@effect-auth/core 0.1.0-alpha.0 → 0.1.0-alpha.10

package/migrations/0001_auth_storage.sql

@@ -0,0 +1,32 @@
+create table if not exists auth_session (
+  id text primary key,
+  user_id text not null,
+  secret_hash text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  auth_time integer not null,
+  aal text not null,
+  amr text not null,
+  mfa_verified_at integer,
+  metadata text,
+  revoked_at integer,
+  last_seen_at integer,
+  rotated_at integer
+);
+
+create index if not exists auth_session_user_id_idx on auth_session (user_id);
+create index if not exists auth_session_expires_at_idx on auth_session (expires_at);
+
+create table if not exists auth_verification (
+  id text primary key,
+  type text not null,
+  subject text not null,
+  secret_hash text,
+  created_at integer not null,
+  expires_at integer not null,
+  metadata text,
+  consumed_at integer
+);
+
+create index if not exists auth_verification_type_subject_idx on auth_verification (type, subject);
+create index if not exists auth_verification_expires_at_idx on auth_verification (expires_at);

package/migrations/0002_auth_password.sql

@@ -0,0 +1,25 @@
+create table if not exists auth_user (
+  id text primary key,
+  email text not null,
+  email_verified integer not null,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_user_email_idx on auth_user (email);
+
+create table if not exists auth_credential (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at integer not null,
+  updated_at integer not null,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_credential_user_id_idx on auth_credential (user_id);
+create unique index if not exists auth_credential_user_type_idx on auth_credential (user_id, type);

package/migrations/0003_auth_login_approval_review.sql

@@ -0,0 +1,22 @@
+create table if not exists auth_login_approval_review (
+  approval_challenge_id text primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required integer not null,
+  status text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  reviewed_at integer,
+  reviewed_by text,
+  denied_reason text,
+  risk text,
+  metadata text,
+  review_metadata text
+);
+
+create index if not exists auth_login_approval_review_flow_id_idx on auth_login_approval_review (flow_id);
+create index if not exists auth_login_approval_review_user_id_idx on auth_login_approval_review (user_id);
+create index if not exists auth_login_approval_review_status_expires_at_idx on auth_login_approval_review (status, expires_at);

package/migrations/0004_auth_trusted_device.sql

@@ -0,0 +1,12 @@
+create table if not exists auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at integer not null,
+  last_seen_at integer not null,
+  expires_at integer not null,
+  metadata text,
+  primary key (user_id, token_hash)
+);
+
+create index if not exists auth_trusted_device_user_id_idx on auth_trusted_device (user_id);
+create index if not exists auth_trusted_device_expires_at_idx on auth_trusted_device (expires_at);

package/migrations/0005_auth_passkey.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_passkey_credential (
+  id text primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count integer not null,
+  transports text,
+  backed_up integer,
+  created_at integer not null,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_passkey_credential_credential_id_idx on auth_passkey_credential (credential_id);
+create index if not exists auth_passkey_credential_user_id_idx on auth_passkey_credential (user_id);
+create index if not exists auth_passkey_credential_revoked_at_idx on auth_passkey_credential (revoked_at);

package/migrations/0006_auth_totp_factor.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_totp_factor (
+  id text primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at integer not null,
+  confirmed_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index if not exists auth_totp_factor_confirmed_at_idx on auth_totp_factor (confirmed_at);
+create index if not exists auth_totp_factor_revoked_at_idx on auth_totp_factor (revoked_at);

package/migrations/0007_auth_recovery_code.sql

@@ -0,0 +1,13 @@
+create table if not exists auth_recovery_code (
+  id text primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at integer not null,
+  used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index if not exists auth_recovery_code_used_at_idx on auth_recovery_code (used_at);
+create index if not exists auth_recovery_code_revoked_at_idx on auth_recovery_code (revoked_at);

package/migrations/0008_auth_api_key.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_api_key (
+  id text primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes text not null,
+  created_at integer not null,
+  expires_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_api_key_prefix_idx on auth_api_key (prefix);
+create index if not exists auth_api_key_user_id_idx on auth_api_key (user_id);
+create index if not exists auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index if not exists auth_api_key_revoked_at_idx on auth_api_key (revoked_at);

package/migrations/0009_auth_refresh_token.sql

@@ -0,0 +1,21 @@
+create table if not exists auth_refresh_token (
+  id text primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  last_used_at integer,
+  rotated_at integer,
+  replaced_by_id text,
+  revoked_at integer,
+  reuse_detected_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_refresh_token_secret_hash_idx on auth_refresh_token (secret_hash);
+create index if not exists auth_refresh_token_family_id_idx on auth_refresh_token (family_id);
+create index if not exists auth_refresh_token_user_id_idx on auth_refresh_token (user_id);
+create index if not exists auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+create index if not exists auth_refresh_token_rotated_at_idx on auth_refresh_token (rotated_at);
+create index if not exists auth_refresh_token_revoked_at_idx on auth_refresh_token (revoked_at);

