@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/Password.d.ts

@@ -0,0 +1,107 @@
+import { Context, Effect, Layer, Redacted } from "effect";
+import { AuthFlow } from "./AuthFlow.js";
+import type { AuthFlowCompleteError, AuthFlowPrimaryFactorResult, AuthFlowService, AuthResultOf } from "./AuthFlow.js";
+import { Crypto } from "./Crypto.js";
+import type { CryptoError, CryptoService } from "./Crypto.js";
+import type { Email } from "./Identifiers.js";
+import { CredentialStore, UserStore } from "./Storage.js";
+import type { CredentialStoreService, StorageError, UserStoreService } from "./Storage.js";
+export interface PasswordSignInInput {
+    readonly email: Email;
+    readonly password: Redacted.Redacted<string>;
+}
+export interface PasswordSignUpInput {
+    readonly email: Email;
+    readonly password: Redacted.Redacted<string>;
+    readonly emailVerified?: boolean;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type PasswordHashOperation = "hash" | "verify";
+declare const PasswordHashError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PasswordHashError";
+} & Readonly<A>;
+export declare class PasswordHashError extends PasswordHashError_base<{
+    readonly operation: PasswordHashOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface PasswordHashInput {
+    readonly password: Redacted.Redacted<string>;
+}
+export interface PasswordVerifyInput {
+    readonly hash: string;
+    readonly password: Redacted.Redacted<string>;
+}
+export interface PasswordHasherService {
+    readonly hash: (input: PasswordHashInput) => Effect.Effect<string, PasswordHashError>;
+    readonly verify: (input: PasswordVerifyInput) => Effect.Effect<boolean, PasswordHashError>;
+}
+declare const PasswordHasher_base: Context.ServiceClass<PasswordHasher, "auth/PasswordHasher", PasswordHasherService>;
+export declare class PasswordHasher extends PasswordHasher_base {
+}
+export declare namespace PasswordHasher {
+    const make: (service: PasswordHasherService) => PasswordHasherService;
+}
+export interface Pbkdf2PasswordHasherOptions {
+    readonly webCrypto?: typeof globalThis.crypto;
+    readonly iterations?: number;
+    readonly saltBytes?: number;
+    readonly hashBytes?: number;
+}
+export interface Pbkdf2PasswordHasherDependencies extends Pbkdf2PasswordHasherOptions {
+    readonly crypto: CryptoService;
+}
+export declare const makePbkdf2PasswordHasher: (dependencies: Pbkdf2PasswordHasherDependencies) => PasswordHasherService;
+export declare const Pbkdf2PasswordHasherLive: (options?: Pbkdf2PasswordHasherOptions) => Layer.Layer<PasswordHasher, never, Crypto>;
+export type PasswordSignInError = StorageError | PasswordHashError | AuthFlowCompleteError;
+export type PasswordSignInResult = AuthFlowPrimaryFactorResult<"password"> | AuthResultOf<"InvalidCredentials" | "AccountDisabled">;
+export interface PasswordLoginService {
+    readonly signIn: (input: PasswordSignInInput) => Effect.Effect<PasswordSignInResult, PasswordSignInError>;
+}
+declare const PasswordLogin_base: Context.ServiceClass<PasswordLogin, "auth/login/Password", PasswordLoginService>;
+export declare class PasswordLogin extends PasswordLogin_base {
+}
+export declare namespace PasswordLogin {
+    const make: (service: PasswordLoginService) => PasswordLoginService;
+}
+export interface PasswordLoginDependencies {
+    readonly users: UserStoreService;
+    readonly credentials: CredentialStoreService;
+    readonly hasher: PasswordHasherService;
+    readonly authFlow: AuthFlowService;
+}
+export declare const makePasswordLogin: (dependencies: PasswordLoginDependencies) => PasswordLoginService;
+export declare const PasswordLoginLive: Layer.Layer<PasswordLogin, never, UserStore | CredentialStore | AuthFlow | PasswordHasher>;
+declare const EmailAlreadyRegisteredError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "EmailAlreadyRegisteredError";
+} & Readonly<A>;
+export declare class EmailAlreadyRegisteredError extends EmailAlreadyRegisteredError_base<{
+    readonly email: Email;
+}> {
+}
+export type PasswordSignUpError = EmailAlreadyRegisteredError | StorageError | PasswordHashError | CryptoError | AuthFlowCompleteError;
+export type PasswordSignUpResult = AuthFlowPrimaryFactorResult<"password">;
+export interface PasswordRegistrationService {
+    readonly signUp: (input: PasswordSignUpInput) => Effect.Effect<PasswordSignUpResult, PasswordSignUpError>;
+}
+declare const PasswordRegistration_base: Context.ServiceClass<PasswordRegistration, "auth/registration/Password", PasswordRegistrationService>;
+export declare class PasswordRegistration extends PasswordRegistration_base {
+}
+export declare namespace PasswordRegistration {
+    const make: (service: PasswordRegistrationService) => PasswordRegistrationService;
+}
+export interface PasswordRegistrationDependencies {
+    readonly users: UserStoreService;
+    readonly credentials: CredentialStoreService;
+    readonly hasher: PasswordHasherService;
+    readonly authFlow: AuthFlowService;
+    readonly crypto: CryptoService;
+    readonly userIdBytes?: number;
+    readonly credentialIdBytes?: number;
+}
+export declare const makePasswordRegistration: (dependencies: PasswordRegistrationDependencies) => PasswordRegistrationService;
+export declare const PasswordRegistrationLive: Layer.Layer<PasswordRegistration, never, Crypto | UserStore | CredentialStore | AuthFlow | PasswordHasher>;
+export declare const PasswordFeatureLive: Layer.Layer<PasswordHasher | PasswordLogin | PasswordRegistration, never, Crypto | UserStore | CredentialStore | AuthFlow>;
+export {};
+//# sourceMappingURL=Password.d.ts.map

