@yielded/auth 0.1.0-beta.1

package/dist/operations/actions.mjs

@@ -0,0 +1,148 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { OperationConfigurationError } from "./errors.mjs";
+import { makeOperation } from "./operation.mjs";
+import { SessionError, SessionSignOutUnavailable } from "../sessions/errors.mjs";
+import { SessionSignOut } from "../sessions/models.mjs";
+import { makeSessionContract } from "../sessions/contract.mjs";
+import { Schema, SchemaAST } from "effect";
+//#region src/operations/actions.ts
+/** Define the schema and behavior of one public method, independently of its
+* implementation. Inputs use the schema's encoded form, matching operation.invoke. */
+const action = (options) => Object.freeze({
+	...options,
+	method: options.method,
+	strategy: options.strategy,
+	requestFields: Object.freeze({ ...options.requestFields }),
+	reveals: Object.freeze([...options.reveals ?? []])
+});
+/** Reuse a pure operation contract for a named action. Request credential fields
+* are removed from the public schema and restored only by the local request adapter. */
+const fromOperation = (operation, options = {}) => {
+	if (operation.exposure !== "public") throw OperationConfigurationError.make({
+		reason: "internal-exposure",
+		operation: options.method ?? "action"
+	});
+	const fields = Object.fromEntries(Object.entries(operation.rpc.payloadSchema.fields).filter(([name]) => !Object.hasOwn(options.requestFields ?? {}, name)));
+	return action({
+		payload: Schema.Struct(fields),
+		success: operation.rpc.successSchema,
+		error: operation.rpc.errorSchema,
+		replay: operation.replay,
+		credentials: operation.credentials,
+		reveals: operation.reveals,
+		...options,
+		mode: options.mode ?? "mutation"
+	});
+};
+const bindAction = (namespace, basePath, name, definition) => {
+	const requestFields = Object.freeze({ ...definition.requestFields });
+	const reveals = Object.freeze([...definition.reveals ?? []]);
+	if (!Schema.is(Schema.NonEmptyString.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9]*$/)))(name) || [
+		"then",
+		"__proto__",
+		"constructor",
+		"prototype",
+		"session",
+		"lifetime",
+		"runtime",
+		"client"
+	].includes(name) || definition.mode === "query" && (definition.credentials === true || reveals.length > 0 || definition.replay !== void 0 && definition.replay !== "read-only")) throw OperationConfigurationError.make({
+		reason: "invalid-action",
+		operation: name
+	});
+	const operation = makeOperation(`${namespace}/api/${name}`, {
+		payload: definition.payload,
+		success: definition.success,
+		error: Schema.Union([
+			definition.error,
+			SessionError,
+			HookDenied
+		]),
+		access: "any",
+		exposure: "public",
+		replay: definition.mode === "query" ? "read-only" : definition.replay ?? "non-idempotent",
+		...definition.credentials === true ? { credentials: true } : {},
+		...reveals.length > 0 ? { reveals } : {}
+	});
+	return Object.freeze({
+		route: Object.freeze({
+			operation,
+			path: `${basePath}/${name}`,
+			method: definition.mode === "query" && Object.keys(requestFields).length === 0 && (SchemaAST.isVoid(Schema.toEncoded(definition.payload).ast) || SchemaAST.isUndefined(Schema.toEncoded(definition.payload).ast)) ? "GET" : "POST",
+			credentials: Object.freeze({}),
+			reveals
+		}),
+		mode: definition.mode,
+		method: definition.method ?? name,
+		strategy: definition.strategy,
+		requestFields,
+		subject: definition.subject
+	});
+};
+const sessionActions = (session) => ({
+	getSession: action({
+		payload: Schema.Void,
+		success: Schema.NullOr(session),
+		error: Schema.Never,
+		mode: "query",
+		subject: { fromSuccess: (value) => value?.subjectId ?? null }
+	}),
+	requireSession: action({
+		payload: Schema.Void,
+		success: session,
+		error: Schema.Never,
+		mode: "query",
+		subject: { fromSuccess: (value) => value.subjectId }
+	}),
+	signOut: action({
+		payload: Schema.Void,
+		success: Schema.Union([SessionSignOut, SessionSignOutUnavailable]),
+		error: Schema.Never,
+		mode: "mutation",
+		replay: "idempotent",
+		credentials: true,
+		subject: { fromSuccess: () => null }
+	}),
+	renewSession: action({
+		payload: Schema.Void,
+		success: session,
+		error: Schema.Never,
+		mode: "mutation",
+		credentials: true
+	})
+});
+/** A browser-safe contract. The action callback only receives schemas; it never
+* receives server configuration, keys, persistence or service implementations. */
+const make = (namespace, options) => {
+	if (!Schema.is(Schema.NonEmptyString.check(Schema.isMaxLength(128), Schema.isPattern(/^[A-Za-z0-9._:/-]+$/)))(namespace)) throw OperationConfigurationError.make({
+		reason: "invalid-action",
+		operation: namespace
+	});
+	const basePath = options.basePath ?? "/auth";
+	if (!Schema.is(Schema.String.check(Schema.isPattern(/^\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+$/)))(basePath)) throw OperationConfigurationError.make({
+		reason: "invalid-action",
+		operation: namespace
+	});
+	const sessions = makeSessionContract(`${namespace}/sessions`, options.claims);
+	const defaults = sessionActions(sessions.Session);
+	const additional = options.actions?.(sessions) ?? {};
+	if (Object.keys(additional).some((name) => Object.hasOwn(defaults, name))) throw OperationConfigurationError.make({
+		reason: "duplicate-operation",
+		operation: namespace
+	});
+	const definitions = {
+		...defaults,
+		...additional
+	};
+	const actions = Object.fromEntries(Object.entries(definitions).map(([name, definition]) => [name, bindAction(namespace, basePath, name, definition)]));
+	return Object.freeze({
+		namespace,
+		claims: options.claims,
+		sessions,
+		actions: Object.freeze(actions)
+	});
+};
+//#endregion
+export { action, fromOperation, make };
+
+//# sourceMappingURL=actions.mjs.map

