@yielded/auth 0.1.0-beta.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel van der Merwe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,18 @@
+# @yielded/auth
+
+Composable authentication workflows for Effect applications: sign-in, sessions,
+OAuth, passwords, passkeys, email and phone proofs, and TOTP.
+
+```sh
+vp add @yielded/auth@beta effect@4.0.0-rc.112
+```
+
+The package owns security-sensitive workflow contracts. Applications own identity,
+persistence, protocol verification, and delivery adapters. Resources live in the
+caller’s Scope; credentials stay outside public results and telemetry.
+
+Optional database, platform, browser, and OAuth adapters have separate exports.
+The root import does not load their peer dependencies. Effect is supplied by the host.
+
+See the [authentication guide](https://github.com/danieljvdm/effect-auth/blob/main/docs/guide/authentication.md)
+and [consumer examples](https://github.com/danieljvdm/effect-auth/tree/main/examples/auth).

package/dist/Atom.d.mts

@@ -0,0 +1,5 @@
+import { AuthAtomLifetime, AuthSubjectLifetime, makeLifetime } from "./atom/AuthAtomLifetime.mjs";
+import { AuthAtomWorkflow } from "./atom/AuthAtomWorkflow.mjs";
+import { ReactivityKeys, mutation, query, workflow } from "./atom/operations.mjs";
+import { AuthActionAtom, AuthAtomOptions, AuthAtoms, make } from "./atom/client.mjs";
+export { type AuthActionAtom, AuthAtomLifetime, type AuthAtomOptions, AuthAtomWorkflow, type AuthAtoms, type AuthSubjectLifetime, type ReactivityKeys, make, makeLifetime, mutation, query, workflow };

package/dist/Atom.mjs

@@ -0,0 +1,5 @@
+import { AuthAtomLifetime, makeLifetime } from "./atom/AuthAtomLifetime.mjs";
+import { AuthAtomWorkflow } from "./atom/AuthAtomWorkflow.mjs";
+import { mutation, query, workflow } from "./atom/operations.mjs";
+import { make } from "./atom/client.mjs";
+export { AuthAtomLifetime, AuthAtomWorkflow, make, makeLifetime, mutation, query, workflow };

package/dist/Auth.d.mts

@@ -0,0 +1,9 @@
+import { AuthenticationRequired } from "./operations/errors.mjs";
+import { RequestBindingConfig } from "./operations/RequestBindingConfig.mjs";
+import { SessionApi, SessionApiError } from "./auth/session.mjs";
+import { AuthRequest } from "./auth/AuthRequest.mjs";
+import { AuthConfigurationError } from "./auth/AuthConfigurationError.mjs";
+import { BindingOf, ClaimsCodec, StrategyBinding, StrategyDefinition, StrategyTypeLambda } from "./auth/definition.mjs";
+import { AuthApi, AuthService, Options, Service, make } from "./auth/Auth.mjs";
+import { AuthMethod, makeAuthStrategy } from "./auth/AuthStrategy.mjs";
+export { type AuthApi, AuthConfigurationError, type AuthMethod, AuthRequest, type AuthService, AuthenticationRequired, type BindingOf, type ClaimsCodec, type Options, RequestBindingConfig, Service, type SessionApi, type SessionApiError, type StrategyBinding, type StrategyDefinition, type StrategyTypeLambda, make, makeAuthStrategy as makeStrategy };

package/dist/Auth.mjs

@@ -0,0 +1,7 @@
+import { AuthenticationRequired } from "./operations/errors.mjs";
+import { AuthConfigurationError } from "./auth/AuthConfigurationError.mjs";
+import { AuthRequest } from "./auth/AuthRequest.mjs";
+import { Service, make } from "./auth/Auth.mjs";
+import { makeAuthStrategy } from "./auth/AuthStrategy.mjs";
+import { RequestBindingConfig } from "./operations/RequestBindingConfig.mjs";
+export { AuthConfigurationError, AuthRequest, AuthenticationRequired, RequestBindingConfig, Service, make, makeAuthStrategy as makeStrategy };

package/dist/AuthContract.d.mts

@@ -0,0 +1,4 @@
+import { ActionDefinitions, ActionError, ActionInput, ActionOptions, ActionSuccess, AnyAuthAction, AnyAuthContract, AuthActions, action, fromOperation, make } from "./operations/actions.mjs";
+import { signIn } from "./password/methods/contracts.mjs";
+import { httpGroup } from "./http/auth-contract.mjs";
+export { type ActionDefinitions, type ActionError, type ActionInput, type ActionOptions, type ActionSuccess, type AnyAuthAction, type AnyAuthContract, type AuthActions, action, fromOperation, httpGroup, make, signIn as passwordSignIn };

package/dist/AuthContract.mjs

@@ -0,0 +1,4 @@
+import { action, fromOperation, make } from "./operations/actions.mjs";
+import { signIn } from "./password/methods/contracts.mjs";
+import { httpGroup } from "./http/auth-contract.mjs";
+export { action, fromOperation, httpGroup, make, signIn as passwordSignIn };

