@yielded/auth 0.1.0-beta.1

package/src/PasswordAuth.ts

@@ -0,0 +1,197 @@
+import { Context, DateTime, Effect, Layer, Option, Redacted } from "effect";
+
+import {
+  type AuthStoreError,
+  type AuthTokenError,
+  AuthRateLimited,
+  InvalidAuthRequest,
+  InvalidCredentials,
+} from "./Errors";
+import { PasswordCredentialStore } from "./PasswordCredentialStore";
+import { PasswordHasher } from "./PasswordHasher";
+import { AuthPolicy } from "./Policy";
+import type { Email, SubjectId } from "./Schema";
+
+export interface SetPasswordInput {
+  /** Required whenever the subject already has a password credential. */
+  readonly currentPassword: Option.Option<Redacted.Redacted<string>>;
+  readonly newPassword: Redacted.Redacted<string>;
+}
+
+/**
+ * Password strategy workflow, a sibling of `EmailOtp`. A password is a second
+ * sign-in method an existing subject opts into; account creation stays with
+ * the email OTP strategy, so a verified email always precedes a credential.
+ * Session issuance stays in `AuthSession`; the HTTP layer composes the two.
+ *
+ * Sessions are stateless, so changing a password does not revoke sessions
+ * issued before the change.
+ */
+export class PasswordAuth extends Context.Service<
+  PasswordAuth,
+  {
+    /**
+     * Verifies an email and password pair and resolves the subject. Unknown
+     * email, missing credential, and wrong password all collapse into
+     * `InvalidCredentials`; a locked credential is `AuthRateLimited`.
+     */
+    readonly signIn: (
+      email: Email,
+      password: Redacted.Redacted<string>,
+    ) => Effect.Effect<
+      SubjectId,
+      InvalidCredentials | AuthRateLimited | AuthStoreError | AuthTokenError
+    >;
+    /**
+     * Sets or changes the subject's password. Changing an existing password
+     * requires the current one; a missing or wrong current password is
+     * `InvalidCredentials`, and a new password outside the policy bounds is
+     * `InvalidAuthRequest`. Wrong current passwords share the sign-in failure
+     * accounting, so a locked credential is `AuthRateLimited` here too —
+     * otherwise this endpoint would be an unthrottled password oracle.
+     */
+    readonly setPassword: (
+      subjectId: SubjectId,
+      input: SetPasswordInput,
+    ) => Effect.Effect<
+      void,
+      InvalidCredentials | InvalidAuthRequest | AuthRateLimited | AuthStoreError | AuthTokenError
+    >;
+    /** Reports whether the subject has set a password. */
+    readonly hasPassword: (subjectId: SubjectId) => Effect.Effect<boolean, AuthStoreError>;
+  }
+>()("effect-auth/PasswordAuth") {
+  static readonly layer: Layer.Layer<
+    PasswordAuth,
+    never,
+    PasswordCredentialStore | PasswordHasher
+  > = Layer.effect(PasswordAuth)(
+    Effect.gen(function* () {
+      const policy = yield* AuthPolicy;
+      const store = yield* PasswordCredentialStore;
+      const hasher = yield* PasswordHasher;
+
+      // Verified when no credential exists so the missing-credential path
+      // costs one key derivation, the same as a wrong password. Hashed here
+      // rather than hard-coded so its iteration count tracks the policy.
+      // Lazily memoized rather than derived at layer build: consumers may
+      // rebuild the layer graph per request, and only the unknown-email
+      // sign-in path should ever pay the full key derivation.
+      const dummyHash = yield* Effect.cached(
+        hasher.hash(Redacted.make("effect-auth/anti-enumeration-dummy")),
+      );
+
+      const failureOptions = {
+        attemptLimit: policy.passwordAttemptLimit,
+        lockDuration: policy.passwordLockDuration,
+      };
+
+      return PasswordAuth.of({
+        signIn: Effect.fn("PasswordAuth.signIn")(function* (email, password) {
+          // An over-long password can never verify (`setPassword` enforces the
+          // cap), so refuse it before any derivation. The response does not
+          // depend on the email, so nothing leaks.
