@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/AuditLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuditLog.d.ts","sourceRoot":"","sources":["../src/AuditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;;;;AAE/H,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAEtF,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;CACvC;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC,CAAA;AAEL,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;CAC7E;;AAED,qBAAa,QAAS,SAAQ,aAA6D;CAAG;AAE9F,yBAAiB,QAAQ,CAAC;IACjB,MAAM,IAAI,GAAI,SAAS,eAAe,KAAG,eAAuC,CAAA;CACxF;AAED,eAAO,MAAM,gBAAgB,qCAE1B,CAAA"}
+{"version":3,"file":"AuditLog.d.ts","sourceRoot":"","sources":["../src/AuditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,MAAM,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,MAAM,EACP,MAAM,kBAAkB,CAAC;;;;AAE1B,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC,CAAC;AAEN,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;CAC9E;;AAED,qBAAa,QAAS,SAAQ,aAE7B;CAAG;AAEJ,yBAAiB,QAAQ,CAAC;IACjB,MAAM,IAAI,GAAI,SAAS,eAAe,KAAG,eAC1B,CAAC;CACxB;AAED,eAAO,MAAM,gBAAgB,qCAI5B,CAAC"}

package/dist/AuditLog.js

@@ -7,6 +7,6 @@ export class AuditLog extends Context.Service()("auth/AuditLog") {
     AuditLog.make = (service) => AuditLog.of(service);
 })(AuditLog || (AuditLog = {}));
 export const AuditLogNoopLive = Layer.succeed(AuditLog)(AuditLog.make({
-    emit: () => Effect.void
+    emit: () => Effect.void,
 }));
 //# sourceMappingURL=AuditLog.js.map

package/dist/AuditLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuditLog.js","sourceRoot":"","sources":["../src/AuditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAIrD,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAGjE;CAAG;AAyDL,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA6B,CAAC,eAAe,CAAC;CAAG;AAE9F,WAAiB,QAAQ;IACV,aAAI,GAAG,CAAC,OAAwB,EAAmB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;AACzF,CAAC,EAFgB,QAAQ,KAAR,QAAQ,QAExB;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IACpE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;CACxB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"AuditLog.js","sourceRoot":"","sources":["../src/AuditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAatD,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAGjE;CAAG;AA6DL,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAA6B,CACxE,eAAe,CAChB;CAAG;AAEJ,WAAiB,QAAQ;IACV,aAAI,GAAG,CAAC,OAAwB,EAAmB,EAAE,CAChE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,EAHgB,QAAQ,KAAR,QAAQ,QAGxB;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CACrD,QAAQ,CAAC,IAAI,CAAC;IACZ,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;CACxB,CAAC,CACH,CAAC"}

package/dist/AuthConfig.d.ts

@@ -0,0 +1,51 @@
+import { Context, Layer } from "effect";
+import type { EmailVerificationSessionPolicyOptions } from "./AuthFlow.js";
+import type { ChallengeOptions } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import type { CryptoError, CryptoKey } from "./Crypto.js";
+import type { EmailOtpOptions } from "./EmailOtp.js";
+import type { EmailVerificationOptions } from "./EmailVerification.js";
+import type { Pbkdf2PasswordHasherOptions } from "./Password.js";
+import type { PrivacyOptions } from "./Privacy.js";
+import type { SessionCookieOptions, SessionsOptions } from "./Sessions.js";
+export interface AuthSecretsShape {
+    readonly session: CryptoKey;
+    readonly challenge: CryptoKey;
+    readonly privacy: CryptoKey;
+}
+declare const AuthSecrets_base: Context.ServiceClass<AuthSecrets, "auth/AuthSecrets", AuthSecretsShape>;
+export declare class AuthSecrets extends AuthSecrets_base {
+}
+export declare namespace AuthSecrets {
+    const make: (secrets: AuthSecretsShape) => AuthSecretsShape;
+}
+export declare const AuthSecretsLive: (secrets: AuthSecretsShape) => Layer.Layer<AuthSecrets, never, never>;
+export interface AuthSecretsFromRootOptions {
+    readonly root: CryptoKey;
+    readonly namespace?: string;
+}
+export declare const AuthSecretsFromRootLive: (options: AuthSecretsFromRootOptions) => Layer.Layer<AuthSecrets, CryptoError, Crypto>;
+export type AuthSessionsConfig = Omit<SessionsOptions, "secret">;
+export type AuthChallengeConfig = Omit<ChallengeOptions, "secret">;
