@yielded/auth 0.1.0-beta.1

package/dist/email/definition.mjs

@@ -0,0 +1,111 @@
+import { snapshotProofConfiguration } from "../proofs/module.mjs";
+import { makeEmailAccountModule, makeEmailSignInModule } from "./module.mjs";
+//#region src/email/definition.ts
+const captureDefine = (mode, _namespace, input) => {
+	return {
+		mode,
+		proof: snapshotProofConfiguration(input)
+	};
+};
+const bindDefine = (binding, captured) => {
+	const { mode, proof } = captured;
+	return makeEmailSignInModule(binding.namespace, {
+		mode,
+		proof,
+		sessions: binding.sessions
+	});
+};
+const define = (mode, namespace, input) => {
+	const captured = captureDefine(mode, namespace, input);
+	const bind = (binding) => bindDefine(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makeCode(options) {
+	return define("code", options.namespace, {
+		...options,
+		secret: {
+			_tag: "NumericCode",
+			digits: options.digits ?? 6
+		}
+	});
+}
+function makeLink(options) {
+	return define("link", options.namespace, {
+		...options,
+		secret: { _tag: "Token" }
+	});
+}
+const captureDefineRegistration = (_namespace, input) => {
+	return { options: snapshotProofConfiguration({
+		...input,
+		secret: {
+			_tag: "NumericCode",
+			digits: input.digits ?? 6
+		}
+	}) };
+};
+const bindDefineRegistration = (binding, captured) => {
+	const { options } = captured;
+	return makeEmailAccountModule(binding.namespace, {
+		sessions: binding.sessions,
+		code: {
+			...options,
+			secret: {
+				_tag: "NumericCode",
+				digits: options.digits ?? 6
+			}
+		}
+	}).registration(options.registration);
+};
+const defineRegistration = (namespace, input) => {
+	const captured = captureDefineRegistration(namespace, input);
+	const bind = (binding) => bindDefineRegistration(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makeRegistration(options) {
+	return defineRegistration(options.namespace, options);
+}
+const captureDefineAddresses = (_namespace, input) => {
+	return { options: snapshotProofConfiguration({
+		...input,
+		addresses: Object.freeze({ ...input.addresses }),
+		secret: {
+			_tag: "NumericCode",
+			digits: input.digits ?? 6
+		}
+	}) };
+};
+const bindDefineAddresses = (binding, captured) => {
+	const { options } = captured;
+	return makeEmailAccountModule(binding.namespace, {
+		sessions: binding.sessions,
+		code: {
+			...options,
+			secret: {
+				_tag: "NumericCode",
+				digits: options.digits ?? 6
+			}
+		}
+	}).addresses(options.addresses);
+};
+const defineAddresses = (namespace, input) => {
+	const captured = captureDefineAddresses(namespace, input);
+	const bind = (binding) => bindDefineAddresses(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makeAddresses(options) {
+	return defineAddresses(options.namespace, options);
+}
+//#endregion
+export { makeAddresses, makeCode, makeLink, makeRegistration };
+
+//# sourceMappingURL=definition.mjs.map

