@effect-auth/core 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Effect Auth contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,113 @@
+# @effect-auth/core
+
+Composable Effect-first authentication primitives.
+
+The current alpha surface is intentionally small: service contracts and small helpers that can be wired with application-owned layers.
+
+## Policy
+
+`Policy` is an `Effect` used for authorization. Success means access is allowed. `AuthzError` means access is denied. Other failures stay operational errors.
+
+```ts
+import { Effect } from "effect"
+import * as Policy from "@effect-auth/core/Policy"
+
+const canEditProject = Policy.deny("missing-permission")
+
+const updateProject = Effect.succeed({ updated: true }).pipe(
+  Policy.require(canEditProject)
+)
+
+const decision = Policy.check(canEditProject)
+const detailed = Policy.checkDetailed(canEditProject)
+```
+
+Use `Policy.check` when callers should branch on allowed/denied and let operational errors fail. Use `Policy.checkDetailed` when callers need a value for allowed, denied, or failed.
+
+Policies compose with `all`, `any`, and `not`:
+
+```ts
+declare const isProjectOwner: Policy.Policy
+declare const hasUpdateGrant: Policy.Policy
+declare const isSuspended: Policy.Policy
+
+const canEditProject = Policy.any(
+  isProjectOwner,
+  hasUpdateGrant
+)
+
+const canEditAndNotSuspended = Policy.all(
+  canEditProject,
+  Policy.not(isSuspended, "account-disabled")
+)
+```
+
+## AuthFlow
+
+Login methods should verify a factor, then hand the result to `AuthFlow`. `AuthFlow` decides whether to issue a session, require MFA, require verification, or deny the attempt.
+
+```ts
+import { Effect } from "effect"
+import { AuthFlow } from "@effect-auth/core/AuthFlow"
+import type { UserId } from "@effect-auth/core/Identifiers"
+
+export const completePassword = (userId: UserId) =>
+  Effect.gen(function* () {
+    const authFlow = yield* AuthFlow
+
+    return yield* authFlow.completePrimaryFactor({
+      userId,
+      method: "password",
+      amr: ["pwd"],
+      aal: "aal1"
+    })
+  })
+```
+
+## Sessions
+
+`Sessions` is the server-side session authority. Transports such as cookies are separate services so browser, API, and custom transports can share the same session strategy.
+
+```ts
+import { Effect } from "effect"
+import type { UserId } from "@effect-auth/core/Identifiers"
+import { SessionCookie, Sessions } from "@effect-auth/core/Sessions"
+
+export const createBrowserSession = (userId: UserId) =>
+  Effect.gen(function* () {
+    const sessions = yield* Sessions
+    const sessionCookie = yield* SessionCookie
+
+    const issued = yield* sessions.create({
+      userId,
+      method: "password",
+      amr: ["pwd"],
+      aal: "aal1"
+    })
+
+    const cookie = yield* sessionCookie.commit(issued)
+
+    return { issued, cookie }
+  })
+```
+
+## Challenge
+
+`Challenge` is the shared primitive for short-lived proofs: email OTP, magic link, passkey challenges, OAuth state, reset password, and MFA.
+
+```ts
+import { Duration, Effect, Redacted } from "effect"
+import { Challenge } from "@effect-auth/core/Challenge"
+
+export const issueEmailOtp = (email: string, code: string) =>
+  Effect.gen(function* () {
+    const challenge = yield* Challenge
+
+    return yield* challenge.issue({
+      type: "email-otp",
+      subject: email,
+      ttl: Duration.minutes(10),
+      secret: Redacted.make(code)
+    })
+  })
+```

package/dist/AuditLog.d.ts

@@ -0,0 +1,71 @@
+import { Context, Effect, Layer } from "effect";
+import type { AuditEventId, EmailHash, IpHash, PolicyId, SessionId, UnixMillis, UserAgentHash, UserId } from "./Identifiers.js";
+declare const AuditLogError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuditLogError";
+} & Readonly<A>;
+export declare class AuditLogError extends AuditLogError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export type AuditActor = {
+    readonly type: "anonymous";
+} | {
+    readonly type: "user";
+    readonly userId: UserId;
+    readonly sessionId?: SessionId;
+};
+export type AuditSubject = {
+    readonly type: "anonymous";
+} | {
+    readonly type: "email";
+    readonly emailHash: EmailHash;
+} | {
+    readonly type: "user";
+    readonly userId: UserId;
+};
+export interface AuditRequest {
+    readonly ipHash?: IpHash;
+    readonly userAgentHash?: UserAgentHash;
+}
+export type AuthAuditEvent = {
+    readonly type: "auth.login.succeeded";
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly method: string;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+} | {
+    readonly type: "auth.login.failed";
+    readonly id?: AuditEventId;
+    readonly subject: AuditSubject;
+    readonly method: string;
+    readonly reason: string;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+} | {
+    readonly type: "auth.session.revoked";
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly sessionId: SessionId;
+    readonly reason: string;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+} | {
+    readonly type: "auth.policy.denied";
+    readonly id?: AuditEventId;
+    readonly actor: AuditActor;
+    readonly policyId: PolicyId;
+    readonly reason: string;
+    readonly request?: AuditRequest;
+    readonly occurredAt: UnixMillis;
+};
+export interface AuditLogService {
+    readonly emit: (event: AuthAuditEvent) => Effect.Effect<void, AuditLogError>;
+}
+declare const AuditLog_base: Context.ServiceClass<AuditLog, "auth/AuditLog", AuditLogService>;
+export declare class AuditLog extends AuditLog_base {
+}
+export declare const AuditLogNoopLive: Layer.Layer<AuditLog, never, never>;
+export {};
+//# sourceMappingURL=AuditLog.d.ts.map

package/dist/AuditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLog.d.ts","sourceRoot":"","sources":["../src/AuditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;;;;AAE/H,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAEtF,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;CACvC;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,CAAA;AAEL,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;CAC7E;;AAED,qBAAa,QAAS,SAAQ,aAA6D;CAAG;AAE9F,eAAO,MAAM,gBAAgB,qCAE3B,CAAA"}

package/dist/AuditLog.js

@@ -0,0 +1,9 @@
+import { Context, Data, Effect, Layer } from "effect";
+export class AuditLogError extends Data.TaggedError("AuditLogError") {
+}
+export class AuditLog extends Context.Service()("auth/AuditLog") {
+}
+export const AuditLogNoopLive = Layer.succeed(AuditLog)({
+    emit: () => Effect.void
+});
+//# sourceMappingURL=AuditLog.js.map

package/dist/AuditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLog.js","sourceRoot":"","sources":["../src/AuditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAIrD,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAGjE;CAAG;AAyDL,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA6B,CAAC,eAAe,CAAC;CAAG;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;CACxB,CAAC,CAAA"}