package/dist/operations/actions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.mjs","names":[],"sources":["../../src/operations/actions.ts"],"sourcesContent":["import type { Effect } from \"effect\";\nimport { Schema, SchemaAST } from \"effect\";\nimport type { Rpc } from \"effect/unstable/rpc\";\n\nimport { HookDenied } from \"../hooks/models\";\nimport { makeSessionContract } from \"../sessions/contract\";\nimport { SessionError, SessionSignOutUnavailable } from \"../sessions/errors\";\nimport { SessionSignOut } from \"../sessions/models\";\nimport type { AuthInvocation } from \"./context\";\nimport type { CredentialSlot } from \"./credentials\";\nimport { OperationConfigurationError } from \"./errors\";\nimport { makeOperation, type OperationReplay } from \"./operation\";\nimport type { AuthRevealKind } from \"./reveals\";\n\n/** Public action data is shared by local, HTTP and reactive callers. Private\n * request fields are supplied by the server when the implementation executes. */\nexport interface ActionOptions<\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Failure extends Schema.Top,\n  Mode extends \"query\" | \"mutation\" = \"query\" | \"mutation\",\n> {\n  readonly payload: Payload;\n  readonly success: Success;\n  readonly error: Failure;\n  readonly mode: Mode;\n  readonly replay?: OperationReplay;\n  readonly credentials?: boolean;\n  readonly reveals?: ReadonlyArray<AuthRevealKind>;\n  readonly method?: string;\n  readonly strategy?: string;\n  readonly requestFields?: Readonly<Record<string, CredentialSlot>>;\n  readonly subject?: {\n    fromSuccess(value: Success[\"Type\"]): string | null | undefined;\n  };\n}\n\n/** Define the schema and behavior of one public method, independently of its\n * implementation. Inputs use the schema's encoded form, matching operation.invoke. */\nexport const action = <\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Failure extends Schema.Top,\n  const Mode extends \"query\" | \"mutation\",\n  const Method extends string | undefined = undefined,\n  const Strategy extends string | undefined = undefined,\n>(\n  options: ActionOptions<Payload, Success, Failure, Mode> & {\n    readonly method?: Method;\n    readonly strategy?: Strategy;\n  },\n) =>\n  Object.freeze({\n    ...options,\n    method: options.method,\n    strategy: options.strategy,\n    requestFields: Object.freeze({ ...options.requestFields }),\n    reveals: Object.freeze([...(options.reveals ?? [])]),\n  });\n\nexport type ActionDefinition = ActionOptions<Schema.Top, Schema.Top, Schema.Top>;\nexport type ActionDefinitions = Readonly<Record<string, ActionDefinition>>;\n\n/** Reuse a pure operation contract for a named action. Request credential fields\n * are removed from the public schema and restored only by the local request adapter. */\nexport const fromOperation = <\n  Fields extends Schema.Struct.Fields,\n  Success extends Schema.Top,\n  Failure extends Schema.Top,\n  const RequestFields extends Readonly<Record<string, CredentialSlot>> = Record<never, never>,\n  const Mode extends \"query\" | \"mutation\" = \"mutation\",\n  const Method extends string | undefined = undefined,\n  const Strategy extends string | undefined = undefined,\n>(\n  operation: {\n    readonly rpc: {\n      readonly payloadSchema: Schema.Struct<Fields>;\n      readonly successSchema: Success;\n      readonly errorSchema: Failure;\n    };\n    readonly exposure: \"public\" | \"internal\";\n    readonly replay: OperationReplay;\n    readonly credentials: boolean;\n    readonly reveals: ReadonlyArray<AuthRevealKind>;\n  },\n  options: {\n    readonly method?: Method;\n    readonly strategy?: Strategy;\n    readonly requestFields?: RequestFields &\n      Record<Exclude<keyof RequestFields, Extract<keyof Fields, string>>, never>;\n    readonly mode?: Mode;\n    readonly subject?: { fromSuccess(value: Success[\"Type\"]): string | null | undefined };\n  } = {},\n) => {\n  if (operation.exposure !== \"public\")\n    throw OperationConfigurationError.make({\n      reason: \"internal-exposure\",\n      operation: options.method ?? \"action\",\n    });\n\n  // Schema fields and their keys remain paired while removing request-only input.\n  const fields = Object.fromEntries(\n    Object.entries(operation.rpc.payloadSchema.fields).filter(\n      ([name]) => !Object.hasOwn(options.requestFields ?? {}, name),\n    ),\n  ) as Omit<Fields, keyof RequestFields>;\n\n  return action({\n    payload: Schema.Struct(fields),\n    success: operation.rpc.successSchema,\n    error: operation.rpc.errorSchema,\n    replay: operation.replay,\n    credentials: operation.credentials,\n    reveals: operation.reveals,\n    ...options,\n    mode: (options.mode ?? \"mutation\") as Mode,\n  });\n};\n\nconst bindAction = <\n  const Name extends string,\n  Payload extends Schema.Top,\n  Success extends Schema.Top,\n  Failure extends Schema.Top,\n  Mode extends \"query\" | \"mutation\",\n>(\n  namespace: string,\n  basePath: `/${string}`,\n  name: Name,\n  definition: ActionOptions<Payload, Success, Failure, Mode>,\n) => {\n  const requestFields = Object.freeze({ ...definition.requestFields });\n  const reveals = Object.freeze([...(definition.reveals ?? [])]);\n\n  if (\n    !Schema.is(Schema.NonEmptyString.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9]*$/)))(name) ||\n    [\n      \"then\",\n      \"__proto__\",\n      \"constructor\",\n      \"prototype\",\n      \"session\",\n      \"lifetime\",\n      \"runtime\",\n      \"client\",\n    ].includes(name) ||\n    (definition.mode === \"query\" &&\n      (definition.credentials === true ||\n        reveals.length > 0 ||\n        (definition.replay !== undefined && definition.replay !== \"read-only\")))\n  )\n    throw OperationConfigurationError.make({ reason: \"invalid-action\", operation: name });\n\n  const operation = makeOperation(`${namespace}/api/${name}`, {\n    payload: definition.payload,\n    success: definition.success,\n    error: Schema.Union([definition.error, SessionError, HookDenied]),\n    access: \"any\",\n    exposure: \"public\",\n    replay: definition.mode === \"query\" ? \"read-only\" : (definition.replay ?? \"non-idempotent\"),\n    ...(definition.credentials === true ? { credentials: true as const } : {}),\n    ...(reveals.length > 0 ? { reveals } : {}),\n  });\n\n  return Object.freeze({\n    route: Object.freeze({\n      operation,\n      path: `${basePath}/${name}` as const,\n      method:\n        definition.mode === \"query\" &&\n        Object.keys(requestFields).length === 0 &&\n        (SchemaAST.isVoid(Schema.toEncoded(definition.payload).ast) ||\n          SchemaAST.isUndefined(Schema.toEncoded(definition.payload).ast))\n          ? (\"GET\" as const)\n          : (\"POST\" as const),\n      credentials: Object.freeze({}),\n      reveals,\n    }),\n    mode: definition.mode,\n    method: definition.method ?? name,\n    strategy: definition.strategy,\n    requestFields,\n    subject: definition.subject,\n  });\n};\n\nexport interface AnyAuthAction {\n  readonly route: {\n    readonly operation: {\n      readonly rpc: Rpc.AnyWithProps;\n      readonly exposure: \"public\" | \"internal\";\n      readonly replay: OperationReplay;\n      readonly credentials: boolean;\n      readonly reveals: ReadonlyArray<AuthRevealKind>;\n      readonly invokeUnknown: (\n        invocation: AuthInvocation,\n        input: unknown,\n      ) => Effect.Effect<unknown, unknown, unknown>;\n    };\n    readonly path: `/${string}`;\n    readonly method: \"POST\" | \"GET\";\n    readonly credentials: Readonly<Record<never, never>>;\n    readonly reveals: ReadonlyArray<AuthRevealKind>;\n  };\n  readonly mode: \"query\" | \"mutation\";\n  readonly method: string;\n  readonly strategy: string | undefined;\n  readonly requestFields: Readonly<Record<string, CredentialSlot>>;\n  readonly subject?: { fromSuccess(value: unknown): string | null | undefined } | undefined;\n}\n\nexport type AuthActions = Readonly<Record<string, AnyAuthAction>>;\n\ntype Target<Definition, Key extends \"method\" | \"strategy\", Default> = Key extends keyof Definition\n  ? Exclude<Definition[Key], undefined> | (undefined extends Definition[Key] ? Default : never)\n  : Default;\n\nexport type BoundActions<Definitions extends ActionDefinitions> = {\n  readonly [Name in keyof Definitions]: Definitions[Name] extends ActionOptions<\n    infer P,\n    infer S,\n    infer E,\n    infer M\n  >\n    ? Omit<\n        ReturnType<typeof bindAction<Extract<Name, string>, P, S, E, M>>,\n        \"method\" | \"strategy\"\n      > & {\n        readonly method: Target<Definitions[Name], \"method\", Extract<Name, string>>;\n        readonly strategy: Target<Definitions[Name], \"strategy\", undefined>;\n      }\n    : never;\n};\n\nconst sessionActions = <\n  S extends Schema.Codec<{ readonly subjectId: string }, unknown, unknown, unknown>,\n>(\n  session: S,\n) => ({\n  getSession: action({\n    payload: Schema.Void,\n    success: Schema.NullOr(session),\n    error: Schema.Never,\n    mode: \"query\",\n    subject: { fromSuccess: (value) => value?.subjectId ?? null },\n  }),\n  requireSession: action({\n    payload: Schema.Void,\n    success: session,\n    error: Schema.Never,\n    mode: \"query\",\n    subject: { fromSuccess: (value) => value.subjectId },\n  }),\n  signOut: action({\n    payload: Schema.Void,\n    success: Schema.Union([SessionSignOut, SessionSignOutUnavailable]),\n    error: Schema.Never,\n    mode: \"mutation\",\n    replay: \"idempotent\",\n    credentials: true,\n    subject: { fromSuccess: () => null },\n  }),\n  renewSession: action({\n    payload: Schema.Void,\n    success: session,\n    error: Schema.Never,\n    mode: \"mutation\",\n    credentials: true,\n  }),\n});\n\n/** A browser-safe contract. The action callback only receives schemas; it never\n * receives server configuration, keys, persistence or service implementations. */\nexport const make = <\n  const Id extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  const Additional extends ActionDefinitions = {},\n>(\n  namespace: Id,\n  options: {\n    readonly claims: Claims;\n    readonly basePath?: `/${string}`;\n    readonly actions?: (\n      schemas: ReturnType<typeof makeSessionContract<`${Id}/sessions`, Claims>>,\n    ) => Additional;\n  },\n) => {\n  if (\n    !Schema.is(\n      Schema.NonEmptyString.check(Schema.isMaxLength(128), Schema.isPattern(/^[A-Za-z0-9._:/-]+$/)),\n    )(namespace)\n  )\n    throw OperationConfigurationError.make({ reason: \"invalid-action\", operation: namespace });\n\n  const basePath = options.basePath ?? \"/auth\";\n\n  if (\n    !Schema.is(Schema.String.check(Schema.isPattern(/^\\/(?:[A-Za-z0-9_-]+\\/)*[A-Za-z0-9_-]+$/)))(\n      basePath,\n    )\n  )\n    throw OperationConfigurationError.make({ reason: \"invalid-action\", operation: namespace });\n\n  const sessions = makeSessionContract(`${namespace}/sessions`, options.claims);\n  const defaults = sessionActions(sessions.Session);\n  const additional = options.actions?.(sessions) ?? {};\n\n  if (Object.keys(additional).some((name) => Object.hasOwn(defaults, name)))\n    throw OperationConfigurationError.make({ reason: \"duplicate-operation\", operation: namespace });\n\n  const definitions = { ...defaults, ...additional };\n\n  const actions = Object.fromEntries(\n    (Object.entries(definitions) as Array<[string, ActionDefinition]>).map(([name, definition]) => [\n      name,\n      bindAction(namespace, basePath, name, definition),\n    ]),\n  );\n\n  // Each entry is bound with the exact schemas from the corresponding definition.\n  return Object.freeze({\n    namespace,\n    claims: options.claims,\n    sessions,\n    actions: Object.freeze(actions) as unknown as BoundActions<typeof defaults & Additional>,\n  });\n};\n\nexport interface AnyAuthContract {\n  readonly namespace: string;\n  readonly claims: Schema.Codec<unknown, unknown, unknown, unknown>;\n  readonly actions: AuthActions;\n}\n\nexport type ActionInput<A extends AnyAuthAction> =\n  A[\"route\"][\"operation\"][\"rpc\"][\"payloadSchema\"][\"Encoded\"];\n\nexport type ActionSuccess<A extends AnyAuthAction> =\n  A[\"route\"][\"operation\"][\"rpc\"][\"successSchema\"][\"Type\"];\n\nexport type ActionError<A extends AnyAuthAction> =\n  A[\"route\"][\"operation\"][\"rpc\"][\"errorSchema\"][\"Type\"];\n"],"mappings":";;;;;;;;;;AAuCA,MAAa,UAQX,YAKA,OAAO,OAAO;CACZ,GAAG;CACH,QAAQ,QAAQ;CAChB,UAAU,QAAQ;CAClB,eAAe,OAAO,OAAO,EAAE,GAAG,QAAQ,cAAc,CAAC;CACzD,SAAS,OAAO,OAAO,CAAC,GAAI,QAAQ,WAAW,CAAC,CAAE,CAAC;AACrD,CAAC;;;AAOH,MAAa,iBASX,WAWA,UAOI,CAAC,MACF;CACH,IAAI,UAAU,aAAa,UACzB,MAAM,4BAA4B,KAAK;EACrC,QAAQ;EACR,WAAW,QAAQ,UAAU;CAC/B,CAAC;CAGH,MAAM,SAAS,OAAO,YACpB,OAAO,QAAQ,UAAU,IAAI,cAAc,MAAM,CAAC,CAAC,QAChD,CAAC,UAAU,CAAC,OAAO,OAAO,QAAQ,iBAAiB,CAAC,GAAG,IAAI,CAC9D,CACF;CAEA,OAAO,OAAO;EACZ,SAAS,OAAO,OAAO,MAAM;EAC7B,SAAS,UAAU,IAAI;EACvB,OAAO,UAAU,IAAI;EACrB,QAAQ,UAAU;EAClB,aAAa,UAAU;EACvB,SAAS,UAAU;EACnB,GAAG;EACH,MAAO,QAAQ,QAAQ;CACzB,CAAC;AACH;AAEA,MAAM,cAOJ,WACA,UACA,MACA,eACG;CACH,MAAM,gBAAgB,OAAO,OAAO,EAAE,GAAG,WAAW,cAAc,CAAC;CACnE,MAAM,UAAU,OAAO,OAAO,CAAC,GAAI,WAAW,WAAW,CAAC,CAAE,CAAC;CAE7D,IACE,CAAC,OAAO,GAAG,OAAO,eAAe,MAAM,OAAO,UAAU,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,KACxF;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,IAAI,KACd,WAAW,SAAS,YAClB,WAAW,gBAAgB,QAC1B,QAAQ,SAAS,KAChB,WAAW,WAAW,KAAA,KAAa,WAAW,WAAW,cAE9D,MAAM,4BAA4B,KAAK;EAAE,QAAQ;EAAkB,WAAW;CAAK,CAAC;CAEtF,MAAM,YAAY,cAAc,GAAG,UAAU,OAAO,QAAQ;EAC1D,SAAS,WAAW;EACpB,SAAS,WAAW;EACpB,OAAO,OAAO,MAAM;GAAC,WAAW;GAAO;GAAc;EAAU,CAAC;EAChE,QAAQ;EACR,UAAU;EACV,QAAQ,WAAW,SAAS,UAAU,cAAe,WAAW,UAAU;EAC1E,GAAI,WAAW,gBAAgB,OAAO,EAAE,aAAa,KAAc,IAAI,CAAC;EACxE,GAAI,QAAQ,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CAC1C,CAAC;CAED,OAAO,OAAO,OAAO;EACnB,OAAO,OAAO,OAAO;GACnB;GACA,MAAM,GAAG,SAAS,GAAG;GACrB,QACE,WAAW,SAAS,WACpB,OAAO,KAAK,aAAa,CAAC,CAAC,WAAW,MACrC,UAAU,OAAO,OAAO,UAAU,WAAW,OAAO,CAAC,CAAC,GAAG,KACxD,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO,CAAC,CAAC,GAAG,KAC3D,QACA;GACP,aAAa,OAAO,OAAO,CAAC,CAAC;GAC7B;EACF,CAAC;EACD,MAAM,WAAW;EACjB,QAAQ,WAAW,UAAU;EAC7B,UAAU,WAAW;EACrB;EACA,SAAS,WAAW;CACtB,CAAC;AACH;AAkDA,MAAM,kBAGJ,aACI;CACJ,YAAY,OAAO;EACjB,SAAS,OAAO;EAChB,SAAS,OAAO,OAAO,OAAO;EAC9B,OAAO,OAAO;EACd,MAAM;EACN,SAAS,EAAE,cAAc,UAAU,OAAO,aAAa,KAAK;CAC9D,CAAC;CACD,gBAAgB,OAAO;EACrB,SAAS,OAAO;EAChB,SAAS;EACT,OAAO,OAAO;EACd,MAAM;EACN,SAAS,EAAE,cAAc,UAAU,MAAM,UAAU;CACrD,CAAC;CACD,SAAS,OAAO;EACd,SAAS,OAAO;EAChB,SAAS,OAAO,MAAM,CAAC,gBAAgB,yBAAyB,CAAC;EACjE,OAAO,OAAO;EACd,MAAM;EACN,QAAQ;EACR,aAAa;EACb,SAAS,EAAE,mBAAmB,KAAK;CACrC,CAAC;CACD,cAAc,OAAO;EACnB,SAAS,OAAO;EAChB,SAAS;EACT,OAAO,OAAO;EACd,MAAM;EACN,aAAa;CACf,CAAC;AACH;;;AAIA,MAAa,QAKX,WACA,YAOG;CACH,IACE,CAAC,OAAO,GACN,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,GAAG,OAAO,UAAU,qBAAqB,CAAC,CAC9F,CAAC,CAAC,SAAS,GAEX,MAAM,4BAA4B,KAAK;EAAE,QAAQ;EAAkB,WAAW;CAAU,CAAC;CAE3F,MAAM,WAAW,QAAQ,YAAY;CAErC,IACE,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,yCAAyC,CAAC,CAAC,CAAC,CAC1F,QACF,GAEA,MAAM,4BAA4B,KAAK;EAAE,QAAQ;EAAkB,WAAW;CAAU,CAAC;CAE3F,MAAM,WAAW,oBAAoB,GAAG,UAAU,YAAY,QAAQ,MAAM;CAC5E,MAAM,WAAW,eAAe,SAAS,OAAO;CAChD,MAAM,aAAa,QAAQ,UAAU,QAAQ,KAAK,CAAC;CAEnD,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,MAAM,SAAS,OAAO,OAAO,UAAU,IAAI,CAAC,GACtE,MAAM,4BAA4B,KAAK;EAAE,QAAQ;EAAuB,WAAW;CAAU,CAAC;CAEhG,MAAM,cAAc;EAAE,GAAG;EAAU,GAAG;CAAW;CAEjD,MAAM,UAAU,OAAO,YACpB,OAAO,QAAQ,WAAW,CAAC,CAAuC,KAAK,CAAC,MAAM,gBAAgB,CAC7F,MACA,WAAW,WAAW,UAAU,MAAM,UAAU,CAClD,CAAC,CACH;CAGA,OAAO,OAAO,OAAO;EACnB;EACA,QAAQ,QAAQ;EAChB;EACA,SAAS,OAAO,OAAO,OAAO;CAChC,CAAC;AACH"}