package/dist/email/definition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.mjs","names":[],"sources":["../../src/email/definition.ts"],"sourcesContent":["import type {\n  BindingOf,\n  ClaimsCodec,\n  StrategyBinding,\n  StrategyDefinition,\n  StrategyTypeLambda,\n} from \"../auth/definition\";\nimport type { ProofKeyring } from \"../proofs/crypto\";\nimport { snapshotProofConfiguration } from \"../proofs/module\";\nimport type { ProofPolicy } from \"../proofs/policy\";\nimport type { EmailAddressPolicy } from \"./addresses\";\nimport { makeEmailAccountModule, makeEmailSignInModule } from \"./module\";\n\nexport interface EmailLinkOptions<Namespace extends string | undefined = undefined> {\n  readonly namespace?: Namespace;\n  readonly template: string;\n  readonly policy: ProofPolicy;\n}\n\nexport interface EmailCodeOptions<\n  Namespace extends string | undefined = undefined,\n> extends EmailLinkOptions<Namespace> {\n  readonly keys: ProofKeyring;\n  readonly digits?: 6 | 7 | 8 | 9 | 10;\n}\n\nconst captureDefine = <\n  const Mode extends \"code\" | \"link\",\n  const Namespace extends string | undefined,\n>(\n  mode: Mode,\n  _namespace: Namespace,\n  input: Parameters<typeof makeEmailSignInModule>[1][\"proof\"],\n) => {\n  const proof = snapshotProofConfiguration(input);\n\n  return { mode, proof };\n};\n\nconst bindDefine = <\n  const Mode extends \"code\" | \"link\",\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefine<Mode, Namespace>>,\n) => {\n  const { mode, proof } = captured;\n\n  return makeEmailSignInModule<Id, SessionId, Claims, Mode>(binding.namespace, {\n    mode,\n    proof,\n    sessions: binding.sessions,\n  });\n};\n\nexport interface DefineStrategy<\n  Mode extends \"code\" | \"link\",\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefine<\n      Mode,\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst define = <const Mode extends \"code\" | \"link\", const Namespace extends string | undefined>(\n  mode: Mode,\n  namespace: Namespace,\n  input: Parameters<typeof makeEmailSignInModule>[1][\"proof\"],\n) => {\n  const captured = captureDefine<Mode, Namespace>(mode, namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefine<Mode, Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineStrategy<Mode, Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function makeCode<const Namespace extends string>(\n  options: EmailCodeOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof define<\"code\", Namespace>>;\n\nexport function makeCode<const Namespace extends string | undefined = undefined>(\n  options: EmailCodeOptions<Namespace>,\n): ReturnType<typeof define<\"code\", Namespace | undefined>>;\n\nexport function makeCode<const Namespace extends string | undefined>(\n  options: EmailCodeOptions<Namespace>,\n) {\n  return define(\"code\", options.namespace, {\n    ...options,\n    secret: { _tag: \"NumericCode\", digits: options.digits ?? 6 },\n  });\n}\n\nexport function makeLink<const Namespace extends string>(\n  options: EmailLinkOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof define<\"link\", Namespace>>;\n\nexport function makeLink<const Namespace extends string | undefined = undefined>(\n  options: EmailLinkOptions<Namespace>,\n): ReturnType<typeof define<\"link\", Namespace | undefined>>;\n\nexport function makeLink<const Namespace extends string | undefined>(\n  options: EmailLinkOptions<Namespace>,\n) {\n  return define(\"link\", options.namespace, { ...options, secret: { _tag: \"Token\" } });\n}\n\nexport interface EmailRegistrationOptions<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined = undefined,\n> extends EmailCodeOptions<Namespace> {\n  readonly registration: Registration;\n}\n\nexport interface EmailAddressOptions<\n  Namespace extends string | undefined = undefined,\n> extends EmailCodeOptions<Namespace> {\n  readonly addresses: EmailAddressPolicy;\n}\n\nconst captureDefineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n>(\n  _namespace: Namespace,\n  input: EmailRegistrationOptions<Registration, Namespace>,\n) => {\n  const options = snapshotProofConfiguration({\n    ...input,\n    secret: { _tag: \"NumericCode\" as const, digits: input.digits ?? 6 },\n  });\n\n  return { options };\n};\n\nconst bindDefineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineRegistration<Registration, Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makeEmailAccountModule<Id, SessionId, Claims>(binding.namespace, {\n    sessions: binding.sessions,\n    code: { ...options, secret: { _tag: \"NumericCode\", digits: options.digits ?? 