@yielded/auth 0.1.0-beta.1

package/dist/DrizzleSqliteWasm.mjs

@@ -0,0 +1,62 @@
+import { sqlClientSessionStandaloneGuard } from "./drizzle/session-target.mjs";
+import { sqlClientEmailStandaloneGuard } from "./drizzle/email-target.mjs";
+import { sqlClientOAuthStandaloneGuard } from "./drizzle/oauth-target.mjs";
+import { sqlClientPasswordStandaloneGuard } from "./drizzle/password-target.mjs";
+import { passwordPreparedPersistenceLayer } from "./drizzle/password-prepared-target.mjs";
+import { sqlClientProofStandaloneGuard } from "./drizzle/proof-target.mjs";
+import { sqlClientPasskeyStandaloneGuard } from "./drizzle/passkey-target.mjs";
+import { makeTotpTarget, sqlClientTotpStandaloneGuard } from "./drizzle/totp-target.mjs";
+import { coordinateSqliteAuthStoreTransaction, coordinateSqliteAuthTransaction, coordinateSqliteOAuthStateTransaction, makeSqliteAuthServices, makeSqliteAuthStoreServices, makeSqliteOAuthStateServices } from "./drizzle/sqlite.mjs";
+import { makePasskeyTarget } from "./drizzle/passkey-drivers.mjs";
+import { makePhoneTarget, sqlClientPhoneStandaloneGuard } from "./drizzle/phone-target.mjs";
+import { makeSqliteEmailTarget, sqliteEmailConfiguration } from "./drizzle/sqlite-emails.mjs";
+import { makeSqliteExternalIdentityServices, makeSqliteIdentityServices, makeSqliteSubjectProvisioningServices } from "./drizzle/sqlite-identity.mjs";
+import { makeSqlitePasswordTarget, sqlitePasswordConfiguration } from "./drizzle/sqlite-passwords.mjs";
+import { makeSqliteProofTarget, sqliteProofConfiguration } from "./drizzle/sqlite-proofs.mjs";
+import { makeSqliteSessionTarget, sqliteSessionConfiguration } from "./drizzle/sqlite-sessions.mjs";
+import { makeSqlitePasswordPreparedTarget } from "./drizzle/sqlite-password-prepared.mjs";
+import { makeOAuthTarget } from "./drizzle/oauth-drivers.mjs";
+//#region src/DrizzleSqliteWasm.ts
+const sessionTarget = makeSqliteSessionTarget((database) => sqliteSessionConfiguration("interactive", sqlClientSessionStandaloneGuard(database)));
+const proofTarget = makeSqliteProofTarget((database) => sqliteProofConfiguration("interactive", sqlClientProofStandaloneGuard(database)));
+const passwordTarget = makeSqlitePasswordTarget((database) => sqlitePasswordConfiguration("interactive", sqlClientPasswordStandaloneGuard(database), sqlClientProofStandaloneGuard(database)));
+const { coordinateEmailAddress, coordinateEmailRegistration, makeEmailAddressServices, makeEmailRegistrationServices, makeEmailSignInServices } = makeSqliteEmailTarget((database) => sqliteEmailConfiguration("interactive", sqlClientEmailStandaloneGuard(database), sqlClientProofStandaloneGuard(database)));
+const { coordinatePasswordPersistence, coordinatePasswordRegistration, makePasswordPersistenceServices, makePasswordRegistrationServices } = passwordTarget;
+const { coordinateProofPersistence, makeProofPersistenceServices } = proofTarget;
+const { coordinateAuthenticationAuthority, coordinatePendingAuthentication, coordinateSignedSessionValidity, coordinateStatefulSessions, makeAuthenticationAuthorityServices, makePendingAuthenticationServices, makeSessionStepUpServices, coordinateSessionStepUp, makeSignedSessionValidityServices, makeStatefulSessionServices } = sessionTarget;
+const commitMode = "interactive";
+const makeAuthStoreServices = (database, mapping) => makeSqliteAuthStoreServices(database, mapping);
+const makeOAuthStateServices = (database, mapping) => makeSqliteOAuthStateServices(database, mapping);
+const makeAuthServices = (database, mapping) => makeSqliteAuthServices(database, mapping);
+const makeIdentityServices = (database, mapping) => makeSqliteIdentityServices(database, mapping, "interactive");
+const makeSubjectProvisioningServices = (database, mapping) => makeSqliteSubjectProvisioningServices(database, mapping, "interactive");
+const makeExternalIdentityServices = (database, mapping) => makeSqliteExternalIdentityServices(database, mapping);
+const { makePasswordPreparedPersistenceServices, coordinatePasswordPreparedPersistence } = makeSqlitePasswordPreparedTarget((database) => sqlitePasswordConfiguration("interactive", sqlClientPasswordStandaloneGuard(database), sqlClientProofStandaloneGuard(database)));
+const { makeOAuthAccountsServices, makeOAuthSignInServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, coordinateOAuthRegistration, coordinateOAuthSignIn, coordinateOAuthRegistrationIntents, coordinateOAuthAccounts, makeOAuthConnectedServices, makeOAuthConnectedRevocationServices, coordinateOAuthConnected, coordinateOAuthConnectedRevocations } = makeOAuthTarget({
+	mode: "interactive",
+	dialect: "sqlite",
+	locking: false,
+	standaloneGuard: sqlClientOAuthStandaloneGuard
+});
+const { makePasskeyCredentialServices, makePasskeyPersistenceServices, makePasskeyEnrollmentContextServices, makePasskeyRegistrationCeremonyServices, coordinatePasskeyPersistence, coordinatePasskeyRegistrationCeremony, makePasskeyManagementServices, makePasskeyRegistrationServices, coordinatePasskeyManagement, coordinatePasskeyRegistration } = makePasskeyTarget({
+	mode: "interactive",
+	dialect: "sqlite",
+	locking: false,
+	standaloneGuard: sqlClientPasskeyStandaloneGuard
+});
+const { makeTotpPersistenceServices, coordinateTotpPersistence } = makeTotpTarget({
+	mode: "interactive",
+	dialect: "sqlite",
+	locking: false,
+	standaloneGuard: sqlClientTotpStandaloneGuard
+});
+const { makePhonePersistenceServices, coordinatePhonePersistence } = makePhoneTarget({
+	mode: "interactive",
+	dialect: "sqlite",
+	locking: false,
+	standaloneGuard: sqlClientPhoneStandaloneGuard
+});
+//#endregion
+export { commitMode, coordinateSqliteAuthStoreTransaction as coordinateAuthStoreTransaction, coordinateSqliteAuthTransaction as coordinateAuthTransaction, coordinateAuthenticationAuthority, coordinateEmailAddress, coordinateEmailRegistration, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, coordinateSqliteOAuthStateTransaction as coordinateOAuthStateTransaction, coordinatePasskeyManagement, coordinatePasskeyPersistence, coordinatePasskeyRegistration, coordinatePasskeyRegistrationCeremony, coordinatePasswordPersistence, coordinatePasswordPreparedPersistence, coordinatePasswordRegistration, coordinatePendingAuthentication, coordinatePhonePersistence, coordinateProofPersistence, coordinateSessionStepUp, coordinateSignedSessionValidity, coordinateStatefulSessions, coordinateTotpPersistence, makeAuthServices, makeAuthStoreServices, makeAuthenticationAuthorityServices, makeEmailAddressServices, makeEmailRegistrationServices, makeEmailSignInServices, makeExternalIdentityServices, makeIdentityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, makeOAuthStateServices, makePasskeyCredentialServices, makePasskeyEnrollmentContextServices, makePasskeyManagementServices, makePasskeyPersistenceServices, makePasskeyRegistrationCeremonyServices, makePasskeyRegistrationServices, makePasswordPersistenceServices, makePasswordPreparedPersistenceServices, makePasswordRegistrationServices, makePendingAuthenticationServices, makePhonePersistenceServices, makeProofPersistenceServices, makeSessionStepUpServices, makeSignedSessionValidityServices, makeStatefulSessionServices, makeSubjectProvisioningServices, makeTotpPersistenceServices, passwordPreparedPersistenceLayer };
+
+//# sourceMappingURL=DrizzleSqliteWasm.mjs.map

