@yielded/auth 0.1.0-beta.1

package/dist/HttpServer.d.mts

@@ -0,0 +1,103 @@
+import { SessionSummary } from "./Schema.mjs";
+import { AuthStoreError, AuthTokenError, AuthUnavailable, IdentityResolutionError, InvalidRegistration, RegistrationIncomplete } from "./Errors.mjs";
+import { AuthSession, AuthSessionWithExtClass, IssuedSession } from "./AuthSession.mjs";
+import { EmailOtp } from "./EmailOtp.mjs";
+import { SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired } from "./http/models.mjs";
+import { ChallengeMiddleware, CurrentRegistration, RegistrationMiddleware, SessionMiddleware } from "./http/security.mjs";
+import { AuthApi } from "./http/auth-api.mjs";
+import { PasswordAuth } from "./PasswordAuth.mjs";
+import { Effect, Layer } from "effect";
+import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiSecurity } from "effect/unstable/httpapi";
+import { HttpServerResponse } from "effect/unstable/http";
+//#region src/HttpServer.d.ts
+/** Registers a pre-response handler that expires one of the auth cookies. */
+declare const expireSecurityCookie: (security: HttpApiSecurity.ApiKey) => Effect.Effect<void, never, import("effect/unstable/http/HttpServerRequest").HttpServerRequest>;
+/**
+ * Bearer-transport counterpart of {@link expireSecurityCookie}: an empty
+ * `set-auth-token` header tells cookie-less clients to drop their stored
+ * session token. Without it, sign-out only expires the cookie and a bearer
+ * client races its own token cleanup against the session refetch — the
+ * stateless token keeps verifying and the client re-authenticates itself
+ * straight back into the session it just revoked.
+ */
+declare const expireAuthTokenHeader: Effect.Effect<void, never, import("effect/unstable/http/HttpServerRequest").HttpServerRequest>;
+/**
+ * Applies the session to a concrete response for both transports. This is the
+ * raw-handler counterpart to {@link registerSession}; keeping both here makes
+ * the cookie and bearer-header contract a single source of truth.
+ */
+declare const setSessionOnResponse: (response: HttpServerResponse.HttpServerResponse, issued: IssuedSession) => HttpServerResponse.HttpServerResponse;
+/**
+ * Registers the session on the response for both transports: the HttpOnly
+ * cookie for browsers, and the `set-auth-token` header for clients that
+ * cannot read the cookie and echo the token back as `Authorization: Bearer`.
+ * Every place that issues a session must go through this so the two
+ * transports never drift — including application-owned handlers that issue
+ * sessions outside this module's workflows.
+ */
+declare const registerSession: (issued: IssuedSession) => Effect.Effect<void, never, import("effect/unstable/http/HttpServerRequest").HttpServerRequest>;
+/**
+ * Resolves the request's optional session and pending-registration credentials.
+ * Browser credentials prefer cookies; native clients can supply the same tokens
+ * through their corresponding headers.
+ * Invalid or expired credentials degrade to the next public state; failures
+ * in the token codec or auth store remain an explicit availability error.
+ */
+declare const resolveSessionState: Effect.Effect<SessionStateAnonymous | SessionStateAuthenticated | SessionStateRegistrationRequired, AuthUnavailable, AuthSession | EmailOtp | import("effect/unstable/http/HttpServerRequest").HttpServerRequest | import("effect/unstable/http/HttpServerRequest").ParsedSearchParams>;
+declare const SessionMiddlewareLayer: Layer.Layer<SessionMiddleware, never, AuthSession>;
+declare const RegistrationMiddlewareLayer: Layer.Layer<RegistrationMiddleware, never, EmailOtp>;
+declare const ChallengeMiddlewareLayer: Layer.Layer<ChallengeMiddleware>;
+/**
+ * Gate for the handler-layer factories: the consumer's API must contain an
+ * `auth` group with every canonical endpoint. API prefixes and middleware may
+ * wrap endpoint path and requirement types, so the check allows those two
+ * differences while preserving every transport schema.
+ */
+type AuthGroup<Groups> = Extract<Groups, {
+  readonly identifier: "auth";
+}>;
+type AuthGroupEndpoints<Groups> = AuthGroup<Groups> extends {
+  readonly endpoints: infer Endpoints;
+} ? Endpoints : never;
+type CanonicalAuthEndpoints = (typeof AuthApi)["endpoints"];
+type AuthEndpoint<Groups, Name> = Name extends keyof AuthGroupEndpoints<Groups> ? AuthGroupEndpoints<Groups>[Name] : never;
+type EndpointContract<Endpoint> = Endpoint extends HttpApiEndpoint.HttpApiEndpoint<infer Identifier, infer Method, infer _Path, infer Params, infer Query, infer Payload, infer Headers, infer Success, infer Error, infer _Middleware, infer _MiddlewareRequirements> ? [Identifier, Method, Params, Query, Payload, Headers, Success, Error] : never;
+type EndpointPath<Endpoint> = Endpoint extends {
+  readonly path: infer Path extends string;
+} ? Path : never;
+type Equal<Left, Right> = [Left, Right] extends [Right, Left] ? true : false;
+type CompatibleEndpoint<Candidate, Canonical> = Equal<EndpointContract<Candidate>, EndpointContract<Canonical>> extends true ? EndpointPath<Candidate> extends `${string}${EndpointPath<Canonical>}` ? true : false : false;
+type IncompatibleAuthEndpoints<Groups> = { [Name in keyof CanonicalAuthEndpoints]: CompatibleEndpoint<AuthEndpoint<Groups, Name>, CanonicalAuthEndpoints[Name]> extends true ? never : Name; }[keyof CanonicalAuthEndpoints];
+type RequiresAuthGroup<Groups> = [AuthGroup<Groups>] extends [never] ? {
+  readonly "~effect-auth": "the consumer HttpApi must include the AuthApi group";
+} : [IncompatibleAuthEndpoints<Groups>] extends [never] ? unknown : {
+  readonly "~effect-auth": "the consumer auth group must preserve every AuthApi endpoint contract";
+};
+/**
+ * Builds the handler layer for the `auth` group of a consumer `HttpApi` that
+ * includes {@link AuthApi}. The internal assertion re-anchors the builder on
+ * the canonical group so endpoint handlers type against it.
+ */
+declare const layerAuthHandlers: <ApiId extends string, Groups extends HttpApiGroup.Constraint, Self = never, Id extends string = string, A = never>(api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>, sessionExt?: AuthSessionWithExtClass<Self, Id, A>) => Layer.Layer<HttpApiGroup.Service<ApiId, "auth">, never, AuthSession | ChallengeMiddleware | EmailOtp | PasswordAuth | SessionMiddleware | Exclude<Self, import("effect/Scope").Scope>>;
+declare const establishSessionFromRegistration: Effect.Effect<SessionSummary, AuthStoreError | AuthTokenError | IdentityResolutionError | InvalidRegistration | RegistrationIncomplete, AuthSession | CurrentRegistration | EmailOtp | import("effect/unstable/http/HttpServerRequest").HttpServerRequest>;
+/**
+ * Everything the auth group needs at the HTTP boundary: handlers plus the
+ * middleware implementations. Requires `EmailOtp`, `PasswordAuth`, and
+ * `AuthSession`.
+ */
+declare const layerAuthHttp: <ApiId extends string, Groups extends HttpApiGroup.Constraint, Self = never, Id extends string = string, A = never>(api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>, sessionExt?: AuthSessionWithExtClass<Self, Id, A>) => Layer.Layer<RegistrationMiddleware | HttpApiGroup.Service<ApiId, "auth"> | SessionMiddleware, never, AuthSession | EmailOtp | PasswordAuth | Exclude<Exclude<Exclude<Self, import("effect/Scope").Scope>, ChallengeMiddleware>, RegistrationMiddleware | SessionMiddleware>>;
+declare const withSession: <Self, Id extends string, A>(sessionExt: AuthSessionWithExtClass<Self, Id, A>) => {
+  readonly layerHandlers: <ApiId extends string, Groups extends HttpApiGroup.Constraint>(api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>) => Layer.Layer<HttpApiGroup.Service<ApiId, "auth">, never, AuthSession | ChallengeMiddleware | EmailOtp | PasswordAuth | SessionMiddleware | Exclude<Self, import("effect/Scope").Scope>>;
+  readonly layer: <ApiId extends string, Groups extends HttpApiGroup.Constraint>(api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>) => Layer.Layer<RegistrationMiddleware | HttpApiGroup.Service<ApiId, "auth"> | SessionMiddleware, never, AuthSession | EmailOtp | PasswordAuth | Exclude<Exclude<Exclude<Self, import("effect/Scope").Scope>, ChallengeMiddleware>, RegistrationMiddleware | SessionMiddleware>>;
+  readonly establishSessionFromRegistration: Effect.Effect<SessionSummary, AuthStoreError | AuthTokenError | IdentityResolutionError | InvalidRegistration | RegistrationIncomplete, Self | AuthSession | CurrentRegistration | EmailOtp | import("effect/unstable/http/HttpServerRequest").HttpServerRequest>;
+};
+/**
+ * Binds an app-typed session declaration to extension-aware HTTP handlers and
+ * registration issuance while retaining runtime services as Effect requirements.
