@effect-auth/core 0.1.0-alpha.0 → 0.1.0-alpha.2

package/dist/AuthFlow.js

@@ -1,10 +1,137 @@
-import { Context, Data, Effect } from "effect";
-export class AuthFlowError extends Data.TaggedError("AuthFlowError") {
+import { Context, Data, Effect, Layer } from "effect";
+import { AuthEmailVerificationSessionPolicyConfig } from "./AuthConfig.js";
+import { AuthFlowId } from "./Identifiers.js";
+import { Sessions } from "./Sessions.js";
+export class EmailVerificationSessionPolicy extends Context.Service()("auth/EmailVerificationSessionPolicy") {
+}
+(function (EmailVerificationSessionPolicy) {
+    EmailVerificationSessionPolicy.make = (service) => EmailVerificationSessionPolicy.of(service);
+})(EmailVerificationSessionPolicy || (EmailVerificationSessionPolicy = {}));
+const addEmailVerificationRequirement = (requirements) => requirements?.includes("email_verification") === true
+    ? requirements
+    : [...(requirements ?? []), "email_verification"];
+const removeEmailVerificationRequirement = (requirements) => requirements?.filter((requirement) => requirement !== "email_verification");
+const withEmailVerified = (claims, emailVerified) => {
+    const requirements = emailVerified
+        ? removeEmailVerificationRequirement(claims?.requirements)
+        : claims?.requirements;
+    return {
+        ...claims,
+        emailVerified,
+        ...(requirements === undefined ? {} : { requirements }),
+    };
+};
+const withEmailVerificationRequirement = (claims) => ({
+    ...claims,
+    emailVerified: false,
+    requirements: addEmailVerificationRequirement(claims?.requirements),
+});
+export const makeEmailVerificationSessionPolicy = (options = {}) => {
+    const mode = options.mode ?? "allow-unverified";
+    return EmailVerificationSessionPolicy.make({
+        decide: Effect.fn("auth.email_verification_session_policy.decide")(function* (input) {
+            const emailVerified = input.claims?.emailVerified;
+            if (emailVerified !== false) {
+                return {
+                    _tag: "CreateSession",
+                    claims: emailVerified === true
+                        ? withEmailVerified(input.claims, true)
+                        : input.claims,
+                };
+            }
+            switch (mode) {
+                case "allow-unverified": {
+                    return {
+                        _tag: "CreateSession",
+                        claims: withEmailVerified(input.claims, false),
+                    };
+                }
+                case "limited-session": {
+                    return {
+                        _tag: "CreateSession",
+                        claims: withEmailVerificationRequirement(input.claims),
+                    };
+                }
+                case "require-before-session": {
+                    return { _tag: "RequiresEmailVerification" };
+                }
+            }
+        }),
+    });
+};
+export const EmailVerificationSessionPolicyLive = (options) => Layer.succeed(EmailVerificationSessionPolicy)(makeEmailVerificationSessionPolicy(options));
+export const AuthResult = Data.taggedEnum();
+export class AuthFlowStateError extends Data.TaggedError("AuthFlowStateError") {
 }
 export class AuthFlow extends Context.Service()("auth/AuthFlow") {
 }
-export const denied = (reason) => ({
-    type: "denied",
-    reason
-});
+(function (AuthFlow) {
+    AuthFlow.make = (service) => AuthFlow.of(service);
+})(AuthFlow || (AuthFlow = {}));
+export const makeAuthFlow = (dependencies) => {
+    const emailVerificationSessionPolicy = dependencies.emailVerificationSessionPolicy ??
+        makeEmailVerificationSessionPolicy();
+    const complete = Effect.fn("auth.auth_flow.complete")(function* (input) {
+        yield* Effect.annotateCurrentSpan({
+            "auth.method": input.method,
+            "auth.aal": input.aal,
+            "auth.amr_count": input.amr.length,
+        });
+        const session = yield* dependencies.sessions.create({
+            userId: input.userId,
+            method: input.method,
+            amr: input.amr,
+            aal: input.aal,
+            claims: input.claims,
+        });
+        yield* Effect.annotateCurrentSpan("auth.result", "Authenticated");
+        return AuthResult.Authenticated({ session });
+    });
+    const completePrimaryFactor = Effect.fn("auth.auth_flow.complete_primary_factor")(function* (input) {
+        const decision = yield* emailVerificationSessionPolicy.decide({
+            claims: input.claims,
+        });
+        if (decision._tag === "RequiresEmailVerification") {
+            yield* Effect.annotateCurrentSpan("auth.result", "RequiresEmailVerification");
+            return AuthResult.RequiresEmailVerification({
+                flowId: AuthFlowId("email-verification"),
+                ...(input.email === undefined
+                    ? {}
+                    : { userId: input.userId, email: input.email }),
+            });
+        }
+        return yield* complete({
+            userId: input.userId,
+            method: input.method,
+            amr: input.amr,
+            aal: input.aal,
+            claims: decision.claims,
+        });
+    });
+    return AuthFlow.make({
+        startPrimaryFactor: completePrimaryFactor,
+        completePrimaryFactor,
+        completeMfa: Effect.fn("auth.auth_flow.complete_mfa")(function* () {
+            return yield* new AuthFlowStateError({
+                message: "MFA flow state is not implemented yet",
+            });
+        }),
+        complete,
+    });
+};
+export const AuthFlowLive = Layer.effect(AuthFlow)(Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    const emailVerificationSessionPolicyOptions = yield* AuthEmailVerificationSessionPolicyConfig;
+    return makeAuthFlow({
+        sessions,
+        emailVerificationSessionPolicy: makeEmailVerificationSessionPolicy(emailVerificationSessionPolicyOptions),
+    });
+}));
+export const AuthFlowLiveWithEmailVerificationPolicy = (options) => Layer.effect(AuthFlow)(Effect.gen(function* () {
+    const sessions = yield* Sessions;
+    return makeAuthFlow({
+        sessions,
+        emailVerificationSessionPolicy: makeEmailVerificationSessionPolicy(options),
+    });
+}));
 //# sourceMappingURL=AuthFlow.js.map