package/dist/DrizzleSqliteWasm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DrizzleSqliteWasm.mjs","names":[],"sources":["../src/DrizzleSqliteWasm.ts"],"sourcesContent":["import type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectSQLiteWasmDatabase } from \"drizzle-orm/effect-sqlite-wasm\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\n\nimport type {\n  AuthStoreTables,\n  AuthTables,\n  ExternalIdentityTables,\n  IdentityTables,\n  OAuthStateTables,\n  SubjectProvisioningTables,\n} from \"./drizzle/model\";\nimport {\n  coordinateSqliteAuthStoreTransaction,\n  coordinateSqliteAuthTransaction,\n  coordinateSqliteOAuthStateTransaction,\n  makeSqliteAuthServices,\n  makeSqliteAuthStoreServices,\n  makeSqliteOAuthStateServices,\n} from \"./drizzle/sqlite\";\n\nexport {\n  coordinateSqliteAuthStoreTransaction as coordinateAuthStoreTransaction,\n  coordinateSqliteAuthTransaction as coordinateAuthTransaction,\n  coordinateSqliteOAuthStateTransaction as coordinateOAuthStateTransaction,\n};\n\nimport { sqlClientEmailStandaloneGuard } from \"./drizzle/email-target\";\nimport { sqlClientPasswordStandaloneGuard } from \"./drizzle/password-target\";\nimport { sqlClientProofStandaloneGuard } from \"./drizzle/proof-target\";\nimport { sqlClientSessionStandaloneGuard } from \"./drizzle/session-target\";\nimport { makeSqliteEmailTarget, sqliteEmailConfiguration } from \"./drizzle/sqlite-emails\";\nimport {\n  makeSqliteExternalIdentityServices,\n  makeSqliteIdentityServices,\n  makeSqliteSubjectProvisioningServices,\n} from \"./drizzle/sqlite-identity\";\nimport { makeSqlitePasswordTarget, sqlitePasswordConfiguration } from \"./drizzle/sqlite-passwords\";\nimport { makeSqliteProofTarget, sqliteProofConfiguration } from \"./drizzle/sqlite-proofs\";\nimport { makeSqliteSessionTarget, sqliteSessionConfiguration } from \"./drizzle/sqlite-sessions\";\n\nconst sessionTarget = makeSqliteSessionTarget<EffectSQLiteWasmDatabase<AnyRelations>>((database) =>\n  sqliteSessionConfiguration(\"interactive\", sqlClientSessionStandaloneGuard(database)),\n);\n\nconst proofTarget = makeSqliteProofTarget<EffectSQLiteWasmDatabase<AnyRelations>>((database) =>\n  sqliteProofConfiguration(\"interactive\", sqlClientProofStandaloneGuard(database)),\n);\n\nconst passwordTarget = makeSqlitePasswordTarget<EffectSQLiteWasmDatabase<AnyRelations>>(\n  (database) =>\n    sqlitePasswordConfiguration(\n      \"interactive\",\n      sqlClientPasswordStandaloneGuard(database),\n      sqlClientProofStandaloneGuard(database),\n    ),\n);\n\nconst emailTarget = makeSqliteEmailTarget<EffectSQLiteWasmDatabase<AnyRelations>>((database) =>\n  sqliteEmailConfiguration(\n    \"interactive\",\n    sqlClientEmailStandaloneGuard(database),\n    sqlClientProofStandaloneGuard(database),\n  ),\n);\n\nexport const {\n  coordinateEmailAddress,\n  coordinateEmailRegistration,\n  makeEmailAddressServices,\n  makeEmailRegistrationServices,\n  makeEmailSignInServices,\n} = emailTarget;\n\nexport const {\n  coordinatePasswordPersistence,\n  coordinatePasswordRegistration,\n  makePasswordPersistenceServices,\n  makePasswordRegistrationServices,\n} = passwordTarget;\n\nexport const { coordinateProofPersistence, makeProofPersistenceServices } = proofTarget;\n\nexport const {\n  coordinateAuthenticationAuthority,\n  coordinatePendingAuthentication,\n  coordinateSignedSessionValidity,\n  coordinateStatefulSessions,\n  makeAuthenticationAuthorityServices,\n  makePendingAuthenticationServices,\n  makeSessionStepUpServices,\n  coordinateSessionStepUp,\n  makeSignedSessionValidityServices,\n  makeStatefulSessionServices,\n} = sessionTarget;\n\nexport const commitMode = \"interactive\" as const;\n\nexport const makeAuthStoreServices = <C extends AnySQLiteTable, R extends AnySQLiteTable>(\n  database: EffectSQLiteWasmDatabase<AnyRelations>,\n  mapping: AuthStoreTables<C, R>,\n) => makeSqliteAuthStoreServices(database, mapping);\n\nexport const makeOAuthStateServices = <S extends AnySQLiteTable>(\n  database: EffectSQLiteWasmDatabase<AnyRelations>,\n  mapping: OAuthStateTables<S>,\n) => makeSqliteOAuthStateServices(database, mapping);\n\nexport const makeAuthServices = <\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  S extends AnySQLiteTable,\n>(\n  database: EffectSQLiteWasmDatabase<AnyRelations>,\n  mapping: AuthTables<C, R, S>,\n) => makeSqliteAuthServices(database, mapping);\n\nexport const makeIdentityServices = <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  database: EffectSQLiteWasmDatabase<AnyRelations>,\n  mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>,\n) => makeSqliteIdentityServices(database, mapping, \"interactive\");\n\nexport const makeSubjectProvisioningServices = <\n  Subject extends AnySQLiteTable,\n  Identifier extends AnySQLiteTable,\n  Request extends AnySQLiteTable,\n  NativeId,\n>(\n  database: EffectSQLiteWasmDatabase<AnyRelations>,\n  mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>,\n) => makeSqliteSubjectProvisioningServices(database, mapping, \"interactive\");\n\nexport const makeExternalIdentityServices = <\n  Subject extends AnySQLiteTable,\n  External extends AnySQLiteTable,\n  NativeId,\n>(\n  database: EffectSQLiteWasmDatabase<AnyRelations>,\n  mapping: ExternalIdentityTables<Subject, External, NativeId>,\n) => makeSqliteExternalIdentityServices(database, mapping);\n\nimport { makeSqlitePasswordPreparedTarget } from \"./drizzle/sqlite-password-prepared\";\n\nconst passwordPreparedTarget = makeSqlitePasswordPreparedTarget<\n  EffectSQLiteWasmDatabase<AnyRelations>\n>((database) =>\n  sqlitePasswordConfiguration(\n    \"interactive\",\n    sqlClientPasswordStandaloneGuard(database),\n    sqlClientProofStandaloneGuard(database),\n  ),\n);\n\nexport const { makePasswordPreparedPersistenceServices, coordinatePasswordPreparedPersistence } =\n  passwordPreparedTarget;\n\nexport { passwordPreparedPersistenceLayer } from \"./drizzle/password-prepared-target\";\n\nimport { makeOAuthTarget } from \"./drizzle/oauth-drivers\";\nimport { sqlClientOAuthStandaloneGuard } from \"./drizzle/oauth-target\";\n\nconst oauthTarget = makeOAuthTarget<\n  EffectSQLiteWasmDatabase<AnyRelations>,\n  AnySQLiteTable<{ dialect: \"sqlite\" }>\n>({\n  mode: \"interactive\",\n  dialect: \"sqlite\",\n  locking: false,\n  standaloneGuard: sqlClientOAuthStandaloneGuard,\n});\n\nexport const {\n  makeOAuthAccountsServices,\n  makeOAuthSignInServices,\n  makeOAuthRegistrationIntentServices,\n  makeOAuthRegistrationServices,\n  coordinateOAuthRegistration,\n  coordinateOAuthSignIn,\n  coordinateOAuthRegistrationIntents,\n  coordinateOAuthAccounts,\n  makeOAuthConnectedServices,\n  makeOAuthConnectedRevocationServices,\n  coordinateOAuthConnected,\n  coordinateOAuthConnectedRevocations,\n} = oauthTarget;\n\nimport { makePasskeyTarget } from \"./drizzle/passkey-drivers\";\nimport { sqlClientPasskeyStandaloneGuard } from \"./drizzle/passkey-target\";\n\nconst passkeyTarget = makePasskeyTarget<\n  EffectSQLiteWasmDatabase<AnyRelations>,\n  AnySQLiteTable<{ dialect: \"sqlite\" }>\n>({\n  mode: \"interactive\",\n  dialect: \"sqlite\",\n  locking: false,\n  standaloneGuard: sqlClientPasskeyStandaloneGuard,\n});\n\nexport const {\n  makePasskeyCredentialServices,\n  makePasskeyPersistenceServices,\n  makePasskeyEnrollmentContextServices,\n  makePasskeyRegistrationCeremonyServices,\n  coordinatePasskeyPersistence,\n  coordinatePasskeyRegistrationCeremony,\n  makePasskeyManagementServices,\n  makePasskeyRegistrationServices,\n  coordinatePasskeyManagement,\n  coordinatePasskeyRegistration,\n} = passkeyTarget;\n\nimport { makeTotpTarget, sqlClientTotpStandaloneGuard } from \"./drizzle/totp-target\";\n\nconst totpTarget = makeTotpTarget<\n  EffectSQLiteWasmDatabase<AnyRelations>,\n  AnySQLiteTable<{ dialect: \"sqlite\" }>\n>({\n  mode: \"interactive\",\n  dialect: \"sqlite\",\n  locking: false,\n  standaloneGuard: sqlClientTotpStandaloneGuard,\n});\n\nexport const { makeTotpPersistenceServices, coordinateTotpPersistence } = totpTarget;\n\nimport { makePhoneTarget, sqlClientPhoneStandaloneGuard } from \"./drizzle/phone-target\";\n\nconst phoneTarget = makePhoneTarget<\n  EffectSQLiteWasmDatabase<AnyRelations>,\n  AnySQLiteTable<{ dialect: \"sqlite\" }>\n>({\n  mode: \"interactive\",\n  dialect: \"sqlite\",\n  locking: false,\n  standaloneGuard: sqlClientPhoneStandaloneGuard,\n});\n\nexport const { makePhonePersistenceServices, coordinatePhonePersistence } = phoneTarget;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAyCA,MAAM,gBAAgB,yBAAiE,aACrF,2BAA2B,eAAe,gCAAgC,QAAQ,CAAC,CACrF;AAEA,MAAM,cAAc,uBAA+D,aACjF,yBAAyB,eAAe,8BAA8B,QAAQ,CAAC,CACjF;AAEA,MAAM,iBAAiB,0BACpB,aACC,4BACE,eACA,iCAAiC,QAAQ,GACzC,8BAA8B,QAAQ,CACxC,CACJ;AAUA,MAAa,EACX,wBACA,6BACA,0BACA,+BACA,4BAbkB,uBAA+D,aACjF,yBACE,eACA,8BAA8B,QAAQ,GACtC,8BAA8B,QAAQ,CACxC,CASE;AAEJ,MAAa,EACX,+BACA,gCACA,iCACA,qCACE;AAEJ,MAAa,EAAE,4BAA4B,iCAAiC;AAE5E,MAAa,EACX,mCACA,iCACA,iCACA,4BACA,qCACA,mCACA,2BACA,yBACA,mCACA,gCACE;AAEJ,MAAa,aAAa;AAE1B,MAAa,yBACX,UACA,YACG,4BAA4B,UAAU,OAAO;AAElD,MAAa,0BACX,UACA,YACG,6BAA6B,UAAU,OAAO;AAEnD,MAAa,oBAKX,UACA,YACG,uBAAuB,UAAU,OAAO;AAE7C,MAAa,wBAOX,UACA,YACG,2BAA2B,UAAU,SAAS,aAAa;AAEhE,MAAa,mCAMX,UACA,YACG,sCAAsC,UAAU,SAAS,aAAa;AAE3E,MAAa,gCAKX,UACA,YACG,mCAAmC,UAAU,OAAO;AAczD,MAAa,EAAE,yCAAyC,0CAVzB,kCAE5B,aACD,4BACE,eACA,iCAAiC,QAAQ,GACzC,8BAA8B,QAAQ,CACxC,CAIA;AAiBF,MAAa,EACX,2BACA,yBACA,qCACA,+BACA,6BACA,uBACA,oCACA,yBACA,4BACA,sCACA,0BACA,wCAtBkB,gBAGlB;CACA,MAAM;CACN,SAAS;CACT,SAAS;CACT,iBAAiB;AACnB,CAeI;AAeJ,MAAa,EACX,+BACA,gCACA,sCACA,yCACA,8BACA,uCACA,+BACA,iCACA,6BACA,kCApBoB,kBAGpB;CACA,MAAM;CACN,SAAS;CACT,SAAS;CACT,iBAAiB;AACnB,CAaI;AAcJ,MAAa,EAAE,6BAA6B,8BAVzB,eAGjB;CACA,MAAM;CACN,SAAS;CACT,SAAS;CACT,iBAAiB;AACnB,CAE0E;AAc1E,MAAa,EAAE,8BAA8B,+BAVzB,gBAGlB;CACA,MAAM;CACN,SAAS;CACT,SAAS;CACT,iBAAiB;AACnB,CAE4E"}

