@yielded/auth 0.1.0-beta.1

package/dist/auth/Auth.mjs

@@ -0,0 +1,141 @@
+import { make as make$1 } from "../operations/actions.mjs";
+import { cryptoLayer, hooksLayer } from "./defaults.mjs";
+import { configuredLayer } from "../sessions/configuration.mjs";
+import { makeSessionModule } from "../sessions/module.mjs";
+import { AuthConfigurationError } from "./AuthConfigurationError.mjs";
+import { makeActionApi } from "./actions.mjs";
+import { makeSessionApi } from "./session.mjs";
+import { Context, Effect, Exit, Layer, Option, Schema, Scope } from "effect";
+//#region src/auth/Auth.ts
+const withConstructionLayer = (create, layer) => Effect.gen(function* () {
+	const current = yield* Effect.serviceOption(Layer.CurrentMemoMap);
+	const memoMap = Option.isSome(current) ? current.value : yield* Layer.makeMemoMap;
+	const scope = yield* Scope.fork(yield* Effect.scope);
+	return yield* Effect.gen(function* () {
+		const services = yield* Layer.buildWithMemoMap(layer, memoMap, scope);
+		return yield* create.pipe(Effect.provide(services), Scope.provide(scope), Effect.provideService(Layer.CurrentMemoMap, memoMap));
+	}).pipe(Effect.onError((cause) => Scope.close(scope, Exit.failCause(cause))));
+});
+const build = Effect.fn("Auth.make")(function* (strategies, defaultStrategy) {
+	const entries = Object.entries(strategies);
+	const current = yield* Effect.serviceOption(Layer.CurrentMemoMap);
+	const memoMap = Option.isSome(current) ? current.value : yield* Layer.makeMemoMap;
+	const scope = yield* Scope.fork(yield* Effect.scope);
+	return yield* Effect.gen(function* () {
+		const built = yield* Effect.forEach(entries, ([name, strategy]) => Effect.map(strategy.make, (api) => [name, api]));
+		const methodsByStrategy = new Map(built);
+		const names = new Set([...methodsByStrategy.values()].flatMap((api) => Object.keys(api)));
+		if ([
+			"then",
+			"getSession",
+			"requireSession",
+			"verifySession",
+			"signOut",
+			"renewSession"
+		].some((name) => names.has(name))) return yield* AuthConfigurationError.make({ reason: "method" });
+		const api = Object.fromEntries([...names].map((name) => [name, (...args) => Effect.suspend(() => {
+			const selected = args.length === 2 ? args[0] : defaultStrategy;
+			const input = args.length === 2 ? args[1] : args[0];
+			const methods = typeof selected === "string" ? methodsByStrategy.get(selected) : void 0;
+			if (args.length > 2 || methods === void 0 || !Object.hasOwn(methods, name)) return Effect.die(AuthConfigurationError.make({ reason: "method" }));
+			return methods[name](input);
+		})]));
+		return {
+			api: Object.freeze(api),
+			strategies: Object.freeze(Object.fromEntries(built))
+		};
+	}).pipe(Effect.provideService(Layer.CurrentMemoMap, memoMap), Scope.provide(scope), Effect.onError((cause) => Scope.close(scope, Exit.failCause(cause))));
+});
+const namespaceSchema = Schema.NonEmptyString.check(Schema.isMaxLength(128), Schema.isPattern(/^[A-Za-z0-9._:/-]+$/));
+const strategyNameSchema = Schema.NonEmptyString.check(Schema.isMaxLength(64), Schema.isPattern(/^[A-Za-z0-9._-]+$/));
+const configurationError = (strategies, defaultStrategy, namespace, sessionNamespace) => {
+	if (!Schema.is(namespaceSchema)(namespace) || !Schema.is(namespaceSchema)(sessionNamespace)) return AuthConfigurationError.make({ reason: "namespace" });
+	const entries = Object.entries(strategies);
+	if (entries.some(([key]) => !Schema.is(strategyNameSchema)(key))) return AuthConfigurationError.make({ reason: "strategies" });
+	if (defaultStrategy !== void 0 && !Object.hasOwn(strategies, defaultStrategy)) return AuthConfigurationError.make({ reason: "default-strategy" });
+	if (entries.flatMap(([key, strategy]) => "bind" in strategy ? [strategy.namespace ?? `${namespace}/${key}`] : []).some((id) => !Schema.is(namespaceSchema)(id))) return AuthConfigurationError.make({ reason: "namespace" });
+};
+/** Bind schemas and service keys once, before choosing the application's adapter Layers. */
+const bind = (options, shared) => {
+	const strategies = { ...options.strategies };
+	const defaultStrategy = options.defaultStrategy;
+	const namespace = options.namespace ?? "effect-auth";
+	const sessionNamespace = options.sessionNamespace ?? `${namespace}/sessions`;
+	const invalid = configurationError(strategies, defaultStrategy, namespace, sessionNamespace);
+	if (invalid !== void 0) throw invalid;
+	const sessions = makeSessionModule(sessionNamespace, options.claims);
+	const modules = Object.fromEntries(Object.entries(strategies).map(([key, strategy]) => [key, "bind" in strategy ? strategy.bind({
+		claims: options.claims,
+		namespace: strategy.namespace ?? `${namespace}/${key}`,
+		sessionNamespace,
+		sessions
+	}) : { strategy }]));
+	const selected = Object.fromEntries(Object.entries(modules).map(([key, module]) => [key, module.strategy]));
+	const contract = shared ?? make$1(namespace, { claims: options.claims });
+	const create = Effect.gen(function* () {
+		const built = yield* build(selected, defaultStrategy);
+		const sessionApi = yield* makeSessionApi(sessions);
+		const raw = {
+			...built.api,
+			...sessionApi
+		};
+		const actions = yield* makeActionApi(sessionApi, built.strategies, defaultStrategy, contract.actions);
+		return Object.freeze({
+			...raw,
+			...actions
+		});
+	});
+	const completing = Object.values(selected).some((strategy) => strategy.completion === true);
+	const make = options.sessions === void 0 ? create : !completing ? withConstructionLayer(create, configuredLayer(sessions, options.sessions)) : withConstructionLayer(create, sessions.completionLayer().pipe(Layer.provideMerge(configuredLayer(sessions, options.sessions)), Layer.provide([cryptoLayer, hooksLayer])));
+	return Object.freeze({
+		claims: options.claims,
+		contract,
+		namespace,
+		sessions,
+		strategies: Object.freeze(modules),
+		make
+	});
+};
+const service = () => (id, definition, create) => {
+	const Auth = Context.Service()(id);
+	const layer = Layer.effect(Auth, create);
+	return Object.assign(Auth, definition, { layer });
+};
+/** Define one yieldable auth service, its schemas, extension ports and runtime Layer. */
+const makeService = (id, options, contract) => {
+	if (!Schema.is(Schema.NonEmptyString)(id)) throw AuthConfigurationError.make({ reason: "id" });
+	const definition = bind({
+		...options,
+		namespace: options.namespace ?? id
+	}, contract);
+	return service()(id, definition, definition.make);
+};
+function make(definition, options) {
+	if (typeof definition !== "string") return makeService(definition.namespace, {
+		...options,
+		namespace: definition.namespace,
+		sessionNamespace: `${definition.namespace}/sessions`,
+		claims: definition.claims
+	}, definition);
+	if (options.claims === void 0) throw AuthConfigurationError.make({ reason: "method" });
+	const namespace = options.namespace ?? definition;
+	return makeService(definition, {
+		...options,
+		namespace,
+		sessionNamespace: options.sessionNamespace ?? `${namespace}/sessions`,
+		claims: options.claims
+	});
+}
+/** Class form of the same auth definition, for applications using named service classes. */
+const Service = () => (id, options) => {
+	if (!Schema.is(Schema.NonEmptyString)(id)) throw AuthConfigurationError.make({ reason: "id" });
+	const definition = bind({
+		...options,
+		namespace: options.namespace ?? id
+	});
+	return service()(id, definition, definition.make);
+};
+//#endregion
+export { Service, make };
+
+//# sourceMappingURL=Auth.mjs.map

