@yielded/auth 0.1.0-beta.1

package/dist/totp/module.mjs

@@ -0,0 +1,355 @@
+import { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { operationGroup } from "../operations/operation.mjs";
+import { sessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { AuthenticationEvidence, AuthenticationFlowId, AuthenticationRequirement } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { assessAuthentication } from "../sessions/assurance.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { makeAuthStrategy } from "../auth/AuthStrategy.mjs";
+import { TotpPersistence } from "./TotpPersistence.mjs";
+import { TotpActionRequired, TotpConfigurationError, TotpRejected, TotpUnavailable } from "./errors.mjs";
+import { TotpActionAuthorization, TotpActionChallenge, TotpPolicy } from "./models.mjs";
+import { TotpSecretKeys } from "./TotpSecretKeys.mjs";
+import { base32, decryptSecret, digest, encryptSecret, generateSecret, matchCode, newRecoveryCodes, randomId, recoveryDigest } from "./crypto.mjs";
+import { BeginInput, ConfirmInput, ManageInput, RecoveryInput, StepUpInput, VerifyInput, makeTotpContract } from "../TotpContract.mjs";
+import { TotpActionEvidence } from "./TotpActionEvidence.mjs";
+import { Context, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/totp/module.ts
+const mapFailure = (error) => error._tag === "HookDenied" ? error : error._tag === "SessionUnavailable" ? TotpUnavailable.make({}) : TotpRejected.make({});
+const read = (commit) => commit.read.pipe(Effect.mapError(() => TotpUnavailable.make({})));
+const decode = (schema, value) => Schema.decodeEffect(Schema.toType(schema))(value).pipe(Effect.mapError(() => TotpRejected.make({})));
+const noAmbient = Effect.gen(function* () {
+	if (yield* hasCommitScope) return yield* TotpUnavailable.make({});
+});
+const strong = (age) => AuthenticationRequirement.make({
+	maximumAgeMillis: age,
+	alternatives: [{
+		factors: ["knowledge", "possession"],
+		minimumCredentials: 2,
+		userVerified: false,
+		phishingResistant: false
+	}, {
+		factors: ["possession"],
+		minimumCredentials: 1,
+		userVerified: true,
+		phishingResistant: true
+	}]
+});
+const makeTotpModule = (moduleId, options, sessions) => {
+	const policySource = Effect.try({
+		try: () => Object.freeze(Schema.decodeSync(TotpPolicy)({ ...options })),
+		catch: () => TotpConfigurationError.make({})
+	});
+	const make = Effect.gen(function* () {
+		const policy = yield* policySource, persistence = yield* TotpPersistence, actions = yield* TotpActionEvidence, authority = yield* AuthenticationAuthority, completion = yield* sessions.AuthenticationCompletion, stepUp = yield* sessions.SessionStepUp, strategy = yield* sessions.SessionStrategy, keys = yield* TotpSecretKeys, hooks = yield* LifecycleHooks;
+		if (policy.requireImmediateInvalidation && strategy.capabilities.subjectInvalidation !== "immediate") return yield* TotpConfigurationError.make({});
+		const invalidation = sessionInvalidationWindow("factor-reset", strategy.capabilities, strategy.policy);
+		const snapshot = Effect.fn("Totp.snapshot")(function* (subjectId) {
+			const result = yield* persistence.snapshot({
+				moduleId,
+				subjectId
+			});
+			if (result === void 0) return yield* TotpRejected.make({});
+			return result;
+		});
+		const authenticated = Effect.fn("Totp.authenticated")(function* (invocation) {
+			yield* noAmbient;
+			if (invocation._tag !== "Authenticated") return yield* TotpRejected.make({});
+			return yield* snapshot(invocation.subjectId);
+		});
+		const authorize = Effect.fn("Totp.authorize")(function* (invocation, captured, action, input, detail) {
+			const challenge = TotpActionChallenge.make({
+				moduleId,
+				action,
+				commandId: input.commandId,
+				flowId: AuthenticationFlowId.make(input.commandId),
+				revision: captured.revision,
+				bindingDigest: digest(`${moduleId.length}:${moduleId}/${action}/${input.commandId}/${captured.record?.version ?? "none"}/${detail}`)
+			});
+			const evidence = yield* actions.verify({
+				invocation,
+				challenge,
+				...input.actionProof === void 0 ? {} : { proof: input.actionProof }
+			});
+			if (evidence.flowId !== challenge.flowId || evidence.bindingDigest !== challenge.bindingDigest || evidence.revision.subjectId !== captured.revision.subjectId || evidence.revision.securityRevision !== captured.revision.securityRevision) return yield* TotpActionRequired.make({});
+			const requirement = yield* authority.requirements(evidence).pipe(Effect.mapError(() => TotpActionRequired.make({})));
+			const central = yield* assessAuthentication(evidence, {
+				...requirement,
+				maximumAgeMillis: Math.min(requirement.maximumAgeMillis, policy.maximumEvidenceAgeMillis)
+			}).pipe(Effect.mapError(() => TotpActionRequired.make({})));
+			const freshStrong = (captured.record === null || captured.record.secret === null) && (action === "enroll" || action === "confirm") ? central : yield* assessAuthentication(evidence, strong(policy.maximumEvidenceAgeMillis)).pipe(Effect.mapError(() => TotpActionRequired.make({})));
+			if (!central.satisfied || !freshStrong.satisfied) return yield* TotpActionRequired.make({});
+			return TotpActionAuthorization.make({
+				challenge,
+				evidence,
+				requirement
+			});
+		});
+		const commit = Effect.fn("Totp.commit")(function* (captured, commandId, action, authorization) {
+			const event = lifecycleEvent({
+				id: LifecycleEventId.make(`totp/${moduleId}/${commandId}`),
+				occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+				snapshot: lifecycleSnapshot({
+					action: "credential-change",
+					operation: `${moduleId}/totp/${action._tag.toLowerCase()}`,
+					subjectId: captured.revision.subjectId,
+					method: action._tag === "Recovery" ? "recovery-code" : "totp",
+					identifiers: []
+				})
+			});
+			if (action._tag !== "Verify" && (action._tag !== "Recovery" || action.reset)) yield* hooks.before(event.snapshot);
+			const receipt = yield* persistence.mutate({
+				snapshot: captured,
+				moduleId,
+				subjectId: captured.revision.subjectId,
+				commandId,
+				policy,
+				action,
+				...authorization === void 0 ? {} : { authorization }
+			}, (decision, journal) => {
+				if (decision._tag === "Accepted" && action._tag !== "Verify") journal.stage(event);
+				return journal.prepare(decision);
+			});
+			const decision = yield* read(receipt);
+			if (decision._tag === "Rejected") return yield* TotpRejected.make({});
+			return decision.record;
+		});
+		const matched = Effect.fn("Totp.matched")(function* (captured, code, pending = false) {
+			const record = captured.record, envelope = pending ? record?.pending?.secret : record?.secret;
+			if (record === null || envelope === null || envelope === void 0) return yield* TotpRejected.make({});
+			const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);
+			return yield* Effect.acquireUseRelease(decryptSecret({
+				moduleId,
+				subjectId: record.subjectId,
+				credentialId: record.credentialId,
+				revision: pending ? record.pending.revision : record.revision
+			}, envelope).pipe(Effect.provideService(TotpSecretKeys, keys)), (secret) => Effect.sync(() => matchCode(secret, code, nowMillis, policy.clockSkewSteps)), (secret) => Effect.sync(() => secret.fill(0)));
+		});
+		const evidenceFor = Effect.fn("Totp.evidence")(function* (captured, target, method) {
+			const record = captured.record;
+			if (record === null || record.secret === null || captured.revision.securityRevision !== target.revision.securityRevision || captured.revision.subjectId !== target.revision.subjectId) return yield* TotpRejected.make({});
+			const revision = yield* authority.capture(record.subjectId, [record.credentialId]).pipe(Effect.mapError(mapFailure));
+			if (revision.securityRevision !== target.revision.securityRevision || !revision.credentials.some((item) => item.credentialId === record.credentialId && item.revision === record.revision)) return yield* TotpRejected.make({});