package/dist/Email.d.mts

@@ -0,0 +1,12 @@
+import { EmailAction, EmailActionChallenge, EmailAddressDecision, EmailCommandId, EmailCredentialSnapshot, EmailRegistrationDecision, SafeReturnTarget } from "./email/models.mjs";
+import { EmailActionRequired, EmailConfigurationError, EmailMethodUnsupported, EmailRejected, EmailUnavailable } from "./email/errors.mjs";
+import { EmailSignInTargets } from "./email/EmailSignInTargets.mjs";
+import { EmailActionAuthorization, EmailActionEvidence } from "./email/EmailActionEvidence.mjs";
+import { EmailAddressMutation, EmailAddressPersistence, EmailAddressTarget, PrepareEmailCommit } from "./email/EmailAddressPersistence.mjs";
+import { EmailReturnTargets } from "./email/EmailReturnTargets.mjs";
+import { EmailIdentifierNotifier, emailIdentifierNotifications } from "./email/EmailIdentifierNotifier.mjs";
+import { magicLinkLandingHeaders, makeMagicLinkRenderer, parseMagicLinkFragment } from "./email/magicLink.mjs";
+import { EmailAddressPolicy } from "./email/addresses.mjs";
+import { makeEmailMethod } from "./email/module.mjs";
+import { EmailAddressOptions, EmailCodeOptions, EmailLinkOptions, EmailRegistrationOptions, makeAddresses, makeCode, makeLink, makeRegistration } from "./email/definition.mjs";
+export { EmailAction, type EmailActionAuthorization, EmailActionChallenge, EmailActionEvidence, EmailActionRequired, type EmailAddressDecision, type EmailAddressMutation, type EmailAddressOptions, EmailAddressPersistence, type EmailAddressPolicy, type EmailAddressTarget, type EmailCodeOptions, EmailCommandId, EmailConfigurationError, EmailCredentialSnapshot, EmailIdentifierNotifier, type EmailLinkOptions, EmailMethodUnsupported, type EmailRegistrationDecision, type EmailRegistrationOptions, EmailRejected, EmailReturnTargets, EmailSignInTargets, EmailUnavailable, type PrepareEmailCommit, SafeReturnTarget, emailIdentifierNotifications, magicLinkLandingHeaders, makeAddresses, makeCode, makeLink, makeMagicLinkRenderer, makeEmailMethod as makeModule, makeRegistration, parseMagicLinkFragment };

package/dist/Email.mjs

@@ -0,0 +1,11 @@
+import { EmailAddressPersistence } from "./email/EmailAddressPersistence.mjs";
+import { EmailSignInTargets } from "./email/EmailSignInTargets.mjs";
+import { EmailActionRequired, EmailConfigurationError, EmailMethodUnsupported, EmailRejected, EmailUnavailable } from "./email/errors.mjs";
+import { EmailAction, EmailActionChallenge, EmailCommandId, EmailCredentialSnapshot, SafeReturnTarget } from "./email/models.mjs";
+import { EmailActionEvidence } from "./email/EmailActionEvidence.mjs";
+import { EmailReturnTargets } from "./email/EmailReturnTargets.mjs";
+import { EmailIdentifierNotifier, emailIdentifierNotifications } from "./email/EmailIdentifierNotifier.mjs";
+import { magicLinkLandingHeaders, makeMagicLinkRenderer, parseMagicLinkFragment } from "./email/magicLink.mjs";
+import { makeEmailMethod } from "./email/module.mjs";
+import { makeAddresses, makeCode, makeLink, makeRegistration } from "./email/definition.mjs";
+export { EmailAction, EmailActionChallenge, EmailActionEvidence, EmailActionRequired, EmailAddressPersistence, EmailCommandId, EmailConfigurationError, EmailCredentialSnapshot, EmailIdentifierNotifier, EmailMethodUnsupported, EmailRejected, EmailReturnTargets, EmailSignInTargets, EmailUnavailable, SafeReturnTarget, emailIdentifierNotifications, magicLinkLandingHeaders, makeAddresses, makeCode, makeLink, makeMagicLinkRenderer, makeEmailMethod as makeModule, makeRegistration, parseMagicLinkFragment };

package/dist/EmailOtp.d.mts

@@ -0,0 +1,42 @@
+import { Email, EmailOtpChallenge, EmailOtpVerification, PendingRegistration, SubjectId } from "./Schema.mjs";
+import { AuthRateLimited, AuthStoreError, AuthTokenError, EmailDeliveryError, IdentityResolutionError, InvalidEmailOtp, InvalidRegistration, RegistrationIncomplete } from "./Errors.mjs";
+import { AuthTokenCodec } from "./AuthTokenCodec.mjs";
+import { AuthStore } from "./AuthStore.mjs";
+import { EmailOtpSender } from "./EmailOtpSender.mjs";
+import { IdentityResolver } from "./IdentityResolver.mjs";
+import { Context, Crypto, Effect, Layer, Redacted } from "effect";
+//#region src/EmailOtp.d.ts
+interface VerifyEmailOtpInput {
+  readonly challengeToken: Redacted.Redacted<string>;
+  readonly code: Redacted.Redacted<string>;
+}
+declare const EmailOtp_base: Context.ServiceClass<EmailOtp, "effect-auth/EmailOtp", {
+  /**
+   * Creates and persists an expiring challenge, sends the code, and returns
+   * the opaque challenge token for the challenge cookie.
+   */
+  readonly request: (email: Email) => Effect.Effect<EmailOtpChallenge, AuthRateLimited | AuthStoreError | AuthTokenError | EmailDeliveryError>;
+  /**
+   * Atomically consumes the challenge and resolves the subject. An unknown
+   * email yields a pending registration, not an account.
+   */
+  readonly verify: (input: VerifyEmailOtpInput) => Effect.Effect<EmailOtpVerification, InvalidEmailOtp | AuthStoreError | AuthTokenError | IdentityResolutionError>;
+  /** Resolves an unconsumed pending registration for onboarding middleware. */
+  readonly inspectRegistration: (registrationToken: Redacted.Redacted<string>) => Effect.Effect<PendingRegistration, InvalidRegistration | AuthStoreError | AuthTokenError>;
+  /**
+   * Re-runs identity resolution and atomically consumes the registration. Fails
+   * with `RegistrationIncomplete` until the application has created the
+   * email-to-subject mapping.
+   */
+  readonly completeRegistration: (registrationToken: Redacted.Redacted<string>) => Effect.Effect<SubjectId, InvalidRegistration | RegistrationIncomplete | AuthStoreError | AuthTokenError | IdentityResolutionError>;
+}>;
+/**
+ * Email OTP strategy workflow. Session issuance stays in `AuthSession`; the
+ * HTTP layer composes the two.
+ */
+declare class EmailOtp extends EmailOtp_base {
+  static readonly layer: Layer.Layer<EmailOtp, never, AuthStore | EmailOtpSender | IdentityResolver | AuthTokenCodec | Crypto.Crypto>;
+}
+//#endregion
+export { EmailOtp, VerifyEmailOtpInput };
+//# sourceMappingURL=EmailOtp.d.mts.map

