@yielded/auth 0.1.0-beta.1

package/dist/phone/module.mjs

@@ -0,0 +1,293 @@
+import { TokenDigest } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { AuthenticationFlowId, AuthenticationRevision } from "../sessions/models.mjs";
+import { cryptoLayer, defaultLayer, hooksLayer } from "../auth/defaults.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { makeAuthStrategy } from "../auth/AuthStrategy.mjs";
+import { ProofBinding, ProofPurpose, ProofRequestId, ProofRequestReceipt } from "../proofs/models.mjs";
+import { RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import { makeRequestBinding } from "../operations/requestBinding.mjs";
+import { PhoneSignInTargets } from "./PhoneSignInTargets.mjs";
+import { PhoneCredentialSnapshot, PhoneNumber, PhoneOtpComplete, PhoneOtpRejected, PhoneOtpUnavailable } from "./models.mjs";
+import { readProofCommit } from "../proofs/dispatch.mjs";
+import { makeProofModule, snapshotProofConfiguration } from "../proofs/module.mjs";
+import { phoneFailure } from "./failure.mjs";
+import { PhoneDeliveryEligibility } from "./PhoneDeliveryEligibility.mjs";
+import { makePhoneLifecycle, phoneAdmission, phoneAttemptAdmission, phoneDigest } from "./lifecycle.mjs";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Option, Schema } from "effect";
+//#region src/phone/module.ts
+const defaultPolicy = {
+	lifetimeMillis: 3e5,
+	continuationLifetimeMillis: 3e4,
+	maximumFailedAttempts: 5,
+	maximumDeliveryAttempts: 1,
+	deliveryClaimMillis: 1e4,
+	deliveryRetryMillis: 3e4,
+	requestRetentionMillis: 36e5,
+	abuse: {
+		issues: {
+			limit: 5,
+			windowMillis: 36e5
+		},
+		attempts: {
+			limit: 10,
+			windowMillis: 3e5
+		},
+		subjectIssues: {
+			limit: 5,
+			windowMillis: 36e5
+		},
+		subjectAttempts: {
+			limit: 10,
+			windowMillis: 3e5
+		},
+		actionIssues: {
+			limit: 1e3,
+			windowMillis: 36e5
+		},
+		actionAttempts: {
+			limit: 1e3,
+			windowMillis: 3e5
+		},
+		resendCooldownMillis: 3e4
+	}
+};
+/** Capture the phone method's proof defaults when its descriptor is constructed. */
+const snapshotPhoneConfiguration = (input) => snapshotProofConfiguration({
+	...input,
+	policy: input.policy ?? defaultPolicy,
+	secret: {
+		_tag: "NumericCode",
+		digits: input.digits ?? 6
+	}
+});
+const Start = Schema.Struct({
+	flowId: RequestBindingFlowId,
+	requestId: ProofRequestId,
+	phoneNumber: PhoneNumber,
+	locale: Schema.NonEmptyString.check(Schema.isMaxLength(64))
+});
+const Challenge = Schema.Struct({
+	...ProofRequestReceipt.fields,
+	flowId: RequestBindingFlowId
+});
+const Failure = Schema.Union([
+	PhoneOtpRejected,
+	PhoneOtpUnavailable,
+	HookDenied
+]);
+const tuple = Schema.fromJsonString(Schema.Array(Schema.String));
+const noAmbient = Effect.fn("PhoneOtp.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* PhoneOtpUnavailable.make({});
+});
+/** Existing-account SMS sign-in. Verification consumes its proof before session
+* issuance; failure after consumption requires a fresh code. No distributed
+* atomicity or implicit account linking is claimed.
+*/
+const makePhoneOtp = (moduleId, options) => {
+	const { sessions } = options;
+	const binding = makeRequestBinding(moduleId, "phone-otp-sign-in");
+	const proof = makeProofModule(`${moduleId}/sign-in`, {
+		purpose: ProofPurpose.make("phone-otp-sign-in"),
+		binding: ProofBinding,
+		channel: "sms",
+		template: options.template,
+		keys: options.keys,
+		secret: {
+			_tag: "NumericCode",
+			digits: options.digits ?? 6
+		},
+		policy: options.policy ?? defaultPolicy
+	});
+	const ClaimsForPhone = Context.Service(`effect-auth/ClaimsForPhone/${moduleId.length}:${moduleId}`);
+	const lifecycle = makePhoneLifecycle(moduleId, {
+		...options,
+		policy: options.policy ?? defaultPolicy,
+		digits: options.digits ?? 6
+	}, ClaimsForPhone);
+	const capture = Effect.fn("PhoneOtp.capture")(function* (request) {
+		const verified = yield* (yield* binding.RequestBinding).verify(request.flowId, request.requestBinding).pipe(Effect.mapError(phoneFailure));
+		const candidate = yield* (yield* PhoneSignInTargets).lookup({
+			moduleId,
+			phoneNumber: request.phoneNumber
+		});
+		let target = Option.none();
+		if (Option.isSome(candidate)) {
+			const codec = Schema.toCodecJson(PhoneCredentialSnapshot);
+			const snapshot = yield* Schema.encodeEffect(codec)(candidate.value).pipe(Effect.flatMap(Schema.decodeEffect(codec)), Effect.mapError(phoneFailure));
+			const current = yield* (yield* AuthenticationAuthority).capture(snapshot.revision.subjectId, [snapshot.credentialId]).pipe(Effect.map(Option.some), Effect.catchTag("StaleAuthentication", () => Effect.succeed(Option.none())), Effect.mapError(phoneFailure));
+			if (Option.isSome(current)) {
+				const revision = yield* Schema.encodeEffect(Schema.toCodecJson(AuthenticationRevision))(current.value).pipe(Effect.flatMap(Schema.decodeEffect(Schema.toCodecJson(AuthenticationRevision)))).pipe(Effect.mapError(phoneFailure));
+				if (snapshot.moduleId === moduleId && snapshot.phoneNumber === request.phoneNumber && snapshot.verifiedAtMillis <= DateTime.toEpochMillis(yield* DateTime.now) && revision.subjectId === snapshot.revision.subjectId && revision.securityRevision === snapshot.revision.securityRevision && revision.credentials.some((value) => value.credentialId === snapshot.credentialId && value.revision === snapshot.credentialRevision)) target = Option.some({
+					...snapshot,
+					revision
+				});
+			}
+		}
+		const encoded = yield* Schema.encodeEffect(tuple)([
+			"effect-auth/phone-otp-sign-in/v1",
+			moduleId,
+			request.flowId,
+			verified.verifier,
+			request.phoneNumber,
+			Option.isSome(target) ? target.value.custodyRevision : ""
+		]).pipe(Effect.mapError(phoneFailure));
+		const digest = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(encoded)).pipe(Effect.mapError(phoneFailure));
+		const base = {
+			flowId: request.flowId,
+			contextDigest: TokenDigest.make(Encoding.encodeBase64Url(digest)),
