Schema.Int
+})]);
+const RevealWire = Schema.Struct({
+	kind: Schema.Literals(["totp-enrollment", "recovery-codes"]),
+	revealId: Schema.NonEmptyString,
+	expiresAtMillis: Schema.Int,
+	payload: Schema.Json
+});
+const credentialWire = (command) => command._tag === "Clear" ? { _tag: "Clear" } : {
+	_tag: "Issue",
+	credential: Redacted.value(command.credential),
+	expiresAtMillis: command.expiresAtMillis
+};
+const revealWire = (command) => ({
+	kind: command.kind,
+	revealId: command.revealId,
+	expiresAtMillis: command.expiresAtMillis,
+	payload: command.kind === "totp-enrollment" ? { ...Redacted.value(command.payload) } : [...Redacted.value(command.payload)]
+});
+const decodeRevealWire = (value) => {
+	return Schema.decodeUnknownSync(AuthRevealCommand)({
+		...value,
+		payload: Redacted.make(value.payload)
+	});
+};
+//#endregion
+export { CredentialWire, RevealWire, credentialSlots, credentialWire, decodeRevealWire, revealWire };
+
+//# sourceMappingURL=private.mjs.map

package/dist/http-operation/private.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"private.mjs","names":[],"sources":["../../src/http-operation/private.ts"],"sourcesContent":["import { Redacted, Schema } from \"effect\";\n\nimport type { AuthCredentialCommand } from \"../operations/credentials\";\nimport { AuthRevealCommand, type AuthRevealKind } from \"../operations/reveals\";\nimport { credentialSlots } from \"./models\";\n\nexport const CredentialWire = Schema.Union([\n  Schema.TaggedStruct(\"Clear\", {}),\n  Schema.TaggedStruct(\"Issue\", {\n    credential: Schema.NonEmptyString.check(Schema.isMaxLength(16384)),\n    expiresAtMillis: Schema.Int,\n  }),\n]);\n\nexport const RevealWire = Schema.Struct({\n  kind: Schema.Literals([\"totp-enrollment\", \"recovery-codes\"]),\n  revealId: Schema.NonEmptyString,\n  expiresAtMillis: Schema.Int,\n  payload: Schema.Json,\n});\n\nexport const credentialWire = (command: AuthCredentialCommand) =>\n  command._tag === \"Clear\"\n    ? { _tag: \"Clear\" as const }\n    : {\n        _tag: \"Issue\" as const,\n        credential: Redacted.value(command.credential),\n        expiresAtMillis: command.expiresAtMillis,\n      };\n\nexport const revealWire = (command: AuthRevealCommand): typeof RevealWire.Type => ({\n  kind: command.kind,\n  revealId: command.revealId,\n  expiresAtMillis: command.expiresAtMillis,\n  payload:\n    command.kind === \"totp-enrollment\"\n      ? { ...Redacted.value(command.payload) }\n      : [...Redacted.value(command.payload)],\n});\n\nexport const decodeRevealWire = (value: typeof RevealWire.Type): AuthRevealCommand => {\n  // oxlint-disable-next-line no-restricted-properties -- raw private transport payload is validated before constructing the redacted boundary.\n  return Schema.decodeUnknownSync(AuthRevealCommand)({\n    ...value,\n    payload: Redacted.make(value.payload),\n  });\n};\n\nexport type PrivateKinds = ReadonlyArray<AuthRevealKind>;\nexport { credentialSlots };\n"],"mappings":";;;;AAMA,MAAa,iBAAiB,OAAO,MAAM,CACzC,OAAO,aAAa,SAAS,CAAC,CAAC,GAC/B,OAAO,aAAa,SAAS;CAC3B,YAAY,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;CACjE,iBAAiB,OAAO;AAC1B,CAAC,CACH,CAAC;AAED,MAAa,aAAa,OAAO,OAAO;CACtC,MAAM,OAAO,SAAS,CAAC,mBAAmB,gBAAgB,CAAC;CAC3D,UAAU,OAAO;CACjB,iBAAiB,OAAO;CACxB,SAAS,OAAO;AAClB,CAAC;AAED,MAAa,kBAAkB,YAC7B,QAAQ,SAAS,UACb,EAAE,MAAM,QAAiB,IACzB;CACE,MAAM;CACN,YAAY,SAAS,MAAM,QAAQ,UAAU;CAC7C,iBAAiB,QAAQ;AAC3B;AAEN,MAAa,cAAc,aAAwD;CACjF,MAAM,QAAQ;CACd,UAAU,QAAQ;CAClB,iBAAiB,QAAQ;CACzB,SACE,QAAQ,SAAS,oBACb,EAAE,GAAG,SAAS,MAAM,QAAQ,OAAO,EAAE,IACrC,CAAC,GAAG,SAAS,MAAM,QAAQ,OAAO,CAAC;AAC3C;AAEA,MAAa,oBAAoB,UAAqD;CAEpF,OAAO,OAAO,kBAAkB,iBAAiB,CAAC,CAAC;EACjD,GAAG;EACH,SAAS,SAAS,KAAK,MAAM,OAAO;CACtC,CAAC;AACH"}

package/dist/http-operation/security.mjs

@@ -0,0 +1,58 @@
+import { OperationHttpError } from "./errors.mjs";
+import { credentialSlots } from "./models.mjs";
+import { origin } from "./configuration-schema.mjs";
+import { OperationHttpServerConfig } from "./OperationHttpServerConfig.mjs";
+import { Effect, Redacted, Schema } from "effect";
+import { Cookies } from "effect/unstable/http";
+//#region src/http-operation/security.ts
+/** Browser mutation admission is independent of body encoding. */
+const mutationSecurity = Effect.fn("OperationHttp.mutationSecurity")(function* (request) {
+	const config = yield* OperationHttpServerConfig;
+	const requestOrigin = request.headers.get("origin");
+	if ([
+		"GET",
+		"HEAD",
+		"OPTIONS"
+	].includes(request.method) || requestOrigin === null || !config.trustedOrigins.includes(requestOrigin)) return yield* OperationHttpError.make({ reason: "origin" });
+	if (request.headers.get(config.csrfHeader) !== config.csrfValue) return yield* OperationHttpError.make({ reason: "csrf" });
+});
+const requestSecurity = Effect.fn("OperationHttp.requestSecurity")(function* (request, kind) {
+	const config = yield* OperationHttpServerConfig;
+	const publicOrigin = typeof config.publicOrigin === "string" ? config.publicOrigin : yield* config.publicOrigin(request);
+	if (!Schema.is(origin)(publicOrigin)) return yield* OperationHttpError.make({ reason: "origin" });
+	const requestOrigin = request.headers.get("origin");
+	const native = config.native !== void 0 && request.headers.get(config.native.modeHeader) === "native";
+	if (native) {
+		if (kind === "callback" || requestOrigin !== null || request.headers.has("sec-fetch-mode") || request.headers.has("cookie")) return yield* OperationHttpError.make({ reason: "origin" });
+		yield* config.native.authorize(request);
+	} else if (kind === "operation") {
+		yield* mutationSecurity(request);
+		if (request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") return yield* OperationHttpError.make({ reason: "csrf" });
+	}
+	if (kind === "read" && requestOrigin !== null && !config.trustedOrigins.includes(requestOrigin)) return yield* OperationHttpError.make({ reason: "origin" });
+	const rawCookie = request.headers.get("cookie") ?? "";
+	if (rawCookie.length > 65536) return yield* OperationHttpError.make({ reason: "too-large" });
+	const parsed = Cookies.parseHeader(rawCookie);
+	const credentials = {};
+	for (const slot of credentialSlots) {
+		const configured = config.cookies[slot];
+		if (rawCookie.split(";").filter((part) => part.trim().split("=", 1)[0] === configured.name).length > 1) return yield* OperationHttpError.make({ reason: "credentials" });
+		const header = config.native === void 0 ? null : request.headers.get(config.native.requestHeaders[slot]);
+		if (!native && header !== null) return yield* OperationHttpError.make({ reason: "credentials" });
+		const value = native ? header : parsed[configured.name];
+		if (value !== null && value !== void 0) {
+			if (value.length === 0 || value.length > 16384 || /[\r\n]/.test(value)) return yield* OperationHttpError.make({ reason: "credentials" });
+			credentials[slot] = Redacted.make(value);
+		}
+	}
+	return {
+		native,
+		credentials: Object.freeze(credentials),
+		publicOrigin,
+		requestOrigin
+	};
+});
+//#endregion
+export { mutationSecurity, requestSecurity };
+
+//# sourceMappingURL=security.mjs.map