package/dist/AuthSession.d.mts

@@ -0,0 +1,82 @@
+import { Email, SessionClaims, SessionSummary, SubjectId } from "./Schema.mjs";
+import { AuthTokenError, IdentityResolutionError, InvalidSession } from "./Errors.mjs";
+import { AuthTokenCodec } from "./AuthTokenCodec.mjs";
+import { Context, Crypto, Effect, Layer, Option, Redacted, Schema } from "effect";
+//#region src/AuthSession.d.ts
+declare const IssuedSession_base: Schema.Class<IssuedSession, Schema.Struct<{
+  readonly token: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionToken">;
+  readonly summary: typeof SessionSummary;
+}>, {}>;
+declare class IssuedSession extends IssuedSession_base {}
+/** A verified session and an optional replacement issued by rolling renewal. */
+interface VerifiedSession {
+  readonly claims: SessionClaims;
+  readonly renewal: Option.Option<IssuedSession>;
+}
+interface IssueSessionOptions {
+  /** App-defined claims, signed into the envelope but opaque to effect-auth. */
+  readonly ext?: unknown;
+}
+/** Flow data available when effect-auth issues a session through its HTTP API. */
+interface SessionExtContext {
+  readonly subjectId: SubjectId;
+  readonly email: Email;
+}
+/** A verified session whose app-defined extension has been decoded by its schema. */
+interface VerifiedSessionWithExt<A> extends VerifiedSession {
+  readonly ext: Option.Option<A>;
+}
+interface AuthSessionWithExtService<A> {
+  readonly issue: (subjectId: SubjectId, ext: A) => Effect.Effect<IssuedSession, AuthTokenError>;
+  readonly verify: (token: Redacted.Redacted<string>) => Effect.Effect<VerifiedSessionWithExt<A>, InvalidSession | AuthTokenError>;
+  /** Verifies the token and renews it when the configured rolling interval is due. */
+  readonly verifyAndRenew: (token: Redacted.Redacted<string>) => Effect.Effect<VerifiedSessionWithExt<A>, InvalidSession | AuthTokenError | IdentityResolutionError>;
+  /** Issues from flow data using the optional builder in the declaration. */
+  readonly issueFromContext: (context: SessionExtContext) => Effect.Effect<IssuedSession, AuthTokenError>;
+}
+type SessionExtBuilder<A> = (context: SessionExtContext) => Effect.Effect<A>;
+type AuthSessionWithExtOptions<S extends Schema.Codec<unknown, unknown>> = {
+  /** App-defined claims schema. The decoded type becomes the service extension type. */
+  readonly ext: S;
+} & (SessionExtContext extends S["Encoded"] ? {
+  /** Overrides automatic decoding from the HTTP session context. */
+  readonly build?: SessionExtBuilder<NoInfer<S["Type"]>>;
+} : {
+  /** Required when the schema cannot decode the HTTP session context directly. */
+  readonly build: SessionExtBuilder<NoInfer<S["Type"]>>;
+});
+type AuthSessionWithExtDefinition<S extends Schema.Codec<unknown, unknown>> = SessionExtContext extends S["Encoded"] ? S | AuthSessionWithExtOptions<S> : AuthSessionWithExtOptions<S>;
+/** Context service class produced by {@link AuthSession.WithExt}. */
+interface AuthSessionWithExtClass<Self, Id extends string, A> extends Context.ServiceClass<Self, Id, AuthSessionWithExtService<A>> {
+  readonly ext: Schema.Codec<A, unknown>;
+  readonly layer: Layer.Layer<Self, never, AuthSession>;
+}
+declare const makeAuthSessionWithExt: <Self>() => <const Id extends string, S extends Schema.Codec<unknown, unknown>>(id: Id, definition: AuthSessionWithExtDefinition<S>) => AuthSessionWithExtClass<Self, Id, S["Type"]>;
+declare const AuthSession_base: Context.ServiceClass<AuthSession, "effect-auth/AuthSession", {
+  readonly issue: (subjectId: SubjectId, options?: IssueSessionOptions) => Effect.Effect<IssuedSession, AuthTokenError>;
+  readonly verify: (token: Redacted.Redacted<string>) => Effect.Effect<SessionClaims, InvalidSession | AuthTokenError>;
+  /** Verifies the token and issues a replacement when rolling renewal is due. */
+  readonly verifyAndRenew: (token: Redacted.Redacted<string>) => Effect.Effect<VerifiedSession, InvalidSession | AuthTokenError | IdentityResolutionError>;
+}>;
+/**
+ * Stateless session issuance and verification. Each token has a fixed expiry;
+ * authenticated HTTP activity can replace it after the configured renewal
+ * interval. There is no per-session revocation. Sign-out removes the browser
+ * cookie, and bulk invalidation happens through key removal or by bumping the
+ * configured session generation.
+ */
+declare class AuthSession extends AuthSession_base {
+  /**
+   * Declares an app-typed session service from one extension schema. Passing
+   * the schema directly automatically constructs extensions from compatible
+   * HTTP session context; schemas with derived inputs provide a `build`
+   * override. The core service remains opaque: this wrapper encodes before
+   * issuance and decodes after verification, preserving `None` for legacy or
+   * undecodable extensions.
+   */
+  static readonly WithExt: typeof makeAuthSessionWithExt;
+  static readonly layer: Layer.Layer<AuthSession, never, AuthTokenCodec | Crypto.Crypto>;
+}
+//#endregion
+export { AuthSession, AuthSessionWithExtClass, AuthSessionWithExtService, IssueSessionOptions, IssuedSession, SessionExtBuilder, SessionExtContext, VerifiedSession, VerifiedSessionWithExt };
+//# sourceMappingURL=AuthSession.d.mts.map