+			identifier: LoginIdentifier.make({
+				namespace: "phone",
+				value: request.phoneNumber
+			})
+		};
+		const proofBinding = Option.isSome(target) ? {
+			_tag: "Subject",
+			...base,
+			revision: target.value.revision
+		} : {
+			_tag: "Identifier",
+			...base
+		};
+		return {
+			target,
+			binding: proofBinding
+		};
+	});
+	const admitSignIn = Effect.fn("PhoneOtp.admitRequest")(function* (input) {
+		if (!(yield* phoneAdmission(moduleId, "request", input.requestId, yield* phoneDigest([
+			"sign-in",
+			input.flowId,
+			input.phoneNumber,
+			input.locale
+		]), options.policy?.requestRetentionMillis ?? defaultPolicy.requestRetentionMillis))) return yield* PhoneOtpRejected.make({});
+	});
+	const SignIn = makeOperation(`${moduleId}/sign-in`, {
+		payload: Start,
+		authorize: admitSignIn,
+		success: Challenge,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/complete`, {
+		payload: PhoneOtpComplete,
+		authorize: (input) => phoneAttemptAdmission(moduleId, input.flowId, input.reference.proofId),
+		success: sessions.CompletionResult,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const handlersLayer = Layer.mergeAll(SignIn.credentialHandlerLayer(Effect.fn("PhoneOtp.signIn")(function* (input, invocation) {
+		yield* noAmbient();
+		if (invocation._tag !== "Guest") return yield* PhoneOtpRejected.make({});
+		const issued = yield* (yield* binding.RequestBinding).issue(input.flowId).pipe(Effect.mapError(phoneFailure));
+		const credential = issued.credentialCommands.find((command) => command._tag === "Issue" && command.slot === "request-binding");
+		if (credential?._tag !== "Issue") return yield* PhoneOtpUnavailable.make({});
+		const current = yield* capture({
+			...input,
+			requestBinding: credential.credential
+		});
+		const eligible = yield* (yield* PhoneDeliveryEligibility).allowed(input.phoneNumber);
+		const dispatch = yield* (yield* proof.Proofs).prepareIssue({
+			requestId: input.requestId,
+			binding: current.binding,
+			locale: input.locale,
+			eligible: Option.isSome(current.target) && eligible
+		}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));
+		yield* dispatch.dispatch.pipe(Effect.mapError(phoneFailure));
+		return {
+			value: {
+				...dispatch.receipt,
+				flowId: input.flowId
+			},
+			credentialCommands: issued.credentialCommands
+		};
+	})), Complete.credentialHandlerLayer(Effect.fn("PhoneOtp.completeSignIn")(function* (input, invocation) {
+		yield* noAmbient();
+		if (invocation._tag !== "Guest") return yield* PhoneOtpRejected.make({});
+		const current = yield* capture(input);
+		const verifiedAt = yield* DateTime.now;
+		const proofs = yield* proof.Proofs;
+		const attempted = yield* proofs.prepareAttempt({
+			binding: current.binding,
+			reference: input.reference,
+			credential: input.code
+		}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));
+		if (attempted.value._tag !== "Accepted" || Option.isNone(current.target)) return yield* PhoneOtpRejected.make({});
+		const continuation = attempted.credentialCommands.find((command) => command._tag === "Issue" && command.slot === "proof-continuation");
+		if (continuation?._tag !== "Issue") return yield* PhoneOtpUnavailable.make({});
+		if ((yield* proofs.prepareComplete({
+			binding: current.binding,
+			continuationId: attempted.value.continuation.continuationId,
+			credential: continuation.credential
+		}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure))) !== "completed") return yield* PhoneOtpRejected.make({});
+		const evidence = {
+			flowId: AuthenticationFlowId.make(input.flowId),
+			bindingDigest: current.binding.contextDigest,
+			revision: current.target.value.revision,
+			proofs: [{
+				method: "phone-otp",
+				credentialId: current.target.value.credentialId,
+				factors: ["possession"],
+				userVerified: false,
+				phishingResistant: false,
+				verifiedAt
+			}]
+		};
+		const claimCredential = yield* Schema.encodeEffect(Schema.toCodecJson(PhoneCredentialSnapshot))(current.target.value).pipe(Effect.flatMap(Schema.decodeEffect(Schema.toCodecJson(PhoneCredentialSnapshot))), Effect.mapError(phoneFailure));
+		const claims = yield* (yield* ClaimsForPhone).resolve(claimCredential);
+		const established = yield* (yield* sessions.AuthenticationCompletion).prepare({
+			evidence,
+			claims
+		}).pipe(Effect.flatMap((receipt) => receipt.read), Effect.mapError(phoneFailure));
+		return {
+			value: established.value,
+			credentialCommands: [...established.credentialCommands, {
+				_tag: "Clear",
+				slot: "request-binding"
+			}]
+		};
+	})));
+	const layer = handlersLayer.pipe(Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)), Layer.provide(defaultLayer(proof.Proofs, proof.smsLayer)), Layer.provide([cryptoLayer, hooksLayer]), Layer.merge(lifecycle.layer));
+	return Object.freeze({
+		ClaimsForPhone,
+		lifecycle,
+		binding,
+		proof,
+		layer,
+		handlersLayer: Layer.merge(handlersLayer, lifecycle.handlersLayer),
+		operations: {
+			SignIn,
+			Complete,
+			...lifecycle.operations
+		},
+		group: operationGroup(SignIn, Complete, lifecycle.operations.Begin, lifecycle.operations.Resend, lifecycle.operations.CompleteLifecycle, lifecycle.operations.Cancel, lifecycle.operations.Cleanup),
+		strategy: makeAuthStrategy({
+			signIn: Effect.fn("PhoneOtp.signInRequest")(function* (invocation, input) {
+				const crypto = yield* Crypto.Crypto;
+				const flowId = yield* crypto.randomUUIDv4.pipe(Effect.mapError(phoneFailure));
+				const requestId = yield* crypto.randomUUIDv4.pipe(Effect.mapError(phoneFailure));
+				return yield* SignIn.invoke(invocation, {
+					...input,
+					flowId,
+					requestId,
+					locale: input.locale ?? "en"
+				});
+			}),
+			completeSignIn: Complete.invoke,
+			...lifecycle.methods
+		}, layer.pipe(Layer.provideMerge(cryptoLayer)), { completion: true })
+	});
+};
+//#endregion
+export { makePhoneOtp, snapshotPhoneConfiguration };
+
+//# sourceMappingURL=module.mjs.map