6 } },\n  }).registration(options.registration);\n};\n\nexport interface DefineRegistrationStrategy<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineRegistration<\n      Registration,\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n>(\n  namespace: Namespace,\n  input: EmailRegistrationOptions<Registration, Namespace>,\n) => {\n  const captured = captureDefineRegistration<Registration, Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineRegistration<Registration, Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<\n    DefineRegistrationStrategy<Registration, Namespace>,\n    Namespace\n  > = { namespace, bind };\n\n  return Object.freeze(definition);\n};\n\nexport function makeRegistration<Registration extends ClaimsCodec, const Namespace extends string>(\n  options: EmailRegistrationOptions<Registration, Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineRegistration<Registration, Namespace>>;\n\nexport function makeRegistration<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  options: EmailRegistrationOptions<Registration, Namespace>,\n): ReturnType<typeof defineRegistration<Registration, Namespace | undefined>>;\n\nexport function makeRegistration<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n>(options: EmailRegistrationOptions<Registration, Namespace>) {\n  return defineRegistration(options.namespace, options);\n}\n\nconst captureDefineAddresses = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: EmailAddressOptions<Namespace>,\n) => {\n  const options = snapshotProofConfiguration({\n    ...input,\n    addresses: Object.freeze({ ...input.addresses }),\n    secret: { _tag: \"NumericCode\" as const, digits: input.digits ?? 6 },\n  });\n\n  return { options };\n};\n\nconst bindDefineAddresses = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineAddresses<Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makeEmailAccountModule<Id, SessionId, Claims>(binding.namespace, {\n    sessions: binding.sessions,\n    code: { ...options, secret: { _tag: \"NumericCode\", digits: options.digits ?? 6 } },\n  }).addresses(options.addresses);\n};\n\nexport interface DefineAddressesStrategy<\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineAddresses<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineAddresses = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: EmailAddressOptions<Namespace>,\n) => {\n  const captured = captureDefineAddresses<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineAddresses<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineAddressesStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function makeAddresses<const Namespace extends string>(\n  options: EmailAddressOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineAddresses<Namespace>>;\n\nexport function makeAddresses<const Namespace extends string | undefined = undefined>(\n  options: EmailAddressOptions<Namespace>,\n): ReturnType<typeof defineAddresses<Namespace | undefined>>;\n\nexport function makeAddresses<const Namespace extends string | undefined>(\n  options: EmailAddressOptions<Namespace>,\n) {\n  return defineAddresses(options.namespace, options);\n}\n"],"mappings":";;;AA0BA,MAAM,iBAIJ,MACA,YACA,UACG;CAGH,OAAO;EAAE;EAAM,OAFD,2BAA2B,KAEtB;CAAE;AACvB;AAEA,MAAM,cAOJ,SACA,aACG;CACH,MAAM,EAAE,MAAM,UAAU;CAExB,OAAO,sBAAmD,QAAQ,WAAW;EAC3E;EACA;EACA,UAAU,QAAQ;CACpB,CAAC;AACH;AAiBA,MAAM,UACJ,MACA,WACA,UACG;CACH,MAAM,WAAW,cAA+B,MAAM,WAAW,KAAK;CAEtE,MAAM,QAKJ,YACG,WAAmD,SAAS,QAAQ;CAOzE,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,SACd,SACA;CACA,OAAO,OAAO,QAAQ,QAAQ,WAAW;EACvC,GAAG;EACH,QAAQ;GAAE,MAAM;GAAe,QAAQ,QAAQ,UAAU;EAAE;CAC7D,CAAC;AACH;AAUA,SAAgB,SACd,SACA;CACA,OAAO,OAAO,QAAQ,QAAQ,WAAW;EAAE,GAAG;EAAS,QAAQ,EAAE,MAAM,QAAQ;CAAE,CAAC;AACpF;AAeA,MAAM,6BAIJ,YACA,UACG;CAMH,OAAO,EAAE,SALO,2BAA2B;EACzC,GAAG;EACH,QAAQ;GAAE,MAAM;GAAwB,QAAQ,MAAM,UAAU;EAAE;CACpE,CAEe,EAAE;AACnB;AAEA,MAAM,0BAOJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,uBAA8C,QAAQ,WAAW;EACtE,UAAU,QAAQ;EAClB,MAAM;GAAE,GAAG;GAAS,QAAQ;IAAE,MAAM;IAAe,QAAQ,QAAQ,UAAU;GAAE;EAAE;CACnF,CAAC,CAAC,CAAC,aAAa,QAAQ,YAAY;AACtC;AAiBA,MAAM,sBAIJ,WACA,UACG;CACH,MAAM,WAAW,0BAAmD,WAAW,KAAK;CAEpF,MAAM,QAKJ,YACG,uBAAuE,SAAS,QAAQ;CAO7F,OAAO,OAAO,OAAO;EAFf;EAAW;CAEa,CAAC;AACjC;AAaA,SAAgB,iBAGd,SAA4D;CAC5D,OAAO,mBAAmB,QAAQ,WAAW,OAAO;AACtD;AAEA,MAAM,0BACJ,YACA,UACG;CAOH,OAAO,EAAE,SANO,2BAA2B;EACzC,GAAG;EACH,WAAW,OAAO,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC;EAC/C,QAAQ;GAAE,MAAM;GAAwB,QAAQ,MAAM,UAAU;EAAE;CACpE,CAEe,EAAE;AACnB;AAEA,MAAM,uBAMJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,uBAA8C,QAAQ,WAAW;EACtE,UAAU,QAAQ;EAClB,MAAM;GAAE,GAAG;GAAS,QAAQ;IAAE,MAAM;IAAe,QAAQ,QAAQ,UAAU;GAAE;EAAE;CACnF,CAAC,CAAC,CAAC,UAAU,QAAQ,SAAS;AAChC;AAeA,MAAM,mBACJ,WACA,UACG;CACH,MAAM,WAAW,uBAAkC,WAAW,KAAK;CAEnE,MAAM,QAKJ,YACG,oBAAsD,SAAS,QAAQ;CAO5E,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,cACd,SACA;CACA,OAAO,gBAAgB,QAAQ,WAAW,OAAO;AACnD"}

