@yielded/auth 0.1.0-beta.1

package/dist/AuthStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStore.mjs","names":[],"sources":["../src/AuthStore.ts"],"sourcesContent":["import { Context, DateTime, Duration, Effect, Layer, Schema, Semaphore } from \"effect\";\n\nimport { AuthRateLimited, AuthStoreError, InvalidRegistration } from \"./Errors\";\nimport {\n  type ConsumeChallenge,\n  type ConsumeRegistration,\n  type TokenDigest,\n  NewChallenge,\n  NewRegistration,\n  PendingRegistration,\n  timingSafeStringEqual,\n  VerifiedEmail,\n} from \"./Schema\";\n\nexport type IssueChallengeError = AuthRateLimited | AuthStoreError;\n\nexport const EmailOtpRejectionReason = Schema.Literals([\n  \"missing_challenge\",\n  \"consumed_challenge\",\n  \"superseded_challenge\",\n  \"expired_challenge\",\n  \"missing_challenge_series\",\n  \"attempts_exhausted\",\n  \"bad_code\",\n]);\n\n/** Internal rejection detail that the HTTP workflow collapses to `InvalidEmailOtp`. */\nexport class EmailOtpRejected extends Schema.TaggedError<EmailOtpRejected>()(\"EmailOtpRejected\", {\n  reason: EmailOtpRejectionReason,\n}) {}\n\n/**\n * Deliberately narrow storage driver behind the store state machine: the\n * in-memory map, Durable Object storage, or any keyed store whose writes\n * become visible in order. Values handed to `put` are already JSON-safe\n * encoded rows, so `get` legitimately yields `unknown`.\n * Retain challenge rows through their original expiry, including after consumption.\n */\nexport class AuthStoreBackend extends Context.Service<\n  AuthStoreBackend,\n  {\n    /** Resolves the stored value for a key, or `undefined` when absent. */\n    readonly get: (key: string) => Effect.Effect<unknown, AuthStoreError>;\n    readonly put: (key: string, value: unknown) => Effect.Effect<void, AuthStoreError>;\n    readonly remove: (key: string) => Effect.Effect<void, AuthStoreError>;\n  }\n>()(\"effect-auth/AuthStoreBackend\") {\n  /** In-memory backend for tests and local development; never durable. */\n  static readonly layerMemory: Layer.Layer<AuthStoreBackend> = Layer.sync(AuthStoreBackend)(() => {\n    const entries = new Map<string, unknown>();\n\n    return AuthStoreBackend.of({\n      get: (key) => Effect.sync(() => entries.get(key)),\n      put: (key, value) =>\n        Effect.sync(() => {\n          entries.set(key, value);\n        }),\n      remove: (key) =>\n        Effect.sync(() => {\n          entries.delete(key);\n        }),\n    });\n  });\n}\n\n// --- Stored rows ---------------------------------------------------------------\n\nclass StoredChallenge extends Schema.Class<StoredChallenge>(\"effect-auth/StoredChallenge\")({\n  challenge: NewChallenge,\n  consumed: Schema.Boolean,\n  superseded: Schema.Boolean,\n}) {}\n\nclass StoredEmailSeries extends Schema.Class<StoredEmailSeries>(\"effect-auth/StoredEmailSeries\")({\n  activeChallengeKey: Schema.UndefinedOr(Schema.String),\n  lastIssuedAt: Schema.DateTimeUtcFromMillis,\n  rollingAttempts: Schema.Natural,\n  windowExpiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\nclass StoredRegistration extends Schema.Class<StoredRegistration>(\"effect-auth/StoredRegistration\")(\n  {\n    registration: NewRegistration,\n    consumed: Schema.Boolean,\n  },\n) {}\n\n// oxlint-disable-next-line no-restricted-properties -- AuthStoreBackend intentionally returns unknown persisted values.\nconst decodeChallengeRow = Schema.decodeUnknownEffect(StoredChallenge);\nconst encodeChallengeRow = Schema.encodeEffect(StoredChallenge);\n// oxlint-disable-next-line no-restricted-properties -- AuthStoreBackend intentionally returns unknown persisted values.\nconst decodeSeriesRow = Schema.decodeUnknownEffect(StoredEmailSeries);\nconst encodeSeriesRow = Schema.encodeEffect(StoredEmailSeries);\n// oxlint-disable-next-line no-restricted-properties -- AuthStoreBackend intentionally returns unknown persisted values.\nconst decodeRegistrationRow = Schema.decodeUnknownEffect(StoredRegistration);\nconst encodeRegistrationRow = Schema.encodeEffect(StoredRegistration);\n\nconst challengeKey = (tokenDigest: string) => `challenge:${tokenDigest}`;\nconst seriesKey = (purpose: string, email: string) => `series:${purpose}|${email}`;\nconst registrationKey = (tokenDigest: string) => `registration:${tokenDigest}`;\n\n/**\n * The canonical store state machine over an `AuthStoreBackend`. Operations are\n * serialized through an internal semaphore, so the exactly-once consume\n * guarantees hold even when the backend's reads and writes suspend. Runtimes\n * that already serialize requests (a Durable Object's input gates) get a\n * second, redundant layer of protection.\n */\nconst makeBackendAuthStore = Effect.gen(function* () {\n  const backend = yield* AuthStoreBackend;\n  const semaphore = yield* Semaphore.make(1);\n  const serialized = semaphore.withPermits(1);\n\n  const read = <Row, DecodeError>(\n    key: string,\n    decode: (value: unknown) => Effect.Effect<Row, DecodeError>,\n  ): Effect.Effect<Row | undefined, AuthStoreError> =>\n    backend.get(key).pipe(\n      Effect.mapError(() => AuthStoreError.make({ message: \"Auth store read failed\" })),\n      Effect.flatMap((value) =>\n        value === undefined\n          ? // The absent row is a meaningful result, not a discarded void.\n            // @effect-diagnostics-next-line effectSucceedWithVoid:off\n            Effect.succeed(undefined)\n          : decode(value).pipe(\n              Effect.mapError(() => AuthStoreError.make({ message: \"Corrupt auth store row\" })),\n            ),\n      ),\n    );\n\n  const write = <Row, EncodeError>(\n    key: string,\n    encode: (row: Row) => Effect.Effect<unknown, EncodeError>,\n    row: Row,\n  ): Effect.Effect<void, AuthStoreError> =>\n    encode(row).pipe(\n      Effect.mapError(() => AuthStoreError.make({ message: \"Auth store write failed\" })),\n      Effect.flatMap((value) =>\n        backend\n          .put(key, value)\n          .pipe(Effect.mapError(() => AuthStoreError.make({ message: \"Auth store write failed\" }))),\n      ),\n    );\n\n  const issueChallenge = Effect.fn(\"AuthStore.issueChallenge\")(function* (input: NewChallenge) {\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n    const existing = yield* read(challengeKey(input.tokenDigest), decodeChallengeRow);\n\n    // An issuance is immutable; a retry must not reset its terminal state.\n    if (existing !== undefined) {\n      return yield* AuthRateLimited.make({ retryAfterSeconds: 1 });\n    }\n\n    const key = seriesKey(input.purpose, input.email);\n    const series = yield* read(key, decodeSeriesRow);\n    const cooldownMillis = Duration.toMillis(input.resendCooldown);\n\n    if (series !== undefined) {\n      const lastIssuedAt = DateTime.toEpochMillis(series.lastIssuedAt);\n\n      if (now < lastIssuedAt + cooldownMillis) {\n        return yield* AuthRateLimited.make({\n          retryAfterSeconds: Math.ceil((lastIssuedAt + cooldownMillis - now) / 1000),\n        });\n      }\n      if (series.activeChallengeKey !== undefined) {\n        const active = yield* read(series.activeChallengeKey, decodeChallengeRow);\n\n        if (active !== undefined && !active.superseded) {\n          yield* write(\n            series.activeChallengeKey,\n            encodeChallengeRow,\n            StoredChallenge.make({ ...active, superseded: true }),\n          );\n        }\n      }\n    }\n\n    // The rolling wrong-code budget survives resends and only resets once\n    // the previous window has fully expired.\n    const rollingAttempts =\n      series !== undefined && now < DateTime.toEpochMillis(series.windowExpiresAt)\n        ? series.rollingAttempts\n        : 0;\n\n    yield* write(\n      challengeKey(input.tokenDigest),\n      encodeChallengeRow,\n      StoredChallenge.make({ challenge: input, consumed: false, superseded: false }),\n    );\n    yield* write(\n      key,\n      encodeSeriesRow,\n      StoredEmailSeries.make({\n        activeChallengeKey: challengeKey(input.tokenDigest),\n        lastIssuedAt: yield* DateTime.now,\n        rollingAttempts,\n        windowExpiresAt: input.expiresAt,\n      }),\n    );\n  });\n\n  const consumeChallenge = Effect.fn(\"AuthStore.consumeChallenge\")(function* (\n    input: ConsumeChallenge,\n  ) {\n    const reject = (reason: typeof EmailOtpRejectionReason.Type) =>\n      EmailOtpRejected.make({ reason });\n\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n    const row = yield* read(challengeKey(input.tokenDigest), decodeChallengeRow);\n\n    if (row === undefined) {\n      return yield* reject(\"missing_challenge\");\n    }\n    const key = seriesKey(row.challenge.purpose, row.challenge.email);\n    const series = yield* read(key, decodeSeriesRow);\n\n    if (row.consumed) return yield* reject(\"consumed_challenge\");\n    if (row.superseded) return yield* reject(\"superseded_challenge\");\n    if (now >= DateTime.toEpochMillis(row.challenge.expiresAt)) {\n      return yield* reject(\"expired_challenge\");\n    }\n    if (series === undefined) return yield* reject(\"missing_challenge_series\");\n    if (series.rollingAttempts >= row.challenge.attemptLimit) {\n      return yield* reject(\"attempts_exhausted\");\n    }\n    const candidate = input.otpDigests[row.challenge.otpKeyId];\n\n    const matches =\n      candidate !