t3code-cli 0.5.0 → 0.5.1

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as is, $n as sync$1, $t as catchFilter, An as timeoutOrElse, Ar as dual, At as tap, B as Boolean$2, Bn as mergeAll, Bt as offer, Cn as scoped, Cr as format, Ct as run$1, Dn as sync, Dr as isNullish, Dt as runLast, En as suspend, Er as isNotUndefined, Et as runFold, F as T3Application, Fn as TaggedError, Fr as __require, Ft as drain, G as Literals, Gn as MinimumLogLevel, Gt as nominal, H as ErrorClass, Hn as provideMerge, Ht as BadArgument, I as Environment, In as fail$1, It as isSink, J as TaggedErrorClass, Jn as isDone, Jt as addFinalizer, K as String$1, Kn as _await, Kt as transform$1, L as T3Config, Ln as hasInterruptsOnly, Lt as endUnsafe, M as ThreadSessionError, Mn as try_, Mr as pipe, Mt as unwrap, N as latestAssistantMessage, Nn as uninterruptible, Nr as pipeArguments, Nt as get, On as tapCause, Or as isUndefined, Ot as splitLines, P as threadStatus, Pn as void_, Pr as __commonJSMin, Pt as make$11, Q as fromJsonString, Qn as ConsoleRef, Qt as callback, R as T3Auth, Rn as squash, Rt as failCauseUnsafe, Sn as runFork, Sr as BaseProto, St as mkString, Tn as succeed, Tr as isNotNull, Tt as runDrain, U as Int, Un as succeed$2, Ut as badArgument, V as Defect, Vn as provide, Vt as offerUnsafe, W as Literal, Wn as sync$2, Wt as systemError, X as decodeTo, Xn as isSuccess, Xt as as, Y as Union, Yn as makeUnsafe, Yt as andThen, Z as decodeUnknownEffect, Zn as succeed$1, Zt as asVoid, _n as orDie, _r as none, _t as decodeText, an as fn, ar as empty$1, at as make$9, bn as provideService, br as PipeInspectableProto, bt as isStream, cn as forkScoped, cr as flatMap$1, ct as Path$1, dn as interrupt, dr as getOrElse, dt as FileSystem, en as catchTags, er as map$3, et as optional$3, fn as isEffect, fr as getOrUndefined, ft as FileTypeId, gn as matchEffect, gr as match, gt as callback$1, hn as mapError, hr as map$4, ht as make$10, in as flatMap, ir as Service, it as Crypto, j as NodeEnvironmentLive, jn as tryPromise, jr as identity, jt as transduce, kn as tapError, kr as constVoid, kt as succeed$4, ln as gen, lr as fromNullishOr, lt as TypeId$7, mn as map$2, mr as isSome, mt as WatchBackend, nn as effectify, nr as succeed$3, nt as tag, on as fnUntraced, or as getUnsafe, ot as fromReadable, pn as logError, pr as isNone, pt as Size, q as Struct, qn as doneUnsafe, qt as acquireRelease, rn as fail, rr as Reference, rt as toCodecStringTree, sn as forEach, sr as make$13, st as fromWritable, t as AppLayer, tn as catch_, tr as fail$2, tt as optionalKey, un as ignore, ur as fromUndefinedOr, ut as FileDescriptor, vn as provide$1, vr as some, vt as empty, wn as serviceOption, wr as hasProperty, wt as runCollect, xn as result, xr as withFiber, xt as merge, yn as provideContext, yr as Prototype, yt as fromIterable, z as ArraySchema, zn as effect, zt as make$12 } from "./runtime-15tR27tv.js";
+import { $ as T3Config, $n as hasInterruptsOnly, $t as endUnsafe, An as map$2, Ar as isSome, At as WatchBackend, Bn as serviceOption, Br as hasProperty, Bt as runCollect, Cn as forEach, Cr as make$13, Ct as fromWritable, Dn as interrupt, Dr as getOrElse, Dt as FileSystem, En as ignore, Er as fromUndefinedOr, Et as FileDescriptor, Fn as provideContext, Fr as Prototype, Ft as fromIterable, Gn as tapError, Gr as constVoid, Gt as succeed$4, Hn as suspend, Hr as isNotUndefined, Ht as runFold, In as provideService, Ir as PipeInspectableProto, It as isStream, J as ThreadSessionError, Jn as try_, Jr as pipe, Jt as unwrap, Kn as timeoutOrElse, Kr as dual, Kt as tap, Ln as result, Lr as withFiber, Lt as merge, Mn as matchEffect, Mr as match, Mt as callback$1, Nn as orDie, Nr as none, Nt as decodeText, On as isEffect, Or as getOrUndefined, Ot as FileTypeId, Pn as provide$1, Pr as some, Pt as empty, Q as Environment, Qn as fail$1, Qt as isSink, Rn as runFork, Rr as BaseProto, Rt as mkString, Sn as fnUntraced, Sr as getUnsafe, St as fromReadable, Tn as gen, Tr as fromNullishOr, Tt as TypeId$7, Un as sync, Ur as isNullish, Ut as runLast, Vn as succeed, Vr as isNotNull, Vt as runDrain, Wn as tapCause, Wr as isUndefined, Wt as splitLines, X as threadStatus, Xn as void_, Xr as __commonJSMin, Xt as make$11, Y as latestAssistantMessage, Yn as uninterruptible, Yr as pipeArguments, Yt as get, Z as T3Application, Zn as TaggedError, Zr as __require, Zt as drain, _n as catch_, _r as fail$2, _t as optionalKey, an as badArgument, ar as succeed$2, at as Int, bn as flatMap, br as Service, bt as Crypto, cn as transform$1, cr as _await, ct as String$1, dn as andThen, dr as makeUnsafe, dt as Union, en as failCauseUnsafe, er as squash, et as T3Auth, fn as as, fr as isSuccess, ft as decodeTo, gn as catchTags, gr as map$3, gt as optional$3, hn as catchFilter, hr as sync$1, ht as is, in as BadArgument, ir as provideMerge, it as ErrorClass, jn as mapError, jr as map$4, jt as make$10, kn as logError, kr as isNone, kt as Size, ln as acquireRelease, lr as doneUnsafe, lt as Struct, mn as callback, mr as ConsoleRef, mt as fromJsonString, nn as offer, nr as mergeAll, nt as Boolean$2, on as systemError, or as sync$2, ot as Literal, pn as asVoid, pr as succeed$1, pt as decodeUnknownEffect, q as NodeEnvironmentLive, qn as tryPromise, qr as identity, qt as transduce, rn as offerUnsafe, rr as provide, rt as Defect, sn as nominal, sr as MinimumLogLevel, st as Literals, t as AppLayer, tn as make$12, tr as effect, tt as ArraySchema, un as addFinalizer, ur as isDone, ut as TaggedErrorClass, vn as effectify, vr as succeed$3, vt as tag, wn as forkScoped, wr as flatMap$1, wt as Path$1, xn as fn, xr as empty$1, xt as make$9, yn as fail, yr as Reference, yt as toCodecStringTree, zn as scoped, zr as format, zt as run$1 } from "./runtime-KQVRmRk-.js";
 import * as NodeChildProcess from "node:child_process";
 import * as NodeCrypto from "node:crypto";
 import * as NFS from "node:fs";
@@ -18149,7 +18149,7 @@ var T3Version = class extends Service()("t3cli/T3Version") {};
 //#endregion
 //#region src/version/layer.ts
 const PackageJsonSchema = fromJsonString(Struct({ version: String$1 }));
-const T3VersionBundledLive = sync$2(T3Version, () => ({ version: "0.5.0" }));
+const T3VersionBundledLive = sync$2(T3Version, () => ({ version: "0.5.1" }));
 effect(T3Version, gen(function* () {
 	const packageJson = yield* (yield* FileSystem).readFileString(fileURLToPath(new URL("../../package.json", import.meta.url)));
 	return { version: (yield* decodeUnknownEffect(PackageJsonSchema)(packageJson)).version };

