t3code-cli 0.5.0 → 0.5.1

package/src/auth/local.ts

@@ -1,30 +1,10 @@
-import {
-  AuthAdministrativeScopes,
-  AuthSessionId,
-  type AuthEnvironmentScope,
-} from "#t3tools/contracts";
 import * as Context from "effect/Context";
-import * as Crypto from "effect/Crypto";
-import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
-import * as Encoding from "effect/Encoding";
-import * as Filter from "effect/Filter";
-import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
-import * as Path from "effect/Path";
-import * as Predicate from "effect/Predicate";
-import * as SqlClient from "effect/unstable/sql/SqlClient";
 
-import { normalizeHttpBaseUrl } from "../config/url.ts";
-import { Environment } from "../environment/service.ts";
-import { SqlClientFactory } from "../sql/service.ts";
-import {
-  AuthLocalDatabaseError,
-  AuthLocalError,
-  AuthLocalSecretError,
-  AuthLocalSigningError,
-} from "./error.ts";
-import { decodeAuthLocalRuntimeStateFromJson } from "./schema.ts";
+import { AuthLocalError } from "./error.ts";
+import { T3LocalAuthOrigin } from "./local-origin.ts";
+import { T3LocalAuthToken } from "./local-token.ts";
 import type { LocalAuthInput, LocalAuthResult } from "./type.ts";
 
 export class T3LocalAuth extends Context.Service<
@@ -35,220 +15,22 @@ export class T3LocalAuth extends Context.Service<
 >()("t3cli/T3LocalAuth") {}
 