package/dist/AuthFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthFlow.js","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAuD9C,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAGjE;CAAG;AASL,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA6B,CAAC,eAAe,CAAC;CAAG;AAE9F,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAc,EAAE,CAAC,CAAC;IAC7D,IAAI,EAAE,QAAQ;IACd,MAAM;CACP,CAAC,CAAA"}
+{"version":3,"file":"AuthFlow.js","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EAAE,wCAAwC,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA4CzC,MAAM,OAAO,8BAA+B,SAAQ,OAAO,CAAC,OAAO,EAGhE,CAAC,qCAAqC,CAAC;CAAG;AAE7C,WAAiB,8BAA8B;IAChC,mCAAI,GAAG,CAClB,OAA8C,EACP,EAAE,CACzC,8BAA8B,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC,EALgB,8BAA8B,KAA9B,8BAA8B,QAK9C;AAED,MAAM,+BAA+B,GAAG,CACtC,YAAuD,EACxB,EAAE,CACjC,YAAY,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,IAAI;IACnD,CAAC,CAAC,YAAY;IACd,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAEtD,MAAM,kCAAkC,GAAG,CACzC,YAAuD,EACZ,EAAE,CAC7C,YAAY,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,oBAAoB,CAAC,CAAC;AAE9E,MAAM,iBAAiB,GAAG,CACxB,MAAiC,EACjC,aAAsB,EACP,EAAE;IACjB,MAAM,YAAY,GAAG,aAAa;QAChC,CAAC,CAAC,kCAAkC,CAAC,MAAM,EAAE,YAAY,CAAC;QAC1D,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC;IAEzB,OAAO;QACL,GAAG,MAAM;QACT,aAAa;QACb,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gCAAgC,GAAG,CACvC,MAAiC,EAClB,EAAE,CAAC,CAAC;IACnB,GAAG,MAAM;IACT,aAAa,EAAE,KAAK;IACpB,YAAY,EAAE,+BAA+B,CAAC,MAAM,EAAE,YAAY,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAChD,UAAiD,EAAE,EACZ,EAAE;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAEhD,OAAO,8BAA8B,CAAC,IAAI,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,+CAA+C,CAAC,CAChE,QAAQ,CAAC,EAAE,KAAK;YACd,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC;YAElD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO;oBACL,IAAI,EAAE,eAAwB;oBAC9B,MAAM,EACJ,aAAa,KAAK,IAAI;wBACpB,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;wBACvC,CAAC,CAAC,KAAK,CAAC,MAAM;iBACnB,CAAC;YACJ,CAAC;YAED,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,kBAAkB,CAAC,CAAC,CAAC;oBACxB,OAAO;wBACL,IAAI,EAAE,eAAwB;wBAC9B,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC;qBAC/C,CAAC;gBACJ,CAAC;gBACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;oBACvB,OAAO;wBACL,IAAI,EAAE,eAAwB;wBAC9B,MAAM,EAAE,gCAAgC,CAAC,KAAK,CAAC,MAAM,CAAC;qBACvD,CAAC;gBACJ,CAAC;gBACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;oBAC9B,OAAO,EAAE,IAAI,EAAE,2BAAoC,EAAE,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC,CACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAChD,OAA+C,EAC/C,EAAE,CACF,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAC3C,kCAAkC,CAAC,OAAO,CAAC,CAC5C,CAAC;AAmDJ,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAc,CAAC;AAyBxD,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAG3E;CAAG;AA0BL,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA6B,CACxE,eAAe,CAChB;CAAG;AAEJ,WAAiB,QAAQ;IACV,aAAI,GAAG,CAAC,OAAwB,EAAmB,EAAE,CAChE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,EAHgB,QAAQ,KAAR,QAAQ,QAGxB;AAOD,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,YAAkC,EACjB,EAAE;IACnB,MAAM,8BAA8B,GAClC,YAAY,CAAC,8BAA8B;QAC3C,kCAAkC,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,QAAQ,CAAC,EAC7D,KAA4B;QAE5B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAChC,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,UAAU,EAAE,KAAK,CAAC,GAAG;YACrB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;SACnC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAElE,OAAO,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CACrC,wCAAwC,CACzC,CAAC,QAAQ,CAAC,EAAE,KAA0B;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,8BAA8B,CAAC,MAAM,CAAC;YAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YAClD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAC/B,aAAa,EACb,2BAA2B,CAC5B,CAAC;YAEF,OAAO,UAAU,CAAC,yBAAyB,CAAC;gBAC1C,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC;gBACxC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;oBAC3B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,kBAAkB,EAAE,qBAAqB;QACzC,qBAAqB;QACrB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC;YAC7D,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC;gBACnC,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,CAAC,CAAC;QACF,QAAQ;KACT,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IACjC,MAAM,qCAAqC,GACzC,KAAK,CAAC,CAAC,wCAAwC,CAAC;IAElD,OAAO,YAAY,CAAC;QAClB,QAAQ;QACR,8BAA8B,EAAE,kCAAkC,CAChE,qCAAqC,CACtC;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,OAA+C,EAC/C,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IAEjC,OAAO,YAAY,CAAC;QAClB,QAAQ;QACR,8BAA8B,EAC5B,kCAAkC,CAAC,OAAO,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/dist/AuthKernel.d.ts

