@effect-auth/core 0.1.0-alpha.0 → 0.1.0-alpha.10

package/dist/StepUp.js

@@ -0,0 +1,82 @@
+import { Data, Duration, Effect } from "effect";
+import { currentUnixMillis } from "./Internal.js";
+import { AuthzError } from "./Policy.js";
+import { CurrentSession } from "./Sessions.js";
+export class StepUpRequired extends Data.TaggedError("StepUpRequired") {
+}
+const aalRank = {
+    aal1: 1,
+    aal2: 2,
+    aal3: 3,
+};
+export const aalAtLeast = (actual, minimum) => aalRank[actual] >= aalRank[minimum];
+const aalFailure = (session, requiredAal) => aalAtLeast(session.aal, requiredAal)
+    ? undefined
+    : {
+        reason: "aal-too-low",
+        requiredAal,
+        currentAal: session.aal,
+    };
+const freshnessFailure = (session, now, maxAge, verifiedAt = Number(session.authTime)) => {
+    const maxAgeMillis = Duration.toMillis(maxAge);
+    const authAgeMillis = Math.max(0, now - verifiedAt);
+    return authAgeMillis <= maxAgeMillis
+        ? undefined
+        : {
+            reason: "auth-too-old",
+            maxAgeMillis,
+            authAgeMillis,
+        };
+};
+const freshnessReferenceTime = (session, requiredAal) => requiredAal !== undefined &&
+    aalRank[requiredAal] >= aalRank.aal2 &&
+    session.mfaVerifiedAt !== undefined
+    ? Number(session.mfaVerifiedAt)
+    : Number(session.authTime);
+const sessionRequirementFailures = (session, noSessionRequirements) => {
+    if (noSessionRequirements === undefined || noSessionRequirements.length === 0) {
+        return [];
+    }
+    const activeRequirements = session.claims?.requirements ?? [];
+    return noSessionRequirements.flatMap((requirement) => activeRequirements.includes(requirement)
+        ? [
+            {
+                reason: "session-requirement-unsatisfied",
+                requirement,
+            },
+        ]
+        : []);
+};
+export const checkStepUp = (requirement) => Effect.gen(function* () {
+    const session = yield* CurrentSession;
+    const now = requirement.maxAge === undefined ? undefined : yield* currentUnixMillis;
+    const failures = [
+        ...(requirement.aal === undefined
+            ? []
+            : [aalFailure(session, requirement.aal)].filter((failure) => failure !== undefined)),
+        ...(requirement.maxAge === undefined || now === undefined
+            ? []
+            : [
+                freshnessFailure(session, Number(now), requirement.maxAge, freshnessReferenceTime(session, requirement.aal)),
+            ].filter((failure) => failure !== undefined)),
+        ...sessionRequirementFailures(session, requirement.noSessionRequirements),
+    ];
+    return failures.length === 0
+        ? { _tag: "Satisfied", session }
+        : { _tag: "Required", session, failures };
+});
+export const requireStepUp = (requirement) => Effect.flatMap(checkStepUp(requirement), (decision) => decision._tag === "Satisfied"
+    ? Effect.void
+    : Effect.fail(new StepUpRequired({
+        failures: decision.failures,
+        session: decision.session,
+    })));
+export const requireAal = (aal) => requireStepUp({ aal });
+export const requireFresh = (maxAge) => requireStepUp({ maxAge });
+export const requireNoSessionRequirements = (...requirements) => requireStepUp({ noSessionRequirements: requirements });
+export const toPolicy = (requirement, policyId) => requireStepUp(requirement).pipe(Effect.mapError((cause) => new AuthzError({
+    reason: "step-up-required",
+    policyId,
+    cause,
+})));
+//# sourceMappingURL=StepUp.js.map