package/dist/Password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Password.d.ts","sourceRoot":"","sources":["../src/Password.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EAEP,MAAM,EAEN,KAAK,EAEL,QAAQ,EAET,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAAE,QAAQ,EAAc,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,YAAY,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,QAAQ,CAAC;;;;AAEtD,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,iBAAiB,KACrB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;CAChD;;AAED,qBAAa,cAAe,SAAQ,mBAGV;CAAG;AAE7B,yBAAiB,cAAc,CAAC;IACvB,MAAM,IAAI,GAAI,SAAS,qBAAqB,KAAG,qBAC1B,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AA8GD,eAAO,MAAM,wBAAwB,GACnC,cAAc,gCAAgC,KAC7C,qBA4EF,CAAC;AAEF,eAAO,MAAM,wBAAwB,GACnC,UAAU,2BAA2B,+CAYpC,CAAC;AAEJ,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,iBAAiB,GACjB,qBAAqB,CAAC;AAC1B,MAAM,MAAM,oBAAoB,GAC5B,2BAA2B,CAAC,UAAU,CAAC,GACvC,YAAY,CAAC,oBAAoB,GAAG,iBAAiB,CAAC,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;CAC/D;;AAED,qBAAa,aAAc,SAAQ,kBAGT;CAAG;AAE7B,yBAAiB,aAAa,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,oBAAoB,KAAG,oBAC1B,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAED,eAAO,MAAM,iBAAiB,GAC5B,cAAc,yBAAyB,KACtC,oBAkDC,CAAC;AAEL,eAAO,MAAM,iBAAiB,4FAc7B,CAAC;;;;AAEF,qBAAa,2BAA4B,SAAQ,iCAE/C;IACA,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB,CAAC;CAAG;AAEL,MAAM,MAAM,mBAAmB,GAC3B,2BAA2B,GAC3B,YAAY,GACZ,iBAAiB,GACjB,WAAW,GACX,qBAAqB,CAAC;AAC1B,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;AAE3E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;CAC/D;;AAED,qBAAa,oBAAqB,SAAQ,yBAGT;CAAG;AAEpC,yBAAiB,oBAAoB,CAAC;IAC7B,MAAM,IAAI,GACf,SAAS,2BAA2B,KACnC,2BAA+D,CAAC;CACpE;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,eAAO,MAAM,wBAAwB,GACnC,cAAc,gCAAgC,KAC7C,2BA4DF,CAAC;AAEF,eAAO,MAAM,wBAAwB,4GAgBpC,CAAC;AAEF,eAAO,MAAM,mBAAmB,4HAGsB,CAAC"}

