@yielded/auth 0.1.0-beta.1

package/dist/password/methods/snapshot.mjs

@@ -0,0 +1,38 @@
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { AuthenticationRequirement } from "../../sessions/models.mjs";
+import { PasswordUnavailable } from "./errors.mjs";
+import { PasswordCredentialSnapshot } from "./models.mjs";
+import { Array, Effect, Schema } from "effect";
+//#region src/password/methods/snapshot.ts
+/** Detach authority-owned vectors before yielding to KDF/claims/hooks. */
+const snapshotPasswordRevision = (value) => Object.freeze({
+	subjectId: value.subjectId,
+	securityRevision: value.securityRevision,
+	credentials: Object.freeze(value.credentials.map((item) => Object.freeze({
+		credentialId: item.credentialId,
+		revision: item.revision
+	})))
+});
+const credentialCodec = Schema.toCodecIso(PasswordCredentialSnapshot);
+const snapshotPasswordCredential = Effect.fn("snapshotPasswordCredential")(function* (input) {
+	const value = yield* Schema.encodeEffect(credentialCodec)(input).pipe(Effect.flatMap(Schema.decodeEffect(credentialCodec)), Effect.mapError(() => PasswordUnavailable.make({})));
+	return Object.freeze({
+		...value,
+		revision: snapshotPasswordRevision(value.revision),
+		identifier: Object.freeze(LoginIdentifier.make(value.identifier))
+	});
+});
+const snapshotPasswordRequirement = Effect.fn("snapshotPasswordRequirement")(function* (input) {
+	const value = yield* Schema.decodeEffect(AuthenticationRequirement)(input).pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+	return Object.freeze({
+		...value,
+		alternatives: Object.freeze(Array.map(value.alternatives, (item) => Object.freeze({
+			...item,
+			factors: Object.freeze([...item.factors])
+		})))
+	});
+});
+//#endregion
+export { snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision };
+
+//# sourceMappingURL=snapshot.mjs.map

package/dist/password/methods/snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/password/methods/snapshot.ts"],"sourcesContent":["import { Array, Effect, Schema } from \"effect\";\n\nimport { LoginIdentifier } from \"../../identity/models\";\nimport type { AuthenticationRevision } from \"../../sessions/models\";\nimport { AuthenticationRequirement } from \"../../sessions/models\";\nimport { PasswordUnavailable } from \"./errors\";\nimport { PasswordCredentialSnapshot } from \"./models\";\n\n/** Detach authority-owned vectors before yielding to KDF/claims/hooks. */\nexport const snapshotPasswordRevision = (value: AuthenticationRevision): AuthenticationRevision =>\n  Object.freeze({\n    subjectId: value.subjectId,\n    securityRevision: value.securityRevision,\n    credentials: Object.freeze(\n      value.credentials.map((item) =>\n        Object.freeze({ credentialId: item.credentialId, revision: item.revision }),\n      ),\n    ),\n  });\n\nconst credentialCodec = Schema.toCodecIso(PasswordCredentialSnapshot);\n\nexport const snapshotPasswordCredential = Effect.fn(\"snapshotPasswordCredential\")(function* (\n  input: PasswordCredentialSnapshot,\n) {\n  const value = yield* Schema.encodeEffect(credentialCodec)(input).pipe(\n    Effect.flatMap(Schema.decodeEffect(credentialCodec)),\n    Effect.mapError(() => PasswordUnavailable.make({})),\n  );\n\n  return Object.freeze({\n    ...value,\n    revision: snapshotPasswordRevision(value.revision),\n    identifier: Object.freeze(LoginIdentifier.make(value.identifier)),\n  });\n});\n\nexport const snapshotPasswordRequirement = Effect.fn(\"snapshotPasswordRequirement\")(function* (\n  input: AuthenticationRequirement,\n) {\n  const value = yield* Schema.decodeEffect(AuthenticationRequirement)(input).pipe(\n    Effect.mapError(() => PasswordUnavailable.make({})),\n  );\n\n  return Object.freeze({\n    ...value,\n    alternatives: Object.freeze(\n      Array.map(value.alternatives, (item) =>\n        Object.freeze({ ...item, factors: Object.freeze([...item.factors]) }),\n      ),\n    ),\n  });\n});\n"],"mappings":";;;;;;;AASA,MAAa,4BAA4B,UACvC,OAAO,OAAO;CACZ,WAAW,MAAM;CACjB,kBAAkB,MAAM;CACxB,aAAa,OAAO,OAClB,MAAM,YAAY,KAAK,SACrB,OAAO,OAAO;EAAE,cAAc,KAAK;EAAc,UAAU,KAAK;CAAS,CAAC,CAC5E,CACF;AACF,CAAC;AAEH,MAAM,kBAAkB,OAAO,WAAW,0BAA0B;AAEpE,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,OACA;CACA,MAAM,QAAQ,OAAO,OAAO,aAAa,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,KAC/D,OAAO,QAAQ,OAAO,aAAa,eAAe,CAAC,GACnD,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,UAAU,yBAAyB,MAAM,QAAQ;EACjD,YAAY,OAAO,OAAO,gBAAgB,KAAK,MAAM,UAAU,CAAC;CAClE,CAAC;AACH,CAAC;AAED,MAAa,8BAA8B,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAClF,OACA;CACA,MAAM,QAAQ,OAAO,OAAO,aAAa,yBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,KACzE,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,cAAc,OAAO,OACnB,MAAM,IAAI,MAAM,eAAe,SAC7B,OAAO,OAAO;GAAE,GAAG;GAAM,SAAS,OAAO,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;EAAE,CAAC,CACtE,CACF;CACF,CAAC;AACH,CAAC"}