package/dist/auth/Auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.mjs","names":["makeContract"],"sources":["../../src/auth/Auth.ts"],"sourcesContent":["import { Context, Effect, Exit, Layer, Option, Schema, Scope, type Types } from \"effect\";\n\nimport { make as makeContract, type AnyAuthContract } from \"../operations/actions\";\nimport type { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport {\n  configuredLayer,\n  type SessionConfiguration,\n  type SessionRequirements,\n} from \"../sessions/configuration\";\nimport type { SessionConfigurationError } from \"../sessions/errors\";\nimport { makeSessionModule, type ModuleService } from \"../sessions/module\";\nimport { makeActionApi } from \"./actions\";\nimport { AuthConfigurationError } from \"./AuthConfigurationError\";\nimport { cryptoLayer, hooksLayer } from \"./defaults\";\nimport type {\n  BoundSelection,\n  BoundStrategies,\n  BuiltStrategy as Strategy,\n  ClaimsCodec,\n  StrategySelection,\n} from \"./definition\";\nimport { makeSessionApi } from \"./session\";\n\ntype Strategies = Readonly<Record<string, Strategy>>;\ntype CompletionOf<S> = S extends { readonly completion: infer C } ? C : false;\n\nconst withConstructionLayer = <A, E, R, Provided, E2, R2>(\n  create: Effect.Effect<A, E, R>,\n  layer: Layer.Layer<Provided, E2, R2>,\n) =>\n  Effect.gen(function* () {\n    const current = yield* Effect.serviceOption(Layer.CurrentMemoMap);\n    const memoMap = Option.isSome(current) ? current.value : yield* Layer.makeMemoMap;\n    const scope = yield* Scope.fork(yield* Effect.scope);\n\n    return yield* Effect.gen(function* () {\n      const services = yield* Layer.buildWithMemoMap(layer, memoMap, scope);\n\n      return yield* create.pipe(\n        Effect.provide(services),\n        Scope.provide(scope),\n        Effect.provideService(Layer.CurrentMemoMap, memoMap),\n      );\n    }).pipe(Effect.onError((cause) => Scope.close(scope, Exit.failCause(cause))));\n  });\n\ntype Api<S extends Strategy> = Effect.Success<S[\"make\"]>;\ntype StrategyMethod<S extends Strategy> = S extends Strategy ? Api<S>[keyof Api<S>] : never;\ntype MethodNames<S extends Strategies> = S[keyof S] extends infer Strategy\n  ? Strategy extends { readonly make: Effect.Effect<infer Api, unknown, unknown> }\n    ? keyof Api\n    : never\n  : never;\ntype Selected<S extends Strategies, M extends PropertyKey> = {\n  [K in keyof S]: M extends keyof Api<S[K]>\n    ? (strategy: K, input: Parameters<Api<S[K]>[M]>[0]) => ReturnType<Api<S[K]>[M]>\n    : never;\n}[keyof S];\n\nexport type AuthApi<S extends Strategies, Default extends keyof S | undefined> = {\n  readonly [M in MethodNames<S>]: Types.UnionToIntersection<Selected<S, M>> &\n    (Default extends keyof S\n      ? M extends keyof Api<S[Default]>\n        ? Api<S[Default]>[M]\n        : unknown\n      : unknown);\n};\n\ntype DefaultedName<Key extends string, Value extends string, Default extends string> = [\n  Value,\n  Default,\n] extends [Default, Value]\n  ? { readonly [K in Key]?: Value }\n  : { readonly [K in Key]: Value };\n\ntype Names<Id extends string, SessionId extends string, Default extends string> = DefaultedName<\n  \"namespace\",\n  Id,\n  Default\n> &\n  DefaultedName<\"sessionNamespace\", SessionId, `${Id}/sessions`>;\n\nexport type Options<\n  Claims extends ClaimsCodec,\n  S extends StrategySelection,\n  Default extends keyof S | undefined = undefined,\n  Id extends string = \"effect-auth\",\n  SessionId extends string = `${Id}/sessions`,\n  DefaultId extends string = \"effect-auth\",\n  Sessions extends SessionConfiguration | undefined = undefined,\n> = {\n  readonly claims: Claims;\n  readonly strategies?: S & Record<Exclude<keyof S, string>, never>;\n  /** Omit when supplying a custom SessionStrategy and completion through Layers. */\n  readonly sessions?: Sessions;\n  readonly defaultStrategy?: Default;\n} & Names<Id, SessionId, DefaultId>;\n\nconst build = Effect.fn(\"Auth.make\")(function* <\n  S extends Strategies,\n  Default extends keyof S | undefined,\n>(strategies: S, defaultStrategy: Default | undefined) {\n  type Build = S[keyof S][\"make\"];\n\n  const entries = Object.entries(strategies) as Array<\n    [\n      string,\n      {\n        readonly make: Effect.Effect<\n          Effect.Success<Build>,\n          Effect.Error<Build>,\n          Effect.Services<Build>\n        >;\n      },\n    ]\n  >;\n\n  const current = yield* Effect.serviceOption(Layer.CurrentMemoMap);\n  const memoMap = Option.isSome(current) ? current.value : yield* Layer.makeMemoMap;\n  const scope = yield* Scope.fork(yield* Effect.scope);\n\n  return yield* Effect.gen(function* () {\n    type Result = ReturnType<StrategyMethod<S[keyof S]>>;\n    type Callable = (\n      input: never,\n    ) => Effect.Effect<Effect.Success<Result>, Effect.Error<Result>, Effect.Services<Result>>;\n\n    const built = yield* Effect.forEach(entries, ([name, strategy]) =>\n      Effect.map(strategy.make, (api) => [name, api] as const),\n    );\n\n    const methodsByStrategy = new Map(\n      built as ReadonlyArray<readonly [string, Readonly<Record<string, Callable>>]>,\n    );\n\n    const names = new Set([...methodsByStrategy.values()].flatMap((api) => Object.keys(api)));\n\n    if (\n      [\"then\", \"getSession\", \"requireSession\", \"verifySession\", \"signOut\", \"renewSession\"].some(\n        (name) => names.has(name),\n      )\n    )\n      return yield* AuthConfigurationError.make({ reason: \"method\" });\n\n    const api = Object.fromEntries(\n      [...names].map((name) => [\n        name,\n        (...args: readonly unknown[]) =>\n          Effect.suspend(() => {\n            const selected = args.length === 2 ? args[0] : defaultStrategy;\n            const input = args.length === 2 ? args[1] : args[0];\n\n            const methods =\n              typeof selected === \"string\" ? methodsByStrategy.get(selected) : undefined;\n\n            if (args.length > 2 || methods === undefined || !Object.hasOwn(methods, name))\n              return Effect.die(AuthConfigurationError.make({ reason: \"method\" }));\n\n            return methods[name](input as never);\n          }),\n      ]),\n    );\n\n    // The dispatch table is assembled from these exact strategy/method pairs.\n    return {\n      api: Object.freeze(api) as AuthApi<S, Default>,\n      strategies: Object.freeze(Object.fromEntries(built)) as {\n        readonly [Name in keyof S]: Api<S[Name]>;\n      },\n    };\n  }).pipe(\n    Effect.provideService(Layer.CurrentMemoMap, memoMap),\n    Scope.provide(scope),\n    Effect.onError((cause) => Scope.close(scope, Exit.failCause(cause))),\n  );\n});\n\nconst namespaceSchema = Schema.NonEmptyString.check(\n  Schema.isMaxLength(128),\n  Schema.isPattern(/^[A-Za-z0-9._:/-]+$/),\n);\n\nconst strategyNameSchema = Schema.NonEmptyString.check(\n  Schema.isMaxLength(64),\n  Schema.isPattern(/^[A-Za-z0-9._-]+$/),\n);\n\nconst configurationError = (\n  strategies: StrategySelection,\n  defaultStrategy: PropertyKey | undefined,\n  namespace: string,\n  sessionNamespace: string,\n) => {\n  if (!Schema.is(namespaceSchema)(namespace) || !Schema.is(namespaceSchema)(sessionNamespace))\n    return AuthConfigurationError.make({ reason: \"namespace\" });\n  const entries = Object.entries(strategies);\n\n  if (entries.some(([key]) => !Schema.is(strategyNameSchema)(key)))\n    return AuthConfigurationError.make({ reason: \"strategies\" });\n  if (defaultStrategy !== undefined && !Object.hasOwn(strategies, defaultStrategy))\n    return AuthConfigurationError.make({ reason: \"default-strategy\" });\n\n  const namespaces = entries.flatMap(([key, strategy]) =>\n    \"bind\" in strategy ? [strategy.namespace ?? `${namespace}/${key}`] : [],\n  );\n\n  if (namespaces.some((id) => !Schema.is(namespaceSchema)(id)))\n    return AuthConfigurationError.make({ reason: \"namespace\" });\n\n  return undefined;\n};\n\n/** Bind schemas and service keys once, before choosing the application's adapter Layers. */\nconst bind = <\n  Claims extends ClaimsCodec,\n  const S extends StrategySelection = {},\n  const Default extends keyof S | undefined = undefined,\n  const Id extends string = \"effect-auth\",\n  const SessionId extends string = `${Id}/sessions`,\n  const Sessions extends SessionConfiguration | undefined = undefined,\n  Contract extends AnyAuthContract | undefined = undefined,\n>(\n  options: Options<Claims, S, Default, Id, SessionId, \"effect-auth\", Sessions>,\n  shared?: Contract,\n) => {\n  const strategies = { ...options.strategies };\n  const defaultStrategy = options.defaultStrategy;\n  // Defaults are fixed credential namespaces, never process-local random identities.\n  const namespace = (options.namespace ?? \"effect-auth\") as Id;\n  const sessionNamespace = (options.sessionNamespace ?? `${namespace}/sessions`) as SessionId;\n  const invalid = configurationError(strategies, defaultStrategy, namespace, sessionNamespace);\n\n  if (invalid !== undefined) throw invalid;\n  const sessions = makeSessionModule(sessionNamespace, options.claims);\n\n  const modules = Object.fromEntries(\n    Object.entries(strategies).map(([key, strategy]) => [\n      key,\n      \"bind\" in strategy\n        ? strategy.bind({\n            claims: options.claims,\n            namespace: strategy.namespace ?? `${namespace}/${key}`,\n            sessionNamespace,\n            sessions,\n          })\n        : { strategy },\n    ]),\n    // Each descriptor is bound to these exact claims, namespace and selection key.\n  ) as BoundStrategies<S, Claims, Id, SessionId>;\n\n  const selected = Object.fromEntries(\n    Object.entries(modules).map(([key, module]) => [key, module.strategy]),\n  ) as BoundSelection<typeof modules>;\n\n  type ContractDefinition = Contract extends AnyAuthContract\n    ? Contract\n    : ReturnType<typeof makeContract<Id, Claims>>;\n\n  const contract = (shared ??\n    makeContract(namespace, { claims: options.claims })) as ContractDefinition;\n\n  const create = Effect.gen(function* () {\n    const built = yield* build(selected, defaultStrategy);\n    const sessionApi = yield* makeSessionApi(sessions);\n\n    const raw = { ...built.api, ...sessionApi };\n\n    const actions = yield* makeActionApi<\n      typeof sessionApi,\n      typeof built.strategies,\n      Default,\n      ContractDefinition[\"actions\"]\n    >(sessionApi, built.strategies, defaultStrategy, contract.actions);\n\n    return Object.freeze({ ...raw, ...actions }) as Omit<typeof raw, keyof typeof actions> &\n      typeof actions;\n  });\n\n  const completing = Object.values<Strategy>(selected).some(\n    (strategy) => strategy.completion === true,\n  );\n\n  const configured =\n    options.sessions === undefined\n      ? create\n      : !completing\n        ? withConstructionLayer(create, configuredLayer(sessions, options.sessions))\n        : withConstructionLayer(\n            create,\n            sessions\n              .completionLayer()\n              .pipe(\n                Layer.provideMerge(configuredLayer(sessions, options.sessions)),\n                Layer.provide([cryptoLayer, hooksLayer]),\n              ),\n          );\n\n  type SelectedStrategies = (typeof selected)[keyof typeof selected];\n  type Completes = true extends CompletionOf<SelectedStrategies> ? true : false;\n  type ConfigurationRequirements = Sessions extends SessionConfiguration\n    ?