package/dist/phone/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":[],"sources":["../../src/phone/module.ts"],"sourcesContent":["import {\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Layer,\n  Option,\n  Schema,\n  type Types,\n} from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport { hasCommitScope } from \"../hooks/commit\";\nimport { HookDenied } from \"../hooks/models\";\nimport { LoginIdentifier } from \"../identity/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport type { RequestBindingCredential } from \"../operations/requestBinding\";\nimport { makeRequestBinding, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport type { ProofKeyring } from \"../proofs/crypto\";\nimport { readProofCommit } from \"../proofs/dispatch\";\nimport { ProofBinding, ProofPurpose, ProofRequestId, ProofRequestReceipt } from \"../proofs/models\";\nimport { makeProofModule, snapshotProofConfiguration } from \"../proofs/module\";\nimport type { ProofPolicy } from \"../proofs/policy\";\nimport { TokenDigest } from \"../Schema\";\nimport { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport {\n  AuthenticationFlowId,\n  AuthenticationRevision,\n  type AuthenticationEvidence,\n} from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport { phoneFailure } from \"./failure\";\nimport {\n  makePhoneLifecycle,\n  phoneAdmission,\n  phoneDigest,\n  phoneAttemptAdmission,\n} from \"./lifecycle\";\nimport type { PhoneLifecyclePolicy } from \"./lifecycleModels\";\nimport {\n  PhoneCredentialSnapshot,\n  PhoneNumber,\n  PhoneOtpComplete,\n  PhoneOtpRejected,\n  PhoneOtpUnavailable,\n} from \"./models\";\nimport { PhoneDeliveryEligibility } from \"./PhoneDeliveryEligibility\";\nimport { PhoneSignInTargets } from \"./PhoneSignInTargets\";\n\nconst defaultPolicy: ProofPolicy = {\n  lifetimeMillis: 300_000,\n  continuationLifetimeMillis: 30_000,\n  maximumFailedAttempts: 5,\n  maximumDeliveryAttempts: 1,\n  deliveryClaimMillis: 10_000,\n  deliveryRetryMillis: 30_000,\n  requestRetentionMillis: 3_600_000,\n  abuse: {\n    issues: { limit: 5, windowMillis: 3_600_000 },\n    attempts: { limit: 10, windowMillis: 300_000 },\n    subjectIssues: { limit: 5, windowMillis: 3_600_000 },\n    subjectAttempts: { limit: 10, windowMillis: 300_000 },\n    actionIssues: { limit: 1000, windowMillis: 3_600_000 },\n    actionAttempts: { limit: 1000, windowMillis: 300_000 },\n    resendCooldownMillis: 30_000,\n  },\n};\n\n/** Capture the phone method's proof defaults when its descriptor is constructed. */\nexport const snapshotPhoneConfiguration = <\n  Configuration extends {\n    readonly template: string;\n    readonly keys: ProofKeyring;\n    readonly policy?: ProofPolicy;\n    readonly digits?: 6 | 7 | 8 | 9 | 10;\n    readonly lifecycle?: PhoneLifecyclePolicy;\n  },\n>(\n  input: Configuration,\n) =>\n  snapshotProofConfiguration({\n    ...input,\n    policy: input.policy ?? defaultPolicy,\n    secret: { _tag: \"NumericCode\" as const, digits: input.digits ?? 6 },\n  });\n\nconst Start = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  requestId: ProofRequestId,\n  phoneNumber: PhoneNumber,\n  locale: Schema.NonEmptyString.check(Schema.isMaxLength(64)),\n});\n\nconst Challenge = Schema.Struct({ ...ProofRequestReceipt.fields, flowId: RequestBindingFlowId });\nconst Failure = Schema.Union([PhoneOtpRejected, PhoneOtpUnavailable, HookDenied]);\nconst tuple = Schema.fromJsonString(Schema.Array(Schema.String));\n\nconst noAmbient = Effect.fn(\"PhoneOtp.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* PhoneOtpUnavailable.make({});\n});\n\n/** Existing-account SMS sign-in. Verification consumes its proof before session\n * issuance; failure after consumption requires a fresh code. No distributed\n * atomicity or implicit account linking is claimed.\n */\nexport const makePhoneOtp = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n    readonly template: string;\n    readonly keys: ProofKeyring;\n    readonly policy?: ProofPolicy;\n    readonly digits?: 6 | 7 | 8 | 9 | 10;\n    readonly lifecycle?: PhoneLifecyclePolicy;\n  },\n) => {\n  const { sessions } = options;\n  const binding = makeRequestBinding(moduleId, \"phone-otp-sign-in\");\n\n  const proof = makeProofModule(`${moduleId}/sign-in`, {\n    purpose: ProofPurpose.make(\"phone-otp-sign-in\"),\n    binding: ProofBinding,\n    channel: \"sms\",\n    template: options.template,\n    keys: options.keys,\n    secret: { _tag: \"NumericCode\", digits: options.digits ?? 6 },\n    policy: options.policy ?? defaultPolicy,\n  });\n\n  const ClaimsForPhone = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"phone-claims\";\n      readonly claims: Types.Invariant<Claims[\"Type\"]>;\n    },\n    {\n      readonly resolve: (\n        credential: PhoneCredentialSnapshot,\n      ) => Effect.Effect<Claims[\"Type\"], PhoneOtpUnavailable>;\n    }\n  >(`effect-auth/ClaimsForPhone/${moduleId.length}:${moduleId}`);\n\n  const lifecycle = makePhoneLifecycle(\n    moduleId,\n    { ...options, policy: options.policy ?? defaultPolicy, digits: options.digits ?? 6 },\n    ClaimsForPhone,\n  );\n\n  const capture = Effect.fn(\"PhoneOtp.capture\")(function* (request: {\n    readonly flowId: RequestBindingFlowId;\n    readonly phoneNumber: PhoneNumber;\n    readonly requestBinding: typeof RequestBindingCredential.Type;\n  }) {\n    const verified = yield* (yield* binding.RequestBinding)\n      .verify(request.flowId, request.requestBinding)\n      .pipe(Effect.mapError(phoneFailure));\n\n    const candidate = yield* (yield* PhoneSignInTargets).lookup({\n      moduleId,\n      phoneNumber: request.phoneNumber,\n    });\n\n    let target: Option.Option<PhoneCredentialSnapshot> = Option.none();\n\n    if (Option.isSome(candidate)) {\n      const codec = Schema.toCodecJson(PhoneCredentialSnapshot);\n\n      const snapshot = yield* Schema.encodeEffect(codec)(candidate.value).pipe(\n        Effect.flatMap(Schema.decodeEffect(codec)),\n        Effect.mapError(phoneFailure),\n      );\n\n      const current = yield* (yield* AuthenticationAuthority)\n        .capture(snapshot.revision.subjectId, [snapshot.credentialId])\n        .pipe(\n          Effect.map(Option.some),\n          Effect.catchTag(\"StaleAuthentication\", () => Effect.succeed(Option.none())),\n          Effect.mapError(phoneFailure),\n        );\n\n      if (Option.isSome(current)) {\n        const revision = yield* Schema.encodeEffect(Schema.toCodecJson(AuthenticationRevision))(\n          current.value,\n        )\n          .pipe(Effect.flatMap(Schema.decodeEffect(Schema.toCodecJson(AuthenticationRevision))))\n          .pipe(Effect.mapError(phoneFailure));\n\n        if (\n          snapshot.moduleId === moduleId &&\n          snapshot.phoneNumber === request.phoneNumber &&\n          snapshot.verifiedAtMillis <= DateTime.toEpochMillis(yield* DateTime.now) &&\n          revision.subjectId === snapshot.revision.subjectId &&\n          revision.securityRevision === snapshot.revision.securityRevision &&\n          revision.credentials.some(\n            (value) =>\n              value.credentialId === snapshot.credentialId &&\n              value.revision === snapshot.credentialRevision,\n          )\n        )\n          target = Option.some({ ...snapshot, revision });\n      }\n    }\n\n    const encoded = yield* Schema.encodeEffect(tuple)([\n      \"effect-auth/phone-otp-sign-in/v1\",\n      moduleId,\n      request.flowId,\n      verified.verifier,\n      request.phoneNumber,\n      Option.isSome(target) ? target.value.custodyRevision : \"\",\n    ]).pipe(Effect.mapError(phoneFailure));\n\n    const digest = yield* (yield* Crypto.Crypto)\n      .digest(\"SHA-256\", new TextEncoder().encode(encoded))\n      .pipe(Effect.mapError(phoneFailure));\n\n    const base = {\n      flowId: request.flowId,\n      contextDigest: TokenDigest.make(Encoding.encodeBase64Url(digest)),\n      identifier: LoginIdentifier.make({ namespace: \"phone\", value: request.phoneNumber }),\n    };\n\n    const proofBinding: ProofBinding = Option.isSome(target)\n      ? { _tag: \"Subject\", ...base, revision: target.value.revision }\n      : { _tag: \"Identifier\", ...base };\n\n    return { target, binding: proofBinding };\n  });\n\n  const admitSignIn = Effect.fn(\"PhoneOtp.admitRequest\")(function* (input: typeof Start.Type) {\n    if (\n      !