+          if (Redacted.value(password).length > policy.passwordMaxLength) {
+            return yield* InvalidCredentials.make();
+          }
+          const credential = yield* store.findByEmail(email);
+
+          if (Option.isSome(credential) && Option.isSome(credential.value.lockedUntil)) {
+            const now = yield* DateTime.now;
+            const lockedUntil = credential.value.lockedUntil.value;
+
+            const remainingMillis =
+              DateTime.toEpochMillis(lockedUntil) - DateTime.toEpochMillis(now);
+
+            if (remainingMillis > 0) {
+              // Deliberate tradeoff: answering 429 here reveals that a
+              // password credential exists for the email (an attacker can
+              // probe by burning attemptLimit guesses). We accept that —
+              // legitimate locked-out users need the retry guidance, and
+              // collapsing to InvalidCredentials would hide the lockout.
+              return yield* AuthRateLimited.make({
+                retryAfterSeconds: Math.ceil(remainingMillis / 1000),
+              });
+            }
+          }
+          if (Option.isNone(credential)) {
+            // Burn the same key derivation a real verification would, so
+            // response timing cannot separate unknown emails from wrong
+            // passwords.
+            yield* hasher.verify(password, yield* dummyHash);
+
+            return yield* InvalidCredentials.make();
+          }
+          const matches = yield* hasher.verify(password, credential.value.hash);
+
+          if (!matches) {
+            yield* store.recordFailure(credential.value.subjectId, failureOptions);
+
+            return yield* InvalidCredentials.make();
+          }
+          yield* store.recordSuccess(credential.value.subjectId);
+
+          return credential.value.subjectId;
+        }),
+
+        setPassword: Effect.fn("PasswordAuth.setPassword")(function* (subjectId, input) {
+          const newPasswordLength = Redacted.value(input.newPassword).length;
+
+          if (newPasswordLength < policy.passwordMinLength) {
+            return yield* InvalidAuthRequest.make({
+              message: `Passwords must be at least ${policy.passwordMinLength} characters`,
+            });
+          }
+          if (newPasswordLength > policy.passwordMaxLength) {
+            return yield* InvalidAuthRequest.make({
+              message: `Passwords must be at most ${policy.passwordMaxLength} characters`,
+            });
+          }
+          const existing = yield* store.findBySubject(subjectId);
+
+          if (Option.isSome(existing)) {
+            // Current-password guesses share the sign-in failure accounting,
+            // so a locked credential is rejected before any verification.
+            if (Option.isSome(existing.value.lockedUntil)) {
+              const now = yield* DateTime.now;
+
+              const remainingMillis =
+                DateTime.toEpochMillis(existing.value.lockedUntil.value) -
+                DateTime.toEpochMillis(now);
+
+              if (remainingMillis > 0) {
+                return yield* AuthRateLimited.make({
+                  retryAfterSeconds: Math.ceil(remainingMillis / 1000),
+                });
+              }
+            }
+            if (Option.isNone(input.currentPassword)) {
+              return yield* InvalidCredentials.make();
+            }
+            const currentPassword = input.currentPassword.value;
+
+            // Same DoS guard as sign-in: never derive from an over-long input.
