@effect-auth/core 0.1.0-alpha.3 → 0.1.0-alpha.4

package/README.md

@@ -58,6 +58,21 @@ const canEditAndNotSuspended = Policy.all(
 );
 ```
 
+Step-up gates live in `@effect-auth/core/StepUp` and can be converted to policies when a product action requires stronger or fresher auth:
+
+```ts
+import { Duration } from "effect";
+import * as Policy from "@effect-auth/core/Policy";
+import * as StepUp from "@effect-auth/core/StepUp";
+
+const canGenerateApiKey = StepUp.toPolicy({
+  aal: "aal2",
+  maxAge: Duration.minutes(15),
+});
+
+const generateApiKey = createApiKey.pipe(Policy.require(canGenerateApiKey));
+```
+
 ## Rate Limiter
 
 `RateLimiter` is a small auth-oriented wrapper around Effect's persistent rate limiter. It keeps the public auth API focused on policies and safe keys while delegating fixed-window/token-bucket mechanics to `effect/unstable/persistence`.
@@ -288,7 +303,7 @@ const PasswordHashingLive = Layer.mergeAll(
 
 ## HTTP API
 
-`@effect-auth/core/HttpApi` contains the first Effect v4 HttpApi contract for password and session auth. It exports `AuthApi`, module-owned `PasswordApi` and `SessionApi` groups, and handler layers for the core services.
+`@effect-auth/core/HttpApi` contains the first Effect v4 HttpApi contract for the built-in auth surface. It exports `AuthApi`, module-owned endpoint groups, and handler layers for the core services.
 
 ```ts
 import { Layer } from "effect";
@@ -306,7 +321,19 @@ export const AuthRoutesLive = HttpRouter.serve(
 );
 ```
 
-The contract currently includes `POST /auth/password/sign-in`, `POST /auth/password/sign-up`, `GET /auth/session`, `POST /auth/session/refresh`, `POST /auth/logout`, `POST /auth/email-verification/start`, and `POST /auth/email-verification/verify`.
+The contract currently includes these endpoint groups:
+
+| Group | Endpoints |
+| --- | --- |
+| Password | `POST /auth/password/sign-in`, `POST /auth/password/sign-up`, `POST /auth/password/reset/start`, `POST /auth/password/reset/verify`, `POST /auth/password/set`, `POST /auth/password/change`. |
+| Sessions | `GET /auth/session`, `POST /auth/session/refresh`, `POST /auth/logout`, `GET /auth/sessions`, `POST /auth/sessions/revoke`, `POST /auth/sessions/revoke-others`. |
+| Email verification | `POST /auth/email-verification/start`, `POST /auth/email-verification/verify`. |
+| Email OTP | `POST /auth/email-otp/start`, `POST /auth/email-otp/verify`. |
+| Magic link | `POST /auth/magic-link/start`, `POST /auth/magic-link/verify`. |
+| Login approval | `POST /auth/login-approval/approve`, `POST /auth/login-approval/status`, `POST /auth/login-approval/finalize`. |
+| Security | `POST /auth/security/login/report`. |
+
+`AuthHttpApiLive` wires the full built-in surface. Apps can own the final HTTP contract and reuse individual endpoints, handlers, or services when a feature needs app-specific payloads or responses.
 
 `Authenticated` results set the configured session cookie and never include the opaque session token in JSON bodies. Invalid credentials and disabled accounts map to the same `401 invalid_credentials` response by default. Duplicate password sign-up emails fail as `EmailAlreadyRegisteredError` in the domain layer and map to a `409 email_already_registered` HTTP API error.
 
@@ -381,7 +408,7 @@ export const AuthHttpApiLayer = AuthHttpApiBareLive.pipe(
 
 `EmailVerificationApi` exposes `start` and `verify` endpoints. `start` calls `EmailVerificationFlow` to issue and send a verification challenge through the app-owned `EmailDelivery` adapter. `verify` calls `EmailVerification` and returns `204` on success. When the request includes a valid current session cookie for the same user, `verify` also marks that session's claims as email verified and removes the `email_verification` requirement. Error responses are generic and do not include emails, user ids, challenge secrets, or provider details.
 
-Default password HTTP handlers start `EmailVerificationFlow` automatically when password sign-in or sign-up returns `RequiresEmailVerification`. The HTTP response remains `requires_email_verification` and does not include the user id, email, challenge secret, or delivery provider details.
+Password HTTP handlers can start `EmailVerificationFlow` automatically when a custom auth flow returns `RequiresEmailVerification`. The HTTP response remains `requires_email_verification` and does not include the user id, email, challenge secret, or delivery provider details.
 
 You can own the final HTTP contract while reusing core endpoints. For example, replace only password sign-up with an app-specific phone payload and keep the default sign-in endpoint:
 
@@ -489,7 +516,7 @@ export const createBrowserSession = (userId: UserId) =>
 
 `SessionClaims` are a safe, transport-visible session summary. They currently include `emailVerified` and `requirements`, and are returned by password auth success, current-session, and refresh HTTP responses when present. Use `Sessions.updateClaims` to update an active session without rotating the opaque session token. Kysely storage persists claims in the existing `auth_session.metadata` column, so no additional storage migration is required.
 
-Password auth passes the user's email verification state into `AuthFlow`, where `EmailVerificationSessionPolicy` decides what happens before a session is created. The default mode is `allow-unverified` for compatibility. Use `limited-session` to issue sessions with an `email_verification` requirement, or `require-before-session` to return `RequiresEmailVerification` without creating a session.
+Password auth passes the user's email verification state into `AuthFlow`, where `EmailVerificationSessionPolicy` decides whether unverified users get a normal session or a constrained session. The default mode is `allow-unverified` for compatibility. Use `limited-session` to issue sessions with an `email_verification` requirement. Per-login email approval is a separate `UserSecurityPolicy` / `LoginApprovalPolicy` concern, not an email verification session mode.
 