package/migrations/0010_auth_jwt_revocation.sql

@@ -0,0 +1,8 @@
+create table if not exists auth_jwt_revocation (
+  jwt_id text primary key,
+  revoked_at integer not null,
+  expires_at integer,
+  reason text
+);
+
+create index if not exists auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);

package/migrations/0011_auth_oauth_account.sql

@@ -0,0 +1,16 @@
+create table if not exists auth_oauth_account (
+  id text primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified integer,
+  created_at integer not null,
+  updated_at integer not null,
+  unlinked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_oauth_account_provider_account_idx on auth_oauth_account (provider_id, provider_account_id);
+create index if not exists auth_oauth_account_user_id_idx on auth_oauth_account (user_id);
+create index if not exists auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);

package/migrations/0012_auth_oauth_provider_token_vault.sql

@@ -0,0 +1,20 @@
+create table if not exists auth_oauth_provider_token_vault (
+  account_id text primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes text,
+  expires_at integer,
+  updated_at integer not null,
+  revoked_at integer,
+  revocation_reason text
+);
+
+create index if not exists auth_oauth_provider_token_vault_user_id_idx on auth_oauth_provider_token_vault (user_id);
+create index if not exists auth_oauth_provider_token_vault_provider_account_idx on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index if not exists auth_oauth_provider_token_vault_expires_at_idx on auth_oauth_provider_token_vault (expires_at);
+create index if not exists auth_oauth_provider_token_vault_revoked_at_idx on auth_oauth_provider_token_vault (revoked_at);

package/migrations/0013_auth_security_timeline.sql

@@ -0,0 +1,16 @@
+create table if not exists auth_security_timeline (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at integer not null,
+  summary text not null,
+  actor text,
+  request text,
+  metadata text
+);
+
+create index if not exists auth_security_timeline_user_occurred_at_idx on auth_security_timeline (user_id, occurred_at);
+create index if not exists auth_security_timeline_type_idx on auth_security_timeline (type);
+create index if not exists auth_security_timeline_category_idx on auth_security_timeline (category);