package/dist/StepUp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StepUp.js","sourceRoot":"","sources":["../src/StepUp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAmC/C,MAAM,OAAO,cAAe,SAAQ,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAGnE;CAAG;AAEL,MAAM,OAAO,GAAuC;IAClD,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAA0B,EAC1B,OAA2B,EAClB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;AAElD,MAAM,UAAU,GAAG,CACjB,OAA4B,EAC5B,WAA+B,EACE,EAAE,CACnC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC;IAClC,CAAC,CAAC,SAAS;IACX,CAAC,CAAC;QACE,MAAM,EAAE,aAAa;QACrB,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,GAAG;KACxB,CAAC;AAER,MAAM,gBAAgB,GAAG,CACvB,OAA4B,EAC5B,GAAW,EACX,MAAyB,EACzB,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EACJ,EAAE;IACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;IAEpD,OAAO,aAAa,IAAI,YAAY;QAClC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,MAAM,EAAE,cAAc;YACtB,YAAY;YACZ,aAAa;SACd,CAAC;AACR,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,OAA4B,EAC5B,WAA2C,EACnC,EAAE,CACV,WAAW,KAAK,SAAS;IACzB,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI;IACpC,OAAO,CAAC,aAAa,KAAK,SAAS;IACjC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE/B,MAAM,0BAA0B,GAAG,CACjC,OAA4B,EAC5B,qBAAgE,EAChC,EAAE;IAClC,IAAI,qBAAqB,KAAK,SAAS,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAE9D,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CACnD,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtC,CAAC,CAAC;YACE;gBACE,MAAM,EAAE,iCAA0C;gBAClD,WAAW;aACZ;SACF;QACH,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,WAA8B,EACwB,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACpF,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,WAAW,CAAC,GAAG,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAC3C,CAAC,OAAO,EAAkC,EAAE,CAAC,OAAO,KAAK,SAAS,CACnE,CAAC;QACN,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,gBAAgB,CACd,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,EACX,WAAW,CAAC,MAAM,EAClB,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CACjD;aACF,CAAC,MAAM,CACN,CAAC,OAAO,EAAkC,EAAE,CAAC,OAAO,KAAK,SAAS,CACnE,CAAC;QACN,GAAG,0BAA0B,CAAC,OAAO,EAAE,WAAW,CAAC,qBAAqB,CAAC;KAC1E,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE;QACzC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,WAA8B,EACuB,EAAE,CACvD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpD,QAAQ,CAAC,IAAI,KAAK,WAAW;IAC3B,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,cAAc,CAAC;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CACH,CACN,CAAC;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,GAAuB,EAC8B,EAAE,CACvD,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;AAEzB,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,MAAyB,EAC4B,EAAE,CACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5B,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,GAAG,YAA2C,EACO,EAAE,CACvD,aAAa,CAAC,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,WAA8B,EAC9B,QAAmB,EAC8B,EAAE,CACnD,aAAa,CAAC,WAAW,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,UAAU,CAAC;IACb,MAAM,EAAE,kBAAkB;IAC1B,QAAQ;IACR,KAAK;CACN,CAAC,CACL,CACF,CAAC"}