package/dist/index.js

@@ -1,2 +1,12 @@
-import { A as UrlError, C as AuthLocalDatabaseError, D as AuthPairingUrlError, E as AuthLocalSigningError, F as T3Application, I as Environment, L as T3Config, O as AuthTransportError, R as T3Auth, S as AuthConfigError, T as AuthLocalSecretError, _ as parsePairingUrl, a as T3AuthTransportLayer, b as makeT3LocalAuth, c as NodeSqliteClientLive, d as makeT3Config, f as T3AuthLive, g as makeT3AuthPairing, h as T3AuthPairingLive, i as T3AuthPairingLayer, j as NodeEnvironmentLive, k as ConfigError, l as makeNodeSqliteClient, m as T3AuthPairing, n as AuthAppLayer, o as T3LocalAuthLayer, p as makeT3Auth, r as T3AuthLayer, s as NodeSqlClientFactoryLive, t as AppLayer, u as T3ConfigLive, v as T3LocalAuth, w as AuthLocalError, x as SqlClientFactory, y as T3LocalAuthLive } from "./runtime-15tR27tv.js";
-export { AppLayer, AuthAppLayer, AuthConfigError, AuthLocalDatabaseError, AuthLocalError, AuthLocalSecretError, AuthLocalSigningError, AuthPairingUrlError, AuthTransportError, ConfigError, Environment, NodeEnvironmentLive, NodeSqlClientFactoryLive, NodeSqliteClientLive, SqlClientFactory, T3Application, T3Auth, T3AuthLayer, T3AuthLive, T3AuthPairing, T3AuthPairingLayer, T3AuthPairingLive, T3AuthTransportLayer, T3Config, T3ConfigLive, T3LocalAuth, T3LocalAuthLayer, T3LocalAuthLive, UrlError, makeNodeSqliteClient, makeT3Auth, makeT3AuthPairing, makeT3Config, makeT3LocalAuth, parsePairingUrl };
+import { $ as T3Config, A as T3LocalAuthTokenLive, B as AuthLocalSigningError, C as makeT3AuthPairing, D as T3LocalAuthLive, E as T3LocalAuth, F as makeT3LocalAuthOrigin, G as layerWebSocketConstructor, H as AuthTransportError, I as AuthConfigError, K as layerUndici, L as AuthLocalDatabaseError, M as SqlClientFactory, N as T3LocalAuthOrigin, O as makeT3LocalAuth, P as T3LocalAuthOriginLive, Q as Environment, R as AuthLocalError, S as T3AuthPairingLive, T as T3AuthTransportLive, U as ConfigError, V as AuthPairingUrlError, W as UrlError, Z as T3Application, _ as makeT3CodeConnectionProvider, a as T3AuthTransportLayer, b as makeT3Auth, c as T3LocalAuthTokenLayer, d as makeNodeSqliteClient, et as T3Auth, f as T3RpcLive, g as T3CodeConnectionProviderLive, h as T3CodeConnectionProvider, i as T3AuthPairingLayer, j as makeT3LocalAuthToken, k as T3LocalAuthToken, l as NodeSqlClientFactoryLive, m as makeT3Config, n as AuthAppLayer, nr as mergeAll, o as T3LocalAuthLayer, p as T3ConfigLive, q as NodeEnvironmentLive, r as T3AuthLayer, rr as provide, s as T3LocalAuthOriginLayer, t as AppLayer, u as NodeSqliteClientLive, v as T3CodeConnectionError, w as parsePairingUrl, x as T3AuthPairing, y as T3AuthLive, z as AuthLocalSecretError } from "./runtime-KQVRmRk-.js";
+//#region src/connection/layer.ts
+function makeT3CodeRpcLayer() {
+	return T3RpcLive.pipe(provide(T3AuthTransportLive));
+}
+const T3CodeRpcLayer = makeT3CodeRpcLayer();
+//#endregion
+//#region src/connection/node.ts
+const NodeConnectionPlatformLayer = mergeAll(layerUndici, layerWebSocketConstructor);
+const T3CodeNodeRpcLayer = T3CodeRpcLayer.pipe(provide(NodeConnectionPlatformLayer));
+//#endregion
+export { AppLayer, AuthAppLayer, AuthConfigError, AuthLocalDatabaseError, AuthLocalError, AuthLocalSecretError, AuthLocalSigningError, AuthPairingUrlError, AuthTransportError, ConfigError, Environment, NodeEnvironmentLive, NodeSqlClientFactoryLive, NodeSqliteClientLive, SqlClientFactory, T3Application, T3Auth, T3AuthLayer, T3AuthLive, T3AuthPairing, T3AuthPairingLayer, T3AuthPairingLive, T3AuthTransportLayer, T3CodeConnectionError, T3CodeConnectionProvider, T3CodeConnectionProviderLive, T3CodeNodeRpcLayer, T3CodeRpcLayer, T3Config, T3ConfigLive, T3LocalAuth, T3LocalAuthLayer, T3LocalAuthLive, T3LocalAuthOrigin, T3LocalAuthOriginLayer, T3LocalAuthOriginLive, T3LocalAuthToken, T3LocalAuthTokenLayer, T3LocalAuthTokenLive, UrlError, makeNodeSqliteClient, makeT3Auth, makeT3AuthPairing, makeT3CodeConnectionProvider, makeT3CodeRpcLayer, makeT3Config, makeT3LocalAuth, makeT3LocalAuthOrigin, makeT3LocalAuthToken, parsePairingUrl };

