reuse client runtime for rpc connections

.changeset/runtime-prepared-connection.md

@@ -0,0 +1,5 @@
+---
+"t3code-cli": minor
+---
+
+Reuse upstream client-runtime authorization and RPC session creation for CLI connections.

package.json

@@ -111,17 +111,18 @@
     "effect": "4.0.0-beta.78",
     "marked": "^15.0.12",
     "marked-terminal": "^7.3.0",
-    "string-width": "^8.2.1",
+    "string-width": "^8.2.2",
     "wrap-ansi": "^10.0.0"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.31.0",
+    "@changesets/cli": "^2.31.1",
     "@effect/vitest": "catalog:",
+    "@t3tools/client-runtime": "workspace:*",
     "@t3tools/contracts": "workspace:*",
     "@total-typescript/shoehorn": "^0.1.2",
-    "@types/node": "^25.9.1",
-    "typescript": "^6.0.3",
-    "vite-plus": "^0.1.24"
+    "@types/node": "^26.1.2",
+    "typescript": "^7.0.2",
+    "vite-plus": "^0.2.6"
   },
   "engines": {
     "node": ">=24.0.0"

pnpm-workspace.yaml

@@ -1,13 +1,21 @@
 packages:
   - .
+  - upstream-t3code/packages/client-runtime
   - upstream-t3code/packages/contracts
+  - upstream-t3code/packages/shared
 
 catalog:
+  "@effect/platform-node": 4.0.0-beta.78
   "@effect/vitest": 4.0.0-beta.78
+  "@noble/curves": 2.2.0
+  "@noble/hashes": 2.2.0
+  "@types/node": ^26.1.2
   effect: 4.0.0-beta.78
-  vite-plus: 0.1.24
-  vite: npm:@voidzero-dev/vite-plus-core@0.1.24
+  jose: 6.2.4
+  vite-plus: 0.2.6
+  vite: npm:@voidzero-dev/vite-plus-core@0.2.6
   vitest: npm:@voidzero-dev/vite-plus-test@0.1.24
+  yaml: ^2.9.0
 
 patchedDependencies:
   "@effect/vitest@4.0.0-beta.78": patches/@effect__vitest@4.0.0-beta.78.patch

src/application/thread-wait.ts

@@ -42,6 +42,10 @@ export function watchThread(input: { readonly threadId: string }) {
               return Stream.fromIterable(events);
             }
 
+            if (item.kind === "synchronized") {
+              return Stream.empty;
+            }
+
             if (current === undefined || currentMessages === undefined) {
               return Stream.fail(
                 new ThreadSessionError({

src/auth/error.ts

@@ -1,10 +1,10 @@
 import * as Cause from "effect/Cause";
 import * as Schema from "effect/Schema";
 import { PlatformError } from "effect/PlatformError";
-import { HttpClientError } from "effect/unstable/http";
 
 import { ConfigError } from "../config/error.ts";
 import { UrlError } from "../config/url/error.ts";
+import { RemoteEnvironmentAuthErrorSchema } from "./remote-error.ts";
 
 export class AuthPairingUrlError extends Schema.TaggedErrorClass<AuthPairingUrlError>()(
   "AuthPairingUrlError",
@@ -23,13 +23,7 @@ export class AuthTransportError extends Schema.TaggedErrorClass<AuthTransportErr
   "AuthTransportError",
   {
     message: Schema.String,
-    cause: Schema.optionalKey(
-      Schema.Union([
-        HttpClientError.HttpClientErrorSchema,
-        Schema.instanceOf(Schema.SchemaError),
-        UrlError,
-      ]),
-    ),
+    cause: RemoteEnvironmentAuthErrorSchema,
   },
 ) {}
 

src/auth/remote-error.ts

@@ -0,0 +1,17 @@
+import {
+  RemoteEnvironmentAuthFetchError,
+  type RemoteEnvironmentAuthError,
+  RemoteEnvironmentAuthInvalidJsonError,
+  RemoteEnvironmentAuthTimeoutError,
+  RemoteEnvironmentAuthUndeclaredStatusError,
+} from "@t3tools/client-runtime/authorization";
+import { EnvironmentHttpCommonError } from "@t3tools/contracts";
+import * as Schema from "effect/Schema";
+
+export const RemoteEnvironmentAuthErrorSchema = Schema.Union([
+  EnvironmentHttpCommonError,
+  Schema.instanceOf(RemoteEnvironmentAuthFetchError),
+  Schema.instanceOf(RemoteEnvironmentAuthInvalidJsonError),
+  Schema.instanceOf(RemoteEnvironmentAuthTimeoutError),
+  Schema.instanceOf(RemoteEnvironmentAuthUndeclaredStatusError),
+]) satisfies Schema.Schema<RemoteEnvironmentAuthError>;