\n        | SessionRequirements<Sessions, SessionId, Claims>\n        | (Completes extends true ? AuthenticationAuthority : never)\n    : never;\n  type Provided = Sessions extends SessionConfiguration\n    ?\n        | ModuleService<SessionId, \"strategy\", Claims[\"Type\"]>\n        | (Completes extends true ? ModuleService<SessionId, \"completion\", Claims[\"Type\"]> : never)\n    : never;\n\n  // Runtime selection mirrors the session mode and presence of selected methods.\n  // Unconfigured definitions retain their explicit strategy/completion requirements.\n  const make = configured as Effect.Effect<\n    Effect.Success<typeof create>,\n    | Effect.Error<typeof create>\n    | (Sessions extends SessionConfiguration ? SessionConfigurationError : never),\n    Exclude<Effect.Services<typeof create>, Provided> | ConfigurationRequirements\n  >;\n\n  return Object.freeze({\n    claims: options.claims,\n    contract,\n    namespace,\n    sessions,\n    strategies: Object.freeze(modules),\n    make,\n  });\n};\n\n/** Identifier for a constant auth service. The stable name also isolates its credentials. */\nexport interface AuthService<Id extends string, Claims> {\n  readonly id: Id;\n  readonly claims: Types.Invariant<Claims>;\n}\n\nconst service =\n  <Self>() =>\n  <const Id extends string, A, E, R, Definition>(\n    id: Id,\n    definition: Definition,\n    create: Effect.Effect<A, E, R>,\n  ) => {\n    const Auth = Context.Service<Self, A>()(id);\n    const layer = Layer.effect(Auth, create);\n\n    return Object.assign(Auth, definition, { layer });\n  };\n\n/** Define one yieldable auth service, its schemas, extension ports and runtime Layer. */\nconst makeService = <\n  const Id extends string,\n  Claims extends ClaimsCodec,\n  const S extends StrategySelection = {},\n  const Default extends keyof S | undefined = undefined,\n  const Namespace extends string = Id,\n  const SessionId extends string = `${Namespace}/sessions`,\n  const Sessions extends SessionConfiguration | undefined = undefined,\n  Contract extends AnyAuthContract | undefined = undefined,\n>(\n  id: Id,\n  options: Options<Claims, S, Default, Namespace, SessionId, Id, Sessions>,\n  contract?: Contract,\n) => {\n  if (!Schema.is(Schema.NonEmptyString)(id)) throw AuthConfigurationError.make({ reason: \"id\" });\n\n  const definition = bind<Claims, S, Default, Namespace, SessionId, Sessions, Contract>(\n    {\n      ...options,\n      namespace: options.namespace ?? id,\n    } as Options<Claims, S, Default, Namespace, SessionId, \"effect-auth\", Sessions>,\n    contract,\n  );\n\n  return service<AuthService<Id, Claims[\"Type\"]>>()(id, definition, definition.make);\n};\n\n/** Create a yieldable auth service from a shared contract or service identifier.\n * Use its Layer for provisioning, or yield its make Effect for direct construction.\n * AuthRequest is resolved when a method executes. */\nexport function make<\n  Contract extends AnyAuthContract,\n  const S extends StrategySelection = {},\n  const Default extends keyof S | undefined = undefined,\n  const Sessions extends SessionConfiguration | undefined = undefined,\n>(\n  contract: Contract,\n  options: Omit<\n    Options<\n      Contract[\"claims\"],\n      S,\n      Default,\n      Contract[\"namespace\"],\n      `${Contract[\"namespace\"]}/sessions`,\n      Contract[\"namespace\"],\n      Sessions\n    >,\n    \"claims\" | \"namespace\" | \"sessionNamespace\"\n  >,\n): ReturnType<\n  typeof makeService<\n    Contract[\"namespace\"],\n    Contract[\"claims\"],\n    S,\n    Default,\n    Contract[\"namespace\"],\n    `${Contract[\"namespace\"]}/sessions`,\n    Sessions,\n    Contract\n  >\n>;\n\nexport function make<\n  const Id extends string,\n  Claims extends ClaimsCodec,\n  const S extends StrategySelection = {},\n  const Default extends keyof S | undefined = undefined,\n  const Namespace extends string = Id,\n  const SessionId extends string = `${Namespace}/sessions`,\n  const Sessions extends SessionConfiguration | undefined = undefined,\n>(\n  id: Id,\n  options: Options<Claims, S, Default, Namespace, SessionId, Id, Sessions>,\n): ReturnType<typeof makeService<Id, Claims, S, Default, Namespace, SessionId, Sessions>>;\n\nexport function make(\n  definition: string | AnyAuthContract,\n  options: {\n    readonly claims?: ClaimsCodec;\n    readonly strategies?: StrategySelection;\n    readonly sessions?: SessionConfiguration;\n    readonly defaultStrategy?: string;\n    readonly namespace?: string;\n    readonly sessionNamespace?: string;\n  },\n): unknown {\n  if (typeof definition !== \"string\") {\n    return makeService(\n      definition.namespace,\n      {\n        ...options,\n        namespace: definition.namespace,\n        sessionNamespace: `${definition.namespace}/sessions`,\n        claims: definition.claims,\n      },\n      definition,\n    );\n  }\n  if (options.claims === undefined) throw AuthConfigurationError.make({ reason: \"method\" });\n  const namespace = options.namespace ?? definition;\n\n  return makeService(definition, {\n    ...options,\n    namespace,\n    sessionNamespace: options.sessionNamespace ?? `${namespace}/sessions`,\n    claims: options.claims,\n  });\n}\n\n/** Class form of the same auth definition, for applications using named service classes. */\nexport const Service =\n  <Self>() =>\n  <\n    const Id extends string,\n    Claims extends ClaimsCodec,\n    const S extends StrategySelection = {},\n    const Default extends keyof S | undefined = undefined,\n    const Namespace extends string = Id,\n    const SessionId extends string = `${Namespace}/sessions`,\n    const Sessions extends SessionConfiguration | undefined = undefined,\n  >(\n    id: Id,\n    options: Options<Claims, S, Default, Namespace, SessionId, Id, Sessions>,\n  ) => {\n    if (!Schema.is(Schema.NonEmptyString)(id)) throw AuthConfigurationError.make({ reason: \"id\" });\n\n    const definition = bind<Claims, S, Default, Namespace, SessionId, Sessions>({\n      ...options,\n      namespace: options.namespace ?? id,\n    } as Options<Claims, S, Default, Namespace, SessionId, \"effect-auth\", Sessions>);\n\n    return service<Self>()(id, definition, definition.make);\n  };\n"],"mappings":";;;;;;;;;AA0BA,MAAM,yBACJ,QACA,UAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,OAAO,cAAc,MAAM,cAAc;CAChE,MAAM,UAAU,OAAO,OAAO,OAAO,IAAI,QAAQ,QAAQ,OAAO,MAAM;CACtE,MAAM,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,KAAK;CAEnD,OAAO,OAAO,OAAO,IAAI,aAAa;EACpC,MAAM,WAAW,OAAO,MAAM,iBAAiB,OAAO,SAAS,KAAK;EAEpE,OAAO,OAAO,OAAO,KACnB,OAAO,QAAQ,QAAQ,GACvB,MAAM,QAAQ,KAAK,GACnB,OAAO,eAAe,MAAM,gBAAgB,OAAO,CACrD;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,MAAM,MAAM,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAsDH,MAAM,QAAQ,OAAO,GAAG,WAAW,CAAC,CAAC,WAGnC,YAAe,iBAAsC;CAGrD,MAAM,UAAU,OAAO,QAAQ,UAAU;CAazC,MAAM,UAAU,OAAO,OAAO,cAAc,MAAM,cAAc;CAChE,MAAM,UAAU,OAAO,OAAO,OAAO,IAAI,QAAQ,QAAQ,OAAO,MAAM;CACtE,MAAM,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,KAAK;CAEnD,OAAO,OAAO,OAAO,IAAI,aAAa;EAMpC,MAAM,QAAQ,OAAO,OAAO,QAAQ,UAAU,CAAC,MAAM,cACnD,OAAO,IAAI,SAAS,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAU,CACzD;EAEA,MAAM,oBAAoB,IAAI,IAC5B,KACF;EAEA,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,kBAAkB,OAAO,CAAC,CAAC,CAAC,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC,CAAC;EAExF,IACE;GAAC;GAAQ;GAAc;GAAkB;GAAiB;GAAW;EAAc,CAAC,CAAC,MAClF,SAAS,MAAM,IAAI,IAAI,CAC1B,GAEA,OAAO,OAAO,uBAAuB,KAAK,EAAE,QAAQ,SAAS,CAAC;EAEhE,MAAM,MAAM,OAAO,YACjB,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,SAAS,CACvB,OACC,GAAG,SACF,OAAO,cAAc;GACnB,MAAM,WAAW,KAAK,WAAW,IAAI,KAAK,KAAK;GAC/C,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK;GAEjD,MAAM,UACJ,OAAO,aAAa,WAAW,kBAAkB,IAAI,QAAQ,IAAI,KAAA;GAEnE,IAAI,KAAK,SAAS,KAAK,YAAY,KAAA,KAAa,CAAC,OAAO,OAAO,SAAS,IAAI,GAC1E,OAAO,OAAO,IAAI,uBAAuB,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC;GAErE,OAAO,QAAQ,KAAK,CAAC,KAAc;EACrC,CAAC,CACL,CAAC,CACH;EAGA,OAAO;GACL,KAAK,OAAO,OAAO,GAAG;GACtB,YAAY,OAAO,OAAO,OAAO,YAAY,KAAK,CAAC;EAGrD;CACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,MAAM,gBAAgB,OAAO,GACnD,MAAM,QAAQ,KAAK,GACnB,OAAO,SAAS,UAAU,MAAM,MAAM,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,CACrE;AACF,CAAC;AAED,MAAM,kBAAkB,OAAO,eAAe,MAC5C,OAAO,YAAY,GAAG,GACtB,OAAO,UAAU,qBAAqB,CACxC;AAEA,MAAM,qBAAqB,OAAO,eAAe,MAC/C,OAAO,YAAY,EAAE,GACrB,OAAO,UAAU,mBAAmB,CACtC;AAEA,MAAM,sBACJ,YACA,iBACA,WACA,qBACG;CACH,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,SAAS,KAAK,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,gBAAgB,GACxF,OAAO,uBAAuB,KAAK,EAAE,QAAQ,YAAY,CAAC;CAC5D,MAAM,UAAU,OAAO,QAAQ,UAAU;CAEzC,IAAI,QAAQ,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAC7D,OAAO,uBAAuB,KAAK,EAAE,QAAQ,aAAa,CAAC;CAC7D,IAAI,oBAAoB,KAAA,KAAa,CAAC,OAAO,OAAO,YAAY,eAAe,GAC7E,OAAO,uBAAuB,KAAK,EAAE,QAAQ,mBAAmB,CAAC;CAMnE,IAJmB,QAAQ,SAAS,CAAC,KAAK,cACxC,UAAU,WAAW,CAAC,SAAS,aAAa,GAAG,UAAU,GAAG,KAAK,IAAI,CAAC,CAG3D,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,GACzD,OAAO,uBAAuB,KAAK,EAAE,QAAQ,YAAY,CAAC;AAG9D;;AAGA,MAAM,QASJ,SACA,WACG;CACH,MAAM,aAAa,EAAE,GAAG,QAAQ,WAAW;CAC3C,MAAM,kBAAkB,QAAQ;CAEhC,MAAM,YAAa,QAAQ,aAAa;CACxC,MAAM,mBAAoB,QAAQ,oBAAoB,GAAG,UAAU;CACnE,MAAM,UAAU,mBAAmB,YAAY,iBAAiB,WAAW,gBAAgB;CAE3F,IAAI,YAAY,KAAA,GAAW,MAAM;CACjC,MAAM,WAAW,kBAAkB,kBAAkB,QAAQ,MAAM;CAEnE,MAAM,UAAU,OAAO,YACrB,OAAO,QAAQ,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,cAAc,CAClD,KACA,UAAU,WACN,SAAS,KAAK;EACZ,QAAQ,QAAQ;EAChB,WAAW,SAAS,aAAa,GAAG,UAAU,GAAG;EACjD;EACA;CACF,CAAC,IACD,EAAE,SAAS,CACjB,CAAC,CAEH;CAEA,MAAM,WAAW,OAAO,YACtB,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO,QAAQ,CAAC,CACvE;CAMA,MAAM,WAAY,UAChBA,OAAa,WAAW,EAAE,QAAQ,QAAQ,OAAO,CAAC;CAEpD,MAAM,SAAS,OAAO,IAAI,aAAa;EACrC,MAAM,QAAQ,OAAO,MAAM,UAAU,eAAe;EACpD,MAAM,aAAa,OAAO,eAAe,QAAQ;EAEjD,MAAM,MAAM;GAAE,GAAG,MAAM;GAAK,GAAG;EAAW;EAE1C,MAAM,UAAU,OAAO,cAKrB,YAAY,MAAM,YAAY,iBAAiB,SAAS,OAAO;EAEjE,OAAO,OAAO,OAAO;GAAE,GAAG;GAAK,GAAG;EAAQ,CAAC;CAE7C,CAAC;CAED,MAAM,aAAa,OAAO,OAAiB,QAAQ,CAAC,CAAC,MAClD,aAAa,SAAS,eAAe,IACxC;CAgCA,MAAM,OA7BJ,QAAQ,aAAa,KAAA,IACjB,SACA,CAAC,aACC,sBAAsB,QAAQ,gBAAgB,UAAU,QAAQ,QAAQ,CAAC,IACzE,sBACE,QACA,SACG,gBAAgB,CAAC,CACjB,KACC,MAAM,aAAa,gBAAgB,UAAU,QAAQ,QAAQ,CAAC,GAC9D,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACJ;CAwBR,OAAO,OAAO,OAAO;EACnB,QAAQ,QAAQ;EAChB;EACA;EACA;EACA,YAAY,OAAO,OAAO,OAAO;EACjC;CACF,CAAC;AACH;AAQA,MAAM,iBAGF,IACA,YACA,WACG;CACH,MAAM,OAAO,QAAQ,QAAiB,CAAC,CAAC,EAAE;CAC1C,MAAM,QAAQ,MAAM,OAAO,MAAM,MAAM;CAEvC,OAAO,OAAO,OAAO,MAAM,YAAY,EAAE,MAAM,CAAC;AAClD;;AAGF,MAAM,eAUJ,IACA,SACA,aACG;CACH,IAAI,CAAC,OAAO,GAAG,OAAO,cAAc,CAAC,CAAC,EAAE,GAAG,MAAM,uBAAuB,KAAK,EAAE,QAAQ,KAAK,CAAC;CAE7F,MAAM,aAAa,KACjB;EACE,GAAG;EACH,WAAW,QAAQ,aAAa;CAClC,GACA,QACF;CAEA,OAAO,QAAyC,CAAC,CAAC,IAAI,YAAY,WAAW,IAAI;AACnF;AAkDA,SAAgB,KACd,YACA,SAQS;CACT,IAAI,OAAO,eAAe,UACxB,OAAO,YACL,WAAW,WACX;EACE,GAAG;EACH,WAAW,WAAW;EACtB,kBAAkB,GAAG,WAAW,UAAU;EAC1C,QAAQ,WAAW;CACrB,GACA,UACF;CAEF,IAAI,QAAQ,WAAW,KAAA,GAAW,MAAM,uBAAuB,KAAK,EAAE,QAAQ,SAAS,CAAC;CACxF,MAAM,YAAY,QAAQ,aAAa;CAEvC,OAAO,YAAY,YAAY;EAC7B,GAAG;EACH;EACA,kBAAkB,QAAQ,oBAAoB,GAAG,UAAU;EAC3D,QAAQ,QAAQ;CAClB,CAAC;AACH;;AAGA,MAAa,iBAWT,IACA,YACG;CACH,IAAI,CAAC,OAAO,GAAG,OAAO,cAAc,CAAC,CAAC,EAAE,GAAG,MAAM,uBAAuB,KAAK,EAAE,QAAQ,KAAK,CAAC;CAE7F,MAAM,aAAa,KAAyD;EAC1E,GAAG;EACH,WAAW,QAAQ,aAAa;CAClC,CAA+E;CAE/E,OAAO,QAAc,CAAC,CAAC,IAAI,YAAY,WAAW,IAAI;AACxD"}

