@yielded/auth 0.1.0-beta.1

package/dist/Sessions.d.mts

@@ -0,0 +1,14 @@
+import { AssuranceAlternative, AuthenticationEvidence, AuthenticationFlowId, AuthenticationProof, AuthenticationRequirement, AuthenticationRevision, CredentialRevision, PendingConsumption, SecurityRevision, SessionAuthenticationProvenance, SessionCapabilities, SessionCredentialVersion, SessionId, SessionInspection, SessionMetadata, SessionSignOut } from "./sessions/models.mjs";
+import { PrepareSessionCommit } from "./sessions/commit.mjs";
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConfigurationError, SessionConflict, SessionError, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication } from "./sessions/errors.mjs";
+import { AuthenticationAuthority } from "./sessions/AuthenticationAuthority.mjs";
+import { PendingAuthentication, PendingAuthenticationContext, PendingAuthenticationRecord, PendingAuthenticationState, pendingAuthenticationContext, snapshotPendingAuthenticationContext } from "./sessions/PendingAuthentication.mjs";
+import { SessionSigningKeyring, makeSessionSecrets, makeSessionSigningCodec } from "./sessions/crypto.mjs";
+import { SessionPolicy, stateAssistedCapabilities, statefulCapabilities, statelessCapabilities, validateSessionPolicy, validateSessionTimeline } from "./sessions/policy.mjs";
+import { SessionInvalidationTrigger, SessionInvalidationWindow, sessionInvalidationWindow } from "./sessions/invalidation.mjs";
+import { SessionRepository, SignedSessionValidity, StatefulSessionPersistence, StatefulSessionRecord } from "./sessions/persistence.mjs";
+import { SessionStepUpCompletionPlan, SessionStepUpIntent, SessionStepUpPersistence, SessionStepUpProfile, SessionStepUpProfileId, SessionStepUpReplacement, SessionStepUpRequirement, SessionStepUpSource, StepUpPending } from "./sessions/SessionStepUpPersistence.mjs";
+import { assessAuthentication, combineAuthenticationEvidence, snapshotAuthenticationEvidence, snapshotSessionAuthenticationProvenance } from "./sessions/assurance.mjs";
+import { SessionConfiguration, SessionOptions, StateAssistedConfiguration, StatefulConfiguration, StatelessConfiguration, stateAssisted, stateful, stateless } from "./sessions/configuration.mjs";
+import { make } from "./sessions/definition.mjs";
+export { AssuranceAlternative, AuthenticationAuthority, AuthenticationEvidence, AuthenticationFlowId, AuthenticationProof, AuthenticationRequirement, AuthenticationRevision, CredentialRevision, type PendingAuthentication, PendingAuthenticationContext, PendingAuthenticationInvalid, type PendingAuthenticationRecord, type PendingAuthenticationState, PendingConsumption, type PrepareSessionCommit, SecurityRevision, SessionAuthenticationProvenance, SessionCapabilities, SessionCapabilityUnsupported, type SessionConfiguration, SessionConfigurationError, SessionConflict, SessionCredentialVersion, SessionError, SessionId, type SessionInspection, SessionInvalid, SessionInvalidationTrigger, SessionInvalidationWindow, SessionMetadata, type SessionOptions, SessionPolicy, SessionRenewalTooEarly, type SessionRepository, SessionSignOut, SessionSignOutUnavailable, type SessionSigningKeyring, type SessionStepUpCompletionPlan, SessionStepUpIntent, SessionStepUpInvalid, type SessionStepUpPersistence, SessionStepUpProfile, SessionStepUpProfileId, type SessionStepUpReplacement, SessionStepUpRequirement, type SessionStepUpSource, SessionUnavailable, type SignedSessionValidity, StaleAuthentication, type StateAssistedConfiguration, type StatefulConfiguration, type StatefulSessionPersistence, type StatefulSessionRecord, type StatelessConfiguration, StepUpPending, assessAuthentication, combineAuthenticationEvidence, make, makeSessionSecrets, makeSessionSigningCodec, pendingAuthenticationContext, sessionInvalidationWindow, snapshotAuthenticationEvidence, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance, stateAssisted, stateAssistedCapabilities, stateful, statefulCapabilities, stateless, statelessCapabilities, validateSessionPolicy, validateSessionTimeline };