+export type AuthPrivacyConfig = Omit<PrivacyOptions, "secret">;
+export declare const AuthSessionsConfig: Context.Reference<AuthSessionsConfig>;
+export declare const AuthSessionCookieConfig: Context.Reference<SessionCookieOptions>;
+export declare const AuthChallengeConfig: Context.Reference<AuthChallengeConfig>;
+export declare const AuthPrivacyConfig: Context.Reference<AuthPrivacyConfig>;
+export declare const AuthPasswordHasherConfig: Context.Reference<Pbkdf2PasswordHasherOptions>;
+export declare const AuthEmailVerificationConfig: Context.Reference<EmailVerificationOptions>;
+export declare const AuthEmailOtpConfig: Context.Reference<EmailOtpOptions>;
+export declare const AuthEmailVerificationSessionPolicyConfig: Context.Reference<EmailVerificationSessionPolicyOptions>;
+export interface AuthDomainConfigOptions {
+    readonly sessions?: AuthSessionsConfig;
+    readonly sessionCookie?: SessionCookieOptions;
+    readonly challenge?: AuthChallengeConfig;
+    readonly privacy?: AuthPrivacyConfig;
+    readonly passwordHasher?: Pbkdf2PasswordHasherOptions;
+    readonly emailOtp?: EmailOtpOptions;
+    readonly emailVerification?: EmailVerificationOptions;
+    readonly emailVerificationSessionPolicy?: EmailVerificationSessionPolicyOptions;
+}
+export declare const AuthDomainConfigLive: (options?: AuthDomainConfigOptions) => Layer.Layer<never, never, never>;
+export {};
+//# sourceMappingURL=AuthConfig.d.ts.map

package/dist/AuthConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthConfig.d.ts","sourceRoot":"","sources":["../src/AuthConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,KAAK,EAAY,MAAM,QAAQ,CAAC;AAE1D,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;CAC7B;;AAED,qBAAa,WAAY,SAAQ,gBAGV;CAAG;AAE1B,yBAAiB,WAAW,CAAC;IACpB,MAAM,IAAI,GAAI,SAAS,gBAAgB,KAAG,gBACxB,CAAC;CAC3B;AAED,eAAO,MAAM,eAAe,GAAI,SAAS,gBAAgB,2CACF,CAAC;AAExD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAiBD,eAAO,MAAM,uBAAuB,GAClC,SAAS,0BAA0B,kDAapC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AACnE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;AAE/D,eAAO,MAAM,kBAAkB,uCAG9B,CAAC;AAEF,eAAO,MAAM,uBAAuB,yCAGnC,CAAC;AAEF,eAAO,MAAM,mBAAmB,wCAG/B,CAAC;AAEF,eAAO,MAAM,iBAAiB,sCAG7B,CAAC;AAEF,eAAO,MAAM,wBAAwB,gDAGjC,CAAC;AAEL,eAAO,MAAM,2BAA2B,6CAGpC,CAAC;AAEL,eAAO,MAAM,kBAAkB,oCAG9B,CAAC;AAEF,eAAO,MAAM,wCAAwC,0DAIlD,CAAC;AAEJ,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,2BAA2B,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,8BAA8B,CAAC,EAAE,qCAAqC,CAAC;CACjF;AAED,eAAO,MAAM,oBAAoB,GAAI,UAAS,uBAA4B,qCA4BvE,CAAC"}

package/dist/AuthConfig.js

@@ -0,0 +1,56 @@
+import { Context, Effect, Layer, Redacted } from "effect";
+import { Crypto } from "./Crypto.js";
+export class AuthSecrets extends Context.Service()("auth/AuthSecrets") {
+}
+(function (AuthSecrets) {
+    AuthSecrets.make = (secrets) => AuthSecrets.of(secrets);
+})(AuthSecrets || (AuthSecrets = {}));
+export const AuthSecretsLive = (secrets) => Layer.succeed(AuthSecrets)(AuthSecrets.make(secrets));
+const deriveSecret = (root, namespace, purpose) => Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const value = yield* crypto.hmacSha256({
+        key: root,
+        data: `${namespace}.${purpose}`,
+    });
+    return Redacted.make(value);
+});
+export const AuthSecretsFromRootLive = (options) => {
+    const namespace = options.namespace ?? "auth.secret.v1";
+    return Layer.effect(AuthSecrets)(Effect.gen(function* () {
+        return AuthSecrets.make({
+            session: yield* deriveSecret(options.root, namespace, "session"),
+            challenge: yield* deriveSecret(options.root, namespace, "challenge"),
+            privacy: yield* deriveSecret(options.root, namespace, "privacy"),
+        });
+    }));
+};
+export const AuthSessionsConfig = Context.Reference("auth/config/Sessions", { defaultValue: () => ({}) });
+export const AuthSessionCookieConfig = Context.Reference("auth/config/SessionCookie", { defaultValue: () => ({}) });
+export const AuthChallengeConfig = Context.Reference("auth/config/Challenge", { defaultValue: () => ({}) });
+export const AuthPrivacyConfig = Context.Reference("auth/config/Privacy", { defaultValue: () => ({}) });