(yield* phoneAdmission(\n        moduleId,\n        \"request\",\n        input.requestId,\n        yield* phoneDigest([\"sign-in\", input.flowId, input.phoneNumber, input.locale]),\n        options.policy?.requestRetentionMillis ?? defaultPolicy.requestRetentionMillis,\n      ))\n    )\n      return yield* PhoneOtpRejected.make({});\n  });\n\n  const SignIn = makeOperation(`${moduleId}/sign-in`, {\n    payload: Start,\n    authorize: admitSignIn,\n    success: Challenge,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/complete`, {\n    payload: PhoneOtpComplete,\n    authorize: (input) => phoneAttemptAdmission(moduleId, input.flowId, input.reference.proofId),\n    success: sessions.CompletionResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    SignIn.credentialHandlerLayer(\n      Effect.fn(\"PhoneOtp.signIn\")(function* (input, invocation) {\n        yield* noAmbient();\n        if (invocation._tag !== \"Guest\") return yield* PhoneOtpRejected.make({});\n\n        const issued = yield* (yield* binding.RequestBinding)\n          .issue(input.flowId)\n          .pipe(Effect.mapError(phoneFailure));\n\n        const credential = issued.credentialCommands.find(\n          (command) => command._tag === \"Issue\" && command.slot === \"request-binding\",\n        );\n\n        if (credential?._tag !== \"Issue\") return yield* PhoneOtpUnavailable.make({});\n        const current = yield* capture({ ...input, requestBinding: credential.credential });\n        const eligible = yield* (yield* PhoneDeliveryEligibility).allowed(input.phoneNumber);\n\n        const dispatch = yield* (yield* proof.Proofs)\n          .prepareIssue({\n            requestId: input.requestId,\n            binding: current.binding,\n            locale: input.locale,\n            eligible: Option.isSome(current.target) && eligible,\n          })\n          .pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));\n\n        yield* dispatch.dispatch.pipe(Effect.mapError(phoneFailure));\n\n        return {\n          value: { ...dispatch.receipt, flowId: input.flowId },\n          credentialCommands: issued.credentialCommands,\n        };\n      }),\n    ),\n    Complete.credentialHandlerLayer(\n      Effect.fn(\"PhoneOtp.completeSignIn\")(function* (input, invocation) {\n        yield* noAmbient();\n        if (invocation._tag !== \"Guest\") return yield* PhoneOtpRejected.make({});\n        const current = yield* capture(input);\n        const verifiedAt = yield* DateTime.now;\n        const proofs = yield* proof.Proofs;\n\n        const attempted = yield* proofs\n          .prepareAttempt({\n            binding: current.binding,\n            reference: input.reference,\n            credential: input.code,\n          })\n          .pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));\n\n        if (attempted.value._tag !== \"Accepted\" || Option.isNone(current.target))\n          return yield* PhoneOtpRejected.make({});\n\n        const continuation = attempted.credentialCommands.find(\n          (command) => command._tag === \"Issue\" && command.slot === \"proof-continuation\",\n        );\n\n        if (continuation?._tag !== \"Issue\") return yield* PhoneOtpUnavailable.make({});\n\n        const consumed = yield* proofs\n          .prepareComplete({\n            binding: current.binding,\n            continuationId: attempted.value.continuation.continuationId,\n            credential: continuation.credential,\n          })\n          .pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));\n\n        if (consumed !== \"completed\") return yield* PhoneOtpRejected.make({});\n\n        const evidence: AuthenticationEvidence = {\n          flowId: AuthenticationFlowId.make(input.flowId),\n          bindingDigest: current.binding.contextDigest,\n          revision: current.target.value.revision,\n          proofs: [\n            {\n              method: \"phone-otp\",\n              credentialId: current.target.value.credentialId,\n              factors: [\"possession\"],\n              userVerified: false,\n              phishingResistant: false,\n              verifiedAt,\n            },\n          ],\n        };\n\n        const claimCredential = yield* Schema.encodeEffect(\n          Schema.toCodecJson(PhoneCredentialSnapshot),\n        )(current.target.value).pipe(\n          Effect.flatMap(Schema.decodeEffect(Schema.toCodecJson(PhoneCredentialSnapshot))),\n          Effect.mapError(phoneFailure),\n        );\n\n        const claims = yield* (yield* ClaimsForPhone).resolve(claimCredential);\n\n        const established = yield* (yield* sessions.AuthenticationCompletion)\n          .prepare({ evidence, claims })\n          .pipe(\n            Effect.flatMap((receipt) => receipt.read),\n            Effect.mapError(phoneFailure),\n          );\n\n        return {\n          value: established.value,\n          credentialCommands: [\n            ...established.credentialCommands,\n            { _tag: \"Clear\" as const, slot: \"request-binding\" as const },\n          ],\n        };\n      }),\n    ),\n  );\n\n  const layer = handlersLayer.pipe(\n    Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n    Layer.provide(defaultLayer(proof.Proofs, proof.smsLayer)),\n    Layer.provide([cryptoLayer, hooksLayer]),\n    Layer.merge(lifecycle.layer),\n  );\n\n  return Object.freeze({\n    ClaimsForPhone,\n    lifecycle,\n    binding,\n    proof,\n    layer,\n    handlersLayer: Layer.merge(handlersLayer, lifecycle.handlersLayer),\n    operations: { SignIn, Complete, ...lifecycle.operations },\n    group: operationGroup(\n      SignIn,\n      Complete,\n      lifecycle.operations.Begin,\n      lifecycle.operations.Resend,\n      lifecycle.operations.CompleteLifecycle,\n      lifecycle.operations.Cancel,\n      lifecycle.operations.Cleanup,\n    ),\n    strategy: makeAuthStrategy(\n      {\n        signIn: Effect.fn(\"PhoneOtp.signInRequest\")(function* (\n          invocation: AuthInvocation,\n          input: { readonly phoneNumber: string; readonly locale?: string },\n        ) {\n          const crypto = yield* Crypto.Crypto;\n          const flowId = yield* crypto.randomUUIDv4.pipe(Effect.mapError(phoneFailure));\n          const requestId = yield* crypto.randomUUIDv4.pipe(Effect.mapError(phoneFailure));\n\n          return yield* SignIn.invoke(invocation, {\n            ...input,\n            flowId,\n            requestId,\n            locale: input.locale ?? \"en\",\n          });\n        }),\n        completeSignIn: Complete.invoke,\n        ...lifecycle.methods,\n      },\n      layer.pipe(Layer.provideMerge(cryptoLayer)),\n      { completion: true },\n    ),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAoDA,MAAM,gBAA6B;CACjC,gBAAgB;CAChB,4BAA4B;CAC5B,uBAAuB;CACvB,yBAAyB;CACzB,qBAAqB;CACrB,qBAAqB;CACrB,wBAAwB;CACxB,OAAO;EACL,QAAQ;GAAE,OAAO;GAAG,cAAc;EAAU;EAC5C,UAAU;GAAE,OAAO;GAAI,cAAc;EAAQ;EAC7C,eAAe;GAAE,OAAO;GAAG,cAAc;EAAU;EACnD,iBAAiB;GAAE,OAAO;GAAI,cAAc;EAAQ;EACpD,cAAc;GAAE,OAAO;GAAM,cAAc;EAAU;EACrD,gBAAgB;GAAE,OAAO;GAAM,cAAc;EAAQ;EACrD,sBAAsB;CACxB;AACF;;AAGA,MAAa,8BASX,UAEA,2BAA2B;CACzB,GAAG;CACH,QAAQ,MAAM,UAAU;CACxB,QAAQ;EAAE,MAAM;EAAwB,QAAQ,MAAM,UAAU;CAAE;AACpE,CAAC;AAEH,MAAM,QAAQ,OAAO,OAAO;CAC1B,QAAQ;CACR,WAAW;CACX,aAAa;CACb,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAAE,GAAG,oBAAoB;CAAQ,QAAQ;AAAqB,CAAC;AAC/F,MAAM,UAAU,OAAO,MAAM;CAAC;CAAkB;CAAqB;AAAU,CAAC;AAChF,MAAM,QAAQ,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;AAE/D,MAAM,YAAY,OAAO,GAAG,oBAAoB,CAAC,CAAC,aAAa;CAC7D,IAAI,OAAO,gBAAgB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;AACtE,CAAC;;;;;AAMD,MAAa,gBAKX,UACA,YAQG;CACH,MAAM,EAAE,aAAa;CACrB,MAAM,UAAU,mBAAmB,UAAU,mBAAmB;CAEhE,MAAM,QAAQ,gBAAgB,GAAG,SAAS,WAAW;EACnD,SAAS,aAAa,KAAK,mBAAmB;EAC9C,SAAS;EACT,SAAS;EACT,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,QAAQ;GAAE,MAAM;GAAe,QAAQ,QAAQ,UAAU;EAAE;EAC3D,QAAQ,QAAQ,UAAU;CAC5B,CAAC;CAED,MAAM,iBAAiB,QAAQ,QAW7B,8BAA8B,SAAS,OAAO,GAAG,UAAU;CAE7D,MAAM,YAAY,mBAChB,UACA;EAAE,GAAG;EAAS,QAAQ,QAAQ,UAAU;EAAe,QAAQ,QAAQ,UAAU;CAAE,GACnF,cACF;CAEA,MAAM,UAAU,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAItD;EACD,MAAM,WAAW,QAAQ,OAAO,QAAQ,eAAA,CACrC,OAAO,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAC9C,KAAK,OAAO,SAAS,YAAY,CAAC;EAErC,MAAM,YAAY,QAAQ,OAAO,mBAAA,CAAoB,OAAO;GAC1D;GACA,aAAa,QAAQ;EACvB,CAAC;EAED,IAAI,SAAiD,OAAO,KAAK;EAEjE,IAAI,OAAO,OAAO,SAAS,GAAG;GAC5B,MAAM,QAAQ,OAAO,YAAY,uBAAuB;GAExD,MAAM,WAAW,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,KAClE,OAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,GACzC,OAAO,SAAS,YAAY,CAC9B;GAEA,MAAM,UAAU,QAAQ,OAAO,wBAAA,CAC5B,QAAQ,SAAS,SAAS,WAAW,CAAC,SAAS,YAAY,CAAC,CAAC,CAC7D,KACC,OAAO,IAAI,OAAO,IAAI,GACtB,OAAO,SAAS,6BAA6B,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,GAC1E,OAAO,SAAS,YAAY,CAC9B;GAEF,IAAI,OAAO,OAAO,OAAO,GAAG;IAC1B,MAAM,WAAW,OAAO,OAAO,aAAa,OAAO,YAAY,sBAAsB,CAAC,CAAC,CACrF,QAAQ,KACV,CAAC,CACE,KAAK,OAAO,QAAQ,OAAO,aAAa,OAAO,YAAY,sBAAsB,CAAC,CAAC,CAAC,CAAC,CACrF,KAAK,OAAO,SAAS,YAAY,CAAC;IAErC,IACE,SAAS,aAAa,YACtB,SAAS,gBAAgB,QAAQ,eACjC,SAAS,oBAAoB,SAAS,cAAc,OAAO,SAAS,GAAG,KACvE,SAAS,cAAc,SAAS,SAAS,aACzC,SAAS,qBAAqB,SAAS,SAAS,oBAChD,SAAS,YAAY,MAClB,UACC,MAAM,iBAAiB,SAAS,gBAChC,MAAM,aAAa,SAAS,kBAChC,GAEA,SAAS,OAAO,KAAK;KAAE,GAAG;KAAU;IAAS,CAAC;GAClD;EACF;EAEA,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GAChD;GACA;GACA,QAAQ;GACR,SAAS;GACT,QAAQ;GACR,OAAO,OAAO,MAAM,IAAI,OAAO,MAAM,kBAAkB;EACzD,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;EAErC,MAAM,SAAS,QAAQ,OAAO,OAAO,OAAA,CAClC,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CACpD,KAAK,OAAO,SAAS,YAAY,CAAC;EAErC,MAAM,OAAO;GACX,QAAQ,QAAQ;GAChB,eAAe,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;GAChE,YAAY,gBAAgB,KAAK;IAAE,WAAW;IAAS,OAAO,QAAQ;GAAY,CAAC;EACrF;EAEA,MAAM,eAA6B,OAAO,OAAO,MAAM,IACnD;GAAE,MAAM;GAAW,GAAG;GAAM,UAAU,OAAO,MAAM;EAAS,IAC5D;GAAE,MAAM;GAAc,GAAG;EAAK;EAElC,OAAO;GAAE;GAAQ,SAAS;EAAa;CACzC,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAA0B;EAC1F,IACE,EAAE,OAAO,eACP,UACA,WACA,MAAM,WACN,OAAO,YAAY;GAAC;GAAW,MAAM;GAAQ,MAAM;GAAa,MAAM;EAAM,CAAC,GAC7E,QAAQ,QAAQ,0BAA0B,cAAc,sBAC1D,IAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CAC1C,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,WAAW;EAClD,SAAS;EACT,WAAW;EACX,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,YAAY;EACrD,SAAS;EACT,YAAY,UAAU,sBAAsB,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO;EAC3F,SAAS,SAAS;EAClB,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,OAAO,uBACL,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,OAAO,YAAY;EACzD,OAAO,UAAU;EACjB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAEvE,MAAM,SAAS,QAAQ,OAAO,QAAQ,eAAA,CACnC,MAAM,MAAM,MAAM,CAAC,CACnB,KAAK,OAAO,SAAS,YAAY,CAAC;EAErC,MAAM,aAAa,OAAO,mBAAmB,MAC1C,YAAY,QAAQ,SAAS,WAAW,QAAQ,SAAS,iBAC5D;EAEA,IAAI,YAAY,SAAS,SAAS,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAC3E,MAAM,UAAU,OAAO,QAAQ;GAAE,GAAG;GAAO,gBAAgB,WAAW;EAAW,CAAC;EAClF,MAAM,WAAW,QAAQ,OAAO,yBAAA,CAA0B,QAAQ,MAAM,WAAW;EAEnF,MAAM,WAAW,QAAQ,OAAO,MAAM,OAAA,CACnC,aAAa;GACZ,WAAW,MAAM;GACjB,SAAS,QAAQ;GACjB,QAAQ,MAAM;GACd,UAAU,OAAO,OAAO,QAAQ,MAAM,KAAK;EAC7C,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,YAAY,CAAC;EAEtE,OAAO,SAAS,SAAS,KAAK,OAAO,SAAS,YAAY,CAAC;EAE3D,OAAO;GACL,OAAO;IAAE,GAAG,SAAS;IAAS,QAAQ,MAAM;GAAO;GACnD,oBAAoB,OAAO;EAC7B;CACF,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAO,YAAY;EACjE,OAAO,UAAU;EACjB,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACvE,MAAM,UAAU,OAAO,QAAQ,KAAK;EACpC,MAAM,aAAa,OAAO,SAAS;EACnC,MAAM,SAAS,OAAO,MAAM;EAE5B,MAAM,YAAY,OAAO,OACtB,eAAe;GACd,SAAS,QAAQ;GACjB,WAAW,MAAM;GACjB,YAAY,MAAM;EACpB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,YAAY,CAAC;EAEtE,IAAI,UAAU,MAAM,SAAS,cAAc,OAAO,OAAO,QAAQ,MAAM,GACrE,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAExC,MAAM,eAAe,UAAU,mBAAmB,MAC/C,YAAY,QAAQ,SAAS,WAAW,QAAQ,SAAS,oBAC5D;EAEA,IAAI,cAAc,SAAS,SAAS,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAU7E,KAAI,OARoB,OACrB,gBAAgB;GACf,SAAS,QAAQ;GACjB,gBAAgB,UAAU,MAAM,aAAa;GAC7C,YAAY,aAAa;EAC3B,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,YAAY,CAAC,OAErD,aAAa,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAEpE,MAAM,WAAmC;GACvC,QAAQ,qBAAqB,KAAK,MAAM,MAAM;GAC9C,eAAe,QAAQ,QAAQ;GAC/B,UAAU,QAAQ,OAAO,MAAM;GAC/B,QAAQ,CACN;IACE,QAAQ;IACR,cAAc,QAAQ,OAAO,MAAM;IACnC,SAAS,CAAC,YAAY;IACtB,cAAc;IACd,mBAAmB;IACnB;GACF,CACF;EACF;EAEA,MAAM,kBAAkB,OAAO,OAAO,aACpC,OAAO,YAAY,uBAAuB,CAC5C,CAAC,CAAC,QAAQ,OAAO,KAAK,CAAC,CAAC,KACtB,OAAO,QAAQ,OAAO,aAAa,OAAO,YAAY,uBAAuB,CAAC,CAAC,GAC/E,OAAO,SAAS,YAAY,CAC9B;EAEA,MAAM,SAAS,QAAQ,OAAO,eAAA,CAAgB,QAAQ,eAAe;EAErE,MAAM,cAAc,QAAQ,OAAO,SAAS,yBAAA,CACzC,QAAQ;GAAE;GAAU;EAAO,CAAC,CAAC,CAC7B,KACC,OAAO,SAAS,YAAY,QAAQ,IAAI,GACxC,OAAO,SAAS,YAAY,CAC9B;EAEF,OAAO;GACL,OAAO,YAAY;GACnB,oBAAoB,CAClB,GAAG,YAAY,oBACf;IAAE,MAAM;IAAkB,MAAM;GAA2B,CAC7D;EACF;CACF,CAAC,CACH,CACF;CAEA,MAAM,QAAQ,cAAc,KAC1B,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,aAAa,MAAM,QAAQ,MAAM,QAAQ,CAAC,GACxD,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,GACvC,MAAM,MAAM,UAAU,KAAK,CAC7B;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA,eAAe,MAAM,MAAM,eAAe,UAAU,aAAa;EACjE,YAAY;GAAE;GAAQ;GAAU,GAAG,UAAU;EAAW;EACxD,OAAO,eACL,QACA,UACA,UAAU,WAAW,OACrB,UAAU,WAAW,QACrB,UAAU,WAAW,mBACrB,UAAU,WAAW,QACrB,UAAU,WAAW,OACvB;EACA,UAAU,iBACR;GACE,QAAQ,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAC1C,YACA,OACA;IACA,MAAM,SAAS,OAAO,OAAO;IAC7B,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,OAAO,SAAS,YAAY,CAAC;IAC5E,MAAM,YAAY,OAAO,OAAO,aAAa,KAAK,OAAO,SAAS,YAAY,CAAC;IAE/E,OAAO,OAAO,OAAO,OAAO,YAAY;KACtC,GAAG;KACH;KACA;KACA,QAAQ,MAAM,UAAU;IAC1B,CAAC;GACH,CAAC;GACD,gBAAgB,SAAS;GACzB,GAAG,UAAU;EACf,GACA,MAAM,KAAK,MAAM,aAAa,WAAW,CAAC,GAC1C,EAAE,YAAY,KAAK,CACrB;CACF,CAAC;AACH"}