package/dist/Password.js

@@ -0,0 +1,252 @@
+import { Context, Data, Effect, Encoding, Layer, Option, Redacted, Result, } from "effect";
+import { AuthPasswordHasherConfig } from "./AuthConfig.js";
+import { AuthFlow, AuthResult } from "./AuthFlow.js";
+import { Crypto } from "./Crypto.js";
+import { CredentialId, UserId } from "./Identifiers.js";
+import { currentUnixMillis, timingSafeEqualString } from "./Internal.js";
+import { CredentialStore, UserStore } from "./Storage.js";
+export class PasswordHashError extends Data.TaggedError("PasswordHashError") {
+}
+export class PasswordHasher extends Context.Service()("auth/PasswordHasher") {
+}
+(function (PasswordHasher) {
+    PasswordHasher.make = (service) => PasswordHasher.of(service);
+})(PasswordHasher || (PasswordHasher = {}));
+const textEncoder = new TextEncoder();
+const passwordHashPrefix = "pbkdf2-sha256";
+const getWebCrypto = (options, operation) => Effect.gen(function* () {
+    const crypto = options.webCrypto ?? globalThis.crypto;
+    if (crypto === undefined) {
+        return yield* new PasswordHashError({
+            operation,
+            message: "Web Crypto is not available",
+        });
+    }
+    return crypto;
+});
+const decodeBase64Url = (value, operation) => Result.match(Encoding.decodeBase64Url(value), {
+    onSuccess: Effect.succeed,
+    onFailure: (cause) => Effect.fail(new PasswordHashError({
+        operation,
+        message: "Invalid password hash encoding",
+        cause,
+    })),
+});
+const parsePasswordHash = (hash) => {
+    const [prefix, iterations, salt, derivedKey] = hash.split("$");
+    if (prefix !== passwordHashPrefix ||
+        iterations === undefined ||
+        salt === undefined ||
+        derivedKey === undefined) {
+        return undefined;
+    }
+    const parsedIterations = Number(iterations);
+    if (!Number.isInteger(parsedIterations) || parsedIterations <= 0) {
+        return undefined;
+    }
+    return {
+        iterations: parsedIterations,
+        salt,
+        derivedKey,
+    };
+};
+const derivePbkdf2Sha256 = (input) => Effect.tryPromise({
+    try: async () => {
+        const key = await input.webCrypto.subtle.importKey("raw", textEncoder.encode(Redacted.value(input.password)), "PBKDF2", false, ["deriveBits"]);
+        const bits = await input.webCrypto.subtle.deriveBits({
+            name: "PBKDF2",
+            hash: "SHA-256",
+            salt: input.salt,
+            iterations: input.iterations,
+        }, key, input.hashBytes * 8);
+        return new Uint8Array(bits);
+    },
+    catch: (cause) => new PasswordHashError({
+        operation: input.operation,
+        message: "Failed to derive PBKDF2 password hash",
+        cause,
+    }),
+});
+export const makePbkdf2PasswordHasher = (dependencies) => {
+    const iterations = dependencies.iterations ?? 210_000;
+    const saltBytes = dependencies.saltBytes ?? 16;
+    const hashBytes = dependencies.hashBytes ?? 32;
+    return PasswordHasher.make({
+        hash: Effect.fn("auth.password_hash.pbkdf2.hash")(function* (input) {
+            const webCrypto = yield* getWebCrypto(dependencies, "hash");
+            const salt = yield* dependencies.crypto.randomBytes(saltBytes).pipe(Effect.mapError((cause) => new PasswordHashError({
+                operation: "hash",
+                message: "Failed to generate password salt",
+                cause,
+            })));
+            const derivedKey = yield* derivePbkdf2Sha256({
+                webCrypto,
+                password: input.password,
+                salt,
+                iterations,
+                hashBytes,
+                operation: "hash",
+            });
+            return [
+                passwordHashPrefix,
+                String(iterations),
+                Encoding.encodeBase64Url(salt),
+                Encoding.encodeBase64Url(derivedKey),
+            ].join("$");
+        }),
+        verify: Effect.fn("auth.password_hash.pbkdf2.verify")(function* (input) {
+            const parsed = parsePasswordHash(input.hash);
+            if (parsed === undefined) {
+                return yield* new PasswordHashError({
+                    operation: "verify",
+                    message: "Invalid password hash format",
+                });
+            }
+            const webCrypto = yield* getWebCrypto(dependencies, "verify");
+            const salt = yield* decodeBase64Url(parsed.salt, "verify");
+            const expected = yield* decodeBase64Url(parsed.derivedKey, "verify");
+            const derivedKey = yield* derivePbkdf2Sha256({
+                webCrypto,
+                password: input.password,
+                salt,
+                iterations: parsed.iterations,
+                hashBytes: expected.byteLength,
+                operation: "verify",
+            });
+            return yield* timingSafeEqualString(dependencies.crypto, Encoding.encodeBase64Url(derivedKey), parsed.derivedKey).pipe(Effect.mapError((cause) => new PasswordHashError({
+                operation: "verify",
+                message: "Failed to compare password hash",
+                cause,
+            })));
+        }),
+    });
+};
+export const Pbkdf2PasswordHasherLive = (options) => Layer.effect(PasswordHasher)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const resolvedOptions = options ?? (yield* AuthPasswordHasherConfig);
+    return makePbkdf2PasswordHasher({
+        ...resolvedOptions,
+        crypto,
+    });
+}));
+export class PasswordLogin extends Context.Service()("auth/login/Password") {
+}
+(function (PasswordLogin) {
+    PasswordLogin.make = (service) => PasswordLogin.of(service);
+})(PasswordLogin || (PasswordLogin = {}));
+export const makePasswordLogin = (dependencies) => PasswordLogin.make({
+    signIn: Effect.fn("auth.password.sign_in")(function* (input) {
+        yield* Effect.annotateCurrentSpan("auth.method", "password");
+        const user = yield* dependencies.users.findByEmail(input.email);
+        if (Option.isNone(user)) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        if (user.value.disabledAt !== undefined) {
+            yield* Effect.annotateCurrentSpan("auth.result", "AccountDisabled");
+            return AuthResult.AccountDisabled();
+        }
+        const credential = yield* dependencies.credentials.findPasswordByUserId(user.value.id);
+        if (Option.isNone(credential) ||
+            credential.value.revokedAt !== undefined) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        const verified = yield* dependencies.hasher.verify({
+            hash: credential.value.passwordHash,
+            password: input.password,
+        });
+        if (!verified) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        return yield* dependencies.authFlow.completePrimaryFactor({
+            userId: user.value.id,
+            email: user.value.email,
+            method: "password",
+            amr: ["pwd"],
+            aal: "aal1",
+            claims: { emailVerified: user.value.emailVerified },
+        });
+    }),
+});
+export const PasswordLoginLive = Layer.effect(PasswordLogin)(Effect.gen(function* () {
+    const users = yield* UserStore;
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    const authFlow = yield* AuthFlow;
+    return makePasswordLogin({
+        users,
+        credentials,
+        hasher,
+        authFlow,
+    });
+}));
+export class EmailAlreadyRegisteredError extends Data.TaggedError("EmailAlreadyRegisteredError") {
+}
+export class PasswordRegistration extends Context.Service()("auth/registration/Password") {
+}
+(function (PasswordRegistration) {
+    PasswordRegistration.make = (service) => PasswordRegistration.of(service);
+})(PasswordRegistration || (PasswordRegistration = {}));
+export const makePasswordRegistration = (dependencies) => {
+    const userIdBytes = dependencies.userIdBytes ?? 16;
+    const credentialIdBytes = dependencies.credentialIdBytes ?? 16;
+    return PasswordRegistration.make({
+        signUp: Effect.fn("auth.password.sign_up")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.method", "password");
+            const existing = yield* dependencies.users.findByEmail(input.email);
+            if (Option.isSome(existing)) {
+                yield* Effect.annotateCurrentSpan("auth.result", "EmailAlreadyRegistered");
+                return yield* new EmailAlreadyRegisteredError({ email: input.email });
+            }
+            const now = yield* currentUnixMillis;
+            const emailVerified = input.emailVerified ?? false;
+            const userId = UserId(yield* dependencies.crypto.randomToken(userIdBytes));
+            const credentialId = CredentialId(yield* dependencies.crypto.randomToken(credentialIdBytes));
+            const passwordHash = yield* dependencies.hasher.hash({
+                password: input.password,
+            });
+            yield* dependencies.users.insert({
+                id: userId,
+                email: input.email,
+                emailVerified,
+                createdAt: now,
+                updatedAt: now,
+                metadata: input.metadata,
+            });
+            yield* dependencies.credentials.insertPassword({
+                id: credentialId,
+                userId,
+                passwordHash,
+                createdAt: now,
+                updatedAt: now,
+            });
+            yield* Effect.annotateCurrentSpan("auth.result", "registered");
+            return yield* dependencies.authFlow.completePrimaryFactor({
+                userId,
+                email: input.email,
+                method: "password",
+                amr: ["pwd"],
+                aal: "aal1",
+                claims: { emailVerified },
+            });
+        }),
+    });
+};
+export const PasswordRegistrationLive = Layer.effect(PasswordRegistration)(Effect.gen(function* () {
+    const users = yield* UserStore;
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    const authFlow = yield* AuthFlow;
+    const crypto = yield* Crypto;
+    return makePasswordRegistration({
+        users,
+        credentials,
+        hasher,
+        authFlow,
+        crypto,
+    });
+}));
+export const PasswordFeatureLive = Layer.mergeAll(PasswordLoginLive, PasswordRegistrationLive).pipe(Layer.provideMerge(Pbkdf2PasswordHasherLive()));
+//# sourceMappingURL=Password.js.map