+export const AuthPasswordHasherConfig = Context.Reference("auth/config/PasswordHasher", {
+    defaultValue: () => ({}),
+});
+export const AuthEmailVerificationConfig = Context.Reference("auth/config/EmailVerification", {
+    defaultValue: () => ({}),
+});
+export const AuthEmailOtpConfig = Context.Reference("auth/config/EmailOtp", { defaultValue: () => ({}) });
+export const AuthEmailVerificationSessionPolicyConfig = Context.Reference("auth/config/EmailVerificationSessionPolicy", { defaultValue: () => ({}) });
+export const AuthDomainConfigLive = (options = {}) => Layer.mergeAll(options.sessions === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthSessionsConfig)(options.sessions), options.sessionCookie === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthSessionCookieConfig)(options.sessionCookie), options.challenge === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthChallengeConfig)(options.challenge), options.privacy === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthPrivacyConfig)(options.privacy), options.passwordHasher === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthPasswordHasherConfig)(options.passwordHasher), options.emailOtp === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthEmailOtpConfig)(options.emailOtp), options.emailVerification === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthEmailVerificationConfig)(options.emailVerification), options.emailVerificationSessionPolicy === undefined
+    ? Layer.empty
+    : Layer.succeed(AuthEmailVerificationSessionPolicyConfig)(options.emailVerificationSessionPolicy));
+//# sourceMappingURL=AuthConfig.js.map

package/dist/AuthConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthConfig.js","sourceRoot":"","sources":["../src/AuthConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAI1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAcrC,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAG7C,CAAC,kBAAkB,CAAC;CAAG;AAE1B,WAAiB,WAAW;IACb,gBAAI,GAAG,CAAC,OAAyB,EAAoB,EAAE,CAClE,WAAW,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC,EAHgB,WAAW,KAAX,WAAW,QAG3B;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAE,EAAE,CAC3D,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAOxD,MAAM,YAAY,GAAG,CACnB,IAAe,EACf,SAAiB,EACjB,OAAe,EACgD,EAAE,CACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACrC,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE;KAChC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAmC,EACnC,EAAE;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAExD,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAC9B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,OAAO,WAAW,CAAC,IAAI,CAAC;YACtB,OAAO,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC;YAChE,SAAS,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;YACpE,OAAO,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CACjD,sBAAsB,EACtB,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC,SAAS,CACtD,2BAA2B,EAC3B,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAClD,uBAAuB,EACvB,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAChD,qBAAqB,EACrB,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GACnC,OAAO,CAAC,SAAS,CAA8B,4BAA4B,EAAE;IAC3E,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;CACzB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,2BAA2B,GACtC,OAAO,CAAC,SAAS,CAA2B,+BAA+B,EAAE;IAC3E,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;CACzB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CACjD,sBAAsB,EACtB,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,wCAAwC,GACnD,OAAO,CAAC,SAAS,CACf,4CAA4C,EAC5C,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7B,CAAC;AAaJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAmC,EAAE,EAAE,EAAE,CAC5E,KAAK,CAAC,QAAQ,CACZ,OAAO,CAAC,QAAQ,KAAK,SAAS;IAC5B,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvD,OAAO,CAAC,aAAa,KAAK,SAAS;IACjC,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EACjE,OAAO,CAAC,SAAS,KAAK,SAAS;IAC7B,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EACzD,OAAO,CAAC,OAAO,KAAK,SAAS;IAC3B,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EACrD,OAAO,CAAC,cAAc,KAAK,SAAS;IAClC,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EACnE,OAAO,CAAC,QAAQ,KAAK,SAAS;IAC5B,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvD,OAAO,CAAC,iBAAiB,KAAK,SAAS;IACrC,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EACzE,OAAO,CAAC,8BAA8B,KAAK,SAAS;IAClD,CAAC,CAAC,KAAK,CAAC,KAAK;IACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,wCAAwC,CAAC,CACrD,OAAO,CAAC,8BAA8B,CACvC,CACN,CAAC"}