package/dist/Storage.d.ts

@@ -0,0 +1,175 @@
+import type { Effect } from "effect";
+import { Context } from "effect";
+import type * as Option from "effect/Option";
+import type { ChallengeType } from "./Challenge.js";
+import type { ChallengeId, CredentialId, Email, SessionId, UnixMillis, UserId } from "./Identifiers.js";
+import type { AuthAssuranceLevel, AuthMethodReference, SessionClaims } from "./Sessions.js";
+export type StorageEntity = "user" | "credential" | "session" | "verification" | (string & {});
+export type StorageOperation = "find" | "insert" | "update" | "delete" | "consume" | (string & {});
+declare const StorageError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "StorageError";
+} & Readonly<A>;
+export declare class StorageError extends StorageError_base<{
+    readonly entity: StorageEntity;
+    readonly operation: StorageOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export declare namespace StorageError {
+    const fromUnknown: (entity: StorageEntity, operation: StorageOperation, cause: unknown, message?: string) => StorageError;
+}
+export interface NewUserRow {
+    readonly id: UserId;
+    readonly email: Email;
+    readonly emailVerified: boolean;
+    readonly createdAt: UnixMillis;
+    readonly updatedAt: UnixMillis;
+    readonly disabledAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface UserRow extends NewUserRow {
+}
+export interface UserMarkEmailVerifiedInput {
+    readonly userId: UserId;
+    readonly updatedAt: UnixMillis;
+}
+export interface UserStoreService {
+    readonly findById: (id: UserId) => Effect.Effect<Option.Option<UserRow>, StorageError>;
+    readonly findByEmail: (email: Email) => Effect.Effect<Option.Option<UserRow>, StorageError>;
+    readonly insert: (row: NewUserRow) => Effect.Effect<void, StorageError>;
+    readonly markEmailVerified: (input: UserMarkEmailVerifiedInput) => Effect.Effect<Option.Option<UserRow>, StorageError>;
+}
+declare const UserStore_base: Context.ServiceClass<UserStore, "auth/UserStore", UserStoreService>;
+export declare class UserStore extends UserStore_base {
+}
+export declare namespace UserStore {
+    const make: (service: UserStoreService) => UserStoreService;
+}
+export interface NewPasswordCredentialRow {
+    readonly id: CredentialId;
+    readonly userId: UserId;
+    readonly passwordHash: string;
+    readonly createdAt: UnixMillis;
+    readonly updatedAt: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface PasswordCredentialRow extends NewPasswordCredentialRow {
+}
+export interface PasswordCredentialUpdatePasswordInput {
+    readonly userId: UserId;
+    readonly passwordHash: string;
+    readonly updatedAt: UnixMillis;
+}
+export interface CredentialStoreService {
+    readonly findPasswordByUserId: (userId: UserId) => Effect.Effect<Option.Option<PasswordCredentialRow>, StorageError>;
+    readonly insertPassword: (row: NewPasswordCredentialRow) => Effect.Effect<void, StorageError>;
+    readonly updatePassword: (input: PasswordCredentialUpdatePasswordInput) => Effect.Effect<Option.Option<PasswordCredentialRow>, StorageError>;
+}
+declare const CredentialStore_base: Context.ServiceClass<CredentialStore, "auth/CredentialStore", CredentialStoreService>;
+export declare class CredentialStore extends CredentialStore_base {
+}
+export declare namespace CredentialStore {
+    const make: (service: CredentialStoreService) => CredentialStoreService;
+}
+export interface NewSessionRow {
+    readonly id: SessionId;
+    readonly userId: UserId;
+    readonly secretHash: string;
+    readonly createdAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly authTime: UnixMillis;
+    readonly aal: AuthAssuranceLevel;
+    readonly amr: readonly AuthMethodReference[];
+    readonly claims?: SessionClaims;
+    readonly mfaVerifiedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface SessionRow extends NewSessionRow {
+    readonly revokedAt?: UnixMillis;
+    readonly lastSeenAt?: UnixMillis;
+    readonly rotatedAt?: UnixMillis;
+}
+export interface SessionRefreshStoreInput {
+    readonly sessionId: SessionId;
+    readonly expiresAt: UnixMillis;
+    readonly lastSeenAt?: UnixMillis;
+}
+export interface SessionListByUserStoreInput {
+    readonly userId: UserId;
+}
+export interface SessionRotateStoreInput {
+    readonly sessionId: SessionId;
+    readonly secretHash: string;
+    readonly rotatedAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+}
+export interface SessionUpdateClaimsStoreInput {
+    readonly sessionId: SessionId;
+    readonly claims?: SessionClaims;
+    readonly aal?: AuthAssuranceLevel;
+    readonly amr?: readonly AuthMethodReference[];
+    readonly mfaVerifiedAt?: UnixMillis;
+}
+export interface SessionRevokeStoreInput {
+    readonly sessionId: SessionId;
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export interface SessionRevokeAllForUserStoreInput {
+    readonly userId: UserId;
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export interface SessionStoreService {
+    readonly findById: (id: SessionId) => Effect.Effect<Option.Option<SessionRow>, StorageError>;
+    readonly listByUser: (input: SessionListByUserStoreInput) => Effect.Effect<readonly SessionRow[], StorageError>;
+    readonly insert: (row: NewSessionRow) => Effect.Effect<void, StorageError>;
+    readonly refresh: (input: SessionRefreshStoreInput) => Effect.Effect<Option.Option<SessionRow>, StorageError>;
+    readonly rotate: (input: SessionRotateStoreInput) => Effect.Effect<Option.Option<SessionRow>, StorageError>;
+    readonly updateClaims: (input: SessionUpdateClaimsStoreInput) => Effect.Effect<Option.Option<SessionRow>, StorageError>;
+    readonly revoke: (input: SessionRevokeStoreInput) => Effect.Effect<void, StorageError>;
+    readonly revokeAllForUser: (input: SessionRevokeAllForUserStoreInput) => Effect.Effect<void, StorageError>;
+}
+declare const SessionStore_base: Context.ServiceClass<SessionStore, "auth/SessionStore", SessionStoreService>;
+export declare class SessionStore extends SessionStore_base {
+}
+export declare namespace SessionStore {
+    const make: (service: SessionStoreService) => SessionStoreService;
+}
+export interface NewVerificationRow {
+    readonly id: ChallengeId;
+    readonly type: ChallengeType;
+    readonly subject: string;
+    readonly secretHash?: string;
+    readonly createdAt: UnixMillis;
+    readonly expiresAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface VerificationRow extends NewVerificationRow {
+    readonly consumedAt?: UnixMillis;
+}
+export interface VerificationConsumeInput {
+    readonly id: ChallengeId;
+    readonly type?: ChallengeType;
+    readonly consumedAt: UnixMillis;
+}
+export interface VerificationDeleteExpiredInput {
+    readonly now: UnixMillis;
+    readonly limit?: number;
+}
+export interface VerificationStoreService {
+    readonly findById: (id: ChallengeId) => Effect.Effect<Option.Option<VerificationRow>, StorageError>;
+    readonly insert: (row: NewVerificationRow) => Effect.Effect<void, StorageError>;
+    readonly consume: (input: VerificationConsumeInput) => Effect.Effect<Option.Option<VerificationRow>, StorageError>;
+    readonly deleteExpired: (input: VerificationDeleteExpiredInput) => Effect.Effect<number, StorageError>;
+}
+declare const VerificationStore_base: Context.ServiceClass<VerificationStore, "auth/VerificationStore", VerificationStoreService>;
+export declare class VerificationStore extends VerificationStore_base {
+}
+export declare namespace VerificationStore {
+    const make: (service: VerificationStoreService) => VerificationStoreService;
+}
+export {};
+//# sourceMappingURL=Storage.d.ts.map