 export const makeT3LocalAuth = Effect.fn("makeT3LocalAuth")(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-  const environment = yield* Environment;
-  const crypto = yield* Crypto.Crypto;
-  const sqlClientFactory = yield* SqlClientFactory;
-
-  function resolveLocalBaseDir(input: string | undefined) {
-    const envBaseDir = environment.env["T3CODE_HOME"];
-    const raw = input ?? envBaseDir;
-    if (raw === undefined || raw.length === 0) {
-      return path.join(environment.homeDir, ".t3");
-    }
-    if (raw === "~") {
-      return environment.homeDir;
-    }
-    if (raw.startsWith("~/") || raw.startsWith("~\\")) {
-      return path.join(environment.homeDir, raw.slice(2));
-    }
-    return path.resolve(environment.cwd, raw);
-  }
-
-  function resolveLocalOrigin(input: { readonly baseDir: string; readonly origin?: string }) {
-    return Effect.gen(function* () {
-      if (input.origin !== undefined) {
-        return yield* normalizeLocalOrigin(input.origin);
-      }
-
-      const runtimeStatePath = path.join(input.baseDir, "userdata", "server-runtime.json");
-      const raw = yield* fs.readFileString(runtimeStatePath).pipe(
-        Effect.mapError(
-          (error) =>
-            new AuthLocalError({
-              message: `local runtime state not found: ${runtimeStatePath}. Make sure T3 Code is running with Network access enabled, or pass --origin manually.`,
-              cause: error,
-            }),
-        ),
-      );
-      const state = yield* decodeAuthLocalRuntimeStateFromJson(raw).pipe(
-        Effect.mapError(
-          (error) =>
-            new AuthLocalError({ message: "local runtime state has invalid shape", cause: error }),
-        ),
-      );
-      return yield* normalizeLocalOrigin(state.origin);
-    });
-  }
-
-  function readSigningSecret(secretPath: string) {
-    return fs.readFile(secretPath).pipe(
-      Effect.map((bytes) => Uint8Array.from(bytes)),
-      Effect.catchFilter(Filter.reason("PlatformError", "NotFound"), () =>
-        Effect.succeed(undefined),
-      ),
-      Effect.mapError(
-        (error) =>
-          new AuthLocalSecretError({
-            message: `failed to read signing secret: ${secretPath}`,
-            cause: error,
-          }),
-      ),
-    );
-  }
-
-  const readRequiredSigningSecret = Effect.fn("readRequiredSigningSecret")(function* (
-    secretsDir: string,
-  ) {
-    const secretPath = path.join(secretsDir, `${signingSecretName}.bin`);
-    const secret = yield* readSigningSecret(secretPath);
-    if (secret === undefined) {
-      return yield* Effect.fail(
-        new AuthLocalSecretError({
-          message: `local signing secret not found: ${secretPath}`,
-        }),
-      );
-    }
-    return secret;
-  });
-
-  const hmacSha256 = (secret: Uint8Array, payload: Uint8Array) =>
-    Effect.gen(function* () {
-      const key =
-        secret.byteLength > sha256BlockSize ? yield* crypto.digest("SHA-256", secret) : secret;
-      const block = new Uint8Array(sha256BlockSize);
-      block.set(key);
-      const outerPad = block.map((byte) => byte ^ 0x5c);
-      const innerPad = block.map((byte) => byte ^ 0x36);
-      const innerHash = yield* crypto.digest("SHA-256", concatBytes(innerPad, payload));
-      return yield* crypto.digest("SHA-256", concatBytes(outerPad, innerHash));
-    });
-
-  const signPayload = (payload: string, secret: Uint8Array) =>
-    hmacSha256(secret, new TextEncoder().encode(payload)).pipe(
-      Effect.map(Encoding.encodeBase64Url),
-      Effect.mapError(
-        (error) =>
-          new AuthLocalSigningError({
-            operation: "sign",
-            message: "failed to sign local auth payload",
-            cause: error,
-          }),
-      ),
-    );
-
-  function openAuthDatabase(dbPath: string) {
-    return sqlClientFactory.sqliteClient({ filename: dbPath }).pipe(
-      Effect.catchTag("SqlError", (error) =>
-        Effect.fail(
-          new AuthLocalDatabaseError({
-            operation: "connect",
-            message: error.message,
-          }),
-        ),
-      ),
-    );
-  }
-
-  const provideAuthDatabase =
-    (dbPath: string) =>
-    <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-      Effect.gen(function* () {
-        const sql = yield* openAuthDatabase(dbPath);
-        return yield* effect.pipe(Effect.provideService(SqlClient.SqlClient, sql));
-      }).pipe(Effect.scoped);
-
-  const issueLocalDatabaseSession = Effect.fn("issueLocalDatabaseSession")(function* (
-    input: LocalDatabaseSessionInput,
-  ) {
-    const secret = yield* readRequiredSigningSecret(input.secretsDir);
-    const issuedAt = yield* DateTime.now;
-    const expiresAt = DateTime.add(issuedAt, { milliseconds: defaultSessionTtlMs });
-    const sessionId = yield* crypto.randomUUIDv4.pipe(
-      Effect.map((id) => AuthSessionId.make(id)),
-      Effect.mapError(
-        (error) =>
-          new AuthLocalSecretError({
-            message: "failed to generate auth session id",
-            cause: error,
-          }),
-      ),
-    );
-    const scopes = [...AuthAdministrativeScopes];
-    const claims: LocalSessionClaims = {
-      v: 1,
-      kind: "session",
-      sid: sessionId,
-      sub: input.subject,
-      scopes,
-      method: "bearer-access-token",
-      iat: DateTime.toEpochMillis(issuedAt),
-      exp: DateTime.toEpochMillis(expiresAt),
-    };
-    const encodedPayload = Encoding.encodeBase64Url(JSON.stringify(claims));
-    const token = `${encodedPayload}.${yield* signPayload(encodedPayload, secret)}`;
-    yield* insertAuthSession({
-      sessionId,
-      subject: input.subject,
-      scopes,
-      label: input.label,
-      issuedAt: DateTime.formatIso(issuedAt),
-      expiresAt: DateTime.formatIso(expiresAt),
-    }).pipe(
-      provideAuthDatabase(input.dbPath),
-      Effect.catchTag("SqlError", (error) =>
-        Effect.fail(
-          new AuthLocalDatabaseError({
-            operation: Predicate.isTagged(error.reason, "ConnectionError") ? "connect" : "query",
-            message: error.message,
-          }),
-        ),
-      ),
-    );
-    return {
-      token,
-      role: input.role,
-      expiresAt: DateTime.formatIso(expiresAt),
-    };
-  });
+  const origin = yield* T3LocalAuthOrigin;
+  const token = yield* T3LocalAuthToken;
 