== undefined && timingSafeStringEqual(candidate, row.challenge.otpDigest);\n\n    if (!matches) {\n      yield* write(\n        key,\n        encodeSeriesRow,\n        StoredEmailSeries.make({ ...series, rollingAttempts: series.rollingAttempts + 1 }),\n      );\n\n      return yield* reject(\"bad_code\");\n    }\n    yield* write(\n      challengeKey(input.tokenDigest),\n      encodeChallengeRow,\n      StoredChallenge.make({ ...row, consumed: true }),\n    );\n    yield* backend\n      .remove(key)\n      .pipe(Effect.mapError(() => AuthStoreError.make({ message: \"Auth store write failed\" })));\n\n    return VerifiedEmail.make({\n      email: row.challenge.email,\n      purpose: row.challenge.purpose,\n    });\n  });\n\n  const issueRegistration = Effect.fn(\"AuthStore.issueRegistration\")(function* (\n    input: NewRegistration,\n  ) {\n    yield* write(\n      registrationKey(input.tokenDigest),\n      encodeRegistrationRow,\n      StoredRegistration.make({ registration: input, consumed: false }),\n    );\n  });\n\n  const inspectRegistration = Effect.fn(\"AuthStore.inspectRegistration\")(function* (\n    tokenDigest: TokenDigest,\n  ) {\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n    const row = yield* read(registrationKey(tokenDigest), decodeRegistrationRow);\n\n    if (\n      row === undefined ||\n      row.consumed ||\n      now >= DateTime.toEpochMillis(row.registration.expiresAt)\n    ) {\n      return yield* InvalidRegistration.make();\n    }\n\n    return PendingRegistration.make({\n      registrationId: row.registration.registrationId,\n      email: row.registration.email,\n      purpose: row.registration.purpose,\n      issuedAt: row.registration.issuedAt,\n      expiresAt: row.registration.expiresAt,\n    });\n  });\n\n  const consumeRegistration = Effect.fn(\"AuthStore.consumeRegistration\")(function* (\n    input: ConsumeRegistration,\n  ) {\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n    const row = yield* read(registrationKey(input.tokenDigest), decodeRegistrationRow);\n\n    if (\n      row === undefined ||\n      row.consumed ||\n      now >= DateTime.toEpochMillis(row.registration.expiresAt)\n    ) {\n      return yield* InvalidRegistration.make();\n    }\n    yield* write(\n      registrationKey(input.tokenDigest),\n      encodeRegistrationRow,\n      StoredRegistration.make({ ...row, consumed: true }),\n    );\n  });\n\n  return {\n    issueChallenge: (input: NewChallenge) => serialized(issueChallenge(input)),\n    consumeChallenge: (input: ConsumeChallenge) => serialized(consumeChallenge(input)),\n    issueRegistration: (input: NewRegistration) => serialized(issueRegistration(input)),\n    inspectRegistration: (tokenDigest: TokenDigest) => serialized(inspectRegistration(tokenDigest)),\n    consumeRegistration: (input: ConsumeRegistration) => serialized(consumeRegistration(input)),\n  };\n});\n\n/**\n * Semantic persistence port for challenges and pending registrations, not\n * CRUD. The consume operations must be atomic: exactly one of concurrent\n * valid consumptions may succeed. Per-challenge attempts, resend cooldown,\n * and email-scoped issuance limits live behind this contract; IP/network\n * limits stay at the edge.\n *\n * Adapters either implement this interface directly against a store with real\n * transactions, or provide an `AuthStoreBackend` to `layerBackend`. Either\n * way, the conformance suite exported from `effect-auth/Testing` is the\n * acceptance test.\n */\nexport class AuthStore extends Context.Service<\n  AuthStore,\n  {\n    readonly issueChallenge: (input: NewChallenge) => Effect.Effect<void, IssueChallengeError>;\n    /**\n     * Checks token digest, OTP digest, purpose, expiry, supersession,\n     * consumption, and attempt budget as one atomic operation. A failed\n     * comparison increments the rolling attempt budget; success consumes the\n     * challenge. The workflow logs the internal rejection reason, then\n     * collapses every failure to the public `InvalidEmailOtp`.\n     */\n    readonly consumeChallenge: (\n      input: ConsumeChallenge,\n    ) => Effect.Effect<VerifiedEmail, EmailOtpRejected | AuthStoreError>;\n    readonly issueRegistration: (input: NewRegistration) => Effect.Effect<void, AuthStoreError>;\n    readonly inspectRegistration: (\n      tokenDigest: TokenDigest,\n    ) => Effect.Effect<PendingRegistration, InvalidRegistration | AuthStoreError>;\n    readonly consumeRegistration: (\n      input: ConsumeRegistration,\n    ) => Effect.Effect<void, InvalidRegistration | AuthStoreError>;\n  }\n>()(\"effect-auth/AuthStore\") {\n  /** The canonical state machine over whichever `AuthStoreBackend` is provided. */\n  static readonly layerBackend: Layer.Layer<AuthStore, never, AuthStoreBackend> =\n    Layer.effect(AuthStore)(makeBackendAuthStore);\n\n  /**\n   * In-memory adapter for tests and local development. Never a durable\n   * production adapter.\n   */\n  static readonly layerMemory: Layer.Layer<AuthStore> = AuthStore.layerBackend.pipe(\n    Layer.provide(AuthStoreBackend.layerMemory),\n  );\n}\n\nexport { AuthStoreDecisions, type ChallengeConsumeDecision } from \"./internal/AuthStoreDecisions\";\nexport type { ConsumeDecision } from \"./auth/ConsumeDecision\";\n"],"mappings":";;;;;AAgBA,MAAa,0BAA0B,OAAO,SAAS;CACrD;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAAC,oBAAoB,EAC/F,QAAQ,wBACV,CAAC,CAAC,CAAC,CAAC;;;;;;;;AASJ,IAAa,mBAAb,MAAa,yBAAyB,QAAQ,QAQ5C,CAAC,CAAC,8BAA8B,CAAC,CAAC;;CAElC,OAAgB,cAA6C,MAAM,KAAK,gBAAgB,CAAC,OAAO;EAC9F,MAAM,0BAAU,IAAI,IAAqB;EAEzC,OAAO,iBAAiB,GAAG;GACzB,MAAM,QAAQ,OAAO,WAAW,QAAQ,IAAI,GAAG,CAAC;GAChD,MAAM,KAAK,UACT,OAAO,WAAW;IAChB,QAAQ,IAAI,KAAK,KAAK;GACxB,CAAC;GACH,SAAS,QACP,OAAO,WAAW;IAChB,QAAQ,OAAO,GAAG;GACpB,CAAC;EACL,CAAC;CACH,CAAC;AACH;AAIA,IAAM,kBAAN,cAA8B,OAAO,MAAuB,6BAA6B,CAAC,CAAC;CACzF,WAAW;CACX,UAAU,OAAO;CACjB,YAAY,OAAO;AACrB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAM,oBAAN,cAAgC,OAAO,MAAyB,+BAA+B,CAAC,CAAC;CAC/F,oBAAoB,OAAO,YAAY,OAAO,MAAM;CACpD,cAAc,OAAO;CACrB,iBAAiB,OAAO;CACxB,iBAAiB,OAAO;AAC1B,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAM,qBAAN,cAAiC,OAAO,MAA0B,gCAAgC,CAAC,CACjG;CACE,cAAc;CACd,UAAU,OAAO;AACnB,CACF,CAAC,CAAC,CAAC;AAGH,MAAM,qBAAqB,OAAO,oBAAoB,eAAe;AACrE,MAAM,qBAAqB,OAAO,aAAa,eAAe;AAE9D,MAAM,kBAAkB,OAAO,oBAAoB,iBAAiB;AACpE,MAAM,kBAAkB,OAAO,aAAa,iBAAiB;AAE7D,MAAM,wBAAwB,OAAO,oBAAoB,kBAAkB;AAC3E,MAAM,wBAAwB,OAAO,aAAa,kBAAkB;AAEpE,MAAM,gBAAgB,gBAAwB,aAAa;AAC3D,MAAM,aAAa,SAAiB,UAAkB,UAAU,QAAQ,GAAG;AAC3E,MAAM,mBAAmB,gBAAwB,gBAAgB;;;;;;;;AASjE,MAAM,uBAAuB,OAAO,IAAI,aAAa;CACnD,MAAM,UAAU,OAAO;CAEvB,MAAM,cAAa,OADM,UAAU,KAAK,CAAC,EAAA,CACZ,YAAY,CAAC;CAE1C,MAAM,QACJ,KACA,WAEA,QAAQ,IAAI,GAAG,CAAC,CAAC,KACf,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC,CAAC,GAChF,OAAO,SAAS,UACd,UAAU,KAAA,IAGN,OAAO,QAAQ,KAAA,CAAS,IACxB,OAAO,KAAK,CAAC,CAAC,KACZ,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC,CAAC,CAClF,CACN,CACF;CAEF,MAAM,SACJ,KACA,QACA,QAEA,OAAO,GAAG,CAAC,CAAC,KACV,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC,CAAC,GACjF,OAAO,SAAS,UACd,QACG,IAAI,KAAK,KAAK,CAAC,CACf,KAAK,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC,CAAC,CAAC,CAC5F,CACF;CAEF,MAAM,iBAAiB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,OAAqB;EAC3F,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EAItD,KAAI,OAHoB,KAAK,aAAa,MAAM,WAAW,GAAG,kBAAkB,OAG/D,KAAA,GACf,OAAO,OAAO,gBAAgB,KAAK,EAAE,mBAAmB,EAAE,CAAC;EAG7D,MAAM,MAAM,UAAU,MAAM,SAAS,MAAM,KAAK;EAChD,MAAM,SAAS,OAAO,KAAK,KAAK,eAAe;EAC/C,MAAM,iBAAiB,SAAS,SAAS,MAAM,cAAc;EAE7D,IAAI,WAAW,KAAA,GAAW;GACxB,MAAM,eAAe,SAAS,cAAc,OAAO,YAAY;GAE/D,IAAI,MAAM,eAAe,gBACvB,OAAO,OAAO,gBAAgB,KAAK,EACjC,mBAAmB,KAAK,MAAM,eAAe,iBAAiB,OAAO,GAAI,EAC3E,CAAC;GAEH,IAAI,OAAO,uBAAuB,KAAA,GAAW;IAC3C,MAAM,SAAS,OAAO,KAAK,OAAO,oBAAoB,kBAAkB;IAExE,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,YAClC,OAAO,MACL,OAAO,oBACP,oBACA,gBAAgB,KAAK;KAAE,GAAG;KAAQ,YAAY;IAAK,CAAC,CACtD;GAEJ;EACF;EAIA,MAAM,kBACJ,WAAW,KAAA,KAAa,MAAM,SAAS,cAAc,OAAO,eAAe,IACvE,OAAO,kBACP;EAEN,OAAO,MACL,aAAa,MAAM,WAAW,GAC9B,oBACA,gBAAgB,KAAK;GAAE,WAAW;GAAO,UAAU;GAAO,YAAY;EAAM,CAAC,CAC/E;EACA,OAAO,MACL,KACA,iBACA,kBAAkB,KAAK;GACrB,oBAAoB,aAAa,MAAM,WAAW;GAClD,cAAc,OAAO,SAAS;GAC9B;GACA,iBAAiB,MAAM;EACzB,CAAC,CACH;CACF,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC/D,OACA;EACA,MAAM,UAAU,WACd,iBAAiB,KAAK,EAAE,OAAO,CAAC;EAElC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EACtD,MAAM,MAAM,OAAO,KAAK,aAAa,MAAM,WAAW,GAAG,kBAAkB;EAE3E,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,OAAO,mBAAmB;EAE1C,MAAM,MAAM,UAAU,IAAI,UAAU,SAAS,IAAI,UAAU,KAAK;EAChE,MAAM,SAAS,OAAO,KAAK,KAAK,eAAe;EAE/C,IAAI,IAAI,UAAU,OAAO,OAAO,OAAO,oBAAoB;EAC3D,IAAI,IAAI,YAAY,OAAO,OAAO,OAAO,sBAAsB;EAC/D,IAAI,OAAO,SAAS,cAAc,IAAI,UAAU,SAAS,GACvD,OAAO,OAAO,OAAO,mBAAmB;EAE1C,IAAI,WAAW,KAAA,GAAW,OAAO,OAAO,OAAO,0BAA0B;EACzE,IAAI,OAAO,mBAAmB,IAAI,UAAU,cAC1C,OAAO,OAAO,OAAO,oBAAoB;EAE3C,MAAM,YAAY,MAAM,WAAW,IAAI,UAAU;EAKjD,IAAI,EAFF,cAAc,KAAA,KAAa,sBAAsB,WAAW,IAAI,UAAU,SAAS,IAEvE;GACZ,OAAO,MACL,KACA,iBACA,kBAAkB,KAAK;IAAE,GAAG;IAAQ,iBAAiB,OAAO,kBAAkB;GAAE,CAAC,CACnF;GAEA,OAAO,OAAO,OAAO,UAAU;EACjC;EACA,OAAO,MACL,aAAa,MAAM,WAAW,GAC9B,oBACA,gBAAgB,KAAK;GAAE,GAAG;GAAK,UAAU;EAAK,CAAC,CACjD;EACA,OAAO,QACJ,OAAO,GAAG,CAAC,CACX,KAAK,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC,CAAC,CAAC;EAE1F,OAAO,cAAc,KAAK;GACxB,OAAO,IAAI,UAAU;GACrB,SAAS,IAAI,UAAU;EACzB,CAAC;CACH,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACjE,OACA;EACA,OAAO,MACL,gBAAgB,MAAM,WAAW,GACjC,uBACA,mBAAmB,KAAK;GAAE,cAAc;GAAO,UAAU;EAAM,CAAC,CAClE;CACF,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACrE,aACA;EACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EACtD,MAAM,MAAM,OAAO,KAAK,gBAAgB,WAAW,GAAG,qBAAqB;EAE3E,IACE,QAAQ,KAAA,KACR,IAAI,YACJ,OAAO,SAAS,cAAc,IAAI,aAAa,SAAS,GAExD,OAAO,OAAO,oBAAoB,KAAK;EAGzC,OAAO,oBAAoB,KAAK;GAC9B,gBAAgB,IAAI,aAAa;GACjC,OAAO,IAAI,aAAa;GACxB,SAAS,IAAI,aAAa;GAC1B,UAAU,IAAI,aAAa;GAC3B,WAAW,IAAI,aAAa;EAC9B,CAAC;CACH,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACrE,OACA;EACA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EACtD,MAAM,MAAM,OAAO,KAAK,gBAAgB,MAAM,WAAW,GAAG,qBAAqB;EAEjF,IACE,QAAQ,KAAA,KACR,IAAI,YACJ,OAAO,SAAS,cAAc,IAAI,aAAa,SAAS,GAExD,OAAO,OAAO,oBAAoB,KAAK;EAEzC,OAAO,MACL,gBAAgB,MAAM,WAAW,GACjC,uBACA,mBAAmB,KAAK;GAAE,GAAG;GAAK,UAAU;EAAK,CAAC,CACpD;CACF,CAAC;CAED,OAAO;EACL,iBAAiB,UAAwB,WAAW,eAAe,KAAK,CAAC;EACzE,mBAAmB,UAA4B,WAAW,iBAAiB,KAAK,CAAC;EACjF,oBAAoB,UAA2B,WAAW,kBAAkB,KAAK,CAAC;EAClF,sBAAsB,gBAA6B,WAAW,oBAAoB,WAAW,CAAC;EAC9F,sBAAsB,UAA+B,WAAW,oBAAoB,KAAK,CAAC;CAC5F;AACF,CAAC;;;;;;;;;;;;;AAcD,IAAa,YAAb,MAAa,kBAAkB,QAAQ,QAsBrC,CAAC,CAAC,uBAAuB,CAAC,CAAC;;CAE3B,OAAgB,eACd,MAAM,OAAO,SAAS,CAAC,CAAC,oBAAoB;;;;;CAM9C,OAAgB,cAAsC,UAAU,aAAa,KAC3E,MAAM,QAAQ,iBAAiB,WAAW,CAC5C;AACF"}

