@yielded/auth 0.1.0-beta.1

package/dist/PasswordHasher.mjs

@@ -0,0 +1,76 @@
+import { PasswordHash, timingSafeStringEqual } from "./Schema.mjs";
+import { SubtleCrypto } from "./WebCrypto.mjs";
+import { AuthTokenError } from "./Errors.mjs";
+import { AuthPolicy } from "./Policy.mjs";
+import { Context, Crypto, Effect, Encoding, Layer, Redacted, Result, Schema } from "effect";
+//#region src/PasswordHasher.ts
+const passwordHashAlgorithm = "pbkdf2-sha256";
+const saltLength = 16;
+const derivedKeyBits = 256;
+const textEncoder = new TextEncoder();
+const passwordHashFromString = Schema.decodeEffect(PasswordHash);
+const parsePasswordHash = (hash) => {
+	const [algorithm, iterationsPart, saltPart, digestPart, ...rest] = hash.split("$");
+	if (algorithm !== passwordHashAlgorithm || iterationsPart === void 0 || saltPart === void 0 || digestPart === void 0 || digestPart === "" || rest.length > 0 || !/^[1-9]\d{0,8}$/.test(iterationsPart)) return;
+	const salt = Result.getOrUndefined(Encoding.decodeBase64Url(saltPart));
+	if (salt === void 0 || salt.length === 0) return;
+	return {
+		iterations: Number(iterationsPart),
+		salt,
+		digest: digestPart
+	};
+};
+/**
+* Default PBKDF2-HMAC-SHA-256 hasher on WebCrypto. Iterations come from
+* `AuthPolicy`; salts come from `Crypto.Crypto` so tests can seed them, and
+* key derivation goes through the `SubtleCrypto` service.
+*/
+const makeWebCryptoHasher = Effect.gen(function* () {
+	const policy = yield* AuthPolicy;
+	const crypto = yield* Crypto.Crypto;
+	const subtle = yield* SubtleCrypto;
+	const derive = (password, salt, iterations) => Effect.tryPromise({
+		try: async () => {
+			const key = await subtle.importKey("raw", textEncoder.encode(Redacted.value(password)), "PBKDF2", false, ["deriveBits"]);
+			const bits = await subtle.deriveBits({
+				name: "PBKDF2",
+				hash: "SHA-256",
+				salt,
+				iterations
+			}, key, derivedKeyBits);
+			return new Uint8Array(bits);
+		},
+		catch: () => AuthTokenError.make({ message: "Password key derivation failed" })
+	});
+	return PasswordHasher.of({
+		hash: Effect.fn("PasswordHasher.hash")(function* (password) {
+			const salt = yield* crypto.randomBytes(saltLength).pipe(Effect.mapError(() => AuthTokenError.make({ message: "Secure randomness unavailable" })));
+			const derived = yield* derive(password, salt, policy.passwordIterations);
+			const encoded = `${passwordHashAlgorithm}$${policy.passwordIterations}$${Encoding.encodeBase64Url(salt)}$${Encoding.encodeBase64Url(derived)}`;
+			return yield* passwordHashFromString(encoded).pipe(Effect.mapError(() => AuthTokenError.make({ message: "Password hash failed to encode" })));
+		}),
+		verify: Effect.fn("PasswordHasher.verify")(function* (password, hash) {
+			const params = parsePasswordHash(hash);
+			if (params === void 0) return false;
+			const derived = yield* derive(password, params.salt, params.iterations);
+			return timingSafeStringEqual(Encoding.encodeBase64Url(derived), params.digest);
+		})
+	});
+});
+/**
+* One-way password hashing and verification. The PHC-style `PasswordHash`
+* format is this service's private concern; stores persist it opaquely.
+*/
+var PasswordHasher = class PasswordHasher extends Context.Service()("effect-auth/PasswordHasher") {
+	/**
+	* Default PBKDF2 implementation backed by WebCrypto. The consumer may
+	* replace it with its own hasher service, or satisfy `SubtleCrypto` with
+	* `SubtleCrypto.layerWeb`.
+	*/
+	static layerWebCrypto = Layer.effect(PasswordHasher)(makeWebCryptoHasher);
+	static layer = PasswordHasher.layerWebCrypto;
+};
+//#endregion
+export { PasswordHasher };
+
+//# sourceMappingURL=PasswordHasher.mjs.map