package/dist/AuthSession.mjs

@@ -0,0 +1,138 @@
+import { SessionClaims, SessionSummary, SessionToken, SessionTokenId } from "./Schema.mjs";
+import { AuthTokenError } from "./Errors.mjs";
+import { AuthTokenCodec } from "./AuthTokenCodec.mjs";
+import { AuthPolicy, revalidateSessionClaims } from "./Policy.mjs";
+import { Context, Crypto, DateTime, Duration, Effect, Layer, Option, Schema } from "effect";
+//#region src/AuthSession.ts
+var IssuedSession = class extends Schema.Class("effect-auth/IssuedSession")({
+	token: SessionToken,
+	summary: SessionSummary
+}) {};
+const decodeSessionTokenId = Schema.decodeEffect(SessionTokenId);
+const makeAuthSessionWithExt = () => (id, definition) => {
+	const definitionIsSchema = Schema.isSchema(definition);
+	const ext = definitionIsSchema ? definition : definition.ext;
+	const build = definitionIsSchema ? void 0 : definition.build;
+	const Service = Context.Service()(id);
+	const extCodec = ext;
+	const encodeExt = Schema.encodeEffect(extCodec);
+	const decodeContext = Schema.decodeEffect(extCodec);
+	const decodeExt = Schema.decodeUnknownEffect(ext);
+	const layer = Layer.effect(Service, Effect.map(AuthSession, (sessions) => {
+		const issue = Effect.fn(`${id}.issue`)(function* (subjectId, ext) {
+			const encoded = yield* encodeExt(ext).pipe(Effect.mapError((error) => AuthTokenError.make({ message: `Session extension encoding failed: ${error.message}` })));
+			return yield* sessions.issue(subjectId, { ext: encoded });
+		});
+		return Service.of({
+			issue,
+			verify: Effect.fn(`${id}.verify`)(function* (token) {
+				const claims = yield* sessions.verify(token);
+				return {
+					claims,
+					ext: yield* Effect.option(decodeExt(claims.ext)),
+					renewal: Option.none()
+				};
+			}),
+			verifyAndRenew: Effect.fn(`${id}.verifyAndRenew`)(function* (token) {
+				const verified = yield* sessions.verifyAndRenew(token);
+				const ext = yield* Effect.option(decodeExt(verified.claims.ext));
+				return {
+					...verified,
+					ext
+				};
+			}),
+			issueFromContext: Effect.fn(`${id}.issueFromContext`)(function* (context) {
+				const ext = build === void 0 ? yield* decodeContext(context).pipe(Effect.mapError((error) => AuthTokenError.make({ message: `Session extension construction failed: ${error.message}` }))) : yield* build(context);
+				return yield* issue(context.subjectId, ext);
+			})
+		});
+	}));
+	return Object.assign(Service, {
+		ext,
+		layer
+	});
+};
+/**
+* Stateless session issuance and verification. Each token has a fixed expiry;
+* authenticated HTTP activity can replace it after the configured renewal
+* interval. There is no per-session revocation. Sign-out removes the browser
+* cookie, and bulk invalidation happens through key removal or by bumping the
+* configured session generation.
+*/
+var AuthSession = class AuthSession extends Context.Service()("effect-auth/AuthSession") {
+	/**
+	* Declares an app-typed session service from one extension schema. Passing
+	* the schema directly automatically constructs extensions from compatible
+	* HTTP session context; schemas with derived inputs provide a `build`
+	* override. The core service remains opaque: this wrapper encodes before
+	* issuance and decodes after verification, preserving `None` for legacy or
+	* undecodable extensions.
+	*/
+	static WithExt = makeAuthSessionWithExt;
+	static layer = Layer.effect(AuthSession)(Effect.gen(function* () {
+		const policy = yield* AuthPolicy;
+		const codec = yield* AuthTokenCodec;
+		const crypto = yield* Crypto.Crypto;
+		const issue = Effect.fn("AuthSession.issue")(function* (subjectId, options) {
+			const now = yield* DateTime.now;
+			const expiresAt = DateTime.addDuration(now, policy.sessionLifetime);
+			const uuid = yield* crypto.randomUUIDv4.pipe(Effect.mapError(() => AuthTokenError.make({ message: "Secure randomness unavailable" })));
+			const tokenId = yield* decodeSessionTokenId(uuid).pipe(Effect.orDie);
+			const claims = SessionClaims.make({
+				ver: 1,
+				gen: policy.sessionGeneration,
+				kid: codec.activeKeyId,
+				sub: subjectId,
+				...options?.ext === void 0 ? {} : { ext: options.ext },
+				iss: policy.issuer,
+				aud: policy.audience,
+				iat: now,
+				exp: expiresAt,
+				jti: tokenId
+			});
+			const token = yield* codec.encodeSession(claims);
+			return IssuedSession.make({
+				token,
+				summary: SessionSummary.make({
+					subjectId,
+					expiresAt
+				})
+			});
+		});
+		const verify = Effect.fn("AuthSession.verify")(function* (token) {
+			const claims = yield* codec.decodeSession(token);
+			return yield* revalidateSessionClaims(claims, {
+				issuer: policy.issuer,
+				audience: policy.audience,
+				sessionGeneration: policy.sessionGeneration,
+				allowedSigningKeyIds: new Set(codec.keyIds)
+			});
+		});
+		const renewIfDue = Effect.fn("AuthSession.renewIfDue")(function* (claims) {
+			const now = yield* DateTime.now;
+			const issuedAtMillis = DateTime.toEpochMillis(claims.iat);
+			const tokenLifetimeMillis = DateTime.toEpochMillis(claims.exp) - issuedAtMillis;
+			const tokenAgeMillis = DateTime.toEpochMillis(now) - issuedAtMillis;
+			const configuredLifetimeMillis = Duration.toMillis(policy.sessionLifetime);
+			const renewalIntervalMillis = Duration.toMillis(policy.sessionRenewalInterval);
+			if (!(tokenLifetimeMillis !== configuredLifetimeMillis || tokenAgeMillis >= renewalIntervalMillis)) return Option.none();
+			const renewed = yield* issue(claims.sub, claims.ext === void 0 ? void 0 : { ext: claims.ext });
+			return Option.some(renewed);
+		});
+		return AuthSession.of({
+			issue,
+			verify,
+			verifyAndRenew: Effect.fn("AuthSession.verifyAndRenew")(function* (token) {
+				const claims = yield* verify(token);
+				return {
+					claims,
+					renewal: yield* renewIfDue(claims)
+				};
+			})
+		});
+	}));
+};
+//#endregion
+export { AuthSession, IssuedSession };
+
+//# sourceMappingURL=AuthSession.mjs.map