package/dist/auth/AuthConfigurationError.d.mts

@@ -0,0 +1,10 @@
+import { Schema } from "effect";
+//#region src/auth/AuthConfigurationError.d.ts
+declare const AuthConfigurationError_base: Schema.Class<AuthConfigurationError, Schema.TaggedStruct<"AuthConfigurationError", {
+  readonly reason: Schema.Literals<readonly ["id", "namespace", "strategies", "default-strategy", "method"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Invalid auth composition, separate from an authentication failure. */
+declare class AuthConfigurationError extends AuthConfigurationError_base {}
+//#endregion
+export { AuthConfigurationError };
+//# sourceMappingURL=AuthConfigurationError.d.mts.map

package/dist/auth/AuthConfigurationError.mjs

@@ -0,0 +1,14 @@
+import { Schema } from "effect";
+//#region src/auth/AuthConfigurationError.ts
+/** Invalid auth composition, separate from an authentication failure. */
+var AuthConfigurationError = class extends Schema.TaggedError()("AuthConfigurationError", { reason: Schema.Literals([
+	"id",
+	"namespace",
+	"strategies",
+	"default-strategy",
+	"method"
+]) }) {};
+//#endregion
+export { AuthConfigurationError };
+
+//# sourceMappingURL=AuthConfigurationError.mjs.map

package/dist/auth/AuthConfigurationError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthConfigurationError.mjs","names":[],"sources":["../../src/auth/AuthConfigurationError.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n/** Invalid auth composition, separate from an authentication failure. */\nexport class AuthConfigurationError extends Schema.TaggedError<AuthConfigurationError>()(\n  \"AuthConfigurationError\",\n  {\n    reason: Schema.Literals([\"id\", \"namespace\", \"strategies\", \"default-strategy\", \"method\"]),\n  },\n) {}\n"],"mappings":";;;AAGA,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,EACE,QAAQ,OAAO,SAAS;CAAC;CAAM;CAAa;CAAc;CAAoB;AAAQ,CAAC,EACzF,CACF,CAAC,CAAC,CAAC"}

package/dist/auth/AuthRequest.d.mts

@@ -0,0 +1,21 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { AuthResolvedCall } from "../operations/credentials.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { SessionApiError } from "./session.mjs";
+import { Context, Effect } from "effect";
+//#region src/auth/AuthRequest.d.ts
+declare const AuthRequest_base: Context.ServiceClass<AuthRequest, "effect-auth/AuthRequest", AuthResolvedCall & {
+  /** Set by the trusted named action declaration while its implementation executes. */
+  readonly actionMode?: "query" | "mutation";
+  /** Host admission runs before mutation side effects; absent for trusted local callers. */
+  readonly beforeMutation?: Effect.Effect<void, HookDenied>;
+  /** HTTP adapters resolve caller authority only when an authentication method needs it. */
+  readonly resolveInvocation?: Effect.Effect<AuthInvocation, SessionApiError>;
+}>;
+/** Supplied by the host for one request or native workflow, never a shared auth Layer.
+ * @effect-leakable-service
+ */
+declare class AuthRequest extends AuthRequest_base {}
+//#endregion
+export { AuthRequest };
+//# sourceMappingURL=AuthRequest.d.mts.map