package/dist/AuthFlow.d.ts

@@ -1,59 +1,310 @@
-import { Context, Effect } from "effect";
-import type { AuthFlowId, UserId } from "./Identifiers.js";
-import type { AuthAssuranceLevel, AuthMethodReference, IssuedSession } from "./Sessions.js";
+import { Context, Data, Effect, Layer } from "effect";
+import { AuthFlowId } from "./Identifiers.js";
+import type { Email, OAuthProviderId, UserId } from "./Identifiers.js";
+import { Sessions } from "./Sessions.js";
+import type { AuthAssuranceLevel, AuthMethodReference, IssuedSession, SessionCreateError, SessionClaims, SessionsService } from "./Sessions.js";
 export type AuthMethod = "password" | "email-otp" | "magic-link" | "passkey" | "oauth" | "totp" | "backup-code" | (string & {});
-export type AuthDenyReason = "invalid-credentials" | "account-disabled" | "rate-limited" | "policy-denied" | "requires-explicit-linking" | (string & {});
+export type EmailVerificationSessionMode = "allow-unverified" | "limited-session" | "require-before-session";
+export interface EmailVerificationSessionPolicyOptions {
+    readonly mode?: EmailVerificationSessionMode;
+}
+export interface EmailVerificationSessionPolicyInput {
+    readonly claims?: SessionClaims;
+}
+export type EmailVerificationSessionPolicyDecision = {
+    readonly _tag: "CreateSession";
+    readonly claims?: SessionClaims;
+} | {
+    readonly _tag: "RequiresEmailVerification";
+};
+export interface EmailVerificationSessionPolicyService {
+    readonly decide: (input: EmailVerificationSessionPolicyInput) => Effect.Effect<EmailVerificationSessionPolicyDecision>;
+}
+declare const EmailVerificationSessionPolicy_base: Context.ServiceClass<EmailVerificationSessionPolicy, "auth/EmailVerificationSessionPolicy", EmailVerificationSessionPolicyService>;
+export declare class EmailVerificationSessionPolicy extends EmailVerificationSessionPolicy_base {
+}
+export declare namespace EmailVerificationSessionPolicy {
+    const make: (service: EmailVerificationSessionPolicyService) => EmailVerificationSessionPolicyService;
+}
+export declare const makeEmailVerificationSessionPolicy: (options?: EmailVerificationSessionPolicyOptions) => EmailVerificationSessionPolicyService;
+export declare const EmailVerificationSessionPolicyLive: (options?: EmailVerificationSessionPolicyOptions) => Layer.Layer<EmailVerificationSessionPolicy, never, never>;
 export interface MfaFactor {
     readonly type: "totp" | "backup-code" | "passkey" | (string & {});
 }
-export interface PrimaryFactorResult {
+export interface PrimaryFactorResult<Method extends AuthMethod = AuthMethod> {
     readonly userId: UserId;
-    readonly method: AuthMethod;
-    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly email?: Email;
+    readonly method: Method;
+    readonly amr: readonly AuthMethodReference[];
     readonly aal: AuthAssuranceLevel;
+    readonly claims?: SessionClaims;
 }
 export interface MfaCompleteInput {
     readonly flowId: AuthFlowId;
     readonly method: AuthMethod;
-    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly amr: readonly AuthMethodReference[];
     readonly aal: AuthAssuranceLevel;
 }
-export interface AuthFlowCompleteInput {
+export interface AuthFlowCompleteInput<Method extends AuthMethod = AuthMethod> {
     readonly userId: UserId;
-    readonly method: AuthMethod;
-    readonly amr: ReadonlyArray<AuthMethodReference>;
+    readonly method: Method;
+    readonly amr: readonly AuthMethodReference[];
     readonly aal: AuthAssuranceLevel;
+    readonly claims?: SessionClaims;
 }
-export type AuthResult = {
-    readonly type: "authenticated";
-    readonly session: IssuedSession;
-} | {
-    readonly type: "requires-mfa";
-    readonly flowId: AuthFlowId;
-    readonly factors: ReadonlyArray<MfaFactor>;
-} | {
-    readonly type: "requires-email-verification";
