@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/Invitation.js

@@ -0,0 +1,633 @@
+import { Array as EffectArray, Brand, Context, Data, Effect, Encoding, Layer, Option, Order, Redacted, Result, Schema, } from "effect";
+import { Crypto } from "./Crypto.js";
+import { UnixMillisSchema } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+export const InvitationId = Brand.nominal();
+export const InvitationIdSchema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)).pipe(Schema.brand("auth/InvitationId"));
+export const InvitationToken = Brand.nominal();
+export const InvitationTokenHash = Brand.nominal();
+export const InvitationTokenHashSchema = Schema.String.check(Schema.isPattern(/^sha256:.+$/)).pipe(Schema.brand("auth/InvitationTokenHash"));
+export const invitationTokenVersion = "inv1";
+export const invitationIdBytes = 16;
+export const invitationSecretBytes = 32;
+export class InvitationTokenError extends Data.TaggedError("InvitationTokenError") {
+}
+const textEncoder = new TextEncoder();
+const invitationHashDomain = "effect-auth:invitation-token:v1\u0000";
+const invitationIdEncodedLength = Math.ceil((invitationIdBytes * 4) / 3);
+const invitationSecretEncodedLength = Math.ceil((invitationSecretBytes * 4) / 3);
+const invitationTokenLength = invitationTokenVersion.length +
+    invitationIdEncodedLength +
+    invitationSecretEncodedLength +
+    2;
+const invitationTokenError = (operation, message, cause) => new InvitationTokenError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const decodeCanonicalTokenPart = (value, expectedBytes, expectedEncodedLength) => {
+    if (value.length !== expectedEncodedLength ||
+        !/^[A-Za-z0-9_-]+$/.test(value)) {
+        return Option.none();
+    }
+    const decoded = Encoding.decodeBase64Url(value);
+    if (Result.isFailure(decoded) ||
+        decoded.success.length !== expectedBytes ||
+        Encoding.encodeBase64Url(decoded.success) !== value) {
+        return Option.none();
+    }
+    return Option.some(decoded.success);
+};
+const parseInvitationTokenValue = (value, operation) => {
+    if (value.length !== invitationTokenLength) {
+        return Effect.fail(invitationTokenError(operation, "Invitation token is malformed"));
+    }
+    const parts = value.split(".");
+    if (parts.length !== 3 || parts[0] !== invitationTokenVersion) {
+        return Effect.fail(invitationTokenError(operation, "Invitation token is malformed"));
+    }
+    const [, idPart, secretPart] = parts;
+    if (idPart === undefined ||
+        secretPart === undefined ||
+        Option.isNone(decodeCanonicalTokenPart(idPart, invitationIdBytes, invitationIdEncodedLength)) ||
+        Option.isNone(decodeCanonicalTokenPart(secretPart, invitationSecretBytes, invitationSecretEncodedLength))) {
+        return Effect.fail(invitationTokenError(operation, "Invitation token is malformed"));
+    }
+    return Effect.succeed({ id: InvitationId(idPart) });
+};
+const hashInvitationTokenValue = (crypto, value, operation) => crypto.digestSha256({ data: `${invitationHashDomain}${value}` }).pipe(Effect.map((hash) => InvitationTokenHash(`sha256:${hash}`)), Effect.mapError((cause) => invitationTokenError(operation, "Failed to hash invitation token", cause)));
+const invitationTokensService = Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    return {
+        generate: Effect.fn("auth.invitation.tokens.generate")(function* () {
+            const idBytes = yield* crypto
+                .randomBytes(invitationIdBytes)
+                .pipe(Effect.mapError((cause) => invitationTokenError("generate", "Failed to generate invitation id", cause)));
+            const secretBytes = yield* crypto
+                .randomBytes(invitationSecretBytes)
+                .pipe(Effect.mapError((cause) => invitationTokenError("generate", "Failed to generate invitation secret", cause)));
+            if (idBytes.length !== invitationIdBytes ||
+                secretBytes.length !== invitationSecretBytes) {
+                return yield* Effect.fail(invitationTokenError("generate", "Crypto returned an unexpected invitation token byte length"));
+            }
+            const id = InvitationId(Encoding.encodeBase64Url(idBytes));
+            const token = InvitationToken(`${invitationTokenVersion}.${id}.${Encoding.encodeBase64Url(secretBytes)}`);