package/dist/PasswordHasher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordHasher.mjs","names":[],"sources":["../src/PasswordHasher.ts"],"sourcesContent":["import { Context, Crypto, Effect, Encoding, Layer, Redacted, Result, Schema } from \"effect\";\n\nimport { AuthTokenError } from \"./Errors\";\nimport { AuthPolicy } from \"./Policy\";\nimport { PasswordHash, timingSafeStringEqual } from \"./Schema\";\nimport { SubtleCrypto } from \"./WebCrypto\";\n\nconst passwordHashAlgorithm = \"pbkdf2-sha256\";\nconst saltLength = 16;\nconst derivedKeyBits = 256;\nconst textEncoder = new TextEncoder();\n\nconst passwordHashFromString = Schema.decodeEffect(PasswordHash);\n\ninterface PasswordHashParams {\n  readonly iterations: number;\n  readonly salt: Uint8Array;\n  readonly digest: string;\n}\n\n// Verification derives with the parameters recorded on the stored hash, not\n// the current policy, so old hashes keep verifying after a policy change.\nconst parsePasswordHash = (hash: string): PasswordHashParams | undefined => {\n  const [algorithm, iterationsPart, saltPart, digestPart, ...rest] = hash.split(\"$\");\n\n  if (\n    algorithm !== passwordHashAlgorithm ||\n    iterationsPart === undefined ||\n    saltPart === undefined ||\n    digestPart === undefined ||\n    digestPart === \"\" ||\n    rest.length > 0 ||\n    !/^[1-9]\\d{0,8}$/.test(iterationsPart)\n  ) {\n    return undefined;\n  }\n  const salt = Result.getOrUndefined(Encoding.decodeBase64Url(saltPart));\n\n  if (salt === undefined || salt.length === 0) {\n    return undefined;\n  }\n\n  return { iterations: Number(iterationsPart), salt, digest: digestPart };\n};\n\n/**\n * Default PBKDF2-HMAC-SHA-256 hasher on WebCrypto. Iterations come from\n * `AuthPolicy`; salts come from `Crypto.Crypto` so tests can seed them, and\n * key derivation goes through the `SubtleCrypto` service.\n */\nconst makeWebCryptoHasher: Effect.Effect<\n  PasswordHasher[\"Service\"],\n  never,\n  Crypto.Crypto | SubtleCrypto\n> = Effect.gen(function* () {\n  const policy = yield* AuthPolicy;\n  const crypto = yield* Crypto.Crypto;\n  const subtle = yield* SubtleCrypto;\n\n  const derive = (password: Redacted.Redacted<string>, salt: Uint8Array, iterations: number) =>\n    Effect.tryPromise({\n      try: async () => {\n        const key = await subtle.importKey(\n          \"raw\",\n          textEncoder.encode(Redacted.value(password)),\n          \"PBKDF2\",\n          false,\n          [\"deriveBits\"],\n        );\n\n        const bits = await subtle.deriveBits(\n          { name: \"PBKDF2\", hash: \"SHA-256\", salt: salt as BufferSource, iterations },\n          key,\n          derivedKeyBits,\n        );\n\n        return new Uint8Array(bits);\n      },\n      catch: () => AuthTokenError.make({ message: \"Password key derivation failed\" }),\n    });\n\n  return PasswordHasher.of({\n    hash: Effect.fn(\"PasswordHasher.hash\")(function* (password) {\n      const salt = yield* crypto\n        .randomBytes(saltLength)\n        .pipe(\n          Effect.mapError(() => AuthTokenError.make({ message: \"Secure randomness unavailable\" })),\n        );\n\n      const derived = yield* derive(password, salt, policy.passwordIterations);\n\n      const encoded =\n        `${passwordHashAlgorithm}$${policy.passwordIterations}` +\n        `$${Encoding.encodeBase64Url(salt)}$${Encoding.encodeBase64Url(derived)}`;\n\n      return yield* passwordHashFromString(encoded).pipe(\n        Effect.mapError(() => AuthTokenError.make({ message: \"Password hash failed to encode\" })),\n      );\n    }),\n\n    verify: Effect.fn(\"PasswordHasher.verify\")(function* (password, hash) {\n      const params = parsePasswordHash(hash);\n\n      // A malformed stored hash degrades to a plain mismatch, never a\n      // distinguishable auth response.\n      if (params === undefined) {\n        return false;\n      }\n      const derived = yield* derive(password, params.salt, params.iterations);\n\n      return timingSafeStringEqual(Encoding.encodeBase64Url(derived), params.digest);\n    }),\n  });\n});\n\n/**\n * One-way password hashing and verification. The PHC-style `PasswordHash`\n * format is this service's private concern; stores persist it opaquely.\n */\nexport class PasswordHasher extends Context.Service<\n  PasswordHasher,\n  {\n    /** Derives a fresh salted hash for the password at the configured cost. */\n    readonly hash: (\n      password: Redacted.Redacted<string>,\n    ) => Effect.Effect<PasswordHash, AuthTokenError>;\n    /**\n     * Verifies the password against a stored hash using the parameters\n     * recorded on the hash, comparing digests in constant time. A malformed\n     * hash yields `false`, never a distinguishable failure.\n     */\n    readonly verify: (\n      password: Redacted.Redacted<string>,\n      hash: PasswordHash,\n    ) => Effect.Effect<boolean, AuthTokenError>;\n  }\n>()(\"effect-auth/PasswordHasher\") {\n  /**\n   * Default PBKDF2 implementation backed by WebCrypto. The consumer may\n   * replace it with its own hasher service, or satisfy `SubtleCrypto` with\n   * `SubtleCrypto.layerWeb`.\n   */\n  static readonly layerWebCrypto: Layer.Layer<PasswordHasher, never, Crypto.Crypto | SubtleCrypto> =\n    Layer.effect(PasswordHasher)(makeWebCryptoHasher);\n\n  static readonly layer = PasswordHasher.layerWebCrypto;\n}\n"],"mappings":";;;;;;AAOA,MAAM,wBAAwB;AAC9B,MAAM,aAAa;AACnB,MAAM,iBAAiB;AACvB,MAAM,cAAc,IAAI,YAAY;AAEpC,MAAM,yBAAyB,OAAO,aAAa,YAAY;AAU/D,MAAM,qBAAqB,SAAiD;CAC1E,MAAM,CAAC,WAAW,gBAAgB,UAAU,YAAY,GAAG,QAAQ,KAAK,MAAM,GAAG;CAEjF,IACE,cAAc,yBACd,mBAAmB,KAAA,KACnB,aAAa,KAAA,KACb,eAAe,KAAA,KACf,eAAe,MACf,KAAK,SAAS,KACd,CAAC,iBAAiB,KAAK,cAAc,GAErC;CAEF,MAAM,OAAO,OAAO,eAAe,SAAS,gBAAgB,QAAQ,CAAC;CAErE,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,GACxC;CAGF,OAAO;EAAE,YAAY,OAAO,cAAc;EAAG;EAAM,QAAQ;CAAW;AACxE;;;;;;AAOA,MAAM,sBAIF,OAAO,IAAI,aAAa;CAC1B,MAAM,SAAS,OAAO;CACtB,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,SAAS,OAAO;CAEtB,MAAM,UAAU,UAAqC,MAAkB,eACrE,OAAO,WAAW;EAChB,KAAK,YAAY;GACf,MAAM,MAAM,MAAM,OAAO,UACvB,OACA,YAAY,OAAO,SAAS,MAAM,QAAQ,CAAC,GAC3C,UACA,OACA,CAAC,YAAY,CACf;GAEA,MAAM,OAAO,MAAM,OAAO,WACxB;IAAE,MAAM;IAAU,MAAM;IAAiB;IAAsB;GAAW,GAC1E,KACA,cACF;GAEA,OAAO,IAAI,WAAW,IAAI;EAC5B;EACA,aAAa,eAAe,KAAK,EAAE,SAAS,iCAAiC,CAAC;CAChF,CAAC;CAEH,OAAO,eAAe,GAAG;EACvB,MAAM,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,UAAU;GAC1D,MAAM,OAAO,OAAO,OACjB,YAAY,UAAU,CAAC,CACvB,KACC,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACzF;GAEF,MAAM,UAAU,OAAO,OAAO,UAAU,MAAM,OAAO,kBAAkB;GAEvE,MAAM,UACJ,GAAG,sBAAsB,GAAG,OAAO,mBAAA,GAC/B,SAAS,gBAAgB,IAAI,EAAE,GAAG,SAAS,gBAAgB,OAAO;GAExE,OAAO,OAAO,uBAAuB,OAAO,CAAC,CAAC,KAC5C,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,iCAAiC,CAAC,CAAC,CAC1F;EACF,CAAC;EAED,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,UAAU,MAAM;GACpE,MAAM,SAAS,kBAAkB,IAAI;GAIrC,IAAI,WAAW,KAAA,GACb,OAAO;GAET,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,MAAM,OAAO,UAAU;GAEtE,OAAO,sBAAsB,SAAS,gBAAgB,OAAO,GAAG,OAAO,MAAM;EAC/E,CAAC;CACH,CAAC;AACH,CAAC;;;;;AAMD,IAAa,iBAAb,MAAa,uBAAuB,QAAQ,QAiB1C,CAAC,CAAC,4BAA4B,CAAC,CAAC;;;;;;CAMhC,OAAgB,iBACd,MAAM,OAAO,cAAc,CAAC,CAAC,mBAAmB;CAElD,OAAgB,QAAQ,eAAe;AACzC"}

package/dist/PhoneOtp.d.mts

@@ -0,0 +1,11 @@
+import { PhoneCredentialSnapshot, PhoneNumber, PhoneOtpComplete, PhoneOtpRejected, PhoneOtpUnavailable } from "./phone/models.mjs";
+import { PhoneActionAuthorization, PhoneActionChallenge, PhoneActionRequired, PhoneAdmissionPolicy, PhoneCommandId, PhoneConfigurationError, PhoneCustody, PhoneLifecycleAction, PhoneLifecycleFailure, PhoneLifecyclePolicy, PhoneLifecycleTarget, PhoneMutationDecision } from "./phone/lifecycleModels.mjs";
+import { PhoneAdmission } from "./phone/PhoneAdmission.mjs";
+import { PhoneMutation, PhonePersistence } from "./phone/PhonePersistence.mjs";
+import { PhoneSignInTargets } from "./phone/PhoneSignInTargets.mjs";
+import { PhoneActionEvidence } from "./phone/PhoneActionEvidence.mjs";
+import { PhoneDeliveryEligibility } from "./phone/PhoneDeliveryEligibility.mjs";
+import { PhoneRequestContext } from "./phone/PhoneRequestContext.mjs";
+import { makePhoneOtp } from "./phone/module.mjs";
+import { PhoneOtpOptions, make } from "./phone/definition.mjs";
+export { PhoneActionAuthorization, PhoneActionChallenge, PhoneActionEvidence, PhoneActionRequired, PhoneAdmission, PhoneAdmissionPolicy, PhoneCommandId, PhoneConfigurationError, PhoneCredentialSnapshot, PhoneCustody, PhoneDeliveryEligibility, PhoneLifecycleAction, PhoneLifecycleFailure, PhoneLifecyclePolicy, PhoneLifecycleTarget, type PhoneMutation, PhoneMutationDecision, PhoneNumber, PhoneOtpComplete, type PhoneOtpOptions, PhoneOtpRejected, PhoneOtpUnavailable, PhonePersistence, PhoneRequestContext, PhoneSignInTargets, make, makePhoneOtp as makeModule };

package/dist/PhoneOtp.mjs

@@ -0,0 +1,11 @@
+import { PhoneAdmission } from "./phone/PhoneAdmission.mjs";
+import { PhonePersistence } from "./phone/PhonePersistence.mjs";
+import { PhoneSignInTargets } from "./phone/PhoneSignInTargets.mjs";
+import { PhoneCredentialSnapshot, PhoneNumber, PhoneOtpComplete, PhoneOtpRejected, PhoneOtpUnavailable } from "./phone/models.mjs";
+import { PhoneActionAuthorization, PhoneActionChallenge, PhoneActionRequired, PhoneAdmissionPolicy, PhoneCommandId, PhoneConfigurationError, PhoneCustody, PhoneLifecycleAction, PhoneLifecycleFailure, PhoneLifecyclePolicy, PhoneLifecycleTarget, PhoneMutationDecision } from "./phone/lifecycleModels.mjs";
+import { PhoneActionEvidence } from "./phone/PhoneActionEvidence.mjs";
+import { PhoneDeliveryEligibility } from "./phone/PhoneDeliveryEligibility.mjs";
+import { PhoneRequestContext } from "./phone/PhoneRequestContext.mjs";
+import { makePhoneOtp } from "./phone/module.mjs";
+import { make } from "./phone/definition.mjs";
+export { PhoneActionAuthorization, PhoneActionChallenge, PhoneActionEvidence, PhoneActionRequired, PhoneAdmission, PhoneAdmissionPolicy, PhoneCommandId, PhoneConfigurationError, PhoneCredentialSnapshot, PhoneCustody, PhoneDeliveryEligibility, PhoneLifecycleAction, PhoneLifecycleFailure, PhoneLifecyclePolicy, PhoneLifecycleTarget, PhoneMutationDecision, PhoneNumber, PhoneOtpComplete, PhoneOtpRejected, PhoneOtpUnavailable, PhonePersistence, PhoneRequestContext, PhoneSignInTargets, make, makePhoneOtp as makeModule };