@@ -0,0 +1,3 @@
+import { Layer } from "effect";
+export declare const AuthKernelLive: Layer.Layer<import("./Challenge.js").Challenge | import("./Sessions.js").Sessions | import("./Sessions.js").SessionCookie | import("./AuthFlow.js").AuthFlow | import("./Privacy.js").Privacy | import("./HttpApi/Transport.js").AuthHttp, never, import("./Crypto.js").Crypto | import("./Storage.js").VerificationStore | import("./AuthConfig.js").AuthSecrets | import("./Storage.js").SessionStore>;
+//# sourceMappingURL=AuthKernel.d.ts.map

package/dist/AuthKernel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthKernel.d.ts","sourceRoot":"","sources":["../src/AuthKernel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAe/B,eAAO,MAAM,cAAc,0YAGyB,CAAC"}

package/dist/AuthKernel.js

@@ -0,0 +1,9 @@
+import { Layer } from "effect";
+import { AuthFlowLive } from "./AuthFlow.js";
+import { ChallengeLive } from "./Challenge.js";
+import { AuthHttpTransportLive } from "./HttpApi/Transport.js";
+import { PrivacyLive } from "./Privacy.js";
+import { SessionCookieLive, SessionsLive } from "./Sessions.js";
+const AuthKernelPrimitivesLive = Layer.mergeAll(SessionsLive(), SessionCookieLive(), ChallengeLive(), PrivacyLive());
+export const AuthKernelLive = Layer.mergeAll(AuthFlowLive, AuthHttpTransportLive).pipe(Layer.provideMerge(AuthKernelPrimitivesLive));
+//# sourceMappingURL=AuthKernel.js.map

package/dist/AuthKernel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthKernel.js","sourceRoot":"","sources":["../src/AuthKernel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEhE,MAAM,wBAAwB,GAAG,KAAK,CAAC,QAAQ,CAC7C,YAAY,EAAE,EACd,iBAAiB,EAAE,EACnB,aAAa,EAAE,EACf,WAAW,EAAE,CACd,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAC1C,YAAY,EACZ,qBAAqB,CACtB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC,CAAC"}

package/dist/Challenge.d.ts

@@ -1,6 +1,11 @@
-import { Context, Effect, Redacted } from "effect";
-import type * as Duration from "effect/Duration";
-import type { ChallengeId, UnixMillis } from "./Identifiers.js";
+import { Context, Duration, Effect, Layer, Redacted } from "effect";
+import { AuthSecrets } from "./AuthConfig.js";
+import { Crypto } from "./Crypto.js";
+import type { CryptoKey, CryptoService } from "./Crypto.js";
+import type { UnixMillis } from "./Identifiers.js";
+import { ChallengeId } from "./Identifiers.js";
+import { VerificationStore } from "./Storage.js";
+import type { VerificationStoreService } from "./Storage.js";
 export type ChallengeType = "email-otp" | "magic-link" | "passkey-authentication" | "reset-password" | "email-verification" | "oauth-state" | "mfa" | (string & {});
 export interface ChallengeIssueInput {
     readonly type: ChallengeType;
@@ -60,5 +65,19 @@ export interface ChallengeService {
 declare const Challenge_base: Context.ServiceClass<Challenge, "auth/Challenge", ChallengeService>;
 export declare class Challenge extends Challenge_base {
 }
+export declare namespace Challenge {
+    const make: (service: ChallengeService) => ChallengeService;
+}
+export interface ChallengeOptions {
+    readonly secret: CryptoKey;
+    readonly challengeIdBytes?: number;
+}
+export interface ChallengeDependencies extends ChallengeOptions {
+    readonly crypto: CryptoService;
+    readonly verificationStore: VerificationStoreService;
+}
+export declare const makeChallenge: (dependencies: ChallengeDependencies) => ChallengeService;
+export declare function ChallengeLive(options: ChallengeOptions): Layer.Layer<Challenge, never, Crypto | VerificationStore>;
+export declare function ChallengeLive(): Layer.Layer<Challenge, never, Crypto | VerificationStore | AuthSecrets>;
 export {};
 //# sourceMappingURL=Challenge.d.ts.map

package/dist/Challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Challenge.d.ts","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE/D,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,YAAY,GACZ,wBAAwB,GACxB,gBAAgB,GAChB,oBAAoB,GACpB,aAAa,GACb,KAAK,GACL,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACtD;;;;AAED,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,cAAc,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,qBAAqB,CAAA;AAE/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IACnG,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAA;IACxG,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;CAClF;;AAED,qBAAa,SAAU,SAAQ,cAAgE;CAAG"}
+{"version":3,"file":"Challenge.d.ts","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EAEP,QAAQ,EACR,MAAM,EACN,KAAK,EAEL,QAAQ,EACT,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAuB,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAM/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAmB,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,YAAY,GACZ,wBAAwB,GACxB,gBAAgB,GAChB,oBAAoB,GACpB,aAAa,GACb,KAAK,GACL,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;;;;AAED,qBAAa,mBAAoB,SAAQ,yBAEvC;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;;;;AAEL,qBAAa,oBAAqB,SAAQ,0BAExC;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;;;;AAEL,qBAAa,qBAAsB,SAAQ,2BAEzC;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,oBAAoB,KACxB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAChB,EAAE,EAAE,WAAW,KACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;CACjD;;AAED,qBAAa,SAAU,SAAQ,cAE9B;CAAG;AAEJ,yBAAiB,SAAS,CAAC;IAClB,MAAM,IAAI,GAAI,SAAS,gBAAgB,KAAG,gBAC1B,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;CACtD;AAiBD,eAAO,MAAM,aAAa,GACxB,cAAc,qBAAqB,KAClC,gBA4MF,CAAC;AAEF,wBAAgB,aAAa,CAC3B,OAAO,EAAE,gBAAgB,GACxB,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC;AAC7D,wBAAgB,aAAa,IAAI,KAAK,CAAC,KAAK,CAC1C,SAAS,EACT,KAAK,EACL,MAAM,GAAG,iBAAiB,GAAG,WAAW,CACzC,CAAC"}