package/dist/Sessions.mjs

@@ -0,0 +1,12 @@
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConfigurationError, SessionConflict, SessionError, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication } from "./sessions/errors.mjs";
+import { SessionInvalidationTrigger, SessionInvalidationWindow, sessionInvalidationWindow } from "./sessions/invalidation.mjs";
+import { AssuranceAlternative, AuthenticationEvidence, AuthenticationFlowId, AuthenticationProof, AuthenticationRequirement, AuthenticationRevision, CredentialRevision, PendingConsumption, SecurityRevision, SessionAuthenticationProvenance, SessionCapabilities, SessionCredentialVersion, SessionId, SessionMetadata, SessionSignOut } from "./sessions/models.mjs";
+import { SessionStepUpIntent, SessionStepUpProfile, SessionStepUpProfileId, SessionStepUpRequirement, StepUpPending } from "./sessions/SessionStepUpPersistence.mjs";
+import { stateAssisted, stateful, stateless } from "./sessions/configuration.mjs";
+import { assessAuthentication, combineAuthenticationEvidence, snapshotAuthenticationEvidence, snapshotSessionAuthenticationProvenance } from "./sessions/assurance.mjs";
+import { AuthenticationAuthority } from "./sessions/AuthenticationAuthority.mjs";
+import { makeSessionSecrets, makeSessionSigningCodec } from "./sessions/crypto.mjs";
+import { PendingAuthenticationContext, pendingAuthenticationContext, snapshotPendingAuthenticationContext } from "./sessions/PendingAuthentication.mjs";
+import { SessionPolicy, stateAssistedCapabilities, statefulCapabilities, statelessCapabilities, validateSessionPolicy, validateSessionTimeline } from "./sessions/policy.mjs";
+import { make } from "./sessions/definition.mjs";
+export { AssuranceAlternative, AuthenticationAuthority, AuthenticationEvidence, AuthenticationFlowId, AuthenticationProof, AuthenticationRequirement, AuthenticationRevision, CredentialRevision, PendingAuthenticationContext, PendingAuthenticationInvalid, PendingConsumption, SecurityRevision, SessionAuthenticationProvenance, SessionCapabilities, SessionCapabilityUnsupported, SessionConfigurationError, SessionConflict, SessionCredentialVersion, SessionError, SessionId, SessionInvalid, SessionInvalidationTrigger, SessionInvalidationWindow, SessionMetadata, SessionPolicy, SessionRenewalTooEarly, SessionSignOut, SessionSignOutUnavailable, SessionStepUpIntent, SessionStepUpInvalid, SessionStepUpProfile, SessionStepUpProfileId, SessionStepUpRequirement, SessionUnavailable, StaleAuthentication, StepUpPending, assessAuthentication, combineAuthenticationEvidence, make, makeSessionSecrets, makeSessionSigningCodec, pendingAuthenticationContext, sessionInvalidationWindow, snapshotAuthenticationEvidence, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance, stateAssisted, stateAssistedCapabilities, stateful, statefulCapabilities, stateless, statelessCapabilities, validateSessionPolicy, validateSessionTimeline };

package/dist/Testing.d.mts

@@ -0,0 +1,7 @@
+import { AuthStoreConformanceCase, authStoreConformanceCases } from "./testing/conformance/AuthStore.mjs";
+import { OAuthConnectionStoreConformanceCase, oauthConnectionStoreConformanceCases } from "./testing/conformance/OAuthConnectionStore.mjs";
+import { OAuthStateStoreConformanceCase, oauthStateStoreConformanceCases } from "./testing/conformance/OAuthStateStore.mjs";
+import { PasswordCredentialStoreConformanceCase, credentialConformanceSubject, layerCredentialConformanceResolver, passwordCredentialStoreConformanceCases } from "./testing/conformance/PasswordCredentialStore.mjs";
+import { layerCryptoDeterministic } from "./testing/crypto.mjs";
+import { layerKeyringTest, testKeyId } from "./testing/keyring.mjs";
+export { type AuthStoreConformanceCase, type OAuthConnectionStoreConformanceCase, type OAuthStateStoreConformanceCase, type PasswordCredentialStoreConformanceCase, authStoreConformanceCases, credentialConformanceSubject, layerCredentialConformanceResolver, layerCryptoDeterministic, layerKeyringTest, oauthConnectionStoreConformanceCases, oauthStateStoreConformanceCases, passwordCredentialStoreConformanceCases, testKeyId };

package/dist/Testing.mjs

@@ -0,0 +1,7 @@
+import { authStoreConformanceCases } from "./testing/conformance/AuthStore.mjs";
+import { oauthConnectionStoreConformanceCases } from "./testing/conformance/OAuthConnectionStore.mjs";
+import { oauthStateStoreConformanceCases } from "./testing/conformance/OAuthStateStore.mjs";
+import { credentialConformanceSubject, layerCredentialConformanceResolver, passwordCredentialStoreConformanceCases } from "./testing/conformance/PasswordCredentialStore.mjs";
+import { layerCryptoDeterministic } from "./testing/crypto.mjs";
+import { layerKeyringTest, testKeyId } from "./testing/keyring.mjs";
+export { authStoreConformanceCases, credentialConformanceSubject, layerCredentialConformanceResolver, layerCryptoDeterministic, layerKeyringTest, oauthConnectionStoreConformanceCases, oauthStateStoreConformanceCases, passwordCredentialStoreConformanceCases, testKeyId };