+			return AuthenticationEvidence.make({
+				revision,
+				flowId: target.flowId,
+				bindingDigest: target.bindingDigest,
+				proofs: [{
+					method,
+					credentialId: record.credentialId,
+					factors: ["possession"],
+					userVerified: false,
+					phishingResistant: false,
+					verifiedAt: yield* DateTime.now
+				}]
+			});
+		});
+		const revealRecovery = (codes, commandId, now) => ({
+			kind: "recovery-codes",
+			revealId: commandId,
+			expiresAtMillis: now + policy.revealLifetimeMillis,
+			payload: Redacted.make(codes)
+		});
+		return {
+			beginEnrollment: Effect.fn("Totp.beginEnrollment")(function* (invocation, original) {
+				const input = yield* decode(BeginInput, original), captured = yield* authenticated(invocation), authorization = yield* authorize(invocation, captured, "enroll", input, input.accountName);
+				const now = DateTime.toEpochMillis(yield* DateTime.now);
+				const secret = generateSecret(), manualKey = base32(secret), enrollmentId = randomId(), revision = randomId(), credentialId = captured.record?.credentialId ?? randomId();
+				const envelope = yield* encryptSecret({
+					moduleId,
+					subjectId: captured.revision.subjectId,
+					credentialId,
+					revision
+				}, secret).pipe(Effect.provideService(TotpSecretKeys, keys), Effect.ensuring(Effect.sync(() => secret.fill(0))));
+				const expiresAtMillis = now + policy.enrollmentLifetimeMillis;
+				yield* commit(captured, input.commandId, {
+					_tag: "Enroll",
+					record: {
+						...captured.record ?? {
+							moduleId,
+							subjectId: captured.revision.subjectId,
+							credentialId,
+							revision,
+							version: randomId(),
+							secret: null,
+							recoveryDigests: [],
+							acceptedStep: -1,
+							attemptWindow: now,
+							failedAttempts: 0
+						},
+						pending: {
+							revision,
+							enrollmentId,
+							secret: envelope,
+							expiresAtMillis,
+							failedAttempts: 0
+						}
+					}
+				}, authorization);
+				return {
+					value: {
+						enrollmentId,
+						expiresAtMillis
+					},
+					credentialCommands: [],
+					revealCommands: [{
+						kind: "totp-enrollment",
+						revealId: enrollmentId,
+						expiresAtMillis: Math.min(expiresAtMillis, now + policy.revealLifetimeMillis),
+						payload: Redacted.make({
+							manualKey,
+							uri: `otpauth://totp/${encodeURIComponent(policy.issuer)}:${encodeURIComponent(input.accountName)}?secret=${manualKey}&issuer=${encodeURIComponent(policy.issuer)}&algorithm=SHA1&digits=6&period=30`
+						})
+					}]
+				};
+			}),
+			confirmEnrollment: Effect.fn("Totp.confirmEnrollment")(function* (invocation, original) {
+				const input = yield* decode(ConfirmInput, original), captured = yield* authenticated(invocation), authorization = yield* authorize(invocation, captured, "confirm", input, input.enrollmentId), codes = newRecoveryCodes(moduleId, captured.revision.subjectId), now = DateTime.toEpochMillis(yield* DateTime.now);
+				yield* commit(captured, input.commandId, {
+					_tag: "Confirm",
+					enrollmentId: input.enrollmentId,
+					matchedStep: yield* matched(captured, Redacted.value(input.code), true),
+					recoveryDigests: codes.digests
+				}, authorization);
+				return {
+					value: {
+						enabled: true,
+						invalidation
+					},
+					credentialCommands: [],
+					revealCommands: [revealRecovery(codes.codes, input.commandId, now)]
+				};
+			}),
+			disable: Effect.fn("Totp.disable")(function* (invocation, original) {
+				const input = yield* decode(ManageInput, original), captured = yield* authenticated(invocation), authorization = yield* authorize(invocation, captured, "disable", input, "");
+				yield* commit(captured, input.commandId, { _tag: "Disable" }, authorization);
+				return {
+					enabled: false,
+					invalidation
+				};
+			}),
+			regenerateRecoveryCodes: Effect.fn("Totp.regenerateRecoveryCodes")(function* (invocation, original) {
+				const input = yield* decode(ManageInput, original), captured = yield* authenticated(invocation), authorization = yield* authorize(invocation, captured, "regenerate", input, ""), codes = newRecoveryCodes(moduleId, captured.revision.subjectId), now = DateTime.toEpochMillis(yield* DateTime.now);
+				yield* commit(captured, input.commandId, {
+					_tag: "Regenerate",
+					recoveryDigests: codes.digests
+				}, authorization);
+				return {
+					value: {
+						enabled: true,
+						invalidation
+					},
+					credentialCommands: [],
+					revealCommands: [revealRecovery(codes.codes, input.commandId, now)]
+				};
+			}),
+			verifyPending: Effect.fn("Totp.verifyPending")(function* (invocation, original) {
+				yield* noAmbient;
+				const input = yield* decode(VerifyInput, original);
+				if (invocation._tag !== "Guest") return yield* TotpRejected.make({});
+				const target = yield* completion.pendingContext(input.pendingCredential).pipe(Effect.mapError(mapFailure)), captured = yield* snapshot(target.revision.subjectId), evidence = yield* evidenceFor(captured, target, "totp");
+				yield* commit(captured, randomId(), {
+					_tag: "Verify",
+					matchedStep: yield* matched(captured, Redacted.value(input.code))
+				}).pipe(Effect.catchTag("TotpRejected", () => completion.rejectPendingCredential(input.pendingCredential).pipe(Effect.mapError(mapFailure), Effect.flatMap(read), Effect.andThen(TotpRejected.make({})))));
+				return yield* completion.preparePending({
+					credential: input.pendingCredential,
+					additional: evidence
+				}).pipe(Effect.mapError(mapFailure), Effect.flatMap(read));
+			}),
+			verifyStepUp: Effect.fn("Totp.verifyStepUp")(function* (invocation, original) {
+				yield* noAmbient;
+				const input = yield* decode(StepUpInput, original);
+				if (invocation._tag !== "Authenticated") return yield* TotpRejected.make({});
+				const target = yield* stepUp.context(input.stepUpCredential).pipe(Effect.mapError(mapFailure));
+				if (target.revision.subjectId !== invocation.subjectId) return yield* TotpRejected.make({});
+				const captured = yield* snapshot(invocation.subjectId), evidence = yield* evidenceFor(captured, target, "totp");
+				yield* commit(captured, randomId(), {
+					_tag: "Verify",
+					matchedStep: yield* matched(captured, Redacted.value(input.code))
+				}).pipe(Effect.catchTag("TotpRejected", () => stepUp.rejectCredential(input.stepUpCredential).pipe(Effect.mapError(mapFailure), Effect.flatMap(read), Effect.andThen(TotpRejected.make({})))));
+				return yield* stepUp.prepareComplete({
+					sourceCredential: input.sourceCredential,
+					stepUpCredential: input.stepUpCredential,
+					additional: evidence
+				}).pipe(Effect.mapError(mapFailure), Effect.flatMap(read));
+			}),
+			recoverPending: Effect.fn("Totp.recoverPending")(function* (invocation, original) {
+				yield* noAmbient;
+				const input = yield* decode(RecoveryInput, original);
+				if (invocation._tag !== "Guest" || !policy.allowRecoveryCodeForPending) return yield* TotpRejected.make({});
+				const target = yield* completion.pendingContext(input.pendingCredential).pipe(Effect.mapError(mapFailure)), captured = yield* snapshot(target.revision.subjectId), evidence = yield* evidenceFor(captured, target, "recovery-code");
+				yield* commit(captured, randomId(), {
+					_tag: "Recovery",
+					digest: recoveryDigest(moduleId, target.revision.subjectId, Redacted.value(input.code)),
+					reset: false
+				}).pipe(Effect.catchTag("TotpRejected", () => completion.rejectPendingCredential(input.pendingCredential).pipe(Effect.mapError(mapFailure), Effect.flatMap(read), Effect.andThen(TotpRejected.make({})))));
+				return yield* completion.preparePending({
+					credential: input.pendingCredential,
+					additional: evidence