package/dist/AuthTokenCodec.d.mts

@@ -0,0 +1,40 @@
+import { KeyId, KeyedDigest, SessionClaims, SessionToken, TokenDigest } from "./Schema.mjs";
+import { AuthTokenError, InvalidSession } from "./Errors.mjs";
+import { Context, Crypto, Effect, Layer, Redacted } from "effect";
+//#region src/AuthTokenCodec.d.ts
+declare const AuthKeyring_base: Context.ServiceClass<AuthKeyring, "effect-auth/AuthKeyring", {
+  readonly activeKeyId: KeyId;
+  readonly keys: ReadonlyArray<{
+    readonly keyId: KeyId;
+    readonly secret: Redacted.Redacted<string>;
+  }>;
+}>;
+/**
+ * HMAC keyring: one active signing key plus verification keys retained until
+ * their sessions expire. Every secret must hold at least 256 random bits.
+ */
+declare class AuthKeyring extends AuthKeyring_base {}
+interface AuthTokenCodecService {
+  readonly activeKeyId: KeyId;
+  /** Active key first, then verification-only keys. */
+  readonly keyIds: ReadonlyArray<KeyId>;
+  readonly encodeSession: (claims: SessionClaims) => Effect.Effect<SessionToken, AuthTokenError>;
+  /** Checks format, key id, and signature. Time and policy checks belong to `AuthSession`. */
+  readonly decodeSession: (token: Redacted.Redacted<string>) => Effect.Effect<SessionClaims, InvalidSession | AuthTokenError>;
+  /** Unkeyed digest for high-entropy tokens; stable across key rotation. */
+  readonly digestToken: (token: Redacted.Redacted<string>, scope: string) => Effect.Effect<TokenDigest, AuthTokenError>;
+  /** Keyed digest for low-entropy secrets, scoped so digests cannot be transplanted. */
+  readonly digestSecret: (value: Redacted.Redacted<string>, scope: string, keyId?: KeyId) => Effect.Effect<KeyedDigest, AuthTokenError>;
+}
+declare const AuthTokenCodec_base: Context.ServiceClass<AuthTokenCodec, "effect-auth/AuthTokenCodec", AuthTokenCodecService>;
+declare class AuthTokenCodec extends AuthTokenCodec_base {
+  /**
+   * Default HMAC implementation backed by WebCrypto. The consumer may replace
+   * it with its own codec service.
+   */
+  static readonly layerWebCrypto: Layer.Layer<AuthTokenCodec, AuthTokenError, AuthKeyring | Crypto.Crypto>;
+  static readonly layer: Layer.Layer<AuthTokenCodec, AuthTokenError, AuthKeyring | Crypto.Crypto>;
+}
+//#endregion
+export { AuthKeyring, AuthTokenCodec, AuthTokenCodecService };
+//# sourceMappingURL=AuthTokenCodec.d.mts.map

package/dist/AuthTokenCodec.mjs

@@ -0,0 +1,104 @@
+import { KeyedDigest, OtpDigest, SessionClaims, SessionToken, TokenDigest } from "./Schema.mjs";
+import { SubtleCrypto } from "./WebCrypto.mjs";
+import { AuthTokenError, InvalidSession } from "./Errors.mjs";
+import { Context, Crypto, Effect, Encoding, Layer, Redacted, Result, Schema } from "effect";
+//#region src/AuthTokenCodec.ts
+/**
+* HMAC keyring: one active signing key plus verification keys retained until
+* their sessions expire. Every secret must hold at least 256 random bits.
+*/
+var AuthKeyring = class extends Context.Service()("effect-auth/AuthKeyring") {};
+const envelopeVersion = "eav1";
+const textEncoder = new TextEncoder();
+const SessionClaimsJson = Schema.fromJsonString(SessionClaims);
+const encodeClaimsJson = Schema.encodeEffect(SessionClaimsJson);
+const decodeClaimsJson = Schema.decodeEffect(SessionClaimsJson);
+const tokenDigestFromString = Schema.decodeEffect(TokenDigest);
+const otpDigestFromString = Schema.decodeEffect(OtpDigest);
+const sessionTokenFromString = Schema.decodeEffect(SessionToken);
+/**
+* Default HMAC-SHA-256 codec on WebCrypto. Signing keys never leave the
+* runtime's key store; secure random bytes come from `Crypto.Crypto`.
+*/
+const makeWebCryptoCodec = Effect.gen(function* () {
+	const keyring = yield* AuthKeyring;
+	const crypto = yield* Crypto.Crypto;
+	const subtle = yield* SubtleCrypto;
+	if (!keyring.keys.some((key) => key.keyId === keyring.activeKeyId)) return yield* AuthTokenError.make({ message: "Keyring does not contain the active signing key" });
+	const importKey = (secret) => Effect.tryPromise({
+		try: () => subtle.importKey("raw", textEncoder.encode(Redacted.value(secret)), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]),
+		catch: () => AuthTokenError.make({ message: "Failed to import HMAC key" })
+	});
+	const keys = /* @__PURE__ */ new Map();
+	for (const entry of keyring.keys) keys.set(entry.keyId, yield* importKey(entry.secret));
+	const hmac = (keyId, data) => Effect.gen(function* () {
+		const key = keys.get(keyId);
+		if (key === void 0) return yield* AuthTokenError.make({ message: "Unknown key id" });
+		const signature = yield* Effect.tryPromise({
+			try: () => subtle.sign("HMAC", key, data),
+			catch: () => AuthTokenError.make({ message: "HMAC signing failed" })
+		});
+		return new Uint8Array(signature);
+	});
+	const hmacVerify = (keyId, data, signature) => Effect.gen(function* () {
+		const key = keys.get(keyId);
+		if (key === void 0) return false;
+		return yield* Effect.tryPromise({
+			try: () => subtle.verify("HMAC", key, signature, data),
+			catch: () => AuthTokenError.make({ message: "HMAC verification failed" })
+		});
+	});
+	return {
+		activeKeyId: keyring.activeKeyId,
+		keyIds: [keyring.activeKeyId, ...keyring.keys.map((key) => key.keyId).filter((id) => id !== keyring.activeKeyId)],
+		encodeSession: Effect.fn("AuthTokenCodec.encodeSession")(function* (claims) {
+			const encoded = yield* encodeClaimsJson(claims).pipe(Effect.mapError(() => AuthTokenError.make({ message: "Session claims failed to encode" })));
+			const payload = Encoding.encodeBase64Url(encoded);
+			const signingInput = `${envelopeVersion}.${payload}`;
+			const signature = yield* hmac(claims.kid, textEncoder.encode(signingInput));
+			const token = `${signingInput}.${Encoding.encodeBase64Url(signature)}`;
+			return yield* sessionTokenFromString(token).pipe(Effect.mapError(() => AuthTokenError.make({ message: "Session token failed to encode" })));
+		}),
+		decodeSession: Effect.fn("AuthTokenCodec.decodeSession")(function* (token) {
+			const [version, payloadPart, signaturePart, ...rest] = Redacted.value(token).split(".");
+			if (version !== envelopeVersion || payloadPart === void 0 || signaturePart === void 0 || rest.length > 0) return yield* InvalidSession.make();
+			const payloadJson = Result.getOrUndefined(Encoding.decodeBase64UrlString(payloadPart));
+			const signature = Result.getOrUndefined(Encoding.decodeBase64Url(signaturePart));
+			if (payloadJson === void 0 || signature === void 0) return yield* InvalidSession.make();
+			const claims = yield* decodeClaimsJson(payloadJson).pipe(Effect.mapError(() => InvalidSession.make()));
+			const signingInput = `${envelopeVersion}.${payloadPart}`;
+			if (!(yield* hmacVerify(claims.kid, textEncoder.encode(signingInput), signature))) return yield* InvalidSession.make();
+			return claims;
+		}),
+		digestToken: Effect.fn("AuthTokenCodec.digestToken")(function* (token, scope) {
+			const data = textEncoder.encode(`${scope}\n${Redacted.value(token)}`);
+			const digest = yield* crypto.digest("SHA-256", data).pipe(Effect.mapError(() => AuthTokenError.make({ message: "Token digest failed" })));
+			return yield* tokenDigestFromString(Encoding.encodeBase64Url(digest)).pipe(Effect.mapError(() => AuthTokenError.make({ message: "Token digest failed to encode" })));
+		}),
+		digestSecret: Effect.fn("AuthTokenCodec.digestSecret")(function* (value, scope, keyId) {
+			const resolvedKeyId = keyId ?? keyring.activeKeyId;
+			const data = textEncoder.encode(`${scope}\n${Redacted.value(value)}`);
+			const digest = yield* hmac(resolvedKeyId, data);
+			const otpDigest = yield* otpDigestFromString(Encoding.encodeBase64Url(digest)).pipe(Effect.mapError(() => AuthTokenError.make({ message: "Secret digest failed to encode" })));
+			return KeyedDigest.make({
+				keyId: resolvedKeyId,
+				digest: otpDigest
+			});
+		})
+	};
+});
+var AuthTokenCodec = class AuthTokenCodec extends Context.Service()("effect-auth/AuthTokenCodec") {
+	/**
+	* Default HMAC implementation backed by WebCrypto. The consumer may replace
+	* it with its own codec service.
+	*/
+	static layerWebCrypto = Layer.effect(AuthTokenCodec)(makeWebCryptoCodec).pipe(Layer.provide(SubtleCrypto.layerWeb));
+	static layer = AuthTokenCodec.layerWebCrypto;
+};
+//#endregion
+export { AuthKeyring, AuthTokenCodec };
+
+//# sourceMappingURL=AuthTokenCodec.mjs.map