   const local = Effect.fn("T3LocalAuthLive.local")(function* (input: LocalAuthInput) {
-    if (input.label.length === 0) {
-      return yield* Effect.fail(
-        new AuthLocalError({ message: "local auth label cannot be empty" }),
-      );
-    }
-    if (input.subject.length === 0) {
-      return yield* Effect.fail(
-        new AuthLocalError({ message: "local auth subject cannot be empty" }),
-      );
-    }
-
-    const baseDir = resolveLocalBaseDir(input.baseDir);
-    const session = yield* issueLocalDatabaseSession({
-      dbPath: path.join(baseDir, "userdata", "state.sqlite"),
-      secretsDir: path.join(baseDir, "userdata", "secrets"),
-      role: input.role,
-      label: input.label,
-      subject: input.subject,
-    }).pipe(
-      Effect.mapError(
-        (error) =>
-          new AuthLocalError({ message: `local auth failed: ${error.message}`, cause: error }),
-      ),
-    );
-    const url = yield* resolveLocalOrigin({
-      baseDir,
+    const created = yield* token.create(input);
+    const url = yield* origin.resolve({
+      baseDir: created.baseDir,
       ...(input.origin !== undefined ? { origin: input.origin } : {}),
     });
     return {
       url,
-      token: session.token,
-      role: session.role,
-      expiresAt: session.expiresAt,
+      token: created.token,
+      role: created.role,
+      expiresAt: created.expiresAt,
       source: "local" as const,
-      baseDir,
+      baseDir: created.baseDir,
     };
   });
 
@@ -256,98 +38,3 @@ export const makeT3LocalAuth = Effect.fn("makeT3LocalAuth")(function* () {
 });
 
 export const T3LocalAuthLive = Layer.effect(T3LocalAuth, makeT3LocalAuth());
-
-function insertAuthSession(input: InsertAuthSessionInput) {
-  return Effect.gen(function* () {
-    const sql = yield* SqlClient.SqlClient;
-    yield* sql`PRAGMA busy_timeout = 5000;`;
-    yield* sql`PRAGMA foreign_keys = ON;`;
-    const columns = yield* sql<{ readonly name: string }>`PRAGMA table_info(auth_sessions)`;
-    if (!columns.some((column) => column.name === "scopes")) {
-      return yield* Effect.fail(
-        new AuthLocalDatabaseError({
-          operation: "schema",
-          message: "local auth database is missing scoped auth_sessions schema",
-        }),
-      );
-    }
-    yield* sql`
-      INSERT INTO auth_sessions (
-        session_id,
-        subject,
-        scopes,
-        method,
-        client_label,
-        client_ip_address,
-        client_user_agent,
-        client_device_type,
-        client_os,
-        client_browser,
-        issued_at,
-        expires_at,
-        revoked_at
-      )
-      VALUES (
-        ${input.sessionId},
-        ${input.subject},
-        ${JSON.stringify(input.scopes)},
-        ${"bearer-access-token"},
-        ${input.label},
-        NULL,
-        NULL,
-        ${"bot"},
-        NULL,
-        NULL,
-        ${input.issuedAt},
-        ${input.expiresAt},
-        NULL
-      )
-    `;
-    return undefined;
-  });
-}
-
-function normalizeLocalOrigin(origin: string) {
-  return normalizeHttpBaseUrl(origin).pipe(
-    Effect.mapError((error) => new AuthLocalError({ message: error.message, cause: error })),
-  );
-}
-
-type LocalSessionClaims = {
-  readonly v: 1;
-  readonly kind: "session";
-  readonly sid: AuthSessionId;
-  readonly sub: string;
-  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
-  readonly method: "bearer-access-token";
-  readonly iat: number;
-  readonly exp: number;
-};
-
-type LocalDatabaseSessionInput = {
-  readonly dbPath: string;
-  readonly secretsDir: string;
-  readonly role: LocalAuthInput["role"];
-  readonly label: string;
-  readonly subject: string;
-};
-
-type InsertAuthSessionInput = {
-  readonly sessionId: AuthSessionId;
-  readonly subject: string;
-  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
-  readonly label: string;
-  readonly issuedAt: string;
-  readonly expiresAt: string;
-};
-
-const defaultSessionTtlMs = 30 * 24 * 60 * 60 * 1000;
-const signingSecretName = "server-signing-key";
-const sha256BlockSize = 64;
-
-function concatBytes(first: Uint8Array, second: Uint8Array) {
-  const bytes = new Uint8Array(first.byteLength + second.byteLength);
-  bytes.set(first);
-  bytes.set(second, first.byteLength);
-  return bytes;
-}