package/dist/email/errors.d.mts

@@ -0,0 +1,15 @@
+import { Schema } from "effect";
+//#region src/email/errors.d.ts
+declare const EmailRejected_base: Schema.Class<EmailRejected, Schema.TaggedStruct<"EmailRejected", {}>, import("effect/Cause").YieldableError>;
+declare class EmailRejected extends EmailRejected_base {}
+declare const EmailUnavailable_base: Schema.Class<EmailUnavailable, Schema.TaggedStruct<"EmailUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class EmailUnavailable extends EmailUnavailable_base {}
+declare const EmailActionRequired_base: Schema.Class<EmailActionRequired, Schema.TaggedStruct<"EmailActionRequired", {}>, import("effect/Cause").YieldableError>;
+declare class EmailActionRequired extends EmailActionRequired_base {}
+declare const EmailMethodUnsupported_base: Schema.Class<EmailMethodUnsupported, Schema.TaggedStruct<"EmailMethodUnsupported", {}>, import("effect/Cause").YieldableError>;
+declare class EmailMethodUnsupported extends EmailMethodUnsupported_base {}
+declare const EmailConfigurationError_base: Schema.Class<EmailConfigurationError, Schema.TaggedStruct<"EmailConfigurationError", {}>, import("effect/Cause").YieldableError>;
+declare class EmailConfigurationError extends EmailConfigurationError_base {}
+//#endregion
+export { EmailActionRequired, EmailConfigurationError, EmailMethodUnsupported, EmailRejected, EmailUnavailable };
+//# sourceMappingURL=errors.d.mts.map