+            if (Redacted.value(currentPassword).length > policy.passwordMaxLength) {
+              return yield* InvalidCredentials.make();
+            }
+            const matches = yield* hasher.verify(currentPassword, existing.value.hash);
+
+            if (!matches) {
+              yield* store.recordFailure(subjectId, failureOptions);
+
+              return yield* InvalidCredentials.make();
+            }
+            yield* store.recordSuccess(subjectId);
+          }
+          const hash = yield* hasher.hash(input.newPassword);
+
+          yield* store.upsert(subjectId, hash);
+        }),
+
+        hasPassword: Effect.fn("PasswordAuth.hasPassword")(function* (subjectId) {
+          return Option.isSome(yield* store.findBySubject(subjectId));
+        }),
+      });
+    }),
+  );
+}

package/src/PasswordCredentialStore.ts

@@ -0,0 +1,140 @@
+import { Context, DateTime, type Duration, Effect, Layer, Option } from "effect";
+
+import { AuthStoreError } from "./Errors";
+import { IdentityResolver } from "./IdentityResolver";
+import { type Email, type PasswordHash, type SubjectId, PasswordCredential } from "./Schema";
+
+/** Failure-accounting knobs, passed per call so the store stays policy-free. */
+export interface RecordFailureOptions {
+  /** Consecutive failures at which the credential locks. */
+  readonly attemptLimit: number;
+  /** How long the credential stays locked once the limit is reached. */
+  readonly lockDuration: Duration.Duration;
+}
+
+/**
+ * Consumer-implemented persistence for long-lived password credentials, keyed
+ * by subject with lookup through the subject's verified email. Deliberately
+ * not part of `AuthStore`: that store is transient-only, while credentials
+ * live as long as the account. Like `IdentityResolver`, the application owns
+ * the implementation; `PasswordAuth` owns the policy decisions around it.
+ */
+export class PasswordCredentialStore extends Context.Service<
+  PasswordCredentialStore,
+  {
+    readonly findByEmail: (
+      email: Email,
+    ) => Effect.Effect<Option.Option<PasswordCredential>, AuthStoreError>;
+    readonly findBySubject: (
+      subjectId: SubjectId,
+    ) => Effect.Effect<Option.Option<PasswordCredential>, AuthStoreError>;
+    /** Creates or replaces the subject's credential, clearing failures and any lock. */
+    readonly upsert: (
+      subjectId: SubjectId,
+      hash: PasswordHash,
+    ) => Effect.Effect<void, AuthStoreError>;
+    /**
+     * Increments the failure count and sets `lockedUntil` once the limit is
+     * reached. A failure arriving after an existing lock has expired starts a
+     * fresh window: the count resets to one and the stale lock is cleared, so
+     * a single wrong attempt per window can never re-lock forever. A no-op
+     * when the subject has no credential.
+     */
+    readonly recordFailure: (
+      subjectId: SubjectId,
+      options: RecordFailureOptions,
+    ) => Effect.Effect<void, AuthStoreError>;
+    /** Clears the failure count and any lock. A no-op when the subject has no credential. */
+    readonly recordSuccess: (subjectId: SubjectId) => Effect.Effect<void, AuthStoreError>;
+  }
+>()("effect-auth/PasswordCredentialStore") {
+  /**
+   * In-memory adapter for tests and local development; never durable. Email
+   * lookup delegates to `IdentityResolver`, mirroring how a production adapter
+   * joins its email mapping.
+   */
+  static readonly layerMemory: Layer.Layer<PasswordCredentialStore, never, IdentityResolver> =
+    Layer.effect(PasswordCredentialStore)(
+      Effect.gen(function* () {
+        const resolver = yield* IdentityResolver;
+        const credentials = new Map<SubjectId, PasswordCredential>();
+
+        const byEmail = (email: Email) =>
+          resolver.findByVerifiedEmail(email).pipe(
+            Effect.mapError(() => AuthStoreError.make({ message: "Identity resolution failed" })),
+            Effect.map(
+              Option.flatMap((subjectId) => Option.fromNullishOr(credentials.get(subjectId))),
+            ),
+          );
+
+        return PasswordCredentialStore.of({
+          findByEmail: byEmail,
+
+          findBySubject: (subjectId) =>
+            Effect.sync(() => Option.fromNullishOr(credentials.get(subjectId))),
+
+          upsert: (subjectId, hash) =>
+            Effect.sync(() => {
+              credentials.set(
+                subjectId,
+                PasswordCredential.make({
+                  subjectId,
+                  hash,
+                  failedAttempts: 0,
+                  lockedUntil: Option.none(),
+                }),
+              );
+            }),
+
+          recordFailure: Effect.fn("PasswordCredentialStore.recordFailure")(
+            function* (subjectId, options) {
+              const credential = credentials.get(subjectId);
+
+              if (credential === undefined) {
+                return;
+              }
+              const now = yield* DateTime.now;
+
+              // An expired lock means the previous window is over: this
+              // failure starts a fresh count instead of stacking on the old
+              // one, so one wrong attempt per window cannot re-lock forever.