-    readonly flowId: AuthFlowId;
-} | {
-    readonly type: "requires-passkey-enrollment";
-    readonly flowId: AuthFlowId;
-} | {
-    readonly type: "denied";
-    readonly reason: AuthDenyReason;
+export type AuthResult = Data.TaggedEnum<{
+    Authenticated: {
+        readonly session: IssuedSession;
+    };
+    RequiresMfa: {
+        readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
+    };
+    RequiresEmailVerification: {
+        readonly flowId: AuthFlowId;
+        readonly userId?: UserId;
+        readonly email?: Email;
+    };
+    RequiresPasskeyEnrollment: {
+        readonly flowId: AuthFlowId;
+    };
+    RequiresExplicitLinking: {
+        readonly flowId: AuthFlowId;
+        readonly provider: OAuthProviderId;
+    };
+    InvalidCredentials: {};
+    AccountDisabled: {};
+    PolicyDenied: {
+        readonly reason?: string;
+    };
+}>;
+export declare const AuthResult: {
+    readonly RequiresEmailVerification: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresEmailVerification";
+        readonly flowId: AuthFlowId;
+        readonly userId?: UserId | undefined;
+        readonly email?: Email | undefined;
+    }, "_tag">;
+    readonly Authenticated: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Authenticated";
+        readonly session: IssuedSession;
+    }, "_tag">;
+    readonly RequiresMfa: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresMfa";
+        readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
+    }, "_tag">;
+    readonly RequiresPasskeyEnrollment: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresPasskeyEnrollment";
+        readonly flowId: AuthFlowId;
+    }, "_tag">;
+    readonly RequiresExplicitLinking: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresExplicitLinking";
+        readonly flowId: AuthFlowId;
+        readonly provider: OAuthProviderId;
+    }, "_tag">;
+    readonly InvalidCredentials: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "InvalidCredentials";
+    }, "_tag">;
+    readonly AccountDisabled: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "AccountDisabled";
+    }, "_tag">;
+    readonly PolicyDenied: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "PolicyDenied";
+        readonly reason?: string | undefined;
+    }, "_tag">;
+    readonly $is: <Tag extends "RequiresEmailVerification" | "Authenticated" | "RequiresMfa" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "RequiresEmailVerification";
+        readonly flowId: AuthFlowId;
+        readonly userId?: UserId | undefined;
+        readonly email?: Email | undefined;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "Authenticated";
+        readonly session: IssuedSession;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresMfa";
+        readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresPasskeyEnrollment";
+        readonly flowId: AuthFlowId;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RequiresExplicitLinking";
+        readonly flowId: AuthFlowId;
+        readonly provider: OAuthProviderId;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "InvalidCredentials";
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "AccountDisabled";
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "PolicyDenied";
+        readonly reason?: string | undefined;
+    }, {
+        readonly _tag: Tag;
+    }>;
+    readonly $match: {
+        <Cases extends {
+            readonly RequiresEmailVerification: (args: {
+                readonly _tag: "RequiresEmailVerification";
+                readonly flowId: AuthFlowId;
+                readonly userId?: UserId | undefined;
+                readonly email?: Email | undefined;
+            }) => any;
+            readonly Authenticated: (args: {
+                readonly _tag: "Authenticated";
+                readonly session: IssuedSession;
+            }) => any;
+            readonly RequiresMfa: (args: {
+                readonly _tag: "RequiresMfa";
+                readonly flowId: AuthFlowId;
+                readonly factors: readonly MfaFactor[];
+            }) => any;
+            readonly RequiresPasskeyEnrollment: (args: {
+                readonly _tag: "RequiresPasskeyEnrollment";