+            return { id, token: Redacted.make(token) };
+        }),
+        parse: Effect.fn("auth.invitation.tokens.parse")(function* (token) {
+            return yield* parseInvitationTokenValue(Redacted.value(token), "parse");
+        }),
+        hash: Effect.fn("auth.invitation.tokens.hash")(function* (input) {
+            const value = Redacted.value(input.token);
+            yield* parseInvitationTokenValue(value, "hash");
+            return yield* hashInvitationTokenValue(crypto, value, "hash");
+        }),
+        verify: Effect.fn("auth.invitation.tokens.verify")(function* (input) {
+            const value = Redacted.value(input.token);
+            const parsed = yield* parseInvitationTokenValue(value, "verify").pipe(Effect.option);
+            if (Option.isNone(parsed)) {
+                return false;
+            }
+            const candidate = yield* hashInvitationTokenValue(crypto, value, "verify");
+            return yield* crypto
+                .timingSafeEqual({
+                left: textEncoder.encode(candidate),
+                right: textEncoder.encode(input.tokenHash),
+            })
+                .pipe(Effect.mapError((cause) => invitationTokenError("verify", "Failed to compare invitation token hashes", cause)));
+        }),
+    };
+});
+export class InvitationTokens extends Context.Service()("auth/InvitationTokens", {
+    make: invitationTokensService,
+}) {
+}
+export const InvitationTokensSha256Live = Layer.effect(InvitationTokens)(InvitationTokens.make);
+const hasConsistentInvitationLifecycle = (record) => {
+    const accepted = record.acceptedAt !== undefined;
+    const revoked = record.revokedAt !== undefined;
+    const superseded = record.supersededAt !== undefined;
+    return (accepted === (record.acceptedBy !== undefined) &&
+        superseded === (record.supersededById !== undefined) &&
+        Number(accepted) + Number(revoked) + Number(superseded) <= 1);
+};
+export const getInvitationStatus = (record, now) => {
+    if (!hasConsistentInvitationLifecycle(record)) {
+        return "invalid";
+    }
+    if (record.acceptedAt !== undefined) {
+        return "accepted";
+    }
+    if (record.revokedAt !== undefined) {
+        return "revoked";
+    }
+    if (record.supersededAt !== undefined) {
+        return "superseded";
+    }
+    if (Number(now) >= Number(record.expiresAt)) {
+        return "expired";
+    }
+    return "pending";
+};
+const NonEmptyStringSchema = Schema.String.check(Schema.isMinLength(1));
+const DelegatedUnixMillisSchema = UnixMillisSchema.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0));
+const PermissionSubjectSchema = Schema.Struct({
+    type: NonEmptyStringSchema,
+    id: NonEmptyStringSchema,
+});
+export const InvitationJsonObjectSchema = Schema.Record(Schema.String, Schema.Json);
+export const InvitationTargetSchema = Schema.Struct({
+    type: NonEmptyStringSchema,
+    id: NonEmptyStringSchema,
+});
+export const InvitationRecipientSchema = Schema.Struct({
+    type: NonEmptyStringSchema,
+    reference: NonEmptyStringSchema,
+});
+export const InvitationIntentSchema = Schema.Struct({
+    type: NonEmptyStringSchema,
+    version: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+    payload: InvitationJsonObjectSchema,
+});
+export const InvitationRecordSchema = Schema.Struct({
+    id: InvitationIdSchema,
+    kind: NonEmptyStringSchema,
+    target: InvitationTargetSchema,
+    intent: InvitationIntentSchema,
+    recipient: Schema.optional(InvitationRecipientSchema),
+    issuedBy: Schema.optional(PermissionSubjectSchema),
+    createdAt: DelegatedUnixMillisSchema,
+    expiresAt: DelegatedUnixMillisSchema,
+    tokenHash: InvitationTokenHashSchema,
+    acceptedAt: Schema.optional(DelegatedUnixMillisSchema),
+    acceptedBy: Schema.optional(PermissionSubjectSchema),
+    revokedAt: Schema.optional(DelegatedUnixMillisSchema),
+    supersededAt: Schema.optional(DelegatedUnixMillisSchema),
+    supersededById: Schema.optional(InvitationIdSchema),
+    metadata: Schema.optional(InvitationJsonObjectSchema),
+}).check(Schema.makeFilter((record) => {
+    if (!hasConsistentInvitationLifecycle(record)) {
+        return "Invitation terminal state is inconsistent";
+    }
+    if (Number(record.expiresAt) <= Number(record.createdAt)) {