package/dist/operations/context.d.mts

@@ -0,0 +1,63 @@
+import { SubjectId } from "../Schema.mjs";
+import { AssuranceRequired, AuthenticationRequired, OperationForbidden } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/operations/context.d.ts
+declare const AuthenticationFactor: Schema.Literals<readonly ["knowledge", "possession", "inherence"]>;
+type AuthenticationFactor = typeof AuthenticationFactor.Type;
+declare const AssuranceEvidence: Schema.Struct<{
+  readonly method: Schema.NonEmptyString;
+  /** Opaque within one session; multiple proofs of the same credential share it. */
+  readonly credentialOrdinal: Schema.optionalKey<Schema.Int>;
+  readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+  readonly userVerified: Schema.Boolean;
+  readonly phishingResistant: Schema.Boolean;
+  readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+}>;
+declare const AuthenticationAssurance_base: Schema.Class<AuthenticationAssurance, Schema.Struct<{
+  readonly method: Schema.NonEmptyString;
+  readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+  readonly authenticatedAt: Schema.DateTimeUtcFromMillis;
+  /** WebAuthn UV is separate from knowledge/inherence: the RP cannot tell PIN from biometrics. */
+  readonly evidence: Schema.optionalKey<Schema.NonEmptyArray<Schema.Struct<{
+    readonly method: Schema.NonEmptyString;
+    /** Opaque within one session; multiple proofs of the same credential share it. */
+    readonly credentialOrdinal: Schema.optionalKey<Schema.Int>;
+    readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    readonly userVerified: Schema.Boolean;
+    readonly phishingResistant: Schema.Boolean;
+    readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+  }>>>;
+}>, {}>;
+/** Describes completed authentication, never a pending second-factor challenge. */
+declare class AuthenticationAssurance extends AuthenticationAssurance_base {}
+interface GuestInvocation {
+  readonly _tag: "Guest";
+}
+interface AuthenticatedInvocation {
+  readonly _tag: "Authenticated";
+  readonly subjectId: SubjectId;
+  readonly sessionId?: string;
+  readonly assurance: AuthenticationAssurance;
+}
+/** Application authority creates this context; clients cannot request it in a payload. */
+interface SystemInvocation {
+  readonly _tag: "System";
+  readonly authority: string;
+}
+/** Passed explicitly per invocation. Never install a caller in a shared handler Layer. */
+type AuthInvocation = GuestInvocation | AuthenticatedInvocation | SystemInvocation;
+declare const guest: GuestInvocation;
+declare const requireAuthenticated: (context: AuthInvocation) => Effect.Effect<never, AuthenticationRequired, never> | Effect.Effect<AuthenticatedInvocation, never, never>;
+declare const requireOwnership: (context: AuthInvocation, subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => Effect.Effect<AuthenticatedInvocation, AuthenticationRequired | OperationForbidden, never>;
+interface AssuranceRequirement {
+  readonly factors?: ReadonlyArray<AuthenticationFactor>;
+  readonly maximumAgeMillis: number;
+  readonly minimumCredentials?: number;
+  readonly userVerified?: true;
+  readonly phishingResistant?: true;
+}
+/** Reject future timestamps as well as stale authentication. */
+declare const requireAssurance: (context: AuthInvocation, requirement: AssuranceRequirement) => Effect.Effect<AuthenticatedInvocation, AssuranceRequired | AuthenticationRequired, never>;
+//#endregion
+export { AssuranceEvidence, AssuranceRequirement, AuthInvocation, AuthenticatedInvocation, AuthenticationAssurance, AuthenticationFactor, GuestInvocation, SystemInvocation, guest, requireAssurance, requireAuthenticated, requireOwnership };
+//# sourceMappingURL=context.d.mts.map