+ */
+declare const AuthHttp: {
+  readonly withSession: typeof withSession;
+};
+//#endregion
+export { AuthHttp, ChallengeMiddlewareLayer, RegistrationMiddlewareLayer, SessionMiddlewareLayer, establishSessionFromRegistration, expireAuthTokenHeader, expireSecurityCookie, layerAuthHandlers, layerAuthHttp, registerSession, resolveSessionState, setSessionOnResponse };
+//# sourceMappingURL=HttpServer.d.mts.map

package/dist/HttpServer.mjs

@@ -0,0 +1,326 @@
+import { Email, SessionSummary } from "./Schema.mjs";
+import { AuthUnavailable, InvalidAuthRequest, InvalidEmailOtp, InvalidRegistration, Unauthorized } from "./Errors.mjs";
+import { ExistingSessionResult, RegistrationRequiredResult, SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired } from "./http/models.mjs";
+import { CurrentSession } from "./internal/CurrentSession.mjs";
+import { ChallengeMiddleware, ChallengeSecurity, CurrentChallenge, CurrentRegistration, RegistrationHeaderSecurity, RegistrationMiddleware, RegistrationSecurity, SessionBearerSecurity, SessionMiddleware, SessionSecurity, authChallengeHeaderName, authRegistrationHeaderName, authTokenHeaderName } from "./http/security.mjs";
+import { AuthSession } from "./AuthSession.mjs";
+import { EmailOtp } from "./EmailOtp.mjs";
+import { PasswordAuth } from "./PasswordAuth.mjs";
+import { DateTime, Effect, Layer, Option, Redacted, Schema } from "effect";
+import { HttpApiBuilder } from "effect/unstable/httpapi";
+import { HttpEffect, HttpServerResponse } from "effect/unstable/http";
+//#region src/HttpServer.ts
+const decodeEmail = Schema.decodeEffect(Email);
+const issueSession = Effect.fn("effect-auth/issueSession")(function* (sessions, context, sessionExt) {
+	if (sessionExt === void 0) return yield* sessions.issue(context.subjectId);
+	return yield* sessionExt.issueFromContext(context);
+});
+const baseCookieOptions = {
+	path: "/",
+	sameSite: "lax",
+	secure: true,
+	httpOnly: true
+};
+const cookieOptionsUntil = (expiresAt) => ({
+	...baseCookieOptions,
+	expires: DateTime.toDateUtc(expiresAt)
+});
+/** Registers a pre-response handler that expires one of the auth cookies. */
+const expireSecurityCookie = (security) => HttpEffect.appendPreResponseHandler((_request, response) => Effect.orDie(HttpServerResponse.expireCookie(response, security.key, baseCookieOptions)));
+/**
+* Bearer-transport counterpart of {@link expireSecurityCookie}: an empty
+* `set-auth-token` header tells cookie-less clients to drop their stored
+* session token. Without it, sign-out only expires the cookie and a bearer
+* client races its own token cleanup against the session refetch — the
+* stateless token keeps verifying and the client re-authenticates itself
+* straight back into the session it just revoked.
+*/
+const expireAuthTokenHeader = HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(HttpServerResponse.setHeader(response, authTokenHeaderName, "")));
+/** Auth responses must never be cached. */
+const noStore = HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(HttpServerResponse.setHeader(response, "cache-control", "no-store")));
+/**
+* Applies the session to a concrete response for both transports. This is the
+* raw-handler counterpart to {@link registerSession}; keeping both here makes
+* the cookie and bearer-header contract a single source of truth.
+*/
+const setSessionOnResponse = (response, issued) => response.pipe(HttpServerResponse.setCookieUnsafe(SessionSecurity.key, issued.token, cookieOptionsUntil(issued.summary.expiresAt)), HttpServerResponse.setHeader(authTokenHeaderName, issued.token));
+/**
+* Registers the session on the response for both transports: the HttpOnly
+* cookie for browsers, and the `set-auth-token` header for clients that
+* cannot read the cookie and echo the token back as `Authorization: Bearer`.
+* Every place that issues a session must go through this so the two
+* transports never drift — including application-owned handlers that issue
+* sessions outside this module's workflows.
+*/
+const registerSession = (issued) => HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(setSessionOnResponse(response, issued)));
+/**
+* Mirrors a flow-intermediate token (challenge, registration) on a response
+* header, the same dual-transport rule as {@link registerSession}: the
+* SameSite cookie serves browsers, the header serves clients whose cookie
+* store never carries it, which echo it back as the matching `x-auth-*`
+* request header.
+*/
+const mirrorTokenHeader = (headerName, token) => HttpEffect.appendPreResponseHandler((_request, response) => Effect.succeed(HttpServerResponse.setHeader(response, headerName, Redacted.value(token))));
+const failUnavailable = Effect.fn("failUnavailable")(function* (operation, fault, detail) {
+	yield* Effect.logError(`${operation} failed`).pipe(Effect.annotateLogs({
+		fault,
+		detail
+	}));
+	return yield* AuthUnavailable.make();
+});
+/**
+* Resolves the request's optional session and pending-registration credentials.
+* Browser credentials prefer cookies; native clients can supply the same tokens
+* through their corresponding headers.
+* Invalid or expired credentials degrade to the next public state; failures
+* in the token codec or auth store remain an explicit availability error.
+*/
+const resolveSessionState = Effect.gen(function* () {
+	const sessions = yield* AuthSession;
+	const emailOtp = yield* EmailOtp;
+	const cookieCredential = yield* HttpApiBuilder.securityDecode(SessionSecurity);
+	const sessionCredential = Redacted.value(cookieCredential) !== "" ? cookieCredential : yield* HttpApiBuilder.securityDecode(SessionBearerSecurity);
+	if (Redacted.value(sessionCredential) !== "") {
+		const authenticated = yield* sessions.verifyAndRenew(sessionCredential).pipe(Effect.flatMap((verified) => Effect.gen(function* () {
+			if (Option.isSome(verified.renewal)) yield* registerSession(verified.renewal.value);
+			return Option.some(SessionStateAuthenticated.make({ session: SessionSummary.make({
+				subjectId: verified.claims.sub,
+				expiresAt: Option.match(verified.renewal, {
+					onNone: () => verified.claims.exp,
+					onSome: (renewal) => renewal.summary.expiresAt
+				})
+			}) }));
+		})), Effect.catchTags({
+			InvalidSession: () => Effect.succeed(Option.none()),
+			AuthTokenError: () => AuthUnavailable.make(),
+			IdentityResolutionError: () => AuthUnavailable.make()
+		}));
+		if (Option.isSome(authenticated)) return authenticated.value;
+	}
+	const registrationCookieCredential = yield* HttpApiBuilder.securityDecode(RegistrationSecurity);
+	const registrationCredential = Redacted.value(registrationCookieCredential) !== "" ? registrationCookieCredential : yield* HttpApiBuilder.securityDecode(RegistrationHeaderSecurity);
+	if (Redacted.value(registrationCredential) !== "") {
+		const pending = yield* emailOtp.inspectRegistration(registrationCredential).pipe(Effect.map((registration) => Option.some(SessionStateRegistrationRequired.make({
+			email: registration.email,
+			registrationExpiresAt: registration.expiresAt
+		}))), Effect.catchTags({
+			InvalidRegistration: () => Effect.succeed(Option.none()),
+			AuthStoreError: () => AuthUnavailable.make(),
+			AuthTokenError: () => AuthUnavailable.make()
+		}));
+		if (Option.isSome(pending)) return pending.value;
+	}
+	return SessionStateAnonymous.make();
+}).pipe(Effect.withSpan("effect-auth.resolveSessionState"));
+const SessionMiddlewareLayer = Layer.effect(SessionMiddleware)(Effect.map(AuthSession, (sessions) => {
+	const verifySession = Effect.fn("SessionMiddleware.session")(function* (httpEffect, { credential }) {
+		const sessionCredential = Redacted.value(credential) === "" ? yield* HttpApiBuilder.securityDecode(SessionSecurity) : credential;
+		if (Redacted.value(sessionCredential) === "") return yield* Unauthorized.make();
+		const verified = yield* sessions.verifyAndRenew(sessionCredential).pipe(Effect.catchTags({
+			InvalidSession: () => Unauthorized.make(),
+			AuthTokenError: () => AuthUnavailable.make(),
+			IdentityResolutionError: () => AuthUnavailable.make()
+		}));
+		const response = yield* Effect.provideService(httpEffect, CurrentSession, verified.claims);
+		if (Option.isSome(verified.renewal)) yield* registerSession(verified.renewal.value);
+		return response;
+	});
+	return SessionMiddleware.of({
+		session: verifySession,
+		sessionBearer: verifySession
+	});
+}));
+const RegistrationMiddlewareLayer = Layer.effect(RegistrationMiddleware)(Effect.map(EmailOtp, (emailOtp) => {
+	const verifyRegistration = Effect.fn("RegistrationMiddleware.registration")(function* (httpEffect, { credential }) {
+		if (Redacted.value(credential) === "") return yield* InvalidRegistration.make();
+		const registration = yield* emailOtp.inspectRegistration(credential).pipe(Effect.catchTags({
+			AuthStoreError: () => AuthUnavailable.make(),
+			AuthTokenError: () => AuthUnavailable.make()
+		}));
+		return yield* Effect.provideService(httpEffect, CurrentRegistration, {
+			registration,
+			token: credential
+		});
+	});
+	return RegistrationMiddleware.of({
+		registration: verifyRegistration,
+		registrationHeader: verifyRegistration
+	});
+}));
+const provideChallenge = (httpEffect, { credential }) => Redacted.value(credential) === "" ? Effect.fail(InvalidEmailOtp.make()) : Effect.provideService(httpEffect, CurrentChallenge, credential);
+const provideChallengeHeader = (httpEffect, input) => Redacted.value(input.credential) === "" ? Effect.logInfo("Email OTP verification rejected").pipe(Effect.annotateLogs({
+	"auth.method": "email_otp",
+	"auth.outcome": "rejected",
+	"auth.reason": "missing_challenge_credential"
+}), Effect.andThen(InvalidEmailOtp.make())) : provideChallenge(httpEffect, input);
+const ChallengeMiddlewareLayer = Layer.succeed(ChallengeMiddleware)(ChallengeMiddleware.of({
+	challenge: provideChallenge,
+	challengeHeader: provideChallengeHeader
+}));
+/**
+* Builds the handler layer for the `auth` group of a consumer `HttpApi` that
+* includes {@link AuthApi}. The internal assertion re-anchors the builder on
+* the canonical group so endpoint handlers type against it.