package/dist/password/methods/verification.mjs

@@ -0,0 +1,138 @@
+import { TokenDigest } from "../../Schema.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { HookDenied } from "../../hooks/models.mjs";
+import { reportAuthFailure } from "../../internal/diagnostics.mjs";
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConflict, SessionInvalid, StaleAuthentication } from "../../sessions/errors.mjs";
+import { hasCommitScope } from "../../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../../sessions/AuthenticationAuthority.mjs";
+import { PasswordHashingUnavailable, PasswordKdfBusy } from "../errors.mjs";
+import { PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import { PasswordPersistence } from "./PasswordPersistence.mjs";
+import { snapshotPasswordCredential, snapshotPasswordRevision } from "./snapshot.mjs";
+import { PasswordHashing } from "../PasswordHashing.mjs";
+import { Cause, Crypto, DateTime, Effect, Encoding, Redacted, Schema } from "effect";
+//#region src/password/methods/verification.ts
+const passwordNoAmbient = Effect.fn("Passwords.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* PasswordMethodUnsupported.make({});
+});
+const readPasswordCommit = (receipt) => receipt.read.pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+/** A commit acknowledgment can be lost after the session is durable. Only
+* definite policy/credential rejection may become PasswordRejected. */
+const passwordCompletionFailure = (error) => {
+	if (Schema.is(HookDenied)(error)) return error;
+	if (Schema.is(SessionCapabilityUnsupported)(error)) return PasswordMethodUnsupported.make({});
+	if (Schema.is(Schema.Union([
+		SessionCapabilityUnsupported,
+		SessionInvalid,
+		SessionConflict,
+		PendingAuthenticationInvalid,
+		StaleAuthentication
+	]))(error)) return PasswordRejected.make({});
+	return PasswordUnavailable.make({});
+};
+const noAmbient = passwordNoAmbient;
+const read = readPasswordCommit;
+const passwordUnexpected = (effect) => effect.pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+const unexpected = passwordUnexpected;
+const hashingInfrastructureFailure = Schema.is(Schema.Union([PasswordHashingUnavailable, PasswordKdfBusy]));
+/** Report infrastructure recovery without recording passwords or verifier data. */
+const passwordHashingDiagnostics = (effect) => effect.pipe(Effect.tapCause((cause) => reportAuthFailure("password-hashing", Cause.fromReasons(cause.reasons.filter((reason) => Cause.isFailReason(reason) && hashingInfrastructureFailure(reason.error))))));
+/** Verification owns attempt admission, settlement and the original proof instant. */
+const makePasswordVerification = ({ moduleId, policy }) => {
+	const encoder = new TextEncoder();
+	const tuple = Schema.fromJsonString(Schema.Array(Schema.String));
+	const digest = Effect.fn("Passwords.digest")(function* (parts) {
+		const crypto = yield* Crypto.Crypto;
+		const bytes = yield* unexpected(crypto.digest("SHA-256", encoder.encode(Schema.encodeSync(tuple)(parts))));
+		return TokenDigest.make(Encoding.encodeBase64Url(bytes));
+	});
+	const identifier = (email) => LoginIdentifier.make({
+		namespace: "email",
+		value: email
+	});
+	const sameCredential = (credential, revision) => credential.moduleId === moduleId && credential.revision.subjectId === revision.subjectId && credential.revision.securityRevision === revision.securityRevision && revision.credentials.some((item) => item.credentialId === credential.credentialId && item.revision === credential.credentialRevision);
+	const checkedPassword = Effect.fn("Passwords.checkedPassword")(function* (password, credential) {
+		const raw = Redacted.value(password);
+		yield* Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(65536)))(raw);
+		if (credential.normalization === "none") return password;
+		yield* Schema.decodeEffect(Schema.String.check(Schema.isPattern(/^[^\uD800-\uDFFF]*$/u)))(raw);
+		return Redacted.make(raw.normalize("NFC"));
+	}, Effect.mapError(() => PasswordRejected.make({})));
+	return {
+		digest,
+		identifier,
+		verifyPassword: Effect.fn("Passwords.verifyPassword")(function* (request, action, subjectId) {
+			yield* noAmbient();
+			const store = yield* PasswordPersistence;
+			const hasher = yield* PasswordHashing;
+			const authority = yield* AuthenticationAuthority;
+			const admitted = yield* read(yield* store.admitAttempt({
+				moduleId,
+				action,
+				identifier: identifier(request.email),
+				subjectId,
+				policy: policy.attempts
+			}, (decision, journal) => journal.prepare(decision)));
+			if (admitted._tag === "Denied") {
+				yield* hasher.dummy(request.password).pipe(passwordHashingDiagnostics, Effect.ignore);
+				return yield* PasswordRejected.make({});
+			}
+			const candidate = admitted.credential === void 0 ? void 0 : yield* snapshotPasswordCredential(admitted.credential);
+			const checked = yield* Effect.gen(function* () {
+				if (candidate === void 0) {
+					yield* hasher.dummy(request.password).pipe(passwordHashingDiagnostics);
+					return yield* PasswordRejected.make({});
+				}
+				const original = snapshotPasswordRevision(yield* authority.capture(candidate.revision.subjectId, [candidate.credentialId]));
+				if (!sameCredential(candidate, original) || subjectId !== void 0 && candidate.revision.subjectId !== subjectId || candidate.identifier.value !== request.email) {
+					yield* hasher.dummy(request.password).pipe(passwordHashingDiagnostics);
+					return yield* PasswordRejected.make({});
+				}
+				const password = yield* checkedPassword(request.password, candidate);
+				const verified = yield* hasher.verify(password, candidate.verifier).pipe(passwordHashingDiagnostics, Effect.catchTag("PasswordVerifierInvalid", () => hasher.dummy(password).pipe(passwordHashingDiagnostics, Effect.andThen(Effect.fail(PasswordRejected.make({}))))));
+				if (!verified.matches) return yield* PasswordRejected.make({});
+				const verifiedAt = yield* DateTime.now;
+				const rehash = action === "sign-in" && verified.needsRehash ? {
+					expectedVersion: candidate.verifierVersion,
+					expectedVerifier: candidate.verifier,
+					nextVerifier: yield* hasher.hash(password).pipe(passwordHashingDiagnostics)
+				} : void 0;
+				const evidence = {
+					revision: original,
+					flowId: request.flowId,
+					bindingDigest: yield* digest([
+						"effect-auth/password-login/v1",
+						moduleId,
+						request.flowId,
+						request.email
+					]),
+					proofs: [{
+						method: "password",
+						credentialId: candidate.credentialId,
+						factors: ["knowledge"],
+						userVerified: false,
+						phishingResistant: false,
+						verifiedAt
+					}]
+				};
+				return {
+					credential: candidate,
+					evidence,
+					rehash
+				};
+			}).pipe(Effect.result);
+			if ((yield* read(yield* store.settleAttempt({
+				moduleId,
+				attemptId: admitted.attemptId,
+				captured: candidate,
+				outcome: checked._tag === "Success" ? "verified" : "rejected",
+				...checked._tag === "Success" && checked.success.rehash !== void 0 ? { rehash: checked.success.rehash } : {}
+			}, (value, journal) => journal.prepare(value)))) !== "verified" || checked._tag !== "Success") return yield* PasswordRejected.make({});
+			return checked.success;
+		})
+	};
+};
+//#endregion
+export { makePasswordVerification, passwordCompletionFailure, passwordHashingDiagnostics, passwordNoAmbient, passwordUnexpected, readPasswordCommit };
+
+//# sourceMappingURL=verification.mjs.map