package/dist/http-operation/security.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.mjs","names":[],"sources":["../../src/http-operation/security.ts"],"sourcesContent":["import { Effect, Redacted, Schema } from \"effect\";\nimport { Cookies } from \"effect/unstable/http\";\n\nimport type { CredentialSlot } from \"../operations/credentials\";\nimport { origin } from \"./configuration-schema\";\nimport { OperationHttpError } from \"./errors\";\nimport { credentialSlots } from \"./models\";\nimport { OperationHttpServerConfig } from \"./OperationHttpServerConfig\";\n\n/** Browser mutation admission is independent of body encoding. */\nexport const mutationSecurity = Effect.fn(\"OperationHttp.mutationSecurity\")(function* (\n  request: Request,\n) {\n  const config = yield* OperationHttpServerConfig;\n  const requestOrigin = request.headers.get(\"origin\");\n\n  if (\n    [\"GET\", \"HEAD\", \"OPTIONS\"].includes(request.method) ||\n    requestOrigin === null ||\n    !config.trustedOrigins.includes(requestOrigin)\n  )\n    return yield* OperationHttpError.make({ reason: \"origin\" });\n  if (request.headers.get(config.csrfHeader) !== config.csrfValue)\n    return yield* OperationHttpError.make({ reason: \"csrf\" });\n});\n\nexport const requestSecurity = Effect.fn(\"OperationHttp.requestSecurity\")(function* (\n  request: Request,\n  kind: \"operation\" | \"callback\" | \"read\" | \"request\",\n) {\n  const config = yield* OperationHttpServerConfig;\n\n  const publicOrigin =\n    typeof config.publicOrigin === \"string\"\n      ? config.publicOrigin\n      : yield* config.publicOrigin(request);\n\n  if (!Schema.is(origin)(publicOrigin)) return yield* OperationHttpError.make({ reason: \"origin\" });\n  const requestOrigin = request.headers.get(\"origin\");\n\n  const native =\n    config.native !== undefined && request.headers.get(config.native.modeHeader) === \"native\";\n\n  if (native) {\n    if (\n      kind === \"callback\" ||\n      requestOrigin !== null ||\n      request.headers.has(\"sec-fetch-mode\") ||\n      request.headers.has(\"cookie\")\n    )\n      return yield* OperationHttpError.make({ reason: \"origin\" });\n    yield* config.native!.authorize(request);\n  } else if (kind === \"operation\") {\n    yield* mutationSecurity(request);\n    if (\n      request.headers.get(\"content-type\")?.split(\";\")[0]?.trim().toLowerCase() !==\n      \"application/json\"\n    )\n      return yield* OperationHttpError.make({ reason: \"csrf\" });\n  }\n  if (kind === \"read\" && requestOrigin !== null && !config.trustedOrigins.includes(requestOrigin))\n    return yield* OperationHttpError.make({ reason: \"origin\" });\n  const rawCookie = request.headers.get(\"cookie\") ?? \"\";\n\n  if (rawCookie.length > 65536) return yield* OperationHttpError.make({ reason: \"too-large\" });\n  const parsed = Cookies.parseHeader(rawCookie);\n  const credentials: Partial<Record<CredentialSlot, Redacted.Redacted<string>>> = {};\n\n  for (const slot of credentialSlots) {\n    const configured = config.cookies[slot];\n\n    const cookies = rawCookie\n      .split(\";\")\n      .filter((part) => part.trim().split(\"=\", 1)[0] === configured.name);\n\n    if (cookies.length > 1) return yield* OperationHttpError.make({ reason: \"credentials\" });\n\n    const header =\n      config.native === undefined ? null : request.headers.get(config.native.requestHeaders[slot]);\n\n    if (!native && header !== null)\n      return yield* OperationHttpError.make({ reason: \"credentials\" });\n    const value = native ? header : parsed[configured.name];\n\n    if (value !== null && value !== undefined) {\n      if (value.length === 0 || value.length > 16384 || /[\\r\\n]/.test(value))\n        return yield* OperationHttpError.make({ reason: \"credentials\" });\n      credentials[slot] = Redacted.make(value);\n    }\n  }\n\n  return { native, credentials: Object.freeze(credentials), publicOrigin, requestOrigin };\n});\n"],"mappings":";;;;;;;;AAUA,MAAa,mBAAmB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAC1E,SACA;CACA,MAAM,SAAS,OAAO;CACtB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;CAElD,IACE;EAAC;EAAO;EAAQ;CAAS,CAAC,CAAC,SAAS,QAAQ,MAAM,KAClD,kBAAkB,QAClB,CAAC,OAAO,eAAe,SAAS,aAAa,GAE7C,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;CAC5D,IAAI,QAAQ,QAAQ,IAAI,OAAO,UAAU,MAAM,OAAO,WACpD,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,OAAO,CAAC;AAC5D,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACxE,SACA,MACA;CACA,MAAM,SAAS,OAAO;CAEtB,MAAM,eACJ,OAAO,OAAO,iBAAiB,WAC3B,OAAO,eACP,OAAO,OAAO,aAAa,OAAO;CAExC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,YAAY,GAAG,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;CAChG,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;CAElD,MAAM,SACJ,OAAO,WAAW,KAAA,KAAa,QAAQ,QAAQ,IAAI,OAAO,OAAO,UAAU,MAAM;CAEnF,IAAI,QAAQ;EACV,IACE,SAAS,cACT,kBAAkB,QAClB,QAAQ,QAAQ,IAAI,gBAAgB,KACpC,QAAQ,QAAQ,IAAI,QAAQ,GAE5B,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;EAC5D,OAAO,OAAO,OAAQ,UAAU,OAAO;CACzC,OAAO,IAAI,SAAS,aAAa;EAC/B,OAAO,iBAAiB,OAAO;EAC/B,IACE,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACvE,oBAEA,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,OAAO,CAAC;CAC5D;CACA,IAAI,SAAS,UAAU,kBAAkB,QAAQ,CAAC,OAAO,eAAe,SAAS,aAAa,GAC5F,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;CAC5D,MAAM,YAAY,QAAQ,QAAQ,IAAI,QAAQ,KAAK;CAEnD,IAAI,UAAU,SAAS,OAAO,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,YAAY,CAAC;CAC3F,MAAM,SAAS,QAAQ,YAAY,SAAS;CAC5C,MAAM,cAA0E,CAAC;CAEjF,KAAK,MAAM,QAAQ,iBAAiB;EAClC,MAAM,aAAa,OAAO,QAAQ;EAMlC,IAJgB,UACb,MAAM,GAAG,CAAC,CACV,QAAQ,SAAS,KAAK,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,WAAW,IAEtD,CAAC,CAAC,SAAS,GAAG,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC;EAEvF,MAAM,SACJ,OAAO,WAAW,KAAA,IAAY,OAAO,QAAQ,QAAQ,IAAI,OAAO,OAAO,eAAe,KAAK;EAE7F,IAAI,CAAC,UAAU,WAAW,MACxB,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC;EACjE,MAAM,QAAQ,SAAS,SAAS,OAAO,WAAW;EAElD,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW;GACzC,IAAI,MAAM,WAAW,KAAK,MAAM,SAAS,SAAS,SAAS,KAAK,KAAK,GACnE,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC;GACjE,YAAY,QAAQ,SAAS,KAAK,KAAK;EACzC;CACF;CAEA,OAAO;EAAE;EAAQ,aAAa,OAAO,OAAO,WAAW;EAAG;EAAc;CAAc;AACxF,CAAC"}

package/dist/http-operation/server.d.mts

@@ -0,0 +1,33 @@
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { AnyRoute } from "./contract.mjs";
+import { OperationHttpConfigurationError, OperationHttpError } from "./errors.mjs";
+import { HttpCredentials } from "./models.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import { OperationHttpInvocation } from "./OperationHttpInvocation.mjs";
+import { OperationHttpServerConfig } from "./OperationHttpServerConfig.mjs";
+import { Effect, Scope } from "effect";
+//#region src/http-operation/server.d.ts
+interface OAuthHttpCallback {
+  readonly route: AnyRoute;
+  readonly path: string;
+  readonly provider: string;
+  readonly callbackId: string;
+  /** Resolve the original public flow ID from application-owned callback custody.
+   * The operation independently authenticates its state and private request binder. */
+  readonly flowId: (request: Request, credentials: HttpCredentials) => Effect.Effect<string, OperationHttpError>;
+  readonly allowedRedirectOrigins: ReadonlyArray<string>;
+  readonly allowedQueryParameters?: ReadonlyArray<string>;
+}
+declare const oauthCallback: <R extends AnyRoute>(route: R, options: Omit<OAuthHttpCallback, "route">) => OAuthHttpCallback & {
+  readonly route: R;
+};
+declare const make: <const Routes extends Readonly<Record<string, AnyRoute>>, const Callbacks extends ReadonlyArray<OAuthHttpCallback> = readonly []>(contract: {
+  readonly routes: Routes;
+}, options?: {
+  readonly callbacks?: Callbacks;
+}) => Effect.Effect<{
+  handle: (request: Request) => Effect.Effect<Response, never, never>;
+}, OperationHttpConfigurationError, OperationHttpInvocation | OperationHttpServerConfig | Exclude<(Routes[keyof Routes] | Callbacks[number]["route"])["operation"]["rpc"]["errorSchema"]["EncodingServices"], AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope> | Exclude<(Routes[keyof Routes] | Callbacks[number]["route"])["operation"]["rpc"]["successSchema"]["EncodingServices"], AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope> | Exclude<Effect.Services<ReturnType<(Routes[keyof Routes] | Callbacks[number]["route"])["operation"]["invokeUnknown"]>>, AuthCredentialCommandCollector | AuthRequest | AuthRevealCommandCollectorService | Scope.Scope>>;
+//#endregion
+export { OAuthHttpCallback, make, oauthCallback };
+//# sourceMappingURL=server.d.mts.map