 ```ts
 import { AuthFlowLiveWithEmailVerificationPolicy } from "@effect-auth/core/AuthFlow";
@@ -503,11 +530,6 @@ export const LimitedSessionAuthFlowLive =
   AuthFlowLiveWithEmailVerificationPolicy({
     mode: "limited-session",
   });
-
-export const RequireBeforeSessionAuthFlowLive =
-  AuthFlowLiveWithEmailVerificationPolicy({
-    mode: "require-before-session",
-  });
 ```
 
 For `limited-session`, protect sensitive app routes by requiring the current session to be email verified. This policy expects your route middleware to provide `CurrentSession`.
@@ -521,6 +543,113 @@ export const updateBillingSettings = Effect.gen(function* () {
 }).pipe(Policy.require(Policy.requireEmailVerified()));
 ```
 
+`LoginApprovalPolicy` is a separate primary-factor decision for high-security sign-in flows. It decides whether a verified primary factor can continue to session creation or should require app-owned login approval. When `AuthFlow` has a `LoginApprovalFlow` and `AuthFlowState`, it stores the pending primary factor, issues a `login-approval` challenge, and returns `AuthResult.RequiresLoginApproval`. The HTTP response is `requires_login_approval` and includes only `flowId`, `approvalChallengeId`, `channel`, `sessionBinding`, `sameDeviceRequired`, and `reason`.
+
+The built-in HTTP API completes approval with `POST /auth/login-approval/approve` using `flowId`, `approvalChallengeId`, and an optional challenge `secret`. It verifies the approval, checks the approval belongs to the pending `flowId`, consumes `AuthFlowState`, marks the user email verified when the approval requested it, and creates the session. `sessionBinding: "originating-device"` protects the pending auth flow state with an HttpOnly `__Host-login-approval` cookie secret; approving from another device fails before session creation. `sessionBinding: "approval-device"` creates the session on the device that completes approval. `sessionBinding: "none"` records an approval review but does not create a user session from the approval response; the originating device finalizes later with `LoginApprovalFinalize`.
+
+Custom policy code is the primary extension point. Presets such as `mode: "new-device"` are convenience defaults for simple apps; high-security apps should model product-specific risk logic directly in `LoginApprovalPolicy.custom`.
+
+```ts
+import { Effect, Layer } from "effect";
+import { AuthFlowStateLive, AuthFlowLive } from "@effect-auth/core/AuthFlow";
+import {
+  LoginApprovalDecision,
+  LoginApprovalDeliveryFromAuthMailerLive,
+  LoginApprovalFlowLive,
+  LoginApprovalLive,
+  LoginApprovalPolicy,
+  LoginApprovalPolicyLive,
+} from "@effect-auth/core/LoginApproval";
+import {
+  LoginRiskContext,
+  LoginRiskEngine,
+  LoginRiskSignal,
+} from "@effect-auth/core/LoginRisk";
+
+export const SimpleEmailApprovalPolicyLive = LoginApprovalPolicyLive({
+  mode: "new-device",
+  channel: "email",
+  sessionBinding: "originating-device",
+  requireForUnverifiedEmail: true,
+  skipMethods: ["passkey"],
+  skipWhenAalAtLeast: "aal2",
+});
+
+export const RiskBasedApprovalPolicyLive = Layer.succeed(
+  LoginApprovalPolicy,
+  LoginApprovalPolicy.custom((input) =>
+    Effect.succeed(
+      input.risk.hasSignal("impossible-travel")
+        ? LoginApprovalDecision.emailCode({
+            reason: "impossible-travel",
+          })
+        : LoginApprovalDecision.continue()
+    )
+  )
+);
+
+export const AppLoginRiskEngineLive = Layer.succeed(
+  LoginRiskEngine,
+  LoginRiskEngine.custom((input) =>
+    Effect.succeed(
+      input.request?.country === "AU"
+        ? LoginRiskContext.make({
+            level: "critical",
+            signals: [
+              LoginRiskSignal.make({
+                type: "impossible-travel",
+                level: "critical",
+              }),
+            ],
+          })
+        : LoginRiskContext.make({ level: "low", signals: [] })
+    )
+  )
+);
+
+export const AppLoginApprovalLive = Layer.mergeAll(
+  AppLoginRiskEngineLive,
+  AuthFlowStateLive(),
+  LoginApprovalLive(),
+  LoginApprovalFlowLive,
+  LoginApprovalDeliveryFromAuthMailerLive,
+  AuthFlowLive
+);
+```
+
