Refactor/rpc only

.agents/skills/effect-house/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: effect-house
-description: House conventions for Effect v4 TypeScript in the vektorprogrammet mono-web repository. It names the shared constructs, the composition roots that select platform layers, the test platform and @effect/vitest conventions, the runtime bridges, typed HTTP problems, Effect-returning services, the lint configuration and the project rules with their FX ids, the module guides, and the Effect exception registry and its check, and it links to the file that owns each fact. Use when you write, review, or test TypeScript in mono-web, and before you choose a construct, a platform or test layer, a Promise bridge, or a lint suppression. It adds to the portable effect-* skills and the installed Effect guidance and does not restate them.
+description: House conventions for Effect v4 TypeScript in the vektorprogrammet mono-web repository. It names the shared constructs, the composition roots that select platform layers, the test platform and @effect/vitest conventions, the runtime bridges, typed RPC problems, Effect-returning services, the lint configuration and the project rules with their FX ids, the module guides, and the Effect exception registry and its check, and it links to the file that owns each fact. Use when you write, review, or test TypeScript in mono-web, and before you choose a construct, a platform or test layer, a Promise bridge, or a lint suppression. It adds to the portable effect-* skills and the installed Effect guidance and does not restate them.
 ---
 
 # effect-house: mono-web
@@ -17,7 +17,7 @@ The links are relative to this file, so the file is a complete entry point also
 1. Read the `AGENTS.md` guide of the folder. Every app, package, and bounded-context folder has one. `just guides write` renders its first part from [docs/model/contexts.cml](../../../docs/model/contexts.cml), the `@construct` tags, and the package exports. Local invariants go below that part.
 2. Search the one-line index [docs/constructs.md](../../../docs/constructs.md) for a construct that already owns the logic, read its contract on the page of its category, and use it.
 3. Find the platform and test layers of the file's role: [references/composition-and-tests.md](references/composition-and-tests.md).
-4. At an HTTP boundary, a service interface, or a Promise callback, read [references/boundaries.md](references/boundaries.md).
+4. At an RPC boundary, a service interface, or a Promise callback, read [references/boundaries.md](references/boundaries.md).
 5. If a rule cannot be followed, register an exception: [references/exceptions.md](references/exceptions.md).
 
 ## Constructs (FX002)
@@ -30,14 +30,14 @@ Reading about a construct discloses in three steps, each only when you need it:
 | Ports for the servers of a journey         | `reserveLoopbackPorts`, `loopbackPortFree` ([test-harness][test-harness])                                                      | `anti-slop/no-port-probe`             |
 | Instants in journey fixtures               | `journeyClock`, `admissionJourneyClock` ([test-harness][test-harness])                                                         | `anti-slop/no-literal-window-instant` |
 | Canonical JSON, digests, SQL JSON values   | `canonicalJson`, `canonicalJsonBytes`, `sha256Hex`, `canonicalJsonValue` ([digest])                                            | `anti-slop/no-json-text-parameter`    |
-| The JSON text of an HTTP representation    | `jsonText` ([http-problem])                                                                                                    | `effecttsgo/prefer-schema-over-json`  |
+| The JSON text of a representation          | `jsonText` ([rpc-problem])                                                                                                     | `effecttsgo/prefer-schema-over-json`  |
 | An advisory lock                           | `lockAdvisory` with a registered `AdvisoryLockKey` ([sql-lock])                                                                | `anti-slop/no-raw-advisory-lock-sql`  |
 | The Promise callbacks of a library         | The pattern of `makeBetterAuthCallbackRunner`, until a second runner makes it a construct ([runtime bridges][runtime-bridges]) | review-only                           |
 | The class of a request that a journey saw  | `isNativeRequest`, `addressesAnyRoute` ([request-ledger])                                                                      | review-only                           |
 