package/dist/auth/AuthRequest.mjs

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+//#region src/auth/AuthRequest.ts
+/** Supplied by the host for one request or native workflow, never a shared auth Layer.
+* @effect-leakable-service
+*/
+var AuthRequest = class extends Context.Service()("effect-auth/AuthRequest") {};
+//#endregion
+export { AuthRequest };
+
+//# sourceMappingURL=AuthRequest.mjs.map

package/dist/auth/AuthRequest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRequest.mjs","names":[],"sources":["../../src/auth/AuthRequest.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { HookDenied } from \"../hooks/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthResolvedCall } from \"../operations/credentials\";\nimport type { SessionApiError } from \"./session\";\n\n/** Supplied by the host for one request or native workflow, never a shared auth Layer.\n * @effect-leakable-service\n */\nexport class AuthRequest extends Context.Service<\n  AuthRequest,\n  AuthResolvedCall & {\n    /** Set by the trusted named action declaration while its implementation executes. */\n    readonly actionMode?: \"query\" | \"mutation\";\n    /** Host admission runs before mutation side effects; absent for trusted local callers. */\n    readonly beforeMutation?: Effect.Effect<void, HookDenied>;\n    /** HTTP adapters resolve caller authority only when an authentication method needs it. */\n    readonly resolveInvocation?: Effect.Effect<AuthInvocation, SessionApiError>;\n  }\n>()(\"effect-auth/AuthRequest\") {}\n"],"mappings":";;;;;AAUA,IAAa,cAAb,cAAiC,QAAQ,QAUvC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC"}

package/dist/auth/AuthStrategy.d.mts

@@ -0,0 +1,23 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { SessionApiError } from "./session.mjs";
+import { AuthRequest } from "./AuthRequest.mjs";
+import { AuthConfigurationError } from "./AuthConfigurationError.mjs";
+import { Effect, Layer, Scope } from "effect";
+//#region src/auth/AuthStrategy.d.ts
+/** The same validated invocations used by local and transport callers. */
+type AuthMethod = (invocation: AuthInvocation, input: never) => Effect.Effect<unknown, unknown, unknown>;
+type RequestCollectorServices = AuthCredentialCommandCollector | AuthRevealCommandCollectorService;
+type BoundMethod<M extends AuthMethod, Provided> = (...args: [Parameters<M>[1]] extends [void] ? [input?: Parameters<M>[1]] : [input: Parameters<M>[1]]) => Effect.Effect<Effect.Success<ReturnType<M>>, Effect.Error<ReturnType<M>> | SessionApiError, AuthRequest | Exclude<Effect.Services<ReturnType<M>>, Exclude<Provided | RequestCollectorServices, AuthRequest | Scope.Scope>>>;
+/** Pair a selected, named API with its implementing Layer, preserving every method's types. */
+declare const makeAuthStrategy: <const Methods extends Readonly<Record<string, AuthMethod>>, Provided, E, R, const Completion extends boolean = false>(methods: Methods & {
+  readonly then?: never;
+} & Record<Exclude<keyof Methods, string>, never>, layer: Layer.Layer<Provided, E, R>, options?: {
+  readonly completion: Completion;
+}) => Readonly<{
+  completion: false | NoInfer<Completion>;
+  make: Effect.Effect<{ readonly [K in keyof Methods]: BoundMethod<Methods[K], Provided>; }, E | AuthConfigurationError, R | Layer.CurrentMemoMap | Scope.Scope>;
+}>;
+//#endregion
+export { AuthMethod, makeAuthStrategy };
+//# sourceMappingURL=AuthStrategy.d.mts.map

package/dist/auth/AuthStrategy.mjs

@@ -0,0 +1,33 @@
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { AuthConfigurationError } from "./AuthConfigurationError.mjs";
+import { AuthRequest } from "./AuthRequest.mjs";
+import { Context, Effect, Layer, Scope } from "effect";
+//#region src/auth/AuthStrategy.ts
+const unsupportedRevealCollector = Object.freeze({
+	supportedKinds: Object.freeze([]),
+	accept: () => Effect.void
+});
+/** Pair a selected, named API with its implementing Layer, preserving every method's types. */
+const makeAuthStrategy = (methods, layer, options) => {
+	const entries = Object.entries(methods);
+	return Object.freeze({
+		completion: options?.completion ?? false,
+		make: Effect.gen(function* () {
+			if (entries.some(([name]) => name === "then")) return yield* AuthConfigurationError.make({ reason: "method" });
+			const built = yield* Layer.buildWithMemoMap(layer, yield* Layer.CurrentMemoMap, yield* Effect.scope);
+			const services = Context.omit(AuthRequest, Scope.Scope, AuthCredentialCommandCollector, AuthRevealCommandCollectorService)(built);
+			const bound = Object.fromEntries(entries.map(([name, invoke]) => [name, Effect.fn(`Auth.${name}`)(function* (input) {
+				const request = yield* AuthRequest;
+				if (request.actionMode !== "query" && request.beforeMutation !== void 0) yield* request.beforeMutation;
+				const invocation = yield* request.resolveInvocation ?? Effect.succeed(request.invocation);
+				const revealCollector = request.revealCommandCollector ?? unsupportedRevealCollector;
+				return yield* invoke(invocation, input).pipe(Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink), Effect.provideService(AuthRevealCommandCollectorService, revealCollector), Effect.provide(services));
+			})]));
+			return Object.freeze(bound);
+		})
+	});
+};
+//#endregion
+export { makeAuthStrategy };
+
+//# sourceMappingURL=AuthStrategy.mjs.map

package/dist/auth/AuthStrategy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStrategy.mjs","names":[],"sources":["../../src/auth/AuthStrategy.ts"],"sourcesContent":["import { Context, Effect, Layer, Scope } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport {\n  AuthCredentialCommandCollector,\n  AuthRevealCommandCollectorService,\n} from \"../operations/credentials\";\nimport { AuthConfigurationError } from \"./AuthConfigurationError\";\nimport { AuthRequest } from \"./AuthRequest\";\nimport type { SessionApiError } from \"./session\";\n\n/** The same validated invocations used by local and transport callers. */\nexport type AuthMethod = (\n  invocation: AuthInvocation,\n  input: never,\n) => Effect.Effect<unknown, unknown, unknown>;\n\ntype RequestCollectorServices = AuthCredentialCommandCollector | AuthRevealCommandCollectorService;\n\nconst unsupportedRevealCollector = Object.freeze({\n  supportedKinds: Object.freeze([]),\n  accept: () => Effect.void,\n});\n\ntype BoundMethod<M extends AuthMethod, Provided> = (\n  ...args: [Parameters<M>[1]] extends [void]\n    ? [input?: Parameters<M>[1]]\n    : [input: Parameters<M>[1]]\n) => Effect.Effect<\n  Effect.Success<ReturnType<M>>,\n  Effect.Error<ReturnType<M>> | SessionApiError,\n  | AuthRequest\n  | Exclude<\n      Effect.Services<ReturnType<M>>,\n      Exclude<Provided | RequestCollectorServices, AuthRequest | Scope.Scope>\n    >\n>;\n\n/** Pair a selected, named API with its implementing Layer, preserving every method's types. */\nexport const makeAuthStrategy = <\n  const Methods extends Readonly<Record<string, AuthMethod>>,\n  Provided,\n  E,\n  R,\n  const Completion extends boolean = false,\n>(\n  methods: Methods & { readonly then?: never } & Record<Exclude<keyof Methods, string>, never>,\n  layer: Layer.Layer<Provided, E, R>,\n  options?: { readonly completion: Completion },\n) => {\n  type Result = ReturnType<Methods[keyof Methods]>;\n\n  // A heterogeneous method table loses its key correlation during iteration.\n  const entries = Object.entries(methods) as Array<\n    [\n      string,\n      (\n        invocation: AuthInvocation,\n        input: never,\n      ) => Effect.Effect<Effect.Success<Result>, Effect.Error<Result>, Effect.Services<Result>>,\n    ]\n  >;\n\n  return Object.freeze({\n    completion: (options?.completion ?? false) as false | NoInfer<Completion>,\n    make: Effect.gen(function* () {\n      if (entries.some(([name]) => name === \"then\"))\n        return yield* AuthConfigurationError.make({ reason: \"method\" });\n\n      const built = yield* Layer.buildWithMemoMap(\n        layer,\n        yield* Layer.CurrentMemoMap,\n        yield* Effect.scope,\n      );\n\n      const services = Context.omit(\n        AuthRequest,\n        Scope.Scope,\n        AuthCredentialCommandCollector,\n        AuthRevealCommandCollectorService,\n      )(built);\n\n      const bound = Object.fromEntries(\n        entries.map(([name, invoke]) => [\n          name,\n          Effect.fn(`Auth.${name}`)(function* (input: never) {\n            // Resolve before providing the shared handler context: callers never get captured.\n            const request = yield* AuthRequest;\n\n            // Raw strategy methods are conservatively mutations. Only a trusted\n            // named query declaration can admit a read without mutation policy.\n            if (request.actionMode !== \"query\" && request.beforeMutation !== undefined)\n              yield* request.beforeMutation;\n\n            const invocation = yield* (\n              request.resolveInvocation ?? Effect.succeed(request.invocation)\n            );\n\n            const revealCollector = request.revealCommandCollector ?? unsupportedRevealCollector;\n\n            return yield* invoke(invocation, input).pipe(\n              Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink),\n              Effect.provideService(AuthRevealCommandCollectorService, revealCollector),\n              Effect.provide(services),\n            );\n          }),\n        ]),\n      );\n\n      // Object.entries loses the key/signature correlation; each method above retains its invoke.\n      return Object.freeze(bound) as {\n        readonly [K in keyof Methods]: BoundMethod<Methods[K], Provided>;\n      };\n    }),\n  });\n};\n"],"mappings":";;;;;AAmBA,MAAM,6BAA6B,OAAO,OAAO;CAC/C,gBAAgB,OAAO,OAAO,CAAC,CAAC;CAChC,cAAc,OAAO;AACvB,CAAC;;AAiBD,MAAa,oBAOX,SACA,OACA,YACG;CAIH,MAAM,UAAU,OAAO,QAAQ,OAAO;CAUtC,OAAO,OAAO,OAAO;EACnB,YAAa,SAAS,cAAc;EACpC,MAAM,OAAO,IAAI,aAAa;GAC5B,IAAI,QAAQ,MAAM,CAAC,UAAU,SAAS,MAAM,GAC1C,OAAO,OAAO,uBAAuB,KAAK,EAAE,QAAQ,SAAS,CAAC;GAEhE,MAAM,QAAQ,OAAO,MAAM,iBACzB,OACA,OAAO,MAAM,gBACb,OAAO,OAAO,KAChB;GAEA,MAAM,WAAW,QAAQ,KACvB,aACA,MAAM,OACN,gCACA,iCACF,CAAC,CAAC,KAAK;GAEP,MAAM,QAAQ,OAAO,YACnB,QAAQ,KAAK,CAAC,MAAM,YAAY,CAC9B,MACA,OAAO,GAAG,QAAQ,MAAM,CAAC,CAAC,WAAW,OAAc;IAEjD,MAAM,UAAU,OAAO;IAIvB,IAAI,QAAQ,eAAe,WAAW,QAAQ,mBAAmB,KAAA,GAC/D,OAAO,QAAQ;IAEjB,MAAM,aAAa,OACjB,QAAQ,qBAAqB,OAAO,QAAQ,QAAQ,UAAU;IAGhE,MAAM,kBAAkB,QAAQ,0BAA0B;IAE1D,OAAO,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC,KACtC,OAAO,eAAe,gCAAgC,QAAQ,qBAAqB,GACnF,OAAO,eAAe,mCAAmC,eAAe,GACxE,OAAO,QAAQ,QAAQ,CACzB;GACF,CAAC,CACH,CAAC,CACH;GAGA,OAAO,OAAO,OAAO,KAAK;EAG5B,CAAC;CACH,CAAC;AACH"}