package/dist/http-operation/server.mjs

@@ -0,0 +1,268 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { AuthRequest } from "../auth/AuthRequest.mjs";
+import { OperationHttpConfigurationError, OperationHttpError } from "./errors.mjs";
+import { CredentialWire, RevealWire, credentialWire, revealWire } from "./private.mjs";
+import { HttpRequestBody } from "./contract.mjs";
+import { OperationHttpInvocation } from "./OperationHttpInvocation.mjs";
+import { OperationHttpServerConfig } from "./OperationHttpServerConfig.mjs";
+import { requestSecurity } from "./security.mjs";
+import { Cause, Context, DateTime, Duration, Effect, Redacted, Schema, SchemaAST, Scope } from "effect";
+import { Cookies } from "effect/unstable/http";
+//#region src/http-operation/server.ts
+const responseSchema = Schema.Union([
+	Schema.TaggedStruct("Success", {
+		value: Schema.optionalKey(Schema.Json),
+		private: Schema.optionalKey(Schema.Array(RevealWire))
+	}),
+	Schema.TaggedStruct("Failure", { error: Schema.Json }),
+	Schema.TaggedStruct("TransportFailure", { reason: Schema.String })
+]);
+const encodeResponse = Schema.encodeEffect(Schema.fromJsonString(responseSchema));
+const encodeCredential = Schema.encodeSync(Schema.fromJsonString(CredentialWire));
+const oauthCallback = (route, options) => {
+	if (!options.path.startsWith("/") || options.path.includes("?") || !Object.values(route.credentials).includes("request-binding") || route.operation.replay !== "single-use") throw OperationHttpConfigurationError.make({ reason: "callback" });
+	return Object.freeze({
+		...options,
+		route,
+		allowedRedirectOrigins: Object.freeze([...options.allowedRedirectOrigins]),
+		...options.allowedQueryParameters === void 0 ? {} : { allowedQueryParameters: Object.freeze([...options.allowedQueryParameters]) }
+	});
+};
+const boundedText = Effect.fn("OperationHttp.boundedText")(function* (request, maximum) {
+	return yield* Effect.tryPromise({
+		try: async (signal) => {
+			if (request.body === null) return "";
+			const reader = request.body.getReader();
+			const chunks = [];
+			let bytes = 0;
+			const abort = () => {
+				reader.cancel();
+			};
+			signal.addEventListener("abort", abort, { once: true });
+			try {
+				while (true) {
+					const next = await reader.read();
+					if (next.done) break;
+					bytes += next.value.byteLength;
+					if (bytes > maximum) {
+						await reader.cancel();
+						throw OperationHttpError.make({ reason: "too-large" });
+					}
+					chunks.push(next.value);
+				}
+				const output = new Uint8Array(bytes);
+				let offset = 0;
+				for (const chunk of chunks) {
+					output.set(chunk, offset);
+					offset += chunk.byteLength;
+				}
+				return new TextDecoder("utf-8", { fatal: true }).decode(output);
+			} finally {
+				signal.removeEventListener("abort", abort);
+				reader.releaseLock();
+			}
+		},
+		catch: (error) => Schema.is(OperationHttpError)(error) ? error : OperationHttpError.make({ reason: "request" })
+	});
+});
+const baseHeaders = () => new Headers({
+	"content-type": "application/json; charset=utf-8",
+	"cache-control": "no-store",
+	pragma: "no-cache",
+	"referrer-policy": "no-referrer",
+	"x-content-type-options": "nosniff",
+	"content-security-policy": "default-src 'none'; frame-ancestors 'none'",
+	vary: "Origin"
+});
+const failResponse = (error) => Effect.map(encodeResponse({
+	_tag: "TransportFailure",
+	reason: error.reason
+}), (body) => new Response(body, {
+	status: error.reason === "not-found" ? 404 : error.reason === "method" ? 405 : error.reason === "too-large" ? 413 : error.reason === "unavailable" ? 503 : error.reason === "origin" || error.reason === "csrf" ? 403 : 400,
+	headers: baseHeaders()
+})).pipe(Effect.orDie);
+const callbackPayload = Effect.fn("OperationHttp.callbackPayload")(function* (callback, request, credentials, url) {
+	const allowed = /* @__PURE__ */ new Set([
+		"state",
+		"code",
+		"error",
+		"error_description",
+		"error_uri",
+		"iss",
+		...callback.allowedQueryParameters ?? []
+	]);
+	const seen = /* @__PURE__ */ new Set();
+	for (const [name, value] of url.searchParams) {
+		if (!allowed.has(name) || seen.has(name) || value.length > 4096) return yield* OperationHttpError.make({ reason: "request" });
+		seen.add(name);
+	}
+	const state = url.searchParams.get("state");
+	const code = url.searchParams.get("code");
+	const error = url.searchParams.get("error");
+	if (state === null || state.length === 0 || state.length > 2048 || code === null === (error === null)) return yield* OperationHttpError.make({ reason: "request" });
+	const issuer = url.searchParams.get("iss");
+	const response = code === null ? {
+		_tag: "Error",
+		state,
+		error: error === "access_denied" ? "access-denied" : "rejected",
+		...issuer === null ? {} : { issuer }
+	} : {
+		_tag: "Code",
+		state,
+		code,
+		...issuer === null ? {} : { issuer }
+	};
+	return {
+		flowId: yield* callback.flowId(request, credentials),
+		provider: callback.provider,
+		callbackId: callback.callbackId,
+		response
+	};
+});
+const inject = (route, input, credentials) => Effect.try({
+	try: () => {
+		const fields = Object.entries(route.credentials);
+		if (fields.length === 0) return input;
+		const output = { ...Schema.decodeUnknownSync(Schema.Record(Schema.String, Schema.Unknown))(input) };
+		for (const [field, slot] of fields) {
+			if (Object.hasOwn(output, field)) throw new Error();
+			const credential = credentials[slot];
+			if (credential === void 0) throw new Error();
+			output[field] = Redacted.value(credential);
+		}
+		return output;
+	},
+	catch: () => OperationHttpError.make({ reason: "credentials" })
+});
+const applyCommands = Effect.fn("OperationHttp.applyCommands")(function* (headers, commands, config, native) {
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	for (const command of commands) if (native) headers.set(config.native.responseHeaders[command.slot], encodeCredential(credentialWire(command)));
+	else {
+		const cookie = config.cookies[command.slot];
+		const value = command._tag === "Issue" ? Redacted.value(command.credential) : "";
+		const maxAge = command._tag === "Issue" ? Math.max(0, command.expiresAtMillis - now) : 0;
+		headers.append("set-cookie", Cookies.serializeCookie(Cookies.makeCookieUnsafe(cookie.name, value, {
+			path: cookie.path,
+			secure: cookie.secure,
+			sameSite: cookie.sameSite,
+			httpOnly: true,
+			...cookie.domain === void 0 ? {} : { domain: cookie.domain },
+			maxAge: Duration.millis(maxAge)
+		})));
+	}
+});
+const make = (contract, options) => Effect.gen(function* () {
+	const services = yield* Effect.context();
+	const config = yield* OperationHttpServerConfig;
+	const invocation = yield* OperationHttpInvocation;
+	for (const route of Object.values(contract.routes)) if (route.method === "GET" && (route.operation.replay !== "read-only" || route.operation.credentials || route.reveals.length > 0 || route.operation.reveals.length > 0 || Object.keys(route.credentials).length > 0 || !(SchemaAST.isVoid(Schema.toEncoded(route.operation.rpc.payloadSchema).ast) || SchemaAST.isUndefined(Schema.toEncoded(route.operation.rpc.payloadSchema).ast)))) return yield* OperationHttpConfigurationError.make({ reason: "route" });
+	const routes = new Map(Object.values(contract.routes).map((route) => [route.path, route]));
+	const callbacks = /* @__PURE__ */ new Map();
+	for (const callback of options?.callbacks ?? []) {
+		if (callbacks.has(callback.path) || routes.has(callback.path)) return yield* OperationHttpConfigurationError.make({ reason: "duplicate-route" });
+		callbacks.set(callback.path, callback);
+	}
+	return { handle: Effect.fn("OperationHttp.handle")(function* (request) {
+		if (new TextEncoder().encode(request.url).byteLength > config.maximumUrlBytes) return yield* OperationHttpError.make({ reason: "too-large" });
+		const url = yield* Effect.try({
+			try: () => new URL(request.url),
+			catch: () => OperationHttpError.make({ reason: "request" })
+		});
+		const callback = callbacks.get(url.pathname);
+		const route = callback?.route ?? routes.get(url.pathname);
+		if (route === void 0) return yield* OperationHttpError.make({ reason: "not-found" });
+		if (request.method === "OPTIONS" && callback === void 0) {
+			const origin = request.headers.get("origin");
+			const requestedHeaders = (request.headers.get("access-control-request-headers") ?? "").toLowerCase().split(",").map((header) => header.trim()).filter(Boolean);
+			if (origin === null || !config.trustedOrigins.includes(origin)) return yield* OperationHttpError.make({ reason: "origin" });
+			if (url.search !== "" || request.headers.get("access-control-request-method") !== route.method || requestedHeaders.some((header) => header !== "content-type" && header !== config.csrfHeader)) return yield* OperationHttpError.make({ reason: "csrf" });
+			const headers = baseHeaders();
+			headers.set("access-control-allow-origin", origin);
+			headers.set("access-control-allow-credentials", "true");
+			headers.set("access-control-allow-methods", route.method);
+			headers.set("access-control-allow-headers", `content-type, ${config.csrfHeader}`);
+			headers.set("vary", "Origin, Access-Control-Request-Method, Access-Control-Request-Headers");
+			return new Response(null, {
+				status: 204,
+				headers
+			});
+		}
+		if (request.method !== (callback === void 0 ? route.method : "GET")) return yield* OperationHttpError.make({ reason: "method" });
+		if (callback === void 0 && url.search !== "") return yield* OperationHttpError.make({ reason: "request" });
+		const security = yield* requestSecurity(request, callback === void 0 ? route.method === "GET" ? "read" : "operation" : "callback");
+		const raw = callback === void 0 && route.method === "GET" ? void 0 : callback === void 0 ? (yield* Schema.decodeEffect(Schema.fromJsonString(HttpRequestBody))(yield* boundedText(request, config.maximumBodyBytes)).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "request" })))).payload : yield* callbackPayload(callback, request, security.credentials, url);
+		const payload = yield* inject(route, raw, security.credentials);
+		const trusted = yield* invocation.resolve(request, security.credentials);
+		const commands = [];
+		const reveals = [];
+		const sink = (values) => Effect.sync(() => {
+			commands.push(...values);
+		});
+		const collector = {
+			supportedKinds: route.reveals,
+			accept: (values) => Effect.sync(() => {
+				reveals.push(...values);
+			})
+		};
+		const invoke = route.operation.invokeUnknown;
+		const call = invoke(trusted, payload);
+		const successSchema = route.operation.rpc.successSchema;
+		const errorSchema = route.operation.rpc.errorSchema;
+		const requestScope = yield* Effect.scope;
+		const requestServices = services.pipe(Context.add(Scope.Scope, requestScope), Context.add(AuthRequest, {
+			invocation: trusted,
+			...invocation.request === void 0 ? {} : { resolveInvocation: invocation.request(request, security.credentials) },
+			credentials: security.credentials,
+			beforeMutation: route.method === "GET" ? HookDenied.make({ reason: "policy" }) : Effect.void,
+			credentialCommandSink: sink,
+			revealCommandCollector: collector
+		}), Context.add(AuthCredentialCommandCollector, sink), Context.add(AuthRevealCommandCollectorService, collector));
+		const resolved = yield* Effect.result(call.pipe(Effect.provide(requestServices)));
+		const headers = baseHeaders();
+		if (security.requestOrigin !== null && config.trustedOrigins.includes(security.requestOrigin)) {
+			headers.set("access-control-allow-origin", security.requestOrigin);
+			headers.set("access-control-allow-credentials", "true");
+		}
+		if (resolved._tag === "Failure") {
+			const encoded = yield* Schema.encodeEffect(errorSchema)(resolved.failure).pipe(Effect.provide(requestServices), Effect.mapError(() => OperationHttpError.make({ reason: "response" })));
+			const error = yield* Schema.decodeUnknownEffect(Schema.Json)(encoded).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "response" })));
+			return new Response(yield* encodeResponse({
+				_tag: "Failure",
+				error
+			}).pipe(Effect.orDie), {
+				status: 400,
+				headers
+			});
+		}
+		const encoded = yield* Schema.encodeEffect(successSchema)(resolved.success).pipe(Effect.provide(requestServices), Effect.mapError(() => OperationHttpError.make({ reason: "response" })));
+		const value = encoded === void 0 ? void 0 : yield* Schema.decodeUnknownEffect(Schema.Json)(encoded).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "response" })));
+		yield* applyCommands(headers, commands, config, security.native);
+		if (callback !== void 0) {
+			const target = yield* Schema.decodeUnknownEffect(Schema.Struct({ returnTarget: Schema.String.check(Schema.isMaxLength(2048)) }))(encoded).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "response" })));
+			const destination = yield* Effect.try({
+				try: () => new URL(target.returnTarget, security.publicOrigin),
+				catch: () => OperationHttpError.make({ reason: "response" })
+			});
+			if (destination.origin !== security.publicOrigin && !callback.allowedRedirectOrigins.includes(destination.origin) || !["https:", "http:"].includes(destination.protocol) || destination.username !== "" || destination.password !== "") return yield* OperationHttpError.make({ reason: "response" });
+			headers.set("location", destination.href);
+			return new Response(null, {
+				status: 303,
+				headers
+			});
+		}
+		return new Response(yield* encodeResponse({
+			_tag: "Success",
+			...value === void 0 ? {} : { value },
+			...reveals.length === 0 ? {} : { private: reveals.map(revealWire) }
+		}).pipe(Effect.orDie), {
+			status: 200,
+			headers
+		});
+	}, Effect.scoped, Effect.catch((error) => failResponse(Schema.is(OperationHttpError)(error) ? error : OperationHttpError.make({ reason: "unavailable" }))), Effect.catchCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("http", cause).pipe(Effect.andThen(failResponse(OperationHttpError.make({ reason: "unavailable" })))) : Effect.failCause(cause)), Effect.provideService(OperationHttpServerConfig, config)) };
+});
+//#endregion
+export { make, oauthCallback };
+
+//# sourceMappingURL=server.mjs.map