package/dist/Challenge.js

@@ -1,4 +1,9 @@
-import { Context, Data, Effect, Redacted } from "effect";
+import { Context, Data, Duration, Effect, Layer, Option, Redacted, } from "effect";
+import { AuthChallengeConfig, AuthSecrets } from "./AuthConfig.js";
+import { Crypto } from "./Crypto.js";
+import { ChallengeId } from "./Identifiers.js";
+import { addMillis, currentUnixMillis, timingSafeEqualString, } from "./Internal.js";
+import { VerificationStore } from "./Storage.js";
 export class ChallengeIssueError extends Data.TaggedError("ChallengeIssueError") {
 }
 export class ChallengeVerifyError extends Data.TaggedError("ChallengeVerifyError") {
@@ -7,4 +12,158 @@ export class ChallengeConsumeError extends Data.TaggedError("ChallengeConsumeErr
 }
 export class Challenge extends Context.Service()("auth/Challenge") {
 }
+(function (Challenge) {
+    Challenge.make = (service) => Challenge.of(service);
+})(Challenge || (Challenge = {}));
+const ttlMillis = (ttl) => Duration.toMillis(ttl);
+const hashChallengeSecret = (crypto, key, secret) => crypto.hmacSha256({ key, data: Redacted.value(secret) });
+const verifiedFromRow = (row) => ({
+    id: row.id,
+    type: row.type,
+    subject: row.subject,
+    metadata: row.metadata,
+});
+export const makeChallenge = (dependencies) => {
+    const challengeIdBytes = dependencies.challengeIdBytes ?? 16;
+    return Challenge.make({
+        issue: Effect.fn("auth.challenge.issue")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.challenge.type", input.type);
+            const ttl = ttlMillis(input.ttl);
+            if (!Number.isFinite(ttl) || ttl <= 0) {
+                return yield* new ChallengeIssueError({
+                    message: "Challenge ttl must be a positive finite duration",
+                });
+            }
+            const now = yield* currentUnixMillis;
+            const id = ChallengeId(yield* dependencies.crypto.randomToken(challengeIdBytes).pipe(Effect.mapError((cause) => new ChallengeIssueError({
+                message: "Failed to generate challenge id",
+                cause,
+            }))));
+            const secretHash = input.secret === undefined
+                ? undefined
+                : yield* hashChallengeSecret(dependencies.crypto, dependencies.secret, input.secret).pipe(Effect.mapError((cause) => new ChallengeIssueError({
+                    message: "Failed to hash challenge secret",
+                    cause,
+                })));
+            yield* dependencies.verificationStore
+                .insert({
+                id,
+                type: input.type,
+                subject: input.subject,
+                secretHash,
+                createdAt: now,
+                expiresAt: addMillis(now, ttl),
+                metadata: input.metadata,
+            })
+                .pipe(Effect.mapError((cause) => new ChallengeIssueError({
+                message: "Failed to store challenge",
+                cause,
+            })));
+            return {
+                id,
+                type: input.type,
+                subject: input.subject,
+                secret: input.secret,
+                expiresAt: addMillis(now, ttl),
+            };
+        }),
+        verify: Effect.fn("auth.challenge.verify")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.challenge.type", input.type);
+            const now = yield* currentUnixMillis;
+            const rowOption = yield* dependencies.verificationStore
+                .findById(input.challengeId)
+                .pipe(Effect.mapError((cause) => new ChallengeVerifyError({
+                message: "Failed to load challenge",
+                cause,
+            })));
+            if (Option.isNone(rowOption)) {
+                return yield* new ChallengeVerifyError({
+                    message: "Challenge not found",
+                });
+            }
+            const row = rowOption.value;
+            if (row.type !== input.type) {
+                return yield* new ChallengeVerifyError({
+                    message: "Challenge type mismatch",
+                });
+            }
+            if (row.consumedAt !== undefined) {
+                return yield* new ChallengeVerifyError({
+                    message: "Challenge already consumed",
+                });
+            }
+            if (Number(row.expiresAt) <= Number(now)) {
+                return yield* new ChallengeVerifyError({
+                    message: "Challenge expired",
+                });
+            }
+            if (row.secretHash !== undefined) {
+                if (input.secret === undefined) {
+                    return yield* new ChallengeVerifyError({
+                        message: "Challenge secret is required",
+                    });
+                }
+                const secretHash = yield* hashChallengeSecret(dependencies.crypto, dependencies.secret, input.secret).pipe(Effect.mapError((cause) => new ChallengeVerifyError({
+                    message: "Failed to hash challenge secret",
+                    cause,
+                })));
+                const secretMatches = yield* timingSafeEqualString(dependencies.crypto, secretHash, row.secretHash).pipe(Effect.mapError((cause) => new ChallengeVerifyError({
+                    message: "Failed to compare challenge secret",
+                    cause,
+                })));
+                if (!secretMatches) {
+                    return yield* new ChallengeVerifyError({
+                        message: "Invalid challenge secret",
+                    });
+                }
+            }
+            const consumed = yield* dependencies.verificationStore
+                .consume({
+                id: input.challengeId,
+                type: input.type,
+                consumedAt: now,
+            })
+                .pipe(Effect.mapError((cause) => new ChallengeVerifyError({
+                message: "Failed to consume challenge",
+                cause,
+            })));
+            if (Option.isNone(consumed)) {
+                return yield* new ChallengeVerifyError({
+                    message: "Challenge already consumed or expired",
+                });
+            }
+            return verifiedFromRow(consumed.value);
+        }),
+        consume: Effect.fn("auth.challenge.consume")(function* (id) {
+            const now = yield* currentUnixMillis;
+            const consumed = yield* dependencies.verificationStore
+                .consume({ id, consumedAt: now })
+                .pipe(Effect.mapError((cause) => new ChallengeConsumeError({
+                message: "Failed to consume challenge",
+                cause,
+            })));
+            if (Option.isNone(consumed)) {
+                return yield* new ChallengeConsumeError({
+                    message: "Challenge not found, expired, or already consumed",
+                });
+            }
+        }),
+    });
+};
+export function ChallengeLive(options) {
+    return Layer.effect(Challenge)(Effect.gen(function* () {
+        const crypto = yield* Crypto;
+        const verificationStore = yield* VerificationStore;
+        const resolvedOptions = options ??
+            {
+                ...(yield* AuthChallengeConfig),
+                secret: (yield* AuthSecrets).challenge,
+            };
+        return makeChallenge({
+            ...resolvedOptions,
+            crypto,
+            verificationStore,
+        });
+    }));
+}
 //# sourceMappingURL=Challenge.js.map