package/dist/AuthTokenCodec.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthTokenCodec.mjs","names":[],"sources":["../src/AuthTokenCodec.ts"],"sourcesContent":["import { Context, Crypto, Effect, Encoding, Layer, Redacted, Result, Schema } from \"effect\";\n\nimport { AuthTokenError, InvalidSession } from \"./Errors\";\nimport {\n  KeyedDigest,\n  type KeyId,\n  OtpDigest,\n  SessionClaims,\n  SessionToken,\n  TokenDigest,\n} from \"./Schema\";\nimport { SubtleCrypto } from \"./WebCrypto\";\n\n/**\n * HMAC keyring: one active signing key plus verification keys retained until\n * their sessions expire. Every secret must hold at least 256 random bits.\n */\nexport class AuthKeyring extends Context.Service<\n  AuthKeyring,\n  {\n    readonly activeKeyId: KeyId;\n    readonly keys: ReadonlyArray<{\n      readonly keyId: KeyId;\n      readonly secret: Redacted.Redacted<string>;\n    }>;\n  }\n>()(\"effect-auth/AuthKeyring\") {}\n\nexport interface AuthTokenCodecService {\n  readonly activeKeyId: KeyId;\n  /** Active key first, then verification-only keys. */\n  readonly keyIds: ReadonlyArray<KeyId>;\n  readonly encodeSession: (claims: SessionClaims) => Effect.Effect<SessionToken, AuthTokenError>;\n  /** Checks format, key id, and signature. Time and policy checks belong to `AuthSession`. */\n  readonly decodeSession: (\n    token: Redacted.Redacted<string>,\n  ) => Effect.Effect<SessionClaims, InvalidSession | AuthTokenError>;\n  /** Unkeyed digest for high-entropy tokens; stable across key rotation. */\n  readonly digestToken: (\n    token: Redacted.Redacted<string>,\n    scope: string,\n  ) => Effect.Effect<TokenDigest, AuthTokenError>;\n  /** Keyed digest for low-entropy secrets, scoped so digests cannot be transplanted. */\n  readonly digestSecret: (\n    value: Redacted.Redacted<string>,\n    scope: string,\n    keyId?: KeyId,\n  ) => Effect.Effect<KeyedDigest, AuthTokenError>;\n}\n\nconst envelopeVersion = \"eav1\";\nconst textEncoder = new TextEncoder();\n\n// One JSON-string codec owns the token payload text, both directions. Plain\n// `fromJsonString` (no `toCodecJson`): the opaque `ext` claims slot keeps\n// native `JSON.stringify` semantics.\nconst SessionClaimsJson = Schema.fromJsonString(SessionClaims);\nconst encodeClaimsJson = Schema.encodeEffect(SessionClaimsJson);\nconst decodeClaimsJson = Schema.decodeEffect(SessionClaimsJson);\nconst tokenDigestFromString = Schema.decodeEffect(TokenDigest);\nconst otpDigestFromString = Schema.decodeEffect(OtpDigest);\nconst sessionTokenFromString = Schema.decodeEffect(SessionToken);\n\n/**\n * Default HMAC-SHA-256 codec on WebCrypto. Signing keys never leave the\n * runtime's key store; secure random bytes come from `Crypto.Crypto`.\n */\nconst makeWebCryptoCodec: Effect.Effect<\n  AuthTokenCodecService,\n  AuthTokenError,\n  AuthKeyring | Crypto.Crypto | SubtleCrypto\n> = Effect.gen(function* () {\n  const keyring = yield* AuthKeyring;\n  const crypto = yield* Crypto.Crypto;\n  const subtle = yield* SubtleCrypto;\n\n  if (!keyring.keys.some((key) => key.keyId === keyring.activeKeyId)) {\n    return yield* AuthTokenError.make({\n      message: \"Keyring does not contain the active signing key\",\n    });\n  }\n\n  const importKey = (secret: Redacted.Redacted<string>) =>\n    Effect.tryPromise({\n      try: () =>\n        subtle.importKey(\n          \"raw\",\n          textEncoder.encode(Redacted.value(secret)),\n          { name: \"HMAC\", hash: \"SHA-256\" },\n          false,\n          [\"sign\", \"verify\"],\n        ),\n      catch: () => AuthTokenError.make({ message: \"Failed to import HMAC key\" }),\n    });\n\n  const keys = new Map<KeyId, CryptoKey>();\n\n  for (const entry of keyring.keys) {\n    keys.set(entry.keyId, yield* importKey(entry.secret));\n  }\n\n  const hmac = (keyId: KeyId, data: Uint8Array) =>\n    Effect.gen(function* () {\n      const key = keys.get(keyId);\n\n      if (key === undefined) {\n        return yield* AuthTokenError.make({ message: \"Unknown key id\" });\n      }\n\n      const signature = yield* Effect.tryPromise({\n        try: () => subtle.sign(\"HMAC\", key, data as BufferSource),\n        catch: () => AuthTokenError.make({ message: \"HMAC signing failed\" }),\n      });\n\n      return new Uint8Array(signature);\n    });\n\n  const hmacVerify = (keyId: KeyId, data: Uint8Array, signature: Uint8Array) =>\n    Effect.gen(function* () {\n      const key = keys.get(keyId);\n\n      if (key === undefined) {\n        return false;\n      }\n\n      return yield* Effect.tryPromise({\n        try: () => subtle.verify(\"HMAC\", key, signature as BufferSource, data as BufferSource),\n        catch: () => AuthTokenError.make({ message: \"HMAC verification failed\" }),\n      });\n    });\n\n  return {\n    activeKeyId: keyring.activeKeyId,\n    keyIds: [\n      keyring.activeKeyId,\n      ...keyring.keys.map((key) => key.keyId).filter((id) => id !== keyring.activeKeyId),\n    ],\n\n    encodeSession: Effect.fn(\"AuthTokenCodec.encodeSession\")(function* (claims) {\n      const encoded = yield* encodeClaimsJson(claims).pipe(\n        Effect.mapError(() => AuthTokenError.make({ message: \"Session claims failed to encode\" })),\n      );\n\n      const payload = Encoding.encodeBase64Url(encoded);\n      const signingInput = `${envelopeVersion}.${payload}`;\n      const signature = yield* hmac(claims.kid, textEncoder.encode(signingInput));\n      const token = `${signingInput}.${Encoding.encodeBase64Url(signature)}`;\n\n      return yield* sessionTokenFromString(token).pipe(\n        Effect.mapError(() => AuthTokenError.make({ message: \"Session token failed to encode\" })),\n      );\n    }),\n\n    decodeSession: Effect.fn(\"AuthTokenCodec.decodeSession\")(function* (token) {\n      const [version, payloadPart, signaturePart, ...rest] = Redacted.value(token).split(\".\");\n\n      if (\n        version !== envelopeVersion ||\n        payloadPart === undefined ||\n        signaturePart === undefined ||\n        rest.length > 0\n      ) {\n        return yield* InvalidSession.make();\n      }\n      const payloadJson = Result.getOrUndefined(Encoding.decodeBase64UrlString(payloadPart));\n      const signature = Result.getOrUndefined(Encoding.decodeBase64Url(signaturePart));\n\n      if (payloadJson === undefined || signature === undefined) {\n        return yield* InvalidSession.make();\n      }\n\n      const claims = yield* decodeClaimsJson(payloadJson).pipe(\n        Effect.mapError(() => InvalidSession.make()),\n      );\n\n      const signingInput = `${envelopeVersion}.${payloadPart}`;\n      const valid = yield* hmacVerify(claims.kid, textEncoder.encode(signingInput), signature);\n\n      if (!valid) {\n        return yield* InvalidSession.make();\n      }\n\n      return claims;\n    }),\n\n    digestToken: Effect.fn(\"AuthTokenCodec.digestToken\")(function* (token, scope) {\n      const data = textEncoder.encode(`${scope}\\n${Redacted.value(token)}`);\n\n      const digest = yield* crypto\n        .digest(\"SHA-256\", data)\n        .pipe(Effect.mapError(() => AuthTokenError.make({ message: \"Token digest failed\" })));\n\n      return yield* tokenDigestFromString(Encoding.encodeBase64Url(digest)).pipe(\n        Effect.mapError(() => AuthTokenError.make({ message: \"Token digest failed to encode\" })),\n      );\n    }),\n\n    digestSecret: Effect.fn(\"AuthTokenCodec.digestSecret\")(function* (value, scope, keyId) {\n      const resolvedKeyId = keyId ?? keyring.activeKeyId;\n      const data = textEncoder.encode(`${scope}\\n${Redacted.value(value)}`);\n      const digest = yield* hmac(resolvedKeyId, data);\n\n      const otpDigest = yield* otpDigestFromString(Encoding.encodeBase64Url(digest)).pipe(\n        Effect.mapError(() => AuthTokenError.make({ message: \"Secret digest failed to encode\" })),\n      );\n\n      return KeyedDigest.make({ keyId: resolvedKeyId, digest: otpDigest });\n    }),\n  };\n});\n\nexport class AuthTokenCodec extends Context.Service<AuthTokenCodec, AuthTokenCodecService>()(\n  \"effect-auth/AuthTokenCodec\",\n) {\n  /**\n   * Default HMAC implementation backed by WebCrypto. The consumer may replace\n   * it with its own codec service.\n   */\n  static readonly layerWebCrypto: Layer.Layer<\n    AuthTokenCodec,\n    AuthTokenError,\n    AuthKeyring | Crypto.Crypto\n  > = Layer.effect(AuthTokenCodec)(makeWebCryptoCodec).pipe(Layer.provide(SubtleCrypto.layerWeb));\n\n  static readonly layer = AuthTokenCodec.layerWebCrypto;\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAa,cAAb,cAAiC,QAAQ,QASvC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAwBhC,MAAM,kBAAkB;AACxB,MAAM,cAAc,IAAI,YAAY;AAKpC,MAAM,oBAAoB,OAAO,eAAe,aAAa;AAC7D,MAAM,mBAAmB,OAAO,aAAa,iBAAiB;AAC9D,MAAM,mBAAmB,OAAO,aAAa,iBAAiB;AAC9D,MAAM,wBAAwB,OAAO,aAAa,WAAW;AAC7D,MAAM,sBAAsB,OAAO,aAAa,SAAS;AACzD,MAAM,yBAAyB,OAAO,aAAa,YAAY;;;;;AAM/D,MAAM,qBAIF,OAAO,IAAI,aAAa;CAC1B,MAAM,UAAU,OAAO;CACvB,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,SAAS,OAAO;CAEtB,IAAI,CAAC,QAAQ,KAAK,MAAM,QAAQ,IAAI,UAAU,QAAQ,WAAW,GAC/D,OAAO,OAAO,eAAe,KAAK,EAChC,SAAS,kDACX,CAAC;CAGH,MAAM,aAAa,WACjB,OAAO,WAAW;EAChB,WACE,OAAO,UACL,OACA,YAAY,OAAO,SAAS,MAAM,MAAM,CAAC,GACzC;GAAE,MAAM;GAAQ,MAAM;EAAU,GAChC,OACA,CAAC,QAAQ,QAAQ,CACnB;EACF,aAAa,eAAe,KAAK,EAAE,SAAS,4BAA4B,CAAC;CAC3E,CAAC;CAEH,MAAM,uBAAO,IAAI,IAAsB;CAEvC,KAAK,MAAM,SAAS,QAAQ,MAC1B,KAAK,IAAI,MAAM,OAAO,OAAO,UAAU,MAAM,MAAM,CAAC;CAGtD,MAAM,QAAQ,OAAc,SAC1B,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,KAAK,IAAI,KAAK;EAE1B,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,eAAe,KAAK,EAAE,SAAS,iBAAiB,CAAC;EAGjE,MAAM,YAAY,OAAO,OAAO,WAAW;GACzC,WAAW,OAAO,KAAK,QAAQ,KAAK,IAAoB;GACxD,aAAa,eAAe,KAAK,EAAE,SAAS,sBAAsB,CAAC;EACrE,CAAC;EAED,OAAO,IAAI,WAAW,SAAS;CACjC,CAAC;CAEH,MAAM,cAAc,OAAc,MAAkB,cAClD,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,KAAK,IAAI,KAAK;EAE1B,IAAI,QAAQ,KAAA,GACV,OAAO;EAGT,OAAO,OAAO,OAAO,WAAW;GAC9B,WAAW,OAAO,OAAO,QAAQ,KAAK,WAA2B,IAAoB;GACrF,aAAa,eAAe,KAAK,EAAE,SAAS,2BAA2B,CAAC;EAC1E,CAAC;CACH,CAAC;CAEH,OAAO;EACL,aAAa,QAAQ;EACrB,QAAQ,CACN,QAAQ,aACR,GAAG,QAAQ,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,QAAQ,OAAO,OAAO,QAAQ,WAAW,CACnF;EAEA,eAAe,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,QAAQ;GAC1E,MAAM,UAAU,OAAO,iBAAiB,MAAM,CAAC,CAAC,KAC9C,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,kCAAkC,CAAC,CAAC,CAC3F;GAEA,MAAM,UAAU,SAAS,gBAAgB,OAAO;GAChD,MAAM,eAAe,GAAG,gBAAgB,GAAG;GAC3C,MAAM,YAAY,OAAO,KAAK,OAAO,KAAK,YAAY,OAAO,YAAY,CAAC;GAC1E,MAAM,QAAQ,GAAG,aAAa,GAAG,SAAS,gBAAgB,SAAS;GAEnE,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC,KAC1C,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,iCAAiC,CAAC,CAAC,CAC1F;EACF,CAAC;EAED,eAAe,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,OAAO;GACzE,MAAM,CAAC,SAAS,aAAa,eAAe,GAAG,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG;GAEtF,IACE,YAAY,mBACZ,gBAAgB,KAAA,KAChB,kBAAkB,KAAA,KAClB,KAAK,SAAS,GAEd,OAAO,OAAO,eAAe,KAAK;GAEpC,MAAM,cAAc,OAAO,eAAe,SAAS,sBAAsB,WAAW,CAAC;GACrF,MAAM,YAAY,OAAO,eAAe,SAAS,gBAAgB,aAAa,CAAC;GAE/E,IAAI,gBAAgB,KAAA,KAAa,cAAc,KAAA,GAC7C,OAAO,OAAO,eAAe,KAAK;GAGpC,MAAM,SAAS,OAAO,iBAAiB,WAAW,CAAC,CAAC,KAClD,OAAO,eAAe,eAAe,KAAK,CAAC,CAC7C;GAEA,MAAM,eAAe,GAAG,gBAAgB,GAAG;GAG3C,IAAI,EAAC,OAFgB,WAAW,OAAO,KAAK,YAAY,OAAO,YAAY,GAAG,SAAS,IAGrF,OAAO,OAAO,eAAe,KAAK;GAGpC,OAAO;EACT,CAAC;EAED,aAAa,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAAO,OAAO;GAC5E,MAAM,OAAO,YAAY,OAAO,GAAG,MAAM,IAAI,SAAS,MAAM,KAAK,GAAG;GAEpE,MAAM,SAAS,OAAO,OACnB,OAAO,WAAW,IAAI,CAAC,CACvB,KAAK,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,sBAAsB,CAAC,CAAC,CAAC;GAEtF,OAAO,OAAO,sBAAsB,SAAS,gBAAgB,MAAM,CAAC,CAAC,CAAC,KACpE,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACzF;EACF,CAAC;EAED,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAAW,OAAO,OAAO,OAAO;GACrF,MAAM,gBAAgB,SAAS,QAAQ;GACvC,MAAM,OAAO,YAAY,OAAO,GAAG,MAAM,IAAI,SAAS,MAAM,KAAK,GAAG;GACpE,MAAM,SAAS,OAAO,KAAK,eAAe,IAAI;GAE9C,MAAM,YAAY,OAAO,oBAAoB,SAAS,gBAAgB,MAAM,CAAC,CAAC,CAAC,KAC7E,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,iCAAiC,CAAC,CAAC,CAC1F;GAEA,OAAO,YAAY,KAAK;IAAE,OAAO;IAAe,QAAQ;GAAU,CAAC;EACrE,CAAC;CACH;AACF,CAAC;AAED,IAAa,iBAAb,MAAa,uBAAuB,QAAQ,QAA+C,CAAC,CAC1F,4BACF,CAAC,CAAC;;;;;CAKA,OAAgB,iBAIZ,MAAM,OAAO,cAAc,CAAC,CAAC,kBAAkB,CAAC,CAAC,KAAK,MAAM,QAAQ,aAAa,QAAQ,CAAC;CAE9F,OAAgB,QAAQ,eAAe;AACzC"}