package/dist/proofs/EmailProofDelivery.d.mts

@@ -0,0 +1,13 @@
+import { ProofDeliveryOutcome } from "./models.mjs";
+import { ProofConfigurationError } from "./errors.mjs";
+import { ProofDelivery, ProofDeliveryMessage, ProofVendorPolicy } from "./delivery.mjs";
+import { Context, Effect } from "effect";
+//#region src/proofs/EmailProofDelivery.d.ts
+declare const EmailProofDelivery_base: Context.ServiceClass<EmailProofDelivery, "effect-auth/EmailProofDelivery", ProofDelivery>;
+/** Consumer-selected email renderer/vendor. No core import of a vendor SDK or application config. */
+declare class EmailProofDelivery extends EmailProofDelivery_base {
+  static readonly layer: <E, R>(vendor: ProofVendorPolicy, send: (message: ProofDeliveryMessage) => Effect.Effect<ProofDeliveryOutcome, E, R>) => import("effect/Layer").Layer<EmailProofDelivery, ProofConfigurationError, Exclude<R, import("effect/Scope").Scope>>;
+}
+//#endregion
+export { EmailProofDelivery };
+//# sourceMappingURL=EmailProofDelivery.d.mts.map

package/dist/proofs/EmailProofDelivery.mjs

@@ -0,0 +1,11 @@
+import { proofDeliveryLayer } from "./delivery.mjs";
+import { Context } from "effect";
+//#region src/proofs/EmailProofDelivery.ts
+/** Consumer-selected email renderer/vendor. No core import of a vendor SDK or application config. */
+var EmailProofDelivery = class extends Context.Service()("effect-auth/EmailProofDelivery") {
+	static layer = (vendor, send) => proofDeliveryLayer(this, vendor, send);
+};
+//#endregion
+export { EmailProofDelivery };
+
+//# sourceMappingURL=EmailProofDelivery.mjs.map

package/dist/proofs/EmailProofDelivery.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailProofDelivery.mjs","names":[],"sources":["../../src/proofs/EmailProofDelivery.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport {\n  type ProofDelivery,\n  type ProofDeliveryMessage,\n  type ProofVendorPolicy,\n  proofDeliveryLayer,\n} from \"./delivery\";\nimport type { ProofDeliveryOutcome } from \"./models\";\n\n/** Consumer-selected email renderer/vendor. No core import of a vendor SDK or application config. */\nexport class EmailProofDelivery extends Context.Service<EmailProofDelivery, ProofDelivery>()(\n  \"effect-auth/EmailProofDelivery\",\n) {\n  static readonly layer = <E, R>(\n    vendor: ProofVendorPolicy,\n    send: (message: ProofDeliveryMessage) => Effect.Effect<ProofDeliveryOutcome, E, R>,\n  ) => proofDeliveryLayer(this, vendor, send);\n}\n"],"mappings":";;;;AAWA,IAAa,qBAAb,cAAwC,QAAQ,QAA2C,CAAC,CAC1F,gCACF,CAAC,CAAC;CACA,OAAgB,SACd,QACA,SACG,mBAAmB,MAAM,QAAQ,IAAI;AAC5C"}

package/dist/proofs/HostIngressLimiter.d.mts

@@ -0,0 +1,20 @@
+import { ProofIngressDenied, ProofUnavailable } from "./errors.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/proofs/HostIngressLimiter.d.ts
+declare const HostIngressLimiter_base: Context.ServiceClass<HostIngressLimiter, "effect-auth/HostIngressLimiter", {
+  readonly check: (input: {
+    readonly action: string;
+    readonly networkKey: Redacted.Redacted<string>;
+    readonly deviceKey?: Redacted.Redacted<string>;
+  }) => Effect.Effect<void, ProofIngressDenied | ProofUnavailable>;
+}>;
+/**
+ * Optional host extension, invoked before RPC/HTTP parsing as well as valid calls.
+ * Only the host's trusted network extraction supplies these keys; wire payloads
+ * cannot choose their own IP/device bucket. No permissive default or process-
+ * memory implementation is presented as distributed protection.
+ */
+declare class HostIngressLimiter extends HostIngressLimiter_base {}
+//#endregion
+export { HostIngressLimiter };
+//# sourceMappingURL=HostIngressLimiter.d.mts.map

package/dist/proofs/HostIngressLimiter.mjs

@@ -0,0 +1,13 @@
+import { Context } from "effect";
+//#region src/proofs/HostIngressLimiter.ts
+/**
+* Optional host extension, invoked before RPC/HTTP parsing as well as valid calls.
+* Only the host's trusted network extraction supplies these keys; wire payloads
+* cannot choose their own IP/device bucket. No permissive default or process-
+* memory implementation is presented as distributed protection.
+*/
+var HostIngressLimiter = class extends Context.Service()("effect-auth/HostIngressLimiter") {};
+//#endregion
+export { HostIngressLimiter };
+
+//# sourceMappingURL=HostIngressLimiter.mjs.map

package/dist/proofs/HostIngressLimiter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"HostIngressLimiter.mjs","names":[],"sources":["../../src/proofs/HostIngressLimiter.ts"],"sourcesContent":["import { Context, type Effect, type Redacted } from \"effect\";\n\nimport type { ProofIngressDenied, ProofUnavailable } from \"./errors\";\n\n/**\n * Optional host extension, invoked before RPC/HTTP parsing as well as valid calls.\n * Only the host's trusted network extraction supplies these keys; wire payloads\n * cannot choose their own IP/device bucket. No permissive default or process-\n * memory implementation is presented as distributed protection.\n */\nexport class HostIngressLimiter extends Context.Service<\n  HostIngressLimiter,\n  {\n    readonly check: (input: {\n      readonly action: string;\n      readonly networkKey: Redacted.Redacted<string>;\n      readonly deviceKey?: Redacted.Redacted<string>;\n    }) => Effect.Effect<void, ProofIngressDenied | ProofUnavailable>;\n  }\n>()(\"effect-auth/HostIngressLimiter\") {}\n"],"mappings":";;;;;;;;AAUA,IAAa,qBAAb,cAAwC,QAAQ,QAS9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/proofs/ProofPersistence.d.mts