+*/
+const layerAuthHandlers = (api, sessionExt) => HttpApiBuilder.group(api, "auth", (handlers) => Effect.gen(function* () {
+	const emailOtp = yield* EmailOtp;
+	const sessions = yield* AuthSession;
+	const sessionsWithExt = sessionExt === void 0 ? void 0 : yield* sessionExt;
+	const passwords = yield* PasswordAuth;
+	const currentSessionState = resolveSessionState.pipe(Effect.provideService(EmailOtp, emailOtp), Effect.provideService(AuthSession, sessions));
+	return handlers.handle("requestEmailOtp", ({ payload }) => Effect.gen(function* () {
+		yield* noStore;
+		const email = yield* decodeEmail(payload.email).pipe(Effect.mapError(() => InvalidAuthRequest.make({ message: "A valid email address is required" })));
+		const challenge = yield* emailOtp.request(email).pipe(Effect.catchTags({
+			AuthStoreError: (error) => failUnavailable("Email OTP request", "auth store", error.message),
+			AuthTokenError: (error) => failUnavailable("Email OTP request", "token codec", error.message),
+			EmailDeliveryError: (error) => failUnavailable("Email OTP request", "email delivery", error.message)
+		}));
+		yield* HttpApiBuilder.securitySetCookie(ChallengeSecurity, challenge.challengeToken, cookieOptionsUntil(challenge.expiresAt));
+		yield* mirrorTokenHeader(authChallengeHeaderName, challenge.challengeToken);
+		yield* Effect.logInfo("Sign-in code requested").pipe(Effect.annotateLogs({
+			"auth.method": "email_otp",
+			"auth.outcome": "challenge_issued",
+			email,
+			expiresAt: DateTime.formatIso(challenge.expiresAt)
+		}));
+	})).handle("verifyEmailOtp", ({ payload }) => Effect.gen(function* () {
+		yield* noStore;
+		const challengeToken = yield* CurrentChallenge;
+		const outcome = yield* emailOtp.verify({
+			challengeToken,
+			code: payload.code
+		}).pipe(Effect.catchTags({
+			AuthStoreError: (error) => failUnavailable("Email OTP verification", "auth store", error.message),
+			AuthTokenError: (error) => failUnavailable("Email OTP verification", "token codec", error.message),
+			IdentityResolutionError: (error) => failUnavailable("Email OTP verification", "identity resolution", error.message)
+		}));
+		yield* expireSecurityCookie(ChallengeSecurity);
+		yield* Effect.logInfo("Sign-in code verified").pipe(Effect.annotateLogs({
+			"auth.method": "email_otp",
+			"auth.outcome": outcome._tag === "ExistingSubject" ? "existing_subject" : "registration_required"
+		}));
+		if (outcome._tag === "ExistingSubject") {
+			const issued = yield* issueSession(sessions, {
+				subjectId: outcome.subjectId,
+				email: outcome.email
+			}, sessionsWithExt).pipe(Effect.catchTag("AuthTokenError", (error) => failUnavailable("Session issuance", "token codec", error.message)));
+			yield* registerSession(issued);
+			yield* Effect.logInfo("Session issued").pipe(Effect.annotateLogs({
+				"auth.method": "email_otp",
+				"auth.outcome": "session_issued",
+				subjectId: outcome.subjectId,
+				expiresAt: DateTime.formatIso(issued.summary.expiresAt)
+			}));
+			return ExistingSessionResult.make({ session: issued.summary });
+		}
+		yield* HttpApiBuilder.securitySetCookie(RegistrationSecurity, outcome.registrationToken, cookieOptionsUntil(outcome.expiresAt));
+		yield* mirrorTokenHeader(authRegistrationHeaderName, outcome.registrationToken);
+		yield* Effect.logInfo("Registration required").pipe(Effect.annotateLogs({
+			"auth.method": "email_otp",
+			"auth.outcome": "registration_required",
+			email: outcome.email,
+			expiresAt: DateTime.formatIso(outcome.expiresAt)
+		}));
+		return RegistrationRequiredResult.make({
+			email: outcome.email,
+			registrationExpiresAt: outcome.expiresAt
+		});
+	})).handle("passwordSignIn", ({ payload }) => Effect.gen(function* () {
+		yield* noStore;
+		const email = yield* decodeEmail(payload.email).pipe(Effect.mapError(() => InvalidAuthRequest.make({ message: "A valid email address is required" })));
+		const subjectId = yield* passwords.signIn(email, payload.password).pipe(Effect.catchTags({
+			AuthStoreError: (error) => failUnavailable("Password sign-in", "credential store", error.message),
+			AuthTokenError: (error) => failUnavailable("Password sign-in", "password hasher", error.message)
+		}));
+		const issued = yield* issueSession(sessions, {
+			subjectId,
+			email
+		}, sessionsWithExt).pipe(Effect.catchTag("AuthTokenError", (error) => failUnavailable("Session issuance", "token codec", error.message)));
+		yield* registerSession(issued);
+		yield* Effect.logInfo("Session issued").pipe(Effect.annotateLogs({
+			"auth.method": "password",
+			"auth.outcome": "session_issued",
+			subjectId,
+			expiresAt: DateTime.formatIso(issued.summary.expiresAt)
+		}));
+		return SessionStateAuthenticated.make({ session: issued.summary });
+	})).handle("setPassword", ({ payload }) => Effect.gen(function* () {
+		yield* noStore;
+		const session = yield* CurrentSession;
+		yield* passwords.setPassword(session.sub, {
+			currentPassword: Option.fromNullishOr(payload.currentPassword),
+			newPassword: payload.newPassword
+		}).pipe(Effect.catchTags({
+			AuthStoreError: (error) => failUnavailable("Password change", "credential store", error.message),
+			AuthTokenError: (error) => failUnavailable("Password change", "password hasher", error.message)
+		}));
+		yield* Effect.logInfo("Password changed").pipe(Effect.annotateLogs({
+			"auth.method": "password",
+			"auth.outcome": "password_changed",
+			subjectId: session.sub
+		}));
+	})).handle("getSession", () => noStore.pipe(Effect.andThen(currentSessionState))).handle("signOut", () => Effect.gen(function* () {
+		yield* noStore;
+		yield* expireSecurityCookie(ChallengeSecurity);
+		yield* expireSecurityCookie(RegistrationSecurity);
+		yield* expireSecurityCookie(SessionSecurity);
+		yield* expireAuthTokenHeader;
+		yield* Effect.logInfo("Session signed out").pipe(Effect.annotateLogs({ "auth.outcome": "signed_out" }));
+	}));
+}));
+/**
+* Real onboarding workflow for application-owned, registration-protected
+* account endpoints: consumes the current pending registration, registers the
+* session cookie on the
+* response, and returns the session summary. Call it after the application has
+* idempotently created the account and email mapping.
+*/
+const establishSessionFromRegistrationWith = Effect.fn("effect-auth/establishSessionFromRegistration")(function* (sessionExt) {
+	const { registration, token } = yield* CurrentRegistration;
+	const emailOtp = yield* EmailOtp;
+	const sessions = yield* AuthSession;
+	const subjectId = yield* emailOtp.completeRegistration(token);
+	const issued = yield* issueSession(sessions, {
+		subjectId,
+		email: registration.email
+	}, sessionExt);
+	yield* registerSession(issued);
+	yield* expireSecurityCookie(RegistrationSecurity);
+	yield* Effect.logInfo("Registration completed; session issued").pipe(Effect.annotateLogs({
+		"auth.method": "email_otp",
+		"auth.outcome": "registration_completed",
+		subjectId,
+		email: registration.email,
+		expiresAt: DateTime.formatIso(issued.summary.expiresAt)
+	}));
+	return issued.summary;
+});
+const establishSessionFromRegistration = establishSessionFromRegistrationWith();
+/**
+* Everything the auth group needs at the HTTP boundary: handlers plus the
+* middleware implementations. Requires `EmailOtp`, `PasswordAuth`, and
+* `AuthSession`.
+*/
+const layerAuthHttp = (api, sessionExt) => layerAuthHandlers(api, sessionExt).pipe(Layer.provide(ChallengeMiddlewareLayer), Layer.provideMerge(Layer.mergeAll(SessionMiddlewareLayer, RegistrationMiddlewareLayer)));
+const withSession = (sessionExt) => {
+	const layerHandlers = (api) => layerAuthHandlers(api, sessionExt);
+	const layer = (api) => layerAuthHttp(api, sessionExt);
+	return {
+		layerHandlers,
+		layer,
+		establishSessionFromRegistration: Effect.gen(function* () {
+			const sessionsWithExt = yield* sessionExt;
+			return yield* establishSessionFromRegistrationWith(sessionsWithExt);
+		})
+	};
+};
+/**
+* Binds an app-typed session declaration to extension-aware HTTP handlers and
+* registration issuance while retaining runtime services as Effect requirements.