+The default preset policy is `mode: "never"`. Passkeys or other high-assurance methods can bypass preset approval with `skipMethods` or `skipWhenAalAtLeast`. Approval `channel` and `reason` are open strings, so apps can model `admin`, `sms`, `push`, `manual-review`, or risk-specific reasons without extending core. `LoginApprovalDecision.emailCode`, `emailLink`, `sms`, `adminReview`, and `custom` set semantic `sessionBinding`; `sameDeviceRequired` remains available as the low-level legacy flag. `adminReview` uses `sessionBinding: "none"`, `LoginApprovalReview.approve` / `deny` record the out-of-band decision, and `LoginApprovalFinalize.complete` creates the session only for the originating device. Email is required only for the built-in email delivery path; non-email channels can omit it and use a custom `LoginApprovalDelivery`. `AuthFlow` always supplies policy with typed `device` and `risk`; the default risk engine returns `LoginRiskContext.make({ level: "unknown", signals: [] })`, and apps can provide `LoginRiskEngine` to calculate impossible travel, IP reputation, tenant policy, or other risk signals. `LoginRiskContext` and `LoginRiskSignal` are `Schema.Class` values, so custom engines should return `LoginRiskContext.make(...)`; policies can use helpers such as `input.risk.hasSignal(...)`, `input.risk.getSignal(...)`, and `input.risk.isAtLeast(...)`. `LoginRiskEngine` receives request context only when the primary-factor integration supplies it; core does not trust proxy or geo headers by default.
+
+`LoginApproval.inspect` validates a login approval challenge without consuming it. Use it for GET preview pages or admin panels that need to display pending approval details. For admin, push, or Slack approvals, configure `LoginApprovalReview` with a persistent store, let the out-of-band actor call `approve` or `deny`, then have the user's original browser poll review status and call `LoginApprovalFinalize.complete` with its pending-cookie secret. The built-in HTTP API exposes this originating-browser path as `POST /auth/login-approval/status` and `POST /auth/login-approval/finalize`, also available as `client.loginApproval.status(...)` and `client.loginApproval.finalize(...)`. `KyselyAuthStorageLive` and `EffectQbSqliteAuthStorageLive` provide durable `LoginApprovalReviewStore`; the included `LoginApprovalReviewStoreMemoryLive` is for tests and local composition.
+
+`AuthFlowState` stores a short-lived, single-use pending primary-factor result in the existing challenge store. It is the bridge between “password/passkey/OTP verified” and “approval/MFA completed, now create a session”. The stored state contains `userId`, `method`, `amr`, `aal`, optional session claims, and app metadata such as `redirectTo`.
+
+```ts
+import { AuthFlowStateLive } from "@effect-auth/core/AuthFlow";
+
+export const AppAuthFlowStateLive = AuthFlowStateLive();
+```
+
+## Trusted Devices
+
+`TrustedDevice` is a small boundary for “remember this device” login policy. It stores only an HMAC hash of an opaque device token and returns `LoginDeviceContext` as `unknown`, `new`, or `known`. `LoginApprovalPolicy({ mode: "new-device" })` can use that context to require approval only for first-time devices.
+
+```ts
+import { Layer, Redacted } from "effect";
+import {
+  TrustedDeviceCookieLive,
+  TrustedDeviceLive,
+  TrustedDeviceStoreMemoryLive,
+} from "@effect-auth/core/TrustedDevice";
+
+export const AppTrustedDeviceLive = Layer.mergeAll(
+  TrustedDeviceStoreMemoryLive,
+  TrustedDeviceLive({ secret: Redacted.make("trusted-device-secret") }),
+  TrustedDeviceCookieLive()
+);
+```
+
+The built-in password sign-in, email OTP verify, and magic-link verify HTTP handlers read the HttpOnly `__Host-auth-device` cookie when `TrustedDeviceCookie` is provided and pass the trusted-device token into `AuthFlow`; `AuthFlow` resolves the device status centrally with `TrustedDevice`. `POST /auth/login-approval/approve` accepts `rememberDevice: true`; when `TrustedDevice` and `TrustedDeviceCookie` are provided it trusts the approved user/device and sets `__Host-auth-device` with the final session response. `KyselyAuthStorageLive` and `EffectQbSqliteAuthStorageLive` provide durable `TrustedDeviceStore`; the in-memory store is intended for tests and local composition.
+
 ## Challenge
 