package/dist/Password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Password.js","sourceRoot":"","sources":["../src/Password.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,EACR,MAAM,GACP,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAOrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAqB1D,MAAM,OAAO,iBAAkB,SAAQ,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAIzE;CAAG;AAoBL,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAGhD,CAAC,qBAAqB,CAAC;CAAG;AAE7B,WAAiB,cAAc;IAChB,mBAAI,GAAG,CAAC,OAA8B,EAAyB,EAAE,CAC5E,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC,EAHgB,cAAc,KAAd,cAAc,QAG9B;AAaD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,MAAM,kBAAkB,GAAG,eAAwB,CAAC;AAEpD,MAAM,YAAY,GAAG,CACnB,OAAoC,EACpC,SAAgC,EAC4B,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC;IAEtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAClC,SAAS;YACT,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,eAAe,GAAG,CACtB,KAAa,EACb,SAAgC,EACc,EAAE,CAChD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC,OAAO;IACzB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,MAAM,CAAC,IAAI,CACT,IAAI,iBAAiB,CAAC;QACpB,SAAS;QACT,OAAO,EAAE,gCAAgC;QACzC,KAAK;KACN,CAAC,CACH;CACJ,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CACxB,IAAY,EAOA,EAAE;IACd,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/D,IACE,MAAM,KAAK,kBAAkB;QAC7B,UAAU,KAAK,SAAS;QACxB,IAAI,KAAK,SAAS;QAClB,UAAU,KAAK,SAAS,EACxB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAE5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,gBAAgB;QAC5B,IAAI;QACJ,UAAU;KACX,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAO3B,EAAgD,EAAE,CACjD,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAChD,KAAK,EACL,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAClD,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAClD;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,EACD,GAAG,EACH,KAAK,CAAC,SAAS,GAAG,CAAC,CACpB,CAAC;QAEF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,iBAAiB,CAAC;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,uCAAuC;QAChD,KAAK;KACN,CAAC;CACL,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,YAA8C,EACvB,EAAE;IACzB,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,OAAO,CAAC;IACtD,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;IAE/C,OAAO,cAAc,CAAC,IAAI,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,EACzD,KAAwB;YAExB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,iBAAiB,CAAC;gBACpB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,kCAAkC;gBAC3C,KAAK;aACN,CAAC,CACL,CACF,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBAC3C,SAAS;gBACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI;gBACJ,UAAU;gBACV,SAAS;gBACT,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO;gBACL,kBAAkB;gBAClB,MAAM,CAAC,UAAU,CAAC;gBAClB,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC;gBAC9B,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC;aACrC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EAC7D,KAA0B;YAE1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;oBAClC,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,8BAA8B;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;gBAC3C,SAAS;gBACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI;gBACJ,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,CAAC,qBAAqB,CACjC,YAAY,CAAC,MAAM,EACnB,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,EACpC,MAAM,CAAC,UAAU,CAClB,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,iBAAiB,CAAC;gBACpB,SAAS,EAAE,QAAQ;gBACnB,OAAO,EAAE,iCAAiC;gBAC1C,KAAK;aACN,CAAC,CACL,CACF,CAAC;QACJ,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,OAAqC,EACrC,EAAE,CACF,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAErE,OAAO,wBAAwB,CAAC;QAC9B,GAAG,eAAe;QAClB,MAAM;KACP,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAgBJ,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAG/C,CAAC,qBAAqB,CAAC;CAAG;AAE7B,WAAiB,aAAa;IACf,kBAAI,GAAG,CAAC,OAA6B,EAAwB,EAAE,CAC1E,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,EAHgB,aAAa,KAAb,aAAa,QAG7B;AASD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,YAAuC,EACjB,EAAE,CACxB,aAAa,CAAC,IAAI,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAClD,KAA0B;QAE1B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAE7D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;YACvE,OAAO,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YACpE,OAAO,UAAU,CAAC,eAAe,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,oBAAoB,CACrE,IAAI,CAAC,KAAK,CAAC,EAAE,CACd,CAAC;QAEF,IACE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACzB,UAAU,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EACxC,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;YACvE,OAAO,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;YACjD,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;YACvE,OAAO,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACxD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU;YAClB,GAAG,EAAE,CAAC,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE;SACpD,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IAEjC,OAAO,iBAAiB,CAAC;QACvB,KAAK;QACL,WAAW;QACX,MAAM;QACN,QAAQ;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,OAAO,2BAA4B,SAAQ,IAAI,CAAC,WAAW,CAC/D,6BAA6B,CAG7B;CAAG;AAgBL,MAAM,OAAO,oBAAqB,SAAQ,OAAO,CAAC,OAAO,EAGtD,CAAC,4BAA4B,CAAC;CAAG;AAEpC,WAAiB,oBAAoB;IACtB,yBAAI,GAAG,CAClB,OAAoC,EACP,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC,EAJgB,oBAAoB,KAApB,oBAAoB,QAIpC;AAYD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,YAA8C,EACjB,EAAE;IAC/B,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC;IACnD,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAE/D,OAAO,oBAAoB,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAClD,KAA0B;YAE1B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAE7D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEpE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAC/B,aAAa,EACb,wBAAwB,CACzB,CAAC;gBACF,OAAO,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;YACrC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CACnB,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CACpD,CAAC;YACF,MAAM,YAAY,GAAG,YAAY,CAC/B,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAC1D,CAAC;YACF,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBACnD,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC/B,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa;gBACb,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC;gBAC7C,EAAE,EAAE,YAAY;gBAChB,MAAM;gBACN,YAAY;gBACZ,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAE/D,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACxD,MAAM;gBACN,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,CAAC,KAAK,CAAC;gBACZ,GAAG,EAAE,MAAM;gBACX,MAAM,EAAE,EAAE,aAAa,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAE7B,OAAO,wBAAwB,CAAC;QAC9B,KAAK;QACL,WAAW;QACX,MAAM;QACN,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAC/C,iBAAiB,EACjB,wBAAwB,CACzB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC"}