package/src/auth/transport.ts

@@ -9,7 +9,6 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
 
-import type { ResolvedConfig } from "../config/service.ts";
 import { toHttpEndpointUrl } from "../config/url.ts";
 import { AuthTransportError } from "./error.ts";
 import {
@@ -21,6 +20,11 @@ import {
   decodeAuthWebSocketTicketResult,
 } from "./schema.ts";
 
+export type AuthTransportConnection = {
+  readonly url: string;
+  readonly token: string;
+};
+
 export class T3AuthTransport extends Context.Service<
   T3AuthTransport,
   {
@@ -29,10 +33,10 @@ export class T3AuthTransport extends Context.Service<
       readonly credential: string;
     }) => Effect.Effect<AuthBearerBootstrapResult, AuthTransportError>;
     readonly getSession: (
-      config: ResolvedConfig,
+      connection: AuthTransportConnection,
     ) => Effect.Effect<AuthSessionState, AuthTransportError>;
     readonly issueWebSocketTicket: (
-      config: ResolvedConfig,
+      connection: AuthTransportConnection,
     ) => Effect.Effect<AuthWebSocketTicketResult, AuthTransportError>;
   }
 >()("t3cli/T3AuthTransport") {}
@@ -91,9 +95,11 @@ const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
     } satisfies AuthBearerBootstrapResult;
   });
 
-  const getSession = Effect.fn("AuthTransport.getSession")(function* (config: ResolvedConfig) {
-    const url = yield* makeHttpEndpointUrl(config.url, "/api/auth/session");
-    const request = HttpClientRequest.get(url).pipe(authenticatedRequest(config));
+  const getSession = Effect.fn("AuthTransport.getSession")(function* (
+    connection: AuthTransportConnection,
+  ) {
+    const url = yield* makeHttpEndpointUrl(connection.url, "/api/auth/session");
+    const request = HttpClientRequest.get(url).pipe(authenticatedRequest(connection));
     const response = yield* client.execute(request).pipe(
       Effect.catchTags({
         HttpClientError: (error) =>
@@ -124,10 +130,10 @@ const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
   });
 
   const issueWebSocketTicket = Effect.fn("AuthTransport.issueWebSocketTicket")(function* (
-    config: ResolvedConfig,
+    connection: AuthTransportConnection,
   ) {
-    const url = yield* makeHttpEndpointUrl(config.url, "/api/auth/websocket-ticket");
-    const request = HttpClientRequest.post(url).pipe(authenticatedRequest(config));
+    const url = yield* makeHttpEndpointUrl(connection.url, "/api/auth/websocket-ticket");
+    const request = HttpClientRequest.post(url).pipe(authenticatedRequest(connection));
     const response = yield* client.execute(request).pipe(
       Effect.catchTags({
         HttpClientError: (error) =>
@@ -167,8 +173,8 @@ const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
 export const T3AuthTransportLive = Layer.effect(T3AuthTransport, makeT3AuthTransport());
 
 const authenticatedRequest =
-  (config: ResolvedConfig) => (request: HttpClientRequest.HttpClientRequest) =>
-    request.pipe(HttpClientRequest.acceptJson, HttpClientRequest.bearerToken(config.token));
+  (connection: AuthTransportConnection) => (request: HttpClientRequest.HttpClientRequest) =>
+    request.pipe(HttpClientRequest.acceptJson, HttpClientRequest.bearerToken(connection.token));
 
 function makeHttpEndpointUrl(baseUrl: string, path: string) {
   return toHttpEndpointUrl(baseUrl, path).pipe(

package/src/auth/type.ts

@@ -27,6 +27,21 @@ export type LocalAuthInput = {
   readonly subject: string;
 };
 