+				}).pipe(Effect.mapError(mapFailure), Effect.flatMap(read));
+			}),
+			recoverLostFactor: Effect.fn("Totp.recoverLostFactor")(function* (invocation, original) {
+				yield* noAmbient;
+				const input = yield* decode(RecoveryInput, original);
+				if (invocation._tag !== "Guest" || policy.lostFactorRecovery !== "reset-with-recovery-code") return yield* TotpRejected.make({});
+				const target = yield* completion.pendingContext(input.pendingCredential).pipe(Effect.mapError(mapFailure)), captured = yield* snapshot(target.revision.subjectId);
+				yield* evidenceFor(captured, target, "recovery-code");
+				yield* commit(captured, randomId(), {
+					_tag: "Recovery",
+					digest: recoveryDigest(moduleId, target.revision.subjectId, Redacted.value(input.code)),
+					reset: true,
+					pending: target
+				});
+				return {
+					value: {
+						outcome: "reauthentication-required",
+						invalidation
+					},
+					credentialCommands: [{
+						_tag: "Clear",
+						slot: "pending-proof"
+					}, {
+						_tag: "Clear",
+						slot: "session"
+					}]
+				};
+			})
+		};
+	});
+	const Totp = Context.Service(`effect-auth/Totp/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(Totp, make);
+	const { Begin, Confirm, Disable, Regenerate, VerifyPending, VerifyStepUp, RecoverPending, RecoverLostFactor } = makeTotpContract(moduleId, sessions).operations;
+	const handlersLayer = Layer.mergeAll(Begin.credentialHandlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.beginEnrollment(invocation, input))), Confirm.credentialHandlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.confirmEnrollment(invocation, input))), Disable.handlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.disable(invocation, input))), Regenerate.credentialHandlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.regenerateRecoveryCodes(invocation, input))), VerifyPending.credentialHandlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.verifyPending(invocation, input))), VerifyStepUp.credentialHandlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.verifyStepUp(invocation, input))), RecoverPending.credentialHandlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.recoverPending(invocation, input))), RecoverLostFactor.credentialHandlerLayer((input, invocation) => Effect.flatMap(Totp, (service) => service.recoverLostFactor(invocation, input))));
+	return Object.freeze({
+		Totp,
+		layer,
+		handlersLayer,
+		operations: {
+			Begin,
+			Confirm,
+			Disable,
+			Regenerate,
+			VerifyPending,
+			VerifyStepUp,
+			RecoverPending,
+			RecoverLostFactor
+		},
+		group: operationGroup(Begin, Confirm, Disable, Regenerate, VerifyPending, VerifyStepUp, RecoverPending, RecoverLostFactor),
+		strategy: makeAuthStrategy({
+			beginEnrollment: Begin.invoke,
+			confirmEnrollment: Confirm.invoke,
+			disable: Disable.invoke,
+			regenerateRecoveryCodes: Regenerate.invoke,
+			verifyPending: VerifyPending.invoke,
+			verifyStepUp: VerifyStepUp.invoke,
+			recoverPending: RecoverPending.invoke,
+			recoverLostFactor: RecoverLostFactor.invoke
+		}, handlersLayer.pipe(Layer.provide(layer)), { completion: true })
+	});
+};
+//#endregion
+export { makeTotpModule };
+
+//# sourceMappingURL=module.mjs.map

package/dist/totp/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":[],"sources":["../../src/totp/module.ts"],"sourcesContent":["import { Context, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { operationGroup } from \"../operations/operation\";\nimport type { AuthRevealCommand } from \"../operations/reveals\";\nimport { assessAuthentication } from \"../sessions/assurance\";\nimport { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport { sessionInvalidationWindow } from \"../sessions/invalidation\";\nimport {\n  AuthenticationEvidence,\n  AuthenticationFlowId,\n  AuthenticationRequirement,\n} from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport {\n  makeTotpContract,\n  BeginInput,\n  ConfirmInput,\n  ManageInput,\n  VerifyInput,\n  RecoveryInput,\n  StepUpInput,\n} from \"../TotpContract\";\nimport {\n  base32,\n  decryptSecret,\n  digest,\n  encryptSecret,\n  generateSecret,\n  matchCode,\n  newRecoveryCodes,\n  randomId,\n  recoveryDigest,\n} from \"./crypto\";\nimport type { TotpFailure } from \"./errors\";\nimport {\n  TotpActionRequired,\n  TotpConfigurationError,\n  TotpRejected,\n  TotpUnavailable,\n} from \"./errors\";\nimport {\n  type TotpEnrollmentStarted,\n  type TotpManagementResult,\n  type TotpRecoveryReset,\n  TotpActionAuthorization,\n  TotpActionChallenge,\n  TotpPolicy,\n  type TotpSnapshot,\n} from \"./models\";\nimport { TotpActionEvidence } from \"./TotpActionEvidence\";\nimport { TotpPersistence } from \"./TotpPersistence\";\nimport { TotpSecretKeys } from \"./TotpSecretKeys\";\n\nconst mapFailure = (error: { _tag: string }) =>\n  error._tag === \"HookDenied\"\n    ? (error as Extract<TotpFailure, { _tag: \"HookDenied\" }>)\n    : error._tag === \"SessionUnavailable\"\n      ? TotpUnavailable.make({})\n      : TotpRejected.make({});\n\nconst read = <A>(commit: PreparedCommit<A>) =>\n  commit.read.pipe(Effect.mapError(() => TotpUnavailable.make({})));\n\nconst decode = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) =>\n  Schema.decodeEffect(Schema.toType(schema))(value).pipe(\n    Effect.mapError(() => TotpRejected.make({})),\n  );\n\nconst noAmbient = Effect.gen(function* () {\n  if (yield* hasCommitScope) return yield* TotpUnavailable.make({});\n});\n\nconst strong = (age: number) =>\n  AuthenticationRequirement.make({\n    maximumAgeMillis: age,\n    alternatives: [\n      {\n        factors: [\"knowledge\", \"possession\"],\n        minimumCredentials: 2,\n        userVerified: false,\n        phishingResistant: false,\n      },\n      {\n        factors: [\"possession\"],\n        minimumCredentials: 1,\n        userVerified: true,\n        phishingResistant: true,\n      },\n    ],\n  });\n\nexport const makeTotpModule = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: TotpPolicy,\n  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,\n) => {\n  const policySource = Effect.try({\n    try: () => Object.freeze(Schema.decodeSync(TotpPolicy)({ ...options })),\n    catch: () => TotpConfigurationError.make({}),\n  });\n\n  const make = Effect.gen(function* () {\n    const policy = yield* policySource,\n      persistence = yield* TotpPersistence,\n      actions = yield* TotpActionEvidence,\n      authority = yield* AuthenticationAuthority,\n      completion = yield* sessions.AuthenticationCompletion,\n      stepUp = yield* sessions.SessionStepUp,\n      strategy = yield* sessions.SessionStrategy,\n      keys = yield* TotpSecretKeys,\n      hooks = yield* LifecycleHooks;\n\n    if (\n      policy.requireImmediateInvalidation &&\n      strategy.capabilities.subjectInvalidation !== \"immediate\"\n    )\n      return yield* TotpConfigurationError.make({});\n\n    const invalidation = sessionInvalidationWindow(\n      \"factor-reset\",\n      strategy.capabilities,\n      strategy.policy,\n    );\n\n    const snapshot = Effect.fn(\"Totp.snapshot\")(function* (\n      subjectId: TotpSnapshot[\"revision\"][\"subjectId\"],\n    ) {\n      const result = yield* persistence.snapshot({ moduleId, subjectId });\n\n      if (result === undefined) return yield* TotpRejected.make({});\n\n      return result;\n    });\n\n    const authenticated = Effect.fn(\"Totp.authenticated\")(function* (invocation: AuthInvocation) {\n      yield* noAmbient;\n      if (invocation._tag !