package/dist/{runtime-15tR27tv.js → runtime-KQVRmRk-.js}

@@ -65511,6 +65511,120 @@ var AuthLocalError = class extends TaggedErrorClass()("AuthLocalError", {
 	]))
 }) {};
 //#endregion
+//#region src/config/url.ts
+function normalizeHttpBaseUrl(value) {
+	return parseUrl$1(value).pipe(flatMap$2((url) => succeed$2(normalizeBaseUrl$1(url))));
+}
+function toHttpEndpointUrl(httpBaseUrl, pathname) {
+	return parseUrl$1(httpBaseUrl).pipe(flatMap$2((url) => succeed$2(withPathname(url, pathname).toString())));
+}
+function toWebSocketEndpointUrl(httpBaseUrl, pathname) {
+	return parseUrl$1(httpBaseUrl).pipe(flatMap$2((url) => {
+		if (url.protocol === "http:") return succeed$2(withPathname(url, pathname, "ws:").toString());
+		if (url.protocol === "https:") return succeed$2(withPathname(url, pathname, "wss:").toString());
+		return fail$2(new UrlError({
+			message: `unsupported server url protocol: ${url.protocol}`,
+			protocol: url.protocol
+		}));
+	}));
+}
+function parseUrl$1(value) {
+	return fromResult(fromString(value)).pipe(catchTags$1({ IllegalArgumentError: (error) => fail$2(new UrlError({
+		message: "invalid url",
+		cause: error
+	})) }));
+}
+function normalizeBaseUrl$1(url) {
+	return mutate(url, (current) => {
+		current.hash = "";
+		current.search = "";
+		current.pathname = normalizePathname(current.pathname);
+	}).toString().replace(/\/$/, "");
+}
+function withPathname(url, pathname, protocol) {
+	return mutate(url, (current) => {
+		if (protocol !== void 0) current.protocol = protocol;
+		current.pathname = appendPathname(current.pathname, pathname);
+		current.search = "";
+		current.hash = "";
+	});
+}
+function normalizePathname(pathname) {
+	return pathname === "/" ? "" : pathname.replace(/\/+$/u, "");
+}
+function appendPathname(basePathname, pathname) {
+	return `${normalizePathname(basePathname)}${pathname.startsWith("/") ? pathname : `/${pathname}`}`;
+}
+//#endregion
+//#region src/auth/local-base-dir.ts
+function resolveLocalBaseDir(input) {
+	const envBaseDir = input.environment.env["T3CODE_HOME"];
+	const raw = input.baseDir ?? envBaseDir;
+	if (raw === void 0 || raw.length === 0) return input.path.join(input.environment.homeDir, ".t3");
+	if (raw === "~") return input.environment.homeDir;
+	if (raw.startsWith("~/") || raw.startsWith("~\\")) return input.path.join(input.environment.homeDir, raw.slice(2));
+	return input.path.resolve(input.environment.cwd, raw);
+}
+//#endregion
+//#region src/auth/schema.ts
+const AuthAccessTokenResultSchema = Struct({
+	access_token: String$1,
+	issued_token_type: String$1,
+	token_type: Literal("Bearer"),
+	expires_in: Number$1,
+	scope: String$1
+});
+const AuthSessionStateSchema = Struct({
+	authenticated: Boolean$1,
+	role: optionalKey(Literals(["owner", "client"])),
+	sessionMethod: optionalKey(String$1),
+	expiresAt: optionalKey(String$1)
+});
+const AuthWebSocketTicketResultSchema = Struct({
+	ticket: String$1,
+	expiresAt: String$1
+});
+const AuthLocalRuntimeStateSchema = Struct({
+	version: Literal(1),
+	origin: String$1
+});
+const decodeAuthAccessTokenResult = decodeUnknownEffect(AuthAccessTokenResultSchema);
+const decodeAuthSessionState = decodeUnknownEffect(AuthSessionStateSchema);
+const decodeAuthWebSocketTicketResult = decodeUnknownEffect(AuthWebSocketTicketResultSchema);
+decodeUnknownEffect(AuthLocalRuntimeStateSchema);
+const decodeAuthLocalRuntimeStateFromJson = decodeUnknownEffect(fromJsonString(AuthLocalRuntimeStateSchema));
+//#endregion
+//#region src/auth/local-origin.ts
+var T3LocalAuthOrigin = class extends Service$1()("t3cli/T3LocalAuthOrigin") {};
+const makeT3LocalAuthOrigin = fn("makeT3LocalAuthOrigin")(function* () {
+	const fs = yield* FileSystem;
+	const path = yield* Path;
+	const environment = yield* Environment;
+	return { resolve: fn("T3LocalAuthOriginLive.resolve")(function* (input) {
+		const baseDir = resolveLocalBaseDir({
+			baseDir: input?.baseDir,
+			environment,
+			path
+		});
+		if (input?.origin !== void 0) return yield* normalizeLocalOrigin(input.origin);
+		const runtimeStatePath = path.join(baseDir, "userdata", "server-runtime.json");
+		return yield* normalizeLocalOrigin((yield* decodeAuthLocalRuntimeStateFromJson(yield* fs.readFileString(runtimeStatePath).pipe(mapError$2((error) => new AuthLocalError({
+			message: `local runtime state not found: ${runtimeStatePath}. Make sure T3 Code is running with Network access enabled, or pass --origin manually.`,
+			cause: error
+		})))).pipe(mapError$2((error) => new AuthLocalError({
+			message: "local runtime state has invalid shape",
+			cause: error
+		})))).origin);
+	}) };
+});
+const T3LocalAuthOriginLive = effect(T3LocalAuthOrigin, makeT3LocalAuthOrigin());
+function normalizeLocalOrigin(origin) {
+	return normalizeHttpBaseUrl(origin).pipe(mapError$2((error) => new AuthLocalError({
+		message: error.message,
+		cause: error
+	})));
+}
+//#endregion
 //#region node_modules/.pnpm/effect@4.0.0-beta.78/node_modules/effect/dist/unstable/reactivity/Reactivity.js
 /**
 * The `Reactivity` module provides process-local invalidation for connecting
@@ -66488,111 +66602,17 @@ const makeWithTransaction = (options) => (effect) => {
 */
 const TransactionConnection = (clientId) => Service$1(`effect/sql/SqlClient/TransactionConnection/${clientId}`);
 //#endregion
-//#region src/config/url.ts
-function normalizeHttpBaseUrl(value) {
-	return parseUrl$1(value).pipe(flatMap$2((url) => succeed$2(normalizeBaseUrl$1(url))));
-}
-function toHttpEndpointUrl(httpBaseUrl, pathname) {
-	return parseUrl$1(httpBaseUrl).pipe(flatMap$2((url) => succeed$2(withPathname(url, pathname).toString())));