package/dist/password/methods/verification.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.mjs","names":[],"sources":["../../../src/password/methods/verification.ts"],"sourcesContent":["import { Cause, Crypto, DateTime, Effect, Encoding, Redacted, Schema } from \"effect\";\n\nimport { hasCommitScope, type PreparedCommit } from \"../../hooks/commit\";\nimport { HookDenied } from \"../../hooks/models\";\nimport { LoginIdentifier } from \"../../identity/models\";\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport type { Email, SubjectId } from \"../../Schema\";\nimport { TokenDigest } from \"../../Schema\";\nimport { AuthenticationAuthority } from \"../../sessions/AuthenticationAuthority\";\nimport {\n  SessionCapabilityUnsupported,\n  SessionInvalid,\n  SessionConflict,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n} from \"../../sessions/errors\";\nimport { type AuthenticationFlowId, type AuthenticationEvidence } from \"../../sessions/models\";\nimport { PasswordHashingUnavailable, PasswordKdfBusy } from \"../errors\";\nimport { PasswordHashing } from \"../PasswordHashing\";\nimport { PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from \"./errors\";\nimport type { PasswordCredentialSnapshot } from \"./models\";\nimport { PasswordPersistence } from \"./PasswordPersistence\";\nimport type { PasswordMethodPolicy } from \"./policy\";\nimport { snapshotPasswordCredential, snapshotPasswordRevision } from \"./snapshot\";\n\nexport const passwordNoAmbient = Effect.fn(\"Passwords.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* PasswordMethodUnsupported.make({});\n});\n\nexport const readPasswordCommit = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => PasswordUnavailable.make({})));\n\n/** A commit acknowledgment can be lost after the session is durable. Only\n * definite policy/credential rejection may become PasswordRejected. */\nexport const passwordCompletionFailure = (\n  error: unknown,\n): PasswordRejected | PasswordUnavailable | PasswordMethodUnsupported | HookDenied => {\n  if (Schema.is(HookDenied)(error)) return error;\n  if (Schema.is(SessionCapabilityUnsupported)(error)) return PasswordMethodUnsupported.make({});\n  if (\n    Schema.is(\n      Schema.Union([\n        SessionCapabilityUnsupported,\n        SessionInvalid,\n        SessionConflict,\n        PendingAuthenticationInvalid,\n        StaleAuthentication,\n      ]),\n    )(error)\n  )\n    return PasswordRejected.make({});\n\n  return PasswordUnavailable.make({});\n};\n\nconst noAmbient = passwordNoAmbient,\n  read = readPasswordCommit;\n\nexport const passwordUnexpected = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(Effect.mapError(() => PasswordUnavailable.make({})));\n\nconst unexpected = passwordUnexpected;\n\nconst hashingInfrastructureFailure = Schema.is(\n  Schema.Union([PasswordHashingUnavailable, PasswordKdfBusy]),\n);\n\n/** Report infrastructure recovery without recording passwords or verifier data. */\nexport const passwordHashingDiagnostics = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      reportAuthFailure(\n        \"password-hashing\",\n        Cause.fromReasons(\n          cause.reasons.filter(\n            (reason) => Cause.isFailReason(reason) && hashingInfrastructureFailure(reason.error),\n          ),\n        ),\n      ),\n    ),\n  );\n\n/** Verification owns attempt admission, settlement and the original proof instant. */\nexport const makePasswordVerification = ({\n  moduleId,\n  policy,\n}: {\n  readonly moduleId: string;\n  readonly policy: PasswordMethodPolicy;\n}) => {\n  const encoder = new TextEncoder();\n  const tuple = Schema.fromJsonString(Schema.Array(Schema.String));\n\n  const digest = Effect.fn(\"Passwords.digest\")(function* (parts: ReadonlyArray<string>) {\n    const crypto = yield* Crypto.Crypto;\n\n    const bytes = yield* unexpected(\n      crypto.digest(\"SHA-256\", encoder.encode(Schema.encodeSync(tuple)(parts))),\n    );\n\n    return TokenDigest.make(Encoding.encodeBase64Url(bytes));\n  });\n\n  const identifier = (email: Email) => LoginIdentifier.make({ namespace: \"email\", value: email });\n\n  const sameCredential = (\n    credential: PasswordCredentialSnapshot,\n    revision: AuthenticationEvidence[\"revision\"],\n  ) =>\n    credential.moduleId === moduleId &&\n    credential.revision.subjectId === revision.subjectId &&\n    credential.revision.securityRevision === revision.securityRevision &&\n    revision.credentials.some(\n      (item) =>\n        item.credentialId === credential.credentialId &&\n        item.revision === credential.credentialRevision,\n    );\n\n  const checkedPassword = Effect.fn(\"Passwords.checkedPassword\")(\n    function* (password: Redacted.Redacted<string>, credential: PasswordCredentialSnapshot) {\n      const raw = Redacted.value(password);\n\n      yield* Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(65536)))(raw);\n      if (credential.normalization === \"none\") return password;\n      yield* Schema.decodeEffect(Schema.String.check(Schema.isPattern(/^[^\\uD800-\\uDFFF]*$/u)))(\n        raw,\n      );\n\n      return Redacted.make(raw.normalize(\"NFC\"));\n    },\n    Effect.mapError(() => PasswordRejected.make({})),\n  );\n\n  const verifyPassword = Effect.fn(\"Passwords.verifyPassword\")(function* (\n    request: {\n      readonly flowId: AuthenticationFlowId;\n      readonly email: Email;\n      readonly password: Redacted.Redacted<string>;\n    },\n    action: \"sign-in\" | \"change\",\n    subjectId?: SubjectId,\n  ) {\n    yield* noAmbient();\n    const store = yield* PasswordPersistence;\n    const hasher = yield* PasswordHashing;\n    const authority = yield* AuthenticationAuthority;\n\n    const admitted = yield* read(\n      yield* store.admitAttempt(\n        {\n          moduleId,\n          action,\n          identifier: identifier(request.email),\n          subjectId,\n          policy: policy.attempts,\n        },\n        (decision, journal) => journal.prepare(decision),\n      ),\n    );\n\n    // All denied branches do one bounded dummy attempt too. Local admission can\n    // reject it; no claim of exact network timing is made.\n    if (admitted._tag === \"Denied\") {\n      yield* hasher.dummy(request.password).pipe(passwordHashingDiagnostics, Effect.ignore);\n\n      return yield* PasswordRejected.make({});\n    }\n\n    const candidate =\n      admitted.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(admitted.credential);\n\n    const checked = yield* Effect.gen(function* () {\n      if (candidate === undefined) {\n        yield* hasher.dummy(request.password).pipe(passwordHashingDiagnostics);\n\n        return yield* PasswordRejected.make({});\n      }\n\n      const original = snapshotPasswordRevision(\n        yield* authority.capture(candidate.revision.subjectId, [candidate.credentialId]),\n      );\n\n      if (\n        !sameCredential(candidate, original) ||\n        (subjectId !