package/dist/Totp.d.mts

@@ -0,0 +1,8 @@
+import { TotpActionAuthorization, TotpActionChallenge, TotpDecision, TotpEnrollmentStarted, TotpManagementResult, TotpMutation, TotpPolicy, TotpRecord, TotpRecoveryReset, TotpSecretBinding, TotpSecretEnvelope, TotpSnapshot } from "./totp/models.mjs";
+import { TotpActionRequired, TotpConfigurationError, TotpFailure, TotpRejected, TotpUnavailable } from "./totp/errors.mjs";
+import { PrepareTotpCommit, TotpPersistence } from "./totp/TotpPersistence.mjs";
+import { TotpActionEvidence } from "./totp/TotpActionEvidence.mjs";
+import { TotpSecretKeys } from "./totp/TotpSecretKeys.mjs";
+import { TotpOptions, make } from "./totp/definition.mjs";
+import { makeTotpModule } from "./totp/module.mjs";
+export { type PrepareTotpCommit, TotpActionAuthorization, TotpActionChallenge, TotpActionEvidence, TotpActionRequired, TotpConfigurationError, TotpDecision, TotpEnrollmentStarted, TotpFailure, TotpManagementResult, TotpMutation, type TotpOptions, TotpPersistence, TotpPolicy, TotpRecord, TotpRecoveryReset, TotpRejected, TotpSecretBinding, TotpSecretEnvelope, TotpSecretKeys, TotpSnapshot, TotpUnavailable, make, makeTotpModule as makeModule };

package/dist/Totp.mjs

@@ -0,0 +1,8 @@
+import { TotpPersistence } from "./totp/TotpPersistence.mjs";
+import { TotpActionRequired, TotpConfigurationError, TotpFailure, TotpRejected, TotpUnavailable } from "./totp/errors.mjs";
+import { TotpActionAuthorization, TotpActionChallenge, TotpDecision, TotpEnrollmentStarted, TotpManagementResult, TotpMutation, TotpPolicy, TotpRecord, TotpRecoveryReset, TotpSecretBinding, TotpSecretEnvelope, TotpSnapshot } from "./totp/models.mjs";
+import { TotpSecretKeys } from "./totp/TotpSecretKeys.mjs";
+import { TotpActionEvidence } from "./totp/TotpActionEvidence.mjs";
+import { makeTotpModule } from "./totp/module.mjs";
+import { make } from "./totp/definition.mjs";
+export { TotpActionAuthorization, TotpActionChallenge, TotpActionEvidence, TotpActionRequired, TotpConfigurationError, TotpDecision, TotpEnrollmentStarted, TotpFailure, TotpManagementResult, TotpMutation, TotpPersistence, TotpPolicy, TotpRecord, TotpRecoveryReset, TotpRejected, TotpSecretBinding, TotpSecretEnvelope, TotpSecretKeys, TotpSnapshot, TotpUnavailable, make, makeTotpModule as makeModule };