 [test-harness]: ../../../docs/constructs/test-harness.md
 [digest]: ../../../docs/constructs/digest.md
-[http-problem]: ../../../docs/constructs/http-problem.md
+[rpc-problem]: ../../../docs/constructs/rpc-problem.md
 [sql-lock]: ../../../docs/constructs/sql-lock.md
 [runtime-bridges]: references/boundaries.md#runtime-bridges-fx003-fx006
 [request-ledger]: ../../../docs/constructs/request-ledger.md
@@ -47,7 +47,7 @@ Reading about a construct discloses in three steps, each only when you need it:
 - **Composition roots select the platform (FX003).** Only a composition root provides `BunServices.layer` or another platform layer; packages and adapters require platform services and stay portable. Enforcement: `effect/no-cross-runtime` against the roles and platforms that [oxlint.config.ts](../../../oxlint.config.ts) declares. Details: [references/composition-and-tests.md](references/composition-and-tests.md).
 - **Tests are Effect programs (FX015).** `@effect/vitest`, one Effect per test, suite resources as `layer(L, { excludeTestServices: true, timeout })`, and the test platform of the package (`TestPlatform`, and `DatabaseTestLive` in database suites). Enforcement: `effecttsgo/async-function` in core code, `anti-slop/no-module-mocking`. Details: [references/composition-and-tests.md](references/composition-and-tests.md).
 - **Services return Effects (FX003).** No Promise interface between Effect layers. A program runs only at a composition root or a runtime bridge. Enforcement: `effecttsgo/async-function` and `effecttsgo/new-promise` in core code, `effect/no-premature-execution`. Details: [references/boundaries.md](references/boundaries.md).
-- **HTTP failures are typed problems (FX004, FX005).** A handler decodes with the contract schemas and answers with a problem that the endpoint declares; `ProblemBoundaryLive` is the only consumer of a Cause. Enforcement: `just check-types`, which checks the endpoint unions and asserts the HTTP contract. Details: [references/boundaries.md](references/boundaries.md).
+- **RPC failures are typed problems (FX004, FX005).** The RPC server decodes each payload with the contract schema, and a handler answers with a problem that its RPC declares; `ProblemBoundaryLive` is the only consumer of a Cause. Enforcement: `just check-types`, which checks the declared unions, and [packages/rpc/test/contract.test.ts](../../../packages/rpc/test/contract.test.ts), which checks that every RPC runs inside the defect boundary. Details: [references/boundaries.md](references/boundaries.md).
 - **Every exception is registered (FX012).** A suppression of an Effect rule names its entry in [docs/effect-exceptions.json](../../../docs/effect-exceptions.json). Enforcement: `just exceptions`. Details: [references/exceptions.md](references/exceptions.md).
 
 ## Lint configuration
@@ -58,7 +58,7 @@ Reading about a construct discloses in three steps, each only when you need it:
 - The last group that matches a file decides every `effect/*` rule for it, so a test file does not inherit the rules of its source group. Groups use plain globs, because Oxlint has no extglob, and run from broad sources to narrow exceptions. [tools/conventions/tests/oxlint-groups.test.ts](../../../tools/conventions/tests/oxlint-groups.test.ts) guards that shape; keep it when you change a group.
 - A new composition root or adapter joins the group of its role and platform, such as the Bun composition-root group; it gets no suppression and no `off` override. The Bun groups admit the Node modules that Bun implements (`bunNodeModules`), and their files import `process` from `node:process` and `Buffer` from `node:buffer`, because the rule admits no Node globals on `bun`.
 - The `effecttsgo/*` rules of the Effect language service come from the `recommended` and `correctness` presets of `@effect/tsgo`, and they make `just lint` type-aware. Every rule is an error, and so is every rule of Oxlint's correctness category, the type-aware ones included. The `effectNative` rules replace platform APIs with Effect services, so they run only in the core Effect packages that `coreEffectFiles` lists; the other apps, packages, and tools are not Effect programs. `oxlint-groups.test.ts` guards these severities and that scope too. The language-service plugin in `tsconfig.json` keeps refactors and quick info in the editor and emits no diagnostics, so `tsc` reports none. Count sites with `just lint`, never with grep or `tsc`.
-- Fix a finding with the rule's own fix, in the house form where one exists: `EffectSdkFailure<Group, Operation>` of `@vektorprogrammet/sdk/effect` is the failure channel of a generated SDK operation, `formText` ([apps/dashboard/app/lib/form-text.ts](../../../apps/dashboard/app/lib/form-text.ts)) reads a form field, and `DateTime` with `normalizeRfc3339Instant` ([packages/domain/src/time.ts](../../../packages/domain/src/time.ts)) handles instants. JSON goes through the constructs above.
+- Fix a finding with the rule's own fix, in the house form where one exists: the declared `Problem` union of an RPC is the failure channel of its client call, and `callBrowserNative` ([apps/dashboard/app/lib/browser-native.ts](../../../apps/dashboard/app/lib/browser-native.ts)) adds `NativeAnswerInvalid` for an answer outside the contract, `formText` ([apps/dashboard/app/lib/form-text.ts](../../../apps/dashboard/app/lib/form-text.ts)) reads a form field, and `DateTime` with `normalizeRfc3339Instant` ([packages/domain/src/time.ts](../../../packages/domain/src/time.ts)) handles instants. JSON goes through the constructs above.
 