package/dist/auth/ConsumeDecision.d.mts

@@ -0,0 +1,11 @@
+//#region src/auth/ConsumeDecision.d.ts
+/** Rejection stays a value until the physical owner commits its accounting. */
+type ConsumeDecision<A> = {
+  readonly _tag: "accepted";
+  readonly value: A;
+} | {
+  readonly _tag: "rejected";
+};
+//#endregion
+export { ConsumeDecision };
+//# sourceMappingURL=ConsumeDecision.d.mts.map

package/dist/auth/actions.d.mts

@@ -0,0 +1,18 @@
+import { AuthRequest } from "./AuthRequest.mjs";
+import "./AuthConfigurationError.mjs";
+import { ActionError, ActionInput, ActionSuccess, AnyAuthAction, AuthActions } from "../operations/actions.mjs";
+import { Effect } from "effect";
+//#region src/auth/actions.d.ts
+type Method = (...input: never[]) => Effect.Effect<unknown, unknown, unknown>;
+type Methods = Readonly<Record<string, Method>>;
+type Implementations = Readonly<Record<string, Methods>>;
+type Lookup<Table, Key> = Table extends unknown ? string extends Key ? Table[keyof Table] : Key extends keyof Table ? Table[Key] : never : never;
+type Selection<Action extends AnyAuthAction, Default> = Exclude<Action["strategy"], undefined> | (undefined extends Action["strategy"] ? Default : never);
+type Implementation<Action extends AnyAuthAction, Sessions extends Methods, Strategies extends Implementations, Default> = Lookup<Sessions, Action["method"]> | Lookup<Lookup<Strategies, Selection<Action, Default>>, Action["method"]>;
+type Requirements<Method> = Method extends ((...args: never[]) => Effect.Effect<unknown, unknown, infer R>) ? R : never;
+type Codecs<Action extends AnyAuthAction> = Action["route"]["operation"]["rpc"]["payloadSchema" | "successSchema" | "errorSchema"];
+type SchemaServices<Action extends AnyAuthAction> = Codecs<Action>["DecodingServices" | "EncodingServices"];
+type LocalActionApi<Actions extends AuthActions, Sessions extends Methods, Strategies extends Implementations, Default> = { readonly [Name in keyof Actions]: (...args: [ActionInput<Actions[Name]>] extends [void] ? [input?: ActionInput<Actions[Name]>] : [input: ActionInput<Actions[Name]>]) => Effect.Effect<ActionSuccess<Actions[Name]>, ActionError<Actions[Name]>, AuthRequest | SchemaServices<Actions[Name]> | Requirements<Implementation<Actions[Name], Sessions, Strategies, Default>>>; };
+//#endregion
+export { LocalActionApi };
+//# sourceMappingURL=actions.d.mts.map

package/dist/auth/actions.mjs

@@ -0,0 +1,70 @@
+import { AuthCredentialCommandCollector, AuthRevealCommandCollectorService } from "../operations/credentials.mjs";
+import { InvalidOperationInput } from "../operations/errors.mjs";
+import { guest } from "../operations/context.mjs";
+import { AuthConfigurationError } from "./AuthConfigurationError.mjs";
+import { AuthRequest } from "./AuthRequest.mjs";
+import { Effect, Predicate, Redacted, Schema } from "effect";
+//#region src/auth/actions.ts
+/** Bind shared schemas to local capabilities. The chosen implementation is fixed
+* at construction; credentials and all execution services are resolved per call. */
+const makeActionApi = Effect.fn("Auth.makeActionApi")(function* (sessions, strategies, defaultStrategy, actions) {
+	const entries = [];
+	for (const [name, action] of Object.entries(actions)) {
+		const selected = action.strategy ?? defaultStrategy;
+		const methods = Object.hasOwn(sessions, action.method) ? sessions : typeof selected === "string" && Object.hasOwn(strategies, selected) ? strategies[selected] : void 0;
+		if (methods === void 0 || !Object.hasOwn(methods, action.method)) return yield* AuthConfigurationError.make({ reason: "method" });
+		const method = methods[action.method];
+		if (!Predicate.isFunction(method)) return yield* AuthConfigurationError.make({ reason: "method" });
+		const run = Effect.fn(`Auth.action.${name}`)(function* (input) {
+			const request = yield* AuthRequest;
+			const encoded = yield* Schema.encodeEffect(action.route.operation.rpc.payloadSchema)(input).pipe(Effect.mapError(() => InvalidOperationInput.make({})));
+			const fields = Object.entries(action.requestFields);
+			if (fields.length > 0 && !Predicate.isObject(encoded)) return yield* InvalidOperationInput.make({});
+			const payload = fields.length === 0 ? encoded : { ...encoded };
+			for (const [field, slot] of fields) {
+				const credential = request.credentials[slot];
+				if (credential === void 0) return yield* InvalidOperationInput.make({});
+				payload[field] = Redacted.value(credential);
+			}
+			const credentialCommands = [];
+			const revealCommands = [];
+			const sink = (commands) => Effect.sync(() => {
+				credentialCommands.push(...commands);
+			});
+			const collector = {
+				supportedKinds: action.route.reveals,
+				accept: (commands) => Effect.sync(() => {
+					revealCommands.push(...commands);
+				})
+			};
+			const value = yield* method(payload).pipe(Effect.provideService(AuthRequest, {
+				...request,
+				actionMode: action.mode,
+				credentialCommandSink: sink,
+				revealCommandCollector: collector
+			}), Effect.provideService(AuthCredentialCommandCollector, sink), Effect.provideService(AuthRevealCommandCollectorService, collector));
+			if (!action.route.operation.credentials && credentialCommands.length > 0 || action.route.reveals.length === 0 && revealCommands.length > 0) return yield* Effect.die(AuthConfigurationError.make({ reason: "method" }));
+			return {
+				value,
+				credentialCommands,
+				revealCommands
+			};
+		});
+		const operation = action.route.operation;
+		const layer = operation.credentials || operation.reveals.length > 0 ? operation.privateHandlerLayer(run) : operation.handlerLayer((input) => run(input).pipe(Effect.map((result) => result.value)));
+		entries.push([name, Effect.fn(`Auth.${name}`)(function* (input) {
+			const request = yield* AuthRequest;
+			if (action.mode === "mutation" && request.beforeMutation !== void 0) yield* request.beforeMutation;
+			if (Predicate.isObject(input) && Object.keys(action.requestFields).some((field) => Object.hasOwn(input, field))) return yield* InvalidOperationInput.make({});
+			return yield* operation.invokeUnknown(guest, input).pipe(Effect.provide(layer, { local: true }), Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink), Effect.provideService(AuthRevealCommandCollectorService, request.revealCommandCollector ?? {
+				supportedKinds: [],
+				accept: () => Effect.void
+			}));
+		})]);
+	}
+	return Object.freeze(Object.fromEntries(entries));
+});
+//#endregion
+export { makeActionApi };
+
+//# sourceMappingURL=actions.mjs.map