+*/
+const AuthHttp = { withSession };
+//#endregion
+export { AuthHttp, ChallengeMiddlewareLayer, RegistrationMiddlewareLayer, SessionMiddlewareLayer, establishSessionFromRegistration, expireAuthTokenHeader, expireSecurityCookie, layerAuthHandlers, layerAuthHttp, registerSession, resolveSessionState, setSessionOnResponse };
+
+//# sourceMappingURL=HttpServer.mjs.map

package/dist/HttpServer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpServer.mjs","names":[],"sources":["../src/HttpServer.ts"],"sourcesContent":["import { type Types, DateTime, Effect, Layer, Option, Redacted, Schema } from \"effect\";\nimport { type Cookies, HttpEffect, HttpServerResponse } from \"effect/unstable/http\";\nimport {\n  type HttpApi,\n  HttpApiBuilder,\n  type HttpApiEndpoint,\n  type HttpApiGroup,\n  type HttpApiSecurity,\n} from \"effect/unstable/httpapi\";\n\nimport {\n  type AuthSessionWithExtClass,\n  type AuthSessionWithExtService,\n  type IssuedSession,\n  type SessionExtContext,\n  AuthSession,\n} from \"./AuthSession\";\nimport { EmailOtp } from \"./EmailOtp\";\nimport {\n  AuthUnavailable,\n  InvalidAuthRequest,\n  InvalidEmailOtp,\n  InvalidRegistration,\n  Unauthorized,\n} from \"./Errors\";\nimport { type AuthApi } from \"./http/auth-api\";\nimport {\n  ExistingSessionResult,\n  RegistrationRequiredResult,\n  SessionStateAnonymous,\n  SessionStateAuthenticated,\n  SessionStateRegistrationRequired,\n} from \"./http/models\";\nimport {\n  authChallengeHeaderName,\n  authRegistrationHeaderName,\n  authTokenHeaderName,\n  ChallengeMiddleware,\n  ChallengeSecurity,\n  CurrentChallenge,\n  CurrentRegistration,\n  CurrentSession,\n  RegistrationHeaderSecurity,\n  RegistrationMiddleware,\n  RegistrationSecurity,\n  SessionBearerSecurity,\n  SessionMiddleware,\n  SessionSecurity,\n} from \"./http/security\";\nimport { PasswordAuth } from \"./PasswordAuth\";\nimport { Email, SessionSummary } from \"./Schema\";\n\nconst decodeEmail = Schema.decodeEffect(Email);\n\nconst issueSession = Effect.fn(\"effect-auth/issueSession\")(function* <A>(\n  sessions: AuthSession[\"Service\"],\n  context: SessionExtContext,\n  sessionExt?: AuthSessionWithExtService<A>,\n) {\n  if (sessionExt === undefined) {\n    return yield* sessions.issue(context.subjectId);\n  }\n\n  return yield* sessionExt.issueFromContext(context);\n});\n\n// --- Cookie helpers ----------------------------------------------------------\n//\n// Handlers never build `Set-Cookie` headers or parse `Cookie` headers; cookies\n// go through the Effect security helpers and pre-response combinators.\n\nconst baseCookieOptions = {\n  path: \"/\",\n  sameSite: \"lax\",\n  secure: true,\n  httpOnly: true,\n} satisfies Cookies.Cookie[\"options\"];\n\nconst cookieOptionsUntil = (expiresAt: DateTime.Utc): Cookies.Cookie[\"options\"] => ({\n  ...baseCookieOptions,\n  expires: DateTime.toDateUtc(expiresAt),\n});\n\n/** Registers a pre-response handler that expires one of the auth cookies. */\nexport const expireSecurityCookie = (security: HttpApiSecurity.ApiKey) =>\n  HttpEffect.appendPreResponseHandler((_request, response) =>\n    Effect.orDie(HttpServerResponse.expireCookie(response, security.key, baseCookieOptions)),\n  );\n\n/**\n * Bearer-transport counterpart of {@link expireSecurityCookie}: an empty\n * `set-auth-token` header tells cookie-less clients to drop their stored\n * session token. Without it, sign-out only expires the cookie and a bearer\n * client races its own token cleanup against the session refetch — the\n * stateless token keeps verifying and the client re-authenticates itself\n * straight back into the session it just revoked.\n */\nexport const expireAuthTokenHeader = HttpEffect.appendPreResponseHandler((_request, response) =>\n  Effect.succeed(HttpServerResponse.setHeader(response, authTokenHeaderName, \"\")),\n);\n\n/** Auth responses must never be cached. */\nconst noStore = HttpEffect.appendPreResponseHandler((_request, response) =>\n  Effect.succeed(HttpServerResponse.setHeader(response, \"cache-control\", \"no-store\")),\n);\n\n/**\n * Applies the session to a concrete response for both transports. This is the\n * raw-handler counterpart to {@link registerSession}; keeping both here makes\n * the cookie and bearer-header contract a single source of truth.\n */\nexport const setSessionOnResponse = (\n  response: HttpServerResponse.HttpServerResponse,\n  issued: IssuedSession,\n): HttpServerResponse.HttpServerResponse =>\n  response.pipe(\n    HttpServerResponse.setCookieUnsafe(\n      SessionSecurity.key,\n      issued.token,\n      cookieOptionsUntil(issued.summary.expiresAt),\n    ),\n    HttpServerResponse.setHeader(authTokenHeaderName, issued.token),\n  );\n\n/**\n * Registers the session on the response for both transports: the HttpOnly\n * cookie for browsers, and the `set-auth-token` header for clients that\n * cannot read the cookie and echo the token back as `Authorization: Bearer`.\n * Every place that issues a session must go through this so the two\n * transports never drift — including application-owned handlers that issue\n * sessions outside this module's workflows.\n */\nexport const registerSession = (issued: IssuedSession) =>\n  HttpEffect.appendPreResponseHandler((_request, response) =>\n    Effect.succeed(setSessionOnResponse(response, issued)),\n  );\n\n/**\n * Mirrors a flow-intermediate token (challenge, registration) on a response\n * header, the same dual-transport rule as {@link registerSession}: the\n * SameSite cookie serves browsers, the header serves clients whose cookie\n * store never carries it, which echo it back as the matching `x-auth-*`\n * request header.\n */\nconst mirrorTokenHeader = (headerName: string, token: Redacted.Redacted<string>) =>\n  HttpEffect.appendPreResponseHandler((_request, response) =>\n    Effect.succeed(HttpServerResponse.setHeader(response, headerName, Redacted.value(token))),\n  );\n\n// `AuthUnavailable` is all the caller should learn from a failed auth\n// operation, but collapsing distinct faults into one status leaves a 503 with\n// nothing to diagnose. Name the fault on the way past. Expected outcomes such\n// as rate limiting or invalid credentials are deliberately never logged.\nconst failUnavailable = Effect.fn(\"failUnavailable\")(function* (\n  operation: string,\n  fault: string,\n  detail: string,\n): Effect.fn.Return<never, AuthUnavailable> {\n  yield* Effect.logError(`${operation} failed`).pipe(Effect.annotateLogs({ fault, detail }));\n\n  return yield* AuthUnavailable.make();\n});\n\n/**\n * Resolves the request's optional session and pending-registration credentials.\n * Browser credentials prefer cookies; native clients can supply the same tokens\n * through their corresponding headers.\n * Invalid or expired credentials degrade to the next public state; failures\n * in the token codec or auth store remain an explicit availability error.\n */\nexport const resolveSessionState = Effect.gen(function* () {\n  const sessions = yield* AuthSession;\n  const emailOtp = yield* EmailOtp;\n  const cookieCredential = yield* HttpApiBuilder.securityDecode(SessionSecurity);\n\n  const sessionCredential =\n    Redacted.value(cookieCredential) !== \"\"\n      ? cookieCredential\n      : yield* HttpApiBuilder.securityDecode(SessionBearerSecurity);\n\n  if (Redacted.value(sessionCredential) !== \"\") {\n    const authenticated = yield* sessions.verifyAndRenew(sessionCredential).pipe(\n      Effect.flatMap((verified) =>\n        Effect.gen(function* () {\n          if (Option.isSome(verified.renewal)) {\n            yield* registerSession(verified.renewal.value);\n          }\n\n          return Option.some(\n            SessionStateAuthenticated.make({\n              session: SessionSummary.make({\n                subjectId: verified.claims.sub,\n                expiresAt: Option.match(verified.renewal, {\n                  onNone: () => verified.claims.exp,\n                  onSome: (renewal) => renewal.summary.expiresAt,\n                }),\n              }),\n            }),\n          );\n        }),\n      ),\n      Effect.catchTags({\n        InvalidSession: () => Effect.succeed(Option.none<SessionStateAuthenticated>()),\n        AuthTokenError: () => AuthUnavailable.make(),\n        IdentityResolutionError: () => AuthUnavailable.make(),\n      }),\n    );\n\n    if (Option.isSome(authenticated)) {\n      return authenticated.value;\n    }\n  }\n  const registrationCookieCredential = yield* HttpApiBuilder.securityDecode(RegistrationSecurity);\n\n  const registrationCredential =\n    Redacted.value(registrationCookieCredential) !== \"\"\n      ? registrationCookieCredential\n      : yield* HttpApiBuilder.securityDecode(RegistrationHeaderSecurity);\n\n  if (Redacted.value(registrationCredential) !