+        return "Invitation expiry must be later than creation";
+    }
+    for (const terminalAt of [
+        record.acceptedAt,
+        record.revokedAt,
+        record.supersededAt,
+    ]) {
+        if (terminalAt !== undefined &&
+            Number(terminalAt) < Number(record.createdAt)) {
+            return "Invitation terminal time must not precede creation";
+        }
+    }
+    return undefined;
+}));
+export const isInvitationRecord = Schema.is(InvitationRecordSchema);
+const isInvitationJsonObject = Schema.is(InvitationJsonObjectSchema);
+export class InvitationStoreError extends Data.TaggedError("InvitationStoreError") {
+}
+export class InvitationStore extends Context.Service()("auth/InvitationStore") {
+}
+const invitationStoreError = (operation, message, cause) => new InvitationStoreError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const cloneMetadata = (metadata) => metadata === undefined ? undefined : structuredClone(metadata);
+const clonePermissionSubject = (subject) => subject === undefined ? undefined : { type: subject.type, id: subject.id };
+const cloneInvitationRecord = (record) => ({
+    id: record.id,
+    kind: record.kind,
+    target: { type: record.target.type, id: record.target.id },
+    intent: {
+        type: record.intent.type,
+        version: record.intent.version,
+        payload: structuredClone(record.intent.payload),
+    },
+    ...(record.recipient === undefined
+        ? {}
+        : {
+            recipient: {
+                type: record.recipient.type,
+                reference: record.recipient.reference,
+            },
+        }),
+    ...(record.issuedBy === undefined
+        ? {}
+        : { issuedBy: clonePermissionSubject(record.issuedBy) }),
+    createdAt: record.createdAt,
+    expiresAt: record.expiresAt,
+    tokenHash: record.tokenHash,
+    ...(record.acceptedAt === undefined ? {} : { acceptedAt: record.acceptedAt }),
+    ...(record.acceptedBy === undefined
+        ? {}
+        : { acceptedBy: clonePermissionSubject(record.acceptedBy) }),
+    ...(record.revokedAt === undefined ? {} : { revokedAt: record.revokedAt }),
+    ...(record.supersededAt === undefined
+        ? {}
+        : { supersededAt: record.supersededAt }),
+    ...(record.supersededById === undefined
+        ? {}
+        : { supersededById: record.supersededById }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(record.metadata) }),
+});
+const subjectsEqual = (left, right) => left === undefined
+    ? right === undefined
+    : right !== undefined && left.type === right.type && left.id === right.id;
+const targetsEqual = (left, right) => left.type === right.type && left.id === right.id;
+const recipientsEqual = (left, right) => left === undefined
+    ? right === undefined
+    : right !== undefined &&
+        left.type === right.type &&
+        left.reference === right.reference;
+const matchesInvitationList = (record, input) => (input.kind === undefined || record.kind === input.kind) &&
+    (input.target === undefined || targetsEqual(record.target, input.target)) &&
+    (input.recipient === undefined ||
+        recipientsEqual(record.recipient, input.recipient)) &&
+    (input.issuedBy === undefined ||
+        subjectsEqual(record.issuedBy, input.issuedBy)) &&
+    (input.statuses === undefined ||
+        input.statuses.includes(getInvitationStatus(record, input.now)));
+const compareInvitationRecords = (left, right) => {
+    const createdAt = Number(left.createdAt) - Number(right.createdAt);
+    if (createdAt !== 0) {
+        return createdAt < 0 ? -1 : 1;
+    }
+    return String(left.id) < String(right.id)
+        ? -1
+        : String(left.id) > String(right.id)
+            ? 1
+            : 0;
+};
+const InvitationRecordOrder = Order.make(compareInvitationRecords);
+const invitationStoreMemory = () => {
+    const records = new Map();
+    return InvitationStore.of({
+        insert: Effect.fn("auth.invitation.store.memory.insert")(function* (record) {
+            if (!isInvitationRecord(record)) {
+                return yield* Effect.fail(invitationStoreError("insert", "Invitation record is invalid"));
+            }
+            if (records.has(record.id)) {
+                return yield* Effect.fail(invitationStoreError("insert", "Invitation id already exists"));