+                readonly flowId: AuthFlowId;
+            }) => any;
+            readonly RequiresExplicitLinking: (args: {
+                readonly _tag: "RequiresExplicitLinking";
+                readonly flowId: AuthFlowId;
+                readonly provider: OAuthProviderId;
+            }) => any;
+            readonly InvalidCredentials: (args: {
+                readonly _tag: "InvalidCredentials";
+            }) => any;
+            readonly AccountDisabled: (args: {
+                readonly _tag: "AccountDisabled";
+            }) => any;
+            readonly PolicyDenied: (args: {
+                readonly _tag: "PolicyDenied";
+                readonly reason?: string | undefined;
+            }) => any;
+        }>(cases: Cases): (value: {
+            readonly _tag: "RequiresEmailVerification";
+            readonly flowId: AuthFlowId;
+            readonly userId?: UserId | undefined;
+            readonly email?: Email | undefined;
+        } | {
+            readonly _tag: "Authenticated";
+            readonly session: IssuedSession;
+        } | {
+            readonly _tag: "RequiresMfa";
+            readonly flowId: AuthFlowId;
+            readonly factors: readonly MfaFactor[];
+        } | {
+            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly flowId: AuthFlowId;
+        } | {
+            readonly _tag: "RequiresExplicitLinking";
+            readonly flowId: AuthFlowId;
+            readonly provider: OAuthProviderId;
+        } | {
+            readonly _tag: "InvalidCredentials";
+        } | {
+            readonly _tag: "AccountDisabled";
+        } | {
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string | undefined;
+        }) => import("effect/Unify").Unify<ReturnType<Cases["RequiresEmailVerification" | "Authenticated" | "RequiresMfa" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied"]>>;
+        <Cases extends {
+            readonly RequiresEmailVerification: (args: {
+                readonly _tag: "RequiresEmailVerification";
+                readonly flowId: AuthFlowId;
+                readonly userId?: UserId | undefined;
+                readonly email?: Email | undefined;
+            }) => any;
+            readonly Authenticated: (args: {
+                readonly _tag: "Authenticated";
+                readonly session: IssuedSession;
+            }) => any;
+            readonly RequiresMfa: (args: {
+                readonly _tag: "RequiresMfa";
+                readonly flowId: AuthFlowId;
+                readonly factors: readonly MfaFactor[];
+            }) => any;
+            readonly RequiresPasskeyEnrollment: (args: {
+                readonly _tag: "RequiresPasskeyEnrollment";
+                readonly flowId: AuthFlowId;
+            }) => any;
+            readonly RequiresExplicitLinking: (args: {
+                readonly _tag: "RequiresExplicitLinking";
+                readonly flowId: AuthFlowId;
+                readonly provider: OAuthProviderId;
+            }) => any;
+            readonly InvalidCredentials: (args: {
+                readonly _tag: "InvalidCredentials";
+            }) => any;
+            readonly AccountDisabled: (args: {
+                readonly _tag: "AccountDisabled";
+            }) => any;
+            readonly PolicyDenied: (args: {
+                readonly _tag: "PolicyDenied";
+                readonly reason?: string | undefined;
+            }) => any;
+        }>(value: {
+            readonly _tag: "RequiresEmailVerification";
+            readonly flowId: AuthFlowId;
+            readonly userId?: UserId | undefined;
+            readonly email?: Email | undefined;
+        } | {
+            readonly _tag: "Authenticated";
+            readonly session: IssuedSession;
+        } | {
+            readonly _tag: "RequiresMfa";
+            readonly flowId: AuthFlowId;
+            readonly factors: readonly MfaFactor[];
+        } | {
+            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly flowId: AuthFlowId;
+        } | {
+            readonly _tag: "RequiresExplicitLinking";
+            readonly flowId: AuthFlowId;
+            readonly provider: OAuthProviderId;
+        } | {