== \"\") {\n    const pending = yield* emailOtp.inspectRegistration(registrationCredential).pipe(\n      Effect.map((registration) =>\n        Option.some(\n          SessionStateRegistrationRequired.make({\n            email: registration.email,\n            registrationExpiresAt: registration.expiresAt,\n          }),\n        ),\n      ),\n      Effect.catchTags({\n        InvalidRegistration: () => Effect.succeed(Option.none<SessionStateRegistrationRequired>()),\n        AuthStoreError: () => AuthUnavailable.make(),\n        AuthTokenError: () => AuthUnavailable.make(),\n      }),\n    );\n\n    if (Option.isSome(pending)) {\n      return pending.value;\n    }\n  }\n\n  return SessionStateAnonymous.make();\n}).pipe(Effect.withSpan(\"effect-auth.resolveSessionState\"));\n\n// --- Middleware implementations ------------------------------------------------\n\nexport const SessionMiddlewareLayer: Layer.Layer<SessionMiddleware, never, AuthSession> =\n  Layer.effect(SessionMiddleware)(\n    Effect.map(AuthSession, (sessions) => {\n      // Cookie and bearer carry the same session token, so both securities\n      // verify identically; failing on an absent credential is what lets the\n      // security dispatch fall through to the other transport.\n      const verifySession = Effect.fn(\"SessionMiddleware.session\")(function* (\n        httpEffect: Effect.Effect<\n          HttpServerResponse.HttpServerResponse,\n          Types.unhandled,\n          CurrentSession\n        >,\n        { credential }: { readonly credential: Redacted.Redacted<string> },\n      ) {\n        // An empty bearer fallback must not replace a cookie infrastructure\n        // failure with Unauthorized after security dispatch tries both.\n        const sessionCredential =\n          Redacted.value(credential) === \"\"\n            ? yield* HttpApiBuilder.securityDecode(SessionSecurity)\n            : credential;\n\n        if (Redacted.value(sessionCredential) === \"\") {\n          return yield* Unauthorized.make();\n        }\n\n        const verified = yield* sessions.verifyAndRenew(sessionCredential).pipe(\n          Effect.catchTags({\n            InvalidSession: () => Unauthorized.make(),\n            AuthTokenError: () => AuthUnavailable.make(),\n            IdentityResolutionError: () => AuthUnavailable.make(),\n          }),\n        );\n\n        const response = yield* Effect.provideService(httpEffect, CurrentSession, verified.claims);\n\n        if (Option.isSome(verified.renewal)) {\n          yield* registerSession(verified.renewal.value);\n        }\n\n        return response;\n      });\n\n      return SessionMiddleware.of({\n        session: verifySession,\n        sessionBearer: verifySession,\n      });\n    }),\n  );\n\nexport const RegistrationMiddlewareLayer: Layer.Layer<RegistrationMiddleware, never, EmailOtp> =\n  Layer.effect(RegistrationMiddleware)(\n    Effect.map(EmailOtp, (emailOtp) => {\n      // Cookie and header carry the same registration token; failing on an\n      // absent credential lets the security dispatch fall through to the\n      // other transport, same as SessionMiddleware.\n      const verifyRegistration = Effect.fn(\"RegistrationMiddleware.registration\")(function* (\n        httpEffect: Effect.Effect<\n          HttpServerResponse.HttpServerResponse,\n          Types.unhandled,\n          CurrentRegistration\n        >,\n        { credential }: { readonly credential: Redacted.Redacted<string> },\n      ) {\n        if (Redacted.value(credential) === \"\") {\n          return yield* InvalidRegistration.make();\n        }\n\n        const registration = yield* emailOtp.inspectRegistration(credential).pipe(\n          Effect.catchTags({\n            AuthStoreError: () => AuthUnavailable.make(),\n            AuthTokenError: () => AuthUnavailable.make(),\n          }),\n        );\n\n        return yield* Effect.provideService(httpEffect, CurrentRegistration, {\n          registration,\n          token: credential,\n        });\n      });\n\n      return RegistrationMiddleware.of({\n        registration: verifyRegistration,\n        registrationHeader: verifyRegistration,\n      });\n    }),\n  );\n\nconst provideChallenge = (\n  httpEffect: Effect.Effect<\n    HttpServerResponse.HttpServerResponse,\n    Types.unhandled,\n    CurrentChallenge\n  >,\n  { credential }: { readonly credential: Redacted.Redacted<string> },\n) =>\n  Redacted.value(credential) === \"\"\n    ? Effect.fail(InvalidEmailOtp.make())\n    : Effect.provideService(httpEffect, CurrentChallenge, credential);\n\nconst provideChallengeHeader = (\n  httpEffect: Effect.Effect<\n    HttpServerResponse.HttpServerResponse,\n    Types.unhandled,\n    CurrentChallenge\n  >,\n  input: { readonly credential: Redacted.Redacted<string> },\n) =>\n  Redacted.value(input.credential) === \"\"\n    ? Effect.logInfo(\"Email OTP verification rejected\").pipe(\n        Effect.annotateLogs({\n          \"auth.method\": \"email_otp\",\n          \"auth.outcome\": \"rejected\",\n          \"auth.reason\": \"missing_challenge_credential\",\n        }),\n        Effect.andThen(InvalidEmailOtp.make()),\n      )\n    : provideChallenge(httpEffect, input);\n\nexport const ChallengeMiddlewareLayer: Layer.Layer<ChallengeMiddleware> = Layer.succeed(\n  ChallengeMiddleware,\n)(\n  ChallengeMiddleware.of({\n    challenge: provideChallenge,\n    challengeHeader: provideChallengeHeader,\n  }),\n);\n\n// --- Handlers -------------------------------------------------------------------\n\n/**\n * Gate for the handler-layer factories: the consumer's API must contain an\n * `auth` group with every canonical endpoint. API prefixes and middleware may\n * wrap endpoint path and requirement types, so the check allows those two\n * differences while preserving every transport schema.\n */\ntype AuthGroup<Groups> = Extract<Groups, { readonly identifier: \"auth\" }>;\ntype AuthGroupEndpoints<Groups> =\n  AuthGroup<Groups> extends {\n    readonly endpoints: infer Endpoints;\n  }\n    ? Endpoints\n    : never;\ntype CanonicalAuthEndpoints = (typeof AuthApi)[\"endpoints\"];\ntype AuthEndpoint<Groups, Name> = Name extends keyof AuthGroupEndpoints<Groups>\n  ? AuthGroupEndpoints<Groups>[Name]\n  : never;\ntype EndpointContract<Endpoint> =\n  Endpoint extends HttpApiEndpoint.HttpApiEndpoint<\n    infer Identifier,\n    infer Method,\n    infer _Path,\n    infer Params,\n    infer Query,\n    infer Payload,\n    infer Headers,\n    infer Success,\n    infer Error,\n    infer _Middleware,\n    infer _MiddlewareRequirements\n  >\n    ? [Identifier, Method, Params, Query, Payload, Headers, Success, Error]\n    : never;\ntype EndpointPath<Endpoint> = Endpoint extends { readonly path: infer Path extends string }\n  ? Path\n  : never;\ntype Equal<Left, Right> = [Left, Right] extends [Right, Left] ? true : false;\ntype CompatibleEndpoint<Candidate, Canonical> =\n  Equal<EndpointContract<Candidate>, EndpointContract<Canonical>> extends true\n    ? EndpointPath<Candidate> extends `${string}${EndpointPath<Canonical>}`\n      ? true\n      : false\n    : false;\ntype IncompatibleAuthEndpoints<Groups> = {\n  [Name in keyof CanonicalAuthEndpoints]: CompatibleEndpoint<\n    AuthEndpoint<Groups, Name>,\n    CanonicalAuthEndpoints[Name]\n  > extends true\n    ? never\n    : Name;\n}[keyof CanonicalAuthEndpoints];\ntype RequiresAuthGroup<Groups> = [AuthGroup<Groups>] extends [never]\n  ? { readonly \"~effect-auth\": \"the consumer HttpApi must include the AuthApi group\" }\n  : [IncompatibleAuthEndpoints<Groups>] extends [never]\n    ? unknown\n    : {\n        readonly \"~effect-auth\": \"the consumer auth group must preserve every AuthApi endpoint contract\";\n      };\n\n/**\n * Builds the handler layer for the `auth` group of a consumer `HttpApi` that\n * includes {@link AuthApi}. The internal assertion re-anchors the builder on\n * the canonical group so endpoint handlers type against it.