package/dist/AuthSession.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthSession.mjs","names":[],"sources":["../src/AuthSession.ts"],"sourcesContent":["import {\n  Context,\n  Crypto,\n  DateTime,\n  Duration,\n  Effect,\n  Layer,\n  Option,\n  type Redacted,\n  Schema,\n} from \"effect\";\n\nimport { AuthTokenCodec } from \"./AuthTokenCodec\";\nimport type { IdentityResolutionError, InvalidSession } from \"./Errors\";\nimport { AuthTokenError } from \"./Errors\";\nimport { AuthPolicy, revalidateSessionClaims } from \"./Policy\";\nimport {\n  type Email,\n  type SubjectId,\n  SessionClaims,\n  SessionSummary,\n  SessionToken,\n  SessionTokenId,\n} from \"./Schema\";\n\nexport class IssuedSession extends Schema.Class<IssuedSession>(\"effect-auth/IssuedSession\")({\n  token: SessionToken,\n  summary: SessionSummary,\n}) {}\n\n/** A verified session and an optional replacement issued by rolling renewal. */\nexport interface VerifiedSession {\n  readonly claims: SessionClaims;\n  readonly renewal: Option.Option<IssuedSession>;\n}\n\nconst decodeSessionTokenId = Schema.decodeEffect(SessionTokenId);\n\nexport interface IssueSessionOptions {\n  /** App-defined claims, signed into the envelope but opaque to effect-auth. */\n  readonly ext?: unknown;\n}\n\n/** Flow data available when effect-auth issues a session through its HTTP API. */\nexport interface SessionExtContext {\n  readonly subjectId: SubjectId;\n  readonly email: Email;\n}\n\n/** A verified session whose app-defined extension has been decoded by its schema. */\nexport interface VerifiedSessionWithExt<A> extends VerifiedSession {\n  readonly ext: Option.Option<A>;\n}\n\nexport interface AuthSessionWithExtService<A> {\n  readonly issue: (subjectId: SubjectId, ext: A) => Effect.Effect<IssuedSession, AuthTokenError>;\n  readonly verify: (\n    token: Redacted.Redacted<string>,\n  ) => Effect.Effect<VerifiedSessionWithExt<A>, InvalidSession | AuthTokenError>;\n  /** Verifies the token and renews it when the configured rolling interval is due. */\n  readonly verifyAndRenew: (\n    token: Redacted.Redacted<string>,\n  ) => Effect.Effect<\n    VerifiedSessionWithExt<A>,\n    InvalidSession | AuthTokenError | IdentityResolutionError\n  >;\n  /** Issues from flow data using the optional builder in the declaration. */\n  readonly issueFromContext: (\n    context: SessionExtContext,\n  ) => Effect.Effect<IssuedSession, AuthTokenError>;\n}\n\nexport type SessionExtBuilder<A> = (context: SessionExtContext) => Effect.Effect<A>;\n\ntype AuthSessionWithExtOptions<S extends Schema.Codec<unknown, unknown>> = {\n  /** App-defined claims schema. The decoded type becomes the service extension type. */\n  readonly ext: S;\n} & (SessionExtContext extends S[\"Encoded\"]\n  ? {\n      /** Overrides automatic decoding from the HTTP session context. */\n      readonly build?: SessionExtBuilder<NoInfer<S[\"Type\"]>>;\n    }\n  : {\n      /** Required when the schema cannot decode the HTTP session context directly. */\n      readonly build: SessionExtBuilder<NoInfer<S[\"Type\"]>>;\n    });\n\ntype AuthSessionWithExtDefinition<S extends Schema.Codec<unknown, unknown>> =\n  SessionExtContext extends S[\"Encoded\"]\n    ? S | AuthSessionWithExtOptions<S>\n    : AuthSessionWithExtOptions<S>;\n\n/** Context service class produced by {@link AuthSession.WithExt}. */\nexport interface AuthSessionWithExtClass<Self, Id extends string, A> extends Context.ServiceClass<\n  Self,\n  Id,\n  AuthSessionWithExtService<A>\n> {\n  readonly ext: Schema.Codec<A, unknown>;\n  readonly layer: Layer.Layer<Self, never, AuthSession>;\n}\n\nconst makeAuthSessionWithExt =\n  <Self>() =>\n  <const Id extends string, S extends Schema.Codec<unknown, unknown>>(\n    id: Id,\n    definition: AuthSessionWithExtDefinition<S>,\n  ): AuthSessionWithExtClass<Self, Id, S[\"Type\"]> => {\n    const definitionIsSchema = Schema.isSchema(definition);\n    const ext = definitionIsSchema ? (definition as S) : definition.ext;\n    const build = definitionIsSchema ? undefined : definition.build;\n    const Service = Context.Service<Self, AuthSessionWithExtService<S[\"Type\"]>>()(id);\n    const extCodec: Schema.Codec<S[\"Type\"], S[\"Encoded\"]> = ext;\n    const encodeExt = Schema.encodeEffect(extCodec);\n    const decodeContext = Schema.decodeEffect(extCodec);\n    // oxlint-disable-next-line no-restricted-properties -- SessionClaims.ext is an intentionally unknown wire boundary.