+            }
+            records.set(record.id, cloneInvitationRecord(record));
+        }),
+        findById: Effect.fn("auth.invitation.store.memory.find_by_id")((id) => Effect.sync(() => {
+            const record = records.get(id);
+            return record === undefined
+                ? Option.none()
+                : Option.some(cloneInvitationRecord(record));
+        })),
+        list: Effect.fn("auth.invitation.store.memory.list")((input) => Effect.sync(() => EffectArray.sort([...records.values()].filter((record) => matchesInvitationList(record, input)), InvitationRecordOrder).map(cloneInvitationRecord))),
+        revokePending: Effect.fn("auth.invitation.store.memory.revoke_pending")(function* (input) {
+            const record = records.get(input.id);
+            if (record === undefined ||
+                getInvitationStatus(record, input.revokedAt) !== "pending") {
+                return Option.none();
+            }
+            const revoked = {
+                ...record,
+                revokedAt: input.revokedAt,
+            };
+            if (!isInvitationRecord(revoked)) {
+                return yield* Effect.fail(invitationStoreError("revoke", "Revoked invitation record is invalid"));
+            }
+            records.set(record.id, revoked);
+            return Option.some(cloneInvitationRecord(revoked));
+        }),
+        supersedePending: Effect.fn("auth.invitation.store.memory.supersede_pending")(function* (input) {
+            if (!isInvitationRecord(input.replacement)) {
+                return yield* Effect.fail(invitationStoreError("supersede", "Replacement invitation record is invalid"));
+            }
+            const record = records.get(input.id);
+            if (record === undefined ||
+                getInvitationStatus(record, input.supersededAt) !== "pending") {
+                return Option.none();
+            }
+            if (records.has(input.replacement.id)) {
+                return yield* Effect.fail(invitationStoreError("supersede", "Replacement invitation id already exists"));
+            }
+            const superseded = {
+                ...record,
+                supersededAt: input.supersededAt,
+                supersededById: input.replacement.id,
+            };
+            if (!isInvitationRecord(superseded)) {
+                return yield* Effect.fail(invitationStoreError("supersede", "Superseded invitation record is invalid"));
+            }
+            const replacement = cloneInvitationRecord(input.replacement);
+            records.set(record.id, superseded);
+            records.set(replacement.id, replacement);
+            return Option.some({
+                superseded: cloneInvitationRecord(superseded),
+                replacement: cloneInvitationRecord(replacement),
+            });
+        }),
+    });
+};
+export const InvitationStoreMemoryLive = Layer.sync(InvitationStore)(invitationStoreMemory);
+export class InvitationManagementError extends Data.TaggedError("InvitationManagementError") {
+}
+const invitationManagementError = (operation, message, cause) => new InvitationManagementError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const validateInvitationText = (value, label, operation) => value.trim().length === 0
+    ? Effect.fail(invitationManagementError(operation, `${label} must not be empty`))
+    : Effect.void;
+const validateNewInvitation = (input, now, operation) => Effect.gen(function* () {
+    yield* validateInvitationText(input.kind, "Invitation kind", operation);
+    yield* validateInvitationText(input.target.type, "Invitation target type", operation);
+    yield* validateInvitationText(input.target.id, "Invitation target id", operation);
+    yield* validateInvitationText(input.intent.type, "Invitation intent type", operation);
+    if (!Number.isSafeInteger(input.intent.version) ||
+        input.intent.version < 1) {
+        return yield* Effect.fail(invitationManagementError(operation, "Invitation intent version must be a positive integer"));
+    }
+    if (!isInvitationJsonObject(input.intent.payload)) {
+        return yield* Effect.fail(invitationManagementError(operation, "Invitation intent payload must be JSON-compatible"));
+    }
+    if (input.metadata !== undefined &&