== undefined && candidate.revision.subjectId !== subjectId) ||\n        candidate.identifier.value !== request.email\n      ) {\n        yield* hasher.dummy(request.password).pipe(passwordHashingDiagnostics);\n\n        return yield* PasswordRejected.make({});\n      }\n      const password = yield* checkedPassword(request.password, candidate);\n\n      const verified = yield* hasher.verify(password, candidate.verifier).pipe(\n        passwordHashingDiagnostics,\n        Effect.catchTag(\"PasswordVerifierInvalid\", () =>\n          hasher\n            .dummy(password)\n            .pipe(\n              passwordHashingDiagnostics,\n              Effect.andThen(Effect.fail(PasswordRejected.make({}))),\n            ),\n        ),\n      );\n\n      if (!verified.matches) return yield* PasswordRejected.make({});\n      const verifiedAt = yield* DateTime.now;\n\n      const rehash =\n        action === \"sign-in\" && verified.needsRehash\n          ? {\n              expectedVersion: candidate.verifierVersion,\n              expectedVerifier: candidate.verifier,\n              nextVerifier: yield* hasher.hash(password).pipe(passwordHashingDiagnostics),\n            }\n          : undefined;\n\n      const evidence: AuthenticationEvidence = {\n        revision: original,\n        flowId: request.flowId,\n        bindingDigest: yield* digest([\n          \"effect-auth/password-login/v1\",\n          moduleId,\n          request.flowId,\n          request.email,\n        ]),\n        proofs: [\n          {\n            method: \"password\",\n            credentialId: candidate.credentialId,\n            factors: [\"knowledge\"],\n            userVerified: false,\n            phishingResistant: false,\n            verifiedAt,\n          },\n        ],\n      };\n\n      return { credential: candidate, evidence, rehash };\n    }).pipe(Effect.result);\n\n    const decision = yield* read(\n      yield* store.settleAttempt(\n        {\n          moduleId,\n          attemptId: admitted.attemptId,\n          captured: candidate,\n          outcome: checked._tag === \"Success\" ? \"verified\" : \"rejected\",\n          ...(checked._tag === \"Success\" && checked.success.rehash !== undefined\n            ? { rehash: checked.success.rehash }\n            : {}),\n        },\n        (value, journal) => journal.prepare(value),\n      ),\n    );\n\n    if (decision !== \"verified\" || checked._tag !== \"Success\")\n      return yield* PasswordRejected.make({});\n\n    return checked.success;\n  });\n\n  return { digest, identifier, verifyPassword };\n};\n"],"mappings":";;;;;;;;;;;;;;AAyBA,MAAa,oBAAoB,OAAO,GAAG,qBAAqB,CAAC,CAAC,aAAa;CAC7E,IAAI,OAAO,gBAAgB,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAa,sBAAyB,YACpC,QAAQ,KAAK,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC;;;AAIvE,MAAa,6BACX,UACoF;CACpF,IAAI,OAAO,GAAG,UAAU,CAAC,CAAC,KAAK,GAAG,OAAO;CACzC,IAAI,OAAO,GAAG,4BAA4B,CAAC,CAAC,KAAK,GAAG,OAAO,0BAA0B,KAAK,CAAC,CAAC;CAC5F,IACE,OAAO,GACL,OAAO,MAAM;EACX;EACA;EACA;EACA;EACA;CACF,CAAC,CACH,CAAC,CAAC,KAAK,GAEP,OAAO,iBAAiB,KAAK,CAAC,CAAC;CAEjC,OAAO,oBAAoB,KAAK,CAAC,CAAC;AACpC;AAEA,MAAM,YAAY;AAChB,MAAA,OAAO;AAET,MAAa,sBAA+B,WAC1C,OAAO,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,aAAa;AAEnB,MAAM,+BAA+B,OAAO,GAC1C,OAAO,MAAM,CAAC,4BAA4B,eAAe,CAAC,CAC5D;;AAGA,MAAa,8BAAuC,WAClD,OAAO,KACL,OAAO,UAAU,UACf,kBACE,oBACA,MAAM,YACJ,MAAM,QAAQ,QACX,WAAW,MAAM,aAAa,MAAM,KAAK,6BAA6B,OAAO,KAAK,CACrF,CACF,CACF,CACF,CACF;;AAGF,MAAa,4BAA4B,EACvC,UACA,aAII;CACJ,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,QAAQ,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;CAE/D,MAAM,SAAS,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,OAA8B;EACpF,MAAM,SAAS,OAAO,OAAO;EAE7B,MAAM,QAAQ,OAAO,WACnB,OAAO,OAAO,WAAW,QAAQ,OAAO,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAC1E;EAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC;CACzD,CAAC;CAED,MAAM,cAAc,UAAiB,gBAAgB,KAAK;EAAE,WAAW;EAAS,OAAO;CAAM,CAAC;CAE9F,MAAM,kBACJ,YACA,aAEA,WAAW,aAAa,YACxB,WAAW,SAAS,cAAc,SAAS,aAC3C,WAAW,SAAS,qBAAqB,SAAS,oBAClD,SAAS,YAAY,MAClB,SACC,KAAK,iBAAiB,WAAW,gBACjC,KAAK,aAAa,WAAW,kBACjC;CAEF,MAAM,kBAAkB,OAAO,GAAG,2BAA2B,CAAC,CAC5D,WAAW,UAAqC,YAAwC;EACtF,MAAM,MAAM,SAAS,MAAM,QAAQ;EAEnC,OAAO,OAAO,aAAa,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;EAC9E,IAAI,WAAW,kBAAkB,QAAQ,OAAO;EAChD,OAAO,OAAO,aAAa,OAAO,OAAO,MAAM,OAAO,UAAU,sBAAsB,CAAC,CAAC,CAAC,CACvF,GACF;EAEA,OAAO,SAAS,KAAK,IAAI,UAAU,KAAK,CAAC;CAC3C,GACA,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAqIA,OAAO;EAAE;EAAQ;EAAY,gBAnIN,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC3D,SAKA,QACA,WACA;GACA,OAAO,UAAU;GACjB,MAAM,QAAQ,OAAO;GACrB,MAAM,SAAS,OAAO;GACtB,MAAM,YAAY,OAAO;GAEzB,MAAM,WAAW,OAAO,KACtB,OAAO,MAAM,aACX;IACE;IACA;IACA,YAAY,WAAW,QAAQ,KAAK;IACpC;IACA,QAAQ,OAAO;GACjB,IACC,UAAU,YAAY,QAAQ,QAAQ,QAAQ,CACjD,CACF;GAIA,IAAI,SAAS,SAAS,UAAU;IAC9B,OAAO,OAAO,MAAM,QAAQ,QAAQ,CAAC,CAAC,KAAK,4BAA4B,OAAO,MAAM;IAEpF,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GACxC;GAEA,MAAM,YACJ,SAAS,eAAe,KAAA,IACpB,KAAA,IACA,OAAO,2BAA2B,SAAS,UAAU;GAE3D,MAAM,UAAU,OAAO,OAAO,IAAI,aAAa;IAC7C,IAAI,cAAc,KAAA,GAAW;KAC3B,OAAO,OAAO,MAAM,QAAQ,QAAQ,CAAC,CAAC,KAAK,0BAA0B;KAErE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACxC;IAEA,MAAM,WAAW,yBACf,OAAO,UAAU,QAAQ,UAAU,SAAS,WAAW,CAAC,UAAU,YAAY,CAAC,CACjF;IAEA,IACE,CAAC,eAAe,WAAW,QAAQ,KAClC,cAAc,KAAA,KAAa,UAAU,SAAS,cAAc,aAC7D,UAAU,WAAW,UAAU,QAAQ,OACvC;KACA,OAAO,OAAO,MAAM,QAAQ,QAAQ,CAAC,CAAC,KAAK,0BAA0B;KAErE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACxC;IACA,MAAM,WAAW,OAAO,gBAAgB,QAAQ,UAAU,SAAS;IAEnE,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,UAAU,QAAQ,CAAC,CAAC,KAClE,4BACA,OAAO,SAAS,iCACd,OACG,MAAM,QAAQ,CAAC,CACf,KACC,4BACA,OAAO,QAAQ,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACvD,CACJ,CACF;IAEA,IAAI,CAAC,SAAS,SAAS,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC7D,MAAM,aAAa,OAAO,SAAS;IAEnC,MAAM,SACJ,WAAW,aAAa,SAAS,cAC7B;KACE,iBAAiB,UAAU;KAC3B,kBAAkB,UAAU;KAC5B,cAAc,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,KAAK,0BAA0B;IAC5E,IACA,KAAA;IAEN,MAAM,WAAmC;KACvC,UAAU;KACV,QAAQ,QAAQ;KAChB,eAAe,OAAO,OAAO;MAC3B;MACA;MACA,QAAQ;MACR,QAAQ;KACV,CAAC;KACD,QAAQ,CACN;MACE,QAAQ;MACR,cAAc,UAAU;MACxB,SAAS,CAAC,WAAW;MACrB,cAAc;MACd,mBAAmB;MACnB;KACF,CACF;IACF;IAEA,OAAO;KAAE,YAAY;KAAW;KAAU;IAAO;GACnD,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;GAiBrB,KAAI,OAfoB,KACtB,OAAO,MAAM,cACX;IACE;IACA,WAAW,SAAS;IACpB,UAAU;IACV,SAAS,QAAQ,SAAS,YAAY,aAAa;IACnD,GAAI,QAAQ,SAAS,aAAa,QAAQ,QAAQ,WAAW,KAAA,IACzD,EAAE,QAAQ,QAAQ,QAAQ,OAAO,IACjC,CAAC;GACP,IACC,OAAO,YAAY,QAAQ,QAAQ,KAAK,CAC3C,CACF,OAEiB,cAAc,QAAQ,SAAS,WAC9C,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,OAAO,QAAQ;EACjB,CAE0C;CAAE;AAC9C"}