package/dist/Challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"Challenge.js","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AA4CxD,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAG7E;CAAG;AAEL,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAG/E;CAAG;AAEL,MAAM,OAAO,qBAAsB,SAAQ,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAGjF;CAAG;AAUL,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAA+B,CAAC,gBAAgB,CAAC;CAAG"}
+{"version":3,"file":"Challenge.js","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,KAAK,EACL,MAAM,EACN,QAAQ,GACT,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AA0CjD,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CACvD,qBAAqB,CAIrB;CAAG;AAEL,MAAM,OAAO,oBAAqB,SAAQ,IAAI,CAAC,WAAW,CACxD,sBAAsB,CAItB;CAAG;AAEL,MAAM,OAAO,qBAAsB,SAAQ,IAAI,CAAC,WAAW,CACzD,uBAAuB,CAIvB;CAAG;AAmBL,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,OAAO,EAA+B,CAC3E,gBAAgB,CACjB;CAAG;AAEJ,WAAiB,SAAS;IACX,cAAI,GAAG,CAAC,OAAyB,EAAoB,EAAE,CAClE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC,EAHgB,SAAS,KAAT,SAAS,QAGzB;AAYD,MAAM,SAAS,GAAG,CAAC,GAAsB,EAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAE7E,MAAM,mBAAmB,GAAG,CAC1B,MAAqB,EACrB,GAAc,EACd,MAAiC,EACjC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE9D,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAqB,EAAE,CAAC,CAAC;IACpE,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,YAAmC,EACjB,EAAE;IACpB,MAAM,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAE7D,OAAO,SAAS,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAChD,KAA0B;YAE1B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAErE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;oBACpC,OAAO,EAAE,kDAAkD;iBAC5D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;YACrC,MAAM,EAAE,GAAG,WAAW,CACpB,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,mBAAmB,CAAC;gBACtB,OAAO,EAAE,iCAAiC;gBAC1C,KAAK;aACN,CAAC,CACL,CACF,CACF,CAAC;YACF,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,KAAK,SAAS;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CACxB,YAAY,CAAC,MAAM,EACnB,YAAY,CAAC,MAAM,EACnB,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,mBAAmB,CAAC;oBACtB,OAAO,EAAE,iCAAiC;oBAC1C,KAAK;iBACN,CAAC,CACL,CACF,CAAC;YAER,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB;iBAClC,MAAM,CAAC;gBACN,EAAE;gBACF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU;gBACV,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,mBAAmB,CAAC;gBACtB,OAAO,EAAE,2BAA2B;gBACpC,KAAK;aACN,CAAC,CACL,CACF,CAAC;YAEJ,OAAO;gBACL,EAAE;gBACF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;aAC/B,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAClD,KAA2B;YAE3B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAErE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;YACrC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB;iBACpD,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;iBAC3B,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;gBACvB,OAAO,EAAE,0BAA0B;gBACnC,KAAK;aACN,CAAC,CACL,CACF,CAAC;YAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,OAAO,EAAE,qBAAqB;iBAC/B,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC;YAE5B,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,OAAO,EAAE,yBAAyB;iBACnC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,OAAO,EAAE,4BAA4B;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,OAAO,EAAE,mBAAmB;iBAC7B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;wBACrC,OAAO,EAAE,8BAA8B;qBACxC,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC3C,YAAY,CAAC,MAAM,EACnB,YAAY,CAAC,MAAM,EACnB,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;oBACvB,OAAO,EAAE,iCAAiC;oBAC1C,KAAK;iBACN,CAAC,CACL,CACF,CAAC;gBACF,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAChD,YAAY,CAAC,MAAM,EACnB,UAAU,EACV,GAAG,CAAC,UAAU,CACf,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;oBACvB,OAAO,EAAE,oCAAoC;oBAC7C,KAAK;iBACN,CAAC,CACL,CACF,CAAC;gBAEF,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;wBACrC,OAAO,EAAE,0BAA0B;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB;iBACnD,OAAO,CAAC;gBACP,EAAE,EAAE,KAAK,CAAC,WAAW;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,GAAG;aAChB,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;gBACvB,OAAO,EAAE,6BAA6B;gBACtC,KAAK;aACN,CAAC,CACL,CACF,CAAC;YAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,OAAO,EAAE,uCAAuC;iBACjD,CAAC,CAAC;YACL,CAAC;YAED,OAAO,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAe;YACrE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;YACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB;iBACnD,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;iBAChC,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,qBAAqB,CAAC;gBACxB,OAAO,EAAE,6BAA6B;gBACtC,KAAK;aACN,CAAC,CACL,CACF,CAAC;YAEJ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;oBACtC,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAUF,MAAM,UAAU,aAAa,CAAC,OAA0B;IACtD,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;QAC7B,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QACnD,MAAM,eAAe,GACnB,OAAO;YACN;gBACC,GAAG,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC;gBAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS;aACX,CAAC;QAEhC,OAAO,aAAa,CAAC;YACnB,GAAG,eAAe;YAClB,MAAM;YACN,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/Client.d.ts

