import type {  AuthBearerBootstrapResult,  AuthSessionState,  AuthWebSocketTokenResult,  ExecutionEnvironmentDescriptor,} from "@t3tools/contracts";import { decodeJsonResult } from "@t3tools/shared/schemaJson";import * as Data from "effect/Data";import * as Duration from "effect/Duration";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Option from "effect/Option";import * as Result from "effect/Result";import * as Schema from "effect/Schema";import { identity } from "effect/Function";import {  FetchHttpClient,  HttpClient,  HttpClientRequest,  HttpClientResponse,} from "effect/unstable/http"; const DEFAULT_REMOTE_REQUEST_TIMEOUT_MS = 10_000;const RemoteAuthErrorBody = Schema.Struct({  error: Schema.optional(Schema.String),});const decodeRemoteAuthErrorBody = decodeJsonResult(RemoteAuthErrorBody); const remoteEndpointUrl = (httpBaseUrl: string, pathname: string): string => {  const url = new URL(httpBaseUrl);  url.pathname = pathname;  url.search = "";  url.hash = "";  return url.toString();}; export class RemoteEnvironmentAuthFetchError extends Data.TaggedError(  "RemoteEnvironmentAuthFetchError",)<{  readonly message: string;  readonly cause: unknown;}> {} export class RemoteEnvironmentAuthResponseReadError extends Data.TaggedError(  "RemoteEnvironmentAuthResponseReadError",)<{  readonly message: string;  readonly cause: unknown;}> {} export class RemoteEnvironmentAuthInvalidJsonError extends Data.TaggedError(  "RemoteEnvironmentAuthInvalidJsonError",)<{  readonly message: string;  readonly cause: unknown;}> {} export class RemoteEnvironmentAuthHttpError extends Data.TaggedError(  "RemoteEnvironmentAuthHttpError",)<{  readonly message: string;  readonly status: number;}> {  constructor(message: string, status: number) {    super({ message, status });  }} export class RemoteEnvironmentAuthTimeoutError extends Data.TaggedError(  "RemoteEnvironmentAuthTimeoutError",)<{  readonly message: string;  readonly requestUrl: string;  readonly timeoutMs: number;}> {  constructor(requestUrl: string, timeoutMs: number) {    super({      message: `Remote auth endpoint ${requestUrl} timed out after ${timeoutMs}ms.`,      requestUrl,      timeoutMs,    });  }} export type RemoteEnvironmentAuthError =  | RemoteEnvironmentAuthFetchError  | RemoteEnvironmentAuthResponseReadError  | RemoteEnvironmentAuthInvalidJsonError  | RemoteEnvironmentAuthHttpError  | RemoteEnvironmentAuthTimeoutError; export const isRemoteEnvironmentAuthHttpError = (  error: unknown,): error is RemoteEnvironmentAuthHttpError => error instanceof RemoteEnvironmentAuthHttpError; const readRemoteAuthErrorMessage = (  response: HttpClientResponse.HttpClientResponse,  fallbackMessage: string,): Effect.Effect<string, RemoteEnvironmentAuthResponseReadError> =>  response.text.pipe(    Effect.mapError(      (cause) =>        new RemoteEnvironmentAuthResponseReadError({          message: "Remote auth endpoint returned an unreadable error response.",          cause,        }),    ),    Effect.map((text) => {      if (!text) {        return fallbackMessage;      }       const decoded = decodeRemoteAuthErrorBody(text);      if (Result.isSuccess(decoded) && decoded.success.error) {        return decoded.success.error;      }       return text;    }),  ); const readRemoteJson = <T>(  response: HttpClientResponse.HttpClientResponse,  requestUrl: string,): Effect.Effect<T, RemoteEnvironmentAuthInvalidJsonError> =>  response.json.pipe(    Effect.mapError(      (cause) =>        new RemoteEnvironmentAuthInvalidJsonError({          message: `Remote auth endpoint returned invalid JSON from ${requestUrl}.