package/dist/password/models.d.mts

@@ -0,0 +1,13 @@
+import { Schema } from "effect";
+//#region src/password/models.d.ts
+/** Sensitive credential material; service boundaries wrap this in Redacted. */
+declare const EncodedPasswordHash: Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">;
+type EncodedPasswordHash = typeof EncodedPasswordHash.Type;
+declare const PasswordVerification: Schema.Struct<{
+  readonly matches: Schema.Boolean;
+  readonly needsRehash: Schema.Boolean;
+}>;
+type PasswordVerification = typeof PasswordVerification.Type;
+//#endregion
+export { EncodedPasswordHash, PasswordVerification };
+//# sourceMappingURL=models.d.mts.map

package/dist/password/models.mjs

@@ -0,0 +1,12 @@
+import { Schema } from "effect";
+//#region src/password/models.ts
+/** Sensitive credential material; service boundaries wrap this in Redacted. */
+const EncodedPasswordHash = Schema.String.check(Schema.isMaxLength(512)).pipe(Schema.brand("effect-auth/EncodedPasswordHash"));
+const PasswordVerification = Schema.Struct({
+	matches: Schema.Boolean,
+	needsRehash: Schema.Boolean
+});
+//#endregion
+export { EncodedPasswordHash, PasswordVerification };
+
+//# sourceMappingURL=models.mjs.map

package/dist/password/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/password/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n/** Sensitive credential material; service boundaries wrap this in Redacted. */\nexport const EncodedPasswordHash = Schema.String.check(Schema.isMaxLength(512)).pipe(\n  Schema.brand(\"effect-auth/EncodedPasswordHash\"),\n);\n\nexport type EncodedPasswordHash = typeof EncodedPasswordHash.Type;\n\nexport const PasswordVerification = Schema.Struct({\n  matches: Schema.Boolean,\n  needsRehash: Schema.Boolean,\n});\n\nexport type PasswordVerification = typeof PasswordVerification.Type;\n"],"mappings":";;;AAGA,MAAa,sBAAsB,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KAC9E,OAAO,MAAM,iCAAiC,CAChD;AAIA,MAAa,uBAAuB,OAAO,OAAO;CAChD,SAAS,OAAO;CAChB,aAAa,OAAO;AACtB,CAAC"}

package/dist/password/policy.d.mts

@@ -0,0 +1,33 @@
+import { PasswordConfigurationError } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/password/policy.d.ts
+declare const PasswordNormalization: Schema.Literals<readonly ["none", "NFC"]>;
+type PasswordNormalization = typeof PasswordNormalization.Type;
+declare const PasswordPolicy: Schema.Struct<{
+  /** Trusted method configuration; never accept this selection from a caller.
+   * always-mfa requires EVERY use, including recovery, to require another factor.
+   */
+  readonly assurance: Schema.Literals<readonly ["single-factor", "always-mfa"]>;
+  readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+  readonly maximumCodePoints: Schema.Int;
+  readonly maximumBytes: Schema.Int;
+}>;
+type PasswordPolicy = typeof PasswordPolicy.Type;
+/** NIST SP800-63B-4: 15 code points, or 8 only when always part of MFA;
+ * support managers/paste/spaces, no composition rules or forced reset cadence.
+ */
+declare const defaultPasswordPolicy: PasswordPolicy;
+declare const validatePasswordPolicy: (input: {
+  readonly assurance: "always-mfa" | "single-factor";
+  readonly normalization: "NFC" | "none";
+  readonly maximumCodePoints: number;
+  readonly maximumBytes: number;
+}) => Effect.Effect<Readonly<{
+  readonly assurance: "always-mfa" | "single-factor";
+  readonly normalization: "NFC" | "none";
+  readonly maximumCodePoints: number;
+  readonly maximumBytes: number;
+}>, PasswordConfigurationError, never>;
+//#endregion
+export { PasswordNormalization, PasswordPolicy, defaultPasswordPolicy, validatePasswordPolicy };
+//# sourceMappingURL=policy.d.mts.map

package/dist/password/policy.mjs

@@ -0,0 +1,37 @@
+import { PasswordConfigurationError } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/password/policy.ts
+const PasswordNormalization = Schema.Literals(["none", "NFC"]);
+const PasswordPolicy = Schema.Struct({
+	/** Trusted method configuration; never accept this selection from a caller.
+	* always-mfa requires EVERY use, including recovery, to require another factor.
+	*/
+	assurance: Schema.Literals(["single-factor", "always-mfa"]),
+	normalization: PasswordNormalization,
+	maximumCodePoints: Schema.Int.check(Schema.isBetween({
+		minimum: 64,
+		maximum: 16384
+	})),
+	maximumBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 256,
+		maximum: 65536
+	}))
+});
+/** NIST SP800-63B-4: 15 code points, or 8 only when always part of MFA;
+* support managers/paste/spaces, no composition rules or forced reset cadence.
+*/
+const defaultPasswordPolicy = Object.freeze({
+	assurance: "single-factor",
+	normalization: "NFC",
+	maximumCodePoints: 1024,
+	maximumBytes: 4096
+});
+const validatePasswordPolicy = Effect.fn("validatePasswordPolicy")(function* (input) {
+	const policy = yield* Schema.decodeEffect(PasswordPolicy)(input).pipe(Effect.mapError(() => PasswordConfigurationError.make({ component: "policy" })));
+	if (policy.maximumBytes < policy.maximumCodePoints * 4) return yield* PasswordConfigurationError.make({ component: "policy" });
+	return Object.freeze(policy);
+});
+//#endregion
+export { PasswordNormalization, PasswordPolicy, defaultPasswordPolicy, validatePasswordPolicy };
+
+//# sourceMappingURL=policy.mjs.map