+        !isInvitationJsonObject(input.metadata)) {
+        return yield* Effect.fail(invitationManagementError(operation, "Invitation metadata must be JSON-compatible"));
+    }
+    if (input.recipient !== undefined) {
+        yield* validateInvitationText(input.recipient.type, "Invitation recipient type", operation);
+        yield* validateInvitationText(input.recipient.reference, "Invitation recipient reference", operation);
+    }
+    if (input.issuedBy !== undefined) {
+        yield* validateInvitationText(input.issuedBy.type, "Invitation issuer type", operation);
+        yield* validateInvitationText(input.issuedBy.id, "Invitation issuer id", operation);
+    }
+    if (!Number.isFinite(Number(input.expiresAt)) ||
+        Number(input.expiresAt) <= Number(now)) {
+        return yield* Effect.fail(invitationManagementError(operation, "Invitation expiry must be in the future"));
+    }
+});
+const invitationInfo = (record, now) => ({
+    id: record.id,
+    kind: record.kind,
+    target: { type: record.target.type, id: record.target.id },
+    intent: {
+        type: record.intent.type,
+        version: record.intent.version,
+        payload: structuredClone(record.intent.payload),
+    },
+    ...(record.recipient === undefined
+        ? {}
+        : {
+            recipient: {
+                type: record.recipient.type,
+                reference: record.recipient.reference,
+            },
+        }),
+    ...(record.issuedBy === undefined
+        ? {}
+        : { issuedBy: clonePermissionSubject(record.issuedBy) }),
+    createdAt: record.createdAt,
+    expiresAt: record.expiresAt,
+    status: getInvitationStatus(record, now),
+    ...(record.acceptedAt === undefined ? {} : { acceptedAt: record.acceptedAt }),
+    ...(record.acceptedBy === undefined
+        ? {}
+        : { acceptedBy: clonePermissionSubject(record.acceptedBy) }),
+    ...(record.revokedAt === undefined ? {} : { revokedAt: record.revokedAt }),
+    ...(record.supersededAt === undefined
+        ? {}
+        : { supersededAt: record.supersededAt }),
+    ...(record.supersededById === undefined
+        ? {}
+        : { supersededById: record.supersededById }),
+    ...(record.metadata === undefined
+        ? {}
+        : { metadata: cloneMetadata(record.metadata) }),
+});
+const invitationInspection = (record, now) => {
+    const { recipient, ...info } = invitationInfo(record, now);
+    return {
+        ...info,
+        ...(recipient === undefined ? {} : { recipientType: recipient.type }),
+    };
+};
+const prepareInvitation = (tokens, input, now, operation) => Effect.gen(function* () {
+    yield* validateNewInvitation(input, now, operation);
+    const generated = yield* tokens
+        .generate()
+        .pipe(Effect.mapError((cause) => invitationManagementError(operation, "Failed to generate invitation token", cause)));
+    const tokenHash = yield* tokens
+        .hash({ token: generated.token })
+        .pipe(Effect.mapError((cause) => invitationManagementError(operation, "Failed to hash invitation token", cause)));
+    const record = {
+        id: generated.id,
+        kind: input.kind,
+        target: { type: input.target.type, id: input.target.id },
+        intent: {
+            type: input.intent.type,
+            version: input.intent.version,
+            payload: structuredClone(input.intent.payload),
+        },
+        ...(input.recipient === undefined
+            ? {}
+            : {
+                recipient: {
+                    type: input.recipient.type,
+                    reference: input.recipient.reference,
+                },
+            }),
+        ...(input.issuedBy === undefined
+            ? {}
+            : { issuedBy: clonePermissionSubject(input.issuedBy) }),
+        createdAt: now,
+        expiresAt: input.expiresAt,
+        tokenHash,
+        ...(input.metadata === undefined
+            ? {}
+            : { metadata: cloneMetadata(input.metadata) }),
+    };
+    return { record, token: generated.token };
+});
+const invitationManagementService = Effect.gen(function* () {
+    const tokens = yield* InvitationTokens;
+    const store = yield* InvitationStore;
+    return {
+        issue: Effect.fn("auth.invitation.management.issue")(function* (input) {
+            const now = yield* currentUnixMillis;