@@ -0,0 +1,36 @@
+import { Schema } from "effect";
+import { CurrentSessionHttpBody, EmailVerificationStartBody, EmailVerificationVerifyBody, PasswordAuthSuccess, PasswordSignInBody, PasswordSignUpBody } from "./HttpApi.js";
+export type PasswordSignInRequest = Schema.Codec.Encoded<typeof PasswordSignInBody>;
+export type PasswordSignUpRequest = Schema.Codec.Encoded<typeof PasswordSignUpBody>;
+export type EmailVerificationStartRequest = Schema.Codec.Encoded<typeof EmailVerificationStartBody>;
+export type EmailVerificationVerifyRequest = Schema.Codec.Encoded<typeof EmailVerificationVerifyBody>;
+export type PasswordAuthResponse = Schema.Schema.Type<typeof PasswordAuthSuccess>;
+export type CurrentSessionResponse = Schema.Schema.Type<typeof CurrentSessionHttpBody>;
+export interface AuthClientRequestOptions {
+    readonly signal?: AbortSignal;
+}
+export interface AuthClientOptions {
+    readonly baseUrl?: URL | string;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly requestInit?: RequestInit;
+}
+export interface AuthClient {
+    readonly password: {
+        readonly signIn: (input: PasswordSignInRequest, options?: AuthClientRequestOptions) => Promise<PasswordAuthResponse>;
+        readonly signUp: (input: PasswordSignUpRequest, options?: AuthClientRequestOptions) => Promise<PasswordAuthResponse>;
+    };
+    readonly session: {
+        readonly current: (options?: AuthClientRequestOptions) => Promise<CurrentSessionResponse>;
+        readonly currentOrUndefined: (options?: AuthClientRequestOptions) => Promise<CurrentSessionResponse | undefined>;
+        readonly refresh: (options?: AuthClientRequestOptions) => Promise<CurrentSessionResponse>;
+        readonly logout: (options?: AuthClientRequestOptions) => Promise<void>;
+    };
+    readonly emailVerification: {
+        readonly start: (input: EmailVerificationStartRequest, options?: AuthClientRequestOptions) => Promise<void>;
+        readonly verify: (input: EmailVerificationVerifyRequest, options?: AuthClientRequestOptions) => Promise<void>;
+    };
+    readonly dispose: () => Promise<void>;
+}
+export declare const authClientErrorMessage: (error: unknown) => string;
+export declare const createAuthClient: (options?: AuthClientOptions) => AuthClient;
+//# sourceMappingURL=Client.d.ts.map

package/dist/Client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Client.d.ts","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,MAAM,EAAE,MAAM,QAAQ,CAAC;AAI/D,OAAO,EAGL,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CACtD,OAAO,kBAAkB,CAC1B,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CACtD,OAAO,kBAAkB,CAC1B,CAAC;AACF,MAAM,MAAM,6BAA6B,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAC9D,OAAO,0BAA0B,CAClC,CAAC;AACF,MAAM,MAAM,8BAA8B,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAC/D,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACnD,OAAO,mBAAmB,CAC3B,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACrD,OAAO,sBAAsB,CAC9B,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,wBAAwB,KAC/B,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACnC,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,wBAAwB,KAC/B,OAAO,CAAC,oBAAoB,CAAC,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,CAChB,OAAO,CAAC,EAAE,wBAAwB,KAC/B,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACrC,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,OAAO,CAAC,EAAE,wBAAwB,KAC/B,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;QACjD,QAAQ,CAAC,OAAO,EAAE,CAChB,OAAO,CAAC,EAAE,wBAAwB,KAC/B,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACxE,CAAC;IACF,QAAQ,CAAC,iBAAiB,EAAE;QAC1B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,6BAA6B,EACpC,OAAO,CAAC,EAAE,wBAAwB,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,8BAA8B,EACrC,OAAO,CAAC,EAAE,wBAAwB,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;KACpB,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AASD,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,MAYvD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,UAAS,iBAAsB,KAC9B,UA4FF,CAAC"}

