DSL for declaring the authenticated context both sides of the app must agree on.

Who is asking — the user, their organization, their role, whatever staff or entitlement flags authorize the surface — is a contract like any other, and it is the one most often re-derived by hand at each call site until the copies disagree. A host module uses this and declares the projection once:

defmodule MyApp.Assets.Session do
  use PhoenixAssets.Session.Fields

  route "/api/session"

  field :user_id, :string
  field :organization_id, :string
  field :role, :string, values: ["owner", "admin", "member", "viewer"]
  field :platform_admin, :boolean
  field :impersonated_by, :string, optional: true
end

The generated session.ts carries the interface and the route, so the frontend reads one declared shape instead of an ad-hoc JSON blob, and a field the server stops sending is a compile error rather than a silent undefined.

Field names are emitted verbatim, matching the JSON the endpoint actually returns. Types: :string, :integer, :float, :boolean, :map, :list and :any. values: narrows a :string to a literal union; optional: true marks a field that may be absent.