package/dist/http-operation/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.mjs","names":[],"sources":["../../src/http-operation/server.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  DateTime,\n  Duration,\n  Effect,\n  Redacted,\n  Schema,\n  SchemaAST,\n  Scope,\n} from \"effect\";\nimport { Cookies } from \"effect/unstable/http\";\n\nimport { AuthRequest } from \"../auth/AuthRequest\";\nimport { HookDenied } from \"../hooks/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport {\n  AuthCredentialCommandCollector,\n  AuthRevealCommandCollectorService,\n  type AuthCredentialCommand,\n} from \"../operations/credentials\";\nimport type { AuthRevealCommand } from \"../operations/reveals\";\nimport {\n  type AnyRoute,\n  HttpRequestBody,\n  type RouteRequirements,\n  type RouteSuccess,\n  type RouteFailure,\n} from \"./contract\";\nimport { OperationHttpConfigurationError, OperationHttpError } from \"./errors\";\nimport type { HttpCredentials, OperationHttpConfiguration } from \"./models\";\nimport { OperationHttpInvocation } from \"./OperationHttpInvocation\";\nimport { OperationHttpServerConfig } from \"./OperationHttpServerConfig\";\nimport { CredentialWire, RevealWire, credentialWire, revealWire } from \"./private\";\nimport { requestSecurity } from \"./security\";\n\nconst responseSchema = Schema.Union([\n  Schema.TaggedStruct(\"Success\", {\n    value: Schema.optionalKey(Schema.Json),\n    private: Schema.optionalKey(Schema.Array(RevealWire)),\n  }),\n  Schema.TaggedStruct(\"Failure\", { error: Schema.Json }),\n  Schema.TaggedStruct(\"TransportFailure\", { reason: Schema.String }),\n]);\n\nconst encodeResponse = Schema.encodeEffect(Schema.fromJsonString(responseSchema));\nconst encodeCredential = Schema.encodeSync(Schema.fromJsonString(CredentialWire));\n\nexport interface OAuthHttpCallback {\n  readonly route: AnyRoute;\n  readonly path: string;\n  readonly provider: string;\n  readonly callbackId: string;\n  /** Resolve the original public flow ID from application-owned callback custody.\n   * The operation independently authenticates its state and private request binder. */\n  readonly flowId: (\n    request: Request,\n    credentials: HttpCredentials,\n  ) => Effect.Effect<string, OperationHttpError>;\n  readonly allowedRedirectOrigins: ReadonlyArray<string>;\n  readonly allowedQueryParameters?: ReadonlyArray<string>;\n}\n\nexport const oauthCallback = <R extends AnyRoute>(\n  route: R,\n  options: Omit<OAuthHttpCallback, \"route\">,\n): OAuthHttpCallback & { readonly route: R } => {\n  if (\n    !options.path.startsWith(\"/\") ||\n    options.path.includes(\"?\") ||\n    !Object.values(route.credentials).includes(\"request-binding\") ||\n    route.operation.replay !== \"single-use\"\n  )\n    throw OperationHttpConfigurationError.make({ reason: \"callback\" });\n\n  return Object.freeze({\n    ...options,\n    route,\n    allowedRedirectOrigins: Object.freeze([...options.allowedRedirectOrigins]),\n    ...(options.allowedQueryParameters === undefined\n      ? {}\n      : { allowedQueryParameters: Object.freeze([...options.allowedQueryParameters]) }),\n  });\n};\n\nconst boundedText = Effect.fn(\"OperationHttp.boundedText\")(function* (\n  request: Request,\n  maximum: number,\n) {\n  return yield* Effect.tryPromise({\n    try: async (signal) => {\n      if (request.body === null) return \"\";\n      const reader = request.body.getReader();\n      const chunks: Uint8Array[] = [];\n      let bytes = 0;\n\n      const abort = () => {\n        void reader.cancel();\n      };\n\n      signal.addEventListener(\"abort\", abort, { once: true });\n      try {\n        while (true) {\n          const next = await reader.read();\n\n          if (next.done) break;\n          bytes += next.value.byteLength;\n          if (bytes > maximum) {\n            await reader.cancel();\n            throw OperationHttpError.make({ reason: \"too-large\" });\n          }\n          chunks.push(next.value);\n        }\n        const output = new Uint8Array(bytes);\n        let offset = 0;\n\n        for (const chunk of chunks) {\n          output.set(chunk, offset);\n          offset += chunk.byteLength;\n        }\n\n        return new TextDecoder(\"utf-8\", { fatal: true }).decode(output);\n      } finally {\n        signal.removeEventListener(\"abort\", abort);\n        reader.releaseLock();\n      }\n    },\n    catch: (error) =>\n      Schema.is(OperationHttpError)(error) ? error : OperationHttpError.make({ reason: \"request\" }),\n  });\n});\n\nconst baseHeaders = () =>\n  new Headers({\n    \"content-type\": \"application/json; charset=utf-8\",\n    \"cache-control\": \"no-store\",\n    pragma: \"no-cache\",\n    \"referrer-policy\": \"no-referrer\",\n    \"x-content-type-options\": \"nosniff\",\n    \"content-security-policy\": \"default-src 'none'; frame-ancestors 'none'\",\n    vary: \"Origin\",\n  });\n\nconst failResponse = (error: OperationHttpError) =>\n  Effect.map(\n    encodeResponse({ _tag: \"TransportFailure\", reason: error.reason }),\n    (body) =>\n      new Response(body, {\n        status:\n          error.reason === \"not-found\"\n            ? 404\n            : error.reason === \"method\"\n              ? 405\n              : error.reason === \"too-large\"\n                ? 413\n                : error.reason === \"unavailable\"\n                  ? 503\n                  : error.reason === \"origin\" || error.reason === \"csrf\"\n                    ? 403\n                    : 400,\n        headers: baseHeaders(),\n      }),\n  ).pipe(Effect.orDie);\n\nconst callbackPayload = Effect.fn(\"OperationHttp.callbackPayload\")(function* (\n  callback: OAuthHttpCallback,\n  request: Request,\n  credentials: HttpCredentials,\n  url: URL,\n) {\n  const allowed = new Set([\n    \"state\",\n    \"code\",\n    \"error\",\n    \"error_description\",\n    \"error_uri\",\n    \"iss\",\n    ...(callback.allowedQueryParameters ?? []),\n  ]);\n\n  const seen = new Set<string>();\n\n  for (const [name, value] of url.searchParams) {\n    if (!allowed.has(name) || seen.has(name) || value.length > 4096)\n      return yield* OperationHttpError.make({ reason: \"request\" });\n    seen.add(name);\n  }\n  const state = url.searchParams.get(\"state\");\n  const code = url.searchParams.get(\"code\");\n  const error = url.searchParams.get(\"error\");\n\n  if (\n    state === null ||\n    state.length === 0 ||\n    state.length > 2048 ||\n    (code === null) === (error === null)\n  )\n    return yield* OperationHttpError.make({ reason: \"request\" });\n  const issuer = url.searchParams.get(\"iss\");\n\n  const response =\n    code === null\n      ? {\n          _tag: \"Error\",\n          state,\n          error: error === \"access_denied\" ? \"access-denied\" : \"rejected\",\n          ...(issuer === null ? {} : { issuer }),\n        }\n      : { _tag: \"Code\", state, code, ...(issuer === null ? {} : { issuer }) };\n\n  return {\n    flowId: yield* callback.flowId(request, credentials),\n    provider: callback.provider,\n    callbackId: callback.callbackId,\n    response,\n  };\n});\n\nconst inject = (route: AnyRoute, input: unknown, credentials: HttpCredentials) =>\n  Effect.try({\n    try: () => {\n      const fields = Object.entries(route.credentials);\n\n      if (fields.length === 0) return input;\n\n      const output = {\n        // oxlint-disable-next-line no-restricted-properties -- untyped HTTP payload must be a record before injecting private fields.