package/package.json

@@ -1,18 +1,26 @@
 {
   "name": "@effect-auth/core",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.10",
   "description": "Composable Effect-first authentication primitives.",
-  "type": "module",
   "license": "MIT",
+  "files": [
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map",
+    "dist/**/*.js",
+    "dist/**/*.js.map",
+    "migrations/**/*.sql"
+  ],
+  "type": "module",
   "sideEffects": false,
-  "publishConfig": {
-    "access": "public"
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./ApiKey": {
+      "types": "./dist/ApiKey.d.ts",
+      "default": "./dist/ApiKey.js"
+    },
     "./AuditLog": {
       "types": "./dist/AuditLog.d.ts",
       "default": "./dist/AuditLog.js"
@@ -21,22 +29,98 @@
       "types": "./dist/AuthFlow.d.ts",
       "default": "./dist/AuthFlow.js"
     },
+    "./AuthConfig": {
+      "types": "./dist/AuthConfig.d.ts",
+      "default": "./dist/AuthConfig.js"
+    },
+    "./AuthKernel": {
+      "types": "./dist/AuthKernel.d.ts",
+      "default": "./dist/AuthKernel.js"
+    },
     "./Challenge": {
       "types": "./dist/Challenge.d.ts",
       "default": "./dist/Challenge.js"
     },
+    "./AlchemyCloudflareRateLimitDurableObject": {
+      "types": "./dist/alchemy/cloudflare/RateLimitDurableObject.d.ts",
+      "default": "./dist/alchemy/cloudflare/RateLimitDurableObject.js"
+    },
+    "./AlchemyCloudflareEmail": {
+      "types": "./dist/alchemy/cloudflare/Email.d.ts",
+      "default": "./dist/alchemy/cloudflare/Email.js"
+    },
+    "./CloudflareRateLimitDurableObject": {
+      "types": "./dist/cloudflare/RateLimitDurableObject.d.ts",
+      "default": "./dist/cloudflare/RateLimitDurableObject.js"
+    },
+    "./CloudflareEmail": {
+      "types": "./dist/cloudflare/Email.d.ts",
+      "default": "./dist/cloudflare/Email.js"
+    },
+    "./Client": {
+      "types": "./dist/Client.d.ts",
+      "default": "./dist/Client.js"
+    },
     "./Crypto": {
       "types": "./dist/Crypto.d.ts",
       "default": "./dist/Crypto.js"
     },
+    "./EffectQbSqliteStorage": {
+      "types": "./dist/EffectQbSqliteStorage.d.ts",
+      "default": "./dist/EffectQbSqliteStorage.js"
+    },
+    "./EmailOtp": {
+      "types": "./dist/EmailOtp.d.ts",
+      "default": "./dist/EmailOtp.js"
+    },
+    "./EmailVerification": {
+      "types": "./dist/EmailVerification.d.ts",
+      "default": "./dist/EmailVerification.js"
+    },
     "./WaitUntil": {
       "types": "./dist/WaitUntil.d.ts",
       "default": "./dist/WaitUntil.js"
     },
+    "./Webhook": {
+      "types": "./dist/Webhook.d.ts",
+      "default": "./dist/Webhook.js"
+    },
     "./Identifiers": {
       "types": "./dist/Identifiers.d.ts",
       "default": "./dist/Identifiers.js"
     },
+    "./LoginApproval": {
+      "types": "./dist/LoginApproval.d.ts",
+      "default": "./dist/LoginApproval.js"
+    },
+    "./LoginNotification": {
+      "types": "./dist/LoginNotification.d.ts",
+      "default": "./dist/LoginNotification.js"
+    },
+    "./LoginRisk": {
+      "types": "./dist/LoginRisk.d.ts",
+      "default": "./dist/LoginRisk.js"
+    },
+    "./Jwt": {
+      "types": "./dist/Jwt.d.ts",
+      "default": "./dist/Jwt.js"
+    },
+    "./HttpApi": {
+      "types": "./dist/HttpApi.d.ts",
+      "default": "./dist/HttpApi.js"
+    },
+    "./Mailer": {
+      "types": "./dist/Mailer.d.ts",
+      "default": "./dist/Mailer.js"
+    },
+    "./MagicLink": {
+      "types": "./dist/MagicLink.d.ts",
+      "default": "./dist/MagicLink.js"
+    },
+    "./OAuth": {
+      "types": "./dist/OAuth.d.ts",
+      "default": "./dist/OAuth.js"
+    },
     "./Policy": {
       "types": "./dist/Policy.d.ts",
       "default": "./dist/Policy.js"
@@ -45,31 +129,92 @@
       "types": "./dist/Privacy.d.ts",
       "default": "./dist/Privacy.js"
     },
+    "./RateLimiter": {
+      "types": "./dist/RateLimiter.d.ts",
+      "default": "./dist/RateLimiter.js"
+    },
+    "./RecoveryCode": {
+      "types": "./dist/RecoveryCode.d.ts",
+      "default": "./dist/RecoveryCode.js"
+    },
+    "./RefreshToken": {
+      "types": "./dist/RefreshToken.d.ts",
+      "default": "./dist/RefreshToken.js"
+    },
+    "./Password": {
+      "types": "./dist/Password.d.ts",
+      "default": "./dist/Password.js"
+    },
+    "./Passkey": {
+      "types": "./dist/Passkey.d.ts",
+      "default": "./dist/Passkey.js"
+    },
+    "./PasskeySimpleWebAuthn": {
+      "types": "./dist/PasskeySimpleWebAuthn.d.ts",
+      "default": "./dist/PasskeySimpleWebAuthn.js"
+    },
     "./Sessions": {
       "types": "./dist/Sessions.d.ts",
       "default": "./dist/Sessions.js"
     },
+    "./SecurityTimeline": {
+      "types": "./dist/SecurityTimeline.d.ts",
+      "default": "./dist/SecurityTimeline.js"
+    },
+    "./Storage": {
+      "types": "./dist/Storage.d.ts",
+      "default": "./dist/Storage.js"
+    },
+    "./StepUp": {
+      "types": "./dist/StepUp.d.ts",
+      "default": "./dist/StepUp.js"
+    },
+    "./StorageMigrations": {
+      "types": "./dist/StorageMigrations.d.ts",
+      "default": "./dist/StorageMigrations.js"
+    },
     "./Testing": {
       "types": "./dist/Testing.d.ts",
       "default": "./dist/Testing.js"
     },
+    "./Totp": {
+      "types": "./dist/Totp.d.ts",
+      "default": "./dist/Totp.js"
+    },
+    "./TrustedDevice": {
+      "types": "./dist/TrustedDevice.d.ts",
+      "default": "./dist/TrustedDevice.js"
+    },
     "./package.json": {
       "default": "./package.json"
     }
   },
-  "files": [
-    "dist/**/*.d.ts",
-    "dist/**/*.d.ts.map",
-    "dist/**/*.js",
-    "dist/**/*.js.map"
-  ],
-  "peerDependencies": {
-    "effect": "^4.0.0-beta.67"
+  "publishConfig": {
+    "access": "public"
   },
   "scripts": {
     "build": "tsc -b",
-    "check": "tsc -b --pretty false && pnpm type-test",
-    "test": "pnpm build && node --test test/*.test.mjs",
+    "check": "tsc -b --pretty false && bun run type-test && bun run test-type",
+    "prepack": "rm -rf dist && bun run build",
+    "test": "bun run build && bun --bun vitest run --config ../../vitest.config.ts",
+    "test-type": "tsc -p tsconfig.test.json --pretty false",
     "type-test": "tsc -p tsconfig.type-tests.json --pretty false"
+  },
+  "peerDependencies": {
+    "@simplewebauthn/server": "^13.3.1",
+    "alchemy": ">=2.0.0-beta.44 <3",
+    "effect": "^4.0.0-beta.67",
+    "effect-qb": "4.0.0-beta.66"
+  },
+  "peerDependenciesMeta": {
+    "@simplewebauthn/server": {
+      "optional": true
+    },
+    "alchemy": {
+      "optional": true
+    },
+    "effect-qb": {
+      "optional": true
+    }
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Effect Auth contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.