package/dist/password/policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../src/password/policy.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport { PasswordConfigurationError } from \"./errors\";\n\nexport const PasswordNormalization = Schema.Literals([\"none\", \"NFC\"]);\nexport type PasswordNormalization = typeof PasswordNormalization.Type;\n\nexport const PasswordPolicy = Schema.Struct({\n  /** Trusted method configuration; never accept this selection from a caller.\n   * always-mfa requires EVERY use, including recovery, to require another factor.\n   */\n  assurance: Schema.Literals([\"single-factor\", \"always-mfa\"]),\n  normalization: PasswordNormalization,\n  maximumCodePoints: Schema.Int.check(Schema.isBetween({ minimum: 64, maximum: 16384 })),\n  maximumBytes: Schema.Int.check(Schema.isBetween({ minimum: 256, maximum: 65536 })),\n});\n\nexport type PasswordPolicy = typeof PasswordPolicy.Type;\n\n/** NIST SP800-63B-4: 15 code points, or 8 only when always part of MFA;\n * support managers/paste/spaces, no composition rules or forced reset cadence.\n */\nexport const defaultPasswordPolicy: PasswordPolicy = Object.freeze({\n  assurance: \"single-factor\",\n  normalization: \"NFC\",\n  maximumCodePoints: 1024,\n  maximumBytes: 4096,\n});\n\nexport const validatePasswordPolicy = Effect.fn(\"validatePasswordPolicy\")(function* (\n  input: PasswordPolicy,\n) {\n  const policy = yield* Schema.decodeEffect(PasswordPolicy)(input).pipe(\n    Effect.mapError(() => PasswordConfigurationError.make({ component: \"policy\" })),\n  );\n\n  if (policy.maximumBytes < policy.maximumCodePoints * 4)\n    return yield* PasswordConfigurationError.make({ component: \"policy\" });\n\n  return Object.freeze(policy);\n});\n"],"mappings":";;;AAIA,MAAa,wBAAwB,OAAO,SAAS,CAAC,QAAQ,KAAK,CAAC;AAGpE,MAAa,iBAAiB,OAAO,OAAO;;;;CAI1C,WAAW,OAAO,SAAS,CAAC,iBAAiB,YAAY,CAAC;CAC1D,eAAe;CACf,mBAAmB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAI,SAAS;CAAM,CAAC,CAAC;CACrF,cAAc,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAK,SAAS;CAAM,CAAC,CAAC;AACnF,CAAC;;;;AAOD,MAAa,wBAAwC,OAAO,OAAO;CACjE,WAAW;CACX,eAAe;CACf,mBAAmB;CACnB,cAAc;AAChB,CAAC;AAED,MAAa,yBAAyB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACxE,OACA;CACA,MAAM,SAAS,OAAO,OAAO,aAAa,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,KAC/D,OAAO,eAAe,2BAA2B,KAAK,EAAE,WAAW,SAAS,CAAC,CAAC,CAChF;CAEA,IAAI,OAAO,eAAe,OAAO,oBAAoB,GACnD,OAAO,OAAO,2BAA2B,KAAK,EAAE,WAAW,SAAS,CAAC;CAEvE,OAAO,OAAO,OAAO,MAAM;AAC7B,CAAC"}

package/dist/phone/PhoneActionEvidence.d.mts

@@ -0,0 +1,23 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement } from "../sessions/models.mjs";
+import { PhoneOtpUnavailable } from "./models.mjs";
+import { PhoneActionChallenge, PhoneActionRequired } from "./lifecycleModels.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/phone/PhoneActionEvidence.d.ts
+declare const PhoneActionEvidence_base: Context.ServiceClass<PhoneActionEvidence, "effect-auth/PhoneActionEvidence", {
+  readonly verify: (input: {
+    readonly invocation: AuthInvocation;
+    readonly challenge: PhoneActionChallenge;
+    readonly proof?: Redacted.Redacted<string>;
+  }) => Effect.Effect<{
+    readonly evidence: AuthenticationEvidence;
+    readonly requirement: AuthenticationRequirement;
+  }, PhoneActionRequired | PhoneOtpUnavailable>;
+}>;
+/** Independent fresh authentication for phone custody mutation. A new phone code
+ * cannot authorize replacement of an existing account identifier or stronger factor.
+ * Consume one-use proofs before returning; later CAS failure does not refund them. */
+declare class PhoneActionEvidence extends PhoneActionEvidence_base {}
+//#endregion
+export { PhoneActionEvidence };
+//# sourceMappingURL=PhoneActionEvidence.d.mts.map

package/dist/phone/PhoneActionEvidence.mjs

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+//#region src/phone/PhoneActionEvidence.ts
+/** Independent fresh authentication for phone custody mutation. A new phone code
+* cannot authorize replacement of an existing account identifier or stronger factor.
+* Consume one-use proofs before returning; later CAS failure does not refund them. */
+var PhoneActionEvidence = class extends Context.Service()("effect-auth/PhoneActionEvidence") {};
+//#endregion
+export { PhoneActionEvidence };
+
+//# sourceMappingURL=PhoneActionEvidence.mjs.map

package/dist/phone/PhoneActionEvidence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PhoneActionEvidence.mjs","names":[],"sources":["../../src/phone/PhoneActionEvidence.ts"],"sourcesContent":["import { Context, type Effect, type Redacted } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthenticationEvidence, AuthenticationRequirement } from \"../sessions/models\";\nimport type { PhoneActionChallenge, PhoneActionRequired } from \"./lifecycleModels\";\nimport type { PhoneOtpUnavailable } from \"./models\";\n\n/** Independent fresh authentication for phone custody mutation. A new phone code\n * cannot authorize replacement of an existing account identifier or stronger factor.\n * Consume one-use proofs before returning; later CAS failure does not refund them. */\nexport class PhoneActionEvidence extends Context.Service<\n  PhoneActionEvidence,\n  {\n    readonly verify: (input: {\n      readonly invocation: AuthInvocation;\n      readonly challenge: PhoneActionChallenge;\n      readonly proof?: Redacted.Redacted<string>;\n    }) => Effect.Effect<\n      {\n        readonly evidence: AuthenticationEvidence;\n        readonly requirement: AuthenticationRequirement;\n      },\n      PhoneActionRequired | PhoneOtpUnavailable\n    >;\n  }\n>()(\"effect-auth/PhoneActionEvidence\") {}\n"],"mappings":";;;;;AAUA,IAAa,sBAAb,cAAyC,QAAQ,QAe/C,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC"}

package/dist/phone/PhoneAdmission.d.mts

@@ -0,0 +1,29 @@
+import { PhoneOtpUnavailable } from "./models.mjs";
+import { Context, Effect } from "effect";
+//#region src/phone/PhoneAdmission.d.ts
+declare const PhoneAdmission_base: Context.ServiceClass<PhoneAdmission, "effect-auth/PhoneAdmission", {
+  readonly admit: (input: {
+    readonly moduleId: string;
+    readonly action: "request" | "attempt";
+    readonly requestId: string;
+    readonly fingerprint: string;
+    readonly networkKey: string;
+    /** At most the shared proof request retention; zero disables replay admission. */
+    readonly replayLifetimeMillis: number;
+  }) => Effect.Effect<boolean, PhoneOtpUnavailable>;
+  readonly cleanup: (input: {
+    readonly moduleId: string;
+    readonly limit: number;
+    readonly after?: string;
+  }) => Effect.Effect<{
+    readonly deleted: number;
+    readonly nextCursor: string | null;
+  }, PhoneOtpUnavailable>;
+}>;
+/** Distributed reservation, including suppressed recipients and failed/ambiguous sends.
+ * Identical request fingerprints may reuse admission, never a new message budget.
+ * Core ProofPersistence separately owns identifier/subject/resend/guess limits. */
+declare class PhoneAdmission extends PhoneAdmission_base {}
+//#endregion
+export { PhoneAdmission };
+//# sourceMappingURL=PhoneAdmission.d.mts.map