\n        ...Schema.decodeUnknownSync(Schema.Record(Schema.String, Schema.Unknown))(input),\n      };\n\n      for (const [field, slot] of fields) {\n        if (Object.hasOwn(output, field)) throw new Error();\n        const credential = credentials[slot];\n\n        if (credential === undefined) throw new Error();\n        output[field] = Redacted.value(credential);\n      }\n\n      return output;\n    },\n    catch: () => OperationHttpError.make({ reason: \"credentials\" }),\n  });\n\nconst applyCommands = Effect.fn(\"OperationHttp.applyCommands\")(function* (\n  headers: Headers,\n  commands: ReadonlyArray<AuthCredentialCommand>,\n  config: OperationHttpConfiguration,\n  native: boolean,\n) {\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  for (const command of commands) {\n    if (native) {\n      headers.set(\n        config.native!.responseHeaders[command.slot],\n        encodeCredential(credentialWire(command)),\n      );\n    } else {\n      const cookie = config.cookies[command.slot];\n      const value = command._tag === \"Issue\" ? Redacted.value(command.credential) : \"\";\n      const maxAge = command._tag === \"Issue\" ? Math.max(0, command.expiresAtMillis - now) : 0;\n\n      headers.append(\n        \"set-cookie\",\n        Cookies.serializeCookie(\n          Cookies.makeCookieUnsafe(cookie.name, value, {\n            path: cookie.path,\n            secure: cookie.secure,\n            sameSite: cookie.sameSite,\n            httpOnly: true,\n            ...(cookie.domain === undefined ? {} : { domain: cookie.domain }),\n            maxAge: Duration.millis(maxAge),\n          }),\n        ),\n      );\n    }\n  }\n});\n\nexport const make = <\n  const Routes extends Readonly<Record<string, AnyRoute>>,\n  const Callbacks extends ReadonlyArray<OAuthHttpCallback> = readonly [],\n>(\n  contract: { readonly routes: Routes },\n  options?: { readonly callbacks?: Callbacks },\n) =>\n  Effect.gen(function* () {\n    type DispatchRoute = Routes[keyof Routes] | Callbacks[number][\"route\"];\n    type Requirements = Exclude<\n      RouteRequirements<DispatchRoute>,\n      AuthRequest | AuthCredentialCommandCollector | AuthRevealCommandCollectorService | Scope.Scope\n    >;\n    const services = yield* Effect.context<Requirements>();\n    const config = yield* OperationHttpServerConfig;\n    const invocation = yield* OperationHttpInvocation;\n\n    for (const route of Object.values(contract.routes)) {\n      if (\n        route.method === \"GET\" &&\n        (route.operation.replay !== \"read-only\" ||\n          route.operation.credentials ||\n          route.reveals.length > 0 ||\n          route.operation.reveals.length > 0 ||\n          Object.keys(route.credentials).length > 0 ||\n          !(\n            SchemaAST.isVoid(Schema.toEncoded(route.operation.rpc.payloadSchema).ast) ||\n            SchemaAST.isUndefined(Schema.toEncoded(route.operation.rpc.payloadSchema).ast)\n          ))\n      )\n        return yield* OperationHttpConfigurationError.make({ reason: \"route\" });\n    }\n    const routes = new Map(Object.values(contract.routes).map((route) => [route.path, route]));\n    const callbacks = new Map<string, OAuthHttpCallback>();\n\n    for (const callback of options?.callbacks ?? []) {\n      if (callbacks.has(callback.path) || routes.has(callback.path))\n        return yield* OperationHttpConfigurationError.make({ reason: \"duplicate-route\" });\n      callbacks.set(callback.path, callback);\n    }\n\n    const handle = Effect.fn(\"OperationHttp.handle\")(\n      function* (request: Request) {\n        if (new TextEncoder().encode(request.url).byteLength > config.maximumUrlBytes)\n          return yield* OperationHttpError.make({ reason: \"too-large\" });\n\n        const url = yield* Effect.try({\n          try: () => new URL(request.url),\n          catch: () => OperationHttpError.make({ reason: \"request\" }),\n        });\n\n        const callback = callbacks.get(url.pathname);\n        const route = callback?.route ?? routes.get(url.pathname);\n\n        if (route === undefined) return yield* OperationHttpError.make({ reason: \"not-found\" });\n        if (request.method === \"OPTIONS\" && callback === undefined) {\n          const origin = request.headers.get(\"origin\");\n\n          const requestedHeaders = (request.headers.get(\"access-control-request-headers\") ?? \"\")\n            .toLowerCase()\n            .split(\",\")\n            .map((header) => header.trim())\n            .filter(Boolean);\n\n          if (origin === null || !config.trustedOrigins.includes(origin))\n            return yield* OperationHttpError.make({ reason: \"origin\" });\n          if (\n            url.search !== \"\" ||\n            request.headers.get(\"access-control-request-method\") !== route.method ||\n            requestedHeaders.some(\n              (header) => header !== \"content-type\" && header !== config.csrfHeader,\n            )\n          )\n            return yield* OperationHttpError.make({ reason: \"csrf\" });\n          const headers = baseHeaders();\n\n          headers.set(\"access-control-allow-origin\", origin);\n          headers.set(\"access-control-allow-credentials\", \"true\");\n          headers.set(\"access-control-allow-methods\", route.method);\n          headers.set(\"access-control-allow-headers\", `content-type, ${config.csrfHeader}`);\n          headers.set(\n            \"vary\",\n            \"Origin, Access-Control-Request-Method, Access-Control-Request-Headers\",\n          );\n\n          return new Response(null, { status: 204, headers });\n        }\n        if (request.method !== (callback === undefined ? route.method : \"GET\"))\n          return yield* OperationHttpError.make({ reason: \"method\" });\n        if (callback === undefined && url.search !== \"\")\n          return yield* OperationHttpError.make({ reason: \"request\" });\n\n        const security = yield* requestSecurity(\n          request,\n          callback === undefined ? (route.method === \"GET\" ? \"read\" : \"operation\") : \"callback\",\n        );\n\n        const raw =\n          callback === undefined && route.method === \"GET\"\n            ? undefined\n            : callback === undefined\n              ? (yield* Schema.decodeEffect(Schema.fromJsonString(HttpRequestBody))(\n                  yield* boundedText(request, config.maximumBodyBytes),\n                ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: \"request\" }))))\n                  .payload\n              : yield* callbackPayload(callback, request, security.credentials, url);\n\n        const payload = yield* inject(route, raw, security.credentials);\n        const trusted = yield* invocation.resolve(request, security.credentials);\n        const commands: AuthCredentialCommand[] = [];\n        const reveals: AuthRevealCommand[] = [];\n\n        const sink = (values: ReadonlyArray<AuthCredentialCommand>) =>\n          Effect.sync(() => {\n            commands.push(...values);\n          });\n\n        const collector = {\n          supportedKinds: route.reveals,\n          accept: (values: ReadonlyArray<AuthRevealCommand>) =>\n            Effect.sync(() => {\n              reveals.push(...values);\n            }),\n        };\n\n        // The selected table entry couples its handler and codecs. The maker's\n        // generic requirements retain every concrete entry before this dispatch.\n        const invoke = route.operation.invokeUnknown as (\n          invocation: AuthInvocation,\n          input: unknown,\n        ) => Effect.Effect<RouteSuccess<DispatchRoute>, RouteFailure<DispatchRoute>, Requirements>;\n\n        const call = invoke(trusted, payload);\n\n        const successSchema = route.operation.rpc.successSchema as Schema.Codec<\n          RouteSuccess<DispatchRoute>,\n          unknown,\n          unknown,\n          Requirements\n        >;\n\n        const errorSchema = route.operation.rpc.errorSchema as Schema.Codec<\n          RouteFailure<DispatchRoute>,\n          unknown,\n          unknown,\n          Requirements\n        >;\n\n        // Context captures retain all runtime entries, regardless of their static\n        // requirement type. Replace request-owned services before every invocation\n        // and wire projection so ambient collectors can never receive secrets.