package/dist/EmailOtp.mjs

@@ -0,0 +1,120 @@
+import { ChallengeId, ConsumeChallenge, ConsumeRegistration, EmailOtpChallenge, EmailOtpMessage, ExistingSubject, NewChallenge, NewRegistration, RegistrationId, RegistrationRequired } from "./Schema.mjs";
+import { AuthTokenError, InvalidEmailOtp, RegistrationIncomplete } from "./Errors.mjs";
+import { AuthStore } from "./AuthStore.mjs";
+import { EmailOtpSender } from "./EmailOtpSender.mjs";
+import { AuthTokenCodec } from "./AuthTokenCodec.mjs";
+import { AuthPolicy } from "./Policy.mjs";
+import { IdentityResolver } from "./IdentityResolver.mjs";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Option, Redacted, Schema } from "effect";
+//#region src/EmailOtp.ts
+const challengeTokenScope = "effect-auth/challenge-token";
+const registrationTokenScope = "effect-auth/registration-token";
+const otpScope = (tokenDigest) => `effect-auth/otp:sign-in:${tokenDigest}`;
+const decodeChallengeId = Schema.decodeEffect(ChallengeId);
+const decodeRegistrationId = Schema.decodeEffect(RegistrationId);
+/**
+* Email OTP strategy workflow. Session issuance stays in `AuthSession`; the
+* HTTP layer composes the two.
+*/
+var EmailOtp = class EmailOtp extends Context.Service()("effect-auth/EmailOtp") {
+	static layer = Layer.effect(EmailOtp)(Effect.gen(function* () {
+		const policy = yield* AuthPolicy;
+		const store = yield* AuthStore;
+		const sender = yield* EmailOtpSender;
+		const resolver = yield* IdentityResolver;
+		const codec = yield* AuthTokenCodec;
+		const crypto = yield* Crypto.Crypto;
+		const randomnessUnavailable = AuthTokenError.make({ message: "Secure randomness unavailable" });
+		const randomToken = crypto.randomBytes(32).pipe(Effect.map(Encoding.encodeBase64Url), Effect.mapError(() => randomnessUnavailable));
+		const randomUuid = crypto.randomUUIDv4.pipe(Effect.mapError(() => randomnessUnavailable));
+		const randomOtp = crypto.randomIntBetween(0, 10 ** policy.otpLength, { halfOpen: true }).pipe(Effect.map((value) => String(value).padStart(policy.otpLength, "0")), Effect.mapError(() => randomnessUnavailable));
+		return EmailOtp.of({
+			request: Effect.fn("EmailOtp.request")(function* (email) {
+				const now = yield* DateTime.now;
+				const expiresAt = DateTime.addDuration(now, policy.otpLifetime);
+				const challengeId = yield* decodeChallengeId(yield* randomUuid).pipe(Effect.orDie);
+				const token = yield* randomToken;
+				const otp = yield* randomOtp;
+				const tokenDigest = yield* codec.digestToken(Redacted.make(token), challengeTokenScope);
+				const otpDigest = yield* codec.digestSecret(Redacted.make(otp), otpScope(tokenDigest));
+				yield* store.issueChallenge(NewChallenge.make({
+					challengeId,
+					tokenDigest,
+					email,
+					purpose: "sign-in",
+					otpDigest: otpDigest.digest,
+					otpKeyId: otpDigest.keyId,
+					issuedAt: now,
+					expiresAt,
+					attemptLimit: policy.attemptLimit,
+					resendCooldown: policy.resendCooldown
+				}));
+				yield* sender.send(EmailOtpMessage.make({
+					email,
+					code: Redacted.make(otp),
+					expiresAt
+				}));
+				return EmailOtpChallenge.make({
+					challengeToken: Redacted.make(token),
+					expiresAt
+				});
+			}),
+			verify: Effect.fn("EmailOtp.verify")(function* ({ challengeToken, code }) {
+				const tokenDigest = yield* codec.digestToken(challengeToken, challengeTokenScope);
+				const scope = otpScope(tokenDigest);
+				const otpDigests = {};
+				for (const keyId of codec.keyIds) {
+					const keyed = yield* codec.digestSecret(code, scope, keyId);
+					otpDigests[keyed.keyId] = keyed.digest;
+				}
+				const verified = yield* store.consumeChallenge(ConsumeChallenge.make({
+					tokenDigest,
+					otpDigests
+				})).pipe(Effect.catchTag("EmailOtpRejected", (rejection) => Effect.logInfo("Email OTP verification rejected").pipe(Effect.annotateLogs({
+					"auth.method": "email_otp",
+					"auth.outcome": "rejected",
+					"auth.reason": rejection.reason
+				}), Effect.andThen(InvalidEmailOtp.make()))));
+				const subject = yield* resolver.findByVerifiedEmail(verified.email);
+				if (Option.isSome(subject)) return ExistingSubject.make({
+					subjectId: subject.value,
+					email: verified.email
+				});
+				const now = yield* DateTime.now;
+				const expiresAt = DateTime.addDuration(now, policy.registrationLifetime);
+				const registrationId = yield* decodeRegistrationId(yield* randomUuid).pipe(Effect.orDie);
+				const registrationToken = yield* randomToken;
+				const registrationDigest = yield* codec.digestToken(Redacted.make(registrationToken), registrationTokenScope);
+				yield* store.issueRegistration(NewRegistration.make({
+					registrationId,
+					tokenDigest: registrationDigest,
+					email: verified.email,
+					purpose: "registration",
+					issuedAt: now,
+					expiresAt
+				}));
+				return RegistrationRequired.make({
+					registrationToken: Redacted.make(registrationToken),
+					email: verified.email,
+					expiresAt
+				});
+			}),
+			inspectRegistration: Effect.fn("EmailOtp.inspectRegistration")(function* (registrationToken) {
+				const tokenDigest = yield* codec.digestToken(registrationToken, registrationTokenScope);
+				return yield* store.inspectRegistration(tokenDigest);
+			}),
+			completeRegistration: Effect.fn("EmailOtp.completeRegistration")(function* (registrationToken) {
+				const tokenDigest = yield* codec.digestToken(registrationToken, registrationTokenScope);
+				const registration = yield* store.inspectRegistration(tokenDigest);
+				const subject = yield* resolver.findByVerifiedEmail(registration.email);
+				if (Option.isNone(subject)) return yield* RegistrationIncomplete.make();
+				yield* store.consumeRegistration(ConsumeRegistration.make({ tokenDigest }));
+				return subject.value;
+			})
+		});
+	}));
+};
+//#endregion
+export { EmailOtp };
+
+//# sourceMappingURL=EmailOtp.mjs.map