\n    const decodeExt = Schema.decodeUnknownEffect(ext);\n\n    const layer = Layer.effect(\n      Service,\n      Effect.map(AuthSession, (sessions) => {\n        const issue = Effect.fn(`${id}.issue`)(function* (subjectId: SubjectId, ext: S[\"Type\"]) {\n          const encoded = yield* encodeExt(ext).pipe(\n            Effect.mapError((error) =>\n              AuthTokenError.make({\n                message: `Session extension encoding failed: ${error.message}`,\n              }),\n            ),\n          );\n\n          return yield* sessions.issue(subjectId, { ext: encoded });\n        });\n\n        return Service.of({\n          issue,\n          verify: Effect.fn(`${id}.verify`)(function* (token) {\n            const claims = yield* sessions.verify(token);\n            const ext = yield* Effect.option(decodeExt(claims.ext));\n\n            return { claims, ext, renewal: Option.none() };\n          }),\n          verifyAndRenew: Effect.fn(`${id}.verifyAndRenew`)(function* (token) {\n            const verified = yield* sessions.verifyAndRenew(token);\n            const ext = yield* Effect.option(decodeExt(verified.claims.ext));\n\n            return { ...verified, ext };\n          }),\n          issueFromContext: Effect.fn(`${id}.issueFromContext`)(function* (context) {\n            const ext =\n              build === undefined\n                ? // The options type admits this branch only when the context\n                  // structurally satisfies the schema's encoded input. TS does\n                  // not narrow indexed access types through that conditional.\n                  yield* decodeContext(context as S[\"Encoded\"]).pipe(\n                    Effect.mapError((error) =>\n                      AuthTokenError.make({\n                        message: `Session extension construction failed: ${error.message}`,\n                      }),\n                    ),\n                  )\n                : yield* build(context);\n\n            return yield* issue(context.subjectId, ext);\n          }),\n        });\n      }),\n    );\n\n    return Object.assign(Service, {\n      ext,\n      layer,\n    });\n  };\n\n/**\n * Stateless session issuance and verification. Each token has a fixed expiry;\n * authenticated HTTP activity can replace it after the configured renewal\n * interval. There is no per-session revocation. Sign-out removes the browser\n * cookie, and bulk invalidation happens through key removal or by bumping the\n * configured session generation.\n */\nexport class AuthSession extends Context.Service<\n  AuthSession,\n  {\n    readonly issue: (\n      subjectId: SubjectId,\n      options?: IssueSessionOptions,\n    ) => Effect.Effect<IssuedSession, AuthTokenError>;\n    readonly verify: (\n      token: Redacted.Redacted<string>,\n    ) => Effect.Effect<SessionClaims, InvalidSession | AuthTokenError>;\n    /** Verifies the token and issues a replacement when rolling renewal is due. */\n    readonly verifyAndRenew: (\n      token: Redacted.Redacted<string>,\n    ) => Effect.Effect<VerifiedSession, InvalidSession | AuthTokenError | IdentityResolutionError>;\n  }\n>()(\"effect-auth/AuthSession\") {\n  /**\n   * Declares an app-typed session service from one extension schema. Passing\n   * the schema directly automatically constructs extensions from compatible\n   * HTTP session context; schemas with derived inputs provide a `build`\n   * override. The core service remains opaque: this wrapper encodes before\n   * issuance and decodes after verification, preserving `None` for legacy or\n   * undecodable extensions.\n   */\n  static readonly WithExt = makeAuthSessionWithExt;\n\n  static readonly layer: Layer.Layer<AuthSession, never, AuthTokenCodec | Crypto.Crypto> =\n    Layer.effect(AuthSession)(\n      Effect.gen(function* () {\n        const policy = yield* AuthPolicy;\n        const codec = yield* AuthTokenCodec;\n        const crypto = yield* Crypto.Crypto;\n\n        const issue = Effect.fn(\"AuthSession.issue\")(function* (\n          subjectId: SubjectId,\n          options?: IssueSessionOptions,\n        ) {\n          const now = yield* DateTime.now;\n          const expiresAt = DateTime.addDuration(now, policy.sessionLifetime);\n\n          const uuid = yield* crypto.randomUUIDv4.pipe(\n            Effect.mapError(() =>\n              AuthTokenError.make({ message: \"Secure randomness unavailable\" }),\n            ),\n          );\n\n          const tokenId = yield* decodeSessionTokenId(uuid).pipe(Effect.orDie);\n\n          const claims = SessionClaims.make({\n            ver: 1,\n            gen: policy.sessionGeneration,\n            kid: codec.activeKeyId,\n            sub: subjectId,\n            ...