package/dist/AuthFlow.d.ts

@@ -0,0 +1,63 @@
+import { Context, Effect } from "effect";
+import type { AuthFlowId, UserId } from "./Identifiers.js";
+import type { AuthAssuranceLevel, AuthMethodReference, IssuedSession } from "./Sessions.js";
+export type AuthMethod = "password" | "email-otp" | "magic-link" | "passkey" | "oauth" | "totp" | "backup-code" | (string & {});
+export type AuthDenyReason = "invalid-credentials" | "account-disabled" | "rate-limited" | "policy-denied" | "requires-explicit-linking" | (string & {});
+export interface MfaFactor {
+    readonly type: "totp" | "backup-code" | "passkey" | (string & {});
+}
+export interface PrimaryFactorResult {
+    readonly userId: UserId;
+    readonly method: AuthMethod;
+    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly aal: AuthAssuranceLevel;
+}
+export interface MfaCompleteInput {
+    readonly flowId: AuthFlowId;
+    readonly method: AuthMethod;
+    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly aal: AuthAssuranceLevel;
+}
+export interface AuthFlowCompleteInput {
+    readonly userId: UserId;
+    readonly method: AuthMethod;
+    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly aal: AuthAssuranceLevel;
+}
+export type AuthResult = {
+    readonly type: "authenticated";
+    readonly session: IssuedSession;
+} | {
+    readonly type: "requires-mfa";
+    readonly flowId: AuthFlowId;
+    readonly factors: ReadonlyArray<MfaFactor>;
+} | {
+    readonly type: "requires-email-verification";
+    readonly flowId: AuthFlowId;
+} | {
+    readonly type: "requires-passkey-enrollment";
+    readonly flowId: AuthFlowId;
+} | {
+    readonly type: "denied";
+    readonly reason: AuthDenyReason;
+};
+declare const AuthFlowError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthFlowError";
+} & Readonly<A>;
+export declare class AuthFlowError extends AuthFlowError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface AuthFlowService {
+    readonly startPrimaryFactor: (input: PrimaryFactorResult) => Effect.Effect<AuthResult, AuthFlowError>;
+    readonly completePrimaryFactor: (input: PrimaryFactorResult) => Effect.Effect<AuthResult, AuthFlowError>;
+    readonly completeMfa: (input: MfaCompleteInput) => Effect.Effect<AuthResult, AuthFlowError>;
+    readonly complete: (input: AuthFlowCompleteInput) => Effect.Effect<AuthResult, AuthFlowError>;
+}
+declare const AuthFlow_base: Context.ServiceClass<AuthFlow, "auth/AuthFlow", AuthFlowService>;
+export declare class AuthFlow extends AuthFlow_base {
+}
+export declare const denied: (reason: AuthDenyReason) => AuthResult;
+export {};
+//# sourceMappingURL=AuthFlow.d.ts.map

package/dist/AuthFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlow.d.ts","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE3F,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,MAAM,cAAc,GACtB,qBAAqB,GACrB,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,2BAA2B,GAC3B,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;CAClE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;CAAE,GAC1G;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;;;;AAEhE,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACrG,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACxG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAC3F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;CAC9F;;AAED,qBAAa,QAAS,SAAQ,aAA6D;CAAG;AAE9F,eAAO,MAAM,MAAM,GAAI,QAAQ,cAAc,KAAG,UAG9C,CAAA"}

package/dist/AuthFlow.js

@@ -0,0 +1,10 @@
+import { Context, Data, Effect } from "effect";
+export class AuthFlowError extends Data.TaggedError("AuthFlowError") {
+}
+export class AuthFlow extends Context.Service()("auth/AuthFlow") {
+}
+export const denied = (reason) => ({
+    type: "denied",
+    reason
+});
+//# sourceMappingURL=AuthFlow.js.map

package/dist/AuthFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlow.js","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAuD9C,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAGjE;CAAG;AASL,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA6B,CAAC,eAAe,CAAC;CAAG;AAE9F,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAc,EAAE,CAAC,CAAC;IAC7D,IAAI,EAAE,QAAQ;IACd,MAAM;CACP,CAAC,CAAA"}

package/dist/Challenge.d.ts

@@ -0,0 +1,64 @@
+import { Context, Effect, Redacted } from "effect";
+import type * as Duration from "effect/Duration";
+import type { ChallengeId, UnixMillis } from "./Identifiers.js";
+export type ChallengeType = "email-otp" | "magic-link" | "passkey-authentication" | "reset-password" | "email-verification" | "oauth-state" | "mfa" | (string & {});
+export interface ChallengeIssueInput {
+    readonly type: ChallengeType;
+    readonly subject: string;
+    readonly ttl: Duration.Duration;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface IssuedChallenge {
+    readonly id: ChallengeId;
+    readonly type: ChallengeType;
+    readonly subject: string;
+    readonly secret?: Redacted.Redacted<string>;
+    readonly expiresAt: UnixMillis;
+}
+export interface ChallengeVerifyInput {
+    readonly challengeId: ChallengeId;
+    readonly type: ChallengeType;
+    readonly secret?: Redacted.Redacted<string>;
+}
+export interface VerifiedChallenge {
+    readonly id: ChallengeId;
+    readonly type: ChallengeType;
+    readonly subject: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+declare const ChallengeIssueError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ChallengeIssueError";
+} & Readonly<A>;
+export declare class ChallengeIssueError extends ChallengeIssueError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const ChallengeVerifyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ChallengeVerifyError";
+} & Readonly<A>;
+export declare class ChallengeVerifyError extends ChallengeVerifyError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const ChallengeConsumeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ChallengeConsumeError";
+} & Readonly<A>;
+export declare class ChallengeConsumeError extends ChallengeConsumeError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export type ChallengeError = ChallengeIssueError | ChallengeVerifyError | ChallengeConsumeError;
+export interface ChallengeService {
+    readonly issue: (input: ChallengeIssueInput) => Effect.Effect<IssuedChallenge, ChallengeIssueError>;
+    readonly verify: (input: ChallengeVerifyInput) => Effect.Effect<VerifiedChallenge, ChallengeVerifyError>;
+    readonly consume: (id: ChallengeId) => Effect.Effect<void, ChallengeConsumeError>;
+}
+declare const Challenge_base: Context.ServiceClass<Challenge, "auth/Challenge", ChallengeService>;
+export declare class Challenge extends Challenge_base {
+}
+export {};
+//# sourceMappingURL=Challenge.d.ts.map

package/dist/Challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Challenge.d.ts","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE/D,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,YAAY,GACZ,wBAAwB,GACxB,gBAAgB,GAChB,oBAAoB,GACpB,aAAa,GACb,KAAK,GACL,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACtD;;;;AAED,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,cAAc,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,qBAAqB,CAAA;AAE/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IACnG,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAA;IACxG,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;CAClF;;AAED,qBAAa,SAAU,SAAQ,cAAgE;CAAG"}