 ## Project rules and checks
 
@@ -81,7 +81,7 @@ The portable skills cite the `effecttsgo/*` rules. The rules and checks of this
 | The rules of the constructs table                                                   | FX002 | Logic that a listed construct owns                                                                                                                                                |
 | `just exceptions`                                                                   | FX012 | A suppression without a registered exception, and an entry that no longer matches its sites or versions                                                                           |
 | `just constructs`                                                                   | FX002 | A construct page that differs from the `@construct` tags and their JSDoc, a construct without its contract tags or annotations, and a construct that fewer than two modules share |
-| `just check-types`                                                                  | FX004 | A type error, and an HTTP contract that differs from the one that it regenerates                                                                                                  |
+| `just check-types`                                                                  | FX004 | A type error, such as a failure that an RPC does not declare                                                                                                                      |
 | `packages/database/src/migration-registry.test.ts`, `just migration-hashes`         | FX010 | An applied migration whose checksum changed, and a migration id, position, or file that the registry lacks                                                                        |
 
 `effect/no-native-promise-control-flow` and `effect/no-untyped-throw` are strict rules, so they run in every group whose role they cover. `effect/no-raw-json-parse` runs where a group declares the `external-data` boundary: the runtime adapters of `apps/backend` and `packages/database`.
@@ -97,8 +97,8 @@ The portable skills leave these facts to the overlay:
 - **Composition roots, test platform, and runtime bridges:** [references/composition-and-tests.md](references/composition-and-tests.md) and [references/boundaries.md](references/boundaries.md).
 - **Layer names:** `<Service>Live` for a live layer, such as `DatabaseLive`, `ContentManagementLive`, and `ReceiptFileStoreLive`, and `DatabaseTest()` for the PGlite database of a test. Services have no `layer` or `layerTest` statics.
 - **Migrations and the test database:** `packages/database/migrations/NNNN-<name>.sql`, frozen by `packages/database/migrations/checksums.json`; `just migration-hashes write` records a new one. A test takes `DatabaseTest()` or a disposable cluster (`withDisposablePostgres`).
-- **Drift check of generated artifacts:** `just check-types` runs the `generate` scripts of `packages/http-api` and `packages/sdk` before the type checks, and asserts the HTTP contract.
-- **Test command and type-test tool:** `bun run --cwd <package> vitest run <file> --no-file-parallelism --maxWorkers=1`. Type tests use `expectTypeOf` of Vitest, as [`packages/sdk/src/__tests__/generated-native-client.test.ts`](../../../packages/sdk/src/__tests__/generated-native-client.test.ts) does.
+- **Drift check of generated artifacts:** none. Nothing is generated from the RPC contract: handlers and clients derive from its groups, and [packages/rpc/test/contract.test.ts](../../../packages/rpc/test/contract.test.ts) checks the operation IDs, AccessSpecs, and defect boundary of every RPC.
+- **Test command and type-test tool:** `bun run --cwd <package> vitest run <file> --no-file-parallelism --maxWorkers=1`. Type tests use `expectTypeOf` of Vitest, as [`packages/domain/src/organization/authority-evidence.test.ts`](../../../packages/domain/src/organization/authority-evidence.test.ts) does.
 - **Foldkit house form:** one folder per bounded context in `apps/dashboard/app/foldkit`, each with its guide, and one Model per stateful workflow. Tests are `update.test.ts`, `view.test.ts` with `Scene` of `foldkit/test`, and `update.property.test.ts`. `anti-slop/no-unkeyed-command-row` runs there. `foldkit/prefer-command-mapmessage` does not, because `oxlint.config.ts` configures no Foldkit plugin.
 
 ## Done means

.agents/skills/effect-house/references/boundaries.md

@@ -1,4 +1,4 @@
-# Services, HTTP boundaries, and runtime bridges
+# Services, RPC boundaries, and runtime bridges
 
 ## Services return Effects (FX003)
 
@@ -22,12 +22,12 @@ The pattern to copy is `makeBetterAuthCallbackRunner` in [packages/database/src/
 A new library of this kind gets its own runner, built the same way in the layer that owns the library. Do not run a program with `Effect.runPromise` inside a callback.
 The runner is no tagged construct while it is the only one, because a construct needs two consumers outside its own module. The second runner makes it one: move the logic that both share into one runner, tag it `@construct runtime-bridge`, and declare that category again in [tools/conventions/src/constructs.ts](../../../../tools/conventions/src/constructs.ts).
 
-## HTTP boundaries (FX004, FX005)
+## RPC boundaries (FX004, FX005)
 
-[packages/http-api](../../../../packages/http-api) owns the contracts; the backend derives its transport from them, and `just check-types` asserts the generated HTTP contract.
+[packages/rpc](../../../../packages/rpc) owns the contract ([docs/architecture.md](../../../../docs/architecture.md#rpc-contract-and-ingress)); the backend implements each context's group, and every client derives from the same group. Nothing is generated.
 