+              const lockExpired =
+                Option.isSome(credential.lockedUntil) &&
+                DateTime.toEpochMillis(credential.lockedUntil.value) <= DateTime.toEpochMillis(now);
+
+              const failedAttempts = lockExpired ? 1 : credential.failedAttempts + 1;
+
+              const lockedUntil =
+                failedAttempts >= options.attemptLimit
+                  ? Option.some(DateTime.addDuration(now, options.lockDuration))
+                  : lockExpired
+                    ? Option.none<DateTime.Utc>()
+                    : credential.lockedUntil;
+
+              credentials.set(
+                subjectId,
+                PasswordCredential.make({ ...credential, failedAttempts, lockedUntil }),
+              );
+            },
+          ),
+
+          recordSuccess: (subjectId) =>
+            Effect.sync(() => {
+              const credential = credentials.get(subjectId);
+
+              if (credential === undefined) {
+                return;
+              }
+              credentials.set(
+                subjectId,
+                PasswordCredential.make({
+                  ...credential,
+                  failedAttempts: 0,
+                  lockedUntil: Option.none(),
+                }),
+              );
+            }),
+        });
+      }),
+    );
+}

package/src/PasswordHasher.ts

@@ -0,0 +1,147 @@
+import { Context, Crypto, Effect, Encoding, Layer, Redacted, Result, Schema } from "effect";
+
+import { AuthTokenError } from "./Errors";
+import { AuthPolicy } from "./Policy";
+import { PasswordHash, timingSafeStringEqual } from "./Schema";
+import { SubtleCrypto } from "./WebCrypto";
+
+const passwordHashAlgorithm = "pbkdf2-sha256";
+const saltLength = 16;
+const derivedKeyBits = 256;
+const textEncoder = new TextEncoder();
+
+const passwordHashFromString = Schema.decodeEffect(PasswordHash);
+
+interface PasswordHashParams {
+  readonly iterations: number;
+  readonly salt: Uint8Array;
+  readonly digest: string;
+}
+
+// Verification derives with the parameters recorded on the stored hash, not
+// the current policy, so old hashes keep verifying after a policy change.
+const parsePasswordHash = (hash: string): PasswordHashParams | undefined => {
+  const [algorithm, iterationsPart, saltPart, digestPart, ...rest] = hash.split("$");
+
+  if (
+    algorithm !== passwordHashAlgorithm ||
+    iterationsPart === undefined ||
+    saltPart === undefined ||
+    digestPart === undefined ||
+    digestPart === "" ||
+    rest.length > 0 ||
+    !/^[1-9]\d{0,8}$/.test(iterationsPart)
+  ) {
+    return undefined;
+  }
+  const salt = Result.getOrUndefined(Encoding.decodeBase64Url(saltPart));
+
+  if (salt === undefined || salt.length === 0) {
+    return undefined;
+  }
+
+  return { iterations: Number(iterationsPart), salt, digest: digestPart };
+};
+
+/**
+ * Default PBKDF2-HMAC-SHA-256 hasher on WebCrypto. Iterations come from
+ * `AuthPolicy`; salts come from `Crypto.Crypto` so tests can seed them, and
+ * key derivation goes through the `SubtleCrypto` service.