+            readonly _tag: "InvalidCredentials";
+        } | {
+            readonly _tag: "AccountDisabled";
+        } | {
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string | undefined;
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["RequiresEmailVerification" | "Authenticated" | "RequiresMfa" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied"]>>;
+    };
 };
-declare const AuthFlowError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "AuthFlowError";
+export type AuthResultOf<Tag extends AuthResult["_tag"]> = Extract<AuthResult, {
+    readonly _tag: Tag;
+}>;
+export type AuthenticatedResult = AuthResultOf<"Authenticated">;
+type CommonPrimaryFactorResult = AuthResultOf<"Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresPasskeyEnrollment" | "PolicyDenied">;
+export type AuthFlowPrimaryFactorResult<Method extends AuthMethod = AuthMethod> = CommonPrimaryFactorResult | (Method extends "oauth" ? AuthResultOf<"RequiresExplicitLinking"> : never);
+export type AuthFlowMfaResult = AuthResultOf<"Authenticated" | "PolicyDenied">;
+declare const AuthFlowStateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthFlowStateError";
 } & Readonly<A>;
-export declare class AuthFlowError extends AuthFlowError_base<{
+export declare class AuthFlowStateError extends AuthFlowStateError_base<{
     readonly message: string;
     readonly cause?: unknown;
 }> {
 }
+export type AuthFlowCompleteError = SessionCreateError;
+export type AuthFlowError = AuthFlowStateError | AuthFlowCompleteError;
 export interface AuthFlowService {
-    readonly startPrimaryFactor: (input: PrimaryFactorResult) => Effect.Effect<AuthResult, AuthFlowError>;
-    readonly completePrimaryFactor: (input: PrimaryFactorResult) => Effect.Effect<AuthResult, AuthFlowError>;
-    readonly completeMfa: (input: MfaCompleteInput) => Effect.Effect<AuthResult, AuthFlowError>;
-    readonly complete: (input: AuthFlowCompleteInput) => Effect.Effect<AuthResult, AuthFlowError>;
+    readonly startPrimaryFactor: <Method extends AuthMethod>(input: PrimaryFactorResult<Method>) => Effect.Effect<AuthFlowPrimaryFactorResult<Method>, AuthFlowCompleteError>;
+    readonly completePrimaryFactor: <Method extends AuthMethod>(input: PrimaryFactorResult<Method>) => Effect.Effect<AuthFlowPrimaryFactorResult<Method>, AuthFlowCompleteError>;
+    readonly completeMfa: (input: MfaCompleteInput) => Effect.Effect<AuthFlowMfaResult, AuthFlowStateError>;
+    readonly complete: <Method extends AuthMethod>(input: AuthFlowCompleteInput<Method>) => Effect.Effect<AuthenticatedResult, AuthFlowCompleteError>;
 }
 declare const AuthFlow_base: Context.ServiceClass<AuthFlow, "auth/AuthFlow", AuthFlowService>;
 export declare class AuthFlow extends AuthFlow_base {
@@ -61,6 +312,12 @@ export declare class AuthFlow extends AuthFlow_base {
 export declare namespace AuthFlow {
     const make: (service: AuthFlowService) => AuthFlowService;
 }
-export declare const denied: (reason: AuthDenyReason) => AuthResult;
+export interface AuthFlowDependencies {
+    readonly sessions: SessionsService;
+    readonly emailVerificationSessionPolicy?: EmailVerificationSessionPolicyService;
+}
+export declare const makeAuthFlow: (dependencies: AuthFlowDependencies) => AuthFlowService;
+export declare const AuthFlowLive: Layer.Layer<AuthFlow, never, Sessions>;
+export declare const AuthFlowLiveWithEmailVerificationPolicy: (options?: EmailVerificationSessionPolicyOptions) => Layer.Layer<AuthFlow, never, Sessions>;
 export {};
 //# sourceMappingURL=AuthFlow.d.ts.map

package/dist/AuthFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthFlow.d.ts","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE3F,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,MAAM,cAAc,GACtB,qBAAqB,GACrB,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,2BAA2B,GAC3B,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;CAClE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAChD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CACjC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;CAAE,GAC1G;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;;;;AAEhE,qBAAa,aAAc,SAAQ,mBAAkC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACrG,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACxG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAC3F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;CAC9F;;AAED,qBAAa,QAAS,SAAQ,aAA6D;CAAG;AAE9F,yBAAiB,QAAQ,CAAC;IACjB,MAAM,IAAI,GAAI,SAAS,eAAe,KAAG,eAAuC,CAAA;CACxF;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,cAAc,KAAG,UAG9C,CAAA"}