-}
-function toWebSocketEndpointUrl(httpBaseUrl, pathname) {
-	return parseUrl$1(httpBaseUrl).pipe(flatMap$2((url) => {
-		if (url.protocol === "http:") return succeed$2(withPathname(url, pathname, "ws:").toString());
-		if (url.protocol === "https:") return succeed$2(withPathname(url, pathname, "wss:").toString());
-		return fail$2(new UrlError({
-			message: `unsupported server url protocol: ${url.protocol}`,
-			protocol: url.protocol
-		}));
-	}));
-}
-function parseUrl$1(value) {
-	return fromResult(fromString(value)).pipe(catchTags$1({ IllegalArgumentError: (error) => fail$2(new UrlError({
-		message: "invalid url",
-		cause: error
-	})) }));
-}
-function normalizeBaseUrl$1(url) {
-	return mutate(url, (current) => {
-		current.hash = "";
-		current.search = "";
-		current.pathname = normalizePathname(current.pathname);
-	}).toString().replace(/\/$/, "");
-}
-function withPathname(url, pathname, protocol) {
-	return mutate(url, (current) => {
-		if (protocol !== void 0) current.protocol = protocol;
-		current.pathname = appendPathname(current.pathname, pathname);
-		current.search = "";
-		current.hash = "";
-	});
-}
-function normalizePathname(pathname) {
-	return pathname === "/" ? "" : pathname.replace(/\/+$/u, "");
-}
-function appendPathname(basePathname, pathname) {
-	return `${normalizePathname(basePathname)}${pathname.startsWith("/") ? pathname : `/${pathname}`}`;
-}
-//#endregion
 //#region src/sql/service.ts
 var SqlClientFactory = class extends Service$1()("t3cli/SqlClientFactory") {};
 //#endregion
-//#region src/auth/schema.ts
-const AuthAccessTokenResultSchema = Struct({
-	access_token: String$1,
-	issued_token_type: String$1,
-	token_type: Literal("Bearer"),
-	expires_in: Number$1,
-	scope: String$1
-});
-const AuthSessionStateSchema = Struct({
-	authenticated: Boolean$1,
-	role: optionalKey(Literals(["owner", "client"])),
-	sessionMethod: optionalKey(String$1),
-	expiresAt: optionalKey(String$1)
-});
-const AuthWebSocketTicketResultSchema = Struct({
-	ticket: String$1,
-	expiresAt: String$1
-});
-const AuthLocalRuntimeStateSchema = Struct({
-	version: Literal(1),
-	origin: String$1
-});
-const decodeAuthAccessTokenResult = decodeUnknownEffect(AuthAccessTokenResultSchema);
-const decodeAuthSessionState = decodeUnknownEffect(AuthSessionStateSchema);
-const decodeAuthWebSocketTicketResult = decodeUnknownEffect(AuthWebSocketTicketResultSchema);
-decodeUnknownEffect(AuthLocalRuntimeStateSchema);
-const decodeAuthLocalRuntimeStateFromJson = decodeUnknownEffect(fromJsonString(AuthLocalRuntimeStateSchema));
-//#endregion
-//#region src/auth/local.ts
-var T3LocalAuth = class extends Service$1()("t3cli/T3LocalAuth") {};
-const makeT3LocalAuth = fn("makeT3LocalAuth")(function* () {
+//#region src/auth/local-token.ts
+var T3LocalAuthToken = class extends Service$1()("t3cli/T3LocalAuthToken") {};
+const makeT3LocalAuthToken = fn("makeT3LocalAuthToken")(function* () {
 	const fs = yield* FileSystem;
 	const path = yield* Path;
 	const environment = yield* Environment;
 	const crypto = yield* Crypto;
 	const sqlClientFactory = yield* SqlClientFactory;
-	function resolveLocalBaseDir(input) {
-		const envBaseDir = environment.env["T3CODE_HOME"];
-		const raw = input ?? envBaseDir;
-		if (raw === void 0 || raw.length === 0) return path.join(environment.homeDir, ".t3");
-		if (raw === "~") return environment.homeDir;
-		if (raw.startsWith("~/") || raw.startsWith("~\\")) return path.join(environment.homeDir, raw.slice(2));
-		return path.resolve(environment.cwd, raw);
-	}
-	function resolveLocalOrigin(input) {
-		return gen(function* () {
-			if (input.origin !== void 0) return yield* normalizeLocalOrigin(input.origin);
-			const runtimeStatePath = path.join(input.baseDir, "userdata", "server-runtime.json");
-			return yield* normalizeLocalOrigin((yield* decodeAuthLocalRuntimeStateFromJson(yield* fs.readFileString(runtimeStatePath).pipe(mapError$2((error) => new AuthLocalError({
-				message: `local runtime state not found: ${runtimeStatePath}. Make sure T3 Code is running with Network access enabled, or pass --origin manually.`,
-				cause: error
-			})))).pipe(mapError$2((error) => new AuthLocalError({
-				message: "local runtime state has invalid shape",
-				cause: error
-			})))).origin);
-		});
-	}
 	function readSigningSecret(secretPath) {
 		return fs.readFile(secretPath).pipe(map$3((bytes) => Uint8Array.from(bytes)), catchFilter$2(reason("PlatformError", "NotFound"), () => succeed$2(void 0)), mapError$2((error) => new AuthLocalSecretError({
 			message: `failed to read signing secret: ${secretPath}`,
@@ -66667,10 +66687,14 @@ const makeT3LocalAuth = fn("makeT3LocalAuth")(function* () {
 			expiresAt: formatIso(expiresAt)
 		};
 	});
-	return { local: fn("T3LocalAuthLive.local")(function* (input) {
+	return { create: fn("T3LocalAuthTokenLive.create")(function* (input) {
 		if (input.label.length === 0) return yield* fail$2(new AuthLocalError({ message: "local auth label cannot be empty" }));
 		if (input.subject.length === 0) return yield* fail$2(new AuthLocalError({ message: "local auth subject cannot be empty" }));
-		const baseDir = resolveLocalBaseDir(input.baseDir);
+		const baseDir = resolveLocalBaseDir({
+			baseDir: input.baseDir,
+			environment,
+			path
+		});
 		const session = yield* issueLocalDatabaseSession({
 			dbPath: path.join(baseDir, "userdata", "state.sqlite"),
 			secretsDir: path.join(baseDir, "userdata", "secrets"),
@@ -66682,10 +66706,6 @@ const makeT3LocalAuth = fn("makeT3LocalAuth")(function* () {
 			cause: error
 		})));
 		return {
-			url: yield* resolveLocalOrigin({