+            const prepared = yield* prepareInvitation(tokens, input, now, "issue");
+            yield* store
+                .insert(prepared.record)
+                .pipe(Effect.mapError((cause) => invitationManagementError("issue", "Failed to store invitation", cause)));
+            return {
+                invitation: invitationInfo(prepared.record, now),
+                token: prepared.token,
+            };
+        }),
+        get: Effect.fn("auth.invitation.management.get")(function* (input) {
+            const now = yield* currentUnixMillis;
+            const record = yield* store
+                .findById(input.id)
+                .pipe(Effect.mapError((cause) => invitationManagementError("get", "Failed to load invitation", cause)));
+            if (Option.isNone(record)) {
+                return yield* Effect.fail(invitationManagementError("get", "Invitation not found"));
+            }
+            return invitationInfo(record.value, now);
+        }),
+        list: Effect.fn("auth.invitation.management.list")(function* (input = {}) {
+            const now = yield* currentUnixMillis;
+            const records = yield* store
+                .list({
+                now,
+                ...(input.kind === undefined ? {} : { kind: input.kind }),
+                ...(input.target === undefined ? {} : { target: input.target }),
+                ...(input.recipient === undefined
+                    ? {}
+                    : { recipient: input.recipient }),
+                ...(input.issuedBy === undefined ? {} : { issuedBy: input.issuedBy }),
+                ...(input.statuses === undefined ? {} : { statuses: input.statuses }),
+            })
+                .pipe(Effect.mapError((cause) => invitationManagementError("list", "Failed to list invitations", cause)));
+            return records.map((record) => invitationInfo(record, now));
+        }),
+        revoke: Effect.fn("auth.invitation.management.revoke")(function* (input) {
+            const now = yield* currentUnixMillis;
+            const revoked = yield* store
+                .revokePending({ id: input.id, revokedAt: now })
+                .pipe(Effect.mapError((cause) => invitationManagementError("revoke", "Failed to revoke invitation", cause)));
+            if (Option.isNone(revoked)) {
+                return yield* Effect.fail(invitationManagementError("revoke", "Invitation not found or not pending"));
+            }
+            return invitationInfo(revoked.value, now);
+        }),
+        supersede: Effect.fn("auth.invitation.management.supersede")(function* (input) {
+            const now = yield* currentUnixMillis;
+            const prepared = yield* prepareInvitation(tokens, input, now, "supersede");
+            const result = yield* store
+                .supersedePending({
+                id: input.id,
+                supersededAt: now,
+                replacement: prepared.record,
+            })
+                .pipe(Effect.mapError((cause) => invitationManagementError("supersede", "Failed to supersede invitation", cause)));
+            if (Option.isNone(result)) {
+                return yield* Effect.fail(invitationManagementError("supersede", "Invitation not found or not pending"));
+            }
+            return {
+                superseded: invitationInfo(result.value.superseded, now),
+                invitation: invitationInfo(result.value.replacement, now),
+                token: prepared.token,
+            };
+        }),
+    };
+});
+export class InvitationManagement extends Context.Service()("auth/InvitationManagement", {
+    make: invitationManagementService,
+}) {
+}
+export const InvitationManagementLive = Layer.effect(InvitationManagement)(InvitationManagement.make);
+export class InvitationVerificationError extends Data.TaggedError("InvitationVerificationError") {
+}
+const invalidInvitationCredential = () => new InvitationVerificationError({
+    operation: "inspect",
+    message: "Invalid invitation credential",
+});
+const invitationVerificationService = Effect.gen(function* () {
+    const tokens = yield* InvitationTokens;
+    const store = yield* InvitationStore;
+    return {
+        inspect: Effect.fn("auth.invitation.verification.inspect")(function* (input) {
+            const parsed = yield* tokens