(options?.ext === undefined ? {} : { ext: options.ext }),\n            iss: policy.issuer,\n            aud: policy.audience,\n            iat: now,\n            exp: expiresAt,\n            jti: tokenId,\n          });\n\n          const token = yield* codec.encodeSession(claims);\n\n          return IssuedSession.make({\n            token,\n            summary: SessionSummary.make({ subjectId, expiresAt }),\n          });\n        });\n\n        const verify = Effect.fn(\"AuthSession.verify\")(function* (\n          token: Redacted.Redacted<string>,\n        ) {\n          const claims = yield* codec.decodeSession(token);\n\n          return yield* revalidateSessionClaims(claims, {\n            issuer: policy.issuer,\n            audience: policy.audience,\n            sessionGeneration: policy.sessionGeneration,\n            allowedSigningKeyIds: new Set(codec.keyIds),\n          });\n        });\n\n        const renewIfDue = Effect.fn(\"AuthSession.renewIfDue\")(function* (claims: SessionClaims) {\n          const now = yield* DateTime.now;\n          const issuedAtMillis = DateTime.toEpochMillis(claims.iat);\n          const tokenLifetimeMillis = DateTime.toEpochMillis(claims.exp) - issuedAtMillis;\n          const tokenAgeMillis = DateTime.toEpochMillis(now) - issuedAtMillis;\n          const configuredLifetimeMillis = Duration.toMillis(policy.sessionLifetime);\n          const renewalIntervalMillis = Duration.toMillis(policy.sessionRenewalInterval);\n\n          const renewalDue =\n            tokenLifetimeMillis !== configuredLifetimeMillis ||\n            tokenAgeMillis >= renewalIntervalMillis;\n\n          if (!renewalDue) return Option.none<IssuedSession>();\n\n          const renewed = yield* issue(\n            claims.sub,\n            claims.ext === undefined ? undefined : { ext: claims.ext },\n          );\n\n          return Option.some(renewed);\n        });\n\n        return AuthSession.of({\n          issue,\n          verify,\n          verifyAndRenew: Effect.fn(\"AuthSession.verifyAndRenew\")(function* (token) {\n            const claims = yield* verify(token);\n            const renewal = yield* renewIfDue(claims);\n\n            return { claims, renewal };\n          }),\n        });\n      }),\n    );\n}\n"],"mappings":";;;;;;AAyBA,IAAa,gBAAb,cAAmC,OAAO,MAAqB,2BAA2B,CAAC,CAAC;CAC1F,OAAO;CACP,SAAS;AACX,CAAC,CAAC,CAAC,CAAC;AAQJ,MAAM,uBAAuB,OAAO,aAAa,cAAc;AAkE/D,MAAM,gCAGF,IACA,eACiD;CACjD,MAAM,qBAAqB,OAAO,SAAS,UAAU;CACrD,MAAM,MAAM,qBAAsB,aAAmB,WAAW;CAChE,MAAM,QAAQ,qBAAqB,KAAA,IAAY,WAAW;CAC1D,MAAM,UAAU,QAAQ,QAAoD,CAAC,CAAC,EAAE;CAChF,MAAM,WAAkD;CACxD,MAAM,YAAY,OAAO,aAAa,QAAQ;CAC9C,MAAM,gBAAgB,OAAO,aAAa,QAAQ;CAElD,MAAM,YAAY,OAAO,oBAAoB,GAAG;CAEhD,MAAM,QAAQ,MAAM,OAClB,SACA,OAAO,IAAI,cAAc,aAAa;EACpC,MAAM,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,WAAW,WAAsB,KAAgB;GACtF,MAAM,UAAU,OAAO,UAAU,GAAG,CAAC,CAAC,KACpC,OAAO,UAAU,UACf,eAAe,KAAK,EAClB,SAAS,sCAAsC,MAAM,UACvD,CAAC,CACH,CACF;GAEA,OAAO,OAAO,SAAS,MAAM,WAAW,EAAE,KAAK,QAAQ,CAAC;EAC1D,CAAC;EAED,OAAO,QAAQ,GAAG;GAChB;GACA,QAAQ,OAAO,GAAG,GAAG,GAAG,QAAQ,CAAC,CAAC,WAAW,OAAO;IAClD,MAAM,SAAS,OAAO,SAAS,OAAO,KAAK;IAG3C,OAAO;KAAE;KAAQ,KAAA,OAFE,OAAO,OAAO,UAAU,OAAO,GAAG,CAAC;KAEhC,SAAS,OAAO,KAAK;IAAE;GAC/C,CAAC;GACD,gBAAgB,OAAO,GAAG,GAAG,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO;IAClE,MAAM,WAAW,OAAO,SAAS,eAAe,KAAK;IACrD,MAAM,MAAM,OAAO,OAAO,OAAO,UAAU,SAAS,OAAO,GAAG,CAAC;IAE/D,OAAO;KAAE,GAAG;KAAU;IAAI;GAC5B,CAAC;GACD,kBAAkB,OAAO,GAAG,GAAG,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAAS;IACxE,MAAM,MACJ,UAAU,KAAA,IAIN,OAAO,cAAc,OAAuB,CAAC,CAAC,KAC5C,OAAO,UAAU,UACf,eAAe,KAAK,EAClB,SAAS,0CAA0C,MAAM,UAC3D,CAAC,CACH,CACF,IACA,OAAO,MAAM,OAAO;IAE1B,OAAO,OAAO,MAAM,QAAQ,WAAW,GAAG;GAC5C,CAAC;EACH,CAAC;CACH,CAAC,CACH;CAEA,OAAO,OAAO,OAAO,SAAS;EAC5B;EACA;CACF,CAAC;AACH;;;;;;;;AASF,IAAa,cAAb,MAAa,oBAAoB,QAAQ,QAevC,CAAC,CAAC,yBAAyB,CAAC,CAAC;;;;;;;;;CAS7B,OAAgB,UAAU;CAE1B,OAAgB,QACd,MAAM,OAAO,WAAW,CAAC,CACvB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO,OAAO;EAE7B,MAAM,QAAQ,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC3C,WACA,SACA;GACA,MAAM,MAAM,OAAO,SAAS;GAC5B,MAAM,YAAY,SAAS,YAAY,KAAK,OAAO,eAAe;GAElE,MAAM,OAAO,OAAO,OAAO,aAAa,KACtC,OAAO,eACL,eAAe,KAAK,EAAE,SAAS,gCAAgC,CAAC,CAClE,CACF;GAEA,MAAM,UAAU,OAAO,qBAAqB,IAAI,CAAC,CAAC,KAAK,OAAO,KAAK;GAEnE,MAAM,SAAS,cAAc,KAAK;IAChC,KAAK;IACL,KAAK,OAAO;IACZ,KAAK,MAAM;IACX,KAAK;IACL,GAAI,SAAS,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;IACzD,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK;IACL,KAAK;IACL,KAAK;GACP,CAAC;GAED,MAAM,QAAQ,OAAO,MAAM,cAAc,MAAM;GAE/C,OAAO,cAAc,KAAK;IACxB;IACA,SAAS,eAAe,KAAK;KAAE;KAAW;IAAU,CAAC;GACvD,CAAC;EACH,CAAC;EAED,MAAM,SAAS,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAC7C,OACA;GACA,MAAM,SAAS,OAAO,MAAM,cAAc,KAAK;GAE/C,OAAO,OAAO,wBAAwB,QAAQ;IAC5C,QAAQ,OAAO;IACf,UAAU,OAAO;IACjB,mBAAmB,OAAO;IAC1B,sBAAsB,IAAI,IAAI,MAAM,MAAM;GAC5C,CAAC;EACH,CAAC;EAED,MAAM,aAAa,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,QAAuB;GACvF,MAAM,MAAM,OAAO,SAAS;GAC5B,MAAM,iBAAiB,SAAS,cAAc,OAAO,GAAG;GACxD,MAAM,sBAAsB,SAAS,cAAc,OAAO,GAAG,IAAI;GACjE,MAAM,iBAAiB,SAAS,cAAc,GAAG,IAAI;GACrD,MAAM,2BAA2B,SAAS,SAAS,OAAO,eAAe;GACzE,MAAM,wBAAwB,SAAS,SAAS,OAAO,sBAAsB;GAM7E,IAAI,EAHF,wBAAwB,4BACxB,kBAAkB,wBAEH,OAAO,OAAO,KAAoB;GAEnD,MAAM,UAAU,OAAO,MACrB,OAAO,KACP,OAAO,QAAQ,KAAA,IAAY,KAAA,IAAY,EAAE,KAAK,OAAO,IAAI,CAC3D;GAEA,OAAO,OAAO,KAAK,OAAO;EAC5B,CAAC;EAED,OAAO,YAAY,GAAG;GACpB;GACA;GACA,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAAO;IACxE,MAAM,SAAS,OAAO,OAAO,KAAK;IAGlC,OAAO;KAAE;KAAQ,SAAA,OAFM,WAAW,MAAM;IAEf;GAC3B,CAAC;EACH,CAAC;CACH,CAAC,CACH;AACJ"}