package/dist/Policy.d.mts

@@ -0,0 +1,52 @@
+import { SessionClaims } from "./Schema.mjs";
+import { InvalidSession } from "./Errors.mjs";
+import { Context, Duration, Effect, Layer } from "effect";
+//#region src/Policy.d.ts
+interface AuthPolicyShape {
+  /** OTP challenge lifetime. */
+  readonly otpLifetime: Duration.Duration;
+  /** Number of decimal digits in the OTP code. */
+  readonly otpLength: number;
+  /** Rolling wrong-code budget per email and purpose. */
+  readonly attemptLimit: number;
+  /** Minimum delay between challenge issuances for the same email and purpose. */
+  readonly resendCooldown: Duration.Duration;
+  /** Pending-registration lifetime. */
+  readonly registrationLifetime: Duration.Duration;
+  /** Lifetime of each issued session token. */
+  readonly sessionLifetime: Duration.Duration;
+  /** Minimum token age before authenticated HTTP activity may renew it. */
+  readonly sessionRenewalInterval: Duration.Duration;
+  /** `iss` claim issued and required on session tokens. */
+  readonly issuer: string;
+  /** `aud` claim issued and required on session tokens. */
+  readonly audience: string;
+  /** Incrementing this invalidates every previously issued session. */
+  readonly sessionGeneration: number;
+  /** Minimum accepted password length. */
+  readonly passwordMinLength: number;
+  /** Maximum accepted password length; bounds the PBKDF2 work per attempt. */
+  readonly passwordMaxLength: number;
+  /** PBKDF2-HMAC-SHA-256 iteration count for newly hashed passwords. */
+  readonly passwordIterations: number;
+  /** Consecutive failed password sign-ins before the credential locks. */
+  readonly passwordAttemptLimit: number;
+  /** How long a locked credential rejects sign-in attempts. */
+  readonly passwordLockDuration: Duration.Duration;
+}
+declare const defaultAuthPolicy: AuthPolicyShape;
+declare const AuthPolicy: Context.Reference<AuthPolicyShape>;
+/** The signed-claim subset that remains meaningful after token verification. */
+interface SessionClaimsPolicy {
+  readonly issuer: string;
+  readonly audience: string;
+  readonly sessionGeneration: number;
+  readonly allowedSigningKeyIds: ReadonlySet<string>;
+}
+/** Revalidates a previously verified claim set at each later trust boundary. */
+declare const revalidateSessionClaims: (claims: SessionClaims, policy: SessionClaimsPolicy) => Effect.Effect<SessionClaims, InvalidSession, never>;
+/** Builds an auth policy layer by overriding the secure library defaults. */
+declare const layerAuthPolicy: (overrides?: Partial<AuthPolicyShape>) => Layer.Layer<never, never, never>;
+//#endregion
+export { AuthPolicy, AuthPolicyShape, SessionClaimsPolicy, defaultAuthPolicy, layerAuthPolicy, revalidateSessionClaims };
+//# sourceMappingURL=Policy.d.mts.map

package/dist/Policy.mjs

@@ -0,0 +1,36 @@
+import { InvalidSession } from "./Errors.mjs";
+import { Context, DateTime, Duration, Effect, Layer } from "effect";
+//#region src/Policy.ts
+const defaultAuthPolicy = {
+	otpLifetime: Duration.minutes(10),
+	otpLength: 6,
+	attemptLimit: 3,
+	resendCooldown: Duration.seconds(30),
+	registrationLifetime: Duration.minutes(15),
+	sessionLifetime: Duration.days(7),
+	sessionRenewalInterval: Duration.days(1),
+	issuer: "effect-auth",
+	audience: "effect-auth",
+	sessionGeneration: 0,
+	passwordMinLength: 8,
+	passwordMaxLength: 256,
+	passwordIterations: 6e5,
+	passwordAttemptLimit: 10,
+	passwordLockDuration: Duration.minutes(15)
+};
+const AuthPolicy = Context.Reference("effect-auth/AuthPolicy", { defaultValue: () => defaultAuthPolicy });
+/** Revalidates a previously verified claim set at each later trust boundary. */
+const revalidateSessionClaims = Effect.fn("AuthSession.revalidateClaims")(function* (claims, policy) {
+	const now = yield* DateTime.now;
+	if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(claims.exp) || claims.gen !== policy.sessionGeneration || claims.iss !== policy.issuer || claims.aud !== policy.audience || !policy.allowedSigningKeyIds.has(claims.kid)) return yield* InvalidSession.make();
+	return claims;
+});
+/** Builds an auth policy layer by overriding the secure library defaults. */
+const layerAuthPolicy = (overrides = {}) => Layer.succeed(AuthPolicy)({
+	...defaultAuthPolicy,
+	...overrides
+});
+//#endregion
+export { AuthPolicy, defaultAuthPolicy, layerAuthPolicy, revalidateSessionClaims };
+
+//# sourceMappingURL=Policy.mjs.map