package/dist/Storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Storage.d.ts","sourceRoot":"","sources":["../src/Storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,OAAO,EAAQ,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,KAAK,EACL,SAAS,EACT,UAAU,EACV,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACd,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,YAAY,GACZ,SAAS,GACT,cAAc,GACd,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,gBAAgB,GACxB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;;;;AAElB,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,yBAAiB,YAAY,CAAC;IACrB,MAAM,WAAW,GACtB,QAAQ,aAAa,EACrB,WAAW,gBAAgB,EAC3B,OAAO,OAAO,EACd,gBAAyC,KACxC,YAAuE,CAAC;CAC5E;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,OAAQ,SAAQ,UAAU;CAAG;AAE9C,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,CACjB,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACxE,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,0BAA0B,KAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;CAC1D;;AAED,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,yBAAiB,SAAS,CAAC;IAClB,MAAM,IAAI,GAAI,SAAS,gBAAgB,KAAG,gBAC1B,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAsB,SAAQ,wBAAwB;CAAG;AAE1E,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,MAAM,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,YAAY,CAAC,CAAC;IACvE,QAAQ,CAAC,cAAc,EAAE,CACvB,GAAG,EAAE,wBAAwB,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,CACvB,KAAK,EAAE,qCAAqC,KACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,YAAY,CAAC,CAAC;CACxE;;AAED,qBAAa,eAAgB,SAAQ,oBAGV;CAAG;AAE9B,yBAAiB,eAAe,CAAC;IACxB,MAAM,IAAI,GACf,SAAS,sBAAsB,KAC9B,sBAAqD,CAAC;CAC1D;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,CACjB,EAAE,EAAE,SAAS,KACV,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,CACnB,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,6BAA6B,KACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,CACzB,KAAK,EAAE,iCAAiC,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;CACxC;;AAED,qBAAa,YAAa,SAAQ,iBAGV;CAAG;AAE3B,yBAAiB,YAAY,CAAC;IACrB,MAAM,IAAI,GAAI,SAAS,mBAAmB,KAAG,mBAC1B,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,CACjB,EAAE,EAAE,WAAW,KACZ,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,YAAY,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,CACf,GAAG,EAAE,kBAAkB,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,YAAY,CAAC,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,CACtB,KAAK,EAAE,8BAA8B,KAClC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC1C;;AAED,qBAAa,iBAAkB,SAAQ,sBAGV;CAAG;AAEhC,yBAAiB,iBAAiB,CAAC;IAC1B,MAAM,IAAI,GACf,SAAS,wBAAwB,KAChC,wBAAyD,CAAC;CAC9D"}