package/dist/Challenge.js

@@ -0,0 +1,10 @@
+import { Context, Data, Effect, Redacted } from "effect";
+export class ChallengeIssueError extends Data.TaggedError("ChallengeIssueError") {
+}
+export class ChallengeVerifyError extends Data.TaggedError("ChallengeVerifyError") {
+}
+export class ChallengeConsumeError extends Data.TaggedError("ChallengeConsumeError") {
+}
+export class Challenge extends Context.Service()("auth/Challenge") {
+}
+//# sourceMappingURL=Challenge.js.map

package/dist/Challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Challenge.js","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AA4CxD,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAG7E;CAAG;AAEL,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAG/E;CAAG;AAEL,MAAM,OAAO,qBAAsB,SAAQ,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAGjF;CAAG;AAUL,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAA+B,CAAC,gBAAgB,CAAC;CAAG"}

package/dist/Crypto.d.ts

@@ -0,0 +1,35 @@
+import { Context, Effect, Redacted } from "effect";
+export type CryptoOperation = "random-bytes" | "random-token" | "digest" | "hmac-sha256" | "timing-safe-equal";
+declare const CryptoError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "CryptoError";
+} & Readonly<A>;
+export declare class CryptoError extends CryptoError_base<{
+    readonly operation: CryptoOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export type CryptoKey = Redacted.Redacted<string> | Uint8Array;
+export interface HmacSha256Input {
+    readonly key: CryptoKey;
+    readonly data: string | Uint8Array;
+}
+export interface DigestInput {
+    readonly data: string | Uint8Array;
+}
+export interface TimingSafeEqualInput {
+    readonly left: Uint8Array;
+    readonly right: Uint8Array;
+}
+export interface CryptoService {
+    readonly randomBytes: (byteLength: number) => Effect.Effect<Uint8Array, CryptoError>;
+    readonly randomToken: (byteLength?: number) => Effect.Effect<string, CryptoError>;
+    readonly digestSha256: (input: DigestInput) => Effect.Effect<string, CryptoError>;
+    readonly hmacSha256: (input: HmacSha256Input) => Effect.Effect<string, CryptoError>;
+    readonly timingSafeEqual: (input: TimingSafeEqualInput) => Effect.Effect<boolean, CryptoError>;
+}
+declare const Crypto_base: Context.ServiceClass<Crypto, "auth/Crypto", CryptoService>;
+export declare class Crypto extends Crypto_base {
+}
+export {};
+//# sourceMappingURL=Crypto.d.ts.map

package/dist/Crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Crypto.d.ts","sourceRoot":"","sources":["../src/Crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAExD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,cAAc,GACd,QAAQ,GACR,aAAa,GACb,mBAAmB,CAAA;;;;AAEvB,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAAA;AAE9D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACpF,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACjF,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACjF,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACnF,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;CAC/F;;AAED,qBAAa,MAAO,SAAQ,WAAuD;CAAG"}

package/dist/Crypto.js

@@ -0,0 +1,6 @@
+import { Context, Data, Effect, Redacted } from "effect";
+export class CryptoError extends Data.TaggedError("CryptoError") {
+}
+export class Crypto extends Context.Service()("auth/Crypto") {
+}
+//# sourceMappingURL=Crypto.js.map

package/dist/Crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Crypto.js","sourceRoot":"","sources":["../src/Crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AASxD,MAAM,OAAO,WAAY,SAAQ,IAAI,CAAC,WAAW,CAAC,aAAa,CAI7D;CAAG;AA0BL,MAAM,OAAO,MAAO,SAAQ,OAAO,CAAC,OAAO,EAAyB,CAAC,aAAa,CAAC;CAAG"}

package/dist/Identifiers.d.ts

@@ -0,0 +1,59 @@
+import { Brand, Schema } from "effect";
+export type UserId = Brand.Branded<string, "auth/UserId">;
+export declare const UserId: Brand.Constructor<UserId>;
+export declare const UserIdSchema: Schema.brand<Schema.String, "auth/UserId">;
+export type IdentityId = Brand.Branded<string, "auth/IdentityId">;
+export declare const IdentityId: Brand.Constructor<IdentityId>;
+export declare const IdentityIdSchema: Schema.brand<Schema.String, "auth/IdentityId">;
+export type CredentialId = Brand.Branded<string, "auth/CredentialId">;
+export declare const CredentialId: Brand.Constructor<CredentialId>;
+export declare const CredentialIdSchema: Schema.brand<Schema.String, "auth/CredentialId">;
+export type SessionId = Brand.Branded<string, "auth/SessionId">;
+export declare const SessionId: Brand.Constructor<SessionId>;
+export declare const SessionIdSchema: Schema.brand<Schema.String, "auth/SessionId">;
+export type SessionToken = Brand.Branded<string, "auth/SessionToken">;
+export declare const SessionToken: Brand.Constructor<SessionToken>;
+export declare const SessionTokenSchema: Schema.brand<Schema.String, "auth/SessionToken">;
+export type ChallengeId = Brand.Branded<string, "auth/ChallengeId">;
+export declare const ChallengeId: Brand.Constructor<ChallengeId>;
+export declare const ChallengeIdSchema: Schema.brand<Schema.String, "auth/ChallengeId">;
+export type AuthFlowId = Brand.Branded<string, "auth/AuthFlowId">;
+export declare const AuthFlowId: Brand.Constructor<AuthFlowId>;
+export declare const AuthFlowIdSchema: Schema.brand<Schema.String, "auth/AuthFlowId">;
+export type OAuthProviderId = Brand.Branded<string, "auth/OAuthProviderId">;
+export declare const OAuthProviderId: Brand.Constructor<OAuthProviderId>;
+export declare const OAuthProviderIdSchema: Schema.brand<Schema.String, "auth/OAuthProviderId">;
+export type OAuthAccountId = Brand.Branded<string, "auth/OAuthAccountId">;
+export declare const OAuthAccountId: Brand.Constructor<OAuthAccountId>;
+export declare const OAuthAccountIdSchema: Schema.brand<Schema.String, "auth/OAuthAccountId">;
+export type PermissionId = Brand.Branded<string, "auth/PermissionId">;
+export declare const PermissionId: Brand.Constructor<PermissionId>;
+export declare const PermissionIdSchema: Schema.brand<Schema.String, "auth/PermissionId">;
+export type PolicyId = Brand.Branded<string, "auth/PolicyId">;
+export declare const PolicyId: Brand.Constructor<PolicyId>;
+export declare const PolicyIdSchema: Schema.brand<Schema.String, "auth/PolicyId">;
+export type RoleId = Brand.Branded<string, "auth/RoleId">;
+export declare const RoleId: Brand.Constructor<RoleId>;
+export declare const RoleIdSchema: Schema.brand<Schema.String, "auth/RoleId">;
+export type AuditEventId = Brand.Branded<string, "auth/AuditEventId">;
+export declare const AuditEventId: Brand.Constructor<AuditEventId>;
+export declare const AuditEventIdSchema: Schema.brand<Schema.String, "auth/AuditEventId">;
+export type Email = Brand.Branded<string, "auth/Email">;
+export declare const Email: Brand.Constructor<Email>;
+export declare const EmailSchema: Schema.brand<Schema.String, "auth/Email">;
+export type EmailHash = Brand.Branded<string, "auth/EmailHash">;
+export declare const EmailHash: Brand.Constructor<EmailHash>;
+export declare const EmailHashSchema: Schema.brand<Schema.String, "auth/EmailHash">;
+export type IpAddress = Brand.Branded<string, "auth/IpAddress">;
+export declare const IpAddress: Brand.Constructor<IpAddress>;
+export declare const IpAddressSchema: Schema.brand<Schema.String, "auth/IpAddress">;
+export type IpHash = Brand.Branded<string, "auth/IpHash">;
+export declare const IpHash: Brand.Constructor<IpHash>;
+export declare const IpHashSchema: Schema.brand<Schema.String, "auth/IpHash">;
+export type UserAgentHash = Brand.Branded<string, "auth/UserAgentHash">;
+export declare const UserAgentHash: Brand.Constructor<UserAgentHash>;
+export declare const UserAgentHashSchema: Schema.brand<Schema.String, "auth/UserAgentHash">;
+export type UnixMillis = Brand.Branded<number, "auth/UnixMillis">;
+export declare const UnixMillis: Brand.Constructor<UnixMillis>;
+export declare const UnixMillisSchema: Schema.brand<Schema.Number, "auth/UnixMillis">;
+//# sourceMappingURL=Identifiers.d.ts.map