package/dist/operations/context.mjs

@@ -0,0 +1,55 @@
+import { AssuranceRequired, AuthenticationRequired, OperationForbidden } from "./errors.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/operations/context.ts
+const AuthenticationFactor = Schema.Literals([
+	"knowledge",
+	"possession",
+	"inherence"
+]);
+const AssuranceEvidence = Schema.Struct({
+	method: Schema.NonEmptyString,
+	/** Opaque within one session; multiple proofs of the same credential share it. */
+	credentialOrdinal: Schema.optionalKey(Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 63
+	}))),
+	factors: Schema.Array(AuthenticationFactor),
+	userVerified: Schema.Boolean,
+	phishingResistant: Schema.Boolean,
+	verifiedAt: Schema.DateTimeUtcFromMillis
+});
+/** Describes completed authentication, never a pending second-factor challenge. */
+var AuthenticationAssurance = class extends Schema.Class("effect-auth/AuthenticationAssurance")({
+	method: Schema.NonEmptyString,
+	factors: Schema.Array(AuthenticationFactor),
+	authenticatedAt: Schema.DateTimeUtcFromMillis,
+	/** WebAuthn UV is separate from knowledge/inherence: the RP cannot tell PIN from biometrics. */
+	evidence: Schema.optionalKey(Schema.NonEmptyArray(AssuranceEvidence))
+}) {};
+const guest = Object.freeze({ _tag: "Guest" });
+const requireAuthenticated = (context) => context._tag === "Authenticated" ? Effect.succeed(context) : Effect.fail(AuthenticationRequired.make({}));
+const requireOwnership = Effect.fn("AuthOperation.requireOwnership")(function* (context, subjectId) {
+	const caller = yield* requireAuthenticated(context);
+	if (caller.subjectId !== subjectId) return yield* OperationForbidden.make({});
+	return caller;
+});
+/** Reject future timestamps as well as stale authentication. */
+const requireAssurance = Effect.fn("AuthOperation.requireAssurance")(function* (context, requirement) {
+	const caller = yield* requireAuthenticated(context);
+	const maximumAge = yield* Schema.decodeEffect(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)))(requirement.maximumAgeMillis).pipe(Effect.orDie);
+	const minimum = yield* Schema.decodeEffect(Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 64
+	})))(requirement.minimumCredentials ?? 1).pipe(Effect.orDie);
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (DateTime.toEpochMillis(caller.assurance.authenticatedAt) > now || caller.assurance.evidence?.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > now)) return yield* AssuranceRequired.make({});
+	const fresh = caller.assurance.evidence?.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < maximumAge) ?? [];
+	const factors = new Set(fresh.flatMap((proof) => proof.factors));
+	const ordinals = new Set(fresh.flatMap((proof) => proof.credentialOrdinal === void 0 ? [] : [proof.credentialOrdinal]));
+	if (fresh.length === 0 || requirement.factors !== void 0 && !requirement.factors.every((factor) => factors.has(factor)) || minimum > 1 && ordinals.size < minimum || !fresh.some((proof) => (requirement.userVerified !== true || proof.userVerified) && (requirement.phishingResistant !== true || proof.phishingResistant))) return yield* AssuranceRequired.make({});
+	return caller;
+});
+//#endregion
+export { AssuranceEvidence, AuthenticationAssurance, AuthenticationFactor, guest, requireAssurance, requireAuthenticated, requireOwnership };
+
+//# sourceMappingURL=context.mjs.map

package/dist/operations/context.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.mjs","names":[],"sources":["../../src/operations/context.ts"],"sourcesContent":["import { DateTime, Effect, Schema } from \"effect\";\n\nimport type { SubjectId } from \"../Schema\";\nimport { AssuranceRequired, AuthenticationRequired, OperationForbidden } from \"./errors\";\n\nexport const AuthenticationFactor = Schema.Literals([\"knowledge\", \"possession\", \"inherence\"]);\nexport type AuthenticationFactor = typeof AuthenticationFactor.Type;\n\nexport const AssuranceEvidence = Schema.Struct({\n  method: Schema.NonEmptyString,\n  /** Opaque within one session; multiple proofs of the same credential share it. */\n  credentialOrdinal: Schema.optionalKey(\n    Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 63 })),\n  ),\n  factors: Schema.Array(AuthenticationFactor),\n  userVerified: Schema.Boolean,\n  phishingResistant: Schema.Boolean,\n  verifiedAt: Schema.DateTimeUtcFromMillis,\n});\n\n/** Describes completed authentication, never a pending second-factor challenge. */\nexport class AuthenticationAssurance extends Schema.Class<AuthenticationAssurance>(\n  \"effect-auth/AuthenticationAssurance\",\n)({\n  method: Schema.NonEmptyString,\n  factors: Schema.Array(AuthenticationFactor),\n  authenticatedAt: Schema.DateTimeUtcFromMillis,\n  /** WebAuthn UV is separate from knowledge/inherence: the RP cannot tell PIN from biometrics. */\n  evidence: Schema.optionalKey(Schema.NonEmptyArray(AssuranceEvidence)),\n}) {}\n\nexport interface GuestInvocation {\n  readonly _tag: \"Guest\";\n}\n\nexport interface AuthenticatedInvocation {\n  readonly _tag: \"Authenticated\";\n  readonly subjectId: SubjectId;\n  readonly sessionId?: string;\n  readonly assurance: AuthenticationAssurance;\n}\n\n/** Application authority creates this context; clients cannot request it in a payload. */\nexport interface SystemInvocation {\n  readonly _tag: \"System\";\n  readonly authority: string;\n}\n\n/** Passed explicitly per invocation. Never install a caller in a shared handler Layer. */\nexport type AuthInvocation = GuestInvocation | AuthenticatedInvocation | SystemInvocation;\n\nexport const guest: GuestInvocation = Object.freeze({ _tag: \"Guest\" });\n\nexport const requireAuthenticated = (context: AuthInvocation) =>\n  context._tag === \"Authenticated\"\n    ? Effect.succeed(context)\n    : Effect.fail(AuthenticationRequired.make({}));\n\nexport const requireOwnership = Effect.fn(\"AuthOperation.requireOwnership\")(function* (\n  context: AuthInvocation,\n  subjectId: SubjectId,\n) {\n  const caller = yield* requireAuthenticated(context);\n\n  if (caller.subjectId !== subjectId) {\n    return yield* OperationForbidden.make({});\n  }\n\n  return caller;\n});\n\nexport interface AssuranceRequirement {\n  readonly factors?: ReadonlyArray<AuthenticationFactor>;\n  readonly maximumAgeMillis: number;\n  readonly minimumCredentials?: number;\n  readonly userVerified?: true;\n  readonly phishingResistant?: true;\n}\n\n/** Reject future timestamps as well as stale authentication. */\nexport const requireAssurance = Effect.fn(\"AuthOperation.requireAssurance\")(function* (\n  context: AuthInvocation,\n  requirement: AssuranceRequirement,\n) {\n  const caller = yield* requireAuthenticated(context);\n\n  const maximumAge = yield* Schema.decodeEffect(\n    Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)),\n  )(requirement.maximumAgeMillis).pipe(Effect.orDie);\n\n  const minimum = yield* Schema.decodeEffect(\n    Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n  )(requirement.minimumCredentials ?? 1).pipe(Effect.orDie);\n\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (\n    DateTime.toEpochMillis(caller.assurance.authenticatedAt) > now ||\n    caller.assurance.evidence?.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > now)\n  )\n    return yield* AssuranceRequired.make({});\n\n  const fresh =\n    caller.assurance.evidence?.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < maximumAge,\n    ) ?? [];\n\n  const factors = new Set(fresh.flatMap((proof) => proof.factors));\n\n  const ordinals = new Set(\n    fresh.flatMap((proof) =>\n      proof.credentialOrdinal === undefined ? [] : [proof.credentialOrdinal],\n    ),\n  );\n\n  if (\n    fresh.length === 0 ||\n    (requirement.factors !== undefined &&\n      !requirement.factors.every((factor) => factors.has(factor))) ||\n    (minimum > 1 && ordinals.size < minimum) ||\n    !fresh.some(\n      (proof) =>\n        (requirement.userVerified !== true || proof.userVerified) &&\n        (requirement.phishingResistant !== true || proof.phishingResistant),\n    )\n  )\n    return yield* AssuranceRequired.make({});\n\n  return caller;\n});\n"],"mappings":";;;AAKA,MAAa,uBAAuB,OAAO,SAAS;CAAC;CAAa;CAAc;AAAW,CAAC;AAG5F,MAAa,oBAAoB,OAAO,OAAO;CAC7C,QAAQ,OAAO;;CAEf,mBAAmB,OAAO,YACxB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC,CAChE;CACA,SAAS,OAAO,MAAM,oBAAoB;CAC1C,cAAc,OAAO;CACrB,mBAAmB,OAAO;CAC1B,YAAY,OAAO;AACrB,CAAC;;AAGD,IAAa,0BAAb,cAA6C,OAAO,MAClD,qCACF,CAAC,CAAC;CACA,QAAQ,OAAO;CACf,SAAS,OAAO,MAAM,oBAAoB;CAC1C,iBAAiB,OAAO;;CAExB,UAAU,OAAO,YAAY,OAAO,cAAc,iBAAiB,CAAC;AACtE,CAAC,CAAC,CAAC,CAAC;AAsBJ,MAAa,QAAyB,OAAO,OAAO,EAAE,MAAM,QAAQ,CAAC;AAErE,MAAa,wBAAwB,YACnC,QAAQ,SAAS,kBACb,OAAO,QAAQ,OAAO,IACtB,OAAO,KAAK,uBAAuB,KAAK,CAAC,CAAC,CAAC;AAEjD,MAAa,mBAAmB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAC1E,SACA,WACA;CACA,MAAM,SAAS,OAAO,qBAAqB,OAAO;CAElD,IAAI,OAAO,cAAc,WACvB,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;CAG1C,OAAO;AACT,CAAC;;AAWD,MAAa,mBAAmB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAC1E,SACA,aACA;CACA,MAAM,SAAS,OAAO,qBAAqB,OAAO;CAElD,MAAM,aAAa,OAAO,OAAO,aAC/B,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC,CACtD,CAAC,CAAC,YAAY,gBAAgB,CAAC,CAAC,KAAK,OAAO,KAAK;CAEjD,MAAM,UAAU,OAAO,OAAO,aAC5B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC,CAChE,CAAC,CAAC,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK;CAExD,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,IACE,SAAS,cAAc,OAAO,UAAU,eAAe,IAAI,OAC3D,OAAO,UAAU,UAAU,MAAM,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,GAEzF,OAAO,OAAO,kBAAkB,KAAK,CAAC,CAAC;CAEzC,MAAM,QACJ,OAAO,UAAU,UAAU,QACxB,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,UAC9D,KAAK,CAAC;CAER,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;CAE/D,MAAM,WAAW,IAAI,IACnB,MAAM,SAAS,UACb,MAAM,sBAAsB,KAAA,IAAY,CAAC,IAAI,CAAC,MAAM,iBAAiB,CACvE,CACF;CAEA,IACE,MAAM,WAAW,KAChB,YAAY,YAAY,KAAA,KACvB,CAAC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KAC3D,UAAU,KAAK,SAAS,OAAO,WAChC,CAAC,MAAM,MACJ,WACE,YAAY,iBAAiB,QAAQ,MAAM,kBAC3C,YAAY,sBAAsB,QAAQ,MAAM,kBACrD,GAEA,OAAO,OAAO,kBAAkB,KAAK,CAAC,CAAC;CAEzC,OAAO;AACT,CAAC"}