package/dist/Policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.mjs","names":[],"sources":["../src/Policy.ts"],"sourcesContent":["import { Context, DateTime, Duration, Effect, Layer } from \"effect\";\n\nimport { InvalidSession } from \"./Errors\";\nimport type { SessionClaims } from \"./Schema\";\n\nexport interface AuthPolicyShape {\n  /** OTP challenge lifetime. */\n  readonly otpLifetime: Duration.Duration;\n  /** Number of decimal digits in the OTP code. */\n  readonly otpLength: number;\n  /** Rolling wrong-code budget per email and purpose. */\n  readonly attemptLimit: number;\n  /** Minimum delay between challenge issuances for the same email and purpose. */\n  readonly resendCooldown: Duration.Duration;\n  /** Pending-registration lifetime. */\n  readonly registrationLifetime: Duration.Duration;\n  /** Lifetime of each issued session token. */\n  readonly sessionLifetime: Duration.Duration;\n  /** Minimum token age before authenticated HTTP activity may renew it. */\n  readonly sessionRenewalInterval: Duration.Duration;\n  /** `iss` claim issued and required on session tokens. */\n  readonly issuer: string;\n  /** `aud` claim issued and required on session tokens. */\n  readonly audience: string;\n  /** Incrementing this invalidates every previously issued session. */\n  readonly sessionGeneration: number;\n  /** Minimum accepted password length. */\n  readonly passwordMinLength: number;\n  /** Maximum accepted password length; bounds the PBKDF2 work per attempt. */\n  readonly passwordMaxLength: number;\n  /** PBKDF2-HMAC-SHA-256 iteration count for newly hashed passwords. */\n  readonly passwordIterations: number;\n  /** Consecutive failed password sign-ins before the credential locks. */\n  readonly passwordAttemptLimit: number;\n  /** How long a locked credential rejects sign-in attempts. */\n  readonly passwordLockDuration: Duration.Duration;\n}\n\n// Numbers match the sign-in design spec (Auth — Sign in, section 8c): a\n// six-digit code valid ten minutes, resend unlocked after thirty seconds,\n// three wrong attempts before the code is invalidated. The password iteration\n// count follows the OWASP 2023+ recommendation for PBKDF2-HMAC-SHA-256.\nexport const defaultAuthPolicy: AuthPolicyShape = {\n  otpLifetime: Duration.minutes(10),\n  otpLength: 6,\n  attemptLimit: 3,\n  resendCooldown: Duration.seconds(30),\n  registrationLifetime: Duration.minutes(15),\n  sessionLifetime: Duration.days(7),\n  sessionRenewalInterval: Duration.days(1),\n  issuer: \"effect-auth\",\n  audience: \"effect-auth\",\n  sessionGeneration: 0,\n  passwordMinLength: 8,\n  passwordMaxLength: 256,\n  passwordIterations: 600_000,\n  passwordAttemptLimit: 10,\n  passwordLockDuration: Duration.minutes(15),\n};\n\nexport const AuthPolicy = Context.Reference<AuthPolicyShape>(\"effect-auth/AuthPolicy\", {\n  defaultValue: () => defaultAuthPolicy,\n});\n\n/** The signed-claim subset that remains meaningful after token verification. */\nexport interface SessionClaimsPolicy {\n  readonly issuer: string;\n  readonly audience: string;\n  readonly sessionGeneration: number;\n  readonly allowedSigningKeyIds: ReadonlySet<string>;\n}\n\n/** Revalidates a previously verified claim set at each later trust boundary. */\nexport const revalidateSessionClaims = Effect.fn(\"AuthSession.revalidateClaims\")(function* (\n  claims: SessionClaims,\n  policy: SessionClaimsPolicy,\n) {\n  const now = yield* DateTime.now;\n\n  if (\n    DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(claims.exp) ||\n    claims.gen !== policy.sessionGeneration ||\n    claims.iss !== policy.issuer ||\n    claims.aud !== policy.audience ||\n    !policy.allowedSigningKeyIds.has(claims.kid)\n  ) {\n    return yield* InvalidSession.make();\n  }\n\n  return claims;\n});\n\n/** Builds an auth policy layer by overriding the secure library defaults. */\nexport const layerAuthPolicy = (overrides: Partial<AuthPolicyShape> = {}) =>\n  Layer.succeed(AuthPolicy)({ ...defaultAuthPolicy, ...overrides });\n"],"mappings":";;;AA0CA,MAAa,oBAAqC;CAChD,aAAa,SAAS,QAAQ,EAAE;CAChC,WAAW;CACX,cAAc;CACd,gBAAgB,SAAS,QAAQ,EAAE;CACnC,sBAAsB,SAAS,QAAQ,EAAE;CACzC,iBAAiB,SAAS,KAAK,CAAC;CAChC,wBAAwB,SAAS,KAAK,CAAC;CACvC,QAAQ;CACR,UAAU;CACV,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;CACnB,oBAAoB;CACpB,sBAAsB;CACtB,sBAAsB,SAAS,QAAQ,EAAE;AAC3C;AAEA,MAAa,aAAa,QAAQ,UAA2B,0BAA0B,EACrF,oBAAoB,kBACtB,CAAC;;AAWD,MAAa,0BAA0B,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC/E,QACA,QACA;CACA,MAAM,MAAM,OAAO,SAAS;CAE5B,IACE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,GAAG,KAChE,OAAO,QAAQ,OAAO,qBACtB,OAAO,QAAQ,OAAO,UACtB,OAAO,QAAQ,OAAO,YACtB,CAAC,OAAO,qBAAqB,IAAI,OAAO,GAAG,GAE3C,OAAO,OAAO,eAAe,KAAK;CAGpC,OAAO;AACT,CAAC;;AAGD,MAAa,mBAAmB,YAAsC,CAAC,MACrE,MAAM,QAAQ,UAAU,CAAC,CAAC;CAAE,GAAG;CAAmB,GAAG;AAAU,CAAC"}

package/dist/Proofs.d.mts

@@ -0,0 +1,14 @@
+import { IdentifierChangeProofBinding, IdentifierProofBinding, ProofAttemptDecision, ProofBinding, ProofCleanupResult, ProofCompletionDecision, ProofContinuation, ProofContinuationId, ProofDeliveryId, ProofDeliveryOutcome, ProofDeliveryStatus, ProofId, ProofInstant, ProofPurpose, ProofReference, ProofRequestId, ProofRequestReceipt, ProofVersion, SubjectProofBinding } from "./proofs/models.mjs";
+import { ProofCapabilityUnsupported, ProofConfigurationError, ProofError, ProofIngressDenied, ProofInvalid, ProofRequestConflict, ProofUnavailable } from "./proofs/errors.mjs";
+import { ProofDelivery, ProofDeliveryMessage, ProofVendorPolicy } from "./proofs/delivery.mjs";
+import { EmailProofDelivery } from "./proofs/EmailProofDelivery.mjs";
+import { HostIngressLimiter } from "./proofs/HostIngressLimiter.mjs";
+import { ProofAbusePolicy, ProofBudget, ProofPolicy, validateProofPolicy } from "./proofs/policy.mjs";
+import { PrepareProofCommit, ProofCompletionInput, ProofDeliveryClaim, ProofDigest, ProofIssueDecision, ProofPersistence, ProofRecord } from "./proofs/ProofPersistence.mjs";
+import { PreparedProofDispatch, ProofIssuePlan, readProofCommit } from "./proofs/dispatch.mjs";
+import { ProofAbuseScope, proofAbuseScope } from "./proofs/abuse.mjs";
+import { ProofCompletionPlan } from "./proofs/completion.mjs";
+import { ProofKeyring, ProofSecretPolicy, makeProofCrypto, validateProofBinding } from "./proofs/crypto.mjs";
+import { SmsProofDelivery } from "./proofs/SmsProofDelivery.mjs";
+import { make } from "./proofs/definition.mjs";
+export { EmailProofDelivery, HostIngressLimiter, IdentifierChangeProofBinding, IdentifierProofBinding, type PrepareProofCommit, type PreparedProofDispatch, ProofAbusePolicy, type ProofAbuseScope, ProofAttemptDecision, ProofBinding, ProofBudget, ProofCapabilityUnsupported, ProofCleanupResult, ProofCompletionDecision, type ProofCompletionInput, type ProofCompletionPlan, ProofConfigurationError, ProofContinuation, ProofContinuationId, type ProofDelivery, type ProofDeliveryClaim, ProofDeliveryId, type ProofDeliveryMessage, ProofDeliveryOutcome, ProofDeliveryStatus, type ProofDigest, ProofError, ProofId, ProofIngressDenied, ProofInstant, ProofInvalid, type ProofIssueDecision, type ProofIssuePlan, type ProofKeyring, ProofPersistence, ProofPolicy, ProofPurpose, type ProofRecord, ProofReference, ProofRequestConflict, ProofRequestId, ProofRequestReceipt, ProofSecretPolicy, ProofUnavailable, ProofVendorPolicy, ProofVersion, SmsProofDelivery, SubjectProofBinding, make, makeProofCrypto, proofAbuseScope, readProofCommit, validateProofBinding, validateProofPolicy };

package/dist/Proofs.mjs

@@ -0,0 +1,13 @@
+import { ProofCapabilityUnsupported, ProofConfigurationError, ProofError, ProofIngressDenied, ProofInvalid, ProofRequestConflict, ProofUnavailable } from "./proofs/errors.mjs";
+import { IdentifierChangeProofBinding, IdentifierProofBinding, ProofAttemptDecision, ProofBinding, ProofCleanupResult, ProofCompletionDecision, ProofContinuation, ProofContinuationId, ProofDeliveryId, ProofDeliveryOutcome, ProofDeliveryStatus, ProofId, ProofInstant, ProofPurpose, ProofReference, ProofRequestId, ProofRequestReceipt, ProofVersion, SubjectProofBinding } from "./proofs/models.mjs";
+import { ProofPersistence } from "./proofs/ProofPersistence.mjs";
+import { ProofVendorPolicy } from "./proofs/delivery.mjs";
+import { EmailProofDelivery } from "./proofs/EmailProofDelivery.mjs";
+import { HostIngressLimiter } from "./proofs/HostIngressLimiter.mjs";
+import { readProofCommit } from "./proofs/dispatch.mjs";
+import { ProofAbusePolicy, ProofBudget, ProofPolicy, validateProofPolicy } from "./proofs/policy.mjs";
+import { proofAbuseScope } from "./proofs/abuse.mjs";
+import { ProofSecretPolicy, makeProofCrypto, validateProofBinding } from "./proofs/crypto.mjs";
+import { SmsProofDelivery } from "./proofs/SmsProofDelivery.mjs";
+import { make } from "./proofs/definition.mjs";
+export { EmailProofDelivery, HostIngressLimiter, IdentifierChangeProofBinding, IdentifierProofBinding, ProofAbusePolicy, ProofAttemptDecision, ProofBinding, ProofBudget, ProofCapabilityUnsupported, ProofCleanupResult, ProofCompletionDecision, ProofConfigurationError, ProofContinuation, ProofContinuationId, ProofDeliveryId, ProofDeliveryOutcome, ProofDeliveryStatus, ProofError, ProofId, ProofIngressDenied, ProofInstant, ProofInvalid, ProofPersistence, ProofPolicy, ProofPurpose, ProofReference, ProofRequestConflict, ProofRequestId, ProofRequestReceipt, ProofSecretPolicy, ProofUnavailable, ProofVendorPolicy, ProofVersion, SmsProofDelivery, SubjectProofBinding, make, makeProofCrypto, proofAbuseScope, readProofCommit, validateProofBinding, validateProofPolicy };