package/dist/Identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identifiers.d.ts","sourceRoot":"","sources":["../src/Identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEtC,MAAM,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AACzD,eAAO,MAAM,MAAM,2BAA0B,CAAA;AAC7C,eAAO,MAAM,YAAY,4CAAkD,CAAA;AAE3E,MAAM,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;AACjE,eAAO,MAAM,UAAU,+BAA8B,CAAA;AACrD,eAAO,MAAM,gBAAgB,gDAAsD,CAAA;AAEnF,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AACrE,eAAO,MAAM,YAAY,iCAAgC,CAAA;AACzD,eAAO,MAAM,kBAAkB,kDAAwD,CAAA;AAEvF,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAC/D,eAAO,MAAM,SAAS,8BAA6B,CAAA;AACnD,eAAO,MAAM,eAAe,+CAAqD,CAAA;AAEjF,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AACrE,eAAO,MAAM,YAAY,iCAAgC,CAAA;AACzD,eAAO,MAAM,kBAAkB,kDAAwD,CAAA;AAEvF,MAAM,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AACnE,eAAO,MAAM,WAAW,gCAA+B,CAAA;AACvD,eAAO,MAAM,iBAAiB,iDAAuD,CAAA;AAErF,MAAM,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;AACjE,eAAO,MAAM,UAAU,+BAA8B,CAAA;AACrD,eAAO,MAAM,gBAAgB,gDAAsD,CAAA;AAEnF,MAAM,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;AAC3E,eAAO,MAAM,eAAe,oCAAmC,CAAA;AAC/D,eAAO,MAAM,qBAAqB,qDAA2D,CAAA;AAE7F,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;AACzE,eAAO,MAAM,cAAc,mCAAkC,CAAA;AAC7D,eAAO,MAAM,oBAAoB,oDAA0D,CAAA;AAE3F,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AACrE,eAAO,MAAM,YAAY,iCAAgC,CAAA;AACzD,eAAO,MAAM,kBAAkB,kDAAwD,CAAA;AAEvF,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;AAC7D,eAAO,MAAM,QAAQ,6BAA4B,CAAA;AACjD,eAAO,MAAM,cAAc,8CAAoD,CAAA;AAE/E,MAAM,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AACzD,eAAO,MAAM,MAAM,2BAA0B,CAAA;AAC7C,eAAO,MAAM,YAAY,4CAAkD,CAAA;AAE3E,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AACrE,eAAO,MAAM,YAAY,iCAAgC,CAAA;AACzD,eAAO,MAAM,kBAAkB,kDAAwD,CAAA;AAEvF,MAAM,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AACvD,eAAO,MAAM,KAAK,0BAAyB,CAAA;AAC3C,eAAO,MAAM,WAAW,2CAAiD,CAAA;AAEzE,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAC/D,eAAO,MAAM,SAAS,8BAA6B,CAAA;AACnD,eAAO,MAAM,eAAe,+CAAqD,CAAA;AAEjF,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAC/D,eAAO,MAAM,SAAS,8BAA6B,CAAA;AACnD,eAAO,MAAM,eAAe,+CAAqD,CAAA;AAEjF,MAAM,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AACzD,eAAO,MAAM,MAAM,2BAA0B,CAAA;AAC7C,eAAO,MAAM,YAAY,4CAAkD,CAAA;AAE3E,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AACvE,eAAO,MAAM,aAAa,kCAAiC,CAAA;AAC3D,eAAO,MAAM,mBAAmB,mDAAyD,CAAA;AAEzF,MAAM,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;AACjE,eAAO,MAAM,UAAU,+BAA8B,CAAA;AACrD,eAAO,MAAM,gBAAgB,gDAAsD,CAAA"}