+ */
+const makeWebCryptoHasher: Effect.Effect<
+  PasswordHasher["Service"],
+  never,
+  Crypto.Crypto | SubtleCrypto
+> = Effect.gen(function* () {
+  const policy = yield* AuthPolicy;
+  const crypto = yield* Crypto.Crypto;
+  const subtle = yield* SubtleCrypto;
+
+  const derive = (password: Redacted.Redacted<string>, salt: Uint8Array, iterations: number) =>
+    Effect.tryPromise({
+      try: async () => {
+        const key = await subtle.importKey(
+          "raw",
+          textEncoder.encode(Redacted.value(password)),
+          "PBKDF2",
+          false,
+          ["deriveBits"],
+        );
+
+        const bits = await subtle.deriveBits(
+          { name: "PBKDF2", hash: "SHA-256", salt: salt as BufferSource, iterations },
+          key,
+          derivedKeyBits,
+        );
+
+        return new Uint8Array(bits);
+      },
+      catch: () => AuthTokenError.make({ message: "Password key derivation failed" }),
+    });
+
+  return PasswordHasher.of({
+    hash: Effect.fn("PasswordHasher.hash")(function* (password) {
+      const salt = yield* crypto
+        .randomBytes(saltLength)
+        .pipe(
+          Effect.mapError(() => AuthTokenError.make({ message: "Secure randomness unavailable" })),
+        );
+
+      const derived = yield* derive(password, salt, policy.passwordIterations);
+
+      const encoded =
+        `${passwordHashAlgorithm}$${policy.passwordIterations}` +
+        `$${Encoding.encodeBase64Url(salt)}$${Encoding.encodeBase64Url(derived)}`;
+
+      return yield* passwordHashFromString(encoded).pipe(
+        Effect.mapError(() => AuthTokenError.make({ message: "Password hash failed to encode" })),
+      );
+    }),
+
+    verify: Effect.fn("PasswordHasher.verify")(function* (password, hash) {
+      const params = parsePasswordHash(hash);
+
+      // A malformed stored hash degrades to a plain mismatch, never a
+      // distinguishable auth response.
+      if (params === undefined) {
+        return false;
+      }
+      const derived = yield* derive(password, params.salt, params.iterations);
+
+      return timingSafeStringEqual(Encoding.encodeBase64Url(derived), params.digest);
+    }),
+  });
+});
+
+/**
+ * One-way password hashing and verification. The PHC-style `PasswordHash`
+ * format is this service's private concern; stores persist it opaquely.
+ */
+export class PasswordHasher extends Context.Service<
+  PasswordHasher,
+  {
+    /** Derives a fresh salted hash for the password at the configured cost. */
+    readonly hash: (
+      password: Redacted.Redacted<string>,
+    ) => Effect.Effect<PasswordHash, AuthTokenError>;
+    /**
+     * Verifies the password against a stored hash using the parameters
+     * recorded on the hash, comparing digests in constant time. A malformed
+     * hash yields `false`, never a distinguishable failure.
+     */
+    readonly verify: (
+      password: Redacted.Redacted<string>,
+      hash: PasswordHash,
+    ) => Effect.Effect<boolean, AuthTokenError>;
+  }
+>()("effect-auth/PasswordHasher") {
+  /**
+   * Default PBKDF2 implementation backed by WebCrypto. The consumer may
+   * replace it with its own hasher service, or satisfy `SubtleCrypto` with
+   * `SubtleCrypto.layerWeb`.