package/dist/Rpc.d.mts

@@ -0,0 +1,12 @@
+import { AuthUnavailable, Unauthorized } from "./Errors.mjs";
+import { CurrentSession } from "./internal/CurrentSession.mjs";
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/unstable/rpc";
+//#region src/Rpc.d.ts
+declare const SessionRpcError: Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable]>;
+declare const SessionRpcMiddleware_base: RpcMiddleware.ServiceClass<SessionRpcMiddleware, "effect-auth/SessionRpcMiddleware", CurrentSession, Schema.Union<readonly [typeof Unauthorized, typeof AuthUnavailable]>, never, never, false>;
+/** Transport-neutral authenticated session contract for finite RPC calls. */
+declare class SessionRpcMiddleware extends SessionRpcMiddleware_base {}
+//#endregion
+export { SessionRpcError, SessionRpcMiddleware };
+//# sourceMappingURL=Rpc.d.mts.map

package/dist/Rpc.mjs

@@ -0,0 +1,11 @@
+import { AuthUnavailable, Unauthorized } from "./Errors.mjs";
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/unstable/rpc";
+//#region src/Rpc.ts
+const SessionRpcError = Schema.Union([Unauthorized, AuthUnavailable]);
+/** Transport-neutral authenticated session contract for finite RPC calls. */
+var SessionRpcMiddleware = class extends RpcMiddleware.Service()("effect-auth/SessionRpcMiddleware", { error: SessionRpcError }) {};
+//#endregion
+export { SessionRpcError, SessionRpcMiddleware };
+
+//# sourceMappingURL=Rpc.mjs.map

package/dist/Rpc.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Rpc.mjs","names":[],"sources":["../src/Rpc.ts"],"sourcesContent":["import { Schema } from \"effect\";\nimport { RpcMiddleware } from \"effect/unstable/rpc\";\n\nimport { AuthUnavailable, Unauthorized } from \"./Errors\";\nimport type { CurrentSession } from \"./internal/CurrentSession\";\n\nexport const SessionRpcError = Schema.Union([Unauthorized, AuthUnavailable] as const);\n\n/** Transport-neutral authenticated session contract for finite RPC calls. */\nexport class SessionRpcMiddleware extends RpcMiddleware.Service<\n  SessionRpcMiddleware,\n  { provides: CurrentSession }\n>()(\"effect-auth/SessionRpcMiddleware\", {\n  error: SessionRpcError,\n}) {}\n"],"mappings":";;;;AAMA,MAAa,kBAAkB,OAAO,MAAM,CAAC,cAAc,eAAe,CAAU;;AAGpF,IAAa,uBAAb,cAA0C,cAAc,QAGtD,CAAC,CAAC,oCAAoC,EACtC,OAAO,gBACT,CAAC,CAAC,CAAC,CAAC"}

package/dist/Schema.d.mts

@@ -0,0 +1,160 @@
+import { Schema } from "effect";
+//#region src/Schema.d.ts
+declare const ChallengeId: Schema.brand<Schema.String, "effect-auth/ChallengeId">;
+type ChallengeId = typeof ChallengeId.Type;
+declare const RegistrationId: Schema.brand<Schema.String, "effect-auth/RegistrationId">;
+type RegistrationId = typeof RegistrationId.Type;
+declare const SessionTokenId: Schema.brand<Schema.String, "effect-auth/SessionTokenId">;
+type SessionTokenId = typeof SessionTokenId.Type;
+/** Opaque application subject. The consumer maps it to its own account id. */
+declare const SubjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+type SubjectId = typeof SubjectId.Type;
+declare const KeyId: Schema.brand<Schema.NonEmptyString, "effect-auth/KeyId">;
+type KeyId = typeof KeyId.Type;
+/** Digest of a high-entropy opaque token (challenge/registration). Never the raw token. */
+declare const TokenDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+type TokenDigest = typeof TokenDigest.Type;
+/** Keyed digest of a low-entropy OTP code. Never the plaintext code. */
+declare const OtpDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/OtpDigest">;
+type OtpDigest = typeof OtpDigest.Type;
+/** Signed session envelope in its transport form. */
+declare const SessionToken: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionToken">;
+type SessionToken = typeof SessionToken.Type;
+/**
+ * PHC-style encoded password verifier,
+ * `pbkdf2-sha256$<iterations>$<base64url salt>$<base64url dk>`. Never the
+ * plaintext password. The format is owned by `PasswordHasher`; everything else
+ * treats the value as opaque.
+ */
+declare const PasswordHash: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordHash">;
+type PasswordHash = typeof PasswordHash.Type;
+declare const Email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+type Email = typeof Email.Type;
+declare const ChallengePurpose: Schema.Literal<"sign-in">;
+type ChallengePurpose = typeof ChallengePurpose.Type;
+declare const RegistrationPurpose: Schema.Literal<"registration">;
+type RegistrationPurpose = typeof RegistrationPurpose.Type;
+declare const VerifiedEmail_base: Schema.Class<VerifiedEmail, Schema.Struct<{
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly purpose: Schema.Literal<"sign-in">;
+}>, {}>;
+declare class VerifiedEmail extends VerifiedEmail_base {}
+declare const NewChallenge_base: Schema.Class<NewChallenge, Schema.Struct<{
+  readonly challengeId: Schema.brand<Schema.String, "effect-auth/ChallengeId">;
+  readonly tokenDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly purpose: Schema.Literal<"sign-in">;
+  readonly otpDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/OtpDigest">;
+  /** Keyring entry used for the OTP digest, so rotation keeps in-flight challenges valid. */
+  readonly otpKeyId: Schema.brand<Schema.NonEmptyString, "effect-auth/KeyId">;
+  readonly issuedAt: Schema.DateTimeUtcFromMillis;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  readonly attemptLimit: Schema.Natural;
+  readonly resendCooldown: Schema.DurationFromMillis;
+}>, {}>;
+declare class NewChallenge extends NewChallenge_base {}
+declare const ConsumeChallenge_base: Schema.Class<ConsumeChallenge, Schema.Struct<{
+  readonly tokenDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  /**
+   * Candidate OTP digests keyed by keyring entry. The store compares the
+   * candidate matching the key id recorded on the challenge, in constant time.
+   */
+  readonly otpDigests: Schema.$Record<Schema.brand<Schema.NonEmptyString, "effect-auth/KeyId">, Schema.brand<Schema.NonEmptyString, "effect-auth/OtpDigest">>;
+}>, {}>;
+declare class ConsumeChallenge extends ConsumeChallenge_base {}
+declare const NewRegistration_base: Schema.Class<NewRegistration, Schema.Struct<{
+  readonly registrationId: Schema.brand<Schema.String, "effect-auth/RegistrationId">;
+  readonly tokenDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly purpose: Schema.Literal<"registration">;
+  readonly issuedAt: Schema.DateTimeUtcFromMillis;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+declare class NewRegistration extends NewRegistration_base {}
+declare const PendingRegistration_base: Schema.Class<PendingRegistration, Schema.Struct<{
+  readonly registrationId: Schema.brand<Schema.String, "effect-auth/RegistrationId">;
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly purpose: Schema.Literal<"registration">;
+  readonly issuedAt: Schema.DateTimeUtcFromMillis;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+declare class PendingRegistration extends PendingRegistration_base {}
+declare const ConsumeRegistration_base: Schema.Class<ConsumeRegistration, Schema.Struct<{
+  readonly tokenDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>, {}>;
+declare class ConsumeRegistration extends ConsumeRegistration_base {}
+declare const SessionClaims_base: Schema.Class<SessionClaims, Schema.Struct<{
+  /** Envelope format version. */
+  readonly ver: Schema.Literal<1>;
+  /** Configured session generation; incrementing invalidates all prior sessions. */
+  readonly gen: Schema.Natural;
+  readonly kid: Schema.brand<Schema.NonEmptyString, "effect-auth/KeyId">;
+  readonly sub: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  /** App-defined claims, opaque to effect-auth. */
+  readonly ext: Schema.optionalKey<Schema.Unknown>;
+  readonly iss: Schema.NonEmptyString;
+  readonly aud: Schema.NonEmptyString;
+  readonly iat: Schema.DateTimeUtcFromMillis;
+  readonly exp: Schema.DateTimeUtcFromMillis;
+  readonly jti: Schema.brand<Schema.String, "effect-auth/SessionTokenId">;
+}>, {}>;
+/**
+ * Claims carried by the signed session envelope. `ext` contains app-defined
+ * claims and is opaque to effect-auth. The envelope is signed, not encrypted,
+ * so applications must treat extension values as client-readable.
+ */
+declare class SessionClaims extends SessionClaims_base {}
+declare const SessionSummary_base: Schema.Class<SessionSummary, Schema.Struct<{
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+/** Public, cookie-free view of an issued session. */
+declare class SessionSummary extends SessionSummary_base {}
+declare const PasswordCredential_base: Schema.Class<PasswordCredential, Schema.Struct<{
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly hash: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordHash">;
+  readonly failedAttempts: Schema.Natural;
+  readonly lockedUntil: Schema.Option<Schema.DateTimeUtcFromMillis>;
+}>, {}>;
+/**
+ * Long-lived password credential state for one subject. Lives behind
+ * `PasswordCredentialStore`, never in `AuthStore` (which is transient-only).
+ */
+declare class PasswordCredential extends PasswordCredential_base {}
+declare const EmailOtpMessage_base: Schema.Class<EmailOtpMessage, Schema.Struct<{
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly code: Schema.Redacted<Schema.String>;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+declare class EmailOtpMessage extends EmailOtpMessage_base {}
+declare const KeyedDigest_base: Schema.Class<KeyedDigest, Schema.Struct<{
+  readonly keyId: Schema.brand<Schema.NonEmptyString, "effect-auth/KeyId">;
+  readonly digest: Schema.brand<Schema.NonEmptyString, "effect-auth/OtpDigest">;
+}>, {}>;
+declare class KeyedDigest extends KeyedDigest_base {}
+declare const EmailOtpChallenge_base: Schema.Class<EmailOtpChallenge, Schema.Struct<{
+  readonly challengeToken: Schema.Redacted<Schema.String>;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+declare class EmailOtpChallenge extends EmailOtpChallenge_base {}
+declare const ExistingSubject_base: Schema.Class<ExistingSubject, Schema.TaggedStruct<"ExistingSubject", {
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+}>, {}>;
+declare class ExistingSubject extends ExistingSubject_base {}
+declare const RegistrationRequired_base: Schema.Class<RegistrationRequired, Schema.TaggedStruct<"RegistrationRequired", {
+  readonly registrationToken: Schema.Redacted<Schema.String>;
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+declare class RegistrationRequired extends RegistrationRequired_base {}
+declare const EmailOtpVerification: Schema.Union<readonly [typeof ExistingSubject, typeof RegistrationRequired]>;
+type EmailOtpVerification = typeof EmailOtpVerification.Type;
+/**
+ * Constant-time string comparison for digest values. Scans the full length of
+ * both inputs regardless of where they diverge.
+ */
+declare const timingSafeStringEqual: (a: string, b: string) => boolean;
+//#endregion
+export { ChallengeId, ChallengePurpose, ConsumeChallenge, ConsumeRegistration, Email, EmailOtpChallenge, EmailOtpMessage, EmailOtpVerification, ExistingSubject, KeyId, KeyedDigest, NewChallenge, NewRegistration, OtpDigest, PasswordCredential, PasswordHash, PendingRegistration, RegistrationId, RegistrationPurpose, RegistrationRequired, SessionClaims, SessionSummary, SessionToken, SessionTokenId, SubjectId, TokenDigest, VerifiedEmail, timingSafeStringEqual };
+//# sourceMappingURL=Schema.d.mts.map