 `Challenge` is the shared primitive for short-lived proofs: email OTP, magic link, passkey challenges, OAuth state, reset password, and MFA.
@@ -640,8 +769,14 @@ The first storage adapter is Kysely-based. Applications own their Kysely instanc
 ```ts
 import { makeKyselyStorage } from "@effect-auth/core/KyselyStorage";
 
-const { userStore, credentialStore, sessionStore, verificationStore } =
-  makeKyselyStorage(db);
+const {
+  userStore,
+  credentialStore,
+  sessionStore,
+  verificationStore,
+  loginApprovalReviewStore,
+  trustedDeviceStore,
+} = makeKyselyStorage(db);
 ```
 
 For Cloudflare D1, use the first-party Kysely dialect instead of an external D1 dialect package:
@@ -661,7 +796,7 @@ const db = makeD1Kysely<DB>(env.DB);
 const StorageLive = KyselyAuthStorageLive(db);
 ```
 
-The default schema expects `auth_user`, `auth_credential`, `auth_session`, and `auth_verification` tables in the Kysely database type:
+The default schema expects `auth_user`, `auth_credential`, `auth_session`, `auth_verification`, `auth_login_approval_review`, `auth_trusted_device`, and `auth_passkey_credential` tables in the Kysely database type:
 
 ```ts
 import type { KyselyAuthDatabase } from "@effect-auth/core/KyselyStorage";
@@ -747,7 +882,7 @@ const authTables = defineEffectQbAuthTables({
       }) satisfies Query.MutationInputOf<Table.UpdateOf<typeof users>>,
   },
 
-  // credential/session/verification mappings follow the same pattern.
+  // credential/session/verification/review/trusted-device mappings follow the same pattern.
 });
 