+   */
+  static readonly layerWebCrypto: Layer.Layer<PasswordHasher, never, Crypto.Crypto | SubtleCrypto> =
+    Layer.effect(PasswordHasher)(makeWebCryptoHasher);
+
+  static readonly layer = PasswordHasher.layerWebCrypto;
+}

package/src/PhoneOtp.ts

@@ -0,0 +1,32 @@
+export {
+  PhoneCredentialSnapshot,
+  PhoneNumber,
+  PhoneOtpComplete,
+  PhoneOtpRejected,
+  PhoneOtpUnavailable,
+} from "./phone/models";
+
+export { PhoneSignInTargets } from "./phone/PhoneSignInTargets";
+export { type PhoneOtpOptions, make } from "./phone/definition";
+export { makePhoneOtp as makeModule } from "./phone/module";
+
+export { PhoneRequestContext } from "./phone/PhoneRequestContext";
+export { PhoneAdmission } from "./phone/PhoneAdmission";
+export { PhoneDeliveryEligibility } from "./phone/PhoneDeliveryEligibility";
+export { PhoneActionEvidence } from "./phone/PhoneActionEvidence";
+export { PhonePersistence, type PhoneMutation } from "./phone/PhonePersistence";
+
+export {
+  PhoneCommandId,
+  PhoneLifecycleAction,
+  PhoneLifecyclePolicy,
+  PhoneAdmissionPolicy,
+  PhoneCustody,
+  PhoneLifecycleTarget,
+  PhoneActionChallenge,
+  PhoneActionAuthorization,
+  PhoneActionRequired,
+  PhoneConfigurationError,
+  PhoneLifecycleFailure,
+  PhoneMutationDecision,
+} from "./phone/lifecycleModels";

package/src/Policy.ts

@@ -0,0 +1,95 @@
+import { Context, DateTime, Duration, Effect, Layer } from "effect";
+
+import { InvalidSession } from "./Errors";
+import type { SessionClaims } from "./Schema";
+
+export interface AuthPolicyShape {
+  /** OTP challenge lifetime. */
+  readonly otpLifetime: Duration.Duration;
+  /** Number of decimal digits in the OTP code. */
+  readonly otpLength: number;
+  /** Rolling wrong-code budget per email and purpose. */
+  readonly attemptLimit: number;
+  /** Minimum delay between challenge issuances for the same email and purpose. */
+  readonly resendCooldown: Duration.Duration;
+  /** Pending-registration lifetime. */
+  readonly registrationLifetime: Duration.Duration;
+  /** Lifetime of each issued session token. */
+  readonly sessionLifetime: Duration.Duration;
+  /** Minimum token age before authenticated HTTP activity may renew it. */
+  readonly sessionRenewalInterval: Duration.Duration;
+  /** `iss` claim issued and required on session tokens. */
+  readonly issuer: string;
+  /** `aud` claim issued and required on session tokens. */
+  readonly audience: string;
+  /** Incrementing this invalidates every previously issued session. */
+  readonly sessionGeneration: number;
+  /** Minimum accepted password length. */
+  readonly passwordMinLength: number;
+  /** Maximum accepted password length; bounds the PBKDF2 work per attempt. */
+  readonly passwordMaxLength: number;
+  /** PBKDF2-HMAC-SHA-256 iteration count for newly hashed passwords. */
+  readonly passwordIterations: number;
+  /** Consecutive failed password sign-ins before the credential locks. */
+  readonly passwordAttemptLimit: number;
+  /** How long a locked credential rejects sign-in attempts. */
+  readonly passwordLockDuration: Duration.Duration;
+}
+
+// Numbers match the sign-in design spec (Auth — Sign in, section 8c): a
+// six-digit code valid ten minutes, resend unlocked after thirty seconds,
+// three wrong attempts before the code is invalidated. The password iteration
+// count follows the OWASP 2023+ recommendation for PBKDF2-HMAC-SHA-256.