package/dist/Schema.mjs

@@ -0,0 +1,141 @@
+import { Schema, SchemaGetter } from "effect";
+//#region src/Schema.ts
+const uuid = (brand) => Schema.String.check(Schema.isUUID()).pipe(Schema.brand(brand));
+const ChallengeId = uuid("effect-auth/ChallengeId");
+const RegistrationId = uuid("effect-auth/RegistrationId");
+const SessionTokenId = uuid("effect-auth/SessionTokenId");
+/** Opaque application subject. The consumer maps it to its own account id. */
+const SubjectId = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/SubjectId"));
+const KeyId = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/KeyId"));
+/** Digest of a high-entropy opaque token (challenge/registration). Never the raw token. */
+const TokenDigest = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/TokenDigest"));
+/** Keyed digest of a low-entropy OTP code. Never the plaintext code. */
+const OtpDigest = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/OtpDigest"));
+/** Signed session envelope in its transport form. */
+const SessionToken = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/SessionToken"));
+/**
+* PHC-style encoded password verifier,
+* `pbkdf2-sha256$<iterations>$<base64url salt>$<base64url dk>`. Never the
+* plaintext password. The format is owned by `PasswordHasher`; everything else
+* treats the value as opaque.
+*/
+const PasswordHash = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/PasswordHash"));
+const Email = Schema.String.pipe(Schema.decodeTo(Schema.String.check(Schema.isPattern(/^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/)).pipe(Schema.brand("effect-auth/Email")), {
+	decode: SchemaGetter.transform((value) => value.trim().toLowerCase()),
+	encode: SchemaGetter.transform((value) => value)
+}));
+const ChallengePurpose = Schema.Literal("sign-in");
+const RegistrationPurpose = Schema.Literal("registration");
+var VerifiedEmail = class extends Schema.Class("effect-auth/VerifiedEmail")({
+	email: Email,
+	purpose: ChallengePurpose
+}) {};
+var NewChallenge = class extends Schema.Class("effect-auth/NewChallenge")({
+	challengeId: ChallengeId,
+	tokenDigest: TokenDigest,
+	email: Email,
+	purpose: ChallengePurpose,
+	otpDigest: OtpDigest,
+	/** Keyring entry used for the OTP digest, so rotation keeps in-flight challenges valid. */
+	otpKeyId: KeyId,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis,
+	attemptLimit: Schema.Natural,
+	resendCooldown: Schema.DurationFromMillis
+}) {};
+var ConsumeChallenge = class extends Schema.Class("effect-auth/ConsumeChallenge")({
+	tokenDigest: TokenDigest,
+	/**
+	* Candidate OTP digests keyed by keyring entry. The store compares the
+	* candidate matching the key id recorded on the challenge, in constant time.
+	*/
+	otpDigests: Schema.Record(KeyId, OtpDigest)
+}) {};
+var NewRegistration = class extends Schema.Class("effect-auth/NewRegistration")({
+	registrationId: RegistrationId,
+	tokenDigest: TokenDigest,
+	email: Email,
+	purpose: RegistrationPurpose,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+var PendingRegistration = class extends Schema.Class("effect-auth/PendingRegistration")({
+	registrationId: RegistrationId,
+	email: Email,
+	purpose: RegistrationPurpose,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+var ConsumeRegistration = class extends Schema.Class("effect-auth/ConsumeRegistration")({ tokenDigest: TokenDigest }) {};
+/**
+* Claims carried by the signed session envelope. `ext` contains app-defined
+* claims and is opaque to effect-auth. The envelope is signed, not encrypted,
+* so applications must treat extension values as client-readable.
+*/
+var SessionClaims = class extends Schema.Class("effect-auth/SessionClaims")({
+	/** Envelope format version. */
+	ver: Schema.Literal(1),
+	/** Configured session generation; incrementing invalidates all prior sessions. */
+	gen: Schema.Natural,
+	kid: KeyId,
+	sub: SubjectId,
+	/** App-defined claims, opaque to effect-auth. */
+	ext: Schema.optionalKey(Schema.Unknown),
+	iss: Schema.NonEmptyString,
+	aud: Schema.NonEmptyString,
+	iat: Schema.DateTimeUtcFromMillis,
+	exp: Schema.DateTimeUtcFromMillis,
+	jti: SessionTokenId
+}) {};
+/** Public, cookie-free view of an issued session. */
+var SessionSummary = class extends Schema.Class("effect-auth/SessionSummary")({
+	subjectId: SubjectId,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+/**
+* Long-lived password credential state for one subject. Lives behind
+* `PasswordCredentialStore`, never in `AuthStore` (which is transient-only).
+*/
+var PasswordCredential = class extends Schema.Class("effect-auth/PasswordCredential")({
+	subjectId: SubjectId,
+	hash: PasswordHash,
+	failedAttempts: Schema.Natural,
+	lockedUntil: Schema.Option(Schema.DateTimeUtcFromMillis)
+}) {};
+var EmailOtpMessage = class extends Schema.Class("effect-auth/EmailOtpMessage")({
+	email: Email,
+	code: Schema.Redacted(Schema.String),
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+var KeyedDigest = class extends Schema.Class("effect-auth/KeyedDigest")({
+	keyId: KeyId,
+	digest: OtpDigest
+}) {};
+var EmailOtpChallenge = class extends Schema.Class("effect-auth/EmailOtpChallenge")({
+	challengeToken: Schema.Redacted(Schema.String),
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+var ExistingSubject = class extends Schema.TaggedClass()("ExistingSubject", {
+	subjectId: SubjectId,
+	email: Email
+}) {};
+var RegistrationRequired = class extends Schema.TaggedClass()("RegistrationRequired", {
+	registrationToken: Schema.Redacted(Schema.String),
+	email: Email,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+const EmailOtpVerification = Schema.Union([ExistingSubject, RegistrationRequired]);
+/**
+* Constant-time string comparison for digest values. Scans the full length of
+* both inputs regardless of where they diverge.
+*/
+const timingSafeStringEqual = (a, b) => {
+	const length = Math.max(a.length, b.length);
+	let diff = a.length ^ b.length;
+	for (let i = 0; i < length; i++) diff |= (a.charCodeAt(i) | 0) ^ (b.charCodeAt(i) | 0);
+	return diff === 0;
+};
+//#endregion
+export { ChallengeId, ChallengePurpose, ConsumeChallenge, ConsumeRegistration, Email, EmailOtpChallenge, EmailOtpMessage, EmailOtpVerification, ExistingSubject, KeyId, KeyedDigest, NewChallenge, NewRegistration, OtpDigest, PasswordCredential, PasswordHash, PendingRegistration, RegistrationId, RegistrationPurpose, RegistrationRequired, SessionClaims, SessionSummary, SessionToken, SessionTokenId, SubjectId, TokenDigest, VerifiedEmail, timingSafeStringEqual };
+
+//# sourceMappingURL=Schema.mjs.map