package/dist/Policy.d.ts

@@ -1,7 +1,8 @@
 import { Effect } from "effect";
 import type { PolicyId } from "./Identifiers.js";
-import type { CurrentActor } from "./Sessions.js";
-export type AuthzDenyReason = "missing-permission" | "missing-role" | "missing-relation" | "missing-grant" | "not-owner" | "not-authenticated" | (string & {});
+import { CurrentSession } from "./Sessions.js";
+import type { CurrentActor, SessionRequirement } from "./Sessions.js";
+export type AuthzDenyReason = "missing-permission" | "missing-role" | "missing-relation" | "missing-grant" | "not-owner" | "not-authenticated" | "session-requirement-unsatisfied" | "email-verification-required" | (string & {});
 declare const AuthzError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "AuthzError";
 } & Readonly<A>;
@@ -29,11 +30,13 @@ type EffectContext<T> = T extends Effect.Effect<unknown, unknown, infer R> ? R :
 export declare const isAuthzError: (error: unknown) => error is AuthzError;
 export declare const allow: Policy;
 export declare const deny: (reason: AuthzDenyReason, policyId?: PolicyId) => Policy<never>;
-export declare const all: <const Policies extends ReadonlyArray<Effect.Effect<unknown, unknown, unknown>>>(...policies: Policies) => Effect.Effect<void, EffectError<Policies[number]>, EffectContext<Policies[number]>>;
-export declare const any: <const Policies extends ReadonlyArray<Effect.Effect<unknown, unknown, unknown>>>(...policies: Policies) => Effect.Effect<void, AuthzError | NonAuthzError<EffectError<Policies[number]>>, EffectContext<Policies[number]>>;
+export declare const all: <const Policies extends readonly Effect.Effect<unknown, unknown, unknown>[]>(...policies: Policies) => Effect.Effect<void, EffectError<Policies[number]>, EffectContext<Policies[number]>>;
+export declare const any: <const Policies extends readonly Effect.Effect<unknown, unknown, unknown>[]>(...policies: Policies) => Effect.Effect<void, AuthzError | NonAuthzError<EffectError<Policies[number]>>, EffectContext<Policies[number]>>;
 export declare const not: <A, E, R>(policy: Effect.Effect<A, E, R>, reason?: AuthzDenyReason) => Effect.Effect<void, AuthzError | NonAuthzError<E>, R>;
 export declare const check: <A, E, R>(policy: Effect.Effect<A, E, R>) => Effect.Effect<PolicyDecision, NonAuthzError<E>, R>;
 export declare const checkDetailed: <A, E, R>(policy: Effect.Effect<A, E, R>) => Effect.Effect<PolicyCheckResult<NonAuthzError<E>>, never, R>;
+export declare const requireNoSessionRequirement: (requirement: SessionRequirement, policyId?: PolicyId) => Effect.Effect<void, AuthzError, CurrentSession>;
+export declare const requireEmailVerified: (policyId?: PolicyId) => Effect.Effect<void, AuthzError, CurrentSession>;
 export declare const require: <A, E, R>(policy: Effect.Effect<A, E, R>) => <B, E2, R2>(effect: Effect.Effect<B, E2, R2>) => Effect.Effect<B, E | E2, R | R2>;
 export {};
 //# sourceMappingURL=Policy.d.ts.map