+export const defaultAuthPolicy: AuthPolicyShape = {
+  otpLifetime: Duration.minutes(10),
+  otpLength: 6,
+  attemptLimit: 3,
+  resendCooldown: Duration.seconds(30),
+  registrationLifetime: Duration.minutes(15),
+  sessionLifetime: Duration.days(7),
+  sessionRenewalInterval: Duration.days(1),
+  issuer: "effect-auth",
+  audience: "effect-auth",
+  sessionGeneration: 0,
+  passwordMinLength: 8,
+  passwordMaxLength: 256,
+  passwordIterations: 600_000,
+  passwordAttemptLimit: 10,
+  passwordLockDuration: Duration.minutes(15),
+};
+
+export const AuthPolicy = Context.Reference<AuthPolicyShape>("effect-auth/AuthPolicy", {
+  defaultValue: () => defaultAuthPolicy,
+});
+
+/** The signed-claim subset that remains meaningful after token verification. */
+export interface SessionClaimsPolicy {
+  readonly issuer: string;
+  readonly audience: string;
+  readonly sessionGeneration: number;
+  readonly allowedSigningKeyIds: ReadonlySet<string>;
+}
+
+/** Revalidates a previously verified claim set at each later trust boundary. */
+export const revalidateSessionClaims = Effect.fn("AuthSession.revalidateClaims")(function* (
+  claims: SessionClaims,
+  policy: SessionClaimsPolicy,
+) {
+  const now = yield* DateTime.now;
+
+  if (
+    DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(claims.exp) ||
+    claims.gen !== policy.sessionGeneration ||
+    claims.iss !== policy.issuer ||
+    claims.aud !== policy.audience ||
+    !policy.allowedSigningKeyIds.has(claims.kid)
+  ) {
+    return yield* InvalidSession.make();
+  }
+
+  return claims;
+});
+
+/** Builds an auth policy layer by overriding the secure library defaults. */
+export const layerAuthPolicy = (overrides: Partial<AuthPolicyShape> = {}) =>
+  Layer.succeed(AuthPolicy)({ ...defaultAuthPolicy, ...overrides });

package/src/Proofs.ts

@@ -0,0 +1,71 @@
+export { EmailProofDelivery } from "./proofs/EmailProofDelivery";
+export { HostIngressLimiter } from "./proofs/HostIngressLimiter";
+
+export {
+  IdentifierChangeProofBinding,
+  IdentifierProofBinding,
+  ProofAttemptDecision,
+  ProofBinding,
+  ProofCleanupResult,
+  ProofCompletionDecision,
+  ProofContinuation,
+  ProofContinuationId,
+  ProofDeliveryId,
+  ProofDeliveryOutcome,
+  ProofDeliveryStatus,
+  ProofId,
+  ProofInstant,
+  ProofPurpose,
+  ProofReference,
+  ProofRequestId,
+  ProofRequestReceipt,
+  ProofVersion,
+  SubjectProofBinding,
+} from "./proofs/models";
+
+export {
+  type PrepareProofCommit,
+  type ProofCompletionInput,
+  type ProofDeliveryClaim,
+  type ProofDigest,
+  type ProofIssueDecision,
+  ProofPersistence,
+  type ProofRecord,
+} from "./proofs/ProofPersistence";
+
+export {
+  type PreparedProofDispatch,
+  type ProofIssuePlan,
+  readProofCommit,
+} from "./proofs/dispatch";
+
+export { ProofAbusePolicy, ProofBudget, ProofPolicy, validateProofPolicy } from "./proofs/policy";
+export { type ProofAbuseScope, proofAbuseScope } from "./proofs/abuse";
+
+export {
+  ProofCapabilityUnsupported,
+  ProofConfigurationError,
+  ProofError,
+  ProofIngressDenied,
+  ProofInvalid,
+  ProofRequestConflict,
+  ProofUnavailable,
+} from "./proofs/errors";
+
+export { type ProofCompletionPlan } from "./proofs/completion";
+
+export {
+  type ProofDelivery,
+  type ProofDeliveryMessage,
+  ProofVendorPolicy,
+} from "./proofs/delivery";
+
+export {
+  type ProofKeyring,
+  ProofSecretPolicy,
+  makeProofCrypto,
+  validateProofBinding,
+} from "./proofs/crypto";
+
+export { SmsProofDelivery } from "./proofs/SmsProofDelivery";
+export { make } from "./proofs/definition";