package/dist/Identifiers.js

@@ -0,0 +1,40 @@
+import { Brand, Schema } from "effect";
+export const UserId = Brand.nominal();
+export const UserIdSchema = Schema.String.pipe(Schema.brand("auth/UserId"));
+export const IdentityId = Brand.nominal();
+export const IdentityIdSchema = Schema.String.pipe(Schema.brand("auth/IdentityId"));
+export const CredentialId = Brand.nominal();
+export const CredentialIdSchema = Schema.String.pipe(Schema.brand("auth/CredentialId"));
+export const SessionId = Brand.nominal();
+export const SessionIdSchema = Schema.String.pipe(Schema.brand("auth/SessionId"));
+export const SessionToken = Brand.nominal();
+export const SessionTokenSchema = Schema.String.pipe(Schema.brand("auth/SessionToken"));
+export const ChallengeId = Brand.nominal();
+export const ChallengeIdSchema = Schema.String.pipe(Schema.brand("auth/ChallengeId"));
+export const AuthFlowId = Brand.nominal();
+export const AuthFlowIdSchema = Schema.String.pipe(Schema.brand("auth/AuthFlowId"));
+export const OAuthProviderId = Brand.nominal();
+export const OAuthProviderIdSchema = Schema.String.pipe(Schema.brand("auth/OAuthProviderId"));
+export const OAuthAccountId = Brand.nominal();
+export const OAuthAccountIdSchema = Schema.String.pipe(Schema.brand("auth/OAuthAccountId"));
+export const PermissionId = Brand.nominal();
+export const PermissionIdSchema = Schema.String.pipe(Schema.brand("auth/PermissionId"));
+export const PolicyId = Brand.nominal();
+export const PolicyIdSchema = Schema.String.pipe(Schema.brand("auth/PolicyId"));
+export const RoleId = Brand.nominal();
+export const RoleIdSchema = Schema.String.pipe(Schema.brand("auth/RoleId"));
+export const AuditEventId = Brand.nominal();
+export const AuditEventIdSchema = Schema.String.pipe(Schema.brand("auth/AuditEventId"));
+export const Email = Brand.nominal();
+export const EmailSchema = Schema.String.pipe(Schema.brand("auth/Email"));
+export const EmailHash = Brand.nominal();
+export const EmailHashSchema = Schema.String.pipe(Schema.brand("auth/EmailHash"));
+export const IpAddress = Brand.nominal();
+export const IpAddressSchema = Schema.String.pipe(Schema.brand("auth/IpAddress"));
+export const IpHash = Brand.nominal();
+export const IpHashSchema = Schema.String.pipe(Schema.brand("auth/IpHash"));
+export const UserAgentHash = Brand.nominal();
+export const UserAgentHashSchema = Schema.String.pipe(Schema.brand("auth/UserAgentHash"));
+export const UnixMillis = Brand.nominal();
+export const UnixMillisSchema = Schema.Number.pipe(Schema.brand("auth/UnixMillis"));
+//# sourceMappingURL=Identifiers.js.map

package/dist/Identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identifiers.js","sourceRoot":"","sources":["../src/Identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGtC,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAU,CAAA;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;AAG3E,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAc,CAAA;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAGnF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,EAAgB,CAAA;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAGvF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAa,CAAA;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;AAGjF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,EAAgB,CAAA;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAGvF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAe,CAAA;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAGrF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAc,CAAA;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAGnF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,EAAmB,CAAA;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAG7F,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,EAAkB,CAAA;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA;AAG3F,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,EAAgB,CAAA;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAGvF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAY,CAAA;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA;AAG/E,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAU,CAAA;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;AAG3E,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,EAAgB,CAAA;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAGvF,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAS,CAAA;AAC3C,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;AAGzE,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAa,CAAA;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;AAGjF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAa,CAAA;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;AAGjF,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAU,CAAA;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;AAG3E,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,EAAiB,CAAA;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAA;AAGzF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAc,CAAA;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA"}

package/dist/Policy.d.ts

@@ -0,0 +1,39 @@
+import { Effect } from "effect";
+import type { PolicyId } from "./Identifiers.js";
+import type { CurrentActor } from "./Sessions.js";
+export type AuthzDenyReason = "missing-permission" | "missing-role" | "missing-relation" | "missing-grant" | "not-owner" | "not-authenticated" | (string & {});
+declare const AuthzError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthzError";
+} & Readonly<A>;
+export declare class AuthzError extends AuthzError_base<{
+    readonly reason: AuthzDenyReason;
+    readonly policyId?: PolicyId;
+    readonly message?: string;
+    readonly cause?: unknown;
+}> {
+}
+export type Policy<A = void, E = never, R = never> = Effect.Effect<A, AuthzError | E, CurrentActor | R>;
+export type PolicyDecision = {
+    readonly type: "allowed";
+} | {
+    readonly type: "denied";
+    readonly error: AuthzError;
+};
+export type PolicyCheckResult<E = never> = PolicyDecision | {
+    readonly type: "failed";
+    readonly error: E;
+};
+type NonAuthzError<E> = Exclude<E, AuthzError>;
+type EffectError<T> = T extends Effect.Effect<unknown, infer E, unknown> ? E : never;
+type EffectContext<T> = T extends Effect.Effect<unknown, unknown, infer R> ? R : never;
+export declare const isAuthzError: (error: unknown) => error is AuthzError;
+export declare const allow: Policy;
+export declare const deny: (reason: AuthzDenyReason, policyId?: PolicyId) => Policy<never>;
+export declare const all: <const Policies extends ReadonlyArray<Effect.Effect<unknown, unknown, unknown>>>(...policies: Policies) => Effect.Effect<void, EffectError<Policies[number]>, EffectContext<Policies[number]>>;
+export declare const any: <const Policies extends ReadonlyArray<Effect.Effect<unknown, unknown, unknown>>>(...policies: Policies) => Effect.Effect<void, AuthzError | NonAuthzError<EffectError<Policies[number]>>, EffectContext<Policies[number]>>;
+export declare const not: <A, E, R>(policy: Effect.Effect<A, E, R>, reason?: AuthzDenyReason) => Effect.Effect<void, AuthzError | NonAuthzError<E>, R>;
+export declare const check: <A, E, R>(policy: Effect.Effect<A, E, R>) => Effect.Effect<PolicyDecision, NonAuthzError<E>, R>;
+export declare const checkDetailed: <A, E, R>(policy: Effect.Effect<A, E, R>) => Effect.Effect<PolicyCheckResult<NonAuthzError<E>>, never, R>;
+export declare const require: <A, E, R>(policy: Effect.Effect<A, E, R>) => <B, E2, R2>(effect: Effect.Effect<B, E2, R2>) => Effect.Effect<B, E | E2, R | R2>;
+export {};
+//# sourceMappingURL=Policy.d.ts.map

package/dist/Policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.d.ts","sourceRoot":"","sources":["../src/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAErC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,mBAAmB,GACnB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;;;;AAEjB,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAA;AAEvG,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAA;AAE3D,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,KAAK,IACnC,cAAc,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAA;AAElD,KAAK,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;AAC9C,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;AACpF,KAAK,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;AAEtF,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,UAQtD,CAAA;AAED,eAAO,MAAM,KAAK,EAAE,MAAoB,CAAA;AAExC,eAAO,MAAM,IAAI,GAAI,QAAQ,eAAe,EAAE,WAAW,QAAQ,KAAG,MAAM,CAAC,KAAK,CAC7B,CAAA;AAEnD,eAAO,MAAM,GAAG,GAAI,KAAK,CAAC,QAAQ,SAAS,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAChG,GAAG,UAAU,QAAQ,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAKM,CAAA;AAE3F,eAAO,MAAM,GAAG,GAAI,KAAK,CAAC,QAAQ,SAAS,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAChG,GAAG,UAAU,QAAQ,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CA4BhH,CAAA;AAED,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACzB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAQ,eAAwC,KAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAMpD,CAAA;AAEH,eAAO,MAAM,KAAK,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAS9G,CAAA;AAEH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACnC,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAS3D,CAAA;AAEH,eAAO,MAAM,OAAO,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAC5D,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CACxC,CAAA"}