package/dist/EmailOtp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtp.mjs","names":[],"sources":["../src/EmailOtp.ts"],"sourcesContent":["import {\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Layer,\n  Option,\n  Redacted,\n  Schema,\n} from \"effect\";\n\nimport { AuthStore } from \"./AuthStore\";\nimport { AuthTokenCodec } from \"./AuthTokenCodec\";\nimport { EmailOtpSender } from \"./EmailOtpSender\";\nimport {\n  type AuthRateLimited,\n  type AuthStoreError,\n  type EmailDeliveryError,\n  type IdentityResolutionError,\n  type InvalidRegistration,\n  AuthTokenError,\n  InvalidEmailOtp,\n  RegistrationIncomplete,\n} from \"./Errors\";\nimport { IdentityResolver } from \"./IdentityResolver\";\nimport { AuthPolicy } from \"./Policy\";\nimport {\n  type Email,\n  type EmailOtpVerification,\n  type PendingRegistration,\n  type KeyId,\n  type OtpDigest,\n  type SubjectId,\n  type TokenDigest,\n  ChallengeId,\n  ConsumeChallenge,\n  ConsumeRegistration,\n  EmailOtpChallenge,\n  EmailOtpMessage,\n  ExistingSubject,\n  NewChallenge,\n  NewRegistration,\n  RegistrationId,\n  RegistrationRequired,\n} from \"./Schema\";\n\nconst challengeTokenScope = \"effect-auth/challenge-token\";\nconst registrationTokenScope = \"effect-auth/registration-token\";\nconst otpScope = (tokenDigest: TokenDigest) => `effect-auth/otp:sign-in:${tokenDigest}`;\n\nconst decodeChallengeId = Schema.decodeEffect(ChallengeId);\nconst decodeRegistrationId = Schema.decodeEffect(RegistrationId);\n\nexport interface VerifyEmailOtpInput {\n  readonly challengeToken: Redacted.Redacted<string>;\n  readonly code: Redacted.Redacted<string>;\n}\n\n/**\n * Email OTP strategy workflow. Session issuance stays in `AuthSession`; the\n * HTTP layer composes the two.\n */\nexport class EmailOtp extends Context.Service<\n  EmailOtp,\n  {\n    /**\n     * Creates and persists an expiring challenge, sends the code, and returns\n     * the opaque challenge token for the challenge cookie.\n     */\n    readonly request: (\n      email: Email,\n    ) => Effect.Effect<\n      EmailOtpChallenge,\n      AuthRateLimited | AuthStoreError | AuthTokenError | EmailDeliveryError\n    >;\n    /**\n     * Atomically consumes the challenge and resolves the subject. An unknown\n     * email yields a pending registration, not an account.\n     */\n    readonly verify: (\n      input: VerifyEmailOtpInput,\n    ) => Effect.Effect<\n      EmailOtpVerification,\n      InvalidEmailOtp | AuthStoreError | AuthTokenError | IdentityResolutionError\n    >;\n    /** Resolves an unconsumed pending registration for onboarding middleware. */\n    readonly inspectRegistration: (\n      registrationToken: Redacted.Redacted<string>,\n    ) => Effect.Effect<PendingRegistration, InvalidRegistration | AuthStoreError | AuthTokenError>;\n    /**\n     * Re-runs identity resolution and atomically consumes the registration. Fails\n     * with `RegistrationIncomplete` until the application has created the\n     * email-to-subject mapping.\n     */\n    readonly completeRegistration: (\n      registrationToken: Redacted.Redacted<string>,\n    ) => Effect.Effect<\n      SubjectId,\n      | InvalidRegistration\n      | RegistrationIncomplete\n      | AuthStoreError\n      | AuthTokenError\n      | IdentityResolutionError\n    >;\n  }\n>()(\"effect-auth/EmailOtp\") {\n  static readonly layer: Layer.Layer<\n    EmailOtp,\n    never,\n    AuthStore | EmailOtpSender | IdentityResolver | AuthTokenCodec | Crypto.Crypto\n  > = Layer.effect(EmailOtp)(\n    Effect.gen(function* () {\n      const policy = yield* AuthPolicy;\n      const store = yield* AuthStore;\n      const sender = yield* EmailOtpSender;\n      const resolver = yield* IdentityResolver;\n      const codec = yield* AuthTokenCodec;\n      const crypto = yield* Crypto.Crypto;\n\n      const randomnessUnavailable = AuthTokenError.make({\n        message: \"Secure randomness unavailable\",\n      });\n\n      const randomToken = crypto.randomBytes(32).pipe(\n        Effect.map(Encoding.encodeBase64Url),\n        Effect.mapError(() => randomnessUnavailable),\n      );\n\n      const randomUuid = crypto.randomUUIDv4.pipe(Effect.mapError(() => randomnessUnavailable));\n\n      const randomOtp = crypto.randomIntBetween(0, 10 ** policy.otpLength, { halfOpen: true }).pipe(\n        Effect.map((value) => String(value).padStart(policy.otpLength, \"0\")),\n        Effect.mapError(() => randomnessUnavailable),\n      );\n\n      return EmailOtp.of({\n        request: Effect.fn(\"EmailOtp.request\")(function* (email) {\n          const now = yield* DateTime.now;\n          const expiresAt = DateTime.addDuration(now, policy.otpLifetime);\n          const challengeId = yield* decodeChallengeId(yield* randomUuid).pipe(Effect.orDie);\n          const token = yield* randomToken;\n          const otp = yield* randomOtp;\n          const tokenDigest = yield* codec.digestToken(Redacted.make(token), challengeTokenScope);\n          const otpDigest = yield* codec.digestSecret(Redacted.make(otp), otpScope(tokenDigest));\n\n          yield* store.issueChallenge(\n            NewChallenge.make({\n              challengeId,\n              tokenDigest,\n              email,\n              purpose: \"sign-in\",\n              otpDigest: otpDigest.digest,\n              otpKeyId: otpDigest.keyId,\n              issuedAt: now,\n              expiresAt,\n              attemptLimit: policy.attemptLimit,\n              resendCooldown: policy.resendCooldown,\n            }),\n          );\n          yield* sender.send(EmailOtpMessage.make({ email, code: Redacted.make(otp), expiresAt }));\n\n          return EmailOtpChallenge.make({ challengeToken: Redacted.make(token), expiresAt });\n        }),\n\n        verify: Effect.fn(\"EmailOtp.verify\")(function* ({ challengeToken, code }) {\n          const tokenDigest = yield* codec.digestToken(challengeToken, challengeTokenScope);\n          const scope = otpScope(tokenDigest);\n          const otpDigests: Record<KeyId, OtpDigest> = {};\n\n          for (const keyId of codec.keyIds) {\n            const keyed = yield* codec.digestSecret(code, scope, keyId);\n\n            otpDigests[keyed.keyId] = keyed.digest;\n          }\n\n          const verified = yield* store\n            .consumeChallenge(ConsumeChallenge.make({ tokenDigest, otpDigests }))\n            .pipe(\n              Effect.catchTag(\"EmailOtpRejected\", (rejection) =>\n                Effect.logInfo(\"Email OTP verification rejected\").pipe(\n                  Effect.annotateLogs({\n                    \"auth.method\": \"email_otp\",\n                    \"auth.outcome\": \"rejected\",\n                    \"auth.reason\": rejection.reason,\n                  }),\n                  Effect.andThen(InvalidEmailOtp.make()),\n                ),\n              ),\n            );\n\n          const subject = yield* resolver.findByVerifiedEmail(verified.email);\n\n          if (Option.isSome(subject)) {\n            return ExistingSubject.make({ subjectId: subject.value, email: verified.email });\n          }\n          const now = yield* DateTime.now;\n          const expiresAt = DateTime.addDuration(now, policy.registrationLifetime);\n          const registrationId = yield* decodeRegistrationId(yield* randomUuid).pipe(Effect.orDie);\n          const registrationToken = yield* randomToken;\n\n          const registrationDigest = yield* codec.digestToken(\n            Redacted.make(registrationToken),\n            registrationTokenScope,\n          );\n\n          yield* store.issueRegistration(\n            NewRegistration.make({\n              registrationId,\n              tokenDigest: registrationDigest,\n              email: verified.email,\n              purpose: \"registration\",\n              issuedAt: now,\n              expiresAt,\n            }),\n          );\n\n          return RegistrationRequired.make({\n            registrationToken: Redacted.make(registrationToken),\n            email: verified.email,\n            expiresAt,\n          });\n        }),\n\n        inspectRegistration: Effect.fn(\"EmailOtp.inspectRegistration\")(\n          function* (registrationToken) {\n            const tokenDigest = yield* codec.digestToken(registrationToken, registrationTokenScope);\n\n            return yield* store.inspectRegistration(tokenDigest);\n          },\n        ),\n\n        completeRegistration: Effect.fn(\"EmailOtp.completeRegistration\")(\n          function* (registrationToken) {\n            const tokenDigest = yield* codec.digestToken(registrationToken, registrationTokenScope);\n            const registration = yield* store.inspectRegistration(tokenDigest);\n            const subject = yield* resolver.findByVerifiedEmail(registration.email);\n\n            if (Option.isNone(subject)) {\n              return yield* RegistrationIncomplete.make();\n            }\n            yield* store.consumeRegistration(ConsumeRegistration.make({ tokenDigest }));\n\n            return subject.value;\n          },\n        ),\n      });\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;AA+CA,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAC/B,MAAM,YAAY,gBAA6B,2BAA2B;AAE1E,MAAM,oBAAoB,OAAO,aAAa,WAAW;AACzD,MAAM,uBAAuB,OAAO,aAAa,cAAc;;;;;AAW/D,IAAa,WAAb,MAAa,iBAAiB,QAAQ,QA2CpC,CAAC,CAAC,sBAAsB,CAAC,CAAC;CAC1B,OAAgB,QAIZ,MAAM,OAAO,QAAQ,CAAC,CACxB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO,OAAO;EAE7B,MAAM,wBAAwB,eAAe,KAAK,EAChD,SAAS,gCACX,CAAC;EAED,MAAM,cAAc,OAAO,YAAY,EAAE,CAAC,CAAC,KACzC,OAAO,IAAI,SAAS,eAAe,GACnC,OAAO,eAAe,qBAAqB,CAC7C;EAEA,MAAM,aAAa,OAAO,aAAa,KAAK,OAAO,eAAe,qBAAqB,CAAC;EAExF,MAAM,YAAY,OAAO,iBAAiB,GAAG,MAAM,OAAO,WAAW,EAAE,UAAU,KAAK,CAAC,CAAC,CAAC,KACvF,OAAO,KAAK,UAAU,OAAO,KAAK,CAAC,CAAC,SAAS,OAAO,WAAW,GAAG,CAAC,GACnE,OAAO,eAAe,qBAAqB,CAC7C;EAEA,OAAO,SAAS,GAAG;GACjB,SAAS,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,OAAO;IACvD,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,YAAY,SAAS,YAAY,KAAK,OAAO,WAAW;IAC9D,MAAM,cAAc,OAAO,kBAAkB,OAAO,UAAU,CAAC,CAAC,KAAK,OAAO,KAAK;IACjF,MAAM,QAAQ,OAAO;IACrB,MAAM,MAAM,OAAO;IACnB,MAAM,cAAc,OAAO,MAAM,YAAY,SAAS,KAAK,KAAK,GAAG,mBAAmB;IACtF,MAAM,YAAY,OAAO,MAAM,aAAa,SAAS,KAAK,GAAG,GAAG,SAAS,WAAW,CAAC;IAErF,OAAO,MAAM,eACX,aAAa,KAAK;KAChB;KACA;KACA;KACA,SAAS;KACT,WAAW,UAAU;KACrB,UAAU,UAAU;KACpB,UAAU;KACV;KACA,cAAc,OAAO;KACrB,gBAAgB,OAAO;IACzB,CAAC,CACH;IACA,OAAO,OAAO,KAAK,gBAAgB,KAAK;KAAE;KAAO,MAAM,SAAS,KAAK,GAAG;KAAG;IAAU,CAAC,CAAC;IAEvF,OAAO,kBAAkB,KAAK;KAAE,gBAAgB,SAAS,KAAK,KAAK;KAAG;IAAU,CAAC;GACnF,CAAC;GAED,QAAQ,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,EAAE,gBAAgB,QAAQ;IACxE,MAAM,cAAc,OAAO,MAAM,YAAY,gBAAgB,mBAAmB;IAChF,MAAM,QAAQ,SAAS,WAAW;IAClC,MAAM,aAAuC,CAAC;IAE9C,KAAK,MAAM,SAAS,MAAM,QAAQ;KAChC,MAAM,QAAQ,OAAO,MAAM,aAAa,MAAM,OAAO,KAAK;KAE1D,WAAW,MAAM,SAAS,MAAM;IAClC;IAEA,MAAM,WAAW,OAAO,MACrB,iBAAiB,iBAAiB,KAAK;KAAE;KAAa;IAAW,CAAC,CAAC,CAAC,CACpE,KACC,OAAO,SAAS,qBAAqB,cACnC,OAAO,QAAQ,iCAAiC,CAAC,CAAC,KAChD,OAAO,aAAa;KAClB,eAAe;KACf,gBAAgB;KAChB,eAAe,UAAU;IAC3B,CAAC,GACD,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CACvC,CACF,CACF;IAEF,MAAM,UAAU,OAAO,SAAS,oBAAoB,SAAS,KAAK;IAElE,IAAI,OAAO,OAAO,OAAO,GACvB,OAAO,gBAAgB,KAAK;KAAE,WAAW,QAAQ;KAAO,OAAO,SAAS;IAAM,CAAC;IAEjF,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,YAAY,SAAS,YAAY,KAAK,OAAO,oBAAoB;IACvE,MAAM,iBAAiB,OAAO,qBAAqB,OAAO,UAAU,CAAC,CAAC,KAAK,OAAO,KAAK;IACvF,MAAM,oBAAoB,OAAO;IAEjC,MAAM,qBAAqB,OAAO,MAAM,YACtC,SAAS,KAAK,iBAAiB,GAC/B,sBACF;IAEA,OAAO,MAAM,kBACX,gBAAgB,KAAK;KACnB;KACA,aAAa;KACb,OAAO,SAAS;KAChB,SAAS;KACT,UAAU;KACV;IACF,CAAC,CACH;IAEA,OAAO,qBAAqB,KAAK;KAC/B,mBAAmB,SAAS,KAAK,iBAAiB;KAClD,OAAO,SAAS;KAChB;IACF,CAAC;GACH,CAAC;GAED,qBAAqB,OAAO,GAAG,8BAA8B,CAAC,CAC5D,WAAW,mBAAmB;IAC5B,MAAM,cAAc,OAAO,MAAM,YAAY,mBAAmB,sBAAsB;IAEtF,OAAO,OAAO,MAAM,oBAAoB,WAAW;GACrD,CACF;GAEA,sBAAsB,OAAO,GAAG,+BAA+B,CAAC,CAC9D,WAAW,mBAAmB;IAC5B,MAAM,cAAc,OAAO,MAAM,YAAY,mBAAmB,sBAAsB;IACtF,MAAM,eAAe,OAAO,MAAM,oBAAoB,WAAW;IACjE,MAAM,UAAU,OAAO,SAAS,oBAAoB,aAAa,KAAK;IAEtE,IAAI,OAAO,OAAO,OAAO,GACvB,OAAO,OAAO,uBAAuB,KAAK;IAE5C,OAAO,MAAM,oBAAoB,oBAAoB,KAAK,EAAE,YAAY,CAAC,CAAC;IAE1E,OAAO,QAAQ;GACjB,CACF;EACF,CAAC;CACH,CAAC,CACH;AACF"}