+{"version":3,"file":"AuthFlow.d.ts","sourceRoot":"","sources":["../src/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,EAEb,eAAe,EAChB,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,4BAA4B,GACpC,kBAAkB,GAClB,iBAAiB,GACjB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC;CAC9C;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,MAAM,sCAAsC,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,mCAAmC,KACvC,MAAM,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;CAC5D;;AAED,qBAAa,8BAA+B,SAAQ,mCAGV;CAAG;AAE7C,yBAAiB,8BAA8B,CAAC;IACvC,MAAM,IAAI,GACf,SAAS,qCAAqC,KAC7C,qCACyC,CAAC;CAC9C;AAqCD,eAAO,MAAM,kCAAkC,GAC7C,UAAS,qCAA0C,KAClD,qCAsCF,CAAC;AAEF,eAAO,MAAM,kCAAkC,GAC7C,UAAU,qCAAqC,8DAI9C,CAAC;AAEJ,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,mBAAmB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvC,aAAa,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAC;IACnD,WAAW,EAAE;QACX,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;KACxC,CAAC;IACF,yBAAyB,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;KACxB,CAAC;IACF,yBAAyB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IAC3D,uBAAuB,EAAE;QACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;KACpC,CAAC;IACF,kBAAkB,EAAE,EAAE,CAAC;IACvB,eAAe,EAAE,EAAE,CAAC;IACpB,YAAY,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,eAAO,MAAM,UAAU;;;yBAdF,UAAU;0BACT,MAAM;yBACP,KAAK;;;;0BARW,aAAa;;;;yBAE7B,UAAU;0BACT,SAAS,SAAS,EAAE;;;;yBAOM,UAAU;;;;yBAErC,UAAU;2BACR,eAAe;;;;;;;;;;0BAIF,MAAM;;;;yBAXrB,UAAU;0BACT,MAAM;yBACP,KAAK;;;;;0BARW,aAAa;;;;;yBAE7B,UAAU;0BACT,SAAS,SAAS,EAAE;;;;;yBAOM,UAAU;;;;;yBAErC,UAAU;2BACR,eAAe;;;;;;;;;;;;;0BAIF,MAAM;;;;;;;;iCAXrB,UAAU;kCACT,MAAM;iCACP,KAAK;;;;kCARW,aAAa;;;;iCAE7B,UAAU;kCACT,SAAS,SAAS,EAAE;;;;iCAOM,UAAU;;;;iCAErC,UAAU;mCACR,eAAe;;;;;;;;;;kCAIF,MAAM;;;;6BAXrB,UAAU;8BACT,MAAM;6BACP,KAAK;;;8BARW,aAAa;;;6BAE7B,UAAU;8BACT,SAAS,SAAS,EAAE;;;6BAOM,UAAU;;;6BAErC,UAAU;+BACR,eAAe;;;;;;;8BAIF,MAAM;;;;;iCAXrB,UAAU;kCACT,MAAM;iCACP,KAAK;;;;kCARW,aAAa;;;;iCAE7B,UAAU;kCACT,SAAS,SAAS,EAAE;;;;iCAOM,UAAU;;;;iCAErC,UAAU;mCACR,eAAe;;;;;;;;;;kCAIF,MAAM;;;;6BAXrB,UAAU;8BACT,MAAM;6BACP,KAAK;;;8BARW,aAAa;;;6BAE7B,UAAU;8BACT,SAAS,SAAS,EAAE;;;6BAOM,UAAU;;;6BAErC,UAAU;+BACR,eAAe;;;;;;;8BAIF,MAAM;;;CAGa,CAAC;AAExD,MAAM,MAAM,YAAY,CAAC,GAAG,SAAS,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAChE,UAAU,EACV;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CACvB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAEhE,KAAK,yBAAyB,GAAG,YAAY,CACzC,eAAe,GACf,aAAa,GACb,2BAA2B,GAC3B,2BAA2B,GAC3B,cAAc,CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CACrC,MAAM,SAAS,UAAU,GAAG,UAAU,IAEpC,yBAAyB,GACzB,CAAC,MAAM,SAAS,OAAO,GAAG,YAAY,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC,CAAC;AAE/E,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,eAAe,GAAG,cAAc,CAAC,CAAC;;;;AAE/E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACvD,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,SAAS,UAAU,EACrD,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAC/B,MAAM,CAAC,MAAM,CAChB,2BAA2B,CAAC,MAAM,CAAC,EACnC,qBAAqB,CACtB,CAAC;IACF,QAAQ,CAAC,qBAAqB,EAAE,CAAC,MAAM,SAAS,UAAU,EACxD,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAC/B,MAAM,CAAC,MAAM,CAChB,2BAA2B,CAAC,MAAM,CAAC,EACnC,qBAAqB,CACtB,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,gBAAgB,KACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;IAC1D,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,SAAS,UAAU,EAC3C,KAAK,EAAE,qBAAqB,CAAC,MAAM,CAAC,KACjC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;CAChE;;AAED,qBAAa,QAAS,SAAQ,aAE7B;CAAG;AAEJ,yBAAiB,QAAQ,CAAC;IACjB,MAAM,IAAI,GAAI,SAAS,eAAe,KAAG,eAC1B,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,qCAAqC,CAAC;CACjF;AAED,eAAO,MAAM,YAAY,GACvB,cAAc,oBAAoB,KACjC,eAmEF,CAAC;AAEF,eAAO,MAAM,YAAY,wCAaxB,CAAC;AAEF,eAAO,MAAM,uCAAuC,GAClD,UAAU,qCAAqC,2CAY9C,CAAC"}