package/dist/email/errors.mjs

@@ -0,0 +1,11 @@
+import { Schema } from "effect";
+//#region src/email/errors.ts
+var EmailRejected = class extends Schema.TaggedError()("EmailRejected", {}) {};
+var EmailUnavailable = class extends Schema.TaggedError()("EmailUnavailable", {}) {};
+var EmailActionRequired = class extends Schema.TaggedError()("EmailActionRequired", {}) {};
+var EmailMethodUnsupported = class extends Schema.TaggedError()("EmailMethodUnsupported", {}) {};
+var EmailConfigurationError = class extends Schema.TaggedError()("EmailConfigurationError", {}) {};
+//#endregion
+export { EmailActionRequired, EmailConfigurationError, EmailMethodUnsupported, EmailRejected, EmailUnavailable };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/email/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../src/email/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport class EmailRejected extends Schema.TaggedError<EmailRejected>()(\"EmailRejected\", {}) {}\n\nexport class EmailUnavailable extends Schema.TaggedError<EmailUnavailable>()(\n  \"EmailUnavailable\",\n  {},\n) {}\n\nexport class EmailActionRequired extends Schema.TaggedError<EmailActionRequired>()(\n  \"EmailActionRequired\",\n  {},\n) {}\n\nexport class EmailMethodUnsupported extends Schema.TaggedError<EmailMethodUnsupported>()(\n  \"EmailMethodUnsupported\",\n  {},\n) {}\n\nexport class EmailConfigurationError extends Schema.TaggedError<EmailConfigurationError>()(\n  \"EmailConfigurationError\",\n  {},\n) {}\n"],"mappings":";;AAEA,IAAa,gBAAb,cAAmC,OAAO,YAA2B,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAC1E,oBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,CAAC,CACH,CAAC,CAAC,CAAC"}

package/dist/email/magicLink.d.mts

@@ -0,0 +1,33 @@
+import { ProofDeliveryMessage } from "../proofs/delivery.mjs";
+import { EmailConfigurationError, EmailRejected } from "./errors.mjs";
+import { Effect, Redacted } from "effect";
+//#region src/email/magicLink.d.ts
+/** Fixed configured HTTPS landing location. Mail vendors must preserve fragments
+ * and disable click tracking/rewriting that leaks them into queries or logs.
+ * The result remains Redacted because the URL fragment contains a bearer proof.
+ */
+declare const makeMagicLinkRenderer: (landing: string) => Effect.Effect<(message: ProofDeliveryMessage) => Effect.Effect<Redacted.Redacted<string>, EmailRejected, never>, EmailConfigurationError, never>;
+/** Client-only extraction, without authentication side effects. Caller removes the
+ * fragment immediately with history.replaceState, then waits for an intentional
+ * action before same-origin CSRF-protected POST. Only reference/token are accepted;
+ * flow, binder and return target come from the originating client's private state.
+ */
+declare const parseMagicLinkFragment: (fragment: Redacted.Redacted<string>) => Effect.Effect<{
+  reference: {
+    readonly proofId: string & import("effect/Brand").Brand<"effect-auth/ProofId">;
+    readonly purpose: string & import("effect/Brand").Brand<"effect-auth/ProofPurpose">;
+    readonly keyId: string;
+  };
+  secret: Redacted.Redacted<string>;
+}, EmailRejected, never>;
+/** Landing GET is static consumer UI: it must not call issue/attempt/complete or
+ * redirect. Consumers choose their CSP script hashes/nonces if adding client code.
+ */
+declare const magicLinkLandingHeaders: Readonly<{
+  "Cache-Control": "no-store";
+  "Referrer-Policy": "no-referrer";
+  "Content-Security-Policy": "default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'";
+}>;
+//#endregion
+export { magicLinkLandingHeaders, makeMagicLinkRenderer, parseMagicLinkFragment };
+//# sourceMappingURL=magicLink.d.mts.map