package/dist/Schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Schema.mjs","names":[],"sources":["../src/Schema.ts"],"sourcesContent":["import { Schema, SchemaGetter } from \"effect\";\n\n// --- Identifiers -----------------------------------------------------------\n\nconst uuid = <Brand extends string>(brand: Brand) =>\n  Schema.String.check(Schema.isUUID()).pipe(Schema.brand(brand));\n\nexport const ChallengeId = uuid(\"effect-auth/ChallengeId\");\nexport type ChallengeId = typeof ChallengeId.Type;\n\nexport const RegistrationId = uuid(\"effect-auth/RegistrationId\");\nexport type RegistrationId = typeof RegistrationId.Type;\n\nexport const SessionTokenId = uuid(\"effect-auth/SessionTokenId\");\nexport type SessionTokenId = typeof SessionTokenId.Type;\n\n/** Opaque application subject. The consumer maps it to its own account id. */\nexport const SubjectId = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/SubjectId\"));\nexport type SubjectId = typeof SubjectId.Type;\n\nexport const KeyId = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/KeyId\"));\nexport type KeyId = typeof KeyId.Type;\n\n/** Digest of a high-entropy opaque token (challenge/registration). Never the raw token. */\nexport const TokenDigest = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/TokenDigest\"));\nexport type TokenDigest = typeof TokenDigest.Type;\n\n/** Keyed digest of a low-entropy OTP code. Never the plaintext code. */\nexport const OtpDigest = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/OtpDigest\"));\nexport type OtpDigest = typeof OtpDigest.Type;\n\n/** Signed session envelope in its transport form. */\nexport const SessionToken = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/SessionToken\"));\nexport type SessionToken = typeof SessionToken.Type;\n\n/**\n * PHC-style encoded password verifier,\n * `pbkdf2-sha256$<iterations>$<base64url salt>$<base64url dk>`. Never the\n * plaintext password. The format is owned by `PasswordHasher`; everything else\n * treats the value as opaque.\n */\nexport const PasswordHash = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/PasswordHash\"));\nexport type PasswordHash = typeof PasswordHash.Type;\n\n// --- Email ------------------------------------------------------------------\n\n/**\n * Ordinary ASCII addresses only; internationalized email is deferred. The\n * normalized (trimmed, fully lowercased) value is the identity key.\n */\nconst asciiEmailPattern =\n  /^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;\n\nexport const Email = Schema.String.pipe(\n  Schema.decodeTo(\n    Schema.String.check(Schema.isPattern(asciiEmailPattern)).pipe(\n      Schema.brand(\"effect-auth/Email\"),\n    ),\n    {\n      decode: SchemaGetter.transform((value: string) => value.trim().toLowerCase()),\n      encode: SchemaGetter.transform((value: string) => value),\n    },\n  ),\n);\n\nexport type Email = typeof Email.Type;\n\n// --- Purposes ---------------------------------------------------------------\n\nexport const ChallengePurpose = Schema.Literal(\"sign-in\");\nexport type ChallengePurpose = typeof ChallengePurpose.Type;\n\nexport const RegistrationPurpose = Schema.Literal(\"registration\");\nexport type RegistrationPurpose = typeof RegistrationPurpose.Type;\n\n// --- Challenge --------------------------------------------------------------\n\nexport class VerifiedEmail extends Schema.Class<VerifiedEmail>(\"effect-auth/VerifiedEmail\")({\n  email: Email,\n  purpose: ChallengePurpose,\n}) {}\n\nexport class NewChallenge extends Schema.Class<NewChallenge>(\"effect-auth/NewChallenge\")({\n  challengeId: ChallengeId,\n  tokenDigest: TokenDigest,\n  email: Email,\n  purpose: ChallengePurpose,\n  otpDigest: OtpDigest,\n  /** Keyring entry used for the OTP digest, so rotation keeps in-flight challenges valid. */\n  otpKeyId: KeyId,\n  issuedAt: Schema.DateTimeUtcFromMillis,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n  attemptLimit: Schema.Natural,\n  resendCooldown: Schema.DurationFromMillis,\n}) {}\n\nexport class ConsumeChallenge extends Schema.Class<ConsumeChallenge>(\n  \"effect-auth/ConsumeChallenge\",\n)({\n  tokenDigest: TokenDigest,\n  /**\n   * Candidate OTP digests keyed by keyring entry. The store compares the\n   * candidate matching the key id recorded on the challenge, in constant time.\n   */\n  otpDigests: Schema.Record(KeyId, OtpDigest),\n}) {}\n\n// --- Pending registration ----------------------------------------------------\n\nexport class NewRegistration extends Schema.Class<NewRegistration>(\"effect-auth/NewRegistration\")({\n  registrationId: RegistrationId,\n  tokenDigest: TokenDigest,\n  email: Email,\n  purpose: RegistrationPurpose,\n  issuedAt: Schema.DateTimeUtcFromMillis,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\nexport class PendingRegistration extends Schema.Class<PendingRegistration>(\n  \"effect-auth/PendingRegistration\",\n)({\n  registrationId: RegistrationId,\n  email: Email,\n  purpose: RegistrationPurpose,\n  issuedAt: Schema.DateTimeUtcFromMillis,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\nexport class ConsumeRegistration extends Schema.Class<ConsumeRegistration>(\n  \"effect-auth/ConsumeRegistration\",\n)({\n  tokenDigest: TokenDigest,\n}) {}\n\n// --- Session ----------------------------------------------------------------\n\n/**\n * Claims carried by the signed session envelope. `ext` contains app-defined\n * claims and is opaque to effect-auth. The envelope is signed, not encrypted,\n * so applications must treat extension values as client-readable.\n */\nexport class SessionClaims extends Schema.Class<SessionClaims>(\"effect-auth/SessionClaims\")({\n  /** Envelope format version. */\n  ver: Schema.Literal(1),\n  /** Configured session generation; incrementing invalidates all prior sessions. */\n  gen: Schema.Natural,\n  kid: KeyId,\n  sub: SubjectId,\n  /** App-defined claims, opaque to effect-auth. */\n  ext: Schema.optionalKey(Schema.Unknown),\n  iss: Schema.NonEmptyString,\n  aud: Schema.NonEmptyString,\n  iat: Schema.DateTimeUtcFromMillis,\n  exp: Schema.DateTimeUtcFromMillis,\n  jti: SessionTokenId,\n}) {}\n\n/** Public, cookie-free view of an issued session. */\nexport class SessionSummary extends Schema.Class<SessionSummary>(\"effect-auth/SessionSummary\")({\n  subjectId: SubjectId,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\n// --- Password credential ------------------------------------------------------\n\n/**\n * Long-lived password credential state for one subject. Lives behind\n * `PasswordCredentialStore`, never in `AuthStore` (which is transient-only).