package/dist/auth/actions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.mjs","names":[],"sources":["../../src/auth/actions.ts"],"sourcesContent":["import { Effect, Predicate, Redacted, Schema } from \"effect\";\n\nimport type {\n  ActionError,\n  ActionInput,\n  ActionSuccess,\n  AnyAuthAction,\n  AuthActions,\n} from \"../operations/actions\";\nimport { guest } from \"../operations/context\";\nimport {\n  type AuthCredentialCommand,\n  AuthCredentialCommandCollector,\n  AuthRevealCommandCollectorService,\n} from \"../operations/credentials\";\nimport { InvalidOperationInput } from \"../operations/errors\";\nimport type { makeOperation } from \"../operations/operation\";\nimport type { AuthRevealCommand } from \"../operations/reveals\";\nimport { AuthConfigurationError } from \"./AuthConfigurationError\";\nimport { AuthRequest } from \"./AuthRequest\";\n\ntype Method = (...input: never[]) => Effect.Effect<unknown, unknown, unknown>;\ntype Methods = Readonly<Record<string, Method>>;\ntype Implementations = Readonly<Record<string, Methods>>;\ntype Lookup<Table, Key> = Table extends unknown\n  ? string extends Key\n    ? Table[keyof Table]\n    : Key extends keyof Table\n      ? Table[Key]\n      : never\n  : never;\ntype Selection<Action extends AnyAuthAction, Default> =\n  | Exclude<Action[\"strategy\"], undefined>\n  | (undefined extends Action[\"strategy\"] ? Default : never);\ntype Implementation<\n  Action extends AnyAuthAction,\n  Sessions extends Methods,\n  Strategies extends Implementations,\n  Default,\n> =\n  | Lookup<Sessions, Action[\"method\"]>\n  | Lookup<Lookup<Strategies, Selection<Action, Default>>, Action[\"method\"]>;\ntype Requirements<Method> = Method extends (\n  ...args: never[]\n) => Effect.Effect<unknown, unknown, infer R>\n  ? R\n  : never;\ntype Codecs<Action extends AnyAuthAction> = Action[\"route\"][\"operation\"][\"rpc\"][\n  | \"payloadSchema\"\n  | \"successSchema\"\n  | \"errorSchema\"];\ntype SchemaServices<Action extends AnyAuthAction> = Codecs<Action>[\n  | \"DecodingServices\"\n  | \"EncodingServices\"];\n\nexport type LocalActionApi<\n  Actions extends AuthActions,\n  Sessions extends Methods,\n  Strategies extends Implementations,\n  Default,\n> = {\n  readonly [Name in keyof Actions]: (\n    ...args: [ActionInput<Actions[Name]>] extends [void]\n      ? [input?: ActionInput<Actions[Name]>]\n      : [input: ActionInput<Actions[Name]>]\n  ) => Effect.Effect<\n    ActionSuccess<Actions[Name]>,\n    ActionError<Actions[Name]>,\n    | AuthRequest\n    | SchemaServices<Actions[Name]>\n    | Requirements<Implementation<Actions[Name], Sessions, Strategies, Default>>\n  >;\n};\n\n/** Bind shared schemas to local capabilities. The chosen implementation is fixed\n * at construction; credentials and all execution services are resolved per call. */\nexport const makeActionApi = Effect.fn(\"Auth.makeActionApi\")(function* <\n  Sessions extends Methods,\n  Strategies extends Implementations,\n  Default extends keyof Strategies | undefined,\n  Actions extends AuthActions,\n>(\n  sessions: Sessions,\n  strategies: Strategies,\n  defaultStrategy: Default | undefined,\n  actions: Actions,\n) {\n  type RawMethod = Sessions[keyof Sessions] | Strategies[keyof Strategies][string];\n  type R = Requirements<RawMethod>;\n\n  const entries: Array<\n    readonly [string, (input: unknown) => Effect.Effect<unknown, unknown, R | AuthRequest>]\n  > = [];\n\n  for (const [name, action] of Object.entries(actions)) {\n    const selected = action.strategy ?? defaultStrategy;\n\n    const methods = Object.hasOwn(sessions, action.method)\n      ? sessions\n      : typeof selected === \"string\" && Object.hasOwn(strategies, selected)\n        ? strategies[selected]\n        : undefined;\n\n    if (methods === undefined || !Object.hasOwn(methods, action.method))\n      return yield* AuthConfigurationError.make({ reason: \"method\" });\n\n    // Indexed iteration hides the paired input/result types, but keeps the union\n    // of implementation requirements. The shared operation validates both sides.\n    const method = methods[action.method] as (input: unknown) => Effect.Effect<unknown, unknown, R>;\n\n    if (!Predicate.isFunction(method))\n      return yield* AuthConfigurationError.make({ reason: \"method\" });\n\n    const run = Effect.fn(`Auth.action.${name}`)(function* (input: unknown) {\n      const request = yield* AuthRequest;\n\n      // The action has decoded and validated the complete public codec. Existing\n      // strategy methods accept encoded inputs at their own operation boundary.\n      const encoded = yield* Schema.encodeEffect(action.route.operation.rpc.payloadSchema)(\n        input,\n      ).pipe(Effect.mapError(() => InvalidOperationInput.make({})));\n\n      const fields = Object.entries(action.requestFields);\n\n      if (fields.length > 0 && !Predicate.isObject(encoded))\n        return yield* InvalidOperationInput.make({});\n\n      const payload = fields.length === 0 ? encoded : { ...(encoded as Record<string, unknown>) };\n\n      for (const [field, slot] of fields) {\n        const credential = request.credentials[slot];\n\n        if (credential === undefined) return yield* InvalidOperationInput.make({});\n        (payload as Record<string, unknown>)[field] = Redacted.value(credential);\n      }\n\n      const credentialCommands: AuthCredentialCommand[] = [];\n      const revealCommands: AuthRevealCommand[] = [];\n\n      const sink = (commands: ReadonlyArray<AuthCredentialCommand>) =>\n        Effect.sync(() => {\n          credentialCommands.push(...commands);\n        });\n\n      const collector = {\n        supportedKinds: action.route.reveals,\n        accept: (commands: ReadonlyArray<AuthRevealCommand>) =>\n          Effect.sync(() => {\n            revealCommands.push(...commands);\n          }),\n      };\n\n      const value = yield* method(payload).pipe(\n        Effect.provideService(AuthRequest, {\n          ...request,\n          actionMode: action.mode,\n          credentialCommandSink: sink,\n          revealCommandCollector: collector,\n        }),\n        Effect.provideService(AuthCredentialCommandCollector, sink),\n        Effect.provideService(AuthRevealCommandCollectorService, collector),\n      );\n\n      if (\n        (!action.route.operation.credentials && credentialCommands.length > 0) ||\n        (action.route.reveals.length === 0 && revealCommands.length > 0)\n      )\n        return yield* Effect.die(AuthConfigurationError.make({ reason: \"method\" }));\n\n      return { value, credentialCommands, revealCommands };\n    });\n\n    // Restore the handler constructors hidden by the heterogeneous descriptor.\n    const operation = action.route.operation as unknown as ReturnType<\n      typeof makeOperation<string, Schema.Top, Schema.Top, Schema.Top>\n    >;\n\n    const layer =\n      operation.credentials || operation.reveals.length > 0\n        ? operation.privateHandlerLayer(run)\n        : operation.handlerLayer((input) => run(input).pipe(Effect.map((result) => result.value)));\n\n    entries.push([\n      name,\n      Effect.fn(`Auth.${name}`)(function* (input: unknown) {\n        const request = yield* AuthRequest;\n\n        if (action.mode === \"mutation\" && request.beforeMutation !== undefined)\n          yield* request.beforeMutation;\n\n        // Reject private input before schema projection can remove unknown fields.\n        if (\n          Predicate.isObject(input) &&\n          Object.keys(action.requestFields).some((field) => Object.hasOwn(input, field))\n        )\n          return yield* InvalidOperationInput.make({});\n\n        return yield* operation.invokeUnknown(guest, input).pipe(\n          Effect.provide(layer, { local: true }),\n          Effect.provideService(AuthCredentialCommandCollector, request.credentialCommandSink),\n          Effect.provideService(\n            AuthRevealCommandCollectorService,\n            request.revealCommandCollector ?? {\n              supportedKinds: [],\n              accept: () => Effect.void,\n            },\n          ),\n        );\n      }) as (input: unknown) => Effect.Effect<unknown, unknown, R | AuthRequest>,\n    ]);\n  }\n\n  // Every entry invokes the exact operation and implementation selected above.\n  return Object.freeze(Object.fromEntries(entries)) as LocalActionApi<\n    Actions,\n    Sessions,\n    Strategies,\n    Default\n  >;\n});\n"],"mappings":";;;;;;;;;AA4EA,MAAa,gBAAgB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAM3D,UACA,YACA,iBACA,SACA;CAIA,MAAM,UAEF,CAAC;CAEL,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,GAAG;EACpD,MAAM,WAAW,OAAO,YAAY;EAEpC,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,MAAM,IACjD,WACA,OAAO,aAAa,YAAY,OAAO,OAAO,YAAY,QAAQ,IAChE,WAAW,YACX,KAAA;EAEN,IAAI,YAAY,KAAA,KAAa,CAAC,OAAO,OAAO,SAAS,OAAO,MAAM,GAChE,OAAO,OAAO,uBAAuB,KAAK,EAAE,QAAQ,SAAS,CAAC;EAIhE,MAAM,SAAS,QAAQ,OAAO;EAE9B,IAAI,CAAC,UAAU,WAAW,MAAM,GAC9B,OAAO,OAAO,uBAAuB,KAAK,EAAE,QAAQ,SAAS,CAAC;EAEhE,MAAM,MAAM,OAAO,GAAG,eAAe,MAAM,CAAC,CAAC,WAAW,OAAgB;GACtE,MAAM,UAAU,OAAO;GAIvB,MAAM,UAAU,OAAO,OAAO,aAAa,OAAO,MAAM,UAAU,IAAI,aAAa,CAAC,CAClF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE5D,MAAM,SAAS,OAAO,QAAQ,OAAO,aAAa;GAElD,IAAI,OAAO,SAAS,KAAK,CAAC,UAAU,SAAS,OAAO,GAClD,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;GAE7C,MAAM,UAAU,OAAO,WAAW,IAAI,UAAU,EAAE,GAAI,QAAoC;GAE1F,KAAK,MAAM,CAAC,OAAO,SAAS,QAAQ;IAClC,MAAM,aAAa,QAAQ,YAAY;IAEvC,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;IACzE,QAAqC,SAAS,SAAS,MAAM,UAAU;GACzE;GAEA,MAAM,qBAA8C,CAAC;GACrD,MAAM,iBAAsC,CAAC;GAE7C,MAAM,QAAQ,aACZ,OAAO,WAAW;IAChB,mBAAmB,KAAK,GAAG,QAAQ;GACrC,CAAC;GAEH,MAAM,YAAY;IAChB,gBAAgB,OAAO,MAAM;IAC7B,SAAS,aACP,OAAO,WAAW;KAChB,eAAe,KAAK,GAAG,QAAQ;IACjC,CAAC;GACL;GAEA,MAAM,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KACnC,OAAO,eAAe,aAAa;IACjC,GAAG;IACH,YAAY,OAAO;IACnB,uBAAuB;IACvB,wBAAwB;GAC1B,CAAC,GACD,OAAO,eAAe,gCAAgC,IAAI,GAC1D,OAAO,eAAe,mCAAmC,SAAS,CACpE;GAEA,IACG,CAAC,OAAO,MAAM,UAAU,eAAe,mBAAmB,SAAS,KACnE,OAAO,MAAM,QAAQ,WAAW,KAAK,eAAe,SAAS,GAE9D,OAAO,OAAO,OAAO,IAAI,uBAAuB,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC;GAE5E,OAAO;IAAE;IAAO;IAAoB;GAAe;EACrD,CAAC;EAGD,MAAM,YAAY,OAAO,MAAM;EAI/B,MAAM,QACJ,UAAU,eAAe,UAAU,QAAQ,SAAS,IAChD,UAAU,oBAAoB,GAAG,IACjC,UAAU,cAAc,UAAU,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC;EAE7F,QAAQ,KAAK,CACX,MACA,OAAO,GAAG,QAAQ,MAAM,CAAC,CAAC,WAAW,OAAgB;GACnD,MAAM,UAAU,OAAO;GAEvB,IAAI,OAAO,SAAS,cAAc,QAAQ,mBAAmB,KAAA,GAC3D,OAAO,QAAQ;GAGjB,IACE,UAAU,SAAS,KAAK,KACxB,OAAO,KAAK,OAAO,aAAa,CAAC,CAAC,MAAM,UAAU,OAAO,OAAO,OAAO,KAAK,CAAC,GAE7E,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;GAE7C,OAAO,OAAO,UAAU,cAAc,OAAO,KAAK,CAAC,CAAC,KAClD,OAAO,QAAQ,OAAO,EAAE,OAAO,KAAK,CAAC,GACrC,OAAO,eAAe,gCAAgC,QAAQ,qBAAqB,GACnF,OAAO,eACL,mCACA,QAAQ,0BAA0B;IAChC,gBAAgB,CAAC;IACjB,cAAc,OAAO;GACvB,CACF,CACF;EACF,CAAC,CACH,CAAC;CACH;CAGA,OAAO,OAAO,OAAO,OAAO,YAAY,OAAO,CAAC;AAMlD,CAAC"}