package/dist/Storage.js

@@ -0,0 +1,27 @@
+import { Context, Data } from "effect";
+export class StorageError extends Data.TaggedError("StorageError") {
+}
+(function (StorageError) {
+    StorageError.fromUnknown = (entity, operation, cause, message = `${entity} ${operation} failed`) => new StorageError({ entity, operation, message, cause });
+})(StorageError || (StorageError = {}));
+export class UserStore extends Context.Service()("auth/UserStore") {
+}
+(function (UserStore) {
+    UserStore.make = (service) => UserStore.of(service);
+})(UserStore || (UserStore = {}));
+export class CredentialStore extends Context.Service()("auth/CredentialStore") {
+}
+(function (CredentialStore) {
+    CredentialStore.make = (service) => CredentialStore.of(service);
+})(CredentialStore || (CredentialStore = {}));
+export class SessionStore extends Context.Service()("auth/SessionStore") {
+}
+(function (SessionStore) {
+    SessionStore.make = (service) => SessionStore.of(service);
+})(SessionStore || (SessionStore = {}));
+export class VerificationStore extends Context.Service()("auth/VerificationStore") {
+}
+(function (VerificationStore) {
+    VerificationStore.make = (service) => VerificationStore.of(service);
+})(VerificationStore || (VerificationStore = {}));
+//# sourceMappingURL=Storage.js.map

package/dist/Storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Storage.js","sourceRoot":"","sources":["../src/Storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAiCvC,MAAM,OAAO,YAAa,SAAQ,IAAI,CAAC,WAAW,CAAC,cAAc,CAK/D;CAAG;AAEL,WAAiB,YAAY;IACd,wBAAW,GAAG,CACzB,MAAqB,EACrB,SAA2B,EAC3B,KAAc,EACd,OAAO,GAAG,GAAG,MAAM,IAAI,SAAS,SAAS,EAC3B,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7E,CAAC,EAPgB,YAAY,KAAZ,YAAY,QAO5B;AAgCD,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAA+B,CAC3E,gBAAgB,CACjB;CAAG;AAEJ,WAAiB,SAAS;IACX,cAAI,GAAG,CAAC,OAAyB,EAAoB,EAAE,CAClE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC,EAHgB,SAAS,KAAT,SAAS,QAGzB;AAgCD,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAGjD,CAAC,sBAAsB,CAAC;CAAG;AAE9B,WAAiB,eAAe;IACjB,oBAAI,GAAG,CAClB,OAA+B,EACP,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC,EAJgB,eAAe,KAAf,eAAe,QAI/B;AAoFD,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAG9C,CAAC,mBAAmB,CAAC;CAAG;AAE3B,WAAiB,YAAY;IACd,iBAAI,GAAG,CAAC,OAA4B,EAAuB,EAAE,CACxE,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,EAHgB,YAAY,KAAZ,YAAY,QAG5B;AA0CD,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAGnD,CAAC,wBAAwB,CAAC;CAAG;AAEhC,WAAiB,iBAAiB;IACnB,sBAAI,GAAG,CAClB,OAAiC,EACP,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC,EAJgB,iBAAiB,KAAjB,iBAAiB,QAIjC"}