src/auth/transport.ts

@@ -1,23 +1,19 @@
 import {
-  AuthAccessTokenType,
-  AuthEnvironmentBootstrapTokenType,
-  AuthTokenExchangeGrantType,
-} from "@t3tools/contracts";
+  bootstrapRemoteBearerSession,
+  fetchRemoteSessionState,
+  issueRemoteWebSocketTicket,
+} from "@t3tools/client-runtime/authorization";
 import * as Context from "effect/Context";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
+import { HttpClient } from "effect/unstable/http";
 
-import { toHttpEndpointUrl } from "../config/url/url.ts";
 import { AuthTransportError } from "./error.ts";
 import {
   type AuthBearerBootstrapResult,
-  decodeAuthAccessTokenResult,
   type AuthSessionState,
-  decodeAuthSessionState,
   type AuthWebSocketTicketResult,
-  decodeAuthWebSocketTicketResult,
 } from "./schema.ts";
 
 export type AuthTransportConnection = {
@@ -42,53 +38,25 @@ export class T3AuthTransport extends Context.Service<
 >()("t3cli/T3AuthTransport") {}
 
 const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
-  const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+  const httpClient = yield* HttpClient.HttpClient;
 
   const bootstrapBearer = Effect.fn("AuthTransport.bootstrapBearer")(function* (input: {
     readonly baseUrl: string;
     readonly credential: string;
   }) {
-    const url = yield* makeHttpEndpointUrl(input.baseUrl, "/oauth/token");
-    const request = HttpClientRequest.post(url).pipe(
-      HttpClientRequest.acceptJson,
-      HttpClientRequest.bodyUrlParams({
-        grant_type: AuthTokenExchangeGrantType,
-        subject_token: input.credential,
-        subject_token_type: AuthEnvironmentBootstrapTokenType,
-        requested_token_type: AuthAccessTokenType,
-      }),
-    );
-    const response = yield* client.execute(request).pipe(
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-      }),
-    );
-    const result = yield* response.json.pipe(
-      Effect.flatMap(decodeAuthAccessTokenResult),
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-        SchemaError: (error) =>
-          Effect.fail(
-            new AuthTransportError({ message: "auth response decode failed", cause: error }),
-          ),
-      }),
+    const result = yield* bootstrapRemoteBearerSession({
+      httpBaseUrl: input.baseUrl,
+      credential: input.credential,
+    }).pipe(
+      Effect.provideService(HttpClient.HttpClient, httpClient),
+      Effect.mapError(
+        (error) => new AuthTransportError({ message: "auth request failed", cause: error }),
+      ),
     );
     const now = yield* DateTime.now;
     return {
       authenticated: true,
-      role: result.scope.split(/\s+/u).includes("access:write") ? "owner" : "client",
+      role: inferRole(result.scope),
       sessionMethod: "bearer-access-token",
       expiresAt: DateTime.formatIso(DateTime.add(now, { seconds: result.expires_in })),
       sessionToken: result.access_token,
@@ -98,69 +66,41 @@ const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
   const getSession = Effect.fn("AuthTransport.getSession")(function* (
     connection: AuthTransportConnection,
   ) {
-    const url = yield* makeHttpEndpointUrl(connection.url, "/api/auth/session");
-    const request = HttpClientRequest.get(url).pipe(authenticatedRequest(connection));
-    const response = yield* client.execute(request).pipe(
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-      }),
-    );
-    return yield* response.json.pipe(
-      Effect.flatMap(decodeAuthSessionState),
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-        SchemaError: (error) =>
-          Effect.fail(
-            new AuthTransportError({ message: "auth response decode failed", cause: error }),
-          ),
-      }),
+    const result = yield* fetchRemoteSessionState({
+      httpBaseUrl: connection.url,
+      bearerToken: connection.token,
+    }).pipe(
+      Effect.provideService(HttpClient.HttpClient, httpClient),
+      Effect.mapError(
+        (error) => new AuthTransportError({ message: "auth request failed", cause: error }),
+      ),
     );
+    return {
+      authenticated: result.authenticated,
+      ...(result.scopes !== undefined ? { role: inferRole(result.scopes.join(" ")) } : {}),
+      ...(result.sessionMethod !== undefined ? { sessionMethod: result.sessionMethod } : {}),
+      ...(result.expiresAt !== undefined
+        ? { expiresAt: DateTime.formatIso(result.expiresAt) }
+        : {}),
+    } satisfies AuthSessionState;
   });
 