package/dist/Policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Policy.d.ts","sourceRoot":"","sources":["../src/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAErC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,mBAAmB,GACnB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;;;;AAEjB,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAA;AAEvG,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAA;AAE3D,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,KAAK,IACnC,cAAc,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAA;AAElD,KAAK,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;AAC9C,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;AACpF,KAAK,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;AAEtF,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,UAQtD,CAAA;AAED,eAAO,MAAM,KAAK,EAAE,MAAoB,CAAA;AAExC,eAAO,MAAM,IAAI,GAAI,QAAQ,eAAe,EAAE,WAAW,QAAQ,KAAG,MAAM,CAAC,KAAK,CAC7B,CAAA;AAEnD,eAAO,MAAM,GAAG,GAAI,KAAK,CAAC,QAAQ,SAAS,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAChG,GAAG,UAAU,QAAQ,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAKM,CAAA;AAE3F,eAAO,MAAM,GAAG,GAAI,KAAK,CAAC,QAAQ,SAAS,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAChG,GAAG,UAAU,QAAQ,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CA4BhH,CAAA;AAED,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACzB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAQ,eAAwC,KAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAMpD,CAAA;AAEH,eAAO,MAAM,KAAK,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAS9G,CAAA;AAEH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACnC,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAS3D,CAAA;AAEH,eAAO,MAAM,OAAO,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAC5D,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CACxC,CAAA"}
+{"version":3,"file":"Policy.d.ts","sourceRoot":"","sources":["../src/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,mBAAmB,GACnB,iCAAiC,GACjC,6BAA6B,GAC7B,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;;;;AAElB,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,CAChE,CAAC,EACD,UAAU,GAAG,CAAC,EACd,YAAY,GAAG,CAAC,CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,KAAK,IACnC,cAAc,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAEnD,KAAK,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/C,KAAK,WAAW,CAAC,CAAC,IAChB,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AACjE,KAAK,aAAa,CAAC,CAAC,IAClB,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAEjE,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,UAQtD,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,MAAoB,CAAC;AAEzC,eAAO,MAAM,IAAI,GACf,QAAQ,eAAe,EACvB,WAAW,QAAQ,KAClB,MAAM,CAAC,KAAK,CAAsD,CAAC;AAEtE,eAAO,MAAM,GAAG,GACd,KAAK,CAAC,QAAQ,SAAS,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAE1E,GAAG,UAAU,QAAQ,KACpB,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAC7B,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAU9B,CAAC;AAEJ,eAAO,MAAM,GAAG,GACd,KAAK,CAAC,QAAQ,SAAS,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAE1E,GAAG,UAAU,QAAQ,KACpB,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EACzD,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAoChC,CAAC;AAEF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACzB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAQ,eAAwC,KAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CASpD,CAAC;AAEJ,eAAO,MAAM,KAAK,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAC3B,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CASjD,CAAC;AAEJ,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACnC,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAS3D,CAAC;AAEJ,eAAO,MAAM,2BAA2B,GACtC,aAAa,kBAAkB,EAC/B,WAAW,QAAQ,KAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,CAU7C,CAAC;AAEL,eAAO,MAAM,oBAAoB,GAC/B,WAAW,QAAQ,KAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,CAc7C,CAAC;AAEL,eAAO,MAAM,OAAO,GACjB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MACvC,CAAC,EAAE,EAAE,EAAE,EAAE,EACR,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,KAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CACI,CAAC"}

package/dist/Policy.js

@@ -1,4 +1,5 @@
 import { Data, Effect } from "effect";
+import { CurrentSession } from "./Sessions.js";
 export class AuthzError extends Data.TaggedError("AuthzError") {
 }
 export const isAuthzError = (error) => {
@@ -25,26 +26,48 @@ export const any = (...policies) => {
             onSuccess: () => Effect.void,
             onFailure: (error) => isAuthzError(error)
                 ? loop(index + 1, error)
-                : Effect.fail(error)
+                : Effect.fail(error),
         }));
     };
     return loop(0, undefined);
 };
 export const not = (policy, reason = "policy-not-satisfied") => policy.pipe(Effect.matchEffect({
     onSuccess: () => Effect.fail(new AuthzError({ reason })),
-    onFailure: (error) => (isAuthzError(error) ? Effect.void : Effect.fail(error))
+    onFailure: (error) => isAuthzError(error)
+        ? Effect.void
+        : Effect.fail(error),
 }));
 export const check = (policy) => policy.pipe(Effect.matchEffect({
     onSuccess: () => Effect.succeed({ type: "allowed" }),
     onFailure: (error) => isAuthzError(error)
         ? Effect.succeed({ type: "denied", error })
-        : Effect.fail(error)
+        : Effect.fail(error),
 }));
 export const checkDetailed = (policy) => policy.pipe(Effect.match({
     onSuccess: () => ({ type: "allowed" }),
     onFailure: (error) => isAuthzError(error)
-        ? ({ type: "denied", error })
-        : ({ type: "failed", error: error })
+        ? { type: "denied", error }
+        : { type: "failed", error: error },
 }));
+export const requireNoSessionRequirement = (requirement, policyId) => Effect.gen(function* () {
+    const session = yield* CurrentSession;
+    if (session.claims?.requirements?.includes(requirement) === true) {
+        return yield* new AuthzError({
+            reason: "session-requirement-unsatisfied",
+            policyId,
+        });
+    }
+});
+export const requireEmailVerified = (policyId) => Effect.gen(function* () {
+    const session = yield* CurrentSession;
+    const { claims } = session;
+    if (claims?.emailVerified !== true ||
+        claims.requirements?.includes("email_verification") === true) {
+        return yield* new AuthzError({
+            reason: "email-verification-required",
+            policyId,
+        });
+    }
+});
 export const require = (policy) => (effect) => Effect.flatMap(policy, () => effect);
 //# sourceMappingURL=Policy.js.map