package/dist/StorageMigrations.d.ts

@@ -0,0 +1,19 @@
+export interface AuthStorageMigration {
+    readonly id: string;
+    readonly sql: string;
+}
+export declare const authStorageMigration001: AuthStorageMigration;
+export declare const authStorageMigration002: AuthStorageMigration;
+export declare const authStorageMigration003: AuthStorageMigration;
+export declare const authStorageMigration004: AuthStorageMigration;
+export declare const authStorageMigration005: AuthStorageMigration;
+export declare const authStorageMigration006: AuthStorageMigration;
+export declare const authStorageMigration007: AuthStorageMigration;
+export declare const authStorageMigration008: AuthStorageMigration;
+export declare const authStorageMigration009: AuthStorageMigration;
+export declare const authStorageMigration010: AuthStorageMigration;
+export declare const authStorageMigration011: AuthStorageMigration;
+export declare const authStorageMigration012: AuthStorageMigration;
+export declare const authStorageMigration013: AuthStorageMigration;
+export declare const authStorageMigrations: readonly [AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration, AuthStorageMigration];
+//# sourceMappingURL=StorageMigrations.d.ts.map

package/dist/StorageMigrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageMigrations.d.ts","sourceRoot":"","sources":["../src/StorageMigrations.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,uBAAuB,EAAE,oBAkCrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBA2BrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAwBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAcrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAmBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAmBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAerC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAmBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAuBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAUrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAkBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAsBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,oBAkBrC,CAAC;AAEF,eAAO,MAAM,qBAAqB,ySAcxB,CAAC"}