package/dist/email/magicLink.mjs

@@ -0,0 +1,58 @@
+import { EmailConfigurationError, EmailRejected } from "./errors.mjs";
+import { ProofReference } from "../proofs/models.mjs";
+import { Effect, Encoding, Redacted, Result, Schema } from "effect";
+//#region src/email/magicLink.ts
+const secret = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
+const payload = Schema.Struct({
+	reference: ProofReference,
+	token: secret
+});
+const codec = Schema.fromJsonString(payload);
+const fragmentSchema = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^#eal1\.[A-Za-z0-9_-]+$/));
+/** Fixed configured HTTPS landing location. Mail vendors must preserve fragments
+* and disable click tracking/rewriting that leaks them into queries or logs.
+* The result remains Redacted because the URL fragment contains a bearer proof.
+*/
+const makeMagicLinkRenderer = Effect.fn("makeMagicLinkRenderer")(function* (landing) {
+	yield* Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(2048)))(landing).pipe(Effect.mapError(() => EmailConfigurationError.make({})));
+	const url = yield* Effect.try({
+		try: () => new URL(landing),
+		catch: () => EmailConfigurationError.make({})
+	});
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.href !== landing) return yield* EmailConfigurationError.make({});
+	const target = url.href;
+	return Effect.fn("MagicLink.render")(function* (message) {
+		const encoded = yield* Schema.encodeEffect(codec)({
+			reference: message.reference,
+			token: Redacted.value(message.secret)
+		}).pipe(Effect.mapError(() => EmailRejected.make({})));
+		return Redacted.make(`${target}#eal1.${Encoding.encodeBase64Url(encoded)}`);
+	});
+});
+/** Client-only extraction, without authentication side effects. Caller removes the
+* fragment immediately with history.replaceState, then waits for an intentional
+* action before same-origin CSRF-protected POST. Only reference/token are accepted;
+* flow, binder and return target come from the originating client's private state.
+*/
+const parseMagicLinkFragment = Effect.fn("MagicLink.parseFragment")(function* (fragment) {
+	const raw = yield* Schema.decodeEffect(fragmentSchema)(Redacted.value(fragment)).pipe(Effect.mapError(() => EmailRejected.make({})));
+	const json = Result.getOrUndefined(Encoding.decodeBase64UrlString(raw.slice(6)));
+	if (json === void 0) return yield* EmailRejected.make({});
+	const decoded = yield* Schema.decodeEffect(codec)(json).pipe(Effect.mapError(() => EmailRejected.make({})));
+	return {
+		reference: decoded.reference,
+		secret: Redacted.make(decoded.token)
+	};
+});
+/** Landing GET is static consumer UI: it must not call issue/attempt/complete or
+* redirect. Consumers choose their CSP script hashes/nonces if adding client code.
+*/
+const magicLinkLandingHeaders = Object.freeze({
+	"Cache-Control": "no-store",
+	"Referrer-Policy": "no-referrer",
+	"Content-Security-Policy": "default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'"
+});
+//#endregion
+export { magicLinkLandingHeaders, makeMagicLinkRenderer, parseMagicLinkFragment };
+
+//# sourceMappingURL=magicLink.mjs.map