package/dist/Policy.js

@@ -0,0 +1,50 @@
+import { Data, Effect } from "effect";
+export class AuthzError extends Data.TaggedError("AuthzError") {
+}
+export const isAuthzError = (error) => {
+    if (typeof error !== "object" || error === null) {
+        return false;
+    }
+    const record = error;
+    return record._tag === "AuthzError" && typeof record.reason === "string";
+};
+export const allow = Effect.void;
+export const deny = (reason, policyId) => Effect.fail(new AuthzError({ reason, policyId }));
+export const all = (...policies) => Effect.gen(function* () {
+    for (const policy of policies) {
+        yield* policy;
+    }
+});
+export const any = (...policies) => {
+    const loop = (index, lastDeny) => {
+        const policy = policies[index];
+        if (policy === undefined) {
+            return Effect.fail(lastDeny ?? new AuthzError({ reason: "policy-not-satisfied" }));
+        }
+        return policy.pipe(Effect.matchEffect({
+            onSuccess: () => Effect.void,
+            onFailure: (error) => isAuthzError(error)
+                ? loop(index + 1, error)
+                : Effect.fail(error)
+        }));
+    };
+    return loop(0, undefined);
+};
+export const not = (policy, reason = "policy-not-satisfied") => policy.pipe(Effect.matchEffect({
+    onSuccess: () => Effect.fail(new AuthzError({ reason })),
+    onFailure: (error) => (isAuthzError(error) ? Effect.void : Effect.fail(error))
+}));
+export const check = (policy) => policy.pipe(Effect.matchEffect({
+    onSuccess: () => Effect.succeed({ type: "allowed" }),
+    onFailure: (error) => isAuthzError(error)
+        ? Effect.succeed({ type: "denied", error })
+        : Effect.fail(error)
+}));
+export const checkDetailed = (policy) => policy.pipe(Effect.match({
+    onSuccess: () => ({ type: "allowed" }),
+    onFailure: (error) => isAuthzError(error)
+        ? ({ type: "denied", error })
+        : ({ type: "failed", error: error })
+}));
+export const require = (policy) => (effect) => Effect.flatMap(policy, () => effect);
+//# sourceMappingURL=Policy.js.map

package/dist/Policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.js","sourceRoot":"","sources":["../src/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAcrC,MAAM,OAAO,UAAW,SAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAK3D;CAAG;AAgBL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAA;IAE/C,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAA;AAC1E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAW,MAAM,CAAC,IAAI,CAAA;AAExC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAuB,EAAE,QAAmB,EAAiB,EAAE,CAClF,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;AAEnD,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAG,QAAkB,EACgE,EAAE,CACvF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,CAAC,MAAM,CAAA;IACf,CAAC;AACH,CAAC,CAAwF,CAAA;AAE3F,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAG,QAAkB,EAC4F,EAAE;IACnH,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,QAAgC,EAI3D,EAAE;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAA;QACpF,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAChB,MAAM,CAAC,WAAW,CAAC;YACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;YAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC;gBACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAqD,CAAC;SACzE,CAAC,CAKH,CAAA;IACH,CAAC,CAAA;IAED,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,MAA8B,EAC9B,SAA0B,sBAAsB,EACO,EAAE,CACzD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,WAAW,CAAC;IACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAyB,CAAC,CAAC;CACnG,CAAC,CACH,CAAA;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAU,MAA8B,EAAsD,EAAE,CACnH,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,WAAW,CAAC;IACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;IAC7D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAW,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAyB,CAAC;CAC7C,CAAC,CACH,CAAA;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAA8B,EACgC,EAAE,CAChE,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC;IACX,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAU;IAC/C,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAU;QACtC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAyB,EAAE,CAAU;CACtE,CAAC,CACH,CAAA;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAU,MAA8B,EAAE,EAAE,CACjE,CAAY,MAAgC,EAAoC,EAAE,CAChF,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA"}

package/dist/Privacy.d.ts

@@ -0,0 +1,24 @@
+import { Context, Effect, Layer } from "effect";
+import { EmailHash, IpHash, UserAgentHash } from "./Identifiers.js";
+import type { Email, IpAddress } from "./Identifiers.js";
+export type PrivacyOperation = "email-hash" | "ip-hash" | "user-agent-hash";
+declare const PrivacyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PrivacyError";
+} & Readonly<A>;
+export declare class PrivacyError extends PrivacyError_base<{
+    readonly operation: PrivacyOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface PrivacyService {
+    readonly emailHash: (email: Email) => Effect.Effect<EmailHash, PrivacyError>;
+    readonly ipHash: (ip: IpAddress) => Effect.Effect<IpHash, PrivacyError>;
+    readonly userAgentHash: (userAgent: string) => Effect.Effect<UserAgentHash, PrivacyError>;
+}
+declare const Privacy_base: Context.ServiceClass<Privacy, "auth/Privacy", PrivacyService>;
+export declare class Privacy extends Privacy_base {
+}
+export declare const PrivacyTestLive: Layer.Layer<Privacy, never, never>;
+export {};
+//# sourceMappingURL=Privacy.d.ts.map

package/dist/Privacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Privacy.d.ts","sourceRoot":"","sources":["../src/Privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAExD,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,SAAS,GAAG,iBAAiB,CAAA;;;;AAE3E,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAC5E,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;CAC1F;;AAED,qBAAa,OAAQ,SAAQ,YAA0D;CAAG;AAE1F,eAAO,MAAM,eAAe,oCAI1B,CAAA"}

package/dist/Privacy.js

@@ -0,0 +1,12 @@
+import { Context, Data, Effect, Layer } from "effect";
+import { EmailHash, IpHash, UserAgentHash } from "./Identifiers.js";
+export class PrivacyError extends Data.TaggedError("PrivacyError") {
+}
+export class Privacy extends Context.Service()("auth/Privacy") {
+}
+export const PrivacyTestLive = Layer.succeed(Privacy)({
+    emailHash: (email) => Effect.succeed(EmailHash(`test:email:${email}`)),
+    ipHash: (ip) => Effect.succeed(IpHash(`test:ip:${ip}`)),
+    userAgentHash: (userAgent) => Effect.succeed(UserAgentHash(`test:user-agent:${userAgent}`))
+});
+//# sourceMappingURL=Privacy.js.map