@@ -0,0 +1,140 @@
+import { TokenDigest } from "../Schema.mjs";
+import { CommitJournal, PreparedCommit } from "../hooks/commit.mjs";
+import { ProofAttemptDecision, ProofBinding, ProofCleanupResult, ProofCompletionDecision, ProofContinuationId, ProofDeliveryId, ProofDeliveryOutcome, ProofId, ProofPurpose, ProofRequestId, ProofRequestReceipt, ProofVersion } from "./models.mjs";
+import { ProofRequestConflict, ProofUnavailable } from "./errors.mjs";
+import { ProofPolicy } from "./policy.mjs";
+import { Context, Effect } from "effect";
+//#region src/proofs/ProofPersistence.d.ts
+interface ProofCompletionInput {
+  readonly moduleId: string;
+  readonly purpose: ProofPurpose;
+  readonly continuationId: ProofContinuationId;
+  readonly continuationDigest: TokenDigest;
+  readonly binding: ProofBinding;
+  readonly nowMillis: number;
+}
+type PrepareProofCommit<Value, A> = (value: Value, journal: CommitJournal) => PreparedCommit<A>;
+interface ProofDigest {
+  readonly keyId: string;
+  readonly digest: TokenDigest;
+}
+interface ProofRecord {
+  readonly moduleId: string;
+  readonly purpose: ProofPurpose;
+  readonly proofId: ProofId;
+  readonly requestId: ProofRequestId;
+  readonly fingerprint: TokenDigest;
+  readonly deliveryId: ProofDeliveryId;
+  readonly binding: ProofBinding;
+  readonly verifier: ProofDigest;
+  readonly issuedAtMillis: number;
+  readonly expiresAtMillis: number;
+  readonly version: ProofVersion;
+}
+type ProofIssueDecision = {
+  readonly _tag: "Issued";
+  readonly record: ProofRecord;
+} | {
+  readonly _tag: "Existing" | "Suppressed";
+  readonly receipt: ProofRequestReceipt;
+};
+type ProofDeliveryClaim = {
+  readonly _tag: "Claimed";
+  readonly claimVersion: ProofVersion;
+} | {
+  readonly _tag: "Declined";
+};
+declare const ProofPersistence_base: Context.ServiceClass<ProofPersistence, "effect-auth/ProofPersistence", {
+  /**
+   * Atomically charge all identifier/subject/action issue windows (independent
+   * of flow/context/request IDs), enforce cooldown, insert a new active series
+   * generation, and supersede its predecessor. Preserve rolling failed-attempt
+   * history and send budgets across resends, consumption, cancellation and expiry.
+   * Matching request fingerprint returns Existing WITHOUT pairing its stored
+   * digest with this attempt's new secret. Mismatched reuse fails Conflict.
+   * eligible=false still charges existence-independent budgets and stores the
+   * request fingerprint, but creates no usable proof/delivery. Never disclose why.
+   * Check any captured security/credential/identifier revision against current authority.
+   */
+  readonly issue: <A>(input: {
+    readonly record: ProofRecord;
+    readonly policy: ProofPolicy;
+    readonly eligible: boolean;
+    readonly supersedes?: ProofId;
+  }, prepare: PrepareProofCommit<ProofIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, ProofRequestConflict | ProofUnavailable>;
+  /**
+   * Charge action/identifier/subject attempt windows even for missing, mismatched,
+   * consumed or malformed candidates. Compare only the row's stored keyId.
+   * Enforce active generation, exact purpose/binding, current revisions, expiry,
+   * rolling failure budget and max failures atomically. One winner consumes proof
+   * and creates a digest-only restricted continuation whose expiry is clipped to
+   * min(proof.expiresAt, now+continuationLifetime); every rejection is a committed VALUE.
+   */
+  readonly attempt: <A>(input: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly proofId: ProofId;
+    readonly binding: ProofBinding;
+    readonly candidate?: ProofDigest;
+    readonly continuationId: ProofContinuationId;
+    readonly continuationDigest: TokenDigest;
+    readonly nowMillis: number;
+    readonly policy: ProofPolicy;
+  }, prepare: PrepareProofCommit<ProofAttemptDecision, A>) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;
+  /**
+   * Consume a continuation exactly once under matching module/purpose/binding,
+   * current revisions and expiry. Method adapters MUST couple this decision and
+   * protected credential/identifier/session writes in the same actual owner.
+   * The standalone operation chooses burn-on-downstream-failure; its result is
+   * never AuthenticationEvidence and cannot itself grant a session.
+   */
+  readonly complete: <A>(input: ProofCompletionInput, prepare: PrepareProofCommit<ProofCompletionDecision, A>) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;
+  /**
+   * Persist a bounded send-attempt claim before network I/O. Check exact generation,
+   * active/unexpired proof and retry deadline. Concurrent/repeated calls have one
+   * claim winner. Expired claims become ambiguous; never reclaim an in-flight send
+   * as if it were definitely unsent. Only explicit idempotent-vendor retry may
+   * claim after ambiguity, with same deliveryId and within max attempt/lifetime.
+   */
+  readonly claimDelivery: <A>(input: {
+    readonly moduleId: string;
+    readonly proofId: ProofId;
+    readonly version: ProofVersion;
+    readonly deliveryId: ProofDeliveryId;
+    readonly nowMillis: number;
+    readonly policy: ProofPolicy;
+    readonly allowAmbiguousRetry: boolean;
+  }, prepare: PrepareProofCommit<ProofDeliveryClaim, A>) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;
+  /** Conditional on this claim/generation; an old failure cannot cancel a resend. Definite failure invalidates this proof, preserving every budget. */
+  readonly settleDelivery: <A>(input: {
+    readonly moduleId: string;
+    readonly proofId: ProofId;
+    readonly version: ProofVersion;
+    readonly deliveryId: ProofDeliveryId;
+    readonly claimVersion: ProofVersion;
+    readonly outcome: ProofDeliveryOutcome;
+    readonly nowMillis: number;
+  }, prepare: PrepareProofCommit<void, A>) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;
+  readonly cancel: <A>(input: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly binding: ProofBinding;
+    readonly nowMillis: number;
+  }, prepare: PrepareProofCommit<void, A>) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;
+  /** Bounded cleanup retains budgets/fingerprints/tombstones through their own horizons; erase verifiers and delivery material when no longer needed. */
+  readonly cleanup: <A>(input: {
+    readonly moduleId: string;
+    readonly nowMillis: number;
+    readonly limit: number;
+  }, prepare: PrepareProofCommit<ProofCleanupResult, A>) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;
+}>;
+/**
+ * Semantic atomic commands, never generic CRUD. Every mutation owns the real
+ * transaction/batch and prepares its receipt BEFORE physical commit. Nested
+ * commands join the same owner. D1 preallocates final IDs/versions before batch.
+ * Use an authoritative fresh clock at each condition; caller timestamps are hints.
+ */
+declare class ProofPersistence extends ProofPersistence_base {}
+//#endregion
+export { PrepareProofCommit, ProofCompletionInput, ProofDeliveryClaim, ProofDigest, ProofIssueDecision, ProofPersistence, ProofRecord };
+//# sourceMappingURL=ProofPersistence.d.mts.map

package/dist/proofs/ProofPersistence.mjs

@@ -0,0 +1,13 @@
+import { Context } from "effect";
+//#region src/proofs/ProofPersistence.ts
+/**
+* Semantic atomic commands, never generic CRUD. Every mutation owns the real
+* transaction/batch and prepares its receipt BEFORE physical commit. Nested
+* commands join the same owner. D1 preallocates final IDs/versions before batch.
+* Use an authoritative fresh clock at each condition; caller timestamps are hints.
+*/
+var ProofPersistence = class extends Context.Service()("effect-auth/ProofPersistence") {};
+//#endregion
+export { ProofPersistence };
+
+//# sourceMappingURL=ProofPersistence.mjs.map