package/dist/Client.d.mts

@@ -0,0 +1,2 @@
+import { ActionArguments, ActionDecodeServices, AuthClient, ClientDefinition, ClientOptions, ClientService, make } from "./http-operation/auth-client.mjs";
+export { type ActionArguments, type ActionDecodeServices, type AuthClient, type ClientDefinition, type ClientOptions, type ClientService, make };

package/dist/Client.mjs

@@ -0,0 +1,2 @@
+import { make } from "./http-operation/auth-client.mjs";
+export { make };

package/dist/Cloudflare.d.mts

@@ -0,0 +1,89 @@
+import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, PendingRegistration, VerifiedEmail } from "./Schema.mjs";
+import { AuthRateLimited, InvalidRegistration } from "./Errors.mjs";
+import { AuthStore, EmailOtpRejected } from "./AuthStore.mjs";
+import { EmailOtpSender } from "./EmailOtpSender.mjs";
+import { Layer, Schema } from "effect";
+import { Binding, DurableObject, DurableObjectState, Email, Environment, Worker } from "effect-cf";
+import { OtlpExporter } from "effect/unstable/observability";
+//#region src/Cloudflare.d.ts
+declare const AuthStoreObject_base: DurableObject.TagClass<AuthStoreObject, "effect-auth/AuthStoreObject", {
+  readonly issueChallenge: DurableObject.Method<readonly [typeof NewChallenge], Schema.Union<readonly [Schema.Null, typeof AuthRateLimited]>>;
+  readonly consumeChallenge: DurableObject.Method<readonly [typeof ConsumeChallenge], Schema.Union<readonly [typeof VerifiedEmail, typeof EmailOtpRejected]>>;
+  readonly issueRegistration: DurableObject.Method<readonly [typeof NewRegistration], Schema.Null>;
+  readonly inspectRegistration: DurableObject.Method<readonly [Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">], Schema.Union<readonly [typeof PendingRegistration, typeof InvalidRegistration]>>;
+  readonly consumeRegistration: DurableObject.Method<readonly [typeof ConsumeRegistration], Schema.Union<readonly [Schema.Null, typeof InvalidRegistration]>>;
+}>;
+/**
+ * Typed RPC contract for the auth store Durable Object. A single named
+ * instance backs a deployment: auth traffic is low-rate, and one serialized
+ * object makes the store's exactly-once consume guarantees structural.
+ * Expected auth failures travel inside the success schemas; the worker-side
+ * client re-fails them.
+ */
+declare class AuthStoreObject extends AuthStoreObject_base {}
+/** Builds the auth store object with an application-owned OTLP telemetry layer. */
+declare const makeAuthStoreDurableObject: (telemetry: Layer.Layer<OtlpExporter.Flusher, never, DurableObjectState.DurableObjectState>) => DurableObject.DurableObjectClass<DurableObject.Handlers<AuthStore | OtlpExporter.Flusher, DurableObject.Definition<"effect-auth/AuthStoreObject", {
+  readonly issueChallenge: DurableObject.Method<readonly [typeof NewChallenge], Schema.Union<readonly [Schema.Null, typeof AuthRateLimited]>>;
+  readonly consumeChallenge: DurableObject.Method<readonly [typeof ConsumeChallenge], Schema.Union<readonly [typeof VerifiedEmail, typeof EmailOtpRejected]>>;
+  readonly issueRegistration: DurableObject.Method<readonly [typeof NewRegistration], Schema.Null>;
+  readonly inspectRegistration: DurableObject.Method<readonly [Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">], Schema.Union<readonly [typeof PendingRegistration, typeof InvalidRegistration]>>;
+  readonly consumeRegistration: DurableObject.Method<readonly [typeof ConsumeRegistration], Schema.Union<readonly [Schema.Null, typeof InvalidRegistration]>>;
+}>>, AuthStore | OtlpExporter.Flusher>;
+/**
+ * Worker-side `AuthStore` over the auth Durable Object binding. Swapping this
+ * layer for a different backing (Postgres, PlanetScale) is the intended
+ * migration path: implement the same `AuthStore` contract and rerun the
+ * conformance suite.
+ */
+declare const layerAuthStoreClient: Layer.Layer<AuthStore, never, AuthStoreObject>;
+/**
+ * Everything the worker needs for a Durable-Object-backed `AuthStore`: the
+ * client layer wired to the given binding. The binding name is an intrinsic
+ * deployment definition, matching the `durable_objects` entry in the wrangler
+ * configuration.
+ */
+declare const layerAuthStore: (options: {
+  readonly binding: string;
+}) => Layer.Layer<AuthStore, Binding.BindingNotFoundError | Binding.BindingValidationError, Environment.WorkerEnvironment>;
+declare const AuthEmail_base: Email.TagClass<AuthEmail, "effect-auth/AuthEmail">;
+/** Send Email binding used by {@link layerEmailOtpSender}. */
+declare class AuthEmail extends AuthEmail_base {}
+/** Input handed to a {@link layerEmailOtpSender} content renderer. */
+interface EmailOtpContentInput {
+  readonly code: string;
+  readonly minutesRemaining: number;
+}
+/** A rendered OTP message for {@link layerEmailOtpSender}. */
+interface EmailOtpContent {
+  readonly subject: string;
+  readonly text: string;
+  /** HTML alternative to `text`; clients that render HTML prefer it. */
+  readonly html?: string;
+  /** Attachments, e.g. `cid:`-referenced inline images used by `html`. */
+  readonly attachments?: ReadonlyArray<Email.EmailAttachment>;
+}
+/**
+ * `EmailOtpSender` over a Cloudflare Send Email binding. The consumer owns the
+ * sending domain (Email Routing must be configured for `from`); message
+ * wording can be overridden through `content`.
+ *
+ * Delivery runs past the response via `waitUntil`: the provider call is the
+ * slow part of an OTP request (routinely multiple seconds), and by the time
+ * the sender runs the challenge is already persisted, so the endpoint's 202
+ * honestly means "accepted". The trade is that a failed send can no longer
+ * surface to the caller; the structured delivery-failure log is the only
+ * signal.
+ */
+declare const layerEmailOtpSender: (options: {
+  /** `send_email` binding name from the wrangler configuration. */
+  readonly binding: string;
+  /**
+   * Verified sender address on a domain with Email Routing enabled. Pass an
+   * object to attach a display name.
+   */
+  readonly from: string | Email.EmailAddress;
+  readonly content?: (input: EmailOtpContentInput) => EmailOtpContent;
+}) => Layer.Layer<EmailOtpSender, Binding.BindingNotFoundError | Binding.BindingValidationError, Environment.WorkerEnvironment | Worker.WorkerContext>;
+//#endregion
+export { AuthEmail, AuthStoreObject, EmailOtpContent, EmailOtpContentInput, layerAuthStore, layerAuthStoreClient, layerEmailOtpSender, makeAuthStoreDurableObject };
+//# sourceMappingURL=Cloudflare.d.mts.map

package/dist/Cloudflare.mjs

@@ -0,0 +1,166 @@
+import { ConsumeChallenge, ConsumeRegistration, NewChallenge, NewRegistration, PendingRegistration, TokenDigest, VerifiedEmail } from "./Schema.mjs";
+import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "./Errors.mjs";
+import { AuthStore, AuthStoreBackend, EmailOtpRejected } from "./AuthStore.mjs";
+import { EmailOtpSender } from "./EmailOtpSender.mjs";
+import { DateTime, Duration, Effect, Layer, Redacted, Schema } from "effect";
+import { DurableObject, DurableObjectState, Email, Worker } from "effect-cf";
+//#region src/Cloudflare.ts
+/**
+* Typed RPC contract for the auth store Durable Object. A single named
+* instance backs a deployment: auth traffic is low-rate, and one serialized
+* object makes the store's exactly-once consume guarantees structural.
+* Expected auth failures travel inside the success schemas; the worker-side
+* client re-fails them.
+*/
+var AuthStoreObject = class extends DurableObject.Tag()("effect-auth/AuthStoreObject", {
+	issueChallenge: DurableObject.method({
+		args: [NewChallenge],
+		success: Schema.Union([Schema.Null, AuthRateLimited])
+	}),
+	consumeChallenge: DurableObject.method({
+		args: [ConsumeChallenge],
+		success: Schema.Union([VerifiedEmail, EmailOtpRejected])
+	}),
+	issueRegistration: DurableObject.method({
+		args: [NewRegistration],
+		success: Schema.Null
+	}),
+	inspectRegistration: DurableObject.method({
+		args: [TokenDigest],
+		success: Schema.Union([PendingRegistration, InvalidRegistration])
+	}),
+	consumeRegistration: DurableObject.method({
+		args: [ConsumeRegistration],
+		success: Schema.Union([Schema.Null, InvalidRegistration])
+	})
+}) {};
+/**
+* The canonical effect-auth store state machine over the object's own
+* storage. The Durable Object's input gates serialize requests; the machine
+* adds its own serialization on top, so exactly-once consumption holds
+* regardless. Export this class from the worker entry module and register it
+* under `durable_objects` in the wrangler configuration.
+*/
+const BackendLive = Layer.effect(AuthStoreBackend)(Effect.map(DurableObjectState.DurableObjectState, (state) => AuthStoreBackend.of({
+	get: (key) => state.storage.get(key).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Auth store storage failed" }))),
+	put: (key, value) => state.storage.put(key, value).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Auth store storage failed" }))),
+	remove: (key) => state.storage.delete(key).pipe(Effect.asVoid, Effect.mapError(() => AuthStoreError.make({ message: "Auth store storage failed" })))
+})));
+const AuthStoreLive = AuthStore.layerBackend.pipe(Layer.provide(BackendLive));
+const AuthStoreDurableObjectOptions = { rpc: {
+	issueChallenge: (input) => Effect.gen(function* () {
+		return yield* (yield* AuthStore).issueChallenge(input).pipe(Effect.as(null), Effect.catchTags({
+			AuthRateLimited: (error) => Effect.succeed(error),
+			AuthStoreError: Effect.die
+		}));
+	}),
+	consumeChallenge: (input) => Effect.gen(function* () {
+		return yield* (yield* AuthStore).consumeChallenge(input).pipe(Effect.catchTags({
+			EmailOtpRejected: (error) => Effect.succeed(error),
+			AuthStoreError: Effect.die
+		}));
+	}),
+	issueRegistration: (input) => Effect.gen(function* () {
+		yield* (yield* AuthStore).issueRegistration(input).pipe(Effect.catchTag("AuthStoreError", Effect.die));
+		return null;
+	}),
+	inspectRegistration: (tokenDigest) => Effect.gen(function* () {
+		return yield* (yield* AuthStore).inspectRegistration(tokenDigest).pipe(Effect.catchTags({
+			InvalidRegistration: (error) => Effect.succeed(error),
+			AuthStoreError: Effect.die
+		}));
+	}),
+	consumeRegistration: (input) => Effect.gen(function* () {
+		return yield* (yield* AuthStore).consumeRegistration(input).pipe(Effect.as(null), Effect.catchTags({
+			InvalidRegistration: (error) => Effect.succeed(error),
+			AuthStoreError: Effect.die
+		}));
+	})
+} };
+/** Builds the auth store object with an application-owned OTLP telemetry layer. */
+const makeAuthStoreDurableObject = (telemetry) => AuthStoreObject.make(Layer.merge(AuthStoreLive, telemetry), AuthStoreDurableObjectOptions);
+const clientUnavailable = () => AuthStoreError.unavailable;
+/**
+* Worker-side `AuthStore` over the auth Durable Object binding. Swapping this
+* layer for a different backing (Postgres, PlanetScale) is the intended
+* migration path: implement the same `AuthStore` contract and rerun the
+* conformance suite.
+*/
+const layerAuthStoreClient = Layer.effect(AuthStore)(Effect.map(AuthStoreObject, (objects) => {
+	const stub = objects.byName("primary");
+	return AuthStore.of({
+		issueChallenge: Effect.fn("AuthStoreObject.client.issueChallenge")(function* (input) {
+			const outcome = yield* stub.issueChallenge(input).pipe(Effect.mapError(clientUnavailable));
+			if (outcome !== null) return yield* outcome;
+		}),
+		consumeChallenge: Effect.fn("AuthStoreObject.client.consumeChallenge")(function* (input) {
+			const outcome = yield* stub.consumeChallenge(input).pipe(Effect.mapError(clientUnavailable));
+			if ("_tag" in outcome) return yield* outcome;
+			return outcome;
+		}),
+		issueRegistration: Effect.fn("AuthStoreObject.client.issueRegistration")(function* (input) {
+			yield* stub.issueRegistration(input).pipe(Effect.mapError(clientUnavailable));
+		}),
+		inspectRegistration: Effect.fn("AuthStoreObject.client.inspectRegistration")(function* (tokenDigest) {
+			const outcome = yield* stub.inspectRegistration(tokenDigest).pipe(Effect.mapError(clientUnavailable));
+			if ("_tag" in outcome) return yield* outcome;
+			return outcome;
+		}),
+		consumeRegistration: Effect.fn("AuthStoreObject.client.consumeRegistration")(function* (input) {
+			const outcome = yield* stub.consumeRegistration(input).pipe(Effect.mapError(clientUnavailable));
+			if (outcome !== null) return yield* outcome;
+		})
+	});
+}));
+/**
+* Everything the worker needs for a Durable-Object-backed `AuthStore`: the
+* client layer wired to the given binding. The binding name is an intrinsic
+* deployment definition, matching the `durable_objects` entry in the wrangler
+* configuration.
+*/
+const layerAuthStore = (options) => layerAuthStoreClient.pipe(Layer.provide(AuthStoreObject.layer({ binding: options.binding })));
+/** Send Email binding used by {@link layerEmailOtpSender}. */
+var AuthEmail = class extends Email.Tag()("effect-auth/AuthEmail") {};
+/**
+* `EmailOtpSender` over a Cloudflare Send Email binding. The consumer owns the
+* sending domain (Email Routing must be configured for `from`); message
+* wording can be overridden through `content`.
+*
+* Delivery runs past the response via `waitUntil`: the provider call is the
+* slow part of an OTP request (routinely multiple seconds), and by the time
+* the sender runs the challenge is already persisted, so the endpoint's 202
+* honestly means "accepted". The trade is that a failed send can no longer
+* surface to the caller; the structured delivery-failure log is the only
+* signal.
+*/
+const layerEmailOtpSender = (options) => Layer.effect(EmailOtpSender)(Effect.gen(function* () {
+	const email = yield* AuthEmail;
+	const context = yield* Worker.WorkerContext;
+	return EmailOtpSender.of({ send: Effect.fn("EmailOtpSender.sendEmail")(function* (message) {
+		const now = yield* DateTime.now;
+		const minutesRemaining = Math.max(1, Math.round(Duration.toMinutes(Duration.millis(DateTime.toEpochMillis(message.expiresAt) - DateTime.toEpochMillis(now)))));
+		const code = Redacted.value(message.code);
+		const rendered = options.content?.({
+			code,
+			minutesRemaining
+		}) ?? {
+			subject: "Your sign-in code",
+			text: `Your sign-in code is ${code}. It expires in ${minutesRemaining} minute${minutesRemaining === 1 ? "" : "s"}. If you did not request it, ignore this email.`
+		};
+		yield* context.waitUntil(email.send({
+			from: options.from,
+			to: message.email,
+			subject: rendered.subject,
+			text: rendered.text,
+			...rendered.html === void 0 ? {} : { html: rendered.html },
+			...rendered.attachments === void 0 ? {} : { attachments: [...rendered.attachments] }
+		}).pipe(Effect.asVoid, Effect.tapError((error) => Effect.logError("Sign-in code delivery failed", {
+			code: Reflect.get(error, "code"),
+			reason: String(Reflect.get(error, "cause") ?? error)
+		})), Effect.catch(() => Effect.void)));
+	}) });
+})).pipe(Layer.provide(AuthEmail.layer({ binding: options.binding })));
+//#endregion
+export { AuthEmail, AuthStoreObject, layerAuthStore, layerAuthStoreClient, layerEmailOtpSender, makeAuthStoreDurableObject };
+
+//# sourceMappingURL=Cloudflare.mjs.map