package/dist/Privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Privacy.js","sourceRoot":"","sources":["../src/Privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAKnE,MAAM,OAAO,YAAa,SAAQ,IAAI,CAAC,WAAW,CAAC,cAAc,CAI/D;CAAG;AAQL,MAAM,OAAO,OAAQ,SAAQ,OAAO,CAAC,OAAO,EAA2B,CAAC,cAAc,CAAC;CAAG;AAE1F,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvD,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;CAC5F,CAAC,CAAA"}

package/dist/Sessions.d.ts

@@ -0,0 +1,121 @@
+import { Context, Effect } from "effect";
+import type * as Option from "effect/Option";
+import type { SessionId, SessionToken, UnixMillis, UserId } from "./Identifiers.js";
+export type AuthAssuranceLevel = "aal1" | "aal2" | "aal3";
+export type AuthMethodReference = "pwd" | "otp" | "email" | "magic_link" | "passkey" | "oauth" | "totp" | "backup_code" | (string & {});
+export interface SessionTtlPolicy {
+    readonly idleTtlMillis: number;
+    readonly absoluteTtlMillis: number;
+    readonly refreshAfterMillis: number;
+}
+export interface SessionCreateInput {
+    readonly userId: UserId;
+    readonly method: string;
+    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly aal: AuthAssuranceLevel;
+    readonly now?: UnixMillis;
+    readonly ttl?: SessionTtlPolicy;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface IssuedSession {
+    readonly sessionId: SessionId;
+    readonly userId: UserId;
+    readonly token: SessionToken;
+    readonly authTime: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly aal: AuthAssuranceLevel;
+    readonly amr: ReadonlyArray<AuthMethodReference>;
+}
+export interface CurrentSessionShape {
+    readonly sessionId: SessionId;
+    readonly userId: UserId;
+    readonly authTime: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly aal: AuthAssuranceLevel;
+    readonly amr: ReadonlyArray<AuthMethodReference>;
+}
+export interface CurrentActorShape {
+    readonly userId: UserId;
+    readonly sessionId: SessionId;
+}
+export interface ValidatedSession {
+    readonly issued: IssuedSession;
+    readonly currentSession: CurrentSessionShape;
+    readonly actor: CurrentActorShape;
+}
+export interface SessionRotateInput {
+    readonly sessionId: SessionId;
+    readonly reason: string;
+}
+export interface SessionRevokeInput {
+    readonly sessionId: SessionId;
+    readonly reason: string;
+}
+declare const SessionCreateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SessionCreateError";
+} & Readonly<A>;
+export declare class SessionCreateError extends SessionCreateError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const SessionValidateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SessionValidateError";
+} & Readonly<A>;
+export declare class SessionValidateError extends SessionValidateError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const SessionRefreshError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SessionRefreshError";
+} & Readonly<A>;
+export declare class SessionRefreshError extends SessionRefreshError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const SessionRotateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SessionRotateError";
+} & Readonly<A>;
+export declare class SessionRotateError extends SessionRotateError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const SessionRevokeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SessionRevokeError";
+} & Readonly<A>;
+export declare class SessionRevokeError extends SessionRevokeError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export type SessionError = SessionCreateError | SessionValidateError | SessionRefreshError | SessionRotateError | SessionRevokeError;
+export interface SessionsService {
+    readonly create: (input: SessionCreateInput) => Effect.Effect<IssuedSession, SessionCreateError>;
+    readonly validate: (token: SessionToken) => Effect.Effect<ValidatedSession, SessionValidateError>;
+    readonly refresh: (token: SessionToken) => Effect.Effect<IssuedSession, SessionRefreshError>;
+    readonly rotate: (input: SessionRotateInput) => Effect.Effect<IssuedSession, SessionRotateError>;
+    readonly revoke: (input: SessionRevokeInput) => Effect.Effect<void, SessionRevokeError>;
+    readonly revokeAllForUser: (userId: UserId) => Effect.Effect<void, SessionRevokeError>;
+}
+declare const Sessions_base: Context.ServiceClass<Sessions, "auth/Sessions", SessionsService>;
+export declare class Sessions extends Sessions_base {
+}
+export interface SessionCookieService {
+    readonly read: (request: Request) => Effect.Effect<Option.Option<SessionToken>, SessionValidateError>;
+    readonly commit: (issued: IssuedSession) => Effect.Effect<string, SessionCreateError>;
+    readonly clear: Effect.Effect<string, SessionRevokeError>;
+}
+declare const SessionCookie_base: Context.ServiceClass<SessionCookie, "auth/SessionCookie", SessionCookieService>;
+export declare class SessionCookie extends SessionCookie_base {
+}
+declare const CurrentSession_base: Context.ServiceClass<CurrentSession, "auth/CurrentSession", CurrentSessionShape>;
+export declare class CurrentSession extends CurrentSession_base {
+}
+declare const CurrentActor_base: Context.ServiceClass<CurrentActor, "auth/CurrentActor", CurrentActorShape>;
+export declare class CurrentActor extends CurrentActor_base {
+}
+export {};
+//# sourceMappingURL=Sessions.d.ts.map

package/dist/Sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sessions.d.ts","sourceRoot":"","sources":["../src/Sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAE5C,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEnF,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;AAEzD,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,KAAK,GACL,OAAO,GACP,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;;;;AAED,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,CAAA;AAEtB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAA;IAChG,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;IACjG,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAC5F,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAA;IAChG,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;IACvF,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;CACvF;;AAED,qBAAa,QAAS,SAAQ,aAA6D;CAAG;AAE9F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC,CAAA;IACrG,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;CAC1D;;AAED,qBAAa,aAAc,SAAQ,kBAA4E;CAAG;;AAElH,qBAAa,cAAe,SAAQ,mBAA6E;CAAG;;AAEpH,qBAAa,YAAa,SAAQ,iBAAuE;CAAG"}

package/dist/Sessions.js

@@ -0,0 +1,20 @@
+import { Context, Data, Effect } from "effect";
+export class SessionCreateError extends Data.TaggedError("SessionCreateError") {
+}
+export class SessionValidateError extends Data.TaggedError("SessionValidateError") {
+}
+export class SessionRefreshError extends Data.TaggedError("SessionRefreshError") {
+}
+export class SessionRotateError extends Data.TaggedError("SessionRotateError") {
+}
+export class SessionRevokeError extends Data.TaggedError("SessionRevokeError") {
+}
+export class Sessions extends Context.Service()("auth/Sessions") {
+}
+export class SessionCookie extends Context.Service()("auth/SessionCookie") {
+}
+export class CurrentSession extends Context.Service()("auth/CurrentSession") {
+}
+export class CurrentActor extends Context.Service()("auth/CurrentActor") {
+}
+//# sourceMappingURL=Sessions.js.map