\n        const requestScope = yield* Effect.scope;\n\n        const requestServices = services.pipe(\n          Context.add(Scope.Scope, requestScope),\n          Context.add(AuthRequest, {\n            invocation: trusted,\n            ...(invocation.request === undefined\n              ? {}\n              : { resolveInvocation: invocation.request(request, security.credentials) }),\n            credentials: security.credentials,\n            beforeMutation:\n              route.method === \"GET\" ? HookDenied.make({ reason: \"policy\" }) : Effect.void,\n            credentialCommandSink: sink,\n            revealCommandCollector: collector,\n          }),\n          Context.add(AuthCredentialCommandCollector, sink),\n          Context.add(AuthRevealCommandCollectorService, collector),\n        );\n\n        const resolved = yield* Effect.result(call.pipe(Effect.provide(requestServices)));\n        const headers = baseHeaders();\n\n        if (\n          security.requestOrigin !== null &&\n          config.trustedOrigins.includes(security.requestOrigin)\n        ) {\n          headers.set(\"access-control-allow-origin\", security.requestOrigin);\n          headers.set(\"access-control-allow-credentials\", \"true\");\n        }\n        if (resolved._tag === \"Failure\") {\n          const encoded = yield* Schema.encodeEffect(errorSchema)(resolved.failure).pipe(\n            Effect.provide(requestServices),\n            Effect.mapError(() => OperationHttpError.make({ reason: \"response\" })),\n          );\n\n          // oxlint-disable-next-line no-restricted-properties -- an encoded operation error enters the JSON transport boundary.\n          const error = yield* Schema.decodeUnknownEffect(Schema.Json)(encoded).pipe(\n            Effect.mapError(() => OperationHttpError.make({ reason: \"response\" })),\n          );\n\n          return new Response(\n            yield* encodeResponse({ _tag: \"Failure\", error }).pipe(Effect.orDie),\n            { status: 400, headers },\n          );\n        }\n\n        const encoded = yield* Schema.encodeEffect(successSchema)(resolved.success).pipe(\n          Effect.provide(requestServices),\n          Effect.mapError(() => OperationHttpError.make({ reason: \"response\" })),\n        );\n\n        const value =\n          encoded === undefined\n            ? undefined\n            : // oxlint-disable-next-line no-restricted-properties -- schema-encoded success enters the JSON boundary.\n              yield* Schema.decodeUnknownEffect(Schema.Json)(encoded).pipe(\n                Effect.mapError(() => OperationHttpError.make({ reason: \"response\" })),\n              );\n\n        yield* applyCommands(headers, commands, config, security.native);\n        if (callback !== undefined) {\n          // oxlint-disable-next-line no-restricted-properties -- only the core-approved return target is projected from the callback result.\n          const target = yield* Schema.decodeUnknownEffect(\n            Schema.Struct({ returnTarget: Schema.String.check(Schema.isMaxLength(2048)) }),\n          )(encoded).pipe(Effect.mapError(() => OperationHttpError.make({ reason: \"response\" })));\n\n          const destination = yield* Effect.try({\n            try: () => new URL(target.returnTarget, security.publicOrigin),\n            catch: () => OperationHttpError.make({ reason: \"response\" }),\n          });\n\n          if (\n            (destination.origin !== security.publicOrigin &&\n              !callback.allowedRedirectOrigins.includes(destination.origin)) ||\n            ![\"https:\", \"http:\"].includes(destination.protocol) ||\n            destination.username !== \"\" ||\n            destination.password !== \"\"\n          )\n            return yield* OperationHttpError.make({ reason: \"response\" });\n          headers.set(\"location\", destination.href);\n\n          return new Response(null, { status: 303, headers });\n        }\n\n        return new Response(\n          yield* encodeResponse({\n            _tag: \"Success\",\n            ...(value === undefined ? {} : { value }),\n            ...(reveals.length === 0 ? {} : { private: reveals.map(revealWire) }),\n          }).pipe(Effect.orDie),\n          { status: 200, headers },\n        );\n      },\n      Effect.scoped,\n      Effect.catch((error) =>\n        failResponse(\n          Schema.is(OperationHttpError)(error)\n            ? error\n            : OperationHttpError.make({ reason: \"unavailable\" }),\n        ),\n      ),\n      Effect.catchCause((cause) =>\n        Cause.hasDies(cause)\n          ? reportAuthFailure(\"http\", cause).pipe(\n              Effect.andThen(failResponse(OperationHttpError.make({ reason: \"unavailable\" }))),\n            )\n          : Effect.failCause(cause),\n      ),\n      Effect.provideService(OperationHttpServerConfig, config),\n    );\n\n    return { handle };\n  });\n"],"mappings":";;;;;;;;;;;;;AAqCA,MAAM,iBAAiB,OAAO,MAAM;CAClC,OAAO,aAAa,WAAW;EAC7B,OAAO,OAAO,YAAY,OAAO,IAAI;EACrC,SAAS,OAAO,YAAY,OAAO,MAAM,UAAU,CAAC;CACtD,CAAC;CACD,OAAO,aAAa,WAAW,EAAE,OAAO,OAAO,KAAK,CAAC;CACrD,OAAO,aAAa,oBAAoB,EAAE,QAAQ,OAAO,OAAO,CAAC;AACnE,CAAC;AAED,MAAM,iBAAiB,OAAO,aAAa,OAAO,eAAe,cAAc,CAAC;AAChF,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,cAAc,CAAC;AAiBhF,MAAa,iBACX,OACA,YAC8C;CAC9C,IACE,CAAC,QAAQ,KAAK,WAAW,GAAG,KAC5B,QAAQ,KAAK,SAAS,GAAG,KACzB,CAAC,OAAO,OAAO,MAAM,WAAW,CAAC,CAAC,SAAS,iBAAiB,KAC5D,MAAM,UAAU,WAAW,cAE3B,MAAM,gCAAgC,KAAK,EAAE,QAAQ,WAAW,CAAC;CAEnE,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA,wBAAwB,OAAO,OAAO,CAAC,GAAG,QAAQ,sBAAsB,CAAC;EACzE,GAAI,QAAQ,2BAA2B,KAAA,IACnC,CAAC,IACD,EAAE,wBAAwB,OAAO,OAAO,CAAC,GAAG,QAAQ,sBAAsB,CAAC,EAAE;CACnF,CAAC;AACH;AAEA,MAAM,cAAc,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACzD,SACA,SACA;CACA,OAAO,OAAO,OAAO,WAAW;EAC9B,KAAK,OAAO,WAAW;GACrB,IAAI,QAAQ,SAAS,MAAM,OAAO;GAClC,MAAM,SAAS,QAAQ,KAAK,UAAU;GACtC,MAAM,SAAuB,CAAC;GAC9B,IAAI,QAAQ;GAEZ,MAAM,cAAc;IAClB,OAAY,OAAO;GACrB;GAEA,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;GACtD,IAAI;IACF,OAAO,MAAM;KACX,MAAM,OAAO,MAAM,OAAO,KAAK;KAE/B,IAAI,KAAK,MAAM;KACf,SAAS,KAAK,MAAM;KACpB,IAAI,QAAQ,SAAS;MACnB,MAAM,OAAO,OAAO;MACpB,MAAM,mBAAmB,KAAK,EAAE,QAAQ,YAAY,CAAC;KACvD;KACA,OAAO,KAAK,KAAK,KAAK;IACxB;IACA,MAAM,SAAS,IAAI,WAAW,KAAK;IACnC,IAAI,SAAS;IAEb,KAAK,MAAM,SAAS,QAAQ;KAC1B,OAAO,IAAI,OAAO,MAAM;KACxB,UAAU,MAAM;IAClB;IAEA,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM;GAChE,UAAU;IACR,OAAO,oBAAoB,SAAS,KAAK;IACzC,OAAO,YAAY;GACrB;EACF;EACA,QAAQ,UACN,OAAO,GAAG,kBAAkB,CAAC,CAAC,KAAK,IAAI,QAAQ,mBAAmB,KAAK,EAAE,QAAQ,UAAU,CAAC;CAChG,CAAC;AACH,CAAC;AAED,MAAM,oBACJ,IAAI,QAAQ;CACV,gBAAgB;CAChB,iBAAiB;CACjB,QAAQ;CACR,mBAAmB;CACnB,0BAA0B;CAC1B,2BAA2B;CAC3B,MAAM;AACR,CAAC;AAEH,MAAM,gBAAgB,UACpB,OAAO,IACL,eAAe;CAAE,MAAM;CAAoB,QAAQ,MAAM;AAAO,CAAC,IAChE,SACC,IAAI,SAAS,MAAM;CACjB,QACE,MAAM,WAAW,cACb,MACA,MAAM,WAAW,WACf,MACA,MAAM,WAAW,cACf,MACA,MAAM,WAAW,gBACf,MACA,MAAM,WAAW,YAAY,MAAM,WAAW,SAC5C,MACA;CACd,SAAS,YAAY;AACvB,CAAC,CACL,CAAC,CAAC,KAAK,OAAO,KAAK;AAErB,MAAM,kBAAkB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACjE,UACA,SACA,aACA,KACA;CACA,MAAM,0BAAU,IAAI,IAAI;EACtB;EACA;EACA;EACA;EACA;EACA;EACA,GAAI,SAAS,0BAA0B,CAAC;CAC1C,CAAC;CAED,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,CAAC,MAAM,UAAU,IAAI,cAAc;EAC5C,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,SAAS,MACzD,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