package/dist/StorageMigrations.js

@@ -0,0 +1,291 @@
+export const authStorageMigration001 = {
+    id: "0001_auth_storage",
+    sql: `create table if not exists auth_session (
+  id text primary key,
+  user_id text not null,
+  secret_hash text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  auth_time integer not null,
+  aal text not null,
+  amr text not null,
+  mfa_verified_at integer,
+  metadata text,
+  revoked_at integer,
+  last_seen_at integer,
+  rotated_at integer
+);
+
+create index if not exists auth_session_user_id_idx on auth_session (user_id);
+create index if not exists auth_session_expires_at_idx on auth_session (expires_at);
+
+create table if not exists auth_verification (
+  id text primary key,
+  type text not null,
+  subject text not null,
+  secret_hash text,
+  created_at integer not null,
+  expires_at integer not null,
+  metadata text,
+  consumed_at integer
+);
+
+create index if not exists auth_verification_type_subject_idx on auth_verification (type, subject);
+create index if not exists auth_verification_expires_at_idx on auth_verification (expires_at);`,
+};
+export const authStorageMigration002 = {
+    id: "0002_auth_password",
+    sql: `create table if not exists auth_user (
+  id text primary key,
+  email text not null,
+  email_verified integer not null,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_user_email_idx on auth_user (email);
+
+create table if not exists auth_credential (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at integer not null,
+  updated_at integer not null,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_credential_user_id_idx on auth_credential (user_id);
+create unique index if not exists auth_credential_user_type_idx on auth_credential (user_id, type);`,
+};
+export const authStorageMigration003 = {
+    id: "0003_auth_login_approval_review",
+    sql: `create table if not exists auth_login_approval_review (
+  approval_challenge_id text primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required integer not null,
+  status text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  reviewed_at integer,
+  reviewed_by text,
+  denied_reason text,
+  risk text,
+  metadata text,
+  review_metadata text
+);
+
+create index if not exists auth_login_approval_review_flow_id_idx on auth_login_approval_review (flow_id);
+create index if not exists auth_login_approval_review_user_id_idx on auth_login_approval_review (user_id);
+create index if not exists auth_login_approval_review_status_expires_at_idx on auth_login_approval_review (status, expires_at);`,
+};
+export const authStorageMigration004 = {
+    id: "0004_auth_trusted_device",
+    sql: `create table if not exists auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at integer not null,
+  last_seen_at integer not null,
+  expires_at integer not null,
+  metadata text,
+  primary key (user_id, token_hash)
+);
+
+create index if not exists auth_trusted_device_user_id_idx on auth_trusted_device (user_id);
+create index if not exists auth_trusted_device_expires_at_idx on auth_trusted_device (expires_at);`,
+};
+export const authStorageMigration005 = {
+    id: "0005_auth_passkey",
+    sql: `create table if not exists auth_passkey_credential (
+  id text primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count integer not null,
+  transports text,
+  backed_up integer,
+  created_at integer not null,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_passkey_credential_credential_id_idx on auth_passkey_credential (credential_id);
+create index if not exists auth_passkey_credential_user_id_idx on auth_passkey_credential (user_id);
+create index if not exists auth_passkey_credential_revoked_at_idx on auth_passkey_credential (revoked_at);`,
+};
+export const authStorageMigration006 = {
+    id: "0006_auth_totp_factor",
+    sql: `create table if not exists auth_totp_factor (
+  id text primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at integer not null,
+  confirmed_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index if not exists auth_totp_factor_confirmed_at_idx on auth_totp_factor (confirmed_at);
+create index if not exists auth_totp_factor_revoked_at_idx on auth_totp_factor (revoked_at);`,
+};
+export const authStorageMigration007 = {
+    id: "0007_auth_recovery_code",
+    sql: `create table if not exists auth_recovery_code (
+  id text primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at integer not null,
+  used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index if not exists auth_recovery_code_used_at_idx on auth_recovery_code (used_at);
+create index if not exists auth_recovery_code_revoked_at_idx on auth_recovery_code (revoked_at);`,
+};
+export const authStorageMigration008 = {
+    id: "0008_auth_api_key",
+    sql: `create table if not exists auth_api_key (
+  id text primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes text not null,
+  created_at integer not null,
+  expires_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_api_key_prefix_idx on auth_api_key (prefix);
+create index if not exists auth_api_key_user_id_idx on auth_api_key (user_id);
+create index if not exists auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index if not exists auth_api_key_revoked_at_idx on auth_api_key (revoked_at);`,
+};
+export const authStorageMigration009 = {
+    id: "0009_auth_refresh_token",
+    sql: `create table if not exists auth_refresh_token (
+  id text primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  last_used_at integer,
+  rotated_at integer,
+  replaced_by_id text,
+  revoked_at integer,
+  reuse_detected_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_refresh_token_secret_hash_idx on auth_refresh_token (secret_hash);
+create index if not exists auth_refresh_token_family_id_idx on auth_refresh_token (family_id);
+create index if not exists auth_refresh_token_user_id_idx on auth_refresh_token (user_id);
+create index if not exists auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+create index if not exists auth_refresh_token_rotated_at_idx on auth_refresh_token (rotated_at);
+create index if not exists auth_refresh_token_revoked_at_idx on auth_refresh_token (revoked_at);`,
+};
+export const authStorageMigration010 = {
+    id: "0010_auth_jwt_revocation",
+    sql: `create table if not exists auth_jwt_revocation (
+  jwt_id text primary key,
+  revoked_at integer not null,
+  expires_at integer,
+  reason text
+);
+
+create index if not exists auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);`,
+};
+export const authStorageMigration011 = {
+    id: "0011_auth_oauth_account",
+    sql: `create table if not exists auth_oauth_account (
+  id text primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified integer,
+  created_at integer not null,
+  updated_at integer not null,
+  unlinked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_oauth_account_provider_account_idx on auth_oauth_account (provider_id, provider_account_id);
+create index if not exists auth_oauth_account_user_id_idx on auth_oauth_account (user_id);
+create index if not exists auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);`,
+};
+export const authStorageMigration012 = {
+    id: "0012_auth_oauth_provider_token_vault",
+    sql: `create table if not exists auth_oauth_provider_token_vault (
+  account_id text primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes text,
+  expires_at integer,
+  updated_at integer not null,
+  revoked_at integer,
+  revocation_reason text
+);
+
+create index if not exists auth_oauth_provider_token_vault_user_id_idx on auth_oauth_provider_token_vault (user_id);
+create index if not exists auth_oauth_provider_token_vault_provider_account_idx on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index if not exists auth_oauth_provider_token_vault_expires_at_idx on auth_oauth_provider_token_vault (expires_at);
+create index if not exists auth_oauth_provider_token_vault_revoked_at_idx on auth_oauth_provider_token_vault (revoked_at);`,
+};
+export const authStorageMigration013 = {
+    id: "0013_auth_security_timeline",
+    sql: `create table if not exists auth_security_timeline (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at integer not null,
+  summary text not null,
+  actor text,
+  request text,
+  metadata text
+);
+
+create index if not exists auth_security_timeline_user_occurred_at_idx on auth_security_timeline (user_id, occurred_at);
+create index if not exists auth_security_timeline_type_idx on auth_security_timeline (type);
+create index if not exists auth_security_timeline_category_idx on auth_security_timeline (category);`,
+};
+export const authStorageMigrations = [
+    authStorageMigration001,
+    authStorageMigration002,
+    authStorageMigration003,
+    authStorageMigration004,
+    authStorageMigration005,
+    authStorageMigration006,
+    authStorageMigration007,
+    authStorageMigration008,
+    authStorageMigration009,
+    authStorageMigration010,
+    authStorageMigration011,
+    authStorageMigration012,
+    authStorageMigration013,
+];
+//# sourceMappingURL=StorageMigrations.js.map