package/dist/operations/credentials.d.mts

@@ -0,0 +1,39 @@
+import { AuthInvocation } from "./context.mjs";
+import { AuthRevealCommand, AuthRevealCommandCollector } from "./reveals.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/operations/credentials.d.ts
+type CredentialSlot = "session" | "pending-proof" | "proof-continuation" | "registration" | "request-binding" | "session-step-up" | "password-intent";
+/** Private delivery instructions. Never include these in a Schema/RPC success or lifecycle event. */
+type AuthCredentialCommand = {
+  readonly _tag: "Issue";
+  readonly slot: CredentialSlot;
+  readonly credential: Redacted.Redacted<string>;
+  readonly expiresAtMillis: number;
+} | {
+  readonly _tag: "Clear";
+  readonly slot: CredentialSlot;
+};
+/** Acceptance into a caller-owned collector, not fallible cookie or secure-store persistence. */
+type AuthCredentialCommandSink = (commands: ReadonlyArray<AuthCredentialCommand>) => Effect.Effect<void>;
+declare const AuthCredentialCommandCollector_base: Context.ServiceClass<AuthCredentialCommandCollector, "effect-auth/AuthCredentialCommandCollector", AuthCredentialCommandSink>;
+/** Request-local acceptance for private credential commands. */
+declare class AuthCredentialCommandCollector extends AuthCredentialCommandCollector_base {}
+declare const AuthRevealCommandCollectorService_base: Context.ServiceClass<AuthRevealCommandCollectorService, "effect-auth/AuthRevealCommandCollector", AuthRevealCommandCollector>;
+/** Request-local acceptance for private reveal commands. */
+declare class AuthRevealCommandCollectorService extends AuthRevealCommandCollectorService_base {}
+interface AuthOperationResult<A> {
+  readonly value: A;
+  readonly credentialCommands: ReadonlyArray<AuthCredentialCommand>;
+  readonly revealCommands?: ReadonlyArray<AuthRevealCommand>;
+}
+interface AuthResolvedCall {
+  readonly invocation: AuthInvocation;
+  /** Private incoming credentials for this request or native workflow only. */
+  readonly credentials: Readonly<Partial<Record<CredentialSlot, Redacted.Redacted<string>>>>;
+  readonly credentialCommandSink: AuthCredentialCommandSink;
+  readonly revealCommandCollector?: AuthRevealCommandCollector;
+}
+declare const validateCredentialCommands: (commands: ReadonlyArray<AuthCredentialCommand>) => Effect.Effect<readonly AuthCredentialCommand[], never, never>;
+//#endregion
+export { AuthCredentialCommand, AuthCredentialCommandCollector, AuthCredentialCommandSink, AuthOperationResult, AuthResolvedCall, AuthRevealCommandCollectorService, CredentialSlot, validateCredentialCommands };
+//# sourceMappingURL=credentials.d.mts.map