,UAAU,CAAC;EAC7D,KAAK,IAAI,IAAI;CACf;CACA,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;CAC1C,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;CACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;CAE1C,IACE,UAAU,QACV,MAAM,WAAW,KACjB,MAAM,SAAS,QACd,SAAS,UAAW,UAAU,OAE/B,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,UAAU,CAAC;CAC7D,MAAM,SAAS,IAAI,aAAa,IAAI,KAAK;CAEzC,MAAM,WACJ,SAAS,OACL;EACE,MAAM;EACN;EACA,OAAO,UAAU,kBAAkB,kBAAkB;EACrD,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,OAAO;CACtC,IACA;EAAE,MAAM;EAAQ;EAAO;EAAM,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,OAAO;CAAG;CAE1E,OAAO;EACL,QAAQ,OAAO,SAAS,OAAO,SAAS,WAAW;EACnD,UAAU,SAAS;EACnB,YAAY,SAAS;EACrB;CACF;AACF,CAAC;AAED,MAAM,UAAU,OAAiB,OAAgB,gBAC/C,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,OAAO,QAAQ,MAAM,WAAW;EAE/C,IAAI,OAAO,WAAW,GAAG,OAAO;EAEhC,MAAM,SAAS,EAEb,GAAG,OAAO,kBAAkB,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,EACjF;EAEA,KAAK,MAAM,CAAC,OAAO,SAAS,QAAQ;GAClC,IAAI,OAAO,OAAO,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM;GAClD,MAAM,aAAa,YAAY;GAE/B,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM;GAC9C,OAAO,SAAS,SAAS,MAAM,UAAU;EAC3C;EAEA,OAAO;CACT;CACA,aAAa,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC;AAChE,CAAC;AAEH,MAAM,gBAAgB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC7D,SACA,UACA,QACA,QACA;CACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,KAAK,MAAM,WAAW,UACpB,IAAI,QACF,QAAQ,IACN,OAAO,OAAQ,gBAAgB,QAAQ,OACvC,iBAAiB,eAAe,OAAO,CAAC,CAC1C;MACK;EACL,MAAM,SAAS,OAAO,QAAQ,QAAQ;EACtC,MAAM,QAAQ,QAAQ,SAAS,UAAU,SAAS,MAAM,QAAQ,UAAU,IAAI;EAC9E,MAAM,SAAS,QAAQ,SAAS,UAAU,KAAK,IAAI,GAAG,QAAQ,kBAAkB,GAAG,IAAI;EAEvF,QAAQ,OACN,cACA,QAAQ,gBACN,QAAQ,iBAAiB,OAAO,MAAM,OAAO;GAC3C,MAAM,OAAO;GACb,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,UAAU;GACV,GAAI,OAAO,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;GAC/D,QAAQ,SAAS,OAAO,MAAM;EAChC,CAAC,CACH,CACF;CACF;AAEJ,CAAC;AAED,MAAa,QAIX,UACA,YAEA,OAAO,IAAI,aAAa;CAMtB,MAAM,WAAW,OAAO,OAAO,QAAsB;CACrD,MAAM,SAAS,OAAO;CACtB,MAAM,aAAa,OAAO;CAE1B,KAAK,MAAM,SAAS,OAAO,OAAO,SAAS,MAAM,GAC/C,IACE,MAAM,WAAW,UAChB,MAAM,UAAU,WAAW,eAC1B,MAAM,UAAU,eAChB,MAAM,QAAQ,SAAS,KACvB,MAAM,UAAU,QAAQ,SAAS,KACjC,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,KACxC,EACE,UAAU,OAAO,OAAO,UAAU,MAAM,UAAU,IAAI,aAAa,CAAC,CAAC,GAAG,KACxE,UAAU,YAAY,OAAO,UAAU,MAAM,UAAU,IAAI,aAAa,CAAC,CAAC,GAAG,KAGjF,OAAO,OAAO,gCAAgC,KAAK,EAAE,QAAQ,QAAQ,CAAC;CAE1E,MAAM,SAAS,IAAI,IAAI,OAAO,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;CACzF,MAAM,4BAAY,IAAI,IAA+B;CAErD,KAAK,MAAM,YAAY,SAAS,aAAa,CAAC,GAAG;EAC/C,IAAI,UAAU,IAAI,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,IAAI,GAC1D,OAAO,OAAO,gCAAgC,KAAK,EAAE,QAAQ,kBAAkB,CAAC;EAClF,UAAU,IAAI,SAAS,MAAM,QAAQ;CACvC;CA+NA,OAAO,EAAE,QA7NM,OAAO,GAAG,sBAAsB,CAAC,CAC9C,WAAW,SAAkB;EAC3B,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,GAAG,CAAC,CAAC,aAAa,OAAO,iBAC5D,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,YAAY,CAAC;EAE/D,MAAM,MAAM,OAAO,OAAO,IAAI;GAC5B,WAAW,IAAI,IAAI,QAAQ,GAAG;GAC9B,aAAa,mBAAmB,KAAK,EAAE,QAAQ,UAAU,CAAC;EAC5D,CAAC;EAED,MAAM,WAAW,UAAU,IAAI,IAAI,QAAQ;EAC3C,MAAM,QAAQ,UAAU,SAAS,OAAO,IAAI,IAAI,QAAQ;EAExD,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,YAAY,CAAC;EACtF,IAAI,QAAQ,WAAW,aAAa,aAAa,KAAA,GAAW;GAC1D,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;GAE3C,MAAM,oBAAoB,QAAQ,QAAQ,IAAI,gCAAgC,KAAK,GAAA,CAChF,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO;GAEjB,IAAI,WAAW,QAAQ,CAAC,OAAO,eAAe,SAAS,MAAM,GAC3D,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;GAC5D,IACE,IAAI,WAAW,MACf,QAAQ,QAAQ,IAAI,+BAA+B,MAAM,MAAM,UAC/D,iBAAiB,MACd,WAAW,WAAW,kBAAkB,WAAW,OAAO,UAC7D,GAEA,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,OAAO,CAAC;GAC1D,MAAM,UAAU,YAAY;GAE5B,QAAQ,IAAI,+BAA+B,MAAM;GACjD,QAAQ,IAAI,oCAAoC,MAAM;GACtD,QAAQ,IAAI,gCAAgC,MAAM,MAAM;GACxD,QAAQ,IAAI,gCAAgC,iBAAiB,OAAO,YAAY;GAChF,QAAQ,IACN,QACA,uEACF;GAEA,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK;GAAQ,CAAC;EACpD;EACA,IAAI,QAAQ,YAAY,aAAa,KAAA,IAAY,MAAM,SAAS,QAC9D,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,SAAS,CAAC;EAC5D,IAAI,aAAa,KAAA,KAAa,IAAI,WAAW,IAC3C,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,UAAU,CAAC;EAE7D,MAAM,WAAW,OAAO,gBACtB,SACA,aAAa,KAAA,IAAa,MAAM,WAAW,QAAQ,SAAS,cAAe,UAC7E;EAEA,MAAM,MACJ,aAAa,KAAA,KAAa,MAAM,WAAW,QACvC,KAAA,IACA,aAAa,KAAA,KACV,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACjE,OAAO,YAAY,SAAS,OAAO,gBAAgB,CACrD,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC,CAAC,EAAA,CACzE,UACH,OAAO,gBAAgB,UAAU,SAAS,SAAS,aAAa,GAAG;EAE3E,MAAM,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,WAAW;EAC9D,MAAM,UAAU,OAAO,WAAW,QAAQ,SAAS,SAAS,WAAW;EACvE,MAAM,WAAoC,CAAC;EAC3C,MAAM,UAA+B,CAAC;EAEtC,MAAM,QAAQ,WACZ,OAAO,WAAW;GAChB,SAAS,KAAK,GAAG,MAAM;EACzB,CAAC;EAEH,MAAM,YAAY;GAChB,gBAAgB,MAAM;GACtB,SAAS,WACP,OAAO,WAAW;IAChB,QAAQ,KAAK,GAAG,MAAM;GACxB,CAAC;EACL;EAIA,MAAM,SAAS,MAAM,UAAU;EAK/B,MAAM,OAAO,OAAO,SAAS,OAAO;EAEpC,MAAM,gBAAgB,MAAM,UAAU,IAAI;EAO1C,MAAM,cAAc,MAAM,UAAU,IAAI;EAUxC,MAAM,eAAe,OAAO,OAAO;EAEnC,MAAM,kBAAkB,SAAS,KAC/B,QAAQ,IAAI,MAAM,OAAO,YAAY,GACrC,QAAQ,IAAI,aAAa;GACvB,YAAY;GACZ,GAAI,WAAW,YAAY,KAAA,IACvB,CAAC,IACD,EAAE,mBAAmB,WAAW,QAAQ,SAAS,SAAS,WAAW,EAAE;GAC3E,aAAa,SAAS;GACtB,gBACE,MAAM,WAAW,QAAQ,WAAW,KAAK,EAAE,QAAQ,SAAS,CAAC,IAAI,OAAO;GAC1E,uBAAuB;GACvB,wBAAwB;EAC1B,CAAC,GACD,QAAQ,IAAI,gCAAgC,IAAI,GAChD,QAAQ,IAAI,mCAAmC,SAAS,CAC1D;EAEA,MAAM,WAAW,OAAO,OAAO,OAAO,KAAK,KAAK,OAAO,QAAQ,eAAe,CAAC,CAAC;EAChF,MAAM,UAAU,YAAY;EAE5B,IACE,SAAS,kBAAkB,QAC3B,OAAO,eAAe,SAAS,SAAS,aAAa,GACrD;GACA,QAAQ,IAAI,+BAA+B,SAAS,aAAa;GACjE,QAAQ,IAAI,oCAAoC,MAAM;EACxD;EACA,IAAI,SAAS,SAAS,WAAW;GAC/B,MAAM,UAAU,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,KACxE,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CACvE;GAGA,MAAM,QAAQ,OAAO,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KACpE,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CACvE;GAEA,OAAO,IAAI,SACT,OAAO,eAAe;IAAE,MAAM;IAAW;GAAM,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,GACnE;IAAE,QAAQ;IAAK;GAAQ,CACzB;EACF;EAEA,MAAM,UAAU,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,KAC1E,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CACvE;EAEA,MAAM,QACJ,YAAY,KAAA,IACR,KAAA,IAEA,OAAO,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KACtD,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CACvE;EAEN,OAAO,cAAc,SAAS,UAAU,QAAQ,SAAS,MAAM;EAC/D,IAAI,aAAa,KAAA,GAAW;GAE1B,MAAM,SAAS,OAAO,OAAO,oBAC3B,OAAO,OAAO,EAAE,cAAc,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,EAAE,CAAC,CAC/E,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CAAC;GAEtF,MAAM,cAAc,OAAO,OAAO,IAAI;IACpC,WAAW,IAAI,IAAI,OAAO,cAAc,SAAS,YAAY;IAC7D,aAAa,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;GAC7D,CAAC;GAED,IACG,YAAY,WAAW,SAAS,gBAC/B,CAAC,SAAS,uBAAuB,SAAS,YAAY,MAAM,KAC9D,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC,SAAS,YAAY,QAAQ,KAClD,YAAY,aAAa,MACzB,YAAY,aAAa,IAEzB,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,WAAW,CAAC;GAC9D,QAAQ,IAAI,YAAY,YAAY,IAAI;GAExC,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK;GAAQ,CAAC;EACpD;EAEA,OAAO,IAAI,SACT,OAAO,eAAe;GACpB,MAAM;GACN,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;GACvC,GAAI,QAAQ,WAAW,IAAI,CAAC,IAAI,EAAE,SAAS,QAAQ,IAAI,UAAU,EAAE;EACrE,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,GACpB;GAAE,QAAQ;GAAK;EAAQ,CACzB;CACF,GACA,OAAO,QACP,OAAO,OAAO,UACZ,aACE,OAAO,GAAG,kBAAkB,CAAC,CAAC,KAAK,IAC/B,QACA,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC,CACvD,CACF,GACA,OAAO,YAAY,UACjB,MAAM,QAAQ,KAAK,IACf,kBAAkB,QAAQ,KAAK,CAAC,CAAC,KAC/B,OAAO,QAAQ,aAAa,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC,CAAC,CAAC,CACjF,IACA,OAAO,UAAU,KAAK,CAC5B,GACA,OAAO,eAAe,2BAA2B,MAAM,CAG3C,EAAE;AAClB,CAAC"}