package/dist/TotpContract.d.mts

@@ -0,0 +1,318 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "./operations/errors.mjs";
+import { AuthOperation } from "./operations/operation.mjs";
+import { HookDenied } from "./hooks/models.mjs";
+import "./Operations.mjs";
+import "./Hooks.mjs";
+import "./Auth.mjs";
+import { TotpPolicy } from "./totp/models.mjs";
+import { TotpActionRequired, TotpConfigurationError, TotpRejected, TotpUnavailable } from "./totp/errors.mjs";
+import "./Totp.mjs";
+import { Schema } from "effect";
+//#region src/TotpContract.d.ts
+declare const actionFields: {
+  commandId: Schema.NonEmptyString;
+  actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+};
+declare const BeginInput: Schema.Struct<{
+  readonly commandId: Schema.NonEmptyString;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  readonly accountName: Schema.NonEmptyString;
+}>;
+declare const ConfirmInput: Schema.Struct<{
+  readonly commandId: Schema.NonEmptyString;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  readonly enrollmentId: Schema.NonEmptyString;
+  readonly code: Schema.RedactedFromValue<Schema.String>;
+}>;
+declare const ManageInput: Schema.Struct<{
+  commandId: Schema.NonEmptyString;
+  actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+}>;
+declare const VerifyInput: Schema.Struct<{
+  readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  readonly code: Schema.RedactedFromValue<Schema.String>;
+}>;
+declare const RecoveryInput: Schema.Struct<{
+  readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  readonly code: Schema.RedactedFromValue<Schema.String>;
+}>;
+declare const StepUpInput: Schema.Struct<{
+  readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+  readonly code: Schema.RedactedFromValue<Schema.String>;
+}>;
+/** Canonical TOTP contracts without secret encryption, storage, or authority Layers. */
+declare const makeTotpContract: <const Id extends string, Session extends Schema.Codec<unknown, unknown, unknown, unknown>, Completion extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, sessions: {
+  readonly Session: Session;
+  readonly CompletionResult: Completion;
+}) => Readonly<{
+  operations: {
+    Begin: AuthOperation<`${Id}/totp/enroll`, Schema.Struct<{
+      readonly commandId: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      readonly accountName: Schema.NonEmptyString;
+    }>, Schema.Struct<{
+      readonly enrollmentId: Schema.NonEmptyString;
+      readonly expiresAtMillis: Schema.Natural;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        readonly accountName: Schema.NonEmptyString;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enrollmentId: Schema.NonEmptyString;
+        readonly expiresAtMillis: Schema.Natural;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+      readonly reveals: readonly ["totp-enrollment"];
+    }>;
+    Confirm: AuthOperation<`${Id}/totp/confirm`, Schema.Struct<{
+      readonly commandId: Schema.NonEmptyString;
+      readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      readonly enrollmentId: Schema.NonEmptyString;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly enabled: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly commandId: Schema.NonEmptyString;
+        readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+        readonly enrollmentId: Schema.NonEmptyString;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enabled: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+      readonly reveals: readonly ["recovery-codes"];
+    }>;
+    Disable: AuthOperation<`${Id}/totp/disable`, Schema.Struct<{
+      commandId: Schema.NonEmptyString;
+      actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly enabled: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        commandId: Schema.NonEmptyString;
+        actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enabled: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+    }>;
+    Regenerate: AuthOperation<`${Id}/totp/recovery/regenerate`, Schema.Struct<{
+      commandId: Schema.NonEmptyString;
+      actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    }>, Schema.Struct<{
+      readonly enabled: Schema.Boolean;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        commandId: Schema.NonEmptyString;
+        actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly enabled: Schema.Boolean;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+      readonly reveals: readonly ["recovery-codes"];
+    }>;
+    VerifyPending: AuthOperation<`${Id}/totp/pending`, Schema.Struct<{
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Completion, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Completion;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    VerifyStepUp: AuthOperation<`${Id}/totp/step-up`, Schema.Struct<{
+      readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Session, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Session;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "authenticated";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RecoverPending: AuthOperation<`${Id}/totp/recovery/pending`, Schema.Struct<{
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Completion, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Completion;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+    RecoverLostFactor: AuthOperation<`${Id}/totp/recovery/reset`, Schema.Struct<{
+      readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+      readonly code: Schema.RedactedFromValue<Schema.String>;
+    }>, Schema.Struct<{
+      readonly outcome: Schema.Literal<"reauthentication-required">;
+      readonly invalidation: Schema.Struct<{
+        readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+        readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+        readonly maximumExposureMillis: Schema.Natural;
+        readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+      }>;
+    }>, Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+        readonly code: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly success: Schema.Struct<{
+        readonly outcome: Schema.Literal<"reauthentication-required">;
+        readonly invalidation: Schema.Struct<{
+          readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+          readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+          readonly maximumExposureMillis: Schema.Natural;
+          readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+        }>;
+      }>;
+      readonly error: Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>;
+      readonly exposure: "public";
+      readonly access: "any";
+      readonly replay: "single-use";
+      readonly credentials: true;
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/confirm`, Schema.Struct<{
+    readonly commandId: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    readonly enrollmentId: Schema.NonEmptyString;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly enabled: Schema.Boolean;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/disable`, Schema.Struct<{
+    commandId: Schema.NonEmptyString;
+    actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>, Schema.Struct<{
+    readonly enabled: Schema.Boolean;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/enroll`, Schema.Struct<{
+    readonly commandId: Schema.NonEmptyString;
+    readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+    readonly accountName: Schema.NonEmptyString;
+  }>, Schema.Struct<{
+    readonly enrollmentId: Schema.NonEmptyString;
+    readonly expiresAtMillis: Schema.Natural;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/pending`, Schema.Struct<{
+    readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Completion, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/recovery/pending`, Schema.Struct<{
+    readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Completion, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/recovery/regenerate`, Schema.Struct<{
+    commandId: Schema.NonEmptyString;
+    actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.NonEmptyString>>;
+  }>, Schema.Struct<{
+    readonly enabled: Schema.Boolean;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/recovery/reset`, Schema.Struct<{
+    readonly pendingCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Schema.Struct<{
+    readonly outcome: Schema.Literal<"reauthentication-required">;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never> | import("effect/unstable/rpc/Rpc").Rpc<`${Id}/totp/step-up`, Schema.Struct<{
+    readonly stepUpCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly sourceCredential: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+  }>, Session, Schema.Union<readonly [Schema.Union<readonly [typeof TotpRejected, typeof TotpUnavailable, typeof TotpConfigurationError, typeof TotpActionRequired, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+}>;
+//#endregion
+export { BeginInput, ConfirmInput, ManageInput, RecoveryInput, StepUpInput, TotpPolicy, VerifyInput, actionFields, makeTotpContract };
+//# sourceMappingURL=TotpContract.d.mts.map