-- A handler decodes its input with the contract schemas: `readJsonBody`, `decodeRequest`, and `strictOutput` ([docs/constructs/http-problem.md](../../../../docs/constructs/http-problem.md)).
-- A failure is a `Problem`. `Problem.make(code)` takes only the code; `NativeProblemRegistry` in [packages/http-api/src/http-semantics.ts](../../../../packages/http-api/src/http-semantics.ts) owns its status and body. An endpoint declares its closed union with `problemUnion`.
+- The RPC server decodes a payload with the contract schema before the handler runs. A handler decodes its success value with `strictOutput` ([docs/constructs/rpc-problem.md](../../../../docs/constructs/rpc-problem.md)).
+- A failure is a `Problem`. `Problem.make(code)` takes only the code; `NativeProblemRegistry` in [packages/rpc/src/problem.ts](../../../../packages/rpc/src/problem.ts) owns its status and body. An RPC declares its closed union with `problemUnion` and takes it as `error: rpcProblems(...)`.
 - Each context maps its domain failures once with `problemMapper`, as `contentProblems` and `receiptProblems` do, and declares the mapper's type as `ProblemMapper<Failure, Cases>`, where `Cases` is the type of its cases. A failure that an operation cannot produce is marked with `unreachable`.
 - `ProblemBoundaryLive` is the only consumer of a Cause. A handler does not catch defects or render causes itself.
 - A JSON representation is written with `jsonText`, which encodes through Schema and writes the bytes that `JSON.stringify` wrote.

.claude/rules/constitution.md

@@ -1,13 +1,13 @@
 # Monoweb Project Conventions
 
-## SDK Conventions
+## RPC Contract Conventions
 
-When working on `packages/sdk/`:
+When working on `packages/rpc/`:
 
-- Domain methods speak the ubiquitous language: `approve()` not `updateStatus("refunded")`
-- Types are Schema.Class — inferred via `Schema.Schema.Type`, never hand-written interfaces
-- Effect is an internal detail — consumers see plain promises via `createClient()`
-- Every new domain type needs a Schema round-trip test (`encode → decode === original`)
-- Adapter transforms (Hydra unwrap, status mapping, date parsing) live in `src/adapter/`
-- `src/domains/` contain the domain method factories — one file per domain
-- Dual export: `@vektorprogrammet/sdk` (promises) + `@vektorprogrammet/sdk/effect`
+- The RPC tag is the operation ID (`social-events.create`). Command receipts store it
+- Payload and success are Schemas; the error is `rpcProblems(<Operation>Problem)`, a closed `problemUnion` of registry codes
+- Types are inferred from the Schemas, never hand-written interfaces
+- Each RPC takes at most one credential middleware (none for anonymous access) and exactly one `withAccessSpec(...)`; `packages/rpc/test/contract.test.ts` checks the AccessSpec, the tag grammar, and the defect boundary
+- A contract re-exports only the schemas its own RPCs use; clients import other domain values from `@vektorprogrammet/domain`
+- Every client derives from the group: `RpcClient` in Effect code, `callNative`, `callBrowserNative`, and `callHomepageNative` in the apps, and `nativeScriptClient` from `@vektorprogrammet/rpc/script` in journeys and probes. No client is generated or written by hand
+- `packages/rpc/src/social-events.ts` is the precedent to copy

.claude/settings.json

@@ -11,9 +11,9 @@
           },
           {
             "type": "command",
-            "command": "jq -r '.tool_input.file_path' | { read -r f; if [[ \"$f\" == *.ts && \"$f\" == */packages/sdk/* ]]; then cd packages/sdk && bunx tsc --noEmit 2>/dev/null | tail -3; fi; }",
+            "command": "jq -r '.tool_input.file_path' | { read -r f; if [[ \"$f\" == *.ts && \"$f\" == */packages/rpc/* ]]; then cd packages/rpc && bunx tsc --noEmit 2>/dev/null | tail -3; fi; }",
             "asyncRewake": true,
-            "statusMessage": "Checking SDK types..."
+            "statusMessage": "Checking RPC contract types..."
           }
         ]
       }

.github/workflows/checks.yml

@@ -40,8 +40,7 @@ jobs:
           just constructs
           just guides
           just exceptions
-      # Type checks run the Turbo `generate` tasks, which derive and assert the HTTP contract
-      # artifacts. `just check` repeats the fast checks above, as the pre-push hook runs it.
-      - name: Check layout, constructs, guides, Effect exceptions, source safety, format, lint, types, and HTTP contract
+      # `just check` repeats the fast checks above, as the pre-push hook runs it.
+      - name: Check layout, constructs, guides, Effect exceptions, source safety, format, lint, and types
         timeout-minutes: 12
         run: just check