package/dist/AuthStore.d.mts

@@ -0,0 +1,68 @@
+import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, PendingRegistration, TokenDigest, VerifiedEmail } from "./Schema.mjs";
+import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "./Errors.mjs";
+import { ConsumeDecision } from "./auth/ConsumeDecision.mjs";
+import { AuthStoreDecisions, ChallengeConsumeDecision } from "./internal/AuthStoreDecisions.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/AuthStore.d.ts
+type IssueChallengeError = AuthRateLimited | AuthStoreError;
+declare const EmailOtpRejectionReason: Schema.Literals<readonly ["missing_challenge", "consumed_challenge", "superseded_challenge", "expired_challenge", "missing_challenge_series", "attempts_exhausted", "bad_code"]>;
+declare const EmailOtpRejected_base: Schema.Class<EmailOtpRejected, Schema.TaggedStruct<"EmailOtpRejected", {
+  readonly reason: Schema.Literals<readonly ["missing_challenge", "consumed_challenge", "superseded_challenge", "expired_challenge", "missing_challenge_series", "attempts_exhausted", "bad_code"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Internal rejection detail that the HTTP workflow collapses to `InvalidEmailOtp`. */
+declare class EmailOtpRejected extends EmailOtpRejected_base {}
+declare const AuthStoreBackend_base: Context.ServiceClass<AuthStoreBackend, "effect-auth/AuthStoreBackend", {
+  /** Resolves the stored value for a key, or `undefined` when absent. */
+  readonly get: (key: string) => Effect.Effect<unknown, AuthStoreError>;
+  readonly put: (key: string, value: unknown) => Effect.Effect<void, AuthStoreError>;
+  readonly remove: (key: string) => Effect.Effect<void, AuthStoreError>;
+}>;
+/**
+ * Deliberately narrow storage driver behind the store state machine: the
+ * in-memory map, Durable Object storage, or any keyed store whose writes
+ * become visible in order. Values handed to `put` are already JSON-safe
+ * encoded rows, so `get` legitimately yields `unknown`.
+ * Retain challenge rows through their original expiry, including after consumption.
+ */
+declare class AuthStoreBackend extends AuthStoreBackend_base {
+  /** In-memory backend for tests and local development; never durable. */
+  static readonly layerMemory: Layer.Layer<AuthStoreBackend>;
+}
+declare const AuthStore_base: Context.ServiceClass<AuthStore, "effect-auth/AuthStore", {
+  readonly issueChallenge: (input: NewChallenge) => Effect.Effect<void, IssueChallengeError>;
+  /**
+   * Checks token digest, OTP digest, purpose, expiry, supersession,
+   * consumption, and attempt budget as one atomic operation. A failed
+   * comparison increments the rolling attempt budget; success consumes the
+   * challenge. The workflow logs the internal rejection reason, then
+   * collapses every failure to the public `InvalidEmailOtp`.
+   */
+  readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<VerifiedEmail, EmailOtpRejected | AuthStoreError>;
+  readonly issueRegistration: (input: NewRegistration) => Effect.Effect<void, AuthStoreError>;
+  readonly inspectRegistration: (tokenDigest: TokenDigest) => Effect.Effect<PendingRegistration, InvalidRegistration | AuthStoreError>;
+  readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<void, InvalidRegistration | AuthStoreError>;
+}>;
+/**
+ * Semantic persistence port for challenges and pending registrations, not
+ * CRUD. The consume operations must be atomic: exactly one of concurrent
+ * valid consumptions may succeed. Per-challenge attempts, resend cooldown,
+ * and email-scoped issuance limits live behind this contract; IP/network
+ * limits stay at the edge.
+ *
+ * Adapters either implement this interface directly against a store with real
+ * transactions, or provide an `AuthStoreBackend` to `layerBackend`. Either
+ * way, the conformance suite exported from `effect-auth/Testing` is the
+ * acceptance test.
+ */
+declare class AuthStore extends AuthStore_base {
+  /** The canonical state machine over whichever `AuthStoreBackend` is provided. */
+  static readonly layerBackend: Layer.Layer<AuthStore, never, AuthStoreBackend>;
+  /**
+   * In-memory adapter for tests and local development. Never a durable
+   * production adapter.
+   */
+  static readonly layerMemory: Layer.Layer<AuthStore>;
+}
+//#endregion
+export { AuthStore, AuthStoreBackend, AuthStoreDecisions, type ChallengeConsumeDecision, type ConsumeDecision, EmailOtpRejected, EmailOtpRejectionReason, IssueChallengeError };
+//# sourceMappingURL=AuthStore.d.mts.map