package/dist/TotpContract.mjs

@@ -0,0 +1,119 @@
+import { makeOperation, operationGroup } from "./operations/operation.mjs";
+import { TotpFailure } from "./totp/errors.mjs";
+import { TotpCode, TotpCredential, TotpEnrollmentStarted, TotpId, TotpManagementResult, TotpPolicy, TotpRecoveryCode, TotpRecoveryReset } from "./totp/models.mjs";
+import { Schema } from "effect";
+//#region src/TotpContract.ts
+const actionFields = {
+	commandId: TotpId,
+	actionProof: Schema.optionalKey(TotpCredential)
+};
+const BeginInput = Schema.Struct({
+	...actionFields,
+	accountName: Schema.NonEmptyString.check(Schema.isMaxLength(128))
+});
+const ConfirmInput = Schema.Struct({
+	...actionFields,
+	enrollmentId: TotpId,
+	code: TotpCode
+});
+const ManageInput = Schema.Struct(actionFields);
+const VerifyInput = Schema.Struct({
+	pendingCredential: TotpCredential,
+	code: TotpCode
+});
+const RecoveryInput = Schema.Struct({
+	pendingCredential: TotpCredential,
+	code: TotpRecoveryCode
+});
+const StepUpInput = Schema.Struct({
+	stepUpCredential: TotpCredential,
+	sourceCredential: TotpCredential,
+	code: TotpCode
+});
+/** Canonical TOTP contracts without secret encryption, storage, or authority Layers. */
+const makeTotpContract = (moduleId, sessions) => {
+	const operations = {
+		Begin: makeOperation(`${moduleId}/totp/enroll`, {
+			payload: BeginInput,
+			success: TotpEnrollmentStarted,
+			error: TotpFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "single-use",
+			credentials: true,
+			reveals: ["totp-enrollment"]
+		}),
+		Confirm: makeOperation(`${moduleId}/totp/confirm`, {
+			payload: ConfirmInput,
+			success: TotpManagementResult,
+			error: TotpFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "single-use",
+			credentials: true,
+			reveals: ["recovery-codes"]
+		}),
+		Disable: makeOperation(`${moduleId}/totp/disable`, {
+			payload: ManageInput,
+			success: TotpManagementResult,
+			error: TotpFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "single-use"
+		}),
+		Regenerate: makeOperation(`${moduleId}/totp/recovery/regenerate`, {
+			payload: ManageInput,
+			success: TotpManagementResult,
+			error: TotpFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "single-use",
+			credentials: true,
+			reveals: ["recovery-codes"]
+		}),
+		VerifyPending: makeOperation(`${moduleId}/totp/pending`, {
+			payload: VerifyInput,
+			success: sessions.CompletionResult,
+			error: TotpFailure,
+			exposure: "public",
+			access: "any",
+			replay: "single-use",
+			credentials: true
+		}),
+		VerifyStepUp: makeOperation(`${moduleId}/totp/step-up`, {
+			payload: StepUpInput,
+			success: sessions.Session,
+			error: TotpFailure,
+			exposure: "public",
+			access: "authenticated",
+			replay: "single-use",
+			credentials: true
+		}),
+		RecoverPending: makeOperation(`${moduleId}/totp/recovery/pending`, {
+			payload: RecoveryInput,
+			success: sessions.CompletionResult,
+			error: TotpFailure,
+			exposure: "public",
+			access: "any",
+			replay: "single-use",
+			credentials: true
+		}),
+		RecoverLostFactor: makeOperation(`${moduleId}/totp/recovery/reset`, {
+			payload: RecoveryInput,
+			success: TotpRecoveryReset,
+			error: TotpFailure,
+			exposure: "public",
+			access: "any",
+			replay: "single-use",
+			credentials: true
+		})
+	};
+	return Object.freeze({
+		operations,
+		group: operationGroup(...Object.values(operations))
+	});
+};
+//#endregion
+export { BeginInput, ConfirmInput, ManageInput, RecoveryInput, StepUpInput, TotpPolicy, VerifyInput, actionFields, makeTotpContract };
+
+//# sourceMappingURL=TotpContract.mjs.map