package/dist/auth/defaults.mjs

@@ -0,0 +1,12 @@
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { SubtleCrypto, layerCryptoWeb } from "../WebCrypto.mjs";
+import { Crypto, Effect, Layer, Option } from "effect";
+//#region src/auth/defaults.ts
+/** Keep explicitly supplied services. Shared Layer values also share their resources. */
+const defaultLayer = (service, fallback) => Layer.unwrap(Effect.map(Effect.serviceOption(service), (current) => Option.isSome(current) ? Layer.succeed(service, current.value) : fallback));
+const cryptoLayer = Layer.mergeAll(defaultLayer(Crypto.Crypto, layerCryptoWeb), defaultLayer(SubtleCrypto, SubtleCrypto.layerWeb));
+const hooksLayer = defaultLayer(LifecycleHooks, LifecycleHooks.empty);
+//#endregion
+export { cryptoLayer, defaultLayer, hooksLayer };
+
+//# sourceMappingURL=defaults.mjs.map

package/dist/auth/defaults.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.mjs","names":[],"sources":["../../src/auth/defaults.ts"],"sourcesContent":["import type { Context } from \"effect\";\nimport { Crypto, Effect, Layer, Option } from \"effect\";\n\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { layerCryptoWeb, SubtleCrypto } from \"../WebCrypto\";\n\n/** Keep explicitly supplied services. Shared Layer values also share their resources. */\nexport const defaultLayer = <I, S, E, R>(\n  service: Context.Key<I, S>,\n  fallback: Layer.Layer<I, E, R>,\n): Layer.Layer<I, E, R> =>\n  Layer.unwrap(\n    Effect.map(Effect.serviceOption(service), (current) =>\n      Option.isSome(current) ? Layer.succeed(service, current.value) : fallback,\n    ),\n  );\n\nexport const cryptoLayer = Layer.mergeAll(\n  defaultLayer(Crypto.Crypto, layerCryptoWeb),\n  defaultLayer(SubtleCrypto, SubtleCrypto.layerWeb),\n);\n\nexport const hooksLayer = defaultLayer(LifecycleHooks, LifecycleHooks.empty);\n"],"mappings":";;;;;AAOA,MAAa,gBACX,SACA,aAEA,MAAM,OACJ,OAAO,IAAI,OAAO,cAAc,OAAO,IAAI,YACzC,OAAO,OAAO,OAAO,IAAI,MAAM,QAAQ,SAAS,QAAQ,KAAK,IAAI,QACnE,CACF;AAEF,MAAa,cAAc,MAAM,SAC/B,aAAa,OAAO,QAAQ,cAAc,GAC1C,aAAa,cAAc,aAAa,QAAQ,CAClD;AAEA,MAAa,aAAa,aAAa,gBAAgB,eAAe,KAAK"}

package/dist/auth/definition.d.mts

@@ -0,0 +1,46 @@
+import { makeSessionModule } from "../sessions/module.mjs";
+import { Effect, HKT, Schema } from "effect";
+//#region src/auth/definition.d.ts
+type ClaimsCodec = Schema.Codec<unknown, unknown, unknown, unknown>;
+type AuthMethod = (...args: never[]) => Effect.Effect<unknown, unknown, unknown>;
+interface BuiltStrategy {
+  /** This method bundle completes authentication through the shared session authority. */
+  readonly completion?: boolean;
+  readonly make: Effect.Effect<Readonly<Record<string, AuthMethod>>, unknown, unknown>;
+}
+/** Static contracts and service keys shared by one auth definition. Implementations come from Layers. */
+interface StrategyBinding<Claims extends ClaimsCodec, Id extends string, SessionId extends string> {
+  readonly claims: Claims;
+  readonly namespace: Id;
+  readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;
+  readonly sessionNamespace: SessionId;
+}
+interface StrategyTypeLambda extends HKT.TypeLambda {
+  readonly type: {
+    readonly strategy: BuiltStrategy;
+  };
+}
+type BindingOf<F extends HKT.TypeLambda> = Extract<F["Target"], {
+  readonly claims: ClaimsCodec;
+  readonly namespace: string;
+  readonly sessionNamespace: string;
+}>;
+interface StrategyDefinition<F extends StrategyTypeLambda, Namespace extends string | undefined = undefined> {
+  readonly _TypeLambda?: F;
+  /** Override only when an existing credential or operation namespace must be retained. */
+  readonly namespace: Namespace;
+  readonly bind: <Claims extends ClaimsCodec, const Id extends string, const SessionId extends string>(binding: StrategyBinding<Claims, Id, SessionId>) => HKT.Kind<F, never, never, never, StrategyBinding<Claims, Id, SessionId>>;
+}
+type StrategySelection = Readonly<Record<string, StrategyDefinition<StrategyTypeLambda, string | undefined> | BuiltStrategy>>;
+type NamespaceOf<S, Root extends string, Key extends string> = S extends {
+  readonly namespace: infer Id extends string | undefined;
+} ? undefined extends Id ? Exclude<Id, undefined> | `${Root}/${Key}` : Id : `${Root}/${Key}`;
+type BoundStrategies<S extends StrategySelection, Claims extends ClaimsCodec, Id extends string, SessionId extends string> = { readonly [K in keyof S]: S[K] extends StrategyDefinition<infer F, string | undefined> ? HKT.Kind<F, never, never, never, StrategyBinding<Claims, NamespaceOf<S[K], Id, Extract<K, string>>, SessionId>> : {
+  readonly strategy: S[K];
+}; };
+type BoundSelection<S> = { readonly [K in keyof S]: S[K] extends {
+  readonly strategy: infer Strategy extends BuiltStrategy;
+} ? Strategy : never; };
+//#endregion
+export { AuthMethod, BindingOf, BoundSelection, BoundStrategies, BuiltStrategy, ClaimsCodec, StrategyBinding, StrategyDefinition, StrategySelection, StrategyTypeLambda };
+//# sourceMappingURL=definition.d.mts.map

package/dist/auth/session.d.mts

@@ -0,0 +1,27 @@
+import { OperationBoundaryError } from "../operations/errors.mjs";
+import "../operations/credentials.mjs";
+import { SessionSignOut } from "../sessions/models.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { SessionError, SessionSignOutUnavailable } from "../sessions/errors.mjs";
+import "../Operations.mjs";
+import { AuthRequest } from "./AuthRequest.mjs";
+import "../sessions/module.mjs";
+import "../Sessions.mjs";
+import { Effect, Redacted, Schema, Scope } from "effect";
+//#region src/auth/session.d.ts
+type SessionApiError = SessionError | HookDenied | OperationBoundaryError;
+/** Session actions share implementations across HTTP, native and local callers. */
+interface SessionApi<Session, R = never> {
+  /** Explicit credential verification; does not read a request or renew credentials. */
+  readonly verifySession: (credential: Redacted.Redacted<string>) => Effect.Effect<Session, SessionApiError>;
+  /** Missing or invalid credentials are anonymous; availability failures remain failures. */
+  readonly getSession: () => Effect.Effect<Session | null, SessionApiError, AuthRequest | R>;
+  readonly requireSession: () => Effect.Effect<Session, SessionApiError, AuthRequest | R>;
+  /** Does not preverify. Local clearing and server invalidation have distinct outcomes. */
+  readonly signOut: () => Effect.Effect<SessionSignOut | SessionSignOutUnavailable, SessionApiError, AuthRequest | R>;
+  /** Explicit renewal; ordinary session reads never rotate credentials. */
+  readonly renewSession: () => Effect.Effect<Session, SessionApiError, AuthRequest | R>;
+}
+//#endregion
+export { SessionApi, SessionApiError };
+//# sourceMappingURL=session.d.mts.map