package/dist/StorageMigrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageMigrations.js","sourceRoot":"","sources":["../src/StorageMigrations.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+FA+BwF;CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,oBAAoB;IACxB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;oGAwB6F;CACnG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,iCAAiC;IACrC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;gIAqByH;CAC/H,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,0BAA0B;IAC9B,GAAG,EAAE;;;;;;;;;;;mGAW4F;CAClG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE;;;;;;;;;;;;;;;;2GAgBoG;CAC1G,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,uBAAuB;IAC3B,GAAG,EAAE;;;;;;;;;;;;;;;;6FAgBsF;CAC5F,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,yBAAyB;IAC7B,GAAG,EAAE;;;;;;;;;;;;iGAY0F;CAChG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE;;;;;;;;;;;;;;;;qFAgB8E;CACpF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,yBAAyB;IAC7B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;iGAoB0F;CAChG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,0BAA0B;IAC9B,GAAG,EAAE;;;;;;;mGAO4F;CAClG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,yBAAyB;IAC7B,GAAG,EAAE;;;;;;;;;;;;;;;mGAe4F;CAClG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,sCAAsC;IAC1C,GAAG,EAAE;;;;;;;;;;;;;;;;;;;2HAmBoH;CAC1H,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,EAAE,EAAE,6BAA6B;IACjC,GAAG,EAAE;;;;;;;;;;;;;;;qGAe8F;CACpG,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;CACf,CAAC"}

package/dist/Testing.d.ts

@@ -1,3 +1,11 @@
 import { Layer } from "effect";
-export declare const CoreTestingLive: Layer.Layer<import("./AuditLog.js").AuditLog | import("./Privacy.js").Privacy | import("./WaitUntil.js").WaitUntil, never, never>;
+import { Crypto } from "./Crypto.js";
+import type { CryptoService } from "./Crypto.js";
+import { PasswordHasher } from "./Password.js";
+import type { PasswordHasherService } from "./Password.js";
+export declare const makeTestCrypto: () => CryptoService;
+export declare const CryptoTestLive: Layer.Layer<Crypto, never, never>;
+export declare const makeTestPasswordHasher: () => PasswordHasherService;
+export declare const PasswordHasherTestLive: Layer.Layer<PasswordHasher, never, never>;
+export declare const CoreTestingLive: Layer.Layer<Crypto | import("./WaitUntil.js").WaitUntil | import("./Privacy.js").Privacy | import("./AuditLog.js").AuditLog | PasswordHasher, never, never>;
 //# sourceMappingURL=Testing.d.ts.map

package/dist/Testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Testing.d.ts","sourceRoot":"","sources":["../src/Testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAM9B,eAAO,MAAM,eAAe,mIAI3B,CAAA"}
+{"version":3,"file":"Testing.d.ts","sourceRoot":"","sources":["../src/Testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAY,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAa,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAY3D,eAAO,MAAM,cAAc,QAAO,aA+BjC,CAAC;AAEF,eAAO,MAAM,cAAc,mCAA0C,CAAC;AAEtE,eAAO,MAAM,sBAAsB,QAAO,qBAQtC,CAAC;AAEL,eAAO,MAAM,sBAAsB,2CAElC,CAAC;AAEF,eAAO,MAAM,eAAe,6JAM3B,CAAC"}