package/dist/Policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"Policy.js","sourceRoot":"","sources":["../src/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAcrC,MAAM,OAAO,UAAW,SAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAK3D;CAAG;AAgBL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAA;IAE/C,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAA;AAC1E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAW,MAAM,CAAC,IAAI,CAAA;AAExC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAuB,EAAE,QAAmB,EAAiB,EAAE,CAClF,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;AAEnD,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAG,QAAkB,EACgE,EAAE,CACvF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,CAAC,MAAM,CAAA;IACf,CAAC;AACH,CAAC,CAAwF,CAAA;AAE3F,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAG,QAAkB,EAC4F,EAAE;IACnH,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,QAAgC,EAI3D,EAAE;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAA;QACpF,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAChB,MAAM,CAAC,WAAW,CAAC;YACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;YAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC;gBACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAqD,CAAC;SACzE,CAAC,CAKH,CAAA;IACH,CAAC,CAAA;IAED,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,MAA8B,EAC9B,SAA0B,sBAAsB,EACO,EAAE,CACzD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,WAAW,CAAC;IACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAyB,CAAC,CAAC;CACnG,CAAC,CACH,CAAA;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAU,MAA8B,EAAsD,EAAE,CACnH,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,WAAW,CAAC;IACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;IAC7D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAW,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAyB,CAAC;CAC7C,CAAC,CACH,CAAA;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAA8B,EACgC,EAAE,CAChE,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC;IACX,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAU;IAC/C,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAU;QACtC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAyB,EAAE,CAAU;CACtE,CAAC,CACH,CAAA;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAU,MAA8B,EAAE,EAAE,CACjE,CAAY,MAAgC,EAAoC,EAAE,CAChF,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"Policy.js","sourceRoot":"","sources":["../src/Policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAc/C,MAAM,OAAO,UAAW,SAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAK3D;CAAG;AAsBL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAEhD,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAW,MAAM,CAAC,IAAI,CAAC;AAEzC,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAuB,EACvB,QAAmB,EACJ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,GAAG,GAAG,CAGjB,GAAG,QAAkB,EAKrB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;AACH,CAAC,CAIA,CAAC;AAEJ,MAAM,CAAC,MAAM,GAAG,GAAG,CAGjB,GAAG,QAAkB,EAKrB,EAAE;IACF,MAAM,IAAI,GAAG,CACX,KAAa,EACb,QAAgC,EAKhC,EAAE;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,IAAI,CAChB,QAAQ,IAAI,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAC/D,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAChB,MAAM,CAAC,WAAW,CAAC;YACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;YAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC;gBACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,KAAqD,CACtD;SACR,CAAC,CAKH,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,MAA8B,EAC9B,SAA0B,sBAAsB,EACO,EAAE,CACzD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,WAAW,CAAC;IACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAyB,CAAC;CAC7C,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAA8B,EACsB,EAAE,CACtD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,WAAW,CAAC;IACjB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;IAC7D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAW,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAyB,CAAC;CAC7C,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAA8B,EACgC,EAAE,CAChE,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC;IACX,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAU;IAC/C,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,YAAY,CAAC,KAAK,CAAC;QACjB,CAAC,CAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAY;QACtC,CAAC,CAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAyB,EAAY;CACtE,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,WAA+B,EAC/B,QAAmB,EAC8B,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IAEtC,IAAI,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC;YAC3B,MAAM,EAAE,iCAAiC;YACzC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAmB,EAC8B,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,IACE,MAAM,EAAE,aAAa,KAAK,IAAI;QAC9B,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,IAAI,EAC5D,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC;YAC3B,MAAM,EAAE,6BAA6B;YACrC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,OAAO,GAClB,CAAU,MAA8B,EAAE,EAAE,CAC5C,CACE,MAAgC,EACE,EAAE,CACpC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC"}

package/dist/Privacy.d.ts

@@ -1,4 +1,7 @@
 import { Context, Effect, Layer } from "effect";
+import { AuthSecrets } from "./AuthConfig.js";
+import { Crypto } from "./Crypto.js";
+import type { CryptoKey, CryptoService } from "./Crypto.js";
 import { EmailHash, IpHash, UserAgentHash } from "./Identifiers.js";
 import type { Email, IpAddress } from "./Identifiers.js";
 export type PrivacyOperation = "email-hash" | "ip-hash" | "user-agent-hash";
@@ -22,6 +25,18 @@ export declare class Privacy extends Privacy_base {
 export declare namespace Privacy {
     const make: (service: PrivacyService) => PrivacyService;
 }
+export interface PrivacyOptions {
+    readonly secret: CryptoKey;
+    readonly normalizeEmail?: (email: Email) => string;
+    readonly normalizeIp?: (ip: IpAddress) => string;
+    readonly normalizeUserAgent?: (userAgent: string) => string;
+}
+export interface PrivacyDependencies extends PrivacyOptions {
+    readonly crypto: CryptoService;
+}
+export declare const makeHmacPrivacy: (dependencies: PrivacyDependencies) => PrivacyService;
+export declare function PrivacyLive(options: PrivacyOptions): Layer.Layer<Privacy, never, Crypto>;
+export declare function PrivacyLive(): Layer.Layer<Privacy, never, Crypto | AuthSecrets>;
 export declare const PrivacyTestLive: Layer.Layer<Privacy, never, never>;
 export {};
 //# sourceMappingURL=Privacy.d.ts.map