package/dist/operations/credentials.mjs

@@ -0,0 +1,60 @@
+import { Context, Effect, Redacted, Schema } from "effect";
+//#region src/operations/credentials.ts
+/** Request-local acceptance for private credential commands. */
+var AuthCredentialCommandCollector = class extends Context.Service()("effect-auth/AuthCredentialCommandCollector") {};
+/** Request-local acceptance for private reveal commands. */
+var AuthRevealCommandCollectorService = class extends Context.Service()("effect-auth/AuthRevealCommandCollector") {};
+const slot = Schema.Literals([
+	"session",
+	"pending-proof",
+	"proof-continuation",
+	"registration",
+	"request-binding",
+	"session-step-up",
+	"password-intent"
+]);
+const decodeCommand = Schema.decodeSync(Schema.Union([Schema.Struct({
+	_tag: Schema.Literal("Issue"),
+	slot,
+	credential: Schema.Redacted(Schema.String),
+	expiresAtMillis: Schema.Finite
+}), Schema.Struct({
+	_tag: Schema.Literal("Clear"),
+	slot
+})]));
+/** Package-private synchronous capture shared with the reveal operation boundary. */
+const snapshotCredentialCommands = (commands) => {
+	try {
+		if (!Array.isArray(commands)) throw new globalThis.Error();
+		const length = commands.length;
+		if (!Number.isInteger(length) || length < 0 || length > 7) throw new globalThis.Error();
+		const slots = /* @__PURE__ */ new Set();
+		const captured = [];
+		for (let index = 0; index < length; index++) {
+			const input = commands[index];
+			const tag = input._tag;
+			const slot = input.slot;
+			const value = tag === "Issue" ? {
+				_tag: tag,
+				slot,
+				credential: Redacted.make(Redacted.value(input.credential)),
+				expiresAtMillis: input.expiresAtMillis
+			} : {
+				_tag: tag,
+				slot
+			};
+			const command = decodeCommand(value);
+			if (slots.has(command.slot)) throw new globalThis.Error();
+			slots.add(command.slot);
+			captured.push(Object.freeze(command));
+		}
+		return Object.freeze(captured);
+	} catch {
+		throw new globalThis.Error("Invalid auth credential commands");
+	}
+};
+const validateCredentialCommands = (commands) => Effect.sync(() => snapshotCredentialCommands(commands));
+//#endregion
+export { AuthCredentialCommandCollector, AuthRevealCommandCollectorService, snapshotCredentialCommands, validateCredentialCommands };
+
+//# sourceMappingURL=credentials.mjs.map

package/dist/operations/credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.mjs","names":[],"sources":["../../src/operations/credentials.ts"],"sourcesContent":["import { Context, Effect, Redacted, Schema } from \"effect\";\n\nimport type { AuthInvocation } from \"./context\";\nimport type { AuthRevealCommand, AuthRevealCommandCollector } from \"./reveals\";\n\nexport type CredentialSlot =\n  | \"session\"\n  | \"pending-proof\"\n  | \"proof-continuation\"\n  | \"registration\"\n  | \"request-binding\"\n  | \"session-step-up\"\n  | \"password-intent\";\n\n/** Private delivery instructions. Never include these in a Schema/RPC success or lifecycle event. */\nexport type AuthCredentialCommand =\n  | {\n      readonly _tag: \"Issue\";\n      readonly slot: CredentialSlot;\n      readonly credential: Redacted.Redacted<string>;\n      readonly expiresAtMillis: number;\n    }\n  | { readonly _tag: \"Clear\"; readonly slot: CredentialSlot };\n\n/** Acceptance into a caller-owned collector, not fallible cookie or secure-store persistence. */\nexport type AuthCredentialCommandSink = (\n  commands: ReadonlyArray<AuthCredentialCommand>,\n) => Effect.Effect<void>;\n\n/** Request-local acceptance for private credential commands. */\nexport class AuthCredentialCommandCollector extends Context.Service<\n  AuthCredentialCommandCollector,\n  AuthCredentialCommandSink\n>()(\"effect-auth/AuthCredentialCommandCollector\") {}\n\n/** Request-local acceptance for private reveal commands. */\nexport class AuthRevealCommandCollectorService extends Context.Service<\n  AuthRevealCommandCollectorService,\n  AuthRevealCommandCollector\n>()(\"effect-auth/AuthRevealCommandCollector\") {}\n\nexport interface AuthOperationResult<A> {\n  readonly value: A;\n  readonly credentialCommands: ReadonlyArray<AuthCredentialCommand>;\n  readonly revealCommands?: ReadonlyArray<AuthRevealCommand>;\n}\n\nexport interface AuthResolvedCall {\n  readonly invocation: AuthInvocation;\n  /** Private incoming credentials for this request or native workflow only. */\n  readonly credentials: Readonly<Partial<Record<CredentialSlot, Redacted.Redacted<string>>>>;\n  readonly credentialCommandSink: AuthCredentialCommandSink;\n  readonly revealCommandCollector?: AuthRevealCommandCollector;\n}\n\nconst slot = Schema.Literals([\n  \"session\",\n  \"pending-proof\",\n  \"proof-continuation\",\n  \"registration\",\n  \"request-binding\",\n  \"session-step-up\",\n  \"password-intent\",\n]);\n\nconst decodeCommand = Schema.decodeSync(\n  Schema.Union([\n    Schema.Struct({\n      _tag: Schema.Literal(\"Issue\"),\n      slot,\n      credential: Schema.Redacted(Schema.String),\n      expiresAtMillis: Schema.Finite,\n    }),\n    Schema.Struct({ _tag: Schema.Literal(\"Clear\"), slot }),\n  ]),\n);\n\n/** Package-private synchronous capture shared with the reveal operation boundary. */\nexport const snapshotCredentialCommands = (\n  commands: ReadonlyArray<AuthCredentialCommand>,\n): ReadonlyArray<AuthCredentialCommand> => {\n  try {\n    if (!Array.isArray(commands)) throw new globalThis.Error();\n    const length = commands.length;\n\n    if (!Number.isInteger(length) || length < 0 || length > 7) throw new globalThis.Error();\n    const slots = new Set<CredentialSlot>();\n    const captured: AuthCredentialCommand[] = [];\n\n    for (let index = 0; index < length; index++) {\n      const input = commands[index];\n      const tag = input._tag;\n      const slot = input.slot;\n\n      const value =\n        tag === \"Issue\"\n          ? {\n              _tag: tag,\n              slot,\n              credential: Redacted.make(Redacted.value(input.credential)),\n              expiresAtMillis: input.expiresAtMillis,\n            }\n          : { _tag: tag, slot };\n\n      const command = decodeCommand(value);\n\n      if (slots.has(command.slot)) {\n        throw new globalThis.Error();\n      }\n      slots.add(command.slot);\n      captured.push(Object.freeze(command));\n    }\n\n    return Object.freeze(captured);\n  } catch {\n    throw new globalThis.Error(\"Invalid auth credential commands\");\n  }\n};\n\nexport const validateCredentialCommands = (commands: ReadonlyArray<AuthCredentialCommand>) =>\n  Effect.sync(() => snapshotCredentialCommands(commands));\n"],"mappings":";;;AA8BA,IAAa,iCAAb,cAAoD,QAAQ,QAG1D,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC;;AAGnD,IAAa,oCAAb,cAAuD,QAAQ,QAG7D,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;AAgB/C,MAAM,OAAO,OAAO,SAAS;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,WAC3B,OAAO,MAAM,CACX,OAAO,OAAO;CACZ,MAAM,OAAO,QAAQ,OAAO;CAC5B;CACA,YAAY,OAAO,SAAS,OAAO,MAAM;CACzC,iBAAiB,OAAO;AAC1B,CAAC,GACD,OAAO,OAAO;CAAE,MAAM,OAAO,QAAQ,OAAO;CAAG;AAAK,CAAC,CACvD,CAAC,CACH;;AAGA,MAAa,8BACX,aACyC;CACzC,IAAI;EACF,IAAI,CAAC,MAAM,QAAQ,QAAQ,GAAG,MAAM,IAAI,WAAW,MAAM;EACzD,MAAM,SAAS,SAAS;EAExB,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,GAAG,MAAM,IAAI,WAAW,MAAM;EACtF,MAAM,wBAAQ,IAAI,IAAoB;EACtC,MAAM,WAAoC,CAAC;EAE3C,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,SAAS;GAC3C,MAAM,QAAQ,SAAS;GACvB,MAAM,MAAM,MAAM;GAClB,MAAM,OAAO,MAAM;GAEnB,MAAM,QACJ,QAAQ,UACJ;IACE,MAAM;IACN;IACA,YAAY,SAAS,KAAK,SAAS,MAAM,MAAM,UAAU,CAAC;IAC1D,iBAAiB,MAAM;GACzB,IACA;IAAE,MAAM;IAAK;GAAK;GAExB,MAAM,UAAU,cAAc,KAAK;GAEnC,IAAI,MAAM,IAAI,QAAQ,IAAI,GACxB,MAAM,IAAI,WAAW,MAAM;GAE7B,MAAM,IAAI,QAAQ,IAAI;GACtB,SAAS,KAAK,OAAO,OAAO,OAAO,CAAC;EACtC;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B,QAAQ;EACN,MAAM,IAAI,WAAW,MAAM,kCAAkC;CAC/D;AACF;AAEA,MAAa,8BAA8B,aACzC,OAAO,WAAW,2BAA2B,QAAQ,CAAC"}