package/dist/Client.js

@@ -0,0 +1,55 @@
+import { Effect, Layer, ManagedRuntime, Schema } from "effect";
+import { FetchHttpClient, HttpClient } from "effect/unstable/http";
+import { HttpApiClient } from "effect/unstable/httpapi";
+import { AuthApi, AuthUnauthenticatedError, CurrentSessionHttpBody, EmailVerificationStartBody, EmailVerificationVerifyBody, PasswordAuthSuccess, PasswordSignInBody, PasswordSignUpBody, } from "./HttpApi.js";
+const defaultRequestInit = { credentials: "include" };
+const authClientErrorShape = (error) => typeof error === "object" && error !== null
+    ? error
+    : undefined;
+export const authClientErrorMessage = (error) => {
+    const shape = authClientErrorShape(error);
+    if (typeof shape?.message === "string") {
+        return shape.message;
+    }
+    if (typeof shape?.code === "string") {
+        return shape.code;
+    }
+    return error instanceof Error ? error.message : "Request failed";
+};
+export const createAuthClient = (options = {}) => {
+    const requestInit = {
+        ...defaultRequestInit,
+        ...options.requestInit,
+    };
+    const fetchLayer = FetchHttpClient.layer.pipe(Layer.provide(Layer.succeed(FetchHttpClient.RequestInit, requestInit)), options.fetch === undefined
+        ? (layer) => layer
+        : Layer.provide(Layer.succeed(FetchHttpClient.Fetch, options.fetch)));
+    const runtime = ManagedRuntime.make(fetchLayer);
+    const clientEffect = HttpApiClient.make(AuthApi, {
+        baseUrl: options.baseUrl,
+    });
+    const decodePasswordSignIn = Schema.decodeUnknownEffect(PasswordSignInBody);
+    const decodePasswordSignUp = Schema.decodeUnknownEffect(PasswordSignUpBody);
+    const decodeEmailVerificationStart = Schema.decodeUnknownEffect(EmailVerificationStartBody);
+    const decodeEmailVerificationVerify = Schema.decodeUnknownEffect(EmailVerificationVerifyBody);
+    const run = (effect, requestOptions = {}) => runtime.runPromise(effect, requestOptions);
+    const withClient = (effect, requestOptions) => run(Effect.flatMap(clientEffect, effect), requestOptions);
+    return {
+        password: {
+            signIn: (input, requestOptions) => withClient((client) => Effect.flatMap(decodePasswordSignIn(input), (payload) => client.password.signIn({ payload })), requestOptions),
+            signUp: (input, requestOptions) => withClient((client) => Effect.flatMap(decodePasswordSignUp(input), (payload) => client.password.signUp({ payload })), requestOptions),
+        },
+        session: {
+            current: (requestOptions) => withClient((client) => client.session.current(), requestOptions),
+            currentOrUndefined: (requestOptions) => withClient((client) => client.session.current().pipe(Effect.catchIf((error) => error instanceof AuthUnauthenticatedError, () => Effect.succeed(undefined))), requestOptions),
+            refresh: (requestOptions) => withClient((client) => client.session.refresh(), requestOptions),
+            logout: (requestOptions) => withClient((client) => client.session.logout(), requestOptions),
+        },
+        emailVerification: {
+            start: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeEmailVerificationStart(input), (payload) => client.emailVerification.start({ payload })), requestOptions),
+            verify: (input, requestOptions) => withClient((client) => Effect.flatMap(decodeEmailVerificationVerify(input), (payload) => client.emailVerification.verify({ payload })), requestOptions),
+        },
+        dispose: () => runtime.dispose(),
+    };
+};
+//# sourceMappingURL=Client.js.map

package/dist/Client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Client.js","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EACL,OAAO,EACP,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAmEtB,MAAM,kBAAkB,GAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAEnE,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAE,EAAE,CAC9C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;IACzC,CAAC,CAAE,KAAiE;IACpE,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/D,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE1C,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,UAA6B,EAAE,EACnB,EAAE;IACd,MAAM,WAAW,GAAG;QAClB,GAAG,kBAAkB;QACrB,GAAG,OAAO,CAAC,WAAW;KACD,CAAC;IACxB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAC3C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EACtE,OAAO,CAAC,KAAK,KAAK,SAAS;QACzB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;QAClB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE;QAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IAC5E,MAAM,4BAA4B,GAAG,MAAM,CAAC,mBAAmB,CAC7D,0BAA0B,CAC3B,CAAC;IACF,MAAM,6BAA6B,GAAG,MAAM,CAAC,mBAAmB,CAC9D,2BAA2B,CAC5B,CAAC;IACF,MAAM,GAAG,GAAG,CACV,MAAkD,EAClD,iBAA2C,EAAE,EAC7C,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,CACjB,MAE+B,EAC/B,cAAyC,EACzC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE;YACR,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAChC,UAAU,CACR,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CACtD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CACpC,EACH,cAAc,CACf;YACH,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAChC,UAAU,CACR,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CACtD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CACpC,EACH,cAAc,CACf;SACJ;QACD,OAAO,EAAE;YACP,OAAO,EAAE,CAAC,cAAc,EAAE,EAAE,CAC1B,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC;YAClE,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE,CACrC,UAAU,CACR,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAC3B,MAAM,CAAC,OAAO,CACZ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,wBAAwB,EACpD,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAChC,CACF,EACH,cAAc,CACf;YACH,OAAO,EAAE,CAAC,cAAc,EAAE,EAAE,CAC1B,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC;YAClE,MAAM,EAAE,CAAC,cAAc,EAAE,EAAE,CACzB,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC;SAClE;QACD,iBAAiB,EAAE;YACjB,KAAK,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAC/B,UAAU,CACR,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9D,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAC5C,EACH,cAAc,CACf;YACH,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAChC,UAAU,CACR,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAC/D,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAC7C,EACH,cAAc,CACf;SACJ;QACD,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;KACjC,CAAC;AACJ,CAAC,CAAC"}

package/dist/Crypto.d.ts

@@ -1,4 +1,4 @@
-import { Context, Effect, Redacted } from "effect";
+import { Context, Effect, Layer, Redacted } from "effect";
 export type CryptoOperation = "random-bytes" | "random-token" | "digest" | "hmac-sha256" | "timing-safe-equal";
 declare const CryptoError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "CryptoError";
@@ -31,5 +31,13 @@ export interface CryptoService {
 declare const Crypto_base: Context.ServiceClass<Crypto, "auth/Crypto", CryptoService>;
 export declare class Crypto extends Crypto_base {
 }
+export declare namespace Crypto {
+    const make: (service: CryptoService) => CryptoService;
+}
+export interface WebCryptoOptions {
+    readonly crypto?: typeof globalThis.crypto;
+}
+export declare const makeWebCrypto: (options?: WebCryptoOptions) => CryptoService;
+export declare const WebCryptoLive: (options?: WebCryptoOptions) => Layer.Layer<Crypto, never, never>;
 export {};
 //# sourceMappingURL=Crypto.d.ts.map