   const issueWebSocketTicket = Effect.fn("AuthTransport.issueWebSocketTicket")(function* (
     connection: AuthTransportConnection,
   ) {
-    const url = yield* makeHttpEndpointUrl(connection.url, "/api/auth/websocket-ticket");
-    const request = HttpClientRequest.post(url).pipe(authenticatedRequest(connection));
-    const response = yield* client.execute(request).pipe(
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-      }),
-    );
-    return yield* response.json.pipe(
-      Effect.flatMap(decodeAuthWebSocketTicketResult),
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-        SchemaError: (error) =>
-          Effect.fail(
-            new AuthTransportError({ message: "auth response decode failed", cause: error }),
-          ),
-      }),
+    const result = yield* issueRemoteWebSocketTicket({
+      httpBaseUrl: connection.url,
+      bearerToken: connection.token,
+    }).pipe(
+      Effect.provideService(HttpClient.HttpClient, httpClient),
+      Effect.mapError(
+        (error) => new AuthTransportError({ message: "auth request failed", cause: error }),
+      ),
     );
+    return {
+      ticket: result.ticket,
+      expiresAt: DateTime.formatIso(result.expiresAt),
+    } satisfies AuthWebSocketTicketResult;
   });
 
   return {
@@ -172,15 +112,6 @@ const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
 
 export const T3AuthTransportLive = Layer.effect(T3AuthTransport, makeT3AuthTransport());
 
-const authenticatedRequest =
-  (connection: AuthTransportConnection) => (request: HttpClientRequest.HttpClientRequest) =>
-    request.pipe(HttpClientRequest.acceptJson, HttpClientRequest.bearerToken(connection.token));
-
-function makeHttpEndpointUrl(baseUrl: string, path: string) {
-  return toHttpEndpointUrl(baseUrl, path).pipe(
-    Effect.catchTags({
-      UrlError: (error) =>
-        Effect.fail(new AuthTransportError({ message: "auth request failed", cause: error })),
-    }),
-  );
+function inferRole(scope: string): AuthBearerBootstrapResult["role"] {
+  return scope.split(/\s+/u).includes("access:write") ? "owner" : "client";
 }

src/connection/error.ts

@@ -1,9 +1,12 @@
 import * as Schema from "effect/Schema";
 
+import { ConfigError } from "../config/error.ts";
+import { UrlError } from "../config/url/error.ts";
+
 export class T3CodeConnectionError extends Schema.TaggedErrorClass<T3CodeConnectionError>()(
   "T3CodeConnectionError",
   {
     message: Schema.String,
-    cause: Schema.optionalKey(Schema.Unknown),
+    cause: Schema.Union([ConfigError, UrlError]),
   },
 ) {}

src/connection/layer.ts

@@ -1,10 +1,13 @@
 import * as Layer from "effect/Layer";
 
-import { T3AuthTransportLive } from "../auth/transport.ts";
+import { T3PreparedConnectionProviderLive } from "./prepared.ts";
 import { T3RpcLive } from "../rpc/layer.ts";
+import { T3RpcSessionFactoryLive } from "../rpc/session.ts";
 
 export function makeT3CodeRpcLayer() {
-  return T3RpcLive.pipe(Layer.provide(T3AuthTransportLive));
+  return T3RpcLive.pipe(
+    Layer.provide(Layer.mergeAll(T3PreparedConnectionProviderLive, T3RpcSessionFactoryLive)),
+  );
 }
 
 export const T3CodeRpcLayer = makeT3CodeRpcLayer();