\n */\nexport const layerAuthHandlers = <\n  ApiId extends string,\n  Groups extends HttpApiGroup.Constraint,\n  Self = never,\n  Id extends string = string,\n  A = never,\n>(\n  api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>,\n  sessionExt?: AuthSessionWithExtClass<Self, Id, A>,\n) =>\n  HttpApiBuilder.group(\n    api as unknown as HttpApi.HttpApi<ApiId, typeof AuthApi>,\n    \"auth\",\n    (handlers) =>\n      Effect.gen(function* () {\n        const emailOtp = yield* EmailOtp;\n        const sessions = yield* AuthSession;\n        const sessionsWithExt = sessionExt === undefined ? undefined : yield* sessionExt;\n        const passwords = yield* PasswordAuth;\n\n        const currentSessionState = resolveSessionState.pipe(\n          Effect.provideService(EmailOtp, emailOtp),\n          Effect.provideService(AuthSession, sessions),\n        );\n\n        return handlers\n          .handle(\"requestEmailOtp\", ({ payload }) =>\n            Effect.gen(function* () {\n              yield* noStore;\n\n              const email = yield* decodeEmail(payload.email).pipe(\n                Effect.mapError(() =>\n                  InvalidAuthRequest.make({ message: \"A valid email address is required\" }),\n                ),\n              );\n\n              const challenge = yield* emailOtp.request(email).pipe(\n                Effect.catchTags({\n                  AuthStoreError: (error) =>\n                    failUnavailable(\"Email OTP request\", \"auth store\", error.message),\n                  AuthTokenError: (error) =>\n                    failUnavailable(\"Email OTP request\", \"token codec\", error.message),\n                  EmailDeliveryError: (error) =>\n                    failUnavailable(\"Email OTP request\", \"email delivery\", error.message),\n                }),\n              );\n\n              yield* HttpApiBuilder.securitySetCookie(\n                ChallengeSecurity,\n                challenge.challengeToken,\n                cookieOptionsUntil(challenge.expiresAt),\n              );\n              yield* mirrorTokenHeader(authChallengeHeaderName, challenge.challengeToken);\n              yield* Effect.logInfo(\"Sign-in code requested\").pipe(\n                Effect.annotateLogs({\n                  \"auth.method\": \"email_otp\",\n                  \"auth.outcome\": \"challenge_issued\",\n                  email,\n                  expiresAt: DateTime.formatIso(challenge.expiresAt),\n                }),\n              );\n            }),\n          )\n          .handle(\"verifyEmailOtp\", ({ payload }) =>\n            Effect.gen(function* () {\n              yield* noStore;\n              const challengeToken = yield* CurrentChallenge;\n\n              const outcome = yield* emailOtp.verify({ challengeToken, code: payload.code }).pipe(\n                Effect.catchTags({\n                  AuthStoreError: (error) =>\n                    failUnavailable(\"Email OTP verification\", \"auth store\", error.message),\n                  AuthTokenError: (error) =>\n                    failUnavailable(\"Email OTP verification\", \"token codec\", error.message),\n                  IdentityResolutionError: (error) =>\n                    failUnavailable(\"Email OTP verification\", \"identity resolution\", error.message),\n                }),\n              );\n\n              yield* expireSecurityCookie(ChallengeSecurity);\n              yield* Effect.logInfo(\"Sign-in code verified\").pipe(\n                Effect.annotateLogs({\n                  \"auth.method\": \"email_otp\",\n                  \"auth.outcome\":\n                    outcome._tag === \"ExistingSubject\"\n                      ? \"existing_subject\"\n                      : \"registration_required\",\n                }),\n              );\n              if (outcome._tag === \"ExistingSubject\") {\n                const issued = yield* issueSession(\n                  sessions,\n                  { subjectId: outcome.subjectId, email: outcome.email },\n                  sessionsWithExt,\n                ).pipe(\n                  Effect.catchTag(\"AuthTokenError\", (error) =>\n                    failUnavailable(\"Session issuance\", \"token codec\", error.message),\n                  ),\n                );\n\n                yield* registerSession(issued);\n                yield* Effect.logInfo(\"Session issued\").pipe(\n                  Effect.annotateLogs({\n                    \"auth.method\": \"email_otp\",\n                    \"auth.outcome\": \"session_issued\",\n                    subjectId: outcome.subjectId,\n                    expiresAt: DateTime.formatIso(issued.summary.expiresAt),\n                  }),\n                );\n\n                return ExistingSessionResult.make({ session: issued.summary });\n              }\n              yield* HttpApiBuilder.securitySetCookie(\n                RegistrationSecurity,\n                outcome.registrationToken,\n                cookieOptionsUntil(outcome.expiresAt),\n              );\n              yield* mirrorTokenHeader(authRegistrationHeaderName, outcome.registrationToken);\n              yield* Effect.logInfo(\"Registration required\").pipe(\n                Effect.annotateLogs({\n                  \"auth.method\": \"email_otp\",\n                  \"auth.outcome\": \"registration_required\",\n                  email: outcome.email,\n                  expiresAt: DateTime.formatIso(outcome.expiresAt),\n                }),\n              );\n\n              return RegistrationRequiredResult.make({\n                email: outcome.email,\n                registrationExpiresAt: outcome.expiresAt,\n              });\n            }),\n          )\n          .handle(\"passwordSignIn\", ({ payload }) =>\n            Effect.gen(function* () {\n              yield* noStore;\n\n              const email = yield* decodeEmail(payload.email).pipe(\n                Effect.mapError(() =>\n                  InvalidAuthRequest.make({ message: \"A valid email address is required\" }),\n                ),\n              );\n\n              const subjectId = yield* passwords.signIn(email, payload.password).pipe(\n                Effect.catchTags({\n                  AuthStoreError: (error) =>\n                    failUnavailable(\"Password sign-in\", \"credential store\", error.message),\n                  AuthTokenError: (error) =>\n                    failUnavailable(\"Password sign-in\", \"password hasher\", error.message),\n                }),\n              );\n\n              const issued = yield* issueSession(\n                sessions,\n                { subjectId, email },\n                sessionsWithExt,\n              ).pipe(\n                Effect.catchTag(\"AuthTokenError\", (error) =>\n                  failUnavailable(\"Session issuance\", \"token codec\", error.message),\n                ),\n              );\n\n              yield* registerSession(issued);\n              yield* Effect.logInfo(\"Session issued\").pipe(\n                Effect.annotateLogs({\n                  \"auth.method\": \"password\",\n                  \"auth.outcome\": \"session_issued\",\n                  subjectId,\n                  expiresAt: DateTime.formatIso(issued.summary.expiresAt),\n                }),\n              );\n\n              return SessionStateAuthenticated.make({ session: issued.summary });\n            }),\n          )\n          .handle(\"setPassword\", ({ payload }) =>\n            Effect.gen(function* () {\n              yield* noStore;\n              const session = yield* CurrentSession;\n\n              yield* passwords\n                .setPassword(session.sub, {\n                  currentPassword: Option.fromNullishOr(payload.currentPassword),\n                  newPassword: payload.newPassword,\n                })\n                .pipe(\n                  Effect.catchTags({\n                    AuthStoreError: (error) =>\n                      failUnavailable(\"Password change\", \"credential store\", error.message),\n                    AuthTokenError: (error) =>\n                      failUnavailable(\"Password change\", \"password hasher\", error.message),\n                  }),\n                );\n              yield* Effect.logInfo(\"Password changed\").pipe(\n                Effect.annotateLogs({\n                  \"auth.method\": \"password\",\n                  \"auth.outcome\": \"password_changed\",\n                  subjectId: session.sub,\n                }),\n              );\n            }),\n          )\n          .handle(\"getSession\", () => noStore.pipe(Effect.andThen(currentSessionState)))\n          .handle(\"signOut\", () =>\n            Effect.gen(function* () {\n              yield* noStore;\n              yield* expireSecurityCookie(ChallengeSecurity);\n              yield* expireSecurityCookie(RegistrationSecurity);\n              yield* expireSecurityCookie(SessionSecurity);\n              yield* expireAuthTokenHeader;\n              yield* Effect.logInfo(\"Session signed out\").pipe(\n                Effect.annotateLogs({ \"auth.outcome\": \"signed_out\" }),\n              );\n            }),\n          );\n      }),\n  );\n\n/**\n * Real onboarding workflow for application-owned, registration-protected\n * account endpoints: consumes the current pending registration, registers the\n * session cookie on the\n * response, and returns the session summary. Call it after the application has\n * idempotently created the account and email mapping.