-				baseDir,
-				...input.origin !== void 0 ? { origin: input.origin } : {}
-			}),
 			token: session.token,
 			role: session.role,
 			expiresAt: session.expiresAt,
@@ -66694,7 +66714,7 @@ const makeT3LocalAuth = fn("makeT3LocalAuth")(function* () {
 		};
 	}) };
 });
-const T3LocalAuthLive = effect(T3LocalAuth, makeT3LocalAuth());
+const T3LocalAuthTokenLive = effect(T3LocalAuthToken, makeT3LocalAuthToken());
 function insertAuthSession(input) {
 	return gen(function* () {
 		const sql = yield* SqlClient;
@@ -66738,12 +66758,6 @@ function insertAuthSession(input) {
     `;
 	});
 }
-function normalizeLocalOrigin(origin) {
-	return normalizeHttpBaseUrl(origin).pipe(mapError$2((error) => new AuthLocalError({
-		message: error.message,
-		cause: error
-	})));
-}
 const defaultSessionTtlMs = 720 * 60 * 60 * 1e3;
 const signingSecretName = "server-signing-key";
 const sha256BlockSize = 64;
@@ -66754,6 +66768,28 @@ function concatBytes(first, second) {
 	return bytes;
 }
 //#endregion
+//#region src/auth/local.ts
+var T3LocalAuth = class extends Service$1()("t3cli/T3LocalAuth") {};
+const makeT3LocalAuth = fn("makeT3LocalAuth")(function* () {
+	const origin = yield* T3LocalAuthOrigin;
+	const token = yield* T3LocalAuthToken;
+	return { local: fn("T3LocalAuthLive.local")(function* (input) {
+		const created = yield* token.create(input);
+		return {
+			url: yield* origin.resolve({
+				baseDir: created.baseDir,
+				...input.origin !== void 0 ? { origin: input.origin } : {}
+			}),
+			token: created.token,
+			role: created.role,
+			expiresAt: created.expiresAt,
+			source: "local",
+			baseDir: created.baseDir
+		};
+	}) };
+});
+const T3LocalAuthLive = effect(T3LocalAuth, makeT3LocalAuth());
+//#endregion
 //#region src/auth/transport.ts
 var T3AuthTransport = class extends Service$1()("t3cli/T3AuthTransport") {};
 const T3AuthTransportLive = effect(T3AuthTransport, fn("makeT3AuthTransport")(function* () {
@@ -66788,8 +66824,8 @@ const T3AuthTransportLive = effect(T3AuthTransport, fn("makeT3AuthTransport")(fu
 				sessionToken: result.access_token
 			};
 		}),
-		getSession: fn("AuthTransport.getSession")(function* (config) {
-			const request = get$1(yield* makeHttpEndpointUrl(config.url, "/api/auth/session")).pipe(authenticatedRequest(config));
+		getSession: fn("AuthTransport.getSession")(function* (connection) {
+			const request = get$1(yield* makeHttpEndpointUrl(connection.url, "/api/auth/session")).pipe(authenticatedRequest(connection));
 			return yield* (yield* client.execute(request).pipe(catchTags$1({ HttpClientError: (error) => fail$2(new AuthTransportError({
 				message: "auth request failed",
 				cause: HttpClientErrorSchema.fromHttpClientError(error)
@@ -66804,8 +66840,8 @@ const T3AuthTransportLive = effect(T3AuthTransport, fn("makeT3AuthTransport")(fu
 				}))
 			}));
 		}),
-		issueWebSocketTicket: fn("AuthTransport.issueWebSocketTicket")(function* (config) {
-			const request = post$1(yield* makeHttpEndpointUrl(config.url, "/api/auth/websocket-ticket")).pipe(authenticatedRequest(config));
+		issueWebSocketTicket: fn("AuthTransport.issueWebSocketTicket")(function* (connection) {
+			const request = post$1(yield* makeHttpEndpointUrl(connection.url, "/api/auth/websocket-ticket")).pipe(authenticatedRequest(connection));
 			return yield* (yield* client.execute(request).pipe(catchTags$1({ HttpClientError: (error) => fail$2(new AuthTransportError({
 				message: "auth request failed",
 				cause: HttpClientErrorSchema.fromHttpClientError(error)
@@ -66822,7 +66858,7 @@ const T3AuthTransportLive = effect(T3AuthTransport, fn("makeT3AuthTransport")(fu
 		})
 	};
 })());
-const authenticatedRequest = (config) => (request) => request.pipe(acceptJson, bearerToken(config.token));
+const authenticatedRequest = (connection) => (request) => request.pipe(acceptJson, bearerToken(connection.token));
 function makeHttpEndpointUrl(baseUrl, path) {
 	return toHttpEndpointUrl(baseUrl, path).pipe(catchTags$1({ UrlError: (error) => fail$2(new AuthTransportError({
 		message: "auth request failed",
@@ -66935,6 +66971,21 @@ const makeT3Auth = fn("makeT3Auth")(function* () {
 });
 const T3AuthLive = effect(T3Auth, makeT3Auth());
 //#endregion
+//#region src/connection/error.ts
+var T3CodeConnectionError = class extends TaggedErrorClass()("T3CodeConnectionError", {
+	message: String$1,
+	cause: optionalKey(Unknown)
+}) {};
+//#endregion
+//#region src/connection/service.ts
+var T3CodeConnectionProvider = class extends Service$1()("t3cli/T3CodeConnectionProvider") {};
+function makeT3CodeConnectionProvider(get) {
+	return { get };
+}
+function T3CodeConnectionProviderLive(connection) {
+	return succeed$3(T3CodeConnectionProvider, makeT3CodeConnectionProvider(succeed$2(connection)));
+}
+//#endregion
 //#region src/config/layer.ts
 const makeT3Config = fn("makeT3Config")(function* () {
 	const fs = yield* FileSystem;
@@ -70260,11 +70311,8 @@ const RpcErrorCauseSchema = Union([
 	OrchestrationDispatchCommandError,
 	OrchestrationGetSnapshotError,
 	ServerSettingsError,
-	AuthConfigError,
-	AuthLocalError,
-	AuthPairingUrlError,
 	AuthTransportError,
-	ConfigError,
+	T3CodeConnectionError,
 	HttpClientErrorSchema,
 	UrlError,
 	instanceOf(SchemaError)
@@ -70867,17 +70915,18 @@ const makeClient = make$1(make$5(WsOrchestrationDispatchCommandRpc, WsOrchestrat
 })));
 const connectionRetrySchedule = exponential("100 millis").pipe(take$2(4));
 const makeT3RpcLayer = fn("makeT3RpcLayer")(function* () {
-	const config = yield* T3Config;
-	const auth = yield* T3Auth;
+	const connectionProvider = yield* T3CodeConnectionProvider;