package/dist/EmailOtpSender.d.mts

@@ -0,0 +1,22 @@
+import { EmailOtpMessage } from "./Schema.mjs";
+import { EmailDeliveryError } from "./Errors.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/EmailOtpSender.d.ts
+declare const EmailOtpSender_base: Context.ServiceClass<EmailOtpSender, "effect-auth/EmailOtpSender", {
+  readonly send: (message: EmailOtpMessage) => Effect.Effect<void, EmailDeliveryError>;
+}>;
+/**
+ * OTP-specific delivery port, not a generic mail client. The consumer owns
+ * provider calls and message templating.
+ */
+declare class EmailOtpSender extends EmailOtpSender_base {
+  /**
+   * Reveals the code through Effect's `Console` for local development. This is
+   * the sole deliberate exception to the no-secrets-in-logs rule and is
+   * explicitly not a production layer.
+   */
+  static readonly layerConsole: Layer.Layer<EmailOtpSender, never, never>;
+}
+//#endregion
+export { EmailOtpSender };
+//# sourceMappingURL=EmailOtpSender.d.mts.map

package/dist/EmailOtpSender.mjs

@@ -0,0 +1,18 @@
+import { Console, Context, DateTime, Layer, Redacted } from "effect";
+//#region src/EmailOtpSender.ts
+/**
+* OTP-specific delivery port, not a generic mail client. The consumer owns
+* provider calls and message templating.
+*/
+var EmailOtpSender = class EmailOtpSender extends Context.Service()("effect-auth/EmailOtpSender") {
+	/**
+	* Reveals the code through Effect's `Console` for local development. This is
+	* the sole deliberate exception to the no-secrets-in-logs rule and is
+	* explicitly not a production layer.
+	*/
+	static layerConsole = Layer.succeed(EmailOtpSender)({ send: (message) => Console.log(`[effect-auth] sign-in code for ${message.email}: ${Redacted.value(message.code)} (expires ${DateTime.formatIso(message.expiresAt)})`) });
+};
+//#endregion
+export { EmailOtpSender };
+
+//# sourceMappingURL=EmailOtpSender.mjs.map

package/dist/EmailOtpSender.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtpSender.mjs","names":[],"sources":["../src/EmailOtpSender.ts"],"sourcesContent":["import { Console, Context, DateTime, type Effect, Layer, Redacted } from \"effect\";\n\nimport type { EmailDeliveryError } from \"./Errors\";\nimport type { EmailOtpMessage } from \"./Schema\";\n\n/**\n * OTP-specific delivery port, not a generic mail client. The consumer owns\n * provider calls and message templating.\n */\nexport class EmailOtpSender extends Context.Service<\n  EmailOtpSender,\n  {\n    readonly send: (message: EmailOtpMessage) => Effect.Effect<void, EmailDeliveryError>;\n  }\n>()(\"effect-auth/EmailOtpSender\") {\n  /**\n   * Reveals the code through Effect's `Console` for local development. This is\n   * the sole deliberate exception to the no-secrets-in-logs rule and is\n   * explicitly not a production layer.\n   */\n  static readonly layerConsole = Layer.succeed(EmailOtpSender)({\n    send: (message) =>\n      Console.log(\n        `[effect-auth] sign-in code for ${message.email}: ${Redacted.value(message.code)}` +\n          ` (expires ${DateTime.formatIso(message.expiresAt)})`,\n      ),\n  });\n}\n"],"mappings":";;;;;;AASA,IAAa,iBAAb,MAAa,uBAAuB,QAAQ,QAK1C,CAAC,CAAC,4BAA4B,CAAC,CAAC;;;;;;CAMhC,OAAgB,eAAe,MAAM,QAAQ,cAAc,CAAC,CAAC,EAC3D,OAAO,YACL,QAAQ,IACN,kCAAkC,QAAQ,MAAM,IAAI,SAAS,MAAM,QAAQ,IAAI,EAAA,YAChE,SAAS,UAAU,QAAQ,SAAS,EAAE,EACvD,EACJ,CAAC;AACH"}

package/dist/Errors.d.mts

@@ -0,0 +1,55 @@
+import { Schema } from "effect";
+//#region src/Errors.d.ts
+declare const InvalidEmailOtp_base: Schema.Class<InvalidEmailOtp, Schema.TaggedStruct<"InvalidEmailOtp", {}>, import("effect/Cause").YieldableError>;
+declare class InvalidEmailOtp extends InvalidEmailOtp_base {}
+declare const InvalidRegistration_base: Schema.Class<InvalidRegistration, Schema.TaggedStruct<"InvalidRegistration", {}>, import("effect/Cause").YieldableError>;
+declare class InvalidRegistration extends InvalidRegistration_base {}
+declare const InvalidCredentials_base: Schema.Class<InvalidCredentials, Schema.TaggedStruct<"InvalidCredentials", {}>, import("effect/Cause").YieldableError>;
+/**
+ * Password sign-in failure modes (unknown email, no password credential, wrong
+ * password) deliberately collapse into this one payload-free error so
+ * responses cannot be used to enumerate accounts.
+ */
+declare class InvalidCredentials extends InvalidCredentials_base {}
+declare const InvalidSession_base: Schema.Class<InvalidSession, Schema.TaggedStruct<"InvalidSession", {}>, import("effect/Cause").YieldableError>;
+/** Never a transport error itself; session middleware maps it to `Unauthorized`. */
+declare class InvalidSession extends InvalidSession_base {}
+declare const Unauthorized_base: Schema.Class<Unauthorized, Schema.TaggedStruct<"Unauthorized", {}>, import("effect/Cause").YieldableError>;
+declare class Unauthorized extends Unauthorized_base {}
+declare const InvalidAuthRequest_base: Schema.Class<InvalidAuthRequest, Schema.TaggedStruct<"InvalidAuthRequest", {
+  readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+declare class InvalidAuthRequest extends InvalidAuthRequest_base {}
+declare const AuthRateLimited_base: Schema.Class<AuthRateLimited, Schema.TaggedStruct<"AuthRateLimited", {
+  readonly retryAfterSeconds: Schema.optionalKey<Schema.Natural>;
+}>, import("effect/Cause").YieldableError>;
+declare class AuthRateLimited extends AuthRateLimited_base {}
+declare const RegistrationIncomplete_base: Schema.Class<RegistrationIncomplete, Schema.TaggedStruct<"RegistrationIncomplete", {}>, import("effect/Cause").YieldableError>;
+/**
+ * Registration cannot complete because the application has not yet created the
+ * email-to-subject mapping for the registration's verified email.
+ */
+declare class RegistrationIncomplete extends RegistrationIncomplete_base {}
+declare const AuthUnavailable_base: Schema.Class<AuthUnavailable, Schema.TaggedStruct<"AuthUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class AuthUnavailable extends AuthUnavailable_base {}
+declare const AuthStoreError_base: Schema.Class<AuthStoreError, Schema.TaggedStruct<"AuthStoreError", {
+  readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+declare class AuthStoreError extends AuthStoreError_base {
+  static readonly unavailable: AuthStoreError;
+}
+declare const AuthTokenError_base: Schema.Class<AuthTokenError, Schema.TaggedStruct<"AuthTokenError", {
+  readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+declare class AuthTokenError extends AuthTokenError_base {}
+declare const EmailDeliveryError_base: Schema.Class<EmailDeliveryError, Schema.TaggedStruct<"EmailDeliveryError", {
+  readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+declare class EmailDeliveryError extends EmailDeliveryError_base {}
+declare const IdentityResolutionError_base: Schema.Class<IdentityResolutionError, Schema.TaggedStruct<"IdentityResolutionError", {
+  readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+declare class IdentityResolutionError extends IdentityResolutionError_base {}
+//#endregion
+export { AuthRateLimited, AuthStoreError, AuthTokenError, AuthUnavailable, EmailDeliveryError, IdentityResolutionError, InvalidAuthRequest, InvalidCredentials, InvalidEmailOtp, InvalidRegistration, InvalidSession, RegistrationIncomplete, Unauthorized };
+//# sourceMappingURL=Errors.d.mts.map