package/dist/email/magicLink.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLink.mjs","names":[],"sources":["../../src/email/magicLink.ts"],"sourcesContent":["import { Effect, Encoding, Redacted, Result, Schema } from \"effect\";\n\nimport type { ProofDeliveryMessage } from \"../proofs/delivery\";\nimport { ProofReference } from \"../proofs/models\";\nimport { EmailConfigurationError, EmailRejected } from \"./errors\";\n\nconst secret = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));\nconst payload = Schema.Struct({ reference: ProofReference, token: secret });\nconst codec = Schema.fromJsonString(payload);\n\nconst fragmentSchema = Schema.String.check(\n  Schema.isMaxLength(4096),\n  Schema.isPattern(/^#eal1\\.[A-Za-z0-9_-]+$/),\n);\n\n/** Fixed configured HTTPS landing location. Mail vendors must preserve fragments\n * and disable click tracking/rewriting that leaks them into queries or logs.\n * The result remains Redacted because the URL fragment contains a bearer proof.\n */\nexport const makeMagicLinkRenderer = Effect.fn(\"makeMagicLinkRenderer\")(function* (\n  landing: string,\n) {\n  yield* Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(2048)))(landing).pipe(\n    Effect.mapError(() => EmailConfigurationError.make({})),\n  );\n\n  const url = yield* Effect.try({\n    try: () => new URL(landing),\n    catch: () => EmailConfigurationError.make({}),\n  });\n\n  if (\n    url.protocol !== \"https:\" ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash ||\n    url.href !== landing\n  )\n    return yield* EmailConfigurationError.make({});\n  const target = url.href;\n\n  return Effect.fn(\"MagicLink.render\")(function* (message: ProofDeliveryMessage) {\n    const encoded = yield* Schema.encodeEffect(codec)({\n      reference: message.reference,\n      token: Redacted.value(message.secret),\n    }).pipe(Effect.mapError(() => EmailRejected.make({})));\n\n    return Redacted.make(`${target}#eal1.${Encoding.encodeBase64Url(encoded)}`);\n  });\n});\n\n/** Client-only extraction, without authentication side effects. Caller removes the\n * fragment immediately with history.replaceState, then waits for an intentional\n * action before same-origin CSRF-protected POST. Only reference/token are accepted;\n * flow, binder and return target come from the originating client's private state.\n */\nexport const parseMagicLinkFragment = Effect.fn(\"MagicLink.parseFragment\")(function* (\n  fragment: Redacted.Redacted<string>,\n) {\n  const raw = yield* Schema.decodeEffect(fragmentSchema)(Redacted.value(fragment)).pipe(\n    Effect.mapError(() => EmailRejected.make({})),\n  );\n\n  const json = Result.getOrUndefined(Encoding.decodeBase64UrlString(raw.slice(6)));\n\n  if (json === undefined) return yield* EmailRejected.make({});\n\n  const decoded = yield* Schema.decodeEffect(codec)(json).pipe(\n    Effect.mapError(() => EmailRejected.make({})),\n  );\n\n  return { reference: decoded.reference, secret: Redacted.make(decoded.token) };\n});\n\n/** Landing GET is static consumer UI: it must not call issue/attempt/complete or\n * redirect. Consumers choose their CSP script hashes/nonces if adding client code.\n */\nexport const magicLinkLandingHeaders = Object.freeze({\n  \"Cache-Control\": \"no-store\",\n  \"Referrer-Policy\": \"no-referrer\",\n  \"Content-Security-Policy\":\n    \"default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'\",\n});\n"],"mappings":";;;;AAMA,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AAC1E,MAAM,UAAU,OAAO,OAAO;CAAE,WAAW;CAAgB,OAAO;AAAO,CAAC;AAC1E,MAAM,QAAQ,OAAO,eAAe,OAAO;AAE3C,MAAM,iBAAiB,OAAO,OAAO,MACnC,OAAO,YAAY,IAAI,GACvB,OAAO,UAAU,yBAAyB,CAC5C;;;;;AAMA,MAAa,wBAAwB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACtE,SACA;CACA,OAAO,OAAO,aAAa,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KACjF,OAAO,eAAe,wBAAwB,KAAK,CAAC,CAAC,CAAC,CACxD;CAEA,MAAM,MAAM,OAAO,OAAO,IAAI;EAC5B,WAAW,IAAI,IAAI,OAAO;EAC1B,aAAa,wBAAwB,KAAK,CAAC,CAAC;CAC9C,CAAC;CAED,IACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,IAAI,SAAS,SAEb,OAAO,OAAO,wBAAwB,KAAK,CAAC,CAAC;CAC/C,MAAM,SAAS,IAAI;CAEnB,OAAO,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAA+B;EAC7E,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;GAChD,WAAW,QAAQ;GACnB,OAAO,SAAS,MAAM,QAAQ,MAAM;EACtC,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;EAErD,OAAO,SAAS,KAAK,GAAG,OAAO,QAAQ,SAAS,gBAAgB,OAAO,GAAG;CAC5E,CAAC;AACH,CAAC;;;;;;AAOD,MAAa,yBAAyB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACzE,UACA;CACA,MAAM,MAAM,OAAO,OAAO,aAAa,cAAc,CAAC,CAAC,SAAS,MAAM,QAAQ,CAAC,CAAC,CAAC,KAC/E,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;CAEA,MAAM,OAAO,OAAO,eAAe,SAAS,sBAAsB,IAAI,MAAM,CAAC,CAAC,CAAC;CAE/E,IAAI,SAAS,KAAA,GAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;CAE3D,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KACtD,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;CAEA,OAAO;EAAE,WAAW,QAAQ;EAAW,QAAQ,SAAS,KAAK,QAAQ,KAAK;CAAE;AAC9E,CAAC;;;;AAKD,MAAa,0BAA0B,OAAO,OAAO;CACnD,iBAAiB;CACjB,mBAAmB;CACnB,2BACE;AACJ,CAAC"}