package/dist/Cloudflare.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cloudflare.mjs","names":[],"sources":["../src/Cloudflare.ts"],"sourcesContent":["import { DateTime, Duration, Effect, Layer, Redacted, Schema } from \"effect\";\nimport {\n  type Binding,\n  type Environment,\n  DurableObject,\n  DurableObjectState,\n  Email,\n  Worker,\n} from \"effect-cf\";\nimport type { OtlpExporter } from \"effect/unstable/observability\";\n\nimport { AuthStore, AuthStoreBackend, EmailOtpRejected } from \"./AuthStore\";\nimport { EmailOtpSender } from \"./EmailOtpSender\";\nimport { AuthRateLimited, AuthStoreError, InvalidRegistration } from \"./Errors\";\nimport {\n  type TokenDigest as TokenDigestType,\n  ConsumeChallenge,\n  ConsumeRegistration,\n  NewChallenge,\n  NewRegistration,\n  PendingRegistration,\n  TokenDigest,\n  VerifiedEmail,\n} from \"./Schema\";\n\n/**\n * Typed RPC contract for the auth store Durable Object. A single named\n * instance backs a deployment: auth traffic is low-rate, and one serialized\n * object makes the store's exactly-once consume guarantees structural.\n * Expected auth failures travel inside the success schemas; the worker-side\n * client re-fails them.\n */\nexport class AuthStoreObject extends DurableObject.Tag<AuthStoreObject>()(\n  \"effect-auth/AuthStoreObject\",\n  {\n    issueChallenge: DurableObject.method({\n      args: [NewChallenge],\n      success: Schema.Union([Schema.Null, AuthRateLimited]),\n    }),\n    consumeChallenge: DurableObject.method({\n      args: [ConsumeChallenge],\n      success: Schema.Union([VerifiedEmail, EmailOtpRejected]),\n    }),\n    issueRegistration: DurableObject.method({\n      args: [NewRegistration],\n      success: Schema.Null,\n    }),\n    inspectRegistration: DurableObject.method({\n      args: [TokenDigest],\n      success: Schema.Union([PendingRegistration, InvalidRegistration]),\n    }),\n    consumeRegistration: DurableObject.method({\n      args: [ConsumeRegistration],\n      success: Schema.Union([Schema.Null, InvalidRegistration]),\n    }),\n  },\n) {}\n\n/**\n * The canonical effect-auth store state machine over the object's own\n * storage. The Durable Object's input gates serialize requests; the machine\n * adds its own serialization on top, so exactly-once consumption holds\n * regardless. Export this class from the worker entry module and register it\n * under `durable_objects` in the wrangler configuration.\n */\nconst BackendLive = Layer.effect(AuthStoreBackend)(\n  Effect.map(DurableObjectState.DurableObjectState, (state) =>\n    AuthStoreBackend.of({\n      get: (key) =>\n        state.storage\n          .get(key)\n          .pipe(\n            Effect.mapError(() => AuthStoreError.make({ message: \"Auth store storage failed\" })),\n          ),\n      put: (key, value) =>\n        state.storage\n          .put(key, value)\n          .pipe(\n            Effect.mapError(() => AuthStoreError.make({ message: \"Auth store storage failed\" })),\n          ),\n      remove: (key) =>\n        state.storage.delete(key).pipe(\n          Effect.asVoid,\n          Effect.mapError(() => AuthStoreError.make({ message: \"Auth store storage failed\" })),\n        ),\n    }),\n  ),\n);\n\n// Expected auth failures travel inside the RPC success schemas; infrastructure\n// failures become defects and surface as transport errors on the caller side.\nconst AuthStoreLive = AuthStore.layerBackend.pipe(Layer.provide(BackendLive));\n\nconst AuthStoreDurableObjectOptions = {\n  rpc: {\n    issueChallenge: (input) =>\n      Effect.gen(function* () {\n        const store = yield* AuthStore;\n\n        return yield* store.issueChallenge(input).pipe(\n          Effect.as(null),\n          Effect.catchTags({\n            AuthRateLimited: (error) => Effect.succeed(error),\n            AuthStoreError: Effect.die,\n          }),\n        );\n      }),\n    consumeChallenge: (input) =>\n      Effect.gen(function* () {\n        const store = yield* AuthStore;\n\n        return yield* store.consumeChallenge(input).pipe(\n          Effect.catchTags({\n            EmailOtpRejected: (error) => Effect.succeed(error),\n            AuthStoreError: Effect.die,\n          }),\n        );\n      }),\n    issueRegistration: (input) =>\n      Effect.gen(function* () {\n        const store = yield* AuthStore;\n\n        yield* store.issueRegistration(input).pipe(Effect.catchTag(\"AuthStoreError\", Effect.die));\n\n        return null;\n      }),\n    inspectRegistration: (tokenDigest: TokenDigestType) =>\n      Effect.gen(function* () {\n        const store = yield* AuthStore;\n\n        return yield* store.inspectRegistration(tokenDigest).pipe(\n          Effect.catchTags({\n            InvalidRegistration: (error) => Effect.succeed(error),\n            AuthStoreError: Effect.die,\n          }),\n        );\n      }),\n    consumeRegistration: (input) =>\n      Effect.gen(function* () {\n        const store = yield* AuthStore;\n\n        return yield* store.consumeRegistration(input).pipe(\n          Effect.as(null),\n          Effect.catchTags({\n            InvalidRegistration: (error) => Effect.succeed(error),\n            AuthStoreError: Effect.die,\n          }),\n        );\n      }),\n  },\n} satisfies DurableObject.Options<AuthStore, typeof AuthStoreObject>;\n\n/** Builds the auth store object with an application-owned OTLP telemetry layer. */\nexport const makeAuthStoreDurableObject = (\n  telemetry: Layer.Layer<OtlpExporter.Flusher, never, DurableObjectState.DurableObjectState>,\n) => AuthStoreObject.make(Layer.merge(AuthStoreLive, telemetry), AuthStoreDurableObjectOptions);\n\nconst clientUnavailable = () => AuthStoreError.unavailable;\n\n/**\n * Worker-side `AuthStore` over the auth Durable Object binding. Swapping this\n * layer for a different backing (Postgres, PlanetScale) is the intended\n * migration path: implement the same `AuthStore` contract and rerun the\n * conformance suite.\n */\nexport const layerAuthStoreClient: Layer.Layer<AuthStore, never, AuthStoreObject> = Layer.effect(\n  AuthStore,\n)(\n  Effect.map(AuthStoreObject, (objects) => {\n    const stub = objects.byName(\"primary\");\n\n    return AuthStore.of({\n      issueChallenge: Effect.fn(\"AuthStoreObject.client.issueChallenge\")(function* (input) {\n        const outcome = yield* stub.issueChallenge(input).pipe(Effect.mapError(clientUnavailable));\n\n        if (outcome !== null) {\n          return yield* outcome;\n        }\n      }),\n      consumeChallenge: Effect.fn(\"AuthStoreObject.client.consumeChallenge\")(function* (input) {\n        const outcome = yield* stub\n          .consumeChallenge(input)\n          .pipe(Effect.mapError(clientUnavailable));\n\n        if (\"_tag\" in outcome) {\n          return yield* outcome;\n        }\n\n        return outcome;\n      }),\n      issueRegistration: Effect.fn(\"AuthStoreObject.client.issueRegistration\")(function* (input) {\n        yield* stub.issueRegistration(input).pipe(Effect.mapError(clientUnavailable));\n      }),\n      inspectRegistration: Effect.fn(\"AuthStoreObject.client.inspectRegistration\")(\n        function* (tokenDigest) {\n          const outcome = yield* stub\n            .inspectRegistration(tokenDigest)\n            .pipe(Effect.mapError(clientUnavailable));\n\n          if (\"_tag\" in outcome) {\n            return yield* outcome;\n          }\n\n          return outcome;\n        },\n      ),\n      consumeRegistration: Effect.fn(\"AuthStoreObject.client.consumeRegistration\")(\n        function* (input) {\n          const outcome = yield* stub\n            .consumeRegistration(input)\n            .pipe(Effect.mapError(clientUnavailable));\n\n          if (outcome !== null) {\n            return yield* outcome;\n          }\n        },\n      ),\n    });\n  }),\n);\n\n/**\n * Everything the worker needs for a Durable-Object-backed `AuthStore`: the\n * client layer wired to the given binding. The binding name is an intrinsic\n * deployment definition, matching the `durable_objects` entry in the wrangler\n * configuration.\n */\nexport const layerAuthStore = (options: {\n  readonly binding: string;\n}): Layer.Layer<\n  AuthStore,\n  Binding.BindingNotFoundError | Binding.BindingValidationError,\n  Environment.WorkerEnvironment\n> => layerAuthStoreClient.pipe(Layer.provide(AuthStoreObject.layer({ binding: options.binding })));\n\n// --- Email delivery ------------------------------------------------------------\n\n/** Send Email binding used by {@link layerEmailOtpSender}. */\nexport class AuthEmail extends Email.Tag<AuthEmail>()(\"effect-auth/AuthEmail\") {}\n\n/** Input handed to a {@link layerEmailOtpSender} content renderer. */\nexport interface EmailOtpContentInput {\n  readonly code: string;\n  readonly minutesRemaining: number;\n}\n\n/** A rendered OTP message for {@link layerEmailOtpSender}. */\nexport interface EmailOtpContent {\n  readonly subject: string;\n  readonly text: string;\n  /** HTML alternative to `text`; clients that render HTML prefer it. */\n  readonly html?: string;\n  /** Attachments, e.g. `cid:`-referenced inline images used by `html`. */\n  readonly attachments?: ReadonlyArray<Email.EmailAttachment>;\n}\n\n/**\n * `EmailOtpSender` over a Cloudflare Send Email binding. The consumer owns the\n * sending domain (Email Routing must be configured for `from`); message\n * wording can be overridden through `content`.