package/dist/Errors.mjs

@@ -0,0 +1,31 @@
+import { Schema } from "effect";
+//#region src/Errors.ts
+var InvalidEmailOtp = class extends Schema.TaggedError()("InvalidEmailOtp", {}, { httpApiStatus: 401 }) {};
+var InvalidRegistration = class extends Schema.TaggedError()("InvalidRegistration", {}, { httpApiStatus: 401 }) {};
+/**
+* Password sign-in failure modes (unknown email, no password credential, wrong
+* password) deliberately collapse into this one payload-free error so
+* responses cannot be used to enumerate accounts.
+*/
+var InvalidCredentials = class extends Schema.TaggedError()("InvalidCredentials", {}, { httpApiStatus: 401 }) {};
+/** Never a transport error itself; session middleware maps it to `Unauthorized`. */
+var InvalidSession = class extends Schema.TaggedError()("InvalidSession", {}) {};
+var Unauthorized = class extends Schema.TaggedError()("Unauthorized", {}, { httpApiStatus: 401 }) {};
+var InvalidAuthRequest = class extends Schema.TaggedError()("InvalidAuthRequest", { message: Schema.NonEmptyString }, { httpApiStatus: 400 }) {};
+var AuthRateLimited = class extends Schema.TaggedError()("AuthRateLimited", { retryAfterSeconds: Schema.optionalKey(Schema.Natural) }, { httpApiStatus: 429 }) {};
+/**
+* Registration cannot complete because the application has not yet created the
+* email-to-subject mapping for the registration's verified email.
+*/
+var RegistrationIncomplete = class extends Schema.TaggedError()("RegistrationIncomplete", {}, { httpApiStatus: 409 }) {};
+var AuthUnavailable = class extends Schema.TaggedError()("AuthUnavailable", {}, { httpApiStatus: 503 }) {};
+var AuthStoreError = class AuthStoreError extends Schema.TaggedError()("AuthStoreError", { message: Schema.NonEmptyString }) {
+	static unavailable = AuthStoreError.make({ message: "The auth store is temporarily unavailable" });
+};
+var AuthTokenError = class extends Schema.TaggedError()("AuthTokenError", { message: Schema.NonEmptyString }) {};
+var EmailDeliveryError = class extends Schema.TaggedError()("EmailDeliveryError", { message: Schema.NonEmptyString }) {};
+var IdentityResolutionError = class extends Schema.TaggedError()("IdentityResolutionError", { message: Schema.NonEmptyString }) {};
+//#endregion
+export { AuthRateLimited, AuthStoreError, AuthTokenError, AuthUnavailable, EmailDeliveryError, IdentityResolutionError, InvalidAuthRequest, InvalidCredentials, InvalidEmailOtp, InvalidRegistration, InvalidSession, RegistrationIncomplete, Unauthorized };
+
+//# sourceMappingURL=Errors.mjs.map

package/dist/Errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Errors.mjs","names":[],"sources":["../src/Errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n// Declared in the style of effect's `HttpApiError` module: transport-facing\n// errors carry their HTTP status as a schema annotation on the class itself,\n// so endpoint and middleware declarations reference the class directly.\n\n// Expected authentication failures. OTP failure reasons (expired, missing,\n// wrong, superseded, consumed, exhausted) deliberately collapse into the same\n// public error so responses cannot be used to probe challenge state.\n\nexport class InvalidEmailOtp extends Schema.TaggedError<InvalidEmailOtp>()(\n  \"InvalidEmailOtp\",\n  {},\n  { httpApiStatus: 401 },\n) {}\n\nexport class InvalidRegistration extends Schema.TaggedError<InvalidRegistration>()(\n  \"InvalidRegistration\",\n  {},\n  { httpApiStatus: 401 },\n) {}\n\n/**\n * Password sign-in failure modes (unknown email, no password credential, wrong\n * password) deliberately collapse into this one payload-free error so\n * responses cannot be used to enumerate accounts.\n */\nexport class InvalidCredentials extends Schema.TaggedError<InvalidCredentials>()(\n  \"InvalidCredentials\",\n  {},\n  { httpApiStatus: 401 },\n) {}\n\n/** Never a transport error itself; session middleware maps it to `Unauthorized`. */\nexport class InvalidSession extends Schema.TaggedError<InvalidSession>()(\"InvalidSession\", {}) {}\n\nexport class Unauthorized extends Schema.TaggedError<Unauthorized>()(\n  \"Unauthorized\",\n  {},\n  { httpApiStatus: 401 },\n) {}\n\nexport class InvalidAuthRequest extends Schema.TaggedError<InvalidAuthRequest>()(\n  \"InvalidAuthRequest\",\n  {\n    message: Schema.NonEmptyString,\n  },\n  { httpApiStatus: 400 },\n) {}\n\nexport class AuthRateLimited extends Schema.TaggedError<AuthRateLimited>()(\n  \"AuthRateLimited\",\n  {\n    retryAfterSeconds: Schema.optionalKey(Schema.Natural),\n  },\n  { httpApiStatus: 429 },\n) {}\n\n/**\n * Registration cannot complete because the application has not yet created the\n * email-to-subject mapping for the registration's verified email.\n */\nexport class RegistrationIncomplete extends Schema.TaggedError<RegistrationIncomplete>()(\n  \"RegistrationIncomplete\",\n  {},\n  { httpApiStatus: 409 },\n) {}\n\n// Infrastructure failures. These map to 503 at the HTTP boundary so a key or\n// store outage does not silently sign users out. Messages must never contain\n// tokens, codes, digests, or key material.\n\nexport class AuthUnavailable extends Schema.TaggedError<AuthUnavailable>()(\n  \"AuthUnavailable\",\n  {},\n  { httpApiStatus: 503 },\n) {}\n\nexport class AuthStoreError extends Schema.TaggedError<AuthStoreError>()(\"AuthStoreError\", {\n  message: Schema.NonEmptyString,\n}) {\n  static readonly unavailable = AuthStoreError.make({\n    message: \"The auth store is temporarily unavailable\",\n  });\n}\n\nexport class AuthTokenError extends Schema.TaggedError<AuthTokenError>()(\"AuthTokenError\", {\n  message: Schema.NonEmptyString,\n}) {}\n\nexport class EmailDeliveryError extends Schema.TaggedError<EmailDeliveryError>()(\n  \"EmailDeliveryError\",\n  {\n    message: Schema.NonEmptyString,\n  },\n) {}\n\nexport class IdentityResolutionError extends Schema.TaggedError<IdentityResolutionError>()(\n  \"IdentityResolutionError\",\n  {\n    message: Schema.NonEmptyString,\n  },\n) {}\n"],"mappings":";;AAUA,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CACxE,mBACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;;;;;AAOH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;AAGH,IAAa,iBAAb,cAAoC,OAAO,YAA4B,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG,IAAa,eAAb,cAAkC,OAAO,YAA0B,CAAC,CAClE,gBACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;AAEH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,EACE,SAAS,OAAO,eAClB,GACA,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;AAEH,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CACxE,mBACA,EACE,mBAAmB,OAAO,YAAY,OAAO,OAAO,EACtD,GACA,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;;;;AAMH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;AAMH,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CACxE,mBACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;AAEH,IAAa,iBAAb,MAAa,uBAAuB,OAAO,YAA4B,CAAC,CAAC,kBAAkB,EACzF,SAAS,OAAO,eAClB,CAAC,CAAC,CAAC;CACD,OAAgB,cAAc,eAAe,KAAK,EAChD,SAAS,4CACX,CAAC;AACH;AAEA,IAAa,iBAAb,cAAoC,OAAO,YAA4B,CAAC,CAAC,kBAAkB,EACzF,SAAS,OAAO,eAClB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,EACE,SAAS,OAAO,eAClB,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,EACE,SAAS,OAAO,eAClB,CACF,CAAC,CAAC,CAAC"}