package/dist/phone/PhoneAdmission.mjs

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+//#region src/phone/PhoneAdmission.ts
+/** Distributed reservation, including suppressed recipients and failed/ambiguous sends.
+* Identical request fingerprints may reuse admission, never a new message budget.
+* Core ProofPersistence separately owns identifier/subject/resend/guess limits. */
+var PhoneAdmission = class extends Context.Service()("effect-auth/PhoneAdmission") {};
+//#endregion
+export { PhoneAdmission };
+
+//# sourceMappingURL=PhoneAdmission.mjs.map

package/dist/phone/PhoneAdmission.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PhoneAdmission.mjs","names":[],"sources":["../../src/phone/PhoneAdmission.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { PhoneOtpUnavailable } from \"./models\";\n\n/** Distributed reservation, including suppressed recipients and failed/ambiguous sends.\n * Identical request fingerprints may reuse admission, never a new message budget.\n * Core ProofPersistence separately owns identifier/subject/resend/guess limits. */\nexport class PhoneAdmission extends Context.Service<\n  PhoneAdmission,\n  {\n    readonly admit: (input: {\n      readonly moduleId: string;\n      readonly action: \"request\" | \"attempt\";\n      readonly requestId: string;\n      readonly fingerprint: string;\n      readonly networkKey: string;\n      /** At most the shared proof request retention; zero disables replay admission. */\n      readonly replayLifetimeMillis: number;\n    }) => Effect.Effect<boolean, PhoneOtpUnavailable>;\n    readonly cleanup: (input: {\n      readonly moduleId: string;\n      readonly limit: number;\n      readonly after?: string;\n    }) => Effect.Effect<\n      { readonly deleted: number; readonly nextCursor: string | null },\n      PhoneOtpUnavailable\n    >;\n  }\n>()(\"effect-auth/PhoneAdmission\") {}\n"],"mappings":";;;;;AAOA,IAAa,iBAAb,cAAoC,QAAQ,QAqB1C,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC"}

package/dist/phone/PhoneDeliveryEligibility.d.mts

@@ -0,0 +1,11 @@
+import { PhoneNumber, PhoneOtpUnavailable } from "./models.mjs";
+import { Context, Effect } from "effect";
+//#region src/phone/PhoneDeliveryEligibility.d.ts
+declare const PhoneDeliveryEligibility_base: Context.ServiceClass<PhoneDeliveryEligibility, "effect-auth/PhoneDeliveryEligibility", {
+  readonly allowed: (phoneNumber: PhoneNumber) => Effect.Effect<boolean, PhoneOtpUnavailable>;
+}>;
+/** Consumer controls supported numbering ranges, sender/template eligibility and vendor rules. */
+declare class PhoneDeliveryEligibility extends PhoneDeliveryEligibility_base {}
+//#endregion
+export { PhoneDeliveryEligibility };
+//# sourceMappingURL=PhoneDeliveryEligibility.d.mts.map

package/dist/phone/PhoneDeliveryEligibility.mjs

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+//#region src/phone/PhoneDeliveryEligibility.ts
+/** Consumer controls supported numbering ranges, sender/template eligibility and vendor rules. */
+var PhoneDeliveryEligibility = class extends Context.Service()("effect-auth/PhoneDeliveryEligibility") {};
+//#endregion
+export { PhoneDeliveryEligibility };
+
+//# sourceMappingURL=PhoneDeliveryEligibility.mjs.map

package/dist/phone/PhoneDeliveryEligibility.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PhoneDeliveryEligibility.mjs","names":[],"sources":["../../src/phone/PhoneDeliveryEligibility.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { PhoneNumber, PhoneOtpUnavailable } from \"./models\";\n\n/** Consumer controls supported numbering ranges, sender/template eligibility and vendor rules. */\nexport class PhoneDeliveryEligibility extends Context.Service<\n  PhoneDeliveryEligibility,\n  { readonly allowed: (phoneNumber: PhoneNumber) => Effect.Effect<boolean, PhoneOtpUnavailable> }\n>()(\"effect-auth/PhoneDeliveryEligibility\") {}\n"],"mappings":";;;AAKA,IAAa,2BAAb,cAA8C,QAAQ,QAGpD,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/dist/phone/PhonePersistence.d.mts

@@ -0,0 +1,33 @@
+import { SubjectId } from "../Schema.mjs";
+import { CommitJournal, PreparedCommit } from "../hooks/commit.mjs";
+import { ProofCompletionPlan } from "../proofs/completion.mjs";
+import { PhoneNumber, PhoneOtpUnavailable } from "./models.mjs";
+import { PhoneActionAuthorization, PhoneLifecycleAction, PhoneLifecyclePolicy, PhoneLifecycleTarget, PhoneMutationDecision } from "./lifecycleModels.mjs";
+import { Context, Effect } from "effect";
+//#region src/phone/PhonePersistence.d.ts
+interface PhoneMutation {
+  readonly moduleId: string;
+  readonly action: PhoneLifecycleAction;
+  readonly commandId: string;
+  readonly target: PhoneLifecycleTarget;
+  readonly authorization?: PhoneActionAuthorization;
+  readonly completion: ProofCompletionPlan;
+  readonly policy: PhoneLifecyclePolicy;
+}
+declare const PhonePersistence_base: Context.ServiceClass<PhonePersistence, "effect-auth/PhonePersistence", {
+  readonly target: (input: {
+    readonly moduleId: string;
+    readonly action: PhoneLifecycleAction;
+    readonly phoneNumber: PhoneNumber;
+    readonly subjectId?: SubjectId;
+    readonly sourcePhoneNumber?: PhoneNumber;
+  }) => Effect.Effect<PhoneLifecycleTarget, PhoneOtpUnavailable>;
+  readonly mutate: <A>(input: PhoneMutation, prepare: (decision: PhoneMutationDecision, journal: CommitJournal) => PreparedCommit<A>) => Effect.Effect<PreparedCommit<A>, PhoneOtpUnavailable>;
+}>;
+/** Custody tombstones are permanent. Recycled numbers never create, transfer or
+ * merge accounts automatically. Verification/change and continuation consumption
+ * share one native owner; a failed protected write cannot consume the proof. */
+declare class PhonePersistence extends PhonePersistence_base {}
+//#endregion
+export { PhoneMutation, PhonePersistence };
+//# sourceMappingURL=PhonePersistence.d.mts.map

package/dist/phone/PhonePersistence.mjs

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+//#region src/phone/PhonePersistence.ts
+/** Custody tombstones are permanent. Recycled numbers never create, transfer or
+* merge accounts automatically. Verification/change and continuation consumption
+* share one native owner; a failed protected write cannot consume the proof. */
+var PhonePersistence = class extends Context.Service()("effect-auth/PhonePersistence") {};
+//#endregion
+export { PhonePersistence };
+
+//# sourceMappingURL=PhonePersistence.mjs.map