\n *\n * Delivery runs past the response via `waitUntil`: the provider call is the\n * slow part of an OTP request (routinely multiple seconds), and by the time\n * the sender runs the challenge is already persisted, so the endpoint's 202\n * honestly means \"accepted\". The trade is that a failed send can no longer\n * surface to the caller; the structured delivery-failure log is the only\n * signal.\n */\nexport const layerEmailOtpSender = (options: {\n  /** `send_email` binding name from the wrangler configuration. */\n  readonly binding: string;\n  /**\n   * Verified sender address on a domain with Email Routing enabled. Pass an\n   * object to attach a display name.\n   */\n  readonly from: string | Email.EmailAddress;\n  readonly content?: (input: EmailOtpContentInput) => EmailOtpContent;\n}): Layer.Layer<\n  EmailOtpSender,\n  Binding.BindingNotFoundError | Binding.BindingValidationError,\n  Environment.WorkerEnvironment | Worker.WorkerContext\n> =>\n  Layer.effect(EmailOtpSender)(\n    Effect.gen(function* () {\n      const email = yield* AuthEmail;\n      const context = yield* Worker.WorkerContext;\n\n      return EmailOtpSender.of({\n        send: Effect.fn(\"EmailOtpSender.sendEmail\")(function* (message) {\n          const now = yield* DateTime.now;\n\n          const minutesRemaining = Math.max(\n            1,\n            Math.round(\n              Duration.toMinutes(\n                Duration.millis(\n                  DateTime.toEpochMillis(message.expiresAt) - DateTime.toEpochMillis(now),\n                ),\n              ),\n            ),\n          );\n\n          const code = Redacted.value(message.code);\n\n          const rendered: EmailOtpContent = options.content?.({ code, minutesRemaining }) ?? {\n            subject: \"Your sign-in code\",\n            text: `Your sign-in code is ${code}. It expires in ${minutesRemaining} minute${\n              minutesRemaining === 1 ? \"\" : \"s\"\n            }. If you did not request it, ignore this email.`,\n          };\n\n          yield* context.waitUntil(\n            email\n              .send({\n                from: options.from,\n                to: message.email,\n                subject: rendered.subject,\n                text: rendered.text,\n                ...(rendered.html === undefined ? {} : { html: rendered.html }),\n                ...(rendered.attachments === undefined\n                  ? {}\n                  : { attachments: [...rendered.attachments] }),\n              })\n              .pipe(\n                Effect.asVoid,\n                // Delivery happens after the response, so this log is all an\n                // undeliverable address leaves behind. Provider reasons are\n                // operational and permanent — a suppressed recipient stays\n                // suppressed — so record enough to act on. Only the provider's\n                // own code and message are logged; the rendered message, which\n                // carries the code, never is.\n                Effect.tapError((error) =>\n                  Effect.logError(\"Sign-in code delivery failed\", {\n                    code: Reflect.get(error, \"code\"),\n                    reason: String(Reflect.get(error, \"cause\") ?? error),\n                  }),\n                ),\n                // Logged above; a second generic waitUntil log adds nothing.\n                Effect.catch(() => Effect.void),\n              ),\n          );\n        }),\n      });\n    }),\n  ).pipe(Layer.provide(AuthEmail.layer({ binding: options.binding })));\n"],"mappings":";;;;;;;;;;;;;;AAgCA,IAAa,kBAAb,cAAqC,cAAc,IAAqB,CAAC,CACvE,+BACA;CACE,gBAAgB,cAAc,OAAO;EACnC,MAAM,CAAC,YAAY;EACnB,SAAS,OAAO,MAAM,CAAC,OAAO,MAAM,eAAe,CAAC;CACtD,CAAC;CACD,kBAAkB,cAAc,OAAO;EACrC,MAAM,CAAC,gBAAgB;EACvB,SAAS,OAAO,MAAM,CAAC,eAAe,gBAAgB,CAAC;CACzD,CAAC;CACD,mBAAmB,cAAc,OAAO;EACtC,MAAM,CAAC,eAAe;EACtB,SAAS,OAAO;CAClB,CAAC;CACD,qBAAqB,cAAc,OAAO;EACxC,MAAM,CAAC,WAAW;EAClB,SAAS,OAAO,MAAM,CAAC,qBAAqB,mBAAmB,CAAC;CAClE,CAAC;CACD,qBAAqB,cAAc,OAAO;EACxC,MAAM,CAAC,mBAAmB;EAC1B,SAAS,OAAO,MAAM,CAAC,OAAO,MAAM,mBAAmB,CAAC;CAC1D,CAAC;AACH,CACF,CAAC,CAAC,CAAC;;;;;;;;AASH,MAAM,cAAc,MAAM,OAAO,gBAAgB,CAAC,CAChD,OAAO,IAAI,mBAAmB,qBAAqB,UACjD,iBAAiB,GAAG;CAClB,MAAM,QACJ,MAAM,QACH,IAAI,GAAG,CAAC,CACR,KACC,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,4BAA4B,CAAC,CAAC,CACrF;CACJ,MAAM,KAAK,UACT,MAAM,QACH,IAAI,KAAK,KAAK,CAAC,CACf,KACC,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,4BAA4B,CAAC,CAAC,CACrF;CACJ,SAAS,QACP,MAAM,QAAQ,OAAO,GAAG,CAAC,CAAC,KACxB,OAAO,QACP,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,4BAA4B,CAAC,CAAC,CACrF;AACJ,CAAC,CACH,CACF;AAIA,MAAM,gBAAgB,UAAU,aAAa,KAAK,MAAM,QAAQ,WAAW,CAAC;AAE5E,MAAM,gCAAgC,EACpC,KAAK;CACH,iBAAiB,UACf,OAAO,IAAI,aAAa;EAGtB,OAAO,QAAO,OAFO,UAAA,CAED,eAAe,KAAK,CAAC,CAAC,KACxC,OAAO,GAAG,IAAI,GACd,OAAO,UAAU;GACf,kBAAkB,UAAU,OAAO,QAAQ,KAAK;GAChD,gBAAgB,OAAO;EACzB,CAAC,CACH;CACF,CAAC;CACH,mBAAmB,UACjB,OAAO,IAAI,aAAa;EAGtB,OAAO,QAAO,OAFO,UAAA,CAED,iBAAiB,KAAK,CAAC,CAAC,KAC1C,OAAO,UAAU;GACf,mBAAmB,UAAU,OAAO,QAAQ,KAAK;GACjD,gBAAgB,OAAO;EACzB,CAAC,CACH;CACF,CAAC;CACH,oBAAoB,UAClB,OAAO,IAAI,aAAa;EAGtB,QAAO,OAFc,UAAA,CAER,kBAAkB,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,OAAO,GAAG,CAAC;EAExF,OAAO;CACT,CAAC;CACH,sBAAsB,gBACpB,OAAO,IAAI,aAAa;EAGtB,OAAO,QAAO,OAFO,UAAA,CAED,oBAAoB,WAAW,CAAC,CAAC,KACnD,OAAO,UAAU;GACf,sBAAsB,UAAU,OAAO,QAAQ,KAAK;GACpD,gBAAgB,OAAO;EACzB,CAAC,CACH;CACF,CAAC;CACH,sBAAsB,UACpB,OAAO,IAAI,aAAa;EAGtB,OAAO,QAAO,OAFO,UAAA,CAED,oBAAoB,KAAK,CAAC,CAAC,KAC7C,OAAO,GAAG,IAAI,GACd,OAAO,UAAU;GACf,sBAAsB,UAAU,OAAO,QAAQ,KAAK;GACpD,gBAAgB,OAAO;EACzB,CAAC,CACH;CACF,CAAC;AACL,EACF;;AAGA,MAAa,8BACX,cACG,gBAAgB,KAAK,MAAM,MAAM,eAAe,SAAS,GAAG,6BAA6B;AAE9F,MAAM,0BAA0B,eAAe;;;;;;;AAQ/C,MAAa,uBAAuE,MAAM,OACxF,SACF,CAAC,CACC,OAAO,IAAI,kBAAkB,YAAY;CACvC,MAAM,OAAO,QAAQ,OAAO,SAAS;CAErC,OAAO,UAAU,GAAG;EAClB,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAAW,OAAO;GACnF,MAAM,UAAU,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,iBAAiB,CAAC;GAEzF,IAAI,YAAY,MACd,OAAO,OAAO;EAElB,CAAC;EACD,kBAAkB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAAW,OAAO;GACvF,MAAM,UAAU,OAAO,KACpB,iBAAiB,KAAK,CAAC,CACvB,KAAK,OAAO,SAAS,iBAAiB,CAAC;GAE1C,IAAI,UAAU,SACZ,OAAO,OAAO;GAGhB,OAAO;EACT,CAAC;EACD,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAAW,OAAO;GACzF,OAAO,KAAK,kBAAkB,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,iBAAiB,CAAC;EAC9E,CAAC;EACD,qBAAqB,OAAO,GAAG,4CAA4C,CAAC,CAC1E,WAAW,aAAa;GACtB,MAAM,UAAU,OAAO,KACpB,oBAAoB,WAAW,CAAC,CAChC,KAAK,OAAO,SAAS,iBAAiB,CAAC;GAE1C,IAAI,UAAU,SACZ,OAAO,OAAO;GAGhB,OAAO;EACT,CACF;EACA,qBAAqB,OAAO,GAAG,4CAA4C,CAAC,CAC1E,WAAW,OAAO;GAChB,MAAM,UAAU,OAAO,KACpB,oBAAoB,KAAK,CAAC,CAC1B,KAAK,OAAO,SAAS,iBAAiB,CAAC;GAE1C,IAAI,YAAY,MACd,OAAO,OAAO;EAElB,CACF;CACF,CAAC;AACH,CAAC,CACH;;;;;;;AAQA,MAAa,kBAAkB,YAM1B,qBAAqB,KAAK,MAAM,QAAQ,gBAAgB,MAAM,EAAE,SAAS,QAAQ,QAAQ,CAAC,CAAC,CAAC;;AAKjG,IAAa,YAAb,cAA+B,MAAM,IAAe,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;;;;;;;;;;;;;AA8BhF,MAAa,uBAAuB,YAclC,MAAM,OAAO,cAAc,CAAC,CAC1B,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAO,OAAO;CAE9B,OAAO,eAAe,GAAG,EACvB,MAAM,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,SAAS;EAC9D,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,mBAAmB,KAAK,IAC5B,GACA,KAAK,MACH,SAAS,UACP,SAAS,OACP,SAAS,cAAc,QAAQ,SAAS,IAAI,SAAS,cAAc,GAAG,CACxE,CACF,CACF,CACF;EAEA,MAAM,OAAO,SAAS,MAAM,QAAQ,IAAI;EAExC,MAAM,WAA4B,QAAQ,UAAU;GAAE;GAAM;EAAiB,CAAC,KAAK;GACjF,SAAS;GACT,MAAM,wBAAwB,KAAK,kBAAkB,iBAAiB,SACpE,qBAAqB,IAAI,KAAK,IAC/B;EACH;EAEA,OAAO,QAAQ,UACb,MACG,KAAK;GACJ,MAAM,QAAQ;GACd,IAAI,QAAQ;GACZ,SAAS,SAAS;GAClB,MAAM,SAAS;GACf,GAAI,SAAS,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,SAAS,KAAK;GAC7D,GAAI,SAAS,gBAAgB,KAAA,IACzB,CAAC,IACD,EAAE,aAAa,CAAC,GAAG,SAAS,WAAW,EAAE;EAC/C,CAAC,CAAC,CACD,KACC,OAAO,QAOP,OAAO,UAAU,UACf,OAAO,SAAS,gCAAgC;GAC9C,MAAM,QAAQ,IAAI,OAAO,MAAM;GAC/B,QAAQ,OAAO,QAAQ,IAAI,OAAO,OAAO,KAAK,KAAK;EACrD,CAAC,CACH,GAEA,OAAO,YAAY,OAAO,IAAI,CAChC,CACJ;CACF,CAAC,EACH,CAAC;AACH,CAAC,CACH,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,MAAM,EAAE,SAAS,QAAQ,QAAQ,CAAC,CAAC,CAAC"}