== \"Authenticated\") return yield* TotpRejected.make({});\n\n      return yield* snapshot(invocation.subjectId);\n    });\n\n    const authorize = Effect.fn(\"Totp.authorize\")(function* (\n      invocation: AuthInvocation,\n      captured: TotpSnapshot,\n      action: typeof TotpActionChallenge.Type.action,\n      input: typeof ManageInput.Type,\n      detail: string,\n    ) {\n      const challenge = TotpActionChallenge.make({\n        moduleId,\n        action,\n        commandId: input.commandId,\n        flowId: AuthenticationFlowId.make(input.commandId),\n        revision: captured.revision,\n        bindingDigest: digest(\n          `${moduleId.length}:${moduleId}/${action}/${input.commandId}/${captured.record?.version ?? \"none\"}/${detail}`,\n        ),\n      });\n\n      const evidence = yield* actions.verify({\n        invocation,\n        challenge,\n        ...(input.actionProof === undefined ? {} : { proof: input.actionProof }),\n      });\n\n      if (\n        evidence.flowId !== challenge.flowId ||\n        evidence.bindingDigest !== challenge.bindingDigest ||\n        evidence.revision.subjectId !== captured.revision.subjectId ||\n        evidence.revision.securityRevision !== captured.revision.securityRevision\n      )\n        return yield* TotpActionRequired.make({});\n\n      const requirement = yield* authority\n        .requirements(evidence)\n        .pipe(Effect.mapError(() => TotpActionRequired.make({})));\n\n      const central = yield* assessAuthentication(evidence, {\n        ...requirement,\n        maximumAgeMillis: Math.min(requirement.maximumAgeMillis, policy.maximumEvidenceAgeMillis),\n      }).pipe(Effect.mapError(() => TotpActionRequired.make({})));\n\n      const freshStrong =\n        (captured.record === null || captured.record.secret === null) &&\n        (action === \"enroll\" || action === \"confirm\")\n          ? central\n          : yield* assessAuthentication(evidence, strong(policy.maximumEvidenceAgeMillis)).pipe(\n              Effect.mapError(() => TotpActionRequired.make({})),\n            );\n\n      if (!central.satisfied || !freshStrong.satisfied) return yield* TotpActionRequired.make({});\n\n      return TotpActionAuthorization.make({ challenge, evidence, requirement });\n    });\n\n    const commit = Effect.fn(\"Totp.commit\")(function* (\n      captured: TotpSnapshot,\n      commandId: string,\n      action: Parameters<TotpPersistence[\"Service\"][\"mutate\"]>[0][\"action\"],\n      authorization?: typeof TotpActionAuthorization.Type,\n    ) {\n      const event = lifecycleEvent({\n        id: LifecycleEventId.make(`totp/${moduleId}/${commandId}`),\n        occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n        snapshot: lifecycleSnapshot({\n          action: \"credential-change\",\n          operation: `${moduleId}/totp/${action._tag.toLowerCase()}`,\n          subjectId: captured.revision.subjectId,\n          method: action._tag === \"Recovery\" ? \"recovery-code\" : \"totp\",\n          identifiers: [],\n        }),\n      });\n\n      if (action._tag !== \"Verify\" && (action._tag !== \"Recovery\" || action.reset))\n        yield* hooks.before(event.snapshot);\n\n      const receipt = yield* persistence.mutate(\n        {\n          snapshot: captured,\n          moduleId,\n          subjectId: captured.revision.subjectId,\n          commandId,\n          policy,\n          action,\n          ...(authorization === undefined ? {} : { authorization }),\n        },\n        (decision, journal) => {\n          if (decision._tag === \"Accepted\" && action._tag !== \"Verify\") journal.stage(event);\n\n          return journal.prepare(decision);\n        },\n      );\n\n      const decision = yield* read(receipt);\n\n      if (decision._tag === \"Rejected\") return yield* TotpRejected.make({});\n\n      return decision.record;\n    });\n\n    const matched = Effect.fn(\"Totp.matched\")(function* (\n      captured: TotpSnapshot,\n      code: string,\n      pending = false,\n    ) {\n      const record = captured.record,\n        envelope = pending ? record?.pending?.secret : record?.secret;\n\n      if (record === null || envelope === null || envelope === undefined)\n        return yield* TotpRejected.make({});\n      const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);\n\n      return yield* Effect.acquireUseRelease(\n        decryptSecret(\n          {\n            moduleId,\n            subjectId: record.subjectId,\n            credentialId: record.credentialId,\n            revision: pending ? record.pending!.revision : record.revision,\n          },\n          envelope,\n        ).pipe(Effect.provideService(TotpSecretKeys, keys)),\n        (secret) => Effect.sync(() => matchCode(secret, code, nowMillis, policy.clockSkewSteps)),\n        (secret) => Effect.sync(() => secret.fill(0)),\n      );\n    });\n\n    const evidenceFor = Effect.fn(\"Totp.evidence\")(function* (\n      captured: TotpSnapshot,\n      target: {\n        readonly revision: TotpSnapshot[\"revision\"];\n        readonly flowId: AuthenticationFlowId;\n        readonly bindingDigest: typeof TotpActionChallenge.Type.bindingDigest;\n      },\n      method: \"totp\" | \"recovery-code\",\n    ) {\n      const record = captured.record;\n\n      if (\n        record === null ||\n        record.secret === null ||\n        captured.revision.securityRevision !== target.revision.securityRevision ||\n        captured.revision.subjectId !== target.revision.subjectId\n      )\n        return yield* TotpRejected.make({});\n\n      const revision = yield* authority\n        .capture(record.subjectId, [record.credentialId])\n        .pipe(Effect.mapError(mapFailure));\n\n      if (\n        revision.securityRevision !== target.revision.securityRevision ||\n        !revision.credentials.some(\n          (item) => item.credentialId === record.credentialId && item.revision === record.revision,\n        )\n      )\n        return yield* TotpRejected.make({});\n\n      return AuthenticationEvidence.make({\n        revision,\n        flowId: target.flowId,\n        bindingDigest: target.bindingDigest,\n        proofs: [\n          {\n            method,\n            credentialId: record.credentialId,\n            factors: [\"possession\"],\n            userVerified: false,\n            phishingResistant: false,\n            verifiedAt: yield* DateTime.now,\n          },\n        ],\n      });\n    });\n\n    const revealRecovery = (\n      codes: readonly string[],\n      commandId: string,\n      now: number,\n    ): AuthRevealCommand => ({\n      kind: \"recovery-codes\",\n      revealId: commandId,\n      expiresAtMillis: now + policy.revealLifetimeMillis,\n      payload: Redacted.make(codes),\n    });\n\n    return {\n      beginEnrollment: Effect.fn(\"Totp.beginEnrollment\")(function* (\n        invocation: AuthInvocation,\n        original: typeof BeginInput.Type,\n      ): Effect.fn.Return<AuthOperationResult<typeof TotpEnrollmentStarted.Type>, TotpFailure> {\n        const input = yield* decode(BeginInput, original),\n          captured = yield* authenticated(invocation),\n          authorization = yield* authorize(\n            invocation,\n            captured,\n            \"enroll\",\n            input,\n            input.accountName,\n          );\n\n        const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n        const secret = generateSecret(),\n          manualKey = base32(secret),\n          enrollmentId = randomId(),\n          revision = randomId(),\n          credentialId = captured.record?.credentialId ?? randomId();\n\n        const envelope = yield* encryptSecret(\n          { moduleId, subjectId: captured.revision.subjectId, credentialId, revision },\n          secret,\n        ).pipe(\n          Effect.provideService(TotpSecretKeys, keys),\n          Effect.ensuring(Effect.sync(() => secret.fill(0))),\n        );\n\n        const expiresAtMillis = now + policy.enrollmentLifetimeMillis;\n\n        yield* commit(\n          captured,\n          input.commandId,\n          {\n            _tag: \"Enroll\",\n            record: {\n              ...