+export type LocalAuthTokenInput = Omit<LocalAuthInput, "origin">;
+
+export type LocalAuthOriginInput = {
+  readonly baseDir?: string;
+  readonly origin?: string;
+};
+
+export type LocalAuthTokenResult = {
+  readonly token: string;
+  readonly role: AuthSessionRole;
+  readonly expiresAt: string;
+  readonly source: "local";
+  readonly baseDir: string;
+};
+
 export type LocalAuthResult = {
   readonly url: string;
   readonly token: string;

package/src/connection/error.ts

@@ -0,0 +1,9 @@
+import * as Schema from "effect/Schema";
+
+export class T3CodeConnectionError extends Schema.TaggedErrorClass<T3CodeConnectionError>()(
+  "T3CodeConnectionError",
+  {
+    message: Schema.String,
+    cause: Schema.optionalKey(Schema.Unknown),
+  },
+) {}

package/src/connection/layer.ts

@@ -0,0 +1,10 @@
+import * as Layer from "effect/Layer";
+
+import { T3AuthTransportLive } from "../auth/transport.ts";
+import { T3RpcLive } from "../rpc/layer.ts";
+
+export function makeT3CodeRpcLayer() {
+  return T3RpcLive.pipe(Layer.provide(T3AuthTransportLive));
+}
+
+export const T3CodeRpcLayer = makeT3CodeRpcLayer();

package/src/connection/node.ts

@@ -0,0 +1,12 @@
+import * as Layer from "effect/Layer";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import * as NodeSocket from "@effect/platform-node/NodeSocket";
+
+import { T3CodeRpcLayer } from "./layer.ts";
+
+const NodeConnectionPlatformLayer = Layer.mergeAll(
+  NodeHttpClient.layerUndici,
+  NodeSocket.layerWebSocketConstructor,
+);
+
+export const T3CodeNodeRpcLayer = T3CodeRpcLayer.pipe(Layer.provide(NodeConnectionPlatformLayer));

package/src/connection/service.ts

@@ -0,0 +1,26 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import type { T3CodeConnectionError } from "./error.ts";
+import type { T3CodeConnection } from "./type.ts";
+
+export class T3CodeConnectionProvider extends Context.Service<
+  T3CodeConnectionProvider,
+  {
+    readonly get: Effect.Effect<T3CodeConnection, T3CodeConnectionError>;
+  }
+>()("t3cli/T3CodeConnectionProvider") {}
+
+export function makeT3CodeConnectionProvider(
+  get: Effect.Effect<T3CodeConnection, T3CodeConnectionError>,
+): T3CodeConnectionProvider["Service"] {
+  return { get };
+}
+
+export function T3CodeConnectionProviderLive(connection: T3CodeConnection) {
+  return Layer.succeed(
+    T3CodeConnectionProvider,
+    makeT3CodeConnectionProvider(Effect.succeed(connection)),
+  );
+}

package/src/connection/type.ts

@@ -0,0 +1,12 @@
+export type T3CodeOrigin = {
+  readonly url: string;
+};
+
+export type T3CodeAuth = {
+  readonly token: string;
+};
+
+export type T3CodeConnection = {
+  readonly origin: T3CodeOrigin;
+  readonly auth: T3CodeAuth;
+};