package/dist/email/models.d.mts

@@ -0,0 +1,56 @@
+import { LoginIdentifier } from "../identity/models.mjs";
+import { Schema } from "effect";
+//#region src/email/models.d.ts
+declare const EmailCommandId: Schema.brand<Schema.NonEmptyString, "effect-auth/EmailCommandId">;
+type EmailCommandId = typeof EmailCommandId.Type;
+declare const SafeReturnTarget: Schema.brand<Schema.NonEmptyString, "effect-auth/SafeReturnTarget">;
+type SafeReturnTarget = typeof SafeReturnTarget.Type;
+declare const EmailCredentialSnapshot: Schema.Struct<{
+  readonly moduleId: Schema.NonEmptyString;
+  readonly identifier: typeof LoginIdentifier;
+  readonly identifierRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly verifiedAtMillis: Schema.Int;
+  readonly credentialId: Schema.NonEmptyString;
+  readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+}>;
+type EmailCredentialSnapshot = typeof EmailCredentialSnapshot.Type;
+declare const EmailAction: Schema.Literals<readonly ["verify-address", "change-address"]>;
+type EmailAction = typeof EmailAction.Type;
+/** Target-mailbox possession is NOT authorization to change a subject's identifier. */
+declare const EmailActionChallenge: Schema.Struct<{
+  readonly moduleId: Schema.NonEmptyString;
+  readonly action: Schema.Literals<readonly ["verify-address", "change-address"]>;
+  readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/EmailCommandId">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly sourceCredentialId: Schema.optionalKey<Schema.NonEmptyString>;
+  readonly target: typeof LoginIdentifier;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>;
+type EmailActionChallenge = typeof EmailActionChallenge.Type;
+type EmailAddressDecision = "changed" | "rejected";
+type EmailRegistrationDecision = {
+  readonly _tag: "Registered";
+} | {
+  readonly _tag: "Rejected";
+} | {
+  readonly _tag: "ProvisioningPending";
+  readonly reference: string;
+};
+//#endregion
+export { EmailAction, EmailActionChallenge, EmailAddressDecision, EmailCommandId, EmailCredentialSnapshot, EmailRegistrationDecision, SafeReturnTarget };
+//# sourceMappingURL=models.d.mts.map

package/dist/email/models.mjs

@@ -0,0 +1,31 @@
+import { TokenDigest } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { AuthenticationRevision, SecurityRevision } from "../sessions/models.mjs";
+import { Schema } from "effect";
+//#region src/email/models.ts
+const EmailCommandId = Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(Schema.brand("effect-auth/EmailCommandId"));
+const SafeReturnTarget = Schema.NonEmptyString.check(Schema.isMaxLength(2048)).pipe(Schema.brand("effect-auth/SafeReturnTarget"));
+const EmailCredentialSnapshot = Schema.Struct({
+	moduleId: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+	identifier: LoginIdentifier,
+	identifierRevision