package/dist/Drizzle.d.mts

@@ -0,0 +1,28 @@
+import { ConsumeDecision } from "./auth/ConsumeDecision.mjs";
+import { AuthStoreDecisions, ChallengeConsumeDecision } from "./internal/AuthStoreDecisions.mjs";
+import { AuthStoreTables, AuthTables, ChallengeColumns, ChallengeInput, ChallengeRecord, ChallengeTableMapping, CommitMode, D1ExternalIdentityMapping, D1GeneratedIdentityMapping, D1SubjectProvisioningMapping, DrizzleMappingError, ExternalIdentityTables, IdentityTables, InstantCodec, OAuthStateColumns, OAuthStateTableMapping, OAuthStateTables, RegistrationColumns, RegistrationRecord, RegistrationTableMapping, RequiredAuthConstraints, RequiredAuthStoreConstraints, RequiredExternalIdentityConstraints, RequiredIdentityConstraints, RequiredOAuthStateConstraints, RequiredSubjectProvisioningConstraints, SubjectIdCodec, SubjectProvisioningTables, authServicesLayer, column, identityServicesLayer, isMappedConstraintConflict, provisioningFingerprint, requireStandaloneConsume, requiredAuthConstraints, requiredAuthStoreConstraints, requiredExternalIdentityConstraints, requiredIdentityConstraints, requiredOAuthStateConstraints, requiredSubjectProvisioningConstraints, updateValues } from "./drizzle/model.mjs";
+import { AnyEmailAddressMapping, AnyEmailRegistrationMapping, AnyEmailSignInMapping, D1EmailAddressMapping, D1EmailRegistrationMapping, EmailAddressMapping, EmailAuthorityCredentialTable, EmailCommandTable, EmailCredentialReadTable, EmailCredentialTable, EmailD1Clock, EmailIdentifierReadTable, EmailIdentifierTable, EmailRegistrationAuthorityCredentialTable, EmailRegistrationCredentialTable, EmailRegistrationIdentifierTable, EmailRegistrationIntent, EmailRegistrationMapping, EmailRegistrationProvisioning, EmailRegistrationState, EmailRegistrationTable, EmailSignInMapping, EmailSubjectReadTable, EmailSubjectTable, RequiredEmailAddressConstraints, RequiredEmailRegistrationConstraints, RequiredEmailSignInConstraints, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints } from "./drizzle/email-model.mjs";
+import { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordChargeTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRateScopeKind, PasswordRateScopeTable, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordScopeKeys, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./drizzle/password-model.mjs";
+import { AnyProofPersistenceMapping, D1ProofPersistenceMapping, ProofAbuseEventTable, ProofAction, ProofAuthorityInput, ProofAuthorityTables, ProofCommandDecision, ProofCommandKind, ProofCommandTable, ProofConstraintClassifier, ProofContinuationRecord, ProofContinuationTable, ProofD1Clock, ProofDeliveryState, ProofFailureEventTable, ProofGenerationState, ProofGenerationTable, ProofPersistenceMapping, ProofRateScopeTable, ProofRequestTable, ProofScopeKeys, ProofScopeKind, ProofSeriesTable, RequiredProofConstraints, requiredProofConstraints } from "./drizzle/proof-model.mjs";
+import { AnyPasswordPreparedPersistenceMapping, D1PasswordPreparedPersistenceMapping, D1PasswordPreparedProofMapping, PasswordPreparedAdmissionTable, PasswordPreparedIntentTable, PasswordPreparedPersistenceMapping, PasswordPreparedProofMapping, PasswordPreparedState, RequiredPasswordPreparedConstraints, requiredPasswordPreparedConstraints } from "./drizzle/password-prepared-model.mjs";
+import { AuthenticationAuthorityMapping, D1AuthenticationAuthorityMapping, D1PendingAuthenticationMapping, D1SessionClockMapping, D1SignedSessionValidityMapping, D1StatefulSessionMapping, PendingAuthenticationMapping, PendingAuthenticationTables, RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionAuthorityTables, SessionConstraintClassifier, SessionFlowTables, SessionIdCodec, SessionSubjectTables, SignedSessionValidityMapping, SignedSessionValidityTables, StatefulSessionMapping, StatefulSessionTables, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./drizzle/session-model.mjs";
+import { D1PasskeyMapping, PasskeyAdmissionTable, PasskeyCeremonyMapping, PasskeyChargeInsert, PasskeyChargeKind, PasskeyChargeTable, PasskeyClock, PasskeyColumn, PasskeyCredentialMapping, PasskeyCredentialOwnershipTable, PasskeyCredentialReadTable, PasskeyCredentialServices, PasskeyEnrollmentContextMapping, PasskeyEnrollmentContextServices, PasskeyFactorReadTable, PasskeyFlowInsert, PasskeyFlowState, PasskeyFlowTable, PasskeyHandleOwnershipTable, PasskeyHandleReadTable, PasskeyHandleReservationTable, PasskeyMappingSource, PasskeyModuleTable, PasskeyPersistenceMapping, PasskeyPersistenceServices, PasskeyPolicyGuard, PasskeySubjectIdCodec, PasskeySubjectReadTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./drizzle/passkey-model.mjs";
+import { D1SessionStepUpMapping, RequiredSessionStepUpConstraints, SessionStepUpIntentTables, SessionStepUpMapping, SessionStepUpSourceTables, requiredSessionStepUpConstraints } from "./drizzle/step-up-model.mjs";
+import { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthTupleState, OAuthUnlinkCommandTable, oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "./drizzle/oauth-model.mjs";
+import { OAuthConnectedAction, OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedOrderCodec, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./drizzle/oauth-connected-model.mjs";
+import { PasskeyRegistrationCeremonyCapabilities, PasskeyRegistrationCeremonyMapping, PasskeyRegistrationCeremonyServices, PasskeyRegistrationIntentReadTable, requiredPasskeyRegistrationCeremonyConstraints } from "./drizzle/passkey-registration-ceremony-model.mjs";
+import { authenticationAuthorityLayer, pendingAuthenticationLayer, signedSessionValidityLayer, statefulSessionLayers } from "./drizzle/session-target.mjs";
+import { proofPersistenceLayer } from "./drizzle/proof-target.mjs";
+import { emailAddressPersistenceLayer, emailRegistrationLayer, emailSignInTargetsLayer } from "./drizzle/email-target.mjs";
+import { OAuthStateDecisions } from "./oauth/OAuthStateDecisions.mjs";
+import { oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./drizzle/oauth-target.mjs";
+import { oauthConnectedOwnershipReferences } from "./drizzle/oauth-connected-reference.mjs";
+import { oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } from "./drizzle/oauth-connected-target.mjs";
+import { passwordPersistenceLayer, passwordRegistrationLayer } from "./drizzle/password-target.mjs";
+import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
+import { D1TotpMapping, TotpMapping, TotpMappingSource, TotpPersistenceServices, requiredTotpConstraints, totpPersistenceLayer } from "./drizzle/totp-model.mjs";
+import { decodeTotpRecord, encodeTotpRecord } from "./drizzle/totp-state.mjs";
+import { PasskeyCommandTable, PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyInvalidationMutation, PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter, PasskeyWriteTables, passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "./drizzle/passkey-write-model.mjs";
+import { passkeyManagementPersistenceLayer } from "./drizzle/passkey-write-target.mjs";
+import { D1PhoneMapping, PhoneMapping, PhoneMappingSource, PhonePersistenceServices, PhoneProofCompletionMapping, phonePersistenceLayer, phoneProofCompletionMapping, requiredPhoneConstraints } from "./drizzle/phone-model.mjs";
+export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordPreparedPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, AuthStoreDecisions, type AuthStoreTables, type AuthTables, type AuthenticationAuthorityMapping, type ChallengeColumns, type ChallengeConsumeDecision, type ChallengeInput, type ChallengeRecord, type ChallengeTableMapping, type CommitMode, type ConsumeDecision, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1ExternalIdentityMapping, type D1GeneratedIdentityMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PasswordPreparedPersistenceMapping, type D1PasswordPreparedProofMapping, type D1PendingAuthenticationMapping, type D1PhoneMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type D1SubjectProvisioningMapping, type D1TotpMapping, DrizzleMappingError, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSubjectReadTable, type EmailSubjectTable, type ExternalIdentityTables, type IdentityTables, type InstantCodec, type OAuthAccountsMapping, type OAuthAction, type OAuthAuthorityReadTable, type OAuthAuthorityTable, type OAuthCleanupDescriptor, type OAuthCleanupTable, type OAuthClock, type OAuthConnectedAction, type OAuthConnectedAdmissionTable, type OAuthConnectedAuthorityMapping, type OAuthConnectedClientRegistrationTable, type OAuthConnectedCohortTable, type OAuthConnectedCommandTable, type OAuthConnectedFlowTable, type OAuthConnectedGrantTable, type OAuthConnectedMapping, type OAuthConnectedOrderCodec, type OAuthConnectedOwnershipRead, type OAuthConnectedPolicyGuard, type OAuthConnectedPolicyGuardTable, type OAuthConnectedPolicyInput, type OAuthConnectedRevocationJobTable, type OAuthConnectedRevocationMapping, type OAuthConnectedSqlPolicy, type OAuthConnectedSubjectTable, type OAuthCredentialReadTable, type OAuthCredentialTable, type OAuthD1Mapping, type OAuthEligibilityDescriptor, type OAuthEligibilityFact, type OAuthEligibilityTable, type OAuthFlowState, type OAuthFlowTable, type OAuthMetadataPolicy, type OAuthOwnershipMutation, type OAuthOwnershipReadTable, type OAuthOwnershipTable, type OAuthReferenceGuardDescriptor, type OAuthReferenceGuardTable, type OAuthRegistrationAuthority, type OAuthRegistrationBase, type OAuthRegistrationCommandTable, type OAuthRegistrationEligibility, type OAuthRegistrationGuardDescriptor, type OAuthRegistrationGuardTable, type OAuthRegistrationIntentMapping, type OAuthRegistrationIntentTable, type OAuthRegistrationMapping, type OAuthRegistrationState, type OAuthSignInMapping, type OAuthStateColumns, OAuthStateDecisions, type OAuthStateTableMapping, type OAuthStateTables, type OAuthSubjectReadTable, type OAuthSubjectTable, type OAuthTupleAuthorityTable, type OAuthTupleState, type OAuthUnlinkCommandTable, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyWriteTables, type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordAttemptTable, type PasswordAuthorityCredentialTable, type PasswordChargeTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, type PasswordPreparedAdmissionTable, type PasswordPreparedIntentTable, type PasswordPreparedPersistenceMapping, type PasswordPreparedProofMapping, type PasswordPreparedState, type PasswordRateScopeKind, type PasswordRateScopeTable, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordScopeKeys, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PhoneMapping, type PhoneMappingSource, type PhonePersistenceServices, type PhoneProofCompletionMapping, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type RegistrationColumns, type RegistrationRecord, type RegistrationTableMapping, type RequiredAuthConstraints, type RequiredAuthStoreConstraints, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredExternalIdentityConstraints, type RequiredIdentityConstraints, type RequiredOAuthStateConstraints, type RequiredPasswordConstraints, type RequiredPasswordPreparedConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type RequiredSubjectProvisioningConstraints, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type StatefulSessionMapping, type StatefulSessionTables, type SubjectIdCodec, type SubjectProvisioningTables, type TotpMapping, type TotpMappingSource, type TotpPersistenceServices, authServicesLayer, authenticationAuthorityLayer, column, decodeTotpRecord, emailAddressPersistenceLayer, emailRegistrationLayer, emailSignInTargetsLayer, encodeTotpRecord, identityServicesLayer, isMappedConstraintConflict, oauthAccountsPersistenceLayer, oauthCleanupTable, oauthConnectedOwnershipReferences, oauthConnectedPersistenceLayer, oauthConnectedPolicyGuard, oauthConnectedRevocationsLayer, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationAuthorityLayer, oauthRegistrationGuardTable, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyManagementPersistenceLayer, passkeyPersistenceLayer, passkeyPolicyGuard, passwordPersistenceLayer, passwordPreparedPersistenceLayer, passwordRegistrationLayer, pendingAuthenticationLayer, phonePersistenceLayer, phoneProofCompletionMapping, proofPersistenceLayer, provisioningFingerprint, requireStandaloneConsume, requiredAuthConstraints, requiredAuthStoreConstraints, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredExternalIdentityConstraints, requiredIdentityConstraints, requiredOAuthAccountsConstraints, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthStateConstraints, requiredOAuthTupleConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordPreparedConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredPhoneConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, requiredSubjectProvisioningConstraints, requiredTotpConstraints, signedSessionValidityLayer, statefulSessionLayers, totpPersistenceLayer, updateValues };