`,          cause,        }),    ),    Effect.map((value) => value as T),  ); export const remoteHttpClientLayer = (  fetchFn: typeof globalThis.fetch,): Layer.Layer<HttpClient.HttpClient> =>  FetchHttpClient.layer.pipe(Layer.provide(Layer.succeed(FetchHttpClient.Fetch, fetchFn))); const fetchRemoteJson = Effect.fn("clientRuntime.remote.fetchRemoteJson")(function* <T>(input: {  readonly httpBaseUrl: string;  readonly pathname: string;  readonly method?: "GET" | "POST";  readonly bearerToken?: string;  readonly body?: unknown;  readonly timeoutMs?: number;}) {  const requestUrl = remoteEndpointUrl(input.httpBaseUrl, input.pathname);  const method = input.method ?? "GET";  const timeoutMs = input.timeoutMs ?? DEFAULT_REMOTE_REQUEST_TIMEOUT_MS;  const request = HttpClientRequest.make(method)(requestUrl).pipe(    input.bearerToken ? HttpClientRequest.bearerToken(input.bearerToken) : identity,    input.body !== undefined ? HttpClientRequest.bodyJsonUnsafe(input.body) : identity,  );   const client = yield* HttpClient.HttpClient;  const response = yield* client.execute(request).pipe(    Effect.mapError(      (cause) =>        new RemoteEnvironmentAuthFetchError({          message: `Failed to fetch remote auth endpoint ${requestUrl} (${String(cause)}).`,          cause,        }),    ),    Effect.timeoutOption(Duration.millis(timeoutMs)),    Effect.flatMap(      Option.match({        onNone: () => Effect.fail(new RemoteEnvironmentAuthTimeoutError(requestUrl, timeoutMs)),        onSome: Effect.succeed,      }),    ),  );   if (response.status < 200 || response.status >= 300) {    return yield* readRemoteAuthErrorMessage(      response,      `Remote auth request failed (${response.status}).`,    ).pipe(      Effect.flatMap((message) =>        Effect.fail(new RemoteEnvironmentAuthHttpError(message, response.status)),      ),    );  }   return yield* readRemoteJson<T>(response, requestUrl);}); export const bootstrapRemoteBearerSession = Effect.fn(  "clientRuntime.remote.bootstrapRemoteBearerSession",)(function* (input: {  readonly httpBaseUrl: string;  readonly credential: string;  readonly timeoutMs?: number;}) {  return yield* fetchRemoteJson<AuthBearerBootstrapResult>({    httpBaseUrl: input.httpBaseUrl,    pathname: "/api/auth/bootstrap/bearer",    method: "POST",    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),    body: {      credential: input.credential,    },  });}); export const fetchRemoteSessionState = Effect.fn("clientRuntime.remote.fetchRemoteSessionState")(  function* (input: {    readonly httpBaseUrl: string;    readonly bearerToken: string;    readonly timeoutMs?: number;  }) {    return yield* fetchRemoteJson<AuthSessionState>({      httpBaseUrl: input.httpBaseUrl,      pathname: "/api/auth/session",      bearerToken: input.bearerToken,      ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),    });  },); export const fetchRemoteEnvironmentDescriptor = Effect.fn(  "clientRuntime.remote.fetchRemoteEnvironmentDescriptor",)(function* (input: { readonly httpBaseUrl: string; readonly timeoutMs?: number }) {  return yield* fetchRemoteJson<ExecutionEnvironmentDescriptor>({    httpBaseUrl: input.httpBaseUrl,    pathname: "/.well-known/t3/environment",    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),  });}); export const issueRemoteWebSocketToken = Effect.fn(  "clientRuntime.remote.issueRemoteWebSocketToken",)(function* (input: {  readonly httpBaseUrl: string;  readonly bearerToken: string;  readonly timeoutMs?: number;}) {  return yield* fetchRemoteJson<AuthWebSocketTokenResult>({    httpBaseUrl: input.httpBaseUrl,    pathname: "/api/auth/ws-token",    method: "POST",    bearerToken: input.bearerToken,    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),  });}); export const resolveRemoteWebSocketConnectionUrl = Effect.fn(  "clientRuntime.remote.resolveRemoteWebSocketConnectionUrl",)(function* (input: {  readonly wsBaseUrl: string;  readonly httpBaseUrl: string;  readonly bearerToken: string;  readonly timeoutMs?: number;}) {  const issued = yield* issueRemoteWebSocketToken({    httpBaseUrl: input.httpBaseUrl,    bearerToken: input.bearerToken,    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),  });   const url = new URL(input.wsBaseUrl);  if (url.pathname === "" || url.pathname === "/") {    url.pathname = "/ws";  }  url.searchParams.set("wsToken", issued.token);  return url.toString();});