(captured.record ?? {\n                moduleId,\n                subjectId: captured.revision.subjectId,\n                credentialId,\n                revision,\n                version: randomId(),\n                secret: null,\n                recoveryDigests: [],\n                acceptedStep: -1,\n                attemptWindow: now,\n                failedAttempts: 0,\n              }),\n              pending: {\n                revision,\n                enrollmentId,\n                secret: envelope,\n                expiresAtMillis,\n                failedAttempts: 0,\n              },\n            },\n          },\n          authorization,\n        );\n\n        return {\n          value: { enrollmentId, expiresAtMillis },\n          credentialCommands: [],\n          revealCommands: [\n            {\n              kind: \"totp-enrollment\",\n              revealId: enrollmentId,\n              expiresAtMillis: Math.min(expiresAtMillis, now + policy.revealLifetimeMillis),\n              payload: Redacted.make({\n                manualKey,\n                uri: `otpauth://totp/${encodeURIComponent(policy.issuer)}:${encodeURIComponent(input.accountName)}?secret=${manualKey}&issuer=${encodeURIComponent(policy.issuer)}&algorithm=SHA1&digits=6&period=30`,\n              }),\n            },\n          ],\n        };\n      }),\n      confirmEnrollment: Effect.fn(\"Totp.confirmEnrollment\")(function* (\n        invocation: AuthInvocation,\n        original: typeof ConfirmInput.Type,\n      ): Effect.fn.Return<AuthOperationResult<typeof TotpManagementResult.Type>, TotpFailure> {\n        const input = yield* decode(ConfirmInput, original),\n          captured = yield* authenticated(invocation),\n          authorization = yield* authorize(\n            invocation,\n            captured,\n            \"confirm\",\n            input,\n            input.enrollmentId,\n          ),\n          codes = newRecoveryCodes(moduleId, captured.revision.subjectId),\n          now = DateTime.toEpochMillis(yield* DateTime.now);\n\n        yield* commit(\n          captured,\n          input.commandId,\n          {\n            _tag: \"Confirm\",\n            enrollmentId: input.enrollmentId,\n            matchedStep: yield* matched(captured, Redacted.value(input.code), true),\n            recoveryDigests: codes.digests,\n          },\n          authorization,\n        );\n\n        return {\n          value: { enabled: true, invalidation },\n          credentialCommands: [],\n          revealCommands: [revealRecovery(codes.codes, input.commandId, now)],\n        };\n      }),\n      disable: Effect.fn(\"Totp.disable\")(function* (\n        invocation: AuthInvocation,\n        original: typeof ManageInput.Type,\n      ) {\n        const input = yield* decode(ManageInput, original),\n          captured = yield* authenticated(invocation),\n          authorization = yield* authorize(invocation, captured, \"disable\", input, \"\");\n\n        yield* commit(captured, input.commandId, { _tag: \"Disable\" }, authorization);\n\n        return { enabled: false, invalidation };\n      }),\n      regenerateRecoveryCodes: Effect.fn(\"Totp.regenerateRecoveryCodes\")(function* (\n        invocation: AuthInvocation,\n        original: typeof ManageInput.Type,\n      ): Effect.fn.Return<AuthOperationResult<typeof TotpManagementResult.Type>, TotpFailure> {\n        const input = yield* decode(ManageInput, original),\n          captured = yield* authenticated(invocation),\n          authorization = yield* authorize(invocation, captured, \"regenerate\", input, \"\"),\n          codes = newRecoveryCodes(moduleId, captured.revision.subjectId),\n          now = DateTime.toEpochMillis(yield* DateTime.now);\n\n        yield* commit(\n          captured,\n          input.commandId,\n          { _tag: \"Regenerate\", recoveryDigests: codes.digests },\n          authorization,\n        );\n\n        return {\n          value: { enabled: true, invalidation },\n          credentialCommands: [],\n          revealCommands: [revealRecovery(codes.codes, input.commandId, now)],\n        };\n      }),\n      verifyPending: Effect.fn(\"Totp.verifyPending\")(function* (\n        invocation: AuthInvocation,\n        original: typeof VerifyInput.Type,\n      ) {\n        yield* noAmbient;\n        const input = yield* decode(VerifyInput, original);\n\n        if (invocation._tag !== \"Guest\") return yield* TotpRejected.make({});\n\n        const target = yield* completion\n            .pendingContext(input.pendingCredential)\n            .pipe(Effect.mapError(mapFailure)),\n          captured = yield* snapshot(target.revision.subjectId),\n          evidence = yield* evidenceFor(captured, target, \"totp\");\n\n        yield* commit(captured, randomId(), {\n          _tag: \"Verify\",\n          matchedStep: yield* matched(captured, Redacted.value(input.code)),\n        }).pipe(\n          Effect.catchTag(\"TotpRejected\", () =>\n            completion\n              .rejectPendingCredential(input.pendingCredential)\n              .pipe(\n                Effect.mapError(mapFailure),\n                Effect.flatMap(read),\n                Effect.andThen(TotpRejected.make({})),\n              ),\n          ),\n        );\n\n        return yield* completion\n          .preparePending({ credential: input.pendingCredential, additional: evidence })\n          .pipe(Effect.mapError(mapFailure), Effect.flatMap(read));\n      }),\n      verifyStepUp: Effect.fn(\"Totp.verifyStepUp\")(function* (\n        invocation: AuthInvocation,\n        original: typeof StepUpInput.Type,\n      ) {\n        yield* noAmbient;\n        const input = yield* decode(StepUpInput, original);\n\n        if (invocation._tag !== \"Authenticated\") return yield* TotpRejected.make({});\n\n        const target = yield* stepUp\n          .context(input.stepUpCredential)\n          .pipe(Effect.mapError(mapFailure));\n\n        if (target.revision.subjectId !== invocation.subjectId) return yield* TotpRejected.make({});\n\n        const captured = yield* snapshot(invocation.subjectId),\n          evidence = yield* evidenceFor(captured, target, \"totp\");\n\n        yield* commit(captured, randomId(), {\n          _tag: \"Verify\",\n          matchedStep: yield* matched(captured, Redacted.value(input.code)),\n        }).pipe(\n          Effect.catchTag(\"TotpRejected\", () =>\n            stepUp\n              .rejectCredential(input.stepUpCredential)\n              .pipe(\n                Effect.mapError(mapFailure),\n                Effect.flatMap(read),\n                Effect.andThen(TotpRejected.make({})),\n              ),\n          ),\n        );\n\n        return yield* stepUp\n          .prepareComplete({\n            sourceCredential: input.sourceCredential,\n            stepUpCredential: input.stepUpCredential,\n            additional: evidence,\n          })\n          .pipe(Effect.mapError(mapFailure), Effect.flatMap(read));\n      }),\n      recoverPending: Effect.fn(\"Totp.recoverPending\")(function* (\n        invocation: AuthInvocation,\n        original: typeof RecoveryInput.Type,\n      ) {\n        yield* noAmbient;\n        const input = yield* decode(RecoveryInput, original);\n\n        if (invocation._tag !