package/src/connection.ts

@@ -0,0 +1,9 @@
+export { T3CodeConnectionError } from "./connection/error.ts";
+export { T3CodeRpcLayer, makeT3CodeRpcLayer } from "./connection/layer.ts";
+export { T3CodeNodeRpcLayer } from "./connection/node.ts";
+export {
+  T3CodeConnectionProvider,
+  T3CodeConnectionProviderLive,
+  makeT3CodeConnectionProvider,
+} from "./connection/service.ts";
+export type { T3CodeAuth, T3CodeConnection, T3CodeOrigin } from "./connection/type.ts";

package/src/index.ts

@@ -9,6 +9,16 @@ export type { ApplicationError } from "./application/error.ts";
 export { T3Auth } from "./auth/service.ts";
 export { T3AuthLive, makeT3Auth } from "./auth/layer.ts";
 export { T3LocalAuth, T3LocalAuthLive, makeT3LocalAuth } from "./auth/local.ts";
+export {
+  T3LocalAuthOrigin,
+  T3LocalAuthOriginLive,
+  makeT3LocalAuthOrigin,
+} from "./auth/local-origin.ts";
+export {
+  T3LocalAuthToken,
+  T3LocalAuthTokenLive,
+  makeT3LocalAuthToken,
+} from "./auth/local-token.ts";
 export {
   T3AuthPairing,
   T3AuthPairingLive,
@@ -30,7 +40,10 @@ export type {
   AuthConfigInput,
   AuthSessionRole,
   LocalAuthInput,
+  LocalAuthOriginInput,
   LocalAuthResult,
+  LocalAuthTokenInput,
+  LocalAuthTokenResult,
   PairingUrl,
   PairResult,
 } from "./auth/type.ts";
@@ -39,6 +52,16 @@ export type { ResolvedConfig, StoredConfig } from "./config/service.ts";
 export { T3ConfigLive, makeT3Config } from "./config/layer.ts";
 export { ConfigError, UrlError } from "./config/error.ts";
 export type { ConfigServiceError } from "./config/error.ts";
+export {
+  makeT3CodeConnectionProvider,
+  makeT3CodeRpcLayer,
+  T3CodeConnectionProvider,
+  T3CodeConnectionProviderLive,
+  T3CodeNodeRpcLayer,
+  T3CodeRpcLayer,
+  T3CodeConnectionError,
+} from "./connection.ts";
+export type { T3CodeAuth, T3CodeConnection, T3CodeOrigin } from "./connection.ts";
 export { Environment } from "./environment/service.ts";
 export type { EnvironmentShape } from "./environment/service.ts";
 export { NodeEnvironmentLive } from "./environment/layer.ts";
@@ -49,6 +72,8 @@ export {
   T3AuthPairingLayer,
   T3AuthTransportLayer,
   T3LocalAuthLayer,
+  T3LocalAuthOriginLayer,
+  T3LocalAuthTokenLayer,
 } from "./runtime.ts";
 export { SqlClientFactory } from "./sql/service.ts";
 export type { SqlClientFactoryShape, SqliteClientConfig } from "./sql/service.ts";

package/src/rpc/error.ts

@@ -9,13 +9,9 @@ import {
 import { HttpClientError } from "effect/unstable/http";
 import { RpcClientError } from "effect/unstable/rpc";
 
-import {
-  AuthConfigError,
-  AuthLocalError,
-  AuthPairingUrlError,
-  AuthTransportError,
-} from "../auth/error.ts";
-import { ConfigError, UrlError } from "../config/error.ts";
+import { AuthTransportError } from "../auth/error.ts";
+import { T3CodeConnectionError } from "../connection/error.ts";
+import { UrlError } from "../config/error.ts";
 
 const RpcErrorCauseSchema = Schema.Union([
   RpcClientError.RpcClientError,
@@ -24,11 +20,8 @@ const RpcErrorCauseSchema = Schema.Union([
   OrchestrationDispatchCommandError,
   OrchestrationGetSnapshotError,
   ServerSettingsError,
-  AuthConfigError,
-  AuthLocalError,
-  AuthPairingUrlError,
   AuthTransportError,
-  ConfigError,
+  T3CodeConnectionError,
   HttpClientError.HttpClientErrorSchema,
   UrlError,
   Schema.instanceOf(Schema.SchemaError),