feat: connect application input and output boundaries

src/application/ports/auth-session-port.js

@@ -10,10 +10,24 @@
  *   subscribe(listener: () => void): () => void,
  *   beginSignIn(returnTo?: string): Promise<void>,
  *   signOut(): Promise<void>,
+ *   recover(): Promise<"restored" | "no-session">
+ * }} SessionGateway
+ */
+
+/**
+ * Credential attachment is an HTTP-adapter collaboration, not an application
+ * input capability.
+ *
+ * @typedef {{
  *   attach(request: Request): Promise<Request>,
- *   recover(): Promise<"restored" | "no-session">,
  *   onUnauthenticated(): void
- * }} AuthSessionPort
+ * }} CredentialAttacher
+ */
+
+/**
+ * External auth adapters implement both segregated capabilities.
+ *
+ * @typedef {SessionGateway & CredentialAttacher} AuthSessionPort
  */
 
 export {};