 const StorageLive = EffectQbSqliteAuthStorageLive(executor, {

package/dist/ApiKey.d.ts

@@ -0,0 +1,207 @@
+import { Brand, Context, Effect, Layer, Redacted } from "effect";
+import type * as OptionTypes from "effect/Option";
+import { Crypto } from "./Crypto.js";
+import type { CryptoService } from "./Crypto.js";
+import type { UnixMillis, UserId } from "./Identifiers.js";
+export type ApiKeyId = Brand.Branded<string, "auth/ApiKeyId">;
+export declare const ApiKeyId: Brand.Constructor<ApiKeyId>;
+export type ApiKeyPrefix = Brand.Branded<string, "auth/ApiKeyPrefix">;
+export declare const ApiKeyPrefix: Brand.Constructor<ApiKeyPrefix>;
+export type ApiKeySecret = Brand.Branded<string, "auth/ApiKeySecret">;
+export declare const ApiKeySecret: Brand.Constructor<ApiKeySecret>;
+export type ApiKeySecretHash = Brand.Branded<string, "auth/ApiKeySecretHash">;
+export declare const ApiKeySecretHash: Brand.Constructor<ApiKeySecretHash>;
+export declare const defaultApiKeyPrefixBytes = 8;
+export declare const defaultApiKeySecretBytes = 32;
+export declare const defaultApiKeyIdBytes = 16;
+export type ApiKeyOperation = "generate" | "parse" | "hash" | "verify";
+declare const ApiKeyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ApiKeyError";
+} & Readonly<A>;
+export declare class ApiKeyError extends ApiKeyError_base<{
+    readonly operation: ApiKeyOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface ApiKeyGenerateInput {
+    readonly prefixBytes?: number;
+    readonly secretBytes?: number;
+}
+export interface GeneratedApiKeySecret {
+    readonly prefix: ApiKeyPrefix;
+    readonly secret: Redacted.Redacted<ApiKeySecret>;
+}
+export interface ApiKeyHashInput {
+    readonly secret: Redacted.Redacted<string>;
+}
+export interface ApiKeyVerifyInput extends ApiKeyHashInput {
+    readonly hash: ApiKeySecretHash;
+}
+export interface ApiKeysService {
+    readonly generate: (input?: ApiKeyGenerateInput) => Effect.Effect<GeneratedApiKeySecret, ApiKeyError>;
+    readonly parse: (secret: Redacted.Redacted<string>) => Effect.Effect<ApiKeyPrefix, ApiKeyError>;
+    readonly hash: (input: ApiKeyHashInput) => Effect.Effect<ApiKeySecretHash, ApiKeyError>;
+    readonly verify: (input: ApiKeyVerifyInput) => Effect.Effect<boolean, ApiKeyError>;
+}
+declare const ApiKeys_base: Context.ServiceClass<ApiKeys, "auth/ApiKeys", ApiKeysService>;
+export declare class ApiKeys extends ApiKeys_base {
+}
+export declare namespace ApiKeys {
+    const make: (service: ApiKeysService) => ApiKeysService;
+}
+export interface ApiKeysDependencies {
+    readonly crypto: CryptoService;
+}
+export declare const makeApiKeys: (dependencies: ApiKeysDependencies) => ApiKeysService;
+export declare const ApiKeysLive: Layer.Layer<ApiKeys, never, Crypto>;
+export interface ApiKeyRecord {
+    readonly id: ApiKeyId;
+    readonly userId: UserId;
+    readonly prefix: ApiKeyPrefix;
+    readonly secretHash: ApiKeySecretHash;
+    readonly scopes: readonly string[];
+    readonly createdAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly lastUsedAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface ApiKeyListByUserInput {
+    readonly userId: UserId;
+    readonly includeRevoked?: boolean;
+}
+export interface ApiKeyMarkUsedInput {
+    readonly id: ApiKeyId;
+    readonly lastUsedAt: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface ApiKeyRevokeInput {
+    readonly id: ApiKeyId;
+    readonly revokedAt: UnixMillis;
+    readonly reason?: string;
+}
+export type ApiKeyStoreOperation = "insert" | "find" | "list" | "mark-used" | "revoke";
+declare const ApiKeyStoreError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ApiKeyStoreError";
+} & Readonly<A>;
+export declare class ApiKeyStoreError extends ApiKeyStoreError_base<{
+    readonly operation: ApiKeyStoreOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface ApiKeyStoreService {
+    readonly insert: (row: ApiKeyRecord) => Effect.Effect<void, ApiKeyStoreError>;
+    readonly findById: (id: ApiKeyId) => Effect.Effect<OptionTypes.Option<ApiKeyRecord>, ApiKeyStoreError>;
+    readonly findByPrefix: (prefix: ApiKeyPrefix) => Effect.Effect<OptionTypes.Option<ApiKeyRecord>, ApiKeyStoreError>;
+    readonly listByUser: (input: ApiKeyListByUserInput) => Effect.Effect<readonly ApiKeyRecord[], ApiKeyStoreError>;
+    readonly markUsed: (input: ApiKeyMarkUsedInput) => Effect.Effect<OptionTypes.Option<ApiKeyRecord>, ApiKeyStoreError>;
+    readonly revoke: (input: ApiKeyRevokeInput) => Effect.Effect<void, ApiKeyStoreError>;
+}