package/dist/phone/PhonePersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PhonePersistence.mjs","names":[],"sources":["../../src/phone/PhonePersistence.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { CommitJournal, PreparedCommit } from \"../hooks/commit\";\nimport type { ProofCompletionPlan } from \"../proofs/completion\";\nimport type { SubjectId } from \"../Schema\";\nimport type {\n  PhoneActionAuthorization,\n  PhoneLifecycleAction,\n  PhoneLifecyclePolicy,\n  PhoneLifecycleTarget,\n  PhoneMutationDecision,\n} from \"./lifecycleModels\";\nimport type { PhoneNumber, PhoneOtpUnavailable } from \"./models\";\n\nexport interface PhoneMutation {\n  readonly moduleId: string;\n  readonly action: PhoneLifecycleAction;\n  readonly commandId: string;\n  readonly target: PhoneLifecycleTarget;\n  readonly authorization?: PhoneActionAuthorization;\n  readonly completion: ProofCompletionPlan;\n  readonly policy: PhoneLifecyclePolicy;\n}\n\n/** Custody tombstones are permanent. Recycled numbers never create, transfer or\n * merge accounts automatically. Verification/change and continuation consumption\n * share one native owner; a failed protected write cannot consume the proof. */\nexport class PhonePersistence extends Context.Service<\n  PhonePersistence,\n  {\n    readonly target: (input: {\n      readonly moduleId: string;\n      readonly action: PhoneLifecycleAction;\n      readonly phoneNumber: PhoneNumber;\n      readonly subjectId?: SubjectId;\n      readonly sourcePhoneNumber?: PhoneNumber;\n    }) => Effect.Effect<PhoneLifecycleTarget, PhoneOtpUnavailable>;\n    readonly mutate: <A>(\n      input: PhoneMutation,\n      prepare: (decision: PhoneMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n    ) => Effect.Effect<PreparedCommit<A>, PhoneOtpUnavailable>;\n  }\n>()(\"effect-auth/PhonePersistence\") {}\n"],"mappings":";;;;;AA2BA,IAAa,mBAAb,cAAsC,QAAQ,QAe5C,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC"}

package/dist/phone/PhoneRequestContext.d.mts

@@ -0,0 +1,10 @@
+import { Context, Redacted } from "effect";
+//#region src/phone/PhoneRequestContext.d.ts
+declare const PhoneRequestContext_base: Context.ServiceClass<PhoneRequestContext, "effect-auth/PhoneRequestContext", {
+  readonly networkKey: Redacted.Redacted<string>;
+}>;
+/** Host-verified opaque network identity. Supply per invocation; never accept this in RPC payloads. */
+declare class PhoneRequestContext extends PhoneRequestContext_base {}
+//#endregion
+export { PhoneRequestContext };
+//# sourceMappingURL=PhoneRequestContext.d.mts.map

package/dist/phone/PhoneRequestContext.mjs

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+//#region src/phone/PhoneRequestContext.ts
+/** Host-verified opaque network identity. Supply per invocation; never accept this in RPC payloads. */
+var PhoneRequestContext = class extends Context.Service()("effect-auth/PhoneRequestContext") {};
+//#endregion
+export { PhoneRequestContext };
+
+//# sourceMappingURL=PhoneRequestContext.mjs.map

package/dist/phone/PhoneRequestContext.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PhoneRequestContext.mjs","names":[],"sources":["../../src/phone/PhoneRequestContext.ts"],"sourcesContent":["import { Context, type Redacted } from \"effect\";\n\n/** Host-verified opaque network identity. Supply per invocation; never accept this in RPC payloads. */\nexport class PhoneRequestContext extends Context.Service<\n  PhoneRequestContext,\n  { readonly networkKey: Redacted.Redacted<string> }\n>()(\"effect-auth/PhoneRequestContext\") {}\n"],"mappings":";;;AAGA,IAAa,sBAAb,cAAyC,QAAQ,QAG/C,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC"}

package/dist/phone/PhoneSignInTargets.d.mts

@@ -0,0 +1,19 @@
+import { PhoneCredentialSnapshot, PhoneNumber, PhoneOtpUnavailable } from "./models.mjs";
+import { Context, Effect, Option } from "effect";
+//#region src/phone/PhoneSignInTargets.d.ts
+declare const PhoneSignInTargets_base: Context.ServiceClass<PhoneSignInTargets, "effect-auth/PhoneSignInTargets", {
+  readonly lookup: (input: {
+    readonly moduleId: string;
+    readonly phoneNumber: PhoneNumber;
+  }) => Effect.Effect<Option.Option<PhoneCredentialSnapshot>, PhoneOtpUnavailable>;
+}>;
+/** Resolve only an existing active account with this exact verified phone credential.
+ * Reassignment/revocation must bump its authentication revision atomically. Custody
+ * revisions are never reused, including after deletion; outstanding codes cannot
+ * transfer to another account. Unknown or ineligible numbers return None.
+ * This capability never provisions or links an account based on a phone match.
+ */
+declare class PhoneSignInTargets extends PhoneSignInTargets_base {}
+//#endregion
+export { PhoneSignInTargets };
+//# sourceMappingURL=PhoneSignInTargets.d.mts.map

package/dist/phone/PhoneSignInTargets.mjs

@@ -0,0 +1,13 @@
+import { Context } from "effect";
+//#region src/phone/PhoneSignInTargets.ts
+/** Resolve only an existing active account with this exact verified phone credential.
+* Reassignment/revocation must bump its authentication revision atomically. Custody
+* revisions are never reused, including after deletion; outstanding codes cannot
+* transfer to another account. Unknown or ineligible numbers return None.
+* This capability never provisions or links an account based on a phone match.
+*/
+var PhoneSignInTargets = class extends Context.Service()("effect-auth/PhoneSignInTargets") {};
+//#endregion
+export { PhoneSignInTargets };
+
+//# sourceMappingURL=PhoneSignInTargets.mjs.map

package/dist/phone/PhoneSignInTargets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PhoneSignInTargets.mjs","names":[],"sources":["../../src/phone/PhoneSignInTargets.ts"],"sourcesContent":["import { Context, type Effect, type Option } from \"effect\";\n\nimport type { PhoneCredentialSnapshot, PhoneNumber, PhoneOtpUnavailable } from \"./models\";\n\n/** Resolve only an existing active account with this exact verified phone credential.\n * Reassignment/revocation must bump its authentication revision atomically. Custody\n * revisions are never reused, including after deletion; outstanding codes cannot\n * transfer to another account. Unknown or ineligible numbers return None.\n * This capability never provisions or links an account based on a phone match.\n */\nexport class PhoneSignInTargets extends Context.Service<\n  PhoneSignInTargets,\n  {\n    readonly lookup: (input: {\n      readonly moduleId: string;\n      readonly phoneNumber: PhoneNumber;\n    }) => Effect.Effect<Option.Option<PhoneCredentialSnapshot>, PhoneOtpUnavailable>;\n  }\n>()(\"effect-auth/PhoneSignInTargets\") {}\n"],"mappings":";;;;;;;;AAUA,IAAa,qBAAb,cAAwC,QAAQ,QAQ9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}