== \"Guest\" || !policy.allowRecoveryCodeForPending)\n          return yield* TotpRejected.make({});\n\n        const target = yield* completion\n            .pendingContext(input.pendingCredential)\n            .pipe(Effect.mapError(mapFailure)),\n          captured = yield* snapshot(target.revision.subjectId),\n          evidence = yield* evidenceFor(captured, target, \"recovery-code\");\n\n        yield* commit(captured, randomId(), {\n          _tag: \"Recovery\",\n          digest: recoveryDigest(moduleId, target.revision.subjectId, Redacted.value(input.code)),\n          reset: false,\n        }).pipe(\n          Effect.catchTag(\"TotpRejected\", () =>\n            completion\n              .rejectPendingCredential(input.pendingCredential)\n              .pipe(\n                Effect.mapError(mapFailure),\n                Effect.flatMap(read),\n                Effect.andThen(TotpRejected.make({})),\n              ),\n          ),\n        );\n\n        return yield* completion\n          .preparePending({ credential: input.pendingCredential, additional: evidence })\n          .pipe(Effect.mapError(mapFailure), Effect.flatMap(read));\n      }),\n      recoverLostFactor: Effect.fn(\"Totp.recoverLostFactor\")(function* (\n        invocation: AuthInvocation,\n        original: typeof RecoveryInput.Type,\n      ): Effect.fn.Return<AuthOperationResult<typeof TotpRecoveryReset.Type>, TotpFailure> {\n        yield* noAmbient;\n        const input = yield* decode(RecoveryInput, original);\n\n        if (invocation._tag !== \"Guest\" || policy.lostFactorRecovery !== \"reset-with-recovery-code\")\n          return yield* TotpRejected.make({});\n\n        const target = yield* completion\n            .pendingContext(input.pendingCredential)\n            .pipe(Effect.mapError(mapFailure)),\n          captured = yield* snapshot(target.revision.subjectId);\n\n        yield* evidenceFor(captured, target, \"recovery-code\");\n        yield* commit(captured, randomId(), {\n          _tag: \"Recovery\",\n          digest: recoveryDigest(moduleId, target.revision.subjectId, Redacted.value(input.code)),\n          reset: true,\n          pending: target,\n        });\n\n        return {\n          value: { outcome: \"reauthentication-required\", invalidation },\n          credentialCommands: [\n            { _tag: \"Clear\", slot: \"pending-proof\" },\n            { _tag: \"Clear\", slot: \"session\" },\n          ],\n        };\n      }),\n    };\n  });\n\n  const Totp = Context.Service<\n    { readonly moduleId: Id; readonly kind: \"totp\" },\n    Effect.Success<typeof make>\n  >(`effect-auth/Totp/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(Totp, make);\n\n  const {\n    Begin,\n    Confirm,\n    Disable,\n    Regenerate,\n    VerifyPending,\n    VerifyStepUp,\n    RecoverPending,\n    RecoverLostFactor,\n  } = makeTotpContract(moduleId, sessions).operations;\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.beginEnrollment(invocation, input)),\n    ),\n    Confirm.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.confirmEnrollment(invocation, input)),\n    ),\n    Disable.handlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.disable(invocation, input)),\n    ),\n    Regenerate.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.regenerateRecoveryCodes(invocation, input)),\n    ),\n    VerifyPending.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.verifyPending(invocation, input)),\n    ),\n    VerifyStepUp.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.verifyStepUp(invocation, input)),\n    ),\n    RecoverPending.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.recoverPending(invocation, input)),\n    ),\n    RecoverLostFactor.credentialHandlerLayer((input, invocation) =>\n      Effect.flatMap(Totp, (service) => service.recoverLostFactor(invocation, input)),\n    ),\n  );\n\n  return Object.freeze({\n    Totp,\n    layer,\n    handlersLayer,\n    operations: {\n      Begin,\n      Confirm,\n      Disable,\n      Regenerate,\n      VerifyPending,\n      VerifyStepUp,\n      RecoverPending,\n      RecoverLostFactor,\n    },\n    group: operationGroup(\n      Begin,\n      Confirm,\n      Disable,\n      Regenerate,\n      VerifyPending,\n      VerifyStepUp,\n      RecoverPending,\n      RecoverLostFactor,\n    ),\n    strategy: makeAuthStrategy(\n      {\n        beginEnrollment: Begin.invoke,\n        confirmEnrollment: Confirm.invoke,\n        disable: Disable.invoke,\n        regenerateRecoveryCodes: Regenerate.invoke,\n        verifyPending: VerifyPending.invoke,\n        verifyStepUp: VerifyStepUp.invoke,\n        recoverPending: RecoverPending.invoke,\n        recoverLostFactor: RecoverLostFactor.invoke,\n      },\n      handlersLayer.pipe(Layer.provide(layer)),\n      { completion: true },\n    ),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2DA,MAAM,cAAc,UAClB,MAAM,SAAS,eACV,QACD,MAAM,SAAS,uBACb,gBAAgB,KAAK,CAAC,CAAC,IACvB,aAAa,KAAK,CAAC,CAAC;AAE5B,MAAM,QAAW,WACf,OAAO,KAAK,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC;AAElE,MAAM,UACJ,QACA,UAEA,OAAO,aAAa,OAAO,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAChD,OAAO,eAAe,aAAa,KAAK,CAAC,CAAC,CAAC,CAC7C;AAEF,MAAM,YAAY,OAAO,IAAI,aAAa;CACxC,IAAI,OAAO,gBAAgB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,QACd,0BAA0B,KAAK;CAC7B,kBAAkB;CAClB,cAAc,CACZ;EACE,SAAS,CAAC,aAAa,YAAY;EACnC,oBAAoB;EACpB,cAAc;EACd,mBAAmB;CACrB,GACA;EACE,SAAS,CAAC,YAAY;EACtB,oBAAoB;EACpB,cAAc;EACd,mBAAmB;CACrB,CACF;AACF,CAAC;AAEH,MAAa,kBAKX,UACA,SACA,aACG;CACH,MAAM,eAAe,OAAO,IAAI;EAC9B,WAAW,OAAO,OAAO,OAAO,WAAW,UAAU,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;EACtE,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,MAAM,OAAO,OAAO,IAAI,aAAa;EACnC,MAAM,SAAS,OAAO,cACpB,cAAc,OAAO,iBACrB,UAAU,OAAO,oBACjB,YAAY,OAAO,yBACnB,aAAa,OAAO,SAAS,0BAC7B,SAAS,OAAO,SAAS,eACzB,WAAW,OAAO,SAAS,iBAC3B,OAAO,OAAO,gBACd,QAAQ,OAAO;EAEjB,IACE,OAAO,gCACP,SAAS,aAAa,wBAAwB,aAE9C,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;EAE9C,MAAM,eAAe,0BACnB,gBACA,SAAS,cACT,SAAS,MACX;EAEA,MAAM,WAAW,OAAO,GAAG,eAAe,CAAC,CAAC,WAC1C,WACA;GACA,MAAM,SAAS,OAAO,YAAY,SAAS;IAAE;IAAU;GAAU,CAAC;GAElE,IAAI,WAAW,KAAA,GAAW,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GAE5D,OAAO;EACT,CAAC;EAED,MAAM,gBAAgB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,YAA4B;GAC3F,OAAO;GACP,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GAE3E,OAAO,OAAO,SAAS,WAAW,SAAS;EAC7C,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAC5C,YACA,UACA,QACA,OACA,QACA;GACA,MAAM,YAAY,oBAAoB,KAAK;IACzC;IACA;IACA,WAAW,MAAM;IACjB,QAAQ,qBAAqB,KAAK,MAAM,SAAS;IACjD,UAAU,SAAS;IACnB,eAAe,OACb,GAAG,SAAS,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,UAAU,GAAG,SAAS,QAAQ,WAAW,OAAO,GAAG,QACvG;GACF,CAAC;GAED,MAAM,WAAW,OAAO,QAAQ,OAAO;IACrC;IACA;IACA,GAAI,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,YAAY;GACxE,CAAC;GAED,IACE,SAAS,WAAW,UAAU,UAC9B,SAAS,kBAAkB,UAAU,iBACrC,SAAS,SAAS,cAAc,SAAS,SAAS,aAClD,SAAS,SAAS,qBAAqB,SAAS,SAAS,kBAEzD,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;GAE1C,MAAM,cAAc,OAAO,UACxB,aAAa,QAAQ,CAAC,CACtB,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE1D,MAAM,UAAU,OAAO,qBAAqB,UAAU;IACpD,GAAG;IACH,kBAAkB,KAAK,IAAI,YAAY,kBAAkB,OAAO,wBAAwB;GAC1F,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE1D,MAAM,eACH,SAAS,WAAW,QAAQ,SAAS,OAAO,WAAW,UACvD,WAAW,YAAY,WAAW,aAC/B,UACA,OAAO,qBAAqB,UAAU,OAAO,OAAO,wBAAwB,CAAC,CAAC,CAAC,KAC7E,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;GAEN,IAAI,CAAC,QAAQ,aAAa,CAAC,YAAY,WAAW,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;GAE1F,OAAO,wBAAwB,KAAK;IAAE;IAAW;IAAU;GAAY,CAAC;EAC1E,CAAC;EAED,MAAM,SAAS,OAAO,GAAG,aAAa,CAAC,CAAC,WACtC,UACA,WACA,QACA,eACA;GACA,MAAM,QAAQ,eAAe;IAC3B,IAAI,iBAAiB,KAAK,QAAQ,SAAS,GAAG,WAAW;IACzD,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;IAC5D,UAAU,kBAAkB;KAC1B,QAAQ;KACR,WAAW,GAAG,SAAS,QAAQ,OAAO,KAAK,YAAY;KACvD,WAAW,SAAS,SAAS;KAC7B,QAAQ,OAAO,SAAS,aAAa,kBAAkB;KACvD,aAAa,CAAC;IAChB,CAAC;GACH,CAAC;GAED,IAAI,OAAO,SAAS,aAAa,OAAO,SAAS,cAAc,OAAO,QACpE,OAAO,MAAM,OAAO,MAAM,QAAQ;GAEpC,MAAM,UAAU,OAAO,YAAY,OACjC;IACE,UAAU;IACV;IACA,WAAW,SAAS,SAAS;IAC7B;IACA;IACA;IACA,GAAI,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc;GACzD,IACC,UAAU,YAAY;IACrB,IAAI,SAAS,SAAS,cAAc,OAAO,SAAS,UAAU,QAAQ,MAAM,KAAK;IAEjF,OAAO,QAAQ,QAAQ,QAAQ;GACjC,CACF;GAEA,MAAM,WAAW,OAAO,KAAK,OAAO;GAEpC,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GAEpE,OAAO,SAAS;EAClB,CAAC;EAED,MAAM,UAAU,OAAO,GAAG,cAAc,CAAC,CAAC,WACxC,UACA,MACA,UAAU,OACV;GACA,MAAM,SAAS,SAAS,QACtB,WAAW,UAAU,QAAQ,SAAS,SAAS,QAAQ;GAEzD,IAAI,WAAW,QAAQ,aAAa,QAAQ,aAAa,KAAA,GACvD,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GACpC,MAAM,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;GAE5D,OAAO,OAAO,OAAO,kBACnB,cACE;IACE;IACA,WAAW,OAAO;IAClB,cAAc,OAAO;IACrB,UAAU,UAAU,OAAO,QAAS,WAAW,OAAO;GACxD,GACA,QACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,IAAI,CAAC,IACjD,WAAW,OAAO,WAAW,UAAU,QAAQ,MAAM,WAAW,OAAO,cAAc,CAAC,IACtF,WAAW,OAAO,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9C;EACF,CAAC;EAED,MAAM,cAAc,OAAO,GAAG,eAAe,CAAC,CAAC,WAC7C,UACA,QAKA,QACA;GACA,MAAM,SAAS,SAAS;GAExB,IACE,WAAW,QACX,OAAO,WAAW,QAClB,SAAS,SAAS,qBAAqB,OAAO,SAAS,oBACvD,SAAS,SAAS,cAAc,OAAO,SAAS,WAEhD,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GAEpC,MAAM,WAAW,OAAO,UACrB,QAAQ,OAAO,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC,CAChD,KAAK,OAAO,SAAS,UAAU,CAAC;GAEnC,IACE,SAAS,qBAAqB,OAAO,SAAS,oBAC9C,CAAC,SAAS,YAAY,MACnB,SAAS,KAAK,iBAAiB,OAAO,gBAAgB,KAAK,aAAa,OAAO,QAClF,GAEA,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GAEpC,OAAO,uBAAuB,KAAK;IACjC;IACA,QAAQ,OAAO;IACf,eAAe,OAAO;IACtB,QAAQ,CACN;KACE;KACA,cAAc,OAAO;KACrB,SAAS,CAAC,YAAY;KACtB,cAAc;KACd,mBAAmB;KACnB,YAAY,OAAO,SAAS;IAC9B,CACF;GACF,CAAC;EACH,CAAC;EAED,MAAM,kBACJ,OACA,WACA,SACuB;GACvB,MAAM;GACN,UAAU;GACV,iBAAiB,MAAM,OAAO;GAC9B,SAAS,SAAS,KAAK,KAAK;EAC9B;EAEA,OAAO;GACL,iBAAiB,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACjD,YACA,UACuF;IACvF,MAAM,QAAQ,OAAO,OAAO,YAAY,QAAQ,GAC9C,WAAW,OAAO,cAAc,UAAU,GAC1C,gBAAgB,OAAO,UACrB,YACA,UACA,UACA,OACA,MAAM,WACR;IAEF,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IAEtD,MAAM,SAAS,eAAe,GAC5B,YAAY,OAAO,MAAM,GACzB,eAAe,SAAS,GACxB,WAAW,SAAS,GACpB,eAAe,SAAS,QAAQ,gBAAgB,SAAS;IAE3D,MAAM,WAAW,OAAO,cACtB;KAAE;KAAU,WAAW,SAAS,SAAS;KAAW;KAAc;IAAS,GAC3E,MACF,CAAC,CAAC,KACA,OAAO,eAAe,gBAAgB,IAAI,GAC1C,OAAO,SAAS,OAAO,WAAW,OAAO,KAAK,CAAC,CAAC,CAAC,CACnD;IAEA,MAAM,kBAAkB,MAAM,OAAO;IAErC,OAAO,OACL,UACA,MAAM,WACN;KACE,MAAM;KACN,QAAQ;MACN,GAAI,SAAS,UAAU;OACrB;OACA,WAAW,SAAS,SAAS;OAC7B;OACA;OACA,SAAS,SAAS;OAClB,QAAQ;OACR,iBAAiB,CAAC;OAClB,cAAc;OACd,eAAe;OACf,gBAAgB;MAClB;MACA,SAAS;OACP;OACA;OACA,QAAQ;OACR;OACA,gBAAgB;MAClB;KACF;IACF,GACA,aACF;IAEA,OAAO;KACL,OAAO;MAAE;MAAc;KAAgB;KACvC,oBAAoB,CAAC;KACrB,gBAAgB,CACd;MACE,MAAM;MACN,UAAU;MACV,iBAAiB,KAAK,IAAI,iBAAiB,MAAM,OAAO,oBAAoB;MAC5E,SAAS,SAAS,KAAK;OACrB;OACA,KAAK,kBAAkB,mBAAmB,OAAO,MAAM,EAAE,GAAG,mBAAmB,MAAM,WAAW,EAAE,UAAU,UAAU,UAAU,mBAAmB,OAAO,MAAM,EAAE;MACpK,CAAC;KACH,CACF;IACF;GACF,CAAC;GACD,mBAAmB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACrD,YACA,UACsF;IACtF,MAAM,QAAQ,OAAO,OAAO,cAAc,QAAQ,GAChD,WAAW,OAAO,cAAc,UAAU,GAC1C,gBAAgB,OAAO,UACrB,YACA,UACA,WACA,OACA,MAAM,YACR,GACA,QAAQ,iBAAiB,UAAU,SAAS,SAAS,SAAS,GAC9D,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IAElD,OAAO,OACL,UACA,MAAM,WACN;KACE,MAAM;KACN,cAAc,MAAM;KACpB,aAAa,OAAO,QAAQ,UAAU,SAAS,MAAM,MAAM,IAAI,GAAG,IAAI;KACtE,iBAAiB,MAAM;IACzB,GACA,aACF;IAEA,OAAO;KACL,OAAO;MAAE,SAAS;MAAM;KAAa;KACrC,oBAAoB,CAAC;KACrB,gBAAgB,CAAC,eAAe,MAAM,OAAO,MAAM,WAAW,GAAG,CAAC;IACpE;GACF,CAAC;GACD,SAAS,OAAO,GAAG,cAAc,CAAC,CAAC,WACjC,YACA,UACA;IACA,MAAM,QAAQ,OAAO,OAAO,aAAa,QAAQ,GAC/C,WAAW,OAAO,cAAc,UAAU,GAC1C,gBAAgB,OAAO,UAAU,YAAY,UAAU,WAAW,OAAO,EAAE;IAE7E,OAAO,OAAO,UAAU,MAAM,WAAW,EAAE,MAAM,UAAU,GAAG,aAAa;IAE3E,OAAO;KAAE,SAAS;KAAO;IAAa;GACxC,CAAC;GACD,yBAAyB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACjE,YACA,UACsF;IACtF,MAAM,QAAQ,OAAO,OAAO,aAAa,QAAQ,GAC/C,WAAW,OAAO,cAAc,UAAU,GAC1C,gBAAgB,OAAO,UAAU,YAAY,UAAU,cAAc,OAAO,EAAE,GAC9E,QAAQ,iBAAiB,UAAU,SAAS,SAAS,SAAS,GAC9D,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IAElD,OAAO,OACL,UACA,MAAM,WACN;KAAE,MAAM;KAAc,iBAAiB,MAAM;IAAQ,GACrD,aACF;IAEA,OAAO;KACL,OAAO;MAAE,SAAS;MAAM;KAAa;KACrC,oBAAoB,CAAC;KACrB,gBAAgB,CAAC,eAAe,MAAM,OAAO,MAAM,WAAW,GAAG,CAAC;IACpE;GACF,CAAC;GACD,eAAe,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAC7C,YACA,UACA;IACA,OAAO;IACP,MAAM,QAAQ,OAAO,OAAO,aAAa,QAAQ;IAEjD,IAAI,WAAW,SAAS,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;IAEnE,MAAM,SAAS,OAAO,WACjB,eAAe,MAAM,iBAAiB,CAAC,CACvC,KAAK,OAAO,SAAS,UAAU,CAAC,GACnC,WAAW,OAAO,SAAS,OAAO,SAAS,SAAS,GACpD,WAAW,OAAO,YAAY,UAAU,QAAQ,MAAM;IAExD,OAAO,OAAO,UAAU,SAAS,GAAG;KAClC,MAAM;KACN,aAAa,OAAO,QAAQ,UAAU,SAAS,MAAM,MAAM,IAAI,CAAC;IAClE,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,sBACd,WACG,wBAAwB,MAAM,iBAAiB,CAAC,CAChD,KACC,OAAO,SAAS,UAAU,GAC1B,OAAO,QAAQ,IAAI,GACnB,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,CAAC,CACtC,CACJ,CACF;IAEA,OAAO,OAAO,WACX,eAAe;KAAE,YAAY,MAAM;KAAmB,YAAY;IAAS,CAAC,CAAC,CAC7E,KAAK,OAAO,SAAS,UAAU,GAAG,OAAO,QAAQ,IAAI,CAAC;GAC3D,CAAC;GACD,cAAc,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC3C,YACA,UACA;IACA,OAAO;IACP,MAAM,QAAQ,OAAO,OAAO,aAAa,QAAQ;IAEjD,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;IAE3E,MAAM,SAAS,OAAO,OACnB,QAAQ,MAAM,gBAAgB,CAAC,CAC/B,KAAK,OAAO,SAAS,UAAU,CAAC;IAEnC,IAAI,OAAO,SAAS,cAAc,WAAW,WAAW,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;IAE1F,MAAM,WAAW,OAAO,SAAS,WAAW,SAAS,GACnD,WAAW,OAAO,YAAY,UAAU,QAAQ,MAAM;IAExD,OAAO,OAAO,UAAU,SAAS,GAAG;KAClC,MAAM;KACN,aAAa,OAAO,QAAQ,UAAU,SAAS,MAAM,MAAM,IAAI,CAAC;IAClE,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,sBACd,OACG,iBAAiB,MAAM,gBAAgB,CAAC,CACxC,KACC,OAAO,SAAS,UAAU,GAC1B,OAAO,QAAQ,IAAI,GACnB,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,CAAC,CACtC,CACJ,CACF;IAEA,OAAO,OAAO,OACX,gBAAgB;KACf,kBAAkB,MAAM;KACxB,kBAAkB,MAAM;KACxB,YAAY;IACd,CAAC,CAAC,CACD,KAAK,OAAO,SAAS,UAAU,GAAG,OAAO,QAAQ,IAAI,CAAC;GAC3D,CAAC;GACD,gBAAgB,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAC/C,YACA,UACA;IACA,OAAO;IACP,MAAM,QAAQ,OAAO,OAAO,eAAe,QAAQ;IAEnD,IAAI,WAAW,SAAS,WAAW,CAAC,OAAO,6BACzC,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;IAEpC,MAAM,SAAS,OAAO,WACjB,eAAe,MAAM,iBAAiB,CAAC,CACvC,KAAK,OAAO,SAAS,UAAU,CAAC,GACnC,WAAW,OAAO,SAAS,OAAO,SAAS,SAAS,GACpD,WAAW,OAAO,YAAY,UAAU,QAAQ,eAAe;IAEjE,OAAO,OAAO,UAAU,SAAS,GAAG;KAClC,MAAM;KACN,QAAQ,eAAe,UAAU,OAAO,SAAS,WAAW,SAAS,MAAM,MAAM,IAAI,CAAC;KACtF,OAAO;IACT,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,sBACd,WACG,wBAAwB,MAAM,iBAAiB,CAAC,CAChD,KACC,OAAO,SAAS,UAAU,GAC1B,OAAO,QAAQ,IAAI,GACnB,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,CAAC,CACtC,CACJ,CACF;IAEA,OAAO,OAAO,WACX,eAAe;KAAE,YAAY,MAAM;KAAmB,YAAY;IAAS,CAAC,CAAC,CAC7E,KAAK,OAAO,SAAS,UAAU,GAAG,OAAO,QAAQ,IAAI,CAAC;GAC3D,CAAC;GACD,mBAAmB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACrD,YACA,UACmF;IACnF,OAAO;IACP,MAAM,QAAQ,OAAO,OAAO,eAAe,QAAQ;IAEnD,IAAI,WAAW,SAAS,WAAW,OAAO,uBAAuB,4BAC/D,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;IAEpC,MAAM,SAAS,OAAO,WACjB,eAAe,MAAM,iBAAiB,CAAC,CACvC,KAAK,OAAO,SAAS,UAAU,CAAC,GACnC,WAAW,OAAO,SAAS,OAAO,SAAS,SAAS;IAEtD,OAAO,YAAY,UAAU,QAAQ,eAAe;IACpD,OAAO,OAAO,UAAU,SAAS,GAAG;KAClC,MAAM;KACN,QAAQ,eAAe,UAAU,OAAO,SAAS,WAAW,SAAS,MAAM,MAAM,IAAI,CAAC;KACtF,OAAO;KACP,SAAS;IACX,CAAC;IAED,OAAO;KACL,OAAO;MAAE,SAAS;MAA6B;KAAa;KAC5D,oBAAoB,CAClB;MAAE,MAAM;MAAS,MAAM;KAAgB,GACvC;MAAE,MAAM;MAAS,MAAM;KAAU,CACnC;IACF;GACF,CAAC;EACH;CACF,CAAC;CAED,MAAM,OAAO,QAAQ,QAGnB,oBAAoB,SAAS,OAAO,GAAG,UAAU;CAEnD,MAAM,QAAQ,MAAM,OAAO,MAAM,IAAI;CAErC,MAAM,EACJ,OACA,SACA,SACA,YACA,eACA,cACA,gBACA,sBACE,iBAAiB,UAAU,QAAQ,CAAC,CAAC;CAEzC,MAAM,gBAAgB,MAAM,SAC1B,MAAM,wBAAwB,OAAO,eACnC,OAAO,QAAQ,OAAO,YAAY,QAAQ,gBAAgB,YAAY,KAAK,CAAC,CAC9E,GACA,QAAQ,wBAAwB,OAAO,eACrC,OAAO,QAAQ,OAAO,YAAY,QAAQ,kBAAkB,YAAY,KAAK,CAAC,CAChF,GACA,QAAQ,cAAc,OAAO,eAC3B,OAAO,QAAQ,OAAO,YAAY,QAAQ,QAAQ,YAAY,KAAK,CAAC,CACtE,GACA,WAAW,wBAAwB,OAAO,eACxC,OAAO,QAAQ,OAAO,YAAY,QAAQ,wBAAwB,YAAY,KAAK,CAAC,CACtF,GACA,cAAc,wBAAwB,OAAO,eAC3C,OAAO,QAAQ,OAAO,YAAY,QAAQ,cAAc,YAAY,KAAK,CAAC,CAC5E,GACA,aAAa,wBAAwB,OAAO,eAC1C,OAAO,QAAQ,OAAO,YAAY,QAAQ,aAAa,YAAY,KAAK,CAAC,CAC3E,GACA,eAAe,wBAAwB,OAAO,eAC5C,OAAO,QAAQ,OAAO,YAAY,QAAQ,eAAe,YAAY,KAAK,CAAC,CAC7E,GACA,kBAAkB,wBAAwB,OAAO,eAC/C,OAAO,QAAQ,OAAO,YAAY,QAAQ,kBAAkB,YAAY,KAAK,CAAC,CAChF,CACF;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA,YAAY;GACV;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,OAAO,eACL,OACA,SACA,SACA,YACA,eACA,cACA,gBACA,iBACF;EACA,UAAU,iBACR;GACE,iBAAiB,MAAM;GACvB,mBAAmB,QAAQ;GAC3B,SAAS,QAAQ;GACjB,yBAAyB,WAAW;GACpC,eAAe,cAAc;GAC7B,cAAc,aAAa;GAC3B,gBAAgB,eAAe;GAC/B,mBAAmB,kBAAkB;EACvC,GACA,cAAc,KAAK,MAAM,QAAQ,KAAK,CAAC,GACvC,EAAE,YAAY,KAAK,CACrB;CACF,CAAC;AACH"}

