context api

type UserId = String where NonEmpty

type Profile = {
  id: UserId,
}

-- A Bearer-authenticated actor: the JWT `sub` claim is minted into a UserId,
-- verified at the boundary before the handler runs.
actor User { auth = Bearer(secret = "AUTH_JWT_SECRET"), identity = UserId }

service api from http {
  on GET("/me") by u: User () -> Effect[HttpResult[Profile]] {
    Ok(Profile { id: u.identity })
  }
}