+                .parse(input.token)
+                .pipe(Effect.mapError(invalidInvitationCredential));
+            const record = yield* store.findById(parsed.id).pipe(Effect.mapError((cause) => new InvitationVerificationError({
+                operation: "inspect",
+                message: "Failed to inspect invitation",
+                cause,
+            })));
+            if (Option.isNone(record)) {
+                return yield* Effect.fail(invalidInvitationCredential());
+            }
+            if (!isInvitationRecord(record.value)) {
+                return yield* Effect.fail(invalidInvitationCredential());
+            }
+            const matches = yield* tokens
+                .verify({ token: input.token, tokenHash: record.value.tokenHash })
+                .pipe(Effect.mapError((cause) => new InvitationVerificationError({
+                operation: "inspect",
+                message: "Failed to inspect invitation",
+                cause,
+            })));
+            if (!matches) {
+                return yield* Effect.fail(invalidInvitationCredential());
+            }
+            const now = yield* currentUnixMillis;
+            if (getInvitationStatus(record.value, now) !== "pending") {
+                return yield* Effect.fail(invalidInvitationCredential());
+            }
+            return invitationInspection(record.value, now);
+        }),
+    };
+});
+export class InvitationVerification extends Context.Service()("auth/InvitationVerification", {
+    make: invitationVerificationService,
+}) {
+}
+export const InvitationVerificationLive = Layer.effect(InvitationVerification)(InvitationVerification.make);
+export class InvitationAcceptanceCommitError extends Data.TaggedError("InvitationAcceptanceCommitError") {
+}
+/** Atomically validates token/state and authoritative recipient eligibility, writes app state, and marks accepted. */
+export class InvitationAcceptanceCommit extends Context.Service()("auth/InvitationAcceptanceCommit") {
+}
+export class InvitationAcceptanceError extends Data.TaggedError("InvitationAcceptanceError") {
+}
+const invitationAcceptanceService = Effect.gen(function* () {
+    const tokens = yield* InvitationTokens;
+    const acceptanceCommit = yield* InvitationAcceptanceCommit;
+    return {
+        accept: Effect.fn("auth.invitation.acceptance.accept")(function* (input) {
+            const parsed = yield* tokens.parse(input.token).pipe(Effect.mapError(() => new InvitationAcceptanceError({
+                operation: "accept",
+                message: "Invitation could not be accepted",
+            })));
+            const candidateTokenHash = yield* tokens
+                .hash({ token: input.token })
+                .pipe(Effect.mapError((cause) => new InvitationAcceptanceError({
+                operation: "accept",
+                message: "Failed to prepare invitation acceptance",
+                cause,
+            })));
+            const now = yield* currentUnixMillis;
+            const result = yield* acceptanceCommit
+                .commit({
+                id: parsed.id,
+                candidateTokenHash,
+                acceptingSubject: input.acceptingSubject,
+                commandId: input.commandId,
+                now,
+            })
+                .pipe(Effect.mapError(() => new InvitationAcceptanceError({
+                operation: "accept",
+                message: "Invitation could not be accepted",
+            })));
+            if (result.receipt.invitationId !== parsed.id ||
+                result.receipt.commandId !== input.commandId ||
+                result.receipt.credentialHash !== candidateTokenHash ||
+                !subjectsEqual(result.receipt.acceptedBy, input.acceptingSubject)) {
+                return yield* new InvitationAcceptanceError({
+                    operation: "accept",
+                    message: "Invitation could not be accepted",
+                });
+            }
+            return result;
+        }),
+    };
+});
+export class InvitationAcceptance extends Context.Service()("auth/InvitationAcceptance", {
+    make: invitationAcceptanceService,
+}) {
+}
+export const InvitationAcceptanceLive = Layer.effect(InvitationAcceptance)(InvitationAcceptance.make);
+//# sourceMappingURL=Invitation.js.map