package/package.json

@@ -0,0 +1 @@
+{"name":"@yielded/auth","version":"0.1.0-beta.1","dependencies":{"@noble/ciphers":"2.1.1","@noble/hashes":"2.3.0"},"devDependencies":{"@cloudflare/workers-types":"5.20260825.1","@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","@simplewebauthn/browser":"14.0.0","@simplewebauthn/server":"14.0.1","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","effect-cf":"0.40.0","openid-client":"6.8.8","tldts":"7.4.11","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","@simplewebauthn/browser":">=14.0.0 <15","@simplewebauthn/server":">=14.0.1 <15","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0","openid-client":">=6.8.8 <7","tldts":">=7.4.11 <8"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Auth":{"types":"./dist/Auth.d.mts","default":"./dist/Auth.mjs"},"./Drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./DrizzleD1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./DrizzleLibsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./DrizzleMysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./DrizzlePglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./DrizzlePostgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./DrizzleSqliteBun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./DrizzleSqliteDo":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./DrizzleSqliteNode":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./DrizzleSqliteWasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"},"./Cloudflare":{"types":"./dist/Cloudflare.d.mts","default":"./dist/Cloudflare.mjs"},"./Http":{"types":"./dist/Http.d.mts","default":"./dist/Http.mjs"},"./HttpServer":{"types":"./dist/HttpServer.d.mts","default":"./dist/HttpServer.mjs"},"./OperationHttp":{"types":"./dist/OperationHttp.d.mts","default":"./dist/OperationHttp.mjs"},"./OperationHttpClient":{"types":"./dist/OperationHttpClient.d.mts","default":"./dist/OperationHttpClient.mjs"},"./OperationHttpServer":{"types":"./dist/OperationHttpServer.d.mts","default":"./dist/OperationHttpServer.mjs"},"./Atom":{"types":"./dist/Atom.d.mts","default":"./dist/Atom.mjs"},"./Hooks":{"types":"./dist/Hooks.d.mts","default":"./dist/Hooks.mjs"},"./Identity":{"types":"./dist/Identity.d.mts","default":"./dist/Identity.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Operations":{"types":"./dist/Operations.d.mts","default":"./dist/Operations.mjs"},"./Rpc":{"types":"./dist/Rpc.d.mts","default":"./dist/Rpc.mjs"},"./Schema":{"types":"./dist/Schema.d.mts","default":"./dist/Schema.mjs"},"./Testing":{"types":"./dist/Testing.d.mts","default":"./dist/Testing.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./Sessions":{"types":"./dist/Sessions.d.mts","default":"./dist/Sessions.mjs"},"./SessionContract":{"types":"./dist/SessionContract.d.mts","default":"./dist/SessionContract.mjs"},"./Proofs":{"types":"./dist/Proofs.d.mts","default":"./dist/Proofs.mjs"},"./Password":{"types":"./dist/Password.d.mts","default":"./dist/Password.mjs"},"./Email":{"types":"./dist/Email.d.mts","default":"./dist/Email.mjs"},"./OpenIdClient":{"types":"./dist/OpenIdClient.d.mts","default":"./dist/OpenIdClient.mjs"},"./OpenIdClientConnected":{"types":"./dist/OpenIdClientConnected.d.mts","default":"./dist/OpenIdClientConnected.mjs"},"./Passkey":{"types":"./dist/Passkey.d.mts","default":"./dist/Passkey.mjs"},"./PasskeyPassword":{"types":"./dist/PasskeyPassword.d.mts","default":"./dist/PasskeyPassword.mjs"},"./PasskeySimpleWebAuthn":{"types":"./dist/PasskeySimpleWebAuthn.d.mts","default":"./dist/PasskeySimpleWebAuthn.mjs"},"./PasskeyBrowser":{"types":"./dist/PasskeyBrowser.d.mts","default":"./dist/PasskeyBrowser.mjs"},"./GitHub":{"types":"./dist/GitHub.d.mts","default":"./dist/GitHub.mjs"},"./AuthSession":{"types":"./dist/AuthSession.d.mts","default":"./dist/AuthSession.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Workflows":{"types":"./dist/Workflows.d.mts","default":"./dist/Workflows.mjs"},"./PasswordHasher":{"types":"./dist/PasswordHasher.d.mts","default":"./dist/PasswordHasher.mjs"},"./EmailOtp":{"types":"./dist/EmailOtp.d.mts","default":"./dist/EmailOtp.mjs"},"./AuthStore":{"types":"./dist/AuthStore.d.mts","default":"./dist/AuthStore.mjs"},"./PasswordAuth":{"types":"./dist/PasswordAuth.d.mts","default":"./dist/PasswordAuth.mjs"},"./Policy":{"types":"./dist/Policy.d.mts","default":"./dist/Policy.mjs"},"./EmailOtpSender":{"types":"./dist/EmailOtpSender.d.mts","default":"./dist/EmailOtpSender.mjs"},"./AuthTokenCodec":{"types":"./dist/AuthTokenCodec.d.mts","default":"./dist/AuthTokenCodec.mjs"},"./IdentityResolver":{"types":"./dist/IdentityResolver.d.mts","default":"./dist/IdentityResolver.mjs"},"./PasswordCredentialStore":{"types":"./dist/PasswordCredentialStore.d.mts","default":"./dist/PasswordCredentialStore.mjs"},"./PhoneOtp":{"types":"./dist/PhoneOtp.d.mts","default":"./dist/PhoneOtp.mjs"},"./Totp":{"types":"./dist/Totp.d.mts","default":"./dist/Totp.mjs"},"./PasskeyContract":{"types":"./dist/PasskeyContract.d.mts","default":"./dist/PasskeyContract.mjs"},"./TotpContract":{"types":"./dist/TotpContract.d.mts","default":"./dist/TotpContract.mjs"},"./AuthContract":{"types":"./dist/AuthContract.d.mts","default":"./dist/AuthContract.mjs"},"./Client":{"types":"./dist/Client.d.mts","default":"./dist/Client.mjs"}},"description":"Composable authentication, sessions, and identity workflows for Effect.","keywords":["authentication","effect","oauth","passkeys","sessions","typescript"],"homepage":"https://github.com/danieljvdm/effect-auth#readme","bugs":{"url":"https://github.com/danieljvdm/effect-auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-auth.git","directory":"packages/effect-auth"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","e2e":"bun test/e2e/harness.ts","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"@simplewebauthn/browser":{"optional":true},"@simplewebauthn/server":{"optional":true},"drizzle-orm":{"optional":true},"effect-cf":{"optional":true},"openid-client":{"optional":true},"tldts":{"optional":true}}}

package/src/Atom.ts

@@ -0,0 +1,4 @@
+export { makeLifetime, AuthAtomLifetime, type AuthSubjectLifetime } from "./atom/AuthAtomLifetime";
+export { AuthAtomWorkflow } from "./atom/AuthAtomWorkflow";
+export { mutation, query, workflow, type ReactivityKeys } from "./atom/operations";
+export { make, type AuthActionAtom, type AuthAtoms, type AuthAtomOptions } from "./atom/client";

package/src/Auth.ts

@@ -0,0 +1,16 @@
+export { type AuthApi, type AuthService, type Options, Service, make } from "./auth/Auth";
+export { AuthenticationRequired } from "./operations/errors";
+export { AuthConfigurationError } from "./auth/AuthConfigurationError";
+export { type AuthMethod, makeAuthStrategy as makeStrategy } from "./auth/AuthStrategy";
+
+export type {
+  BindingOf,
+  ClaimsCodec,
+  StrategyBinding,
+  StrategyDefinition,
+  StrategyTypeLambda,
+} from "./auth/definition";
+
+export { AuthRequest } from "./auth/AuthRequest";
+export type { SessionApi, SessionApiError } from "./auth/session";
+export { RequestBindingConfig } from "./operations/RequestBindingConfig";

package/src/AuthContract.ts

@@ -0,0 +1,17 @@
+export {
+  action,
+  fromOperation,
+  make,
+  type ActionOptions,
+  type ActionDefinitions,
+  type ActionInput,
+  type ActionSuccess,
+  type ActionError,
+  type AnyAuthAction,
+  type AuthActions,
+  type AnyAuthContract,
+} from "./operations/actions";
+
+export { signIn as passwordSignIn } from "./password/methods/contracts";
+
+export { httpGroup } from "./http/auth-contract";