package/dist/proofs/ProofPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProofPersistence.mjs","names":[],"sources":["../../src/proofs/ProofPersistence.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { CommitJournal, PreparedCommit } from \"../hooks/commit\";\nimport type { TokenDigest } from \"../Schema\";\nimport type { ProofRequestConflict, ProofUnavailable } from \"./errors\";\nimport type {\n  ProofAttemptDecision,\n  ProofBinding,\n  ProofCleanupResult,\n  ProofCompletionDecision,\n  ProofContinuationId,\n  ProofDeliveryId,\n  ProofDeliveryOutcome,\n  ProofId,\n  ProofPurpose,\n  ProofRequestId,\n  ProofRequestReceipt,\n  ProofVersion,\n} from \"./models\";\nimport type { ProofPolicy } from \"./policy\";\n\nexport interface ProofCompletionInput {\n  readonly moduleId: string;\n  readonly purpose: ProofPurpose;\n  readonly continuationId: ProofContinuationId;\n  readonly continuationDigest: TokenDigest;\n  readonly binding: ProofBinding;\n  readonly nowMillis: number;\n}\n\nexport type PrepareProofCommit<Value, A> = (\n  value: Value,\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\nexport interface ProofDigest {\n  readonly keyId: string;\n  readonly digest: TokenDigest;\n}\n\nexport interface ProofRecord {\n  readonly moduleId: string;\n  readonly purpose: ProofPurpose;\n  readonly proofId: ProofId;\n  readonly requestId: ProofRequestId;\n  readonly fingerprint: TokenDigest;\n  readonly deliveryId: ProofDeliveryId;\n  readonly binding: ProofBinding;\n  readonly verifier: ProofDigest;\n  readonly issuedAtMillis: number;\n  readonly expiresAtMillis: number;\n  readonly version: ProofVersion;\n}\n\nexport type ProofIssueDecision =\n  | { readonly _tag: \"Issued\"; readonly record: ProofRecord }\n  | { readonly _tag: \"Existing\" | \"Suppressed\"; readonly receipt: ProofRequestReceipt };\n\nexport type ProofDeliveryClaim =\n  | { readonly _tag: \"Claimed\"; readonly claimVersion: ProofVersion }\n  | { readonly _tag: \"Declined\" };\n\n/**\n * Semantic atomic commands, never generic CRUD. Every mutation owns the real\n * transaction/batch and prepares its receipt BEFORE physical commit. Nested\n * commands join the same owner. D1 preallocates final IDs/versions before batch.\n * Use an authoritative fresh clock at each condition; caller timestamps are hints.\n */\nexport class ProofPersistence extends Context.Service<\n  ProofPersistence,\n  {\n    /**\n     * Atomically charge all identifier/subject/action issue windows (independent\n     * of flow/context/request IDs), enforce cooldown, insert a new active series\n     * generation, and supersede its predecessor. Preserve rolling failed-attempt\n     * history and send budgets across resends, consumption, cancellation and expiry.\n     * Matching request fingerprint returns Existing WITHOUT pairing its stored\n     * digest with this attempt's new secret. Mismatched reuse fails Conflict.\n     * eligible=false still charges existence-independent budgets and stores the\n     * request fingerprint, but creates no usable proof/delivery. Never disclose why.\n     * Check any captured security/credential/identifier revision against current authority.\n     */\n    readonly issue: <A>(\n      input: {\n        readonly record: ProofRecord;\n        readonly policy: ProofPolicy;\n        readonly eligible: boolean;\n        readonly supersedes?: ProofId;\n      },\n      prepare: PrepareProofCommit<ProofIssueDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, ProofRequestConflict | ProofUnavailable>;\n    /**\n     * Charge action/identifier/subject attempt windows even for missing, mismatched,\n     * consumed or malformed candidates. Compare only the row's stored keyId.\n     * Enforce active generation, exact purpose/binding, current revisions, expiry,\n     * rolling failure budget and max failures atomically. One winner consumes proof\n     * and creates a digest-only restricted continuation whose expiry is clipped to\n     * min(proof.expiresAt, now+continuationLifetime); every rejection is a committed VALUE.\n     */\n    readonly attempt: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly purpose: ProofPurpose;\n        readonly proofId: ProofId;\n        readonly binding: ProofBinding;\n        readonly candidate?: ProofDigest;\n        readonly continuationId: ProofContinuationId;\n        readonly continuationDigest: TokenDigest;\n        readonly nowMillis: number;\n        readonly policy: ProofPolicy;\n      },\n      prepare: PrepareProofCommit<ProofAttemptDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;\n    /**\n     * Consume a continuation exactly once under matching module/purpose/binding,\n     * current revisions and expiry. Method adapters MUST couple this decision and\n     * protected credential/identifier/session writes in the same actual owner.\n     * The standalone operation chooses burn-on-downstream-failure; its result is\n     * never AuthenticationEvidence and cannot itself grant a session.\n     */\n    readonly complete: <A>(\n      input: ProofCompletionInput,\n      prepare: PrepareProofCommit<ProofCompletionDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;\n    /**\n     * Persist a bounded send-attempt claim before network I/O. Check exact generation,\n     * active/unexpired proof and retry deadline. Concurrent/repeated calls have one\n     * claim winner. Expired claims become ambiguous; never reclaim an in-flight send\n     * as if it were definitely unsent. Only explicit idempotent-vendor retry may\n     * claim after ambiguity, with same deliveryId and within max attempt/lifetime.\n     */\n    readonly claimDelivery: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly proofId: ProofId;\n        readonly version: ProofVersion;\n        readonly deliveryId: ProofDeliveryId;\n        readonly nowMillis: number;\n        readonly policy: ProofPolicy;\n        readonly allowAmbiguousRetry: boolean;\n      },\n      prepare: PrepareProofCommit<ProofDeliveryClaim, A>,\n    ) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;\n    /** Conditional on this claim/generation; an old failure cannot cancel a resend. Definite failure invalidates this proof, preserving every budget. */\n    readonly settleDelivery: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly proofId: ProofId;\n        readonly version: ProofVersion;\n        readonly deliveryId: ProofDeliveryId;\n        readonly claimVersion: ProofVersion;\n        readonly outcome: ProofDeliveryOutcome;\n        readonly nowMillis: number;\n      },\n      prepare: PrepareProofCommit<void, A>,\n    ) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;\n    readonly cancel: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly purpose: ProofPurpose;\n        readonly binding: ProofBinding;\n        readonly nowMillis: number;\n      },\n      prepare: PrepareProofCommit<void, A>,\n    ) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;\n    /** Bounded cleanup retains budgets/fingerprints/tombstones through their own horizons; erase verifiers and delivery material when no longer needed. */\n    readonly cleanup: <A>(\n      input: { readonly moduleId: string; readonly nowMillis: number; readonly limit: number },\n      prepare: PrepareProofCommit<ProofCleanupResult, A>,\n    ) => Effect.Effect<PreparedCommit<A>, ProofUnavailable>;\n  }\n>()(\"effect-auth/ProofPersistence\") {}\n"],"mappings":";;;;;;;;AAoEA,IAAa,mBAAb,cAAsC,QAAQ,QAuG5C,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC"}

package/dist/proofs/SmsProofDelivery.d.mts

@@ -0,0 +1,13 @@
+import { ProofDeliveryOutcome } from "./models.mjs";
+import { ProofConfigurationError } from "./errors.mjs";
+import { ProofDelivery, ProofDeliveryMessage, ProofVendorPolicy } from "./delivery.mjs";
+import { Context, Effect } from "effect";
+//#region src/proofs/SmsProofDelivery.d.ts
+declare const SmsProofDelivery_base: Context.ServiceClass<SmsProofDelivery, "effect-auth/SmsProofDelivery", ProofDelivery>;
+/** The consumer owns number/country eligibility, sender identity and vendor spend policy. */
+declare class SmsProofDelivery extends SmsProofDelivery_base {
+  static readonly layer: <E, R>(vendor: ProofVendorPolicy, send: (message: ProofDeliveryMessage) => Effect.Effect<ProofDeliveryOutcome, E, R>) => import("effect/Layer").Layer<SmsProofDelivery, ProofConfigurationError, Exclude<R, import("effect/Scope").Scope>>;
+}
+//#endregion
+export { SmsProofDelivery };
+//# sourceMappingURL=SmsProofDelivery.d.mts.map

package/dist/proofs/SmsProofDelivery.mjs

@@ -0,0 +1,11 @@
+import { proofDeliveryLayer } from "./delivery.mjs";
+import { Context } from "effect";
+//#region src/proofs/SmsProofDelivery.ts
+/** The consumer owns number/country eligibility, sender identity and vendor spend policy. */
+var SmsProofDelivery = class extends Context.Service()("effect-auth/SmsProofDelivery") {
+	static layer = (vendor, send) => proofDeliveryLayer(this, vendor, send);
+};
+//#endregion
+export { SmsProofDelivery };
+
+//# sourceMappingURL=SmsProofDelivery.mjs.map

package/dist/proofs/SmsProofDelivery.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SmsProofDelivery.mjs","names":[],"sources":["../../src/proofs/SmsProofDelivery.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport {\n  type ProofDelivery,\n  type ProofDeliveryMessage,\n  type ProofVendorPolicy,\n  proofDeliveryLayer,\n} from \"./delivery\";\nimport type { ProofDeliveryOutcome } from \"./models\";\n\n/** The consumer owns number/country eligibility, sender identity and vendor spend policy. */\nexport class SmsProofDelivery extends Context.Service<SmsProofDelivery, ProofDelivery>()(\n  \"effect-auth/SmsProofDelivery\",\n) {\n  static readonly layer = <E, R>(\n    vendor: ProofVendorPolicy,\n    send: (message: ProofDeliveryMessage) => Effect.Effect<ProofDeliveryOutcome, E, R>,\n  ) => proofDeliveryLayer(this, vendor, send);\n}\n"],"mappings":";;;;AAWA,IAAa,mBAAb,cAAsC,QAAQ,QAAyC,CAAC,CACtF,8BACF,CAAC,CAAC;CACA,OAAgB,SACd,QACA,SACG,mBAAmB,MAAM,QAAQ,IAAI;AAC5C"}

package/dist/proofs/abuse.d.mts

@@ -0,0 +1,15 @@
+import { SubjectId } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { ProofBinding, ProofPurpose } from "./models.mjs";
+//#region src/proofs/abuse.d.ts
+/** Structured composite keys. Every dimension is independent of flow, context, request, and proof IDs. */
+interface ProofAbuseScope {
+  readonly moduleId: string;
+  readonly purpose: ProofPurpose;
+  readonly identifier: LoginIdentifier;
+  readonly subjectId?: SubjectId;
+}
+declare const proofAbuseScope: (moduleId: string, purpose: ProofPurpose, binding: ProofBinding) => ProofAbuseScope;
+//#endregion
+export { ProofAbuseScope, proofAbuseScope };
+//# sourceMappingURL=abuse.d.mts.map