package/dist/operations/errors.d.mts

@@ -0,0 +1,24 @@
+import { Schema } from "effect";
+//#region src/operations/errors.d.ts
+declare const OperationConfigurationError_base: Schema.Class<OperationConfigurationError, Schema.TaggedStruct<"OperationConfigurationError", {
+  readonly reason: Schema.Literals<readonly ["duplicate-operation", "invalid-action", "internal-exposure", "credential-handler", "reveal-configuration", "private-handler"]>;
+  readonly operation: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Invalid static composition; never a wire failure or an authentication rejection. */
+declare class OperationConfigurationError extends OperationConfigurationError_base {}
+declare const InvalidOperationInput_base: Schema.Class<InvalidOperationInput, Schema.TaggedStruct<"InvalidOperationInput", {}>, import("effect/Cause").YieldableError>;
+/** Intentionally excludes the invalid value and parser details, which may contain secrets. */
+declare class InvalidOperationInput extends InvalidOperationInput_base {}
+declare const AuthenticationRequired_base: Schema.Class<AuthenticationRequired, Schema.TaggedStruct<"AuthenticationRequired", {}>, import("effect/Cause").YieldableError>;
+declare class AuthenticationRequired extends AuthenticationRequired_base {}
+declare const OperationForbidden_base: Schema.Class<OperationForbidden, Schema.TaggedStruct<"OperationForbidden", {}>, import("effect/Cause").YieldableError>;
+declare class OperationForbidden extends OperationForbidden_base {}
+declare const AssuranceRequired_base: Schema.Class<AssuranceRequired, Schema.TaggedStruct<"AssuranceRequired", {}>, import("effect/Cause").YieldableError>;
+declare class AssuranceRequired extends AssuranceRequired_base {}
+declare const OperationPrivateOutputUnsupported_base: Schema.Class<OperationPrivateOutputUnsupported, Schema.TaggedStruct<"OperationPrivateOutputUnsupported", {}>, import("effect/Cause").YieldableError>;
+declare class OperationPrivateOutputUnsupported extends OperationPrivateOutputUnsupported_base {}
+declare const OperationBoundaryError: Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>;
+type OperationBoundaryError = typeof OperationBoundaryError.Type;
+//#endregion
+export { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationBoundaryError, OperationConfigurationError, OperationForbidden, OperationPrivateOutputUnsupported };
+//# sourceMappingURL=errors.d.mts.map

package/dist/operations/errors.mjs

@@ -0,0 +1,31 @@
+import { Schema } from "effect";
+//#region src/operations/errors.ts
+/** Invalid static composition; never a wire failure or an authentication rejection. */
+var OperationConfigurationError = class extends Schema.TaggedError()("OperationConfigurationError", {
+	reason: Schema.Literals([
+		"duplicate-operation",
+		"invalid-action",
+		"internal-exposure",
+		"credential-handler",
+		"reveal-configuration",
+		"private-handler"
+	]),
+	operation: Schema.String
+}) {};
+/** Intentionally excludes the invalid value and parser details, which may contain secrets. */
+var InvalidOperationInput = class extends Schema.TaggedError()("InvalidOperationInput", {}) {};
+var AuthenticationRequired = class extends Schema.TaggedError()("AuthenticationRequired", {}) {};
+var OperationForbidden = class extends Schema.TaggedError()("OperationForbidden", {}) {};
+var AssuranceRequired = class extends Schema.TaggedError()("AssuranceRequired", {}) {};
+var OperationPrivateOutputUnsupported = class extends Schema.TaggedError()("OperationPrivateOutputUnsupported", {}) {};
+const OperationBoundaryError = Schema.Union([
+	InvalidOperationInput,
+	AuthenticationRequired,
+	OperationForbidden,
+	AssuranceRequired,
+	OperationPrivateOutputUnsupported
+]);
+//#endregion
+export { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationBoundaryError, OperationConfigurationError, OperationForbidden, OperationPrivateOutputUnsupported };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/operations/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../src/operations/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n/** Invalid static composition; never a wire failure or an authentication rejection. */\nexport class OperationConfigurationError extends Schema.TaggedError<OperationConfigurationError>()(\n  \"OperationConfigurationError\",\n  {\n    reason: Schema.Literals([\n      \"duplicate-operation\",\n      \"invalid-action\",\n      \"internal-exposure\",\n      \"credential-handler\",\n      \"reveal-configuration\",\n      \"private-handler\",\n    ]),\n    operation: Schema.String,\n  },\n) {}\n\n/** Intentionally excludes the invalid value and parser details, which may contain secrets. */\nexport class InvalidOperationInput extends Schema.TaggedError<InvalidOperationInput>()(\n  \"InvalidOperationInput\",\n  {},\n) {}\n\nexport class AuthenticationRequired extends Schema.TaggedError<AuthenticationRequired>()(\n  \"AuthenticationRequired\",\n  {},\n) {}\n\nexport class OperationForbidden extends Schema.TaggedError<OperationForbidden>()(\n  \"OperationForbidden\",\n  {},\n) {}\n\nexport class AssuranceRequired extends Schema.TaggedError<AssuranceRequired>()(\n  \"AssuranceRequired\",\n  {},\n) {}\n\nexport class OperationPrivateOutputUnsupported extends Schema.TaggedError<OperationPrivateOutputUnsupported>()(\n  \"OperationPrivateOutputUnsupported\",\n  {},\n) {}\n\nexport const OperationBoundaryError = Schema.Union([\n  InvalidOperationInput,\n  AuthenticationRequired,\n  OperationForbidden,\n  AssuranceRequired,\n  OperationPrivateOutputUnsupported,\n]);\n\nexport type OperationBoundaryError = typeof OperationBoundaryError.Type;\n"],"mappings":";;;AAGA,IAAa,8BAAb,cAAiD,OAAO,YAAyC,CAAC,CAChG,+BACA;CACE,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,oCAAb,cAAuD,OAAO,YAA+C,CAAC,CAC5G,qCACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,yBAAyB,OAAO,MAAM;CACjD;CACA;CACA;CACA;CACA;AACF,CAAC"}