package/dist/TotpContract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TotpContract.mjs","names":[],"sources":["../src/TotpContract.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { makeOperation, operationGroup } from \"./operations/operation\";\nimport { TotpFailure } from \"./totp/errors\";\nimport {\n  TotpId,\n  TotpCredential,\n  TotpCode,\n  TotpRecoveryCode,\n  TotpEnrollmentStarted,\n  TotpManagementResult,\n  TotpRecoveryReset,\n} from \"./totp/models\";\n\nexport const actionFields = { commandId: TotpId, actionProof: Schema.optionalKey(TotpCredential) };\n\nexport const BeginInput = Schema.Struct({\n  ...actionFields,\n  accountName: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n});\n\nexport const ConfirmInput = Schema.Struct({\n  ...actionFields,\n  enrollmentId: TotpId,\n  code: TotpCode,\n});\n\nexport const ManageInput = Schema.Struct(actionFields);\nexport const VerifyInput = Schema.Struct({ pendingCredential: TotpCredential, code: TotpCode });\n\nexport const RecoveryInput = Schema.Struct({\n  pendingCredential: TotpCredential,\n  code: TotpRecoveryCode,\n});\n\nexport const StepUpInput = Schema.Struct({\n  stepUpCredential: TotpCredential,\n  sourceCredential: TotpCredential,\n  code: TotpCode,\n});\n\n/** Canonical TOTP contracts without secret encryption, storage, or authority Layers. */\nexport const makeTotpContract = <\n  const Id extends string,\n  Session extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  Completion extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  sessions: { readonly Session: Session; readonly CompletionResult: Completion },\n) => {\n  const Begin = makeOperation(`${moduleId}/totp/enroll`, {\n    payload: BeginInput,\n    success: TotpEnrollmentStarted,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n    reveals: [\"totp-enrollment\"],\n  });\n\n  const Confirm = makeOperation(`${moduleId}/totp/confirm`, {\n    payload: ConfirmInput,\n    success: TotpManagementResult,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n    reveals: [\"recovery-codes\"],\n  });\n\n  const Disable = makeOperation(`${moduleId}/totp/disable`, {\n    payload: ManageInput,\n    success: TotpManagementResult,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n  });\n\n  const Regenerate = makeOperation(`${moduleId}/totp/recovery/regenerate`, {\n    payload: ManageInput,\n    success: TotpManagementResult,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n    reveals: [\"recovery-codes\"],\n  });\n\n  const VerifyPending = makeOperation(`${moduleId}/totp/pending`, {\n    payload: VerifyInput,\n    success: sessions.CompletionResult,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const VerifyStepUp = makeOperation(`${moduleId}/totp/step-up`, {\n    payload: StepUpInput,\n    success: sessions.Session,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const RecoverPending = makeOperation(`${moduleId}/totp/recovery/pending`, {\n    payload: RecoveryInput,\n    success: sessions.CompletionResult,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const RecoverLostFactor = makeOperation(`${moduleId}/totp/recovery/reset`, {\n    payload: RecoveryInput,\n    success: TotpRecoveryReset,\n    error: TotpFailure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const operations = {\n    Begin,\n    Confirm,\n    Disable,\n    Regenerate,\n    VerifyPending,\n    VerifyStepUp,\n    RecoverPending,\n    RecoverLostFactor,\n  };\n\n  return Object.freeze({ operations, group: operationGroup(...Object.values(operations)) });\n};\n\nexport { TotpPolicy } from \"./totp/models\";\n"],"mappings":";;;;;AAcA,MAAa,eAAe;CAAE,WAAW;CAAQ,aAAa,OAAO,YAAY,cAAc;AAAE;AAEjG,MAAa,aAAa,OAAO,OAAO;CACtC,GAAG;CACH,aAAa,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AAClE,CAAC;AAED,MAAa,eAAe,OAAO,OAAO;CACxC,GAAG;CACH,cAAc;CACd,MAAM;AACR,CAAC;AAED,MAAa,cAAc,OAAO,OAAO,YAAY;AACrD,MAAa,cAAc,OAAO,OAAO;CAAE,mBAAmB;CAAgB,MAAM;AAAS,CAAC;AAE9F,MAAa,gBAAgB,OAAO,OAAO;CACzC,mBAAmB;CACnB,MAAM;AACR,CAAC;AAED,MAAa,cAAc,OAAO,OAAO;CACvC,kBAAkB;CAClB,kBAAkB;CAClB,MAAM;AACR,CAAC;;AAGD,MAAa,oBAKX,UACA,aACG;CAmFH,MAAM,aAAa;EACjB,OAnFY,cAAc,GAAG,SAAS,eAAe;GACrD,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;GACb,SAAS,CAAC,iBAAiB;EAC7B,CA0EM;EACJ,SAzEc,cAAc,GAAG,SAAS,gBAAgB;GACxD,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;GACb,SAAS,CAAC,gBAAgB;EAC5B,CAgEQ;EACN,SA/Dc,cAAc,GAAG,SAAS,gBAAgB;GACxD,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;EACV,CAwDQ;EACN,YAvDiB,cAAc,GAAG,SAAS,4BAA4B;GACvE,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;GACb,SAAS,CAAC,gBAAgB;EAC5B,CA8CW;EACT,eA7CoB,cAAc,GAAG,SAAS,gBAAgB;GAC9D,SAAS;GACT,SAAS,SAAS;GAClB,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAqCc;EACZ,cApCmB,cAAc,GAAG,SAAS,gBAAgB;GAC7D,SAAS;GACT,SAAS,SAAS;GAClB,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CA4Ba;EACX,gBA3BqB,cAAc,GAAG,SAAS,yBAAyB;GACxE,SAAS;GACT,SAAS,SAAS;GAClB,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAmBe;EACb,mBAlBwB,cAAc,GAAG,SAAS,uBAAuB;GACzE,SAAS;GACT,SAAS;GACT,OAAO;GACP,UAAU;GACV,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAUkB;CAClB;CAEA,OAAO,OAAO,OAAO;EAAE;EAAY,OAAO,eAAe,GAAG,OAAO,OAAO,UAAU,CAAC;CAAE,CAAC;AAC1F"}