+	const authTransport = yield* T3AuthTransport;
+	const webSocketConstructor = yield* WebSocketConstructor;
 	const parentScope = yield* Scope;
 	const connection = yield* make(none());
 	const openConnection = fn("T3RpcLive.openConnection")(function* () {
 		const scope = yield* fork(parentScope);
 		return yield* gen(function* () {
 			const protocol = yield* buildWithScope(makeProtocolLayer(yield* makeWsUrl({
-				auth,
-				config
-			})), scope);
+				authTransport,
+				connectionProvider
+			}), webSocketConstructor), scope);
 			return {
 				scope,
 				client: yield* makeClient.pipe(provide(protocol), provideService$1(Scope, scope))
@@ -70904,12 +70953,16 @@ const makeT3RpcLayer = fn("makeT3RpcLayer")(function* () {
 	};
 });
 const makeWsUrl = fn("makeWsUrl")(function* (input) {
-	const resolved = yield* input.config.resolve();
-	const wsTicket = yield* input.auth.issueWebSocketTicket();
-	return getOrThrow(toUrl(get$1(yield* toWebSocketEndpointUrl(resolved.url, "/ws")).pipe(setUrlParam("wsTicket", wsTicket.ticket)))).toString();
+	const connection = yield* input.connectionProvider.get;
+	const origin = yield* normalizeHttpBaseUrl(connection.origin.url);
+	const wsTicket = yield* input.authTransport.issueWebSocketTicket({
+		url: origin,
+		token: connection.auth.token
+	});
+	return getOrThrow(toUrl(get$1(yield* toWebSocketEndpointUrl(origin, "/ws")).pipe(setUrlParam("wsTicket", wsTicket.ticket)))).toString();
 });
-function makeProtocolLayer(url) {
-	const socketLayer = layerWebSocket(url).pipe(provide$2(layerWebSocketConstructor));
+function makeProtocolLayer(url, webSocketConstructor) {
+	const socketLayer = layerWebSocket(url).pipe(provide$2(succeed$3(WebSocketConstructor, webSocketConstructor)));
 	return layerProtocolSocket({ retryTransientErrors: true }).pipe(provide$2(socketLayer), provide$2(layerJson));
 }
 const T3RpcLive = effectContext(makeT3RpcLayer().pipe(map$3((rpc) => make$40(T3Rpc, rpc))));
@@ -71423,13 +71476,24 @@ function toSqlInputValue(value) {
 //#endregion
 //#region src/runtime.ts
 const T3AuthTransportLayer = T3AuthTransportLive.pipe(provide$2(layerUndici));
-const T3LocalAuthLayer = T3LocalAuthLive.pipe(provide$2(NodeSqlClientFactoryLive));
+const T3LocalAuthOriginLayer = T3LocalAuthOriginLive;
+const T3LocalAuthTokenLayer = T3LocalAuthTokenLive.pipe(provide$2(NodeSqlClientFactoryLive));
+const T3LocalAuthLayer = T3LocalAuthLive.pipe(provide$2(mergeAll$1(T3LocalAuthOriginLayer, T3LocalAuthTokenLayer)));
 const T3AuthPairingLayer = T3AuthPairingLive.pipe(provide$2(T3AuthTransportLayer));
 const T3AuthLayer = T3AuthLive.pipe(provide$2(mergeAll$1(T3ConfigLive, T3AuthTransportLayer, T3LocalAuthLayer, T3AuthPairingLayer)));
-const T3RpcLayer = T3RpcLive.pipe(provide$2(mergeAll$1(T3ConfigLive, T3AuthLayer, layerWebSocketConstructor)));
+const T3ConfigConnectionProviderLayer = effect(T3CodeConnectionProvider, gen(function* () {
+	return makeT3CodeConnectionProvider((yield* T3Config).resolve().pipe(map$3((resolved) => ({
+		origin: { url: resolved.url },
+		auth: { token: resolved.token }
+	})), mapError$2((error) => new T3CodeConnectionError({
+		message: "failed to resolve T3 Code connection from CLI config",
+		cause: error
+	}))));
+})).pipe(provide$2(T3ConfigLive));
+const T3RpcLayer = T3RpcLive.pipe(provide$2(mergeAll$1(T3ConfigConnectionProviderLayer, T3AuthTransportLayer, layerWebSocketConstructor)));
 const T3OrchestrationLayer = T3OrchestrationLive.pipe(provide$2(T3RpcLayer));
 const T3ApplicationLayer = T3ApplicationLive.pipe(provide$2(T3OrchestrationLayer));
 const AuthAppLayer = mergeAll$1(T3ConfigLive, T3AuthLayer);
 const AppLayer = mergeAll$1(T3ConfigLive, T3AuthLayer, T3RpcLayer, T3OrchestrationLayer, T3ApplicationLayer);
 //#endregion
-export { is as $, sync$2 as $n, catchFilter$2 as $t, UrlError as A, timeoutOrElse as An, dual as Ar, tap as At, Boolean$1 as B, mergeAll$1 as Bn, offer as Bt, AuthLocalDatabaseError as C, scoped$2 as Cn, format$1 as Cr, run$1 as Ct, AuthPairingUrlError as D, sync as Dn, isNullish as Dr, runLast as Dt, AuthLocalSigningError as E, suspend$3 as En, isNotUndefined as Er, runFold as Et, T3Application as F, TaggedError as Fn, __require as Fr, drain as Ft, Literals as G, MinimumLogLevel as Gn, nominal as Gt, ErrorClass as H, provideMerge as Hn, BadArgument as Ht, Environment as I, fail$3 as In, __toESM as Ir, isSink as It, TaggedErrorClass as J, isDone$1 as Jn, addFinalizer as Jt, String$1 as K, _await as Kn, transform as Kt, T3Config as L, hasInterruptsOnly as Ln, endUnsafe as Lt, ThreadSessionError as M, try_ as Mn, pipe as Mr, unwrap as Mt, latestAssistantMessage as N, uninterruptible as Nn, pipeArguments as Nr, get$2 as Nt, AuthTransportError as O, tapCause as On, isUndefined as Or, splitLines as Ot, threadStatus as P, void_$1 as Pn, __commonJSMin as Pr, make$25 as Pt, fromJsonString as Q, ConsoleRef as Qn, callback$1 as Qt, T3Auth as R, squash as Rn, failCauseUnsafe as Rt, AuthConfigError as S, runFork as Sn, BaseProto as Sr, mkString as St, AuthLocalSecretError as T, succeed$2 as Tn, isNotNull as Tr, runDrain as Tt, Int as U, succeed$3 as Un, badArgument as Ut, Defect as V, provide$2 as Vn, offerUnsafe as Vt, Literal as W, sync$1 as Wn, systemError as Wt, decodeTo as X, isSuccess as Xn, as as Xt, Union as Y, makeUnsafe$8 as Yn, andThen as Yt, decodeUnknownEffect as Z, succeed$4 as Zn, asVoid as Zt, parsePairingUrl as _, orDie as _n, none as _r, decodeText as _t, T3AuthTransportLayer as a, fn as an, empty$11 as ar, make$23 as at, makeT3LocalAuth as b, provideService$1 as bn, PipeInspectableProto as br, isStream as bt, NodeSqliteClientLive as