package/dist/identity/ExternalIdentityMutation.d.mts

@@ -0,0 +1,15 @@
+import { SubjectId } from "../Schema.mjs";
+import { ExternalIdentity, IdentityConflict, IdentityUnavailable } from "./models.mjs";
+import { Context, Effect } from "effect";
+//#region src/identity/ExternalIdentityMutation.d.ts
+declare const ExternalIdentityMutation_base: Context.ServiceClass<ExternalIdentityMutation, "effect-auth/ExternalIdentityMutation", {
+  readonly bind: (subjectId: SubjectId, identity: ExternalIdentity) => Effect.Effect<void, IdentityConflict | IdentityUnavailable>;
+}>;
+/**
+ * Binds a provider subject to an application subject. The authoritative store
+ * enforces uniqueness of the full provider, issuer and external-subject tuple.
+ */
+declare class ExternalIdentityMutation extends ExternalIdentityMutation_base {}
+//#endregion
+export { ExternalIdentityMutation };
+//# sourceMappingURL=ExternalIdentityMutation.d.mts.map

package/dist/identity/ExternalIdentityMutation.mjs

@@ -0,0 +1,11 @@
+import { Context } from "effect";
+//#region src/identity/ExternalIdentityMutation.ts
+/**
+* Binds a provider subject to an application subject. The authoritative store
+* enforces uniqueness of the full provider, issuer and external-subject tuple.
+*/
+var ExternalIdentityMutation = class extends Context.Service()("effect-auth/ExternalIdentityMutation") {};
+//#endregion
+export { ExternalIdentityMutation };
+
+//# sourceMappingURL=ExternalIdentityMutation.mjs.map

package/dist/identity/ExternalIdentityMutation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalIdentityMutation.mjs","names":[],"sources":["../../src/identity/ExternalIdentityMutation.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { SubjectId } from \"../Schema\";\nimport type { ExternalIdentity, IdentityConflict, IdentityUnavailable } from \"./models\";\n\n/**\n * Binds a provider subject to an application subject. The authoritative store\n * enforces uniqueness of the full provider, issuer and external-subject tuple.\n */\nexport class ExternalIdentityMutation extends Context.Service<\n  ExternalIdentityMutation,\n  {\n    readonly bind: (\n      subjectId: SubjectId,\n      identity: ExternalIdentity,\n    ) => Effect.Effect<void, IdentityConflict | IdentityUnavailable>;\n  }\n>()(\"effect-auth/ExternalIdentityMutation\") {}\n"],"mappings":";;;;;;AASA,IAAa,2BAAb,cAA8C,QAAQ,QAQpD,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/dist/identity/IdentityMutation.d.mts

@@ -0,0 +1,22 @@
+import { SubjectId } from "../Schema.mjs";
+import { CredentialId, IdentityConflict, IdentityUnavailable, LastSignInMethod, LoginIdentifier, SubjectInactive } from "./models.mjs";
+import { Context, Effect } from "effect";
+//#region src/identity/IdentityMutation.d.ts
+declare const IdentityMutation_base: Context.ServiceClass<IdentityMutation, "effect-auth/IdentityMutation", {
+  readonly removeIdentifier: (subjectId: SubjectId, identifier: LoginIdentifier) => Effect.Effect<void, IdentityConflict | LastSignInMethod | SubjectInactive | IdentityUnavailable>;
+  readonly removeCredential: (subjectId: SubjectId, credentialId: CredentialId) => Effect.Effect<void, IdentityConflict | LastSignInMethod | SubjectInactive | IdentityUnavailable>;
+}>;
+/**
+ * Narrow removal capability. The authoritative adapter checks active status,
+ * ownership and the remaining usable sign-in methods in the SAME atomic write.
+ * A read/count followed by deletion is insufficient under concurrent removals.
+ * Removing a credential also removes its retained secrets and dependent proofs.
+ * Identifier removal/rebinding/verification changes that invalidate captured login
+ * authority MUST atomically bump subject securityRevision. AuthenticationRevision
+ * deliberately has no identifier-binding revision: deleting dependent proofs alone
+ * cannot invalidate password evidence already captured before verification.
+ */
+declare class IdentityMutation extends IdentityMutation_base {}
+//#endregion
+export { IdentityMutation };
+//# sourceMappingURL=IdentityMutation.d.mts.map

package/dist/identity/IdentityMutation.mjs

@@ -0,0 +1,17 @@
+import { Context } from "effect";
+//#region src/identity/IdentityMutation.ts
+/**
+* Narrow removal capability. The authoritative adapter checks active status,
+* ownership and the remaining usable sign-in methods in the SAME atomic write.
+* A read/count followed by deletion is insufficient under concurrent removals.
+* Removing a credential also removes its retained secrets and dependent proofs.
+* Identifier removal/rebinding/verification changes that invalidate captured login
+* authority MUST atomically bump subject securityRevision. AuthenticationRevision
+* deliberately has no identifier-binding revision: deleting dependent proofs alone
+* cannot invalidate password evidence already captured before verification.
+*/
+var IdentityMutation = class extends Context.Service()("effect-auth/IdentityMutation") {};
+//#endregion
+export { IdentityMutation };
+
+//# sourceMappingURL=IdentityMutation.mjs.map