package/dist/WebCrypto.d.mts

@@ -0,0 +1,28 @@
+import { Context, Crypto, Layer } from "effect";
+//#region src/WebCrypto.d.ts
+declare const SubtleCrypto_base: Context.ServiceClass<SubtleCrypto, "effect-auth/SubtleCrypto", globalThis.SubtleCrypto>;
+/**
+ * The platform's low-level WebCrypto interface, as a service so consumers
+ * (key derivation in `PasswordHasher`, HMAC in `AuthTokenCodec`) never reach
+ * for `globalThis` themselves. `Crypto.Crypto` deliberately does not expose
+ * `SubtleCrypto`, so this is the seam for the primitives it lacks.
+ */
+declare class SubtleCrypto extends SubtleCrypto_base {
+  /**
+   * The WebCrypto `SubtleCrypto` from the platform global. Dies when the
+   * runtime has no WebCrypto — a platform gap, not a recoverable failure.
+   */
+  static readonly layerWeb: Layer.Layer<SubtleCrypto>;
+}
+/** Decode a PEM body's base64 payload into its DER bytes. */
+declare const decodePem: (pem: string) => Uint8Array | undefined;
+/**
+ * `Crypto.Crypto` backed by the platform WebCrypto API. Suitable for browsers,
+ * Cloudflare Workers, and Node.js 20+, all of which expose `globalThis.crypto`.
+ */
+declare const layerCryptoWeb: Layer.Layer<Crypto.Crypto>;
+/** Complete WebCrypto adapter for auth workflows on web-compatible runtimes. */
+declare const layerWebCrypto: Layer.Layer<Crypto.Crypto | SubtleCrypto, never, never>;
+//#endregion
+export { SubtleCrypto, decodePem, layerCryptoWeb, layerWebCrypto };
+//# sourceMappingURL=WebCrypto.d.mts.map

package/dist/WebCrypto.mjs

@@ -0,0 +1,42 @@
+import { Context, Crypto, Effect, Encoding, Layer, PlatformError, Result } from "effect";
+//#region src/WebCrypto.ts
+/**
+* The platform's low-level WebCrypto interface, as a service so consumers
+* (key derivation in `PasswordHasher`, HMAC in `AuthTokenCodec`) never reach
+* for `globalThis` themselves. `Crypto.Crypto` deliberately does not expose
+* `SubtleCrypto`, so this is the seam for the primitives it lacks.
+*/
+var SubtleCrypto = class SubtleCrypto extends Context.Service()("effect-auth/SubtleCrypto") {
+	/**
+	* The WebCrypto `SubtleCrypto` from the platform global. Dies when the
+	* runtime has no WebCrypto — a platform gap, not a recoverable failure.
+	*/
+	static layerWeb = Layer.effect(SubtleCrypto)(Effect.suspend(() => {
+		const subtle = globalThis.crypto?.subtle;
+		return subtle === void 0 ? Effect.die(/* @__PURE__ */ new Error("WebCrypto is unavailable in this runtime")) : Effect.succeed(subtle);
+	}));
+};
+/** Decode a PEM body's base64 payload into its DER bytes. */
+const decodePem = (pem) => Result.getOrUndefined(Encoding.decodeBase64(pem.replace(/\\r\\n|\\n/g, "\n").replace(/-----[A-Z ]+-----/g, "").replace(/\s/g, "")));
+/**
+* `Crypto.Crypto` backed by the platform WebCrypto API. Suitable for browsers,
+* Cloudflare Workers, and Node.js 20+, all of which expose `globalThis.crypto`.
+*/
+const layerCryptoWeb = Layer.sync(Crypto.Crypto)(() => Crypto.make({
+	randomBytes: (size) => globalThis.crypto.getRandomValues(new Uint8Array(size)),
+	digest: (algorithm, data) => Effect.tryPromise({
+		try: async () => new Uint8Array(await globalThis.crypto.subtle.digest(algorithm, data)),
+		catch: (cause) => PlatformError.systemError({
+			_tag: "Unknown",
+			module: "Crypto",
+			method: "digest",
+			cause
+		})
+	})
+}));
+/** Complete WebCrypto adapter for auth workflows on web-compatible runtimes. */
+const layerWebCrypto = Layer.mergeAll(layerCryptoWeb, SubtleCrypto.layerWeb);
+//#endregion
+export { SubtleCrypto, decodePem, layerCryptoWeb, layerWebCrypto };
+
+//# sourceMappingURL=WebCrypto.mjs.map