package/dist/GitHub.d.mts

@@ -0,0 +1,5 @@
+import { OpenIdClientConfigurationError } from "./oauth/openid-client/models.mjs";
+import { GitHubOAuthAppConnectedProtocolOptions, GitHubOAuthAppGeneration, GitHubOAuthAppProtocolOptions } from "./oauth/github/models.mjs";
+import { gitHubOAuthAppConnectedProtocolLayer, gitHubOAuthAppProtocolLayer, makeGitHubOAuthAppConnectedProtocol, makeGitHubOAuthAppProtocol } from "./oauth/github/protocol.mjs";
+import { gitHubOAuthAppProviderKey } from "./oauth/github/identity.mjs";
+export { type GitHubOAuthAppConnectedProtocolOptions, type GitHubOAuthAppGeneration, type GitHubOAuthAppProtocolOptions, OpenIdClientConfigurationError, gitHubOAuthAppConnectedProtocolLayer, gitHubOAuthAppProtocolLayer, gitHubOAuthAppProviderKey, makeGitHubOAuthAppConnectedProtocol, makeGitHubOAuthAppProtocol };

package/dist/GitHub.mjs

@@ -0,0 +1,4 @@
+import { OpenIdClientConfigurationError } from "./oauth/openid-client/models.mjs";
+import { gitHubOAuthAppProviderKey } from "./oauth/github/identity.mjs";
+import { gitHubOAuthAppConnectedProtocolLayer, gitHubOAuthAppProtocolLayer, makeGitHubOAuthAppConnectedProtocol, makeGitHubOAuthAppProtocol } from "./oauth/github/protocol.mjs";
+export { OpenIdClientConfigurationError, gitHubOAuthAppConnectedProtocolLayer, gitHubOAuthAppProtocolLayer, gitHubOAuthAppProviderKey, makeGitHubOAuthAppConnectedProtocol, makeGitHubOAuthAppProtocol };

package/dist/Hooks.d.mts

@@ -0,0 +1,6 @@
+import { HookConfigurationError, HookDelivery, HookDeliveryFailed, HookDenied, LifecycleAction, LifecycleEvent, LifecycleEventId, LifecycleSnapshot, lifecycleEvent, lifecycleSnapshot } from "./hooks/models.mjs";
+import { AnyHookContribution, HookContribution, HookContributionId, HookHandlers, LifecycleHooks, composeHooks, hookContribution } from "./hooks/LifecycleHooks.mjs";
+import { AtomicContribution, CommitMode, batchContribution, interactiveContribution, synchronousContribution, validateContributions } from "./hooks/transactions.mjs";
+import { BatchEventOutbox, CommitDiscarded, CommitJournal, CommitPending, CommitResult, EventOutbox, PreparedCommit, coordinateCommit, hasCommitScope } from "./hooks/commit.mjs";
+import { PluginContributions, RouteContribution, composePlugins, pluginContributions } from "./hooks/plugins.mjs";
+export { type AnyHookContribution, type AtomicContribution, type BatchEventOutbox, CommitDiscarded, type CommitJournal, type CommitMode, CommitPending, type CommitResult, type EventOutbox, HookConfigurationError, type HookContribution, type HookContributionId, type HookDelivery, HookDeliveryFailed, HookDenied, type HookHandlers, LifecycleAction, LifecycleEvent, LifecycleEventId, LifecycleHooks, LifecycleSnapshot, type PluginContributions, type PreparedCommit, type RouteContribution, batchContribution, composeHooks, composePlugins, coordinateCommit, hasCommitScope, hookContribution, interactiveContribution, lifecycleEvent, lifecycleSnapshot, pluginContributions, synchronousContribution, validateContributions };

package/dist/Hooks.mjs

@@ -0,0 +1,6 @@
+import { HookConfigurationError, HookDeliveryFailed, HookDenied, LifecycleAction, LifecycleEvent, LifecycleEventId, LifecycleSnapshot, lifecycleEvent, lifecycleSnapshot } from "./hooks/models.mjs";
+import { LifecycleHooks, composeHooks, hookContribution } from "./hooks/LifecycleHooks.mjs";
+import { batchContribution, interactiveContribution, synchronousContribution, validateContributions } from "./hooks/transactions.mjs";
+import { CommitDiscarded, CommitPending, coordinateCommit, hasCommitScope } from "./hooks/commit.mjs";
+import { composePlugins, pluginContributions } from "./hooks/plugins.mjs";
+export { CommitDiscarded, CommitPending, HookConfigurationError, HookDeliveryFailed, HookDenied, LifecycleAction, LifecycleEvent, LifecycleEventId, LifecycleHooks, LifecycleSnapshot, batchContribution, composeHooks, composePlugins, coordinateCommit, hasCommitScope, hookContribution, interactiveContribution, lifecycleEvent, lifecycleSnapshot, pluginContributions, synchronousContribution, validateContributions };

package/dist/Http.d.mts

@@ -0,0 +1,12 @@
+import { AuthHttpOptions, make } from "./http/auth-http.mjs";
+import { ExistingSessionResult, PasswordSignInPayload, RegistrationRequiredResult, RequestEmailOtpPayload, SessionState, SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired, SetPasswordPayload, VerifyEmailOtpPayload, VerifyEmailOtpResult } from "./http/models.mjs";
+import { CurrentSession } from "./internal/CurrentSession.mjs";
+import { ChallengeHeaderSecurity, ChallengeMiddleware, ChallengeSecurity, CurrentChallenge, CurrentRegistration, RegistrationHeaderSecurity, RegistrationMiddleware, RegistrationSecurity, SessionBearerSecurity, SessionMiddleware, SessionSecurity, authChallengeHeaderName, authRegistrationHeaderName, authTokenHeaderName, challengeCookieName, challengeHeaderName, registrationCookieName, registrationHeaderName, sessionCookieName } from "./http/security.mjs";
+import { AuthApi } from "./http/auth-api.mjs";
+import { GetSessionEndpoint } from "./http/endpoints/get-session.mjs";
+import { PasswordSignInEndpoint } from "./http/endpoints/password-sign-in.mjs";
+import { RequestEmailOtpEndpoint } from "./http/endpoints/request-email-otp.mjs";
+import { SetPasswordEndpoint } from "./http/endpoints/set-password.mjs";
+import { SignOutEndpoint } from "./http/endpoints/sign-out.mjs";
+import { VerifyEmailOtpEndpoint } from "./http/endpoints/verify-email-otp.mjs";
+export { AuthApi, type AuthHttpOptions, ChallengeHeaderSecurity, ChallengeMiddleware, ChallengeSecurity, CurrentChallenge, CurrentRegistration, CurrentSession, ExistingSessionResult, GetSessionEndpoint, PasswordSignInEndpoint, PasswordSignInPayload, RegistrationHeaderSecurity, RegistrationMiddleware, RegistrationRequiredResult, RegistrationSecurity, RequestEmailOtpEndpoint, RequestEmailOtpPayload, SessionBearerSecurity, SessionMiddleware, SessionSecurity, SessionState, SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired, SetPasswordEndpoint, SetPasswordPayload, SignOutEndpoint, VerifyEmailOtpEndpoint, VerifyEmailOtpPayload, VerifyEmailOtpResult, authChallengeHeaderName, authRegistrationHeaderName, authTokenHeaderName, challengeCookieName, challengeHeaderName, make, registrationCookieName, registrationHeaderName, sessionCookieName };

package/dist/Http.mjs

@@ -0,0 +1,12 @@
+import { make } from "./http/auth-http.mjs";
+import { ExistingSessionResult, PasswordSignInPayload, RegistrationRequiredResult, RequestEmailOtpPayload, SessionState, SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired, SetPasswordPayload, VerifyEmailOtpPayload, VerifyEmailOtpResult } from "./http/models.mjs";
+import { GetSessionEndpoint } from "./http/endpoints/get-session.mjs";
+import { PasswordSignInEndpoint } from "./http/endpoints/password-sign-in.mjs";
+import { RequestEmailOtpEndpoint } from "./http/endpoints/request-email-otp.mjs";
+import { CurrentSession } from "./internal/CurrentSession.mjs";
+import { ChallengeHeaderSecurity, ChallengeMiddleware, ChallengeSecurity, CurrentChallenge, CurrentRegistration, RegistrationHeaderSecurity, RegistrationMiddleware, RegistrationSecurity, SessionBearerSecurity, SessionMiddleware, SessionSecurity, authChallengeHeaderName, authRegistrationHeaderName, authTokenHeaderName, challengeCookieName, challengeHeaderName, registrationCookieName, registrationHeaderName, sessionCookieName } from "./http/security.mjs";
+import { SetPasswordEndpoint } from "./http/endpoints/set-password.mjs";
+import { SignOutEndpoint } from "./http/endpoints/sign-out.mjs";
+import { VerifyEmailOtpEndpoint } from "./http/endpoints/verify-email-otp.mjs";
+import { AuthApi } from "./http/auth-api.mjs";
+export { AuthApi, ChallengeHeaderSecurity, ChallengeMiddleware, ChallengeSecurity, CurrentChallenge, CurrentRegistration, CurrentSession, ExistingSessionResult, GetSessionEndpoint, PasswordSignInEndpoint, PasswordSignInPayload, RegistrationHeaderSecurity, RegistrationMiddleware, RegistrationRequiredResult, RegistrationSecurity, RequestEmailOtpEndpoint, RequestEmailOtpPayload, SessionBearerSecurity, SessionMiddleware, SessionSecurity, SessionState, SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired, SetPasswordEndpoint, SetPasswordPayload, SignOutEndpoint, VerifyEmailOtpEndpoint, VerifyEmailOtpPayload, VerifyEmailOtpResult, authChallengeHeaderName, authRegistrationHeaderName, authTokenHeaderName, challengeCookieName, challengeHeaderName, make, registrationCookieName, registrationHeaderName, sessionCookieName };