package/dist/Sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sessions.js","sourceRoot":"","sources":["../src/Sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AA0E9C,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAG3E;CAAG;AAEL,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAG/E;CAAG;AAEL,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAG7E;CAAG;AAEL,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAG3E;CAAG;AAEL,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAG3E;CAAG;AAkBL,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA6B,CAAC,eAAe,CAAC;CAAG;AAQ9F,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAAuC,CAAC,oBAAoB,CAAC;CAAG;AAElH,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAAuC,CAAC,qBAAqB,CAAC;CAAG;AAEpH,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAAmC,CAAC,mBAAmB,CAAC;CAAG"}

package/dist/Testing.d.ts

@@ -0,0 +1,3 @@
+import { Layer } from "effect";
+export declare const CoreTestingLive: Layer.Layer<import("./AuditLog.js").AuditLog | import("./Privacy.js").Privacy | import("./WaitUntil.js").WaitUntil, never, never>;
+//# sourceMappingURL=Testing.d.ts.map

package/dist/Testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Testing.d.ts","sourceRoot":"","sources":["../src/Testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAM9B,eAAO,MAAM,eAAe,mIAI3B,CAAA"}

package/dist/Testing.js

@@ -0,0 +1,6 @@
+import { Layer } from "effect";
+import { AuditLogNoopLive } from "./AuditLog.js";
+import { PrivacyTestLive } from "./Privacy.js";
+import { WaitUntilNoopLive } from "./WaitUntil.js";
+export const CoreTestingLive = Layer.mergeAll(AuditLogNoopLive, PrivacyTestLive, WaitUntilNoopLive);
+//# sourceMappingURL=Testing.js.map

package/dist/Testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Testing.js","sourceRoot":"","sources":["../src/Testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAC3C,gBAAgB,EAChB,eAAe,EACf,iBAAiB,CAClB,CAAA"}

package/dist/WaitUntil.d.ts

@@ -0,0 +1,18 @@
+import { Context, Effect, Layer } from "effect";
+declare const WaitUntilError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "WaitUntilError";
+} & Readonly<A>;
+export declare class WaitUntilError extends WaitUntilError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface WaitUntilService {
+    readonly waitUntil: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<void, WaitUntilError, R>;
+}
+declare const WaitUntil_base: Context.ServiceClass<WaitUntil, "runtime/WaitUntil", WaitUntilService>;
+export declare class WaitUntil extends WaitUntil_base {
+}
+export declare const WaitUntilNoopLive: Layer.Layer<WaitUntil, never, never>;
+export {};
+//# sourceMappingURL=WaitUntil.d.ts.map

package/dist/WaitUntil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WaitUntil.d.ts","sourceRoot":"","sources":["../src/WaitUntil.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;;;;AAErD,qBAAa,cAAe,SAAQ,oBAAmC;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;CACxG;;AAED,qBAAa,SAAU,SAAQ,cAAmE;CAAG;AAErG,eAAO,MAAM,iBAAiB,sCAE5B,CAAA"}

package/dist/WaitUntil.js

@@ -0,0 +1,9 @@
+import { Context, Data, Effect, Layer } from "effect";
+export class WaitUntilError extends Data.TaggedError("WaitUntilError") {
+}
+export class WaitUntil extends Context.Service()("runtime/WaitUntil") {
+}
+export const WaitUntilNoopLive = Layer.succeed(WaitUntil)({
+    waitUntil: (_effect) => Effect.asVoid(Effect.context())
+});
+//# sourceMappingURL=WaitUntil.js.map

package/dist/WaitUntil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WaitUntil.js","sourceRoot":"","sources":["../src/WaitUntil.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAErD,MAAM,OAAO,cAAe,SAAQ,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAGnE;CAAG;AAML,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAA+B,CAAC,mBAAmB,CAAC;CAAG;AAErG,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,SAAS,EAAE,CAAU,OAA+B,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAK,CAAC;CAC5F,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export declare const packageName: "@effect-auth/core";
+export * from "./AuditLog.js";
+export * from "./AuthFlow.js";
+export * from "./Challenge.js";
+export * from "./Crypto.js";
+export * from "./Identifiers.js";
+export * from "./Policy.js";
+export * from "./Privacy.js";
+export * from "./Sessions.js";
+export * from "./WaitUntil.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,EAAG,mBAA4B,CAAA;AAEvD,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -0,0 +1,11 @@
+export const packageName = "@effect-auth/core";
+export * from "./AuditLog.js";
+export * from "./AuthFlow.js";
+export * from "./Challenge.js";
+export * from "./Crypto.js";
+export * from "./Identifiers.js";
+export * from "./Policy.js";
+export * from "./Privacy.js";
+export * from "./Sessions.js";
+export * from "./WaitUntil.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,mBAA4B,CAAA;AAEvD,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA"}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@effect-auth/core",
+  "version": "0.1.0-alpha.0",
+  "description": "Composable Effect-first authentication primitives.",
+  "type": "module",
+  "license": "MIT",
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./AuditLog": {
+      "types": "./dist/AuditLog.d.ts",
+      "default": "./dist/AuditLog.js"
+    },
+    "./AuthFlow": {
+      "types": "./dist/AuthFlow.d.ts",
+      "default": "./dist/AuthFlow.js"
+    },
+    "./Challenge": {
+      "types": "./dist/Challenge.d.ts",
+      "default": "./dist/Challenge.js"
+    },
+    "./Crypto": {
+      "types": "./dist/Crypto.d.ts",
+      "default": "./dist/Crypto.js"
+    },
+    "./WaitUntil": {
+      "types": "./dist/WaitUntil.d.ts",
+      "default": "./dist/WaitUntil.js"
+    },
+    "./Identifiers": {
+      "types": "./dist/Identifiers.d.ts",
+      "default": "./dist/Identifiers.js"
+    },
+    "./Policy": {
+      "types": "./dist/Policy.d.ts",
+      "default": "./dist/Policy.js"
+    },
+    "./Privacy": {
+      "types": "./dist/Privacy.d.ts",
+      "default": "./dist/Privacy.js"
+    },
+    "./Sessions": {
+      "types": "./dist/Sessions.d.ts",
+      "default": "./dist/Sessions.js"
+    },
+    "./Testing": {
+      "types": "./dist/Testing.d.ts",
+      "default": "./dist/Testing.js"
+    },
+    "./package.json": {
+      "default": "./package.json"
+    }
+  },
+  "files": [
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map",
+    "dist/**/*.js",
+    "dist/**/*.js.map"
+  ],
+  "peerDependencies": {
+    "effect": "^4.0.0-beta.67"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "check": "tsc -b --pretty false && pnpm type-test",
+    "test": "pnpm build && node --test test/*.test.mjs",
+    "type-test": "tsc -p tsconfig.type-tests.json --pretty false"
+  }
+}