c, forkScoped as cn, flatMap$4 as cr, Path as ct, makeT3Config as d, interrupt$1 as dn, getOrElse$1 as dr, FileSystem as dt, catchTags$1 as en, map$5 as er, optional as et, T3AuthLive as f, isEffect as fn, getOrUndefined as fr, FileTypeId as ft, makeT3AuthPairing as g, matchEffect as gn, match$3 as gr, callback as gt, T3AuthPairingLive as h, mapError$2 as hn, map$7 as hr, make$24 as ht, T3AuthPairingLayer as i, flatMap$2 as in, Service$1 as ir, Crypto as it, NodeEnvironmentLive as j, tryPromise as jn, identity as jr, transduce as jt, ConfigError as k, tapError$2 as kn, constVoid as kr, succeed as kt, makeNodeSqliteClient as l, gen as ln, fromNullishOr as lr, TypeId$29 as lt, T3AuthPairing as m, map$3 as mn, isSome as mr, WatchBackend as mt, AuthAppLayer as n, effectify as nn, succeed$6 as nr, tag as nt, T3LocalAuthLayer as o, fnUntraced as on, getUnsafe$2 as or, fromReadable as ot, makeT3Auth as p, logError as pn, isNone as pr, Size as pt, Struct as q, doneUnsafe as qn, acquireRelease as qt, T3AuthLayer as r, fail$2 as rn, Reference as rr, toCodecStringTree as rt, NodeSqlClientFactoryLive as s, forEach$1 as sn, make$40 as sr, fromWritable as st, AppLayer as t, catch_$1 as tn, fail$6 as tr, optionalKey as tt, T3ConfigLive as u, ignore$1 as un, fromUndefinedOr as ur, FileDescriptor as ut, T3LocalAuth as v, provide as vn, some as vr, empty$6 as vt, AuthLocalError as w, serviceOption as wn, hasProperty as wr, runCollect as wt, SqlClientFactory as x, result as xn, withFiber$1 as xr, merge$1 as xt, T3LocalAuthLive as y, provideContext$2 as yn, Prototype as yr, fromIterable$1 as yt, ArraySchema as z, effect as zn, make$27 as zt };
+export { T3Config as $, hasInterruptsOnly as $n, endUnsafe as $t, T3LocalAuthTokenLive as A, map$3 as An, isSome as Ar, WatchBackend as At, AuthLocalSigningError as B, serviceOption as Bn, hasProperty as Br, runCollect as Bt, makeT3AuthPairing as C, forEach$1 as Cn, make$40 as Cr, fromWritable as Ct, T3LocalAuthLive as D, interrupt$1 as Dn, getOrElse$1 as Dr, FileSystem as Dt, T3LocalAuth as E, ignore$1 as En, fromUndefinedOr as Er, FileDescriptor as Et, makeT3LocalAuthOrigin as F, provideContext$2 as Fn, Prototype as Fr, fromIterable$1 as Ft, layerWebSocketConstructor as G, tapError$2 as Gn, constVoid as Gr, succeed as Gt, AuthTransportError as H, suspend$3 as Hn, isNotUndefined as Hr, runFold as Ht, AuthConfigError as I, provideService$1 as In, PipeInspectableProto as Ir, isStream as It, ThreadSessionError as J, try_ as Jn, pipe as Jr, unwrap as Jt, layerUndici as K, timeoutOrElse as Kn, dual as Kr, tap as Kt, AuthLocalDatabaseError as L, result as Ln, withFiber$1 as Lr, merge$1 as Lt, SqlClientFactory as M, matchEffect as Mn, match$3 as Mr, callback as Mt, T3LocalAuthOrigin as N, orDie as Nn, none as Nr, decodeText as Nt, makeT3LocalAuth as O, isEffect as On, getOrUndefined as Or, FileTypeId as Ot, T3LocalAuthOriginLive as P, provide as Pn, some as Pr, empty$6 as Pt, Environment as Q, fail$3 as Qn, __toESM as Qr, isSink as Qt, AuthLocalError as R, runFork as Rn, BaseProto as Rr, mkString as Rt, T3AuthPairingLive as S, fnUntraced as Sn, getUnsafe$2 as Sr, fromReadable as St, T3AuthTransportLive as T, gen as Tn, fromNullishOr as Tr, TypeId$29 as Tt, ConfigError as U, sync as Un, isNullish as Ur, runLast as Ut, AuthPairingUrlError as V, succeed$2 as Vn, isNotNull as Vr, runDrain as Vt, UrlError as W, tapCause as Wn, isUndefined as Wr, splitLines as Wt, threadStatus as X, void_$1 as Xn, __commonJSMin as Xr, make$25 as Xt, latestAssistantMessage as Y, uninterruptible as Yn, pipeArguments as Yr, get$2 as Yt, T3Application as Z, TaggedError as Zn, __require as Zr, drain as Zt, makeT3CodeConnectionProvider as _, catch_$1 as _n, fail$6 as _r, optionalKey as _t, T3AuthTransportLayer as a, badArgument as an, succeed$3 as ar, Int as at, makeT3Auth as b, flatMap$2 as bn, Service$1 as br, Crypto as bt, T3LocalAuthTokenLayer as c, transform as cn, _await as cr, String$1 as ct, makeNodeSqliteClient as d, andThen as dn, makeUnsafe$8 as dr, Union as dt, failCauseUnsafe as en, squash as er, T3Auth as et, T3RpcLive as f, as as fn, isSuccess as fr, decodeTo as ft, T3CodeConnectionProviderLive as g, catchTags$1 as gn, map$5 as gr, optional as gt, T3CodeConnectionProvider as h, catchFilter$2 as hn, sync$2 as hr, is as ht, T3AuthPairingLayer as i, BadArgument as in, provideMerge as ir, ErrorClass as it, makeT3LocalAuthToken as j, mapError$2 as jn, map$7 as jr, make$24 as jt, T3LocalAuthToken as k, logError as kn, isNone as kr, Size as kt, NodeSqlClientFactoryLive as l, acquireRelease as ln, doneUnsafe as lr, Struct as lt, makeT3Config as m, callback$1 as mn, ConsoleRef as mr, fromJsonString as mt, AuthAppLayer as n, offer as nn, mergeAll$1 as nr, Boolean$1 as nt, T3LocalAuthLayer as o, systemError as on, sync$1 as or, Literal as ot, T3ConfigLive as p, asVoid as pn, succeed$4 as pr, decodeUnknownEffect as pt, NodeEnvironmentLive as q, tryPromise as qn, identity as qr, transduce as qt, T3AuthLayer as r, offerUnsafe as rn, provide$2 as rr, Defect as rt, T3LocalAuthOriginLayer as s, nominal as sn, MinimumLogLevel as sr, Literals as st, AppLayer as t, make$27 as tn, effect as tr, ArraySchema as tt, NodeSqliteClientLive as u, addFinalizer as un, isDone$1 as ur, TaggedErrorClass as ut, T3CodeConnectionError as v, effectify as vn, succeed$6 as vr, tag as vt, parsePairingUrl as w, forkScoped as wn, flatMap$4 as wr, Path as wt, T3AuthPairing as x, fn as xn, empty$11 as xr, make$23 as xt, T3AuthLive as y, fail$2 as yn, Reference as yr, toCodecStringTree as yt, AuthLocalSecretError as z, scoped$2 as zn, format$1 as zr, run$1 as zt };