\n */\nconst establishSessionFromRegistrationWith = Effect.fn(\n  \"effect-auth/establishSessionFromRegistration\",\n)(function* <A>(sessionExt?: AuthSessionWithExtService<A>) {\n  const { registration, token } = yield* CurrentRegistration;\n  const emailOtp = yield* EmailOtp;\n  const sessions = yield* AuthSession;\n  const subjectId = yield* emailOtp.completeRegistration(token);\n\n  const issued = yield* issueSession(\n    sessions,\n    { subjectId, email: registration.email },\n    sessionExt,\n  );\n\n  yield* registerSession(issued);\n  yield* expireSecurityCookie(RegistrationSecurity);\n  yield* Effect.logInfo(\"Registration completed; session issued\").pipe(\n    Effect.annotateLogs({\n      \"auth.method\": \"email_otp\",\n      \"auth.outcome\": \"registration_completed\",\n      subjectId,\n      email: registration.email,\n      expiresAt: DateTime.formatIso(issued.summary.expiresAt),\n    }),\n  );\n\n  return issued.summary;\n});\n\nexport const establishSessionFromRegistration = establishSessionFromRegistrationWith();\n\n/**\n * Everything the auth group needs at the HTTP boundary: handlers plus the\n * middleware implementations. Requires `EmailOtp`, `PasswordAuth`, and\n * `AuthSession`.\n */\nexport const layerAuthHttp = <\n  ApiId extends string,\n  Groups extends HttpApiGroup.Constraint,\n  Self = never,\n  Id extends string = string,\n  A = never,\n>(\n  api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>,\n  sessionExt?: AuthSessionWithExtClass<Self, Id, A>,\n) =>\n  layerAuthHandlers(api, sessionExt).pipe(\n    Layer.provide(ChallengeMiddlewareLayer),\n    Layer.provideMerge(Layer.mergeAll(SessionMiddlewareLayer, RegistrationMiddlewareLayer)),\n  );\n\nconst withSession = <Self, Id extends string, A>(\n  sessionExt: AuthSessionWithExtClass<Self, Id, A>,\n) => {\n  const layerHandlers = <ApiId extends string, Groups extends HttpApiGroup.Constraint>(\n    api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>,\n  ) => layerAuthHandlers(api, sessionExt);\n\n  const layer = <ApiId extends string, Groups extends HttpApiGroup.Constraint>(\n    api: HttpApi.HttpApi<ApiId, Groups> & NoInfer<RequiresAuthGroup<Groups>>,\n  ) => layerAuthHttp(api, sessionExt);\n\n  const establishSessionFromRegistration = Effect.gen(function* () {\n    const sessionsWithExt = yield* sessionExt;\n\n    return yield* establishSessionFromRegistrationWith(sessionsWithExt);\n  });\n\n  return { layerHandlers, layer, establishSessionFromRegistration } as const;\n};\n\n/**\n * Binds an app-typed session declaration to extension-aware HTTP handlers and\n * registration issuance while retaining runtime services as Effect requirements.\n */\nexport const AuthHttp = {\n  withSession,\n} as const;\n"],"mappings":";;;;;;;;;;;;AAoDA,MAAM,cAAc,OAAO,aAAa,KAAK;AAE7C,MAAM,eAAe,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACzD,UACA,SACA,YACA;CACA,IAAI,eAAe,KAAA,GACjB,OAAO,OAAO,SAAS,MAAM,QAAQ,SAAS;CAGhD,OAAO,OAAO,WAAW,iBAAiB,OAAO;AACnD,CAAC;AAOD,MAAM,oBAAoB;CACxB,MAAM;CACN,UAAU;CACV,QAAQ;CACR,UAAU;AACZ;AAEA,MAAM,sBAAsB,eAAwD;CAClF,GAAG;CACH,SAAS,SAAS,UAAU,SAAS;AACvC;;AAGA,MAAa,wBAAwB,aACnC,WAAW,0BAA0B,UAAU,aAC7C,OAAO,MAAM,mBAAmB,aAAa,UAAU,SAAS,KAAK,iBAAiB,CAAC,CACzF;;;;;;;;;AAUF,MAAa,wBAAwB,WAAW,0BAA0B,UAAU,aAClF,OAAO,QAAQ,mBAAmB,UAAU,UAAU,qBAAqB,EAAE,CAAC,CAChF;;AAGA,MAAM,UAAU,WAAW,0BAA0B,UAAU,aAC7D,OAAO,QAAQ,mBAAmB,UAAU,UAAU,iBAAiB,UAAU,CAAC,CACpF;;;;;;AAOA,MAAa,wBACX,UACA,WAEA,SAAS,KACP,mBAAmB,gBACjB,gBAAgB,KAChB,OAAO,OACP,mBAAmB,OAAO,QAAQ,SAAS,CAC7C,GACA,mBAAmB,UAAU,qBAAqB,OAAO,KAAK,CAChE;;;;;;;;;AAUF,MAAa,mBAAmB,WAC9B,WAAW,0BAA0B,UAAU,aAC7C,OAAO,QAAQ,qBAAqB,UAAU,MAAM,CAAC,CACvD;;;;;;;;AASF,MAAM,qBAAqB,YAAoB,UAC7C,WAAW,0BAA0B,UAAU,aAC7C,OAAO,QAAQ,mBAAmB,UAAU,UAAU,YAAY,SAAS,MAAM,KAAK,CAAC,CAAC,CAC1F;AAMF,MAAM,kBAAkB,OAAO,GAAG,iBAAiB,CAAC,CAAC,WACnD,WACA,OACA,QAC0C;CAC1C,OAAO,OAAO,SAAS,GAAG,UAAU,QAAQ,CAAC,CAAC,KAAK,OAAO,aAAa;EAAE;EAAO;CAAO,CAAC,CAAC;CAEzF,OAAO,OAAO,gBAAgB,KAAK;AACrC,CAAC;;;;;;;;AASD,MAAa,sBAAsB,OAAO,IAAI,aAAa;CACzD,MAAM,WAAW,OAAO;CACxB,MAAM,WAAW,OAAO;CACxB,MAAM,mBAAmB,OAAO,eAAe,eAAe,eAAe;CAE7E,MAAM,oBACJ,SAAS,MAAM,gBAAgB,MAAM,KACjC,mBACA,OAAO,eAAe,eAAe,qBAAqB;CAEhE,IAAI,SAAS,MAAM,iBAAiB,MAAM,IAAI;EAC5C,MAAM,gBAAgB,OAAO,SAAS,eAAe,iBAAiB,CAAC,CAAC,KACtE,OAAO,SAAS,aACd,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,OAAO,SAAS,OAAO,GAChC,OAAO,gBAAgB,SAAS,QAAQ,KAAK;GAG/C,OAAO,OAAO,KACZ,0BAA0B,KAAK,EAC7B,SAAS,eAAe,KAAK;IAC3B,WAAW,SAAS,OAAO;IAC3B,WAAW,OAAO,MAAM,SAAS,SAAS;KACxC,cAAc,SAAS,OAAO;KAC9B,SAAS,YAAY,QAAQ,QAAQ;IACvC,CAAC;GACH,CAAC,EACH,CAAC,CACH;EACF,CAAC,CACH,GACA,OAAO,UAAU;GACf,sBAAsB,OAAO,QAAQ,OAAO,KAAgC,CAAC;GAC7E,sBAAsB,gBAAgB,KAAK;GAC3C,+BAA+B,gBAAgB,KAAK;EACtD,CAAC,CACH;EAEA,IAAI,OAAO,OAAO,aAAa,GAC7B,OAAO,cAAc;CAEzB;CACA,MAAM,+BAA+B,OAAO,eAAe,eAAe,oBAAoB;CAE9F,MAAM,yBACJ,SAAS,MAAM,4BAA4B,MAAM,KAC7C,+BACA,OAAO,eAAe,eAAe,0BAA0B;CAErE,IAAI,SAAS,MAAM,sBAAsB,MAAM,IAAI;EACjD,MAAM,UAAU,OAAO,SAAS,oBAAoB,sBAAsB,CAAC,CAAC,KAC1E,OAAO,KAAK,iBACV,OAAO,KACL,iCAAiC,KAAK;GACpC,OAAO,aAAa;GACpB,uBAAuB,aAAa;EACtC,CAAC,CACH,CACF,GACA,OAAO,UAAU;GACf,2BAA2B,OAAO,QAAQ,OAAO,KAAuC,CAAC;GACzF,sBAAsB,gBAAgB,KAAK;GAC3C,sBAAsB,gBAAgB,KAAK;EAC7C,CAAC,CACH;EAEA,IAAI,OAAO,OAAO,OAAO,GACvB,OAAO,QAAQ;CAEnB;CAEA,OAAO,sBAAsB,KAAK;AACpC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,iCAAiC,CAAC;AAI1D,MAAa,yBACX,MAAM,OAAO,iBAAiB,CAAC,CAC7B,OAAO,IAAI,cAAc,aAAa;CAIpC,MAAM,gBAAgB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC3D,YAKA,EAAE,cACF;EAGA,MAAM,oBACJ,SAAS,MAAM,UAAU,MAAM,KAC3B,OAAO,eAAe,eAAe,eAAe,IACpD;EAEN,IAAI,SAAS,MAAM,iBAAiB,MAAM,IACxC,OAAO,OAAO,aAAa,KAAK;EAGlC,MAAM,WAAW,OAAO,SAAS,eAAe,iBAAiB,CAAC,CAAC,KACjE,OAAO,UAAU;GACf,sBAAsB,aAAa,KAAK;GACxC,sBAAsB,gBAAgB,KAAK;GAC3C,+BAA+B,gBAAgB,KAAK;EACtD,CAAC,CACH;EAEA,MAAM,WAAW,OAAO,OAAO,eAAe,YAAY,gBAAgB,SAAS,MAAM;EAEzF,IAAI,OAAO,OAAO,SAAS,OAAO,GAChC,OAAO,gBAAgB,SAAS,QAAQ,KAAK;EAG/C,OAAO;CACT,CAAC;CAED,OAAO,kBAAkB,GAAG;EAC1B,SAAS;EACT,eAAe;CACjB,CAAC;AACH,CAAC,CACH;AAEF,MAAa,8BACX,MAAM,OAAO,sBAAsB,CAAC,CAClC,OAAO,IAAI,WAAW,aAAa;CAIjC,MAAM,qBAAqB,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAC1E,YAKA,EAAE,cACF;EACA,IAAI,SAAS,MAAM,UAAU,MAAM,IACjC,OAAO,OAAO,oBAAoB,KAAK;EAGzC,MAAM,eAAe,OAAO,SAAS,oBAAoB,UAAU,CAAC,CAAC,KACnE,OAAO,UAAU;GACf,sBAAsB,gBAAgB,KAAK;GAC3C,sBAAsB,gBAAgB,KAAK;EAC7C,CAAC,CACH;EAEA,OAAO,OAAO,OAAO,eAAe,YAAY,qBAAqB;GACnE;GACA,OAAO;EACT,CAAC;CACH,CAAC;CAED,OAAO,uBAAuB,GAAG;EAC/B,cAAc;EACd,oBAAoB;CACtB,CAAC;AACH,CAAC,CACH;AAEF,MAAM,oBACJ,YAKA,EAAE,iBAEF,SAAS,MAAM,UAAU,MAAM,KAC3B,OAAO,KAAK,gBAAgB,KAAK,CAAC,IAClC,OAAO,eAAe,YAAY,kBAAkB,UAAU;AAEpE,MAAM,0BACJ,YAKA,UAEA,SAAS,MAAM,MAAM,UAAU,MAAM,KACjC,OAAO,QAAQ,iCAAiC,CAAC,CAAC,KAChD,OAAO,aAAa;CAClB,eAAe;CACf,gBAAgB;CAChB,eAAe;AACjB,CAAC,GACD,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CACvC,IACA,iBAAiB,YAAY,KAAK;AAExC,MAAa,2BAA6D,MAAM,QAC9E,mBACF,CAAC,CACC,oBAAoB,GAAG;CACrB,WAAW;CACX,iBAAiB;AACnB,CAAC,CACH;;;;;;AAoEA,MAAa,qBAOX,KACA,eAEA,eAAe,MACb,KACA,SACC,aACC,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,WAAW,OAAO;CACxB,MAAM,kBAAkB,eAAe,KAAA,IAAY,KAAA,IAAY,OAAO;CACtE,MAAM,YAAY,OAAO;CAEzB,MAAM,sBAAsB,oBAAoB,KAC9C,OAAO,eAAe,UAAU,QAAQ,GACxC,OAAO,eAAe,aAAa,QAAQ,CAC7C;CAEA,OAAO,SACJ,OAAO,oBAAoB,EAAE,cAC5B,OAAO,IAAI,aAAa;EACtB,OAAO;EAEP,MAAM,QAAQ,OAAO,YAAY,QAAQ,KAAK,CAAC,CAAC,KAC9C,OAAO,eACL,mBAAmB,KAAK,EAAE,SAAS,oCAAoC,CAAC,CAC1E,CACF;EAEA,MAAM,YAAY,OAAO,SAAS,QAAQ,KAAK,CAAC,CAAC,KAC/C,OAAO,UAAU;GACf,iBAAiB,UACf,gBAAgB,qBAAqB,cAAc,MAAM,OAAO;GAClE,iBAAiB,UACf,gBAAgB,qBAAqB,eAAe,MAAM,OAAO;GACnE,qBAAqB,UACnB,gBAAgB,qBAAqB,kBAAkB,MAAM,OAAO;EACxE,CAAC,CACH;EAEA,OAAO,eAAe,kBACpB,mBACA,UAAU,gBACV,mBAAmB,UAAU,SAAS,CACxC;EACA,OAAO,kBAAkB,yBAAyB,UAAU,cAAc;EAC1E,OAAO,OAAO,QAAQ,wBAAwB,CAAC,CAAC,KAC9C,OAAO,aAAa;GAClB,eAAe;GACf,gBAAgB;GAChB;GACA,WAAW,SAAS,UAAU,UAAU,SAAS;EACnD,CAAC,CACH;CACF,CAAC,CACH,CAAC,CACA,OAAO,mBAAmB,EAAE,cAC3B,OAAO,IAAI,aAAa;EACtB,OAAO;EACP,MAAM,iBAAiB,OAAO;EAE9B,MAAM,UAAU,OAAO,SAAS,OAAO;GAAE;GAAgB,MAAM,QAAQ;EAAK,CAAC,CAAC,CAAC,KAC7E,OAAO,UAAU;GACf,iBAAiB,UACf,gBAAgB,0BAA0B,cAAc,MAAM,OAAO;GACvE,iBAAiB,UACf,gBAAgB,0BAA0B,eAAe,MAAM,OAAO;GACxE,0BAA0B,UACxB,gBAAgB,0BAA0B,uBAAuB,MAAM,OAAO;EAClF,CAAC,CACH;EAEA,OAAO,qBAAqB,iBAAiB;EAC7C,OAAO,OAAO,QAAQ,uBAAuB,CAAC,CAAC,KAC7C,OAAO,aAAa;GAClB,eAAe;GACf,gBACE,QAAQ,SAAS,oBACb,qBACA;EACR,CAAC,CACH;EACA,IAAI,QAAQ,SAAS,mBAAmB;GACtC,MAAM,SAAS,OAAO,aACpB,UACA;IAAE,WAAW,QAAQ;IAAW,OAAO,QAAQ;GAAM,GACrD,eACF,CAAC,CAAC,KACA,OAAO,SAAS,mBAAmB,UACjC,gBAAgB,oBAAoB,eAAe,MAAM,OAAO,CAClE,CACF;GAEA,OAAO,gBAAgB,MAAM;GAC7B,OAAO,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KACtC,OAAO,aAAa;IAClB,eAAe;IACf,gBAAgB;IAChB,WAAW,QAAQ;IACnB,WAAW,SAAS,UAAU,OAAO,QAAQ,SAAS;GACxD,CAAC,CACH;GAEA,OAAO,sBAAsB,KAAK,EAAE,SAAS,OAAO,QAAQ,CAAC;EAC/D;EACA,OAAO,eAAe,kBACpB,sBACA,QAAQ,mBACR,mBAAmB,QAAQ,SAAS,CACtC;EACA,OAAO,kBAAkB,4BAA4B,QAAQ,iBAAiB;EAC9E,OAAO,OAAO,QAAQ,uBAAuB,CAAC,CAAC,KAC7C,OAAO,aAAa;GAClB,eAAe;GACf,gBAAgB;GAChB,OAAO,QAAQ;GACf,WAAW,SAAS,UAAU,QAAQ,SAAS;EACjD,CAAC,CACH;EAEA,OAAO,2BAA2B,KAAK;GACrC,OAAO,QAAQ;GACf,uBAAuB,QAAQ;EACjC,CAAC;CACH,CAAC,CACH,CAAC,CACA,OAAO,mBAAmB,EAAE,cAC3B,OAAO,IAAI,aAAa;EACtB,OAAO;EAEP,MAAM,QAAQ,OAAO,YAAY,QAAQ,KAAK,CAAC,CAAC,KAC9C,OAAO,eACL,mBAAmB,KAAK,EAAE,SAAS,oCAAoC,CAAC,CAC1E,CACF;EAEA,MAAM,YAAY,OAAO,UAAU,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,KACjE,OAAO,UAAU;GACf,iBAAiB,UACf,gBAAgB,oBAAoB,oBAAoB,MAAM,OAAO;GACvE,iBAAiB,UACf,gBAAgB,oBAAoB,mBAAmB,MAAM,OAAO;EACxE,CAAC,CACH;EAEA,MAAM,SAAS,OAAO,aACpB,UACA;GAAE;GAAW;EAAM,GACnB,eACF,CAAC,CAAC,KACA,OAAO,SAAS,mBAAmB,UACjC,gBAAgB,oBAAoB,eAAe,MAAM,OAAO,CAClE,CACF;EAEA,OAAO,gBAAgB,MAAM;EAC7B,OAAO,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KACtC,OAAO,aAAa;GAClB,eAAe;GACf,gBAAgB;GAChB;GACA,WAAW,SAAS,UAAU,OAAO,QAAQ,SAAS;EACxD,CAAC,CACH;EAEA,OAAO,0BAA0B,KAAK,EAAE,SAAS,OAAO,QAAQ,CAAC;CACnE,CAAC,CACH,CAAC,CACA,OAAO,gBAAgB,EAAE,cACxB,OAAO,IAAI,aAAa;EACtB,OAAO;EACP,MAAM,UAAU,OAAO;EAEvB,OAAO,UACJ,YAAY,QAAQ,KAAK;GACxB,iBAAiB,OAAO,cAAc,QAAQ,eAAe;GAC7D,aAAa,QAAQ;EACvB,CAAC,CAAC,CACD,KACC,OAAO,UAAU;GACf,iBAAiB,UACf,gBAAgB,mBAAmB,oBAAoB,MAAM,OAAO;GACtE,iBAAiB,UACf,gBAAgB,mBAAmB,mBAAmB,MAAM,OAAO;EACvE,CAAC,CACH;EACF,OAAO,OAAO,QAAQ,kBAAkB,CAAC,CAAC,KACxC,OAAO,aAAa;GAClB,eAAe;GACf,gBAAgB;GAChB,WAAW,QAAQ;EACrB,CAAC,CACH;CACF,CAAC,CACH,CAAC,CACA,OAAO,oBAAoB,QAAQ,KAAK,OAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,CAC7E,OAAO,iBACN,OAAO,IAAI,aAAa;EACtB,OAAO;EACP,OAAO,qBAAqB,iBAAiB;EAC7C,OAAO,qBAAqB,oBAAoB;EAChD,OAAO,qBAAqB,eAAe;EAC3C,OAAO;EACP,OAAO,OAAO,QAAQ,oBAAoB,CAAC,CAAC,KAC1C,OAAO,aAAa,EAAE,gBAAgB,aAAa,CAAC,CACtD;CACF,CAAC,CACH;AACJ,CAAC,CACL;;;;;;;;AASF,MAAM,uCAAuC,OAAO,GAClD,8CACF,CAAC,CAAC,WAAc,YAA2C;CACzD,MAAM,EAAE,cAAc,UAAU,OAAO;CACvC,MAAM,WAAW,OAAO;CACxB,MAAM,WAAW,OAAO;CACxB,MAAM,YAAY,OAAO,SAAS,qBAAqB,KAAK;CAE5D,MAAM,SAAS,OAAO,aACpB,UACA;EAAE;EAAW,OAAO,aAAa;CAAM,GACvC,UACF;CAEA,OAAO,gBAAgB,MAAM;CAC7B,OAAO,qBAAqB,oBAAoB;CAChD,OAAO,OAAO,QAAQ,wCAAwC,CAAC,CAAC,KAC9D,OAAO,aAAa;EAClB,eAAe;EACf,gBAAgB;EAChB;EACA,OAAO,aAAa;EACpB,WAAW,SAAS,UAAU,OAAO,QAAQ,SAAS;CACxD,CAAC,CACH;CAEA,OAAO,OAAO;AAChB,CAAC;AAED,MAAa,mCAAmC,qCAAqC;;;;;;AAOrF,MAAa,iBAOX,KACA,eAEA,kBAAkB,KAAK,UAAU,CAAC,CAAC,KACjC,MAAM,QAAQ,wBAAwB,GACtC,MAAM,aAAa,MAAM,SAAS,wBAAwB,2BAA2B,CAAC,CACxF;AAEF,MAAM,eACJ,eACG;CACH,MAAM,iBACJ,QACG,kBAAkB,KAAK,UAAU;CAEtC,MAAM,SACJ,QACG,cAAc,KAAK,UAAU;CAQlC,OAAO;EAAE;EAAe;EAAO,kCANU,OAAO,IAAI,aAAa;GAC/D,MAAM,kBAAkB,OAAO;GAE/B,OAAO,OAAO,qCAAqC,eAAe;EACpE,CAE8D;CAAE;AAClE;;;;;AAMA,MAAa,WAAW,EACtB,YACF"}

package/dist/Identity.d.mts

@@ -0,0 +1,9 @@
+import { CredentialId, CredentialSummary, ExternalIdentity, IdentifierBinding, IdentityConflict, IdentityUnavailable, LastSignInMethod, LoginIdentifier, ProvisioningPending, ProvisioningResult, RecoveryReference, SubjectInactive, SubjectProvisioned, SubjectSnapshot } from "./identity/models.mjs";
+import { ExternalIdentityMutation } from "./identity/ExternalIdentityMutation.mjs";
+import { SubjectProvisioner, SubjectProvisioningInput } from "./identity/SubjectProvisioner.mjs";
+import { ExpiresBy, ImmediatelyInvalidated, InvalidationUnsupported, SubjectCleanupComplete, SubjectCleanupPending, SubjectCleanupResult, SubjectInvalidation, SubjectLifecycle, SubjectTerminationInput } from "./identity/SubjectLifecycle.mjs";
+import { IdentityMutation } from "./identity/IdentityMutation.mjs";
+import { IdentityRepository } from "./identity/IdentityRepository.mjs";
+import { DeleteSubject, DisableSubject, InspectIdentity, ListCredentials, ListIdentifiers, identityQueryLayer, makeIdentityChanges, subjectLifecycleLayer } from "./identity/operations.mjs";
+import { IdentityCodecError, bigintSubjectId, numericSubjectId, stringSubjectId, subjectIdCodec } from "./identity/codecs.mjs";
+export { CredentialId, CredentialSummary, DeleteSubject, DisableSubject, ExpiresBy, ExternalIdentity, ExternalIdentityMutation, IdentifierBinding, IdentityCodecError, IdentityConflict, IdentityMutation, IdentityRepository, IdentityUnavailable, ImmediatelyInvalidated, InspectIdentity, InvalidationUnsupported, LastSignInMethod, ListCredentials, ListIdentifiers, LoginIdentifier, ProvisioningPending, ProvisioningResult, RecoveryReference, SubjectCleanupComplete, SubjectCleanupPending, SubjectCleanupResult, SubjectInactive, SubjectInvalidation, SubjectLifecycle, SubjectProvisioned, SubjectProvisioner, type SubjectProvisioningInput, SubjectSnapshot, type SubjectTerminationInput, bigintSubjectId, identityQueryLayer, makeIdentityChanges, numericSubjectId, stringSubjectId, subjectIdCodec, subjectLifecycleLayer };

package/dist/Identity.mjs

@@ -0,0 +1,9 @@
+import { CredentialId, CredentialSummary, ExternalIdentity, IdentifierBinding, IdentityConflict, IdentityUnavailable, LastSignInMethod, LoginIdentifier, ProvisioningPending, ProvisioningResult, RecoveryReference, SubjectInactive, SubjectProvisioned, SubjectSnapshot } from "./identity/models.mjs";
+import { ExternalIdentityMutation } from "./identity/ExternalIdentityMutation.mjs";
+import { SubjectProvisioner } from "./identity/SubjectProvisioner.mjs";
+import { IdentityMutation } from "./identity/IdentityMutation.mjs";
+import { IdentityRepository } from "./identity/IdentityRepository.mjs";
+import { ExpiresBy, ImmediatelyInvalidated, InvalidationUnsupported, SubjectCleanupComplete, SubjectCleanupPending, SubjectCleanupResult, SubjectInvalidation, SubjectLifecycle } from "./identity/SubjectLifecycle.mjs";
+import { DeleteSubject, DisableSubject, InspectIdentity, ListCredentials, ListIdentifiers, identityQueryLayer, makeIdentityChanges, subjectLifecycleLayer } from "./identity/operations.mjs";
+import { IdentityCodecError, bigintSubjectId, numericSubjectId, stringSubjectId, subjectIdCodec } from "./identity/codecs.mjs";
+export { CredentialId, CredentialSummary, DeleteSubject, DisableSubject, ExpiresBy, ExternalIdentity, ExternalIdentityMutation, IdentifierBinding, IdentityCodecError, IdentityConflict, IdentityMutation, IdentityRepository, IdentityUnavailable, ImmediatelyInvalidated, InspectIdentity, InvalidationUnsupported, LastSignInMethod, ListCredentials, ListIdentifiers, LoginIdentifier, ProvisioningPending, ProvisioningResult, RecoveryReference, SubjectCleanupComplete, SubjectCleanupPending, SubjectCleanupResult, SubjectInactive, SubjectInvalidation, SubjectLifecycle, SubjectProvisioned, SubjectProvisioner, SubjectSnapshot, bigintSubjectId, identityQueryLayer, makeIdentityChanges, numericSubjectId, stringSubjectId, subjectIdCodec, subjectLifecycleLayer };

package/dist/IdentityResolver.d.mts

@@ -0,0 +1,16 @@
+import { Email, SubjectId } from "./Schema.mjs";
+import { IdentityResolutionError } from "./Errors.mjs";
+import { Context, Effect, Option } from "effect";
+//#region src/IdentityResolver.d.ts
+declare const IdentityResolver_base: Context.ServiceClass<IdentityResolver, "effect-auth/IdentityResolver", {
+  readonly findByVerifiedEmail: (email: Email) => Effect.Effect<Option.Option<SubjectId>, IdentityResolutionError>;
+}>;
+/**
+ * Read-only mapping from a verified canonical email to an existing subject.
+ * Must not auto-provision: account creation stays a separate, application-owned
+ * operation.
+ */
+declare class IdentityResolver extends IdentityResolver_base {}
+//#endregion
+export { IdentityResolver };
+//# sourceMappingURL=IdentityResolver.d.mts.map

package/dist/IdentityResolver.mjs

@@ -0,0 +1,12 @@
+import { Context } from "effect";
+//#region src/IdentityResolver.ts
+/**
+* Read-only mapping from a verified canonical email to an existing subject.
+* Must not auto-provision: account creation stays a separate, application-owned
+* operation.
+*/
+var IdentityResolver = class extends Context.Service()("effect-auth/IdentityResolver") {};
+//#endregion
+export { IdentityResolver };
+
+//# sourceMappingURL=IdentityResolver.mjs.map

package/dist/IdentityResolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityResolver.mjs","names":[],"sources":["../src/IdentityResolver.ts"],"sourcesContent":["import { type Effect, type Option, Context } from \"effect\";\n\nimport type { IdentityResolutionError } from \"./Errors\";\nimport type { Email, SubjectId } from \"./Schema\";\n\n/**\n * Read-only mapping from a verified canonical email to an existing subject.\n * Must not auto-provision: account creation stays a separate, application-owned\n * operation.\n */\nexport class IdentityResolver extends Context.Service<\n  IdentityResolver,\n  {\n    readonly findByVerifiedEmail: (\n      email: Email,\n    ) => Effect.Effect<Option.Option<SubjectId>, IdentityResolutionError>;\n  }\n>()(\"effect-auth/IdentityResolver\") {}\n"],"mappings":";;;;;;;AAUA,IAAa,mBAAb,cAAsC,QAAQ,QAO5C,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC"}