package/dist/WebCrypto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCrypto.mjs","names":[],"sources":["../src/WebCrypto.ts"],"sourcesContent":["import { Context, Crypto, Effect, Encoding, Layer, PlatformError, Result } from \"effect\";\n\n/**\n * The platform's low-level WebCrypto interface, as a service so consumers\n * (key derivation in `PasswordHasher`, HMAC in `AuthTokenCodec`) never reach\n * for `globalThis` themselves. `Crypto.Crypto` deliberately does not expose\n * `SubtleCrypto`, so this is the seam for the primitives it lacks.\n */\nexport class SubtleCrypto extends Context.Service<SubtleCrypto, globalThis.SubtleCrypto>()(\n  \"effect-auth/SubtleCrypto\",\n) {\n  /**\n   * The WebCrypto `SubtleCrypto` from the platform global. Dies when the\n   * runtime has no WebCrypto — a platform gap, not a recoverable failure.\n   */\n  static readonly layerWeb: Layer.Layer<SubtleCrypto> = Layer.effect(SubtleCrypto)(\n    Effect.suspend(() => {\n      const subtle = globalThis.crypto?.subtle;\n\n      return subtle === undefined\n        ? Effect.die(new Error(\"WebCrypto is unavailable in this runtime\"))\n        : Effect.succeed(subtle);\n    }),\n  );\n}\n\n/** Decode a PEM body's base64 payload into its DER bytes. */\nexport const decodePem = (pem: string): Uint8Array | undefined =>\n  Result.getOrUndefined(\n    Encoding.decodeBase64(\n      pem\n        .replace(/\\\\r\\\\n|\\\\n/g, \"\\n\")\n        .replace(/-----[A-Z ]+-----/g, \"\")\n        .replace(/\\s/g, \"\"),\n    ),\n  );\n\n/**\n * `Crypto.Crypto` backed by the platform WebCrypto API. Suitable for browsers,\n * Cloudflare Workers, and Node.js 20+, all of which expose `globalThis.crypto`.\n */\nexport const layerCryptoWeb: Layer.Layer<Crypto.Crypto> = Layer.sync(Crypto.Crypto)(() =>\n  Crypto.make({\n    randomBytes: (size) => globalThis.crypto.getRandomValues(new Uint8Array(size)),\n    digest: (algorithm, data) =>\n      Effect.tryPromise({\n        try: async () =>\n          new Uint8Array(await globalThis.crypto.subtle.digest(algorithm, data as BufferSource)),\n        catch: (cause) =>\n          PlatformError.systemError({\n            _tag: \"Unknown\",\n            module: \"Crypto\",\n            method: \"digest\",\n            cause,\n          }),\n      }),\n  }),\n);\n\n/** Complete WebCrypto adapter for auth workflows on web-compatible runtimes. */\nexport const layerWebCrypto = Layer.mergeAll(layerCryptoWeb, SubtleCrypto.layerWeb);\n"],"mappings":";;;;;;;;AAQA,IAAa,eAAb,MAAa,qBAAqB,QAAQ,QAA+C,CAAC,CACxF,0BACF,CAAC,CAAC;;;;;CAKA,OAAgB,WAAsC,MAAM,OAAO,YAAY,CAAC,CAC9E,OAAO,cAAc;EACnB,MAAM,SAAS,WAAW,QAAQ;EAElC,OAAO,WAAW,KAAA,IACd,OAAO,oBAAI,IAAI,MAAM,0CAA0C,CAAC,IAChE,OAAO,QAAQ,MAAM;CAC3B,CAAC,CACH;AACF;;AAGA,MAAa,aAAa,QACxB,OAAO,eACL,SAAS,aACP,IACG,QAAQ,eAAe,IAAI,CAAC,CAC5B,QAAQ,sBAAsB,EAAE,CAAC,CACjC,QAAQ,OAAO,EAAE,CACtB,CACF;;;;;AAMF,MAAa,iBAA6C,MAAM,KAAK,OAAO,MAAM,CAAC,OACjF,OAAO,KAAK;CACV,cAAc,SAAS,WAAW,OAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;CAC7E,SAAS,WAAW,SAClB,OAAO,WAAW;EAChB,KAAK,YACH,IAAI,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAoB,CAAC;EACvF,QAAQ,UACN,cAAc,YAAY;GACxB,MAAM;GACN,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;CACL,CAAC;AACL,CAAC,CACH;;AAGA,MAAa,iBAAiB,MAAM,SAAS,gBAAgB,aAAa,QAAQ"}

package/dist/Workflows.d.mts

@@ -0,0 +1,16 @@
+import { AuthTokenCodec } from "./AuthTokenCodec.mjs";
+import { AuthSession } from "./AuthSession.mjs";
+import { AuthStore } from "./AuthStore.mjs";
+import { EmailOtpSender } from "./EmailOtpSender.mjs";
+import { IdentityResolver } from "./IdentityResolver.mjs";
+import { EmailOtp } from "./EmailOtp.mjs";
+import { PasswordCredentialStore } from "./PasswordCredentialStore.mjs";
+import { PasswordHasher } from "./PasswordHasher.mjs";
+import { PasswordAuth } from "./PasswordAuth.mjs";
+import { Layer } from "effect";
+//#region src/Workflows.d.ts
+/** The three core auth workflows, retaining their adapter requirements. */
+declare const layerAuthWorkflows: Layer.Layer<AuthSession | EmailOtp | PasswordAuth, never, AuthStore | AuthTokenCodec | import("effect/Crypto").Crypto | EmailOtpSender | IdentityResolver | PasswordCredentialStore | PasswordHasher>;
+//#endregion
+export { layerAuthWorkflows };
+//# sourceMappingURL=Workflows.d.mts.map