\n */\nexport class PasswordCredential extends Schema.Class<PasswordCredential>(\n  \"effect-auth/PasswordCredential\",\n)({\n  subjectId: SubjectId,\n  hash: PasswordHash,\n  failedAttempts: Schema.Natural,\n  lockedUntil: Schema.Option(Schema.DateTimeUtcFromMillis),\n}) {}\n\n// --- Sender -----------------------------------------------------------------\n\nexport class EmailOtpMessage extends Schema.Class<EmailOtpMessage>(\"effect-auth/EmailOtpMessage\")({\n  email: Email,\n  code: Schema.Redacted(Schema.String),\n  expiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\n// --- Digests ----------------------------------------------------------------\n\nexport class KeyedDigest extends Schema.Class<KeyedDigest>(\"effect-auth/KeyedDigest\")({\n  keyId: KeyId,\n  digest: OtpDigest,\n}) {}\n\n// --- Workflow results -------------------------------------------------------\n\nexport class EmailOtpChallenge extends Schema.Class<EmailOtpChallenge>(\n  \"effect-auth/EmailOtpChallenge\",\n)({\n  challengeToken: Schema.Redacted(Schema.String),\n  expiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\nexport class ExistingSubject extends Schema.TaggedClass<ExistingSubject>()(\"ExistingSubject\", {\n  subjectId: SubjectId,\n  email: Email,\n}) {}\n\nexport class RegistrationRequired extends Schema.TaggedClass<RegistrationRequired>()(\n  \"RegistrationRequired\",\n  {\n    registrationToken: Schema.Redacted(Schema.String),\n    email: Email,\n    expiresAt: Schema.DateTimeUtcFromMillis,\n  },\n) {}\n\nexport const EmailOtpVerification = Schema.Union([ExistingSubject, RegistrationRequired]);\nexport type EmailOtpVerification = typeof EmailOtpVerification.Type;\n\n// --- Constant-time comparison ------------------------------------------------\n\n/**\n * Constant-time string comparison for digest values. Scans the full length of\n * both inputs regardless of where they diverge.\n */\nexport const timingSafeStringEqual = (a: string, b: string): boolean => {\n  const length = Math.max(a.length, b.length);\n  let diff = a.length ^ b.length;\n\n  for (let i = 0; i < length; i++) {\n    diff |= (a.charCodeAt(i) | 0) ^ (b.charCodeAt(i) | 0);\n  }\n\n  return diff === 0;\n};\n"],"mappings":";;AAIA,MAAM,QAA8B,UAClC,OAAO,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,KAAK,CAAC;AAE/D,MAAa,cAAc,KAAK,yBAAyB;AAGzD,MAAa,iBAAiB,KAAK,4BAA4B;AAG/D,MAAa,iBAAiB,KAAK,4BAA4B;;AAI/D,MAAa,YAAY,OAAO,eAAe,KAAK,OAAO,MAAM,uBAAuB,CAAC;AAGzF,MAAa,QAAQ,OAAO,eAAe,KAAK,OAAO,MAAM,mBAAmB,CAAC;;AAIjF,MAAa,cAAc,OAAO,eAAe,KAAK,OAAO,MAAM,yBAAyB,CAAC;;AAI7F,MAAa,YAAY,OAAO,eAAe,KAAK,OAAO,MAAM,uBAAuB,CAAC;;AAIzF,MAAa,eAAe,OAAO,eAAe,KAAK,OAAO,MAAM,0BAA0B,CAAC;;;;;;;AAS/F,MAAa,eAAe,OAAO,eAAe,KAAK,OAAO,MAAM,0BAA0B,CAAC;AAY/F,MAAa,QAAQ,OAAO,OAAO,KACjC,OAAO,SACL,OAAO,OAAO,MAAM,OAAO,UAAU,mJAAiB,CAAC,CAAC,CAAC,KACvD,OAAO,MAAM,mBAAmB,CAClC,GACA;CACE,QAAQ,aAAa,WAAW,UAAkB,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC;CAC5E,QAAQ,aAAa,WAAW,UAAkB,KAAK;AACzD,CACF,CACF;AAMA,MAAa,mBAAmB,OAAO,QAAQ,SAAS;AAGxD,MAAa,sBAAsB,OAAO,QAAQ,cAAc;AAKhE,IAAa,gBAAb,cAAmC,OAAO,MAAqB,2BAA2B,CAAC,CAAC;CAC1F,OAAO;CACP,SAAS;AACX,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,0BAA0B,CAAC,CAAC;CACvF,aAAa;CACb,aAAa;CACb,OAAO;CACP,SAAS;CACT,WAAW;;CAEX,UAAU;CACV,UAAU,OAAO;CACjB,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,gBAAgB,OAAO;AACzB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,8BACF,CAAC,CAAC;CACA,aAAa;;;;;CAKb,YAAY,OAAO,OAAO,OAAO,SAAS;AAC5C,CAAC,CAAC,CAAC,CAAC;AAIJ,IAAa,kBAAb,cAAqC,OAAO,MAAuB,6BAA6B,CAAC,CAAC;CAChG,gBAAgB;CAChB,aAAa;CACb,OAAO;CACP,SAAS;CACT,UAAU,OAAO;CACjB,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,iCACF,CAAC,CAAC;CACA,gBAAgB;CAChB,OAAO;CACP,SAAS;CACT,UAAU,OAAO;CACjB,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,iCACF,CAAC,CAAC,EACA,aAAa,YACf,CAAC,CAAC,CAAC,CAAC;;;;;;AASJ,IAAa,gBAAb,cAAmC,OAAO,MAAqB,2BAA2B,CAAC,CAAC;;CAE1F,KAAK,OAAO,QAAQ,CAAC;;CAErB,KAAK,OAAO;CACZ,KAAK;CACL,KAAK;;CAEL,KAAK,OAAO,YAAY,OAAO,OAAO;CACtC,KAAK,OAAO;CACZ,KAAK,OAAO;CACZ,KAAK,OAAO;CACZ,KAAK,OAAO;CACZ,KAAK;AACP,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,iBAAb,cAAoC,OAAO,MAAsB,4BAA4B,CAAC,CAAC;CAC7F,WAAW;CACX,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;;;;AAQJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,gCACF,CAAC,CAAC;CACA,WAAW;CACX,MAAM;CACN,gBAAgB,OAAO;CACvB,aAAa,OAAO,OAAO,OAAO,qBAAqB;AACzD,CAAC,CAAC,CAAC,CAAC;AAIJ,IAAa,kBAAb,cAAqC,OAAO,MAAuB,6BAA6B,CAAC,CAAC;CAChG,OAAO;CACP,MAAM,OAAO,SAAS,OAAO,MAAM;CACnC,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAIJ,IAAa,cAAb,cAAiC,OAAO,MAAmB,yBAAyB,CAAC,CAAC;CACpF,OAAO;CACP,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;AAIJ,IAAa,oBAAb,cAAuC,OAAO,MAC5C,+BACF,CAAC,CAAC;CACA,gBAAgB,OAAO,SAAS,OAAO,MAAM;CAC7C,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,mBAAmB;CAC5F,WAAW;CACX,OAAO;AACT,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA;CACE,mBAAmB,OAAO,SAAS,OAAO,MAAM;CAChD,OAAO;CACP,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;AAEH,MAAa,uBAAuB,OAAO,MAAM,CAAC,iBAAiB,oBAAoB,CAAC;;;;;AASxF,MAAa,yBAAyB,GAAW,MAAuB;CACtE,MAAM,SAAS,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;CAC1C,IAAI,OAAO,EAAE,SAAS,EAAE;CAExB,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,KAC1B,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,EAAE,WAAW,CAAC,IAAI;CAGrD,OAAO,SAAS;AAClB"}

package/dist/SessionContract.d.mts

@@ -0,0 +1,3 @@
+import { makeSessionContract } from "./sessions/contract.mjs";
+import { makeSessionHttpContract } from "./http/session-contract.mjs";
+export { makeSessionContract, makeSessionHttpContract };

package/dist/SessionContract.mjs

@@ -0,0 +1,3 @@
+import { makeSessionContract } from "./sessions/contract.mjs";
+import { makeSessionHttpContract } from "./http/session-contract.mjs";
+export { makeSessionContract, makeSessionHttpContract };