+declare const ApiKeyStore_base: Context.ServiceClass<ApiKeyStore, "auth/ApiKeyStore", ApiKeyStoreService>;
+export declare class ApiKeyStore extends ApiKeyStore_base {
+}
+export declare namespace ApiKeyStore {
+    const make: (service: ApiKeyStoreService) => ApiKeyStoreService;
+}
+export declare const makeApiKeyStoreMemory: () => ApiKeyStoreService;
+export declare const ApiKeyStoreMemoryLive: Layer.Layer<ApiKeyStore, never, never>;
+export interface ApiKeyInfo {
+    readonly id: ApiKeyId;
+    readonly userId: UserId;
+    readonly prefix: ApiKeyPrefix;
+    readonly scopes: readonly string[];
+    readonly createdAt: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly lastUsedAt?: UnixMillis;
+    readonly revokedAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface ApiKeyCreateForUserInput {
+    readonly userId: UserId;
+    readonly keyId?: ApiKeyId;
+    readonly scopes?: readonly string[];
+    readonly now?: UnixMillis;
+    readonly expiresAt?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface CreatedApiKey {
+    readonly secret: Redacted.Redacted<ApiKeySecret>;
+    readonly key: ApiKeyInfo;
+}
+export interface ApiKeyManagementListInput {
+    readonly userId: UserId;
+    readonly includeRevoked?: boolean;
+}
+export interface ApiKeyManagementRevokeInput {
+    readonly userId: UserId;
+    readonly keyId: ApiKeyId;
+    readonly revokedAt?: UnixMillis;
+    readonly reason?: string;
+}
+export type ApiKeyManagementOperation = "create" | "list" | "revoke";
+declare const ApiKeyManagementError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ApiKeyManagementError";
+} & Readonly<A>;
+export declare class ApiKeyManagementError extends ApiKeyManagementError_base<{
+    readonly operation: ApiKeyManagementOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface ApiKeyManagementService {
+    readonly createForUser: (input: ApiKeyCreateForUserInput) => Effect.Effect<CreatedApiKey, ApiKeyManagementError>;
+    readonly listForUser: (input: ApiKeyManagementListInput) => Effect.Effect<readonly ApiKeyInfo[], ApiKeyManagementError>;
+    readonly revokeForUser: (input: ApiKeyManagementRevokeInput) => Effect.Effect<void, ApiKeyManagementError>;
+}
+declare const ApiKeyManagement_base: Context.ServiceClass<ApiKeyManagement, "auth/ApiKeyManagement", ApiKeyManagementService>;
+export declare class ApiKeyManagement extends ApiKeyManagement_base {
+}
+export declare namespace ApiKeyManagement {
+    const make: (service: ApiKeyManagementService) => ApiKeyManagementService;
+}
+export interface ApiKeyManagementDependencies {
+    readonly apiKeys: ApiKeysService;
+    readonly crypto: CryptoService;
+    readonly keyStore: ApiKeyStoreService;
+    readonly keyIdBytes?: number;
+}
+export declare const makeApiKeyManagement: (dependencies: ApiKeyManagementDependencies) => ApiKeyManagementService;
+export declare const ApiKeyManagementLive: Layer.Layer<ApiKeyManagement, never, Crypto | ApiKeys | ApiKeyStore>;
+export interface ApiKeyVerificationInput {
+    readonly secret: Redacted.Redacted<string>;
+    readonly now?: UnixMillis;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface ApiKeyVerificationResult {
+    readonly valid: boolean;
+    readonly key?: ApiKeyInfo;
+}
+export type ApiKeyVerificationOperation = "verify";
+declare const ApiKeyVerificationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ApiKeyVerificationError";
+} & Readonly<A>;
+export declare class ApiKeyVerificationError extends ApiKeyVerificationError_base<{
+    readonly operation: ApiKeyVerificationOperation;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface ApiKeyVerificationService {
+    readonly verify: (input: ApiKeyVerificationInput) => Effect.Effect<ApiKeyVerificationResult, ApiKeyVerificationError>;
+}
+declare const ApiKeyVerification_base: Context.ServiceClass<ApiKeyVerification, "auth/ApiKeyVerification", ApiKeyVerificationService>;
+export declare class ApiKeyVerification extends ApiKeyVerification_base {
+}
+export declare namespace ApiKeyVerification {
+    const make: (service: ApiKeyVerificationService) => ApiKeyVerificationService;
+}
+export interface ApiKeyVerificationDependencies {
+    readonly apiKeys: ApiKeysService;
+    readonly keyStore: ApiKeyStoreService;
+}
+export declare const makeApiKeyVerification: (dependencies: ApiKeyVerificationDependencies) => ApiKeyVerificationService;
+export declare const ApiKeyVerificationLive: Layer.Layer<ApiKeyVerification, never, ApiKeys | ApiKeyStore>;
+export {};
+//# sourceMappingURL=ApiKey.d.ts.map