package/dist/AuthStore.mjs

@@ -0,0 +1,194 @@
+import { NewChallenge, NewRegistration, PendingRegistration, VerifiedEmail, timingSafeStringEqual } from "./Schema.mjs";
+import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "./Errors.mjs";
+import { AuthStoreDecisions } from "./internal/AuthStoreDecisions.mjs";
+import { Context, DateTime, Duration, Effect, Layer, Schema, Semaphore } from "effect";
+//#region src/AuthStore.ts
+const EmailOtpRejectionReason = Schema.Literals([
+	"missing_challenge",
+	"consumed_challenge",
+	"superseded_challenge",
+	"expired_challenge",
+	"missing_challenge_series",
+	"attempts_exhausted",
+	"bad_code"
+]);
+/** Internal rejection detail that the HTTP workflow collapses to `InvalidEmailOtp`. */
+var EmailOtpRejected = class extends Schema.TaggedError()("EmailOtpRejected", { reason: EmailOtpRejectionReason }) {};
+/**
+* Deliberately narrow storage driver behind the store state machine: the
+* in-memory map, Durable Object storage, or any keyed store whose writes
+* become visible in order. Values handed to `put` are already JSON-safe
+* encoded rows, so `get` legitimately yields `unknown`.
+* Retain challenge rows through their original expiry, including after consumption.
+*/
+var AuthStoreBackend = class AuthStoreBackend extends Context.Service()("effect-auth/AuthStoreBackend") {
+	/** In-memory backend for tests and local development; never durable. */
+	static layerMemory = Layer.sync(AuthStoreBackend)(() => {
+		const entries = /* @__PURE__ */ new Map();
+		return AuthStoreBackend.of({
+			get: (key) => Effect.sync(() => entries.get(key)),
+			put: (key, value) => Effect.sync(() => {
+				entries.set(key, value);
+			}),
+			remove: (key) => Effect.sync(() => {
+				entries.delete(key);
+			})
+		});
+	});
+};
+var StoredChallenge = class extends Schema.Class("effect-auth/StoredChallenge")({
+	challenge: NewChallenge,
+	consumed: Schema.Boolean,
+	superseded: Schema.Boolean
+}) {};
+var StoredEmailSeries = class extends Schema.Class("effect-auth/StoredEmailSeries")({
+	activeChallengeKey: Schema.UndefinedOr(Schema.String),
+	lastIssuedAt: Schema.DateTimeUtcFromMillis,
+	rollingAttempts: Schema.Natural,
+	windowExpiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+var StoredRegistration = class extends Schema.Class("effect-auth/StoredRegistration")({
+	registration: NewRegistration,
+	consumed: Schema.Boolean
+}) {};
+const decodeChallengeRow = Schema.decodeUnknownEffect(StoredChallenge);
+const encodeChallengeRow = Schema.encodeEffect(StoredChallenge);
+const decodeSeriesRow = Schema.decodeUnknownEffect(StoredEmailSeries);
+const encodeSeriesRow = Schema.encodeEffect(StoredEmailSeries);
+const decodeRegistrationRow = Schema.decodeUnknownEffect(StoredRegistration);
+const encodeRegistrationRow = Schema.encodeEffect(StoredRegistration);
+const challengeKey = (tokenDigest) => `challenge:${tokenDigest}`;
+const seriesKey = (purpose, email) => `series:${purpose}|${email}`;
+const registrationKey = (tokenDigest) => `registration:${tokenDigest}`;
+/**
+* The canonical store state machine over an `AuthStoreBackend`. Operations are
+* serialized through an internal semaphore, so the exactly-once consume
+* guarantees hold even when the backend's reads and writes suspend. Runtimes
+* that already serialize requests (a Durable Object's input gates) get a
+* second, redundant layer of protection.
+*/
+const makeBackendAuthStore = Effect.gen(function* () {
+	const backend = yield* AuthStoreBackend;
+	const serialized = (yield* Semaphore.make(1)).withPermits(1);
+	const read = (key, decode) => backend.get(key).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Auth store read failed" })), Effect.flatMap((value) => value === void 0 ? Effect.succeed(void 0) : decode(value).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Corrupt auth store row" })))));
+	const write = (key, encode, row) => encode(row).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Auth store write failed" })), Effect.flatMap((value) => backend.put(key, value).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Auth store write failed" })))));
+	const issueChallenge = Effect.fn("AuthStore.issueChallenge")(function* (input) {
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		if ((yield* read(challengeKey(input.tokenDigest), decodeChallengeRow)) !== void 0) return yield* AuthRateLimited.make({ retryAfterSeconds: 1 });
+		const key = seriesKey(input.purpose, input.email);
+		const series = yield* read(key, decodeSeriesRow);
+		const cooldownMillis = Duration.toMillis(input.resendCooldown);
+		if (series !== void 0) {
+			const lastIssuedAt = DateTime.toEpochMillis(series.lastIssuedAt);
+			if (now < lastIssuedAt + cooldownMillis) return yield* AuthRateLimited.make({ retryAfterSeconds: Math.ceil((lastIssuedAt + cooldownMillis - now) / 1e3) });
+			if (series.activeChallengeKey !== void 0) {
+				const active = yield* read(series.activeChallengeKey, decodeChallengeRow);
+				if (active !== void 0 && !active.superseded) yield* write(series.activeChallengeKey, encodeChallengeRow, StoredChallenge.make({
+					...active,
+					superseded: true
+				}));
+			}
+		}
+		const rollingAttempts = series !== void 0 && now < DateTime.toEpochMillis(series.windowExpiresAt) ? series.rollingAttempts : 0;
+		yield* write(challengeKey(input.tokenDigest), encodeChallengeRow, StoredChallenge.make({
+			challenge: input,
+			consumed: false,
+			superseded: false
+		}));
+		yield* write(key, encodeSeriesRow, StoredEmailSeries.make({
+			activeChallengeKey: challengeKey(input.tokenDigest),
+			lastIssuedAt: yield* DateTime.now,
+			rollingAttempts,
+			windowExpiresAt: input.expiresAt
+		}));
+	});
+	const consumeChallenge = Effect.fn("AuthStore.consumeChallenge")(function* (input) {
+		const reject = (reason) => EmailOtpRejected.make({ reason });
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		const row = yield* read(challengeKey(input.tokenDigest), decodeChallengeRow);
+		if (row === void 0) return yield* reject("missing_challenge");
+		const key = seriesKey(row.challenge.purpose, row.challenge.email);
+		const series = yield* read(key, decodeSeriesRow);
+		if (row.consumed) return yield* reject("consumed_challenge");
+		if (row.superseded) return yield* reject("superseded_challenge");
+		if (now >= DateTime.toEpochMillis(row.challenge.expiresAt)) return yield* reject("expired_challenge");
+		if (series === void 0) return yield* reject("missing_challenge_series");
+		if (series.rollingAttempts >= row.challenge.attemptLimit) return yield* reject("attempts_exhausted");
+		const candidate = input.otpDigests[row.challenge.otpKeyId];
+		if (!(candidate !== void 0 && timingSafeStringEqual(candidate, row.challenge.otpDigest))) {
+			yield* write(key, encodeSeriesRow, StoredEmailSeries.make({
+				...series,
+				rollingAttempts: series.rollingAttempts + 1
+			}));
+			return yield* reject("bad_code");
+		}
+		yield* write(challengeKey(input.tokenDigest), encodeChallengeRow, StoredChallenge.make({
+			...row,
+			consumed: true
+		}));
+		yield* backend.remove(key).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Auth store write failed" })));
+		return VerifiedEmail.make({
+			email: row.challenge.email,
+			purpose: row.challenge.purpose
+		});
+	});
+	const issueRegistration = Effect.fn("AuthStore.issueRegistration")(function* (input) {
+		yield* write(registrationKey(input.tokenDigest), encodeRegistrationRow, StoredRegistration.make({
+			registration: input,
+			consumed: false
+		}));
+	});
+	const inspectRegistration = Effect.fn("AuthStore.inspectRegistration")(function* (tokenDigest) {
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		const row = yield* read(registrationKey(tokenDigest), decodeRegistrationRow);
+		if (row === void 0 || row.consumed || now >= DateTime.toEpochMillis(row.registration.expiresAt)) return yield* InvalidRegistration.make();
+		return PendingRegistration.make({
+			registrationId: row.registration.registrationId,
+			email: row.registration.email,
+			purpose: row.registration.purpose,
+			issuedAt: row.registration.issuedAt,
+			expiresAt: row.registration.expiresAt
+		});
+	});
+	const consumeRegistration = Effect.fn("AuthStore.consumeRegistration")(function* (input) {
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		const row = yield* read(registrationKey(input.tokenDigest), decodeRegistrationRow);
+		if (row === void 0 || row.consumed || now >= DateTime.toEpochMillis(row.registration.expiresAt)) return yield* InvalidRegistration.make();
+		yield* write(registrationKey(input.tokenDigest), encodeRegistrationRow, StoredRegistration.make({
+			...row,
+			consumed: true
+		}));
+	});
+	return {
+		issueChallenge: (input) => serialized(issueChallenge(input)),
+		consumeChallenge: (input) => serialized(consumeChallenge(input)),
+		issueRegistration: (input) => serialized(issueRegistration(input)),
+		inspectRegistration: (tokenDigest) => serialized(inspectRegistration(tokenDigest)),
+		consumeRegistration: (input) => serialized(consumeRegistration(input))
+	};
+});
+/**
+* Semantic persistence port for challenges and pending registrations, not
+* CRUD. The consume operations must be atomic: exactly one of concurrent
+* valid consumptions may succeed. Per-challenge attempts, resend cooldown,
+* and email-scoped issuance limits live behind this contract; IP/network
+* limits stay at the edge.
+*
+* Adapters either implement this interface directly against a store with real
+* transactions, or provide an `AuthStoreBackend` to `layerBackend`. Either
+* way, the conformance suite exported from `effect-auth/Testing` is the
+* acceptance test.
+*/
+var AuthStore = class AuthStore extends Context.Service()("effect-auth/AuthStore") {
+	/** The canonical state machine over whichever `AuthStoreBackend` is provided. */
+	static layerBackend = Layer.effect(AuthStore)(makeBackendAuthStore);
+	/**
+	* In-memory adapter for tests and local development. Never a durable
+	* production adapter.
+	*/
+	static layerMemory = AuthStore.layerBackend.pipe(Layer.provide(AuthStoreBackend.layerMemory));
+};
+//#endregion
+export { AuthStore, AuthStoreBackend, AuthStoreDecisions, EmailOtpRejected, EmailOtpRejectionReason };
+
+//# sourceMappingURL=AuthStore.mjs.map