package/dist/Privacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Privacy.d.ts","sourceRoot":"","sources":["../src/Privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAExD,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,SAAS,GAAG,iBAAiB,CAAA;;;;AAE3E,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAC5E,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;CAC1F;;AAED,qBAAa,OAAQ,SAAQ,YAA0D;CAAG;AAE1F,yBAAiB,OAAO,CAAC;IAChB,MAAM,IAAI,GAAI,SAAS,cAAc,KAAG,cAAqC,CAAA;CACrF;AAED,eAAO,MAAM,eAAe,oCAIzB,CAAA"}
+{"version":3,"file":"Privacy.d.ts","sourceRoot":"","sources":["../src/Privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EAAqB,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,SAAS,GAAG,iBAAiB,CAAC;;;;AAE5E,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7E,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,CACtB,SAAS,EAAE,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;CACjD;;AAED,qBAAa,OAAQ,SAAQ,YAE5B;CAAG;AAEJ,yBAAiB,OAAO,CAAC;IAChB,MAAM,IAAI,GAAI,SAAS,cAAc,KAAG,cAC1B,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAmDD,eAAO,MAAM,eAAe,GAC1B,cAAc,mBAAmB,KAChC,cA6CF,CAAC;AAEF,wBAAgB,WAAW,CACzB,OAAO,EAAE,cAAc,GACtB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACvC,wBAAgB,WAAW,IAAI,KAAK,CAAC,KAAK,CACxC,OAAO,EACP,KAAK,EACL,MAAM,GAAG,WAAW,CACrB,CAAC;AAoBF,eAAO,MAAM,eAAe,oCAO3B,CAAC"}

package/dist/Privacy.js

@@ -1,4 +1,6 @@
 import { Context, Data, Effect, Layer } from "effect";
+import { AuthPrivacyConfig, AuthSecrets } from "./AuthConfig.js";
+import { Crypto } from "./Crypto.js";
 import { EmailHash, IpHash, UserAgentHash } from "./Identifiers.js";
 export class PrivacyError extends Data.TaggedError("PrivacyError") {
 }
@@ -7,9 +9,64 @@ export class Privacy extends Context.Service()("auth/Privacy") {
 (function (Privacy) {
     Privacy.make = (service) => Privacy.of(service);
 })(Privacy || (Privacy = {}));
+const hmacNamespace = "auth.privacy.v1";
+const normalizeEmail = (email) => String(email).trim().toLowerCase();
+const normalizeIp = (ip) => String(ip).trim();
+const normalizeUserAgent = (userAgent) => userAgent.trim().replaceAll(/\s+/g, " ");
+const normalizeInput = (operation, normalize, input) => Effect.try({
+    try: () => normalize(input),
+    catch: (cause) => new PrivacyError({
+        operation,
+        message: "Failed to normalize privacy input",
+        cause,
+    }),
+});
+const hmacHash = (dependencies, operation, kind, normalized, brand) => dependencies.crypto
+    .hmacSha256({
+    key: dependencies.secret,
+    data: `${hmacNamespace}.${kind}:${normalized}`,
+})
+    .pipe(Effect.map(brand), Effect.mapError((cause) => new PrivacyError({
+    operation,
+    message: "Failed to hash privacy input",
+    cause,
+})));
+export const makeHmacPrivacy = (dependencies) => {
+    const emailNormalizer = dependencies.normalizeEmail ?? normalizeEmail;
+    const ipNormalizer = dependencies.normalizeIp ?? normalizeIp;
+    const userAgentNormalizer = dependencies.normalizeUserAgent ?? normalizeUserAgent;
+    return Privacy.make({
+        emailHash: Effect.fn("auth.privacy.email_hash")(function* (email) {
+            const normalized = yield* normalizeInput("email-hash", emailNormalizer, email);
+            return yield* hmacHash(dependencies, "email-hash", "email", normalized, EmailHash);
+        }),
+        ipHash: Effect.fn("auth.privacy.ip_hash")(function* (ip) {
+            const normalized = yield* normalizeInput("ip-hash", ipNormalizer, ip);
+            return yield* hmacHash(dependencies, "ip-hash", "ip", normalized, IpHash);
+        }),
+        userAgentHash: Effect.fn("auth.privacy.user_agent_hash")(function* (userAgent) {
+            const normalized = yield* normalizeInput("user-agent-hash", userAgentNormalizer, userAgent);
+            return yield* hmacHash(dependencies, "user-agent-hash", "user-agent", normalized, UserAgentHash);
+        }),
+    });
+};
+export function PrivacyLive(options) {
+    return Layer.effect(Privacy)(Effect.gen(function* () {
+        const crypto = yield* Crypto;
+        const resolvedOptions = options ??
+            {
+                ...(yield* AuthPrivacyConfig),
+                secret: (yield* AuthSecrets).privacy,
+            };
+        return makeHmacPrivacy({
+            ...resolvedOptions,
+            crypto,
+        });
+    }));
+}
 export const PrivacyTestLive = Layer.succeed(Privacy)(Privacy.make({
     emailHash: (email) => Effect.succeed(EmailHash(`test:email:${email}`)),
     ipHash: (ip) => Effect.succeed(IpHash(`test:ip:${ip}`)),
-    userAgentHash: (userAgent) => Effect.succeed(UserAgentHash(`test:user-agent:${userAgent}`))
+    userAgentHash: (userAgent) => Effect.succeed(UserAgentHash(`test:user-agent:${userAgent}`)),
 }));
 //# sourceMappingURL=Privacy.js.map