package/dist/ApiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey.d.ts","sourceRoot":"","sources":["../src/ApiKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAU,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,KAAK,KAAK,WAAW,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG3D,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC9D,eAAO,MAAM,QAAQ,6BAA4B,CAAC;AAElD,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AACtE,eAAO,MAAM,YAAY,iCAAgC,CAAC;AAE1D,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AACtE,eAAO,MAAM,YAAY,iCAAgC,CAAC;AAE1D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAC9E,eAAO,MAAM,gBAAgB,qCAAoC,CAAC;AAElE,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;;;;AAEvE,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,CAAC,EAAE,mBAAmB,KACxB,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,CACd,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAC9B,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,iBAAiB,KACrB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;CAC1C;;AAED,qBAAa,OAAQ,SAAQ,YAE5B;CAAG;AAEJ,yBAAiB,OAAO,CAAC;IAChB,MAAM,IAAI,GAAI,SAAS,cAAc,KAAG,cAC1B,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAsDD,eAAO,MAAM,WAAW,GAAI,cAAc,mBAAmB,KAAG,cAoE5D,CAAC;AAEL,eAAO,MAAM,WAAW,qCAMvB,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,GACR,MAAM,GACN,MAAM,GACN,WAAW,GACX,QAAQ,CAAC;;;;AAEb,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,CACjB,EAAE,EAAE,QAAQ,KACT,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvE,QAAQ,CAAC,YAAY,EAAE,CACrB,MAAM,EAAE,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvE,QAAQ,CAAC,UAAU,EAAE,CACnB,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,SAAS,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC9D,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;CACtF;;AAED,qBAAa,WAAY,SAAQ,gBAGV;CAAG;AAE1B,yBAAiB,WAAW,CAAC;IACpB,MAAM,IAAI,GAAI,SAAS,kBAAkB,KAAG,kBAC1B,CAAC;CAC3B;AAaD,eAAO,MAAM,qBAAqB,QAAO,kBAmExC,CAAC;AAEF,eAAO,MAAM,qBAAqB,wCAEjC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;;;;AAErE,qBAAa,qBAAsB,SAAQ,2BAEzC;IACA,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,CACtB,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,yBAAyB,KAC7B,MAAM,CAAC,MAAM,CAAC,SAAS,UAAU,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,CACtB,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;CACjD;;AAED,qBAAa,gBAAiB,SAAQ,qBAGV;CAAG;AAE/B,yBAAiB,gBAAgB,CAAC;IACzB,MAAM,IAAI,GACf,SAAS,uBAAuB,KAC/B,uBAAuD,CAAC;CAC5D;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAsDD,eAAO,MAAM,oBAAoB,GAC/B,cAAc,4BAA4B,KACzC,uBA2EC,CAAC;AAEL,eAAO,MAAM,oBAAoB,sEAQhC,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;;;;AAEnD,qBAAa,uBAAwB,SAAQ,6BAE3C;IACA,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,CAAC;CACvE;;AAED,qBAAa,kBAAmB,SAAQ,uBAGV;CAAG;AAEjC,yBAAiB,kBAAkB,CAAC;IAC3B,MAAM,IAAI,GACf,SAAS,yBAAyB,KACjC,yBAA2D,CAAC;CAChE;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAYD,eAAO,MAAM,sBAAsB,GACjC,cAAc,8BAA8B,KAC3C,yBA4DC,CAAC;AAEL,eAAO,MAAM,sBAAsB,+DAOlC,CAAC"}