package/dist/Crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Crypto.d.ts","sourceRoot":"","sources":["../src/Crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAExD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,cAAc,GACd,QAAQ,GACR,aAAa,GACb,mBAAmB,CAAA;;;;AAEvB,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAAA;AAE9D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACpF,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACjF,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACjF,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACnF,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;CAC/F;;AAED,qBAAa,MAAO,SAAQ,WAAuD;CAAG"}
+{"version":3,"file":"Crypto.d.ts","sourceRoot":"","sources":["../src/Crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAY,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAE1E,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,cAAc,GACd,QAAQ,GACR,aAAa,GACb,mBAAmB,CAAC;;;;AAExB,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,CACpB,UAAU,EAAE,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,CACpB,UAAU,CAAC,EAAE,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,WAAW,KACf,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,CACnB,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,CACxB,KAAK,EAAE,oBAAoB,KACxB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;CAC1C;;AAED,qBAAa,MAAO,SAAQ,WAE3B;CAAG;AAEJ,yBAAiB,MAAM,CAAC;IACf,MAAM,IAAI,GAAI,SAAS,aAAa,KAAG,aAC1B,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,UAAU,CAAC,MAAM,CAAC;CAC5C;AA4CD,eAAO,MAAM,aAAa,GAAI,UAAU,gBAAgB,KAAG,aA2EvD,CAAC;AAEL,eAAO,MAAM,aAAa,GAAI,UAAU,gBAAgB,sCACT,CAAC"}

package/dist/Crypto.js

@@ -1,6 +1,70 @@
-import { Context, Data, Effect, Redacted } from "effect";
+import { Context, Data, Effect, Encoding, Layer, Redacted } from "effect";
 export class CryptoError extends Data.TaggedError("CryptoError") {
 }
 export class Crypto extends Context.Service()("auth/Crypto") {
 }
+(function (Crypto) {
+    Crypto.make = (service) => Crypto.of(service);
+})(Crypto || (Crypto = {}));
+const textEncoder = new TextEncoder();
+const cryptoError = (operation, message, cause) => new CryptoError({ operation, message, cause });
+const getWebCrypto = (options, operation) => {
+    const crypto = options?.crypto ?? globalThis.crypto;
+    if (crypto === undefined) {
+        throw cryptoError(operation, "Web Crypto is not available");
+    }
+    return crypto;
+};
+const keyBytes = (key) => key instanceof Uint8Array ? key : textEncoder.encode(Redacted.value(key));
+const valueBytes = (value) => typeof value === "string" ? textEncoder.encode(value) : value;
+const randomBytesWith = (crypto, byteLength) => {
+    const bytes = new Uint8Array(byteLength);
+    for (let offset = 0; offset < bytes.length; offset += 65_536) {
+        crypto.getRandomValues(bytes.subarray(offset, Math.min(offset + 65_536, bytes.length)));
+    }
+    return bytes;
+};
+export const makeWebCrypto = (options) => Crypto.make({
+    randomBytes: (byteLength) => Effect.try({
+        try: () => {
+            if (!Number.isInteger(byteLength) || byteLength <= 0) {
+                throw new Error("byteLength must be a positive integer");
+            }
+            return randomBytesWith(getWebCrypto(options, "random-bytes"), byteLength);
+        },
+        catch: (cause) => cryptoError("random-bytes", "Failed to generate random bytes", cause),
+    }),
+    randomToken: (byteLength = 32) => Effect.try({
+        try: () => Encoding.encodeBase64Url(randomBytesWith(getWebCrypto(options, "random-token"), byteLength)),
+        catch: (cause) => cryptoError("random-token", "Failed to generate random token", cause),
+    }),
+    digestSha256: (input) => Effect.tryPromise({
+        try: async () => {
+            const digest = await getWebCrypto(options, "digest").subtle.digest("SHA-256", valueBytes(input.data));
+            return Encoding.encodeBase64Url(new Uint8Array(digest));
+        },
+        catch: (cause) => cryptoError("digest", "Failed to digest data", cause),
+    }),
+    hmacSha256: (input) => Effect.tryPromise({
+        try: async () => {
+            const crypto = getWebCrypto(options, "hmac-sha256");
+            const key = await crypto.subtle.importKey("raw", keyBytes(input.key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+            const signature = await crypto.subtle.sign("HMAC", key, valueBytes(input.data));
+            return Encoding.encodeBase64Url(new Uint8Array(signature));
+        },
+        catch: (cause) => cryptoError("hmac-sha256", "Failed to calculate HMAC-SHA256", cause),
+    }),
+    timingSafeEqual: (input) => Effect.try({
+        try: () => {
+            const length = Math.max(input.left.length, input.right.length);
+            let diff = input.left.length ^ input.right.length;
+            for (let index = 0; index < length; index += 1) {
+                diff |= (input.left[index] ?? 0) ^ (input.right[index] ?? 0);
+            }
+            return diff === 0;
+        },
+        catch: (cause) => cryptoError("timing-safe-equal", "Failed to compare values", cause),
+    }),
+});
+export const WebCryptoLive = (options) => Layer.succeed(Crypto)(makeWebCrypto(options));
 //# sourceMappingURL=Crypto.js.map