package/dist/src/auth/local-base-dir.d.ts

@@ -0,0 +1,7 @@
+import type * as Path from "effect/Path";
+import type { EnvironmentShape } from "../environment/service.ts";
+export declare function resolveLocalBaseDir(input: {
+    readonly baseDir: string | undefined;
+    readonly environment: EnvironmentShape;
+    readonly path: Path.Path;
+}): string;

package/dist/src/auth/local-origin.d.ts

@@ -0,0 +1,18 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import { Environment } from "../environment/service.ts";
+import { AuthLocalError } from "./error.ts";
+import type { LocalAuthOriginInput } from "./type.ts";
+declare const T3LocalAuthOrigin_base: Context.ServiceClass<T3LocalAuthOrigin, "t3cli/T3LocalAuthOrigin", {
+    readonly resolve: (input?: LocalAuthOriginInput) => Effect.Effect<string, AuthLocalError>;
+}>;
+export declare class T3LocalAuthOrigin extends T3LocalAuthOrigin_base {
+}
+export declare const makeT3LocalAuthOrigin: () => Effect.Effect<{
+    resolve: (input?: LocalAuthOriginInput | undefined) => Effect.Effect<string, AuthLocalError, never>;
+}, never, Environment | Path.Path | FileSystem.FileSystem>;
+export declare const T3LocalAuthOriginLive: Layer.Layer<T3LocalAuthOrigin, never, Environment | Path.Path | FileSystem.FileSystem>;
+export {};

package/dist/src/auth/local-token.d.ts

@@ -0,0 +1,26 @@
+import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import { Environment } from "../environment/service.ts";
+import { SqlClientFactory } from "../sql/service.ts";
+import { AuthLocalError } from "./error.ts";
+import type { LocalAuthTokenInput, LocalAuthTokenResult } from "./type.ts";
+declare const T3LocalAuthToken_base: Context.ServiceClass<T3LocalAuthToken, "t3cli/T3LocalAuthToken", {
+    readonly create: (input: LocalAuthTokenInput) => Effect.Effect<LocalAuthTokenResult, AuthLocalError>;
+}>;
+export declare class T3LocalAuthToken extends T3LocalAuthToken_base {
+}
+export declare const makeT3LocalAuthToken: () => Effect.Effect<{
+    create: (input: LocalAuthTokenInput) => Effect.Effect<{
+        token: string;
+        role: "client" | "owner";
+        expiresAt: string;
+        source: "local";
+        baseDir: string;
+    }, AuthLocalError, never>;
+}, never, Environment | Path.Path | FileSystem.FileSystem | SqlClientFactory | Crypto.Crypto>;
+export declare const T3LocalAuthTokenLive: Layer.Layer<T3LocalAuthToken, never, Environment | Path.Path | FileSystem.FileSystem | SqlClientFactory | Crypto.Crypto>;
+export {};

package/dist/src/auth/local.d.ts

@@ -1,12 +1,9 @@
 import * as Context from "effect/Context";
-import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
-import * as Path from "effect/Path";
-import { Environment } from "../environment/service.ts";
-import { SqlClientFactory } from "../sql/service.ts";
 import { AuthLocalError } from "./error.ts";
+import { T3LocalAuthOrigin } from "./local-origin.ts";
+import { T3LocalAuthToken } from "./local-token.ts";
 import type { LocalAuthInput, LocalAuthResult } from "./type.ts";
 declare const T3LocalAuth_base: Context.ServiceClass<T3LocalAuth, "t3cli/T3LocalAuth", {
     readonly local: (input: LocalAuthInput) => Effect.Effect<LocalAuthResult, AuthLocalError>;
@@ -22,6 +19,6 @@ export declare const makeT3LocalAuth: () => Effect.Effect<{
         source: "local";
         baseDir: string;
     }, AuthLocalError, never>;
-}, never, Environment | SqlClientFactory | Path.Path | FileSystem.FileSystem | Crypto.Crypto>;
-export declare const T3LocalAuthLive: Layer.Layer<T3LocalAuth, never, Environment | SqlClientFactory | Path.Path | FileSystem.FileSystem | Crypto.Crypto>;
+}, never, T3LocalAuthOrigin | T3LocalAuthToken>;
+export declare const T3LocalAuthLive: Layer.Layer<T3LocalAuth, never, T3LocalAuthOrigin | T3LocalAuthToken>;
 export {};

package/dist/src/auth/transport.d.ts

@@ -2,16 +2,19 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { HttpClient } from "effect/unstable/http";
-import type { ResolvedConfig } from "../config/service.ts";
 import { AuthTransportError } from "./error.ts";
 import { type AuthBearerBootstrapResult, type AuthSessionState, type AuthWebSocketTicketResult } from "./schema.ts";
+export type AuthTransportConnection = {
+    readonly url: string;
+    readonly token: string;
+};
 declare const T3AuthTransport_base: Context.ServiceClass<T3AuthTransport, "t3cli/T3AuthTransport", {
     readonly bootstrapBearer: (input: {
         readonly baseUrl: string;
         readonly credential: string;
     }) => Effect.Effect<AuthBearerBootstrapResult, AuthTransportError>;
-    readonly getSession: (config: ResolvedConfig) => Effect.Effect<AuthSessionState, AuthTransportError>;
-    readonly issueWebSocketTicket: (config: ResolvedConfig) => Effect.Effect<AuthWebSocketTicketResult, AuthTransportError>;
+    readonly getSession: (connection: AuthTransportConnection) => Effect.Effect<AuthSessionState, AuthTransportError>;
+    readonly issueWebSocketTicket: (connection: AuthTransportConnection) => Effect.Effect<AuthWebSocketTicketResult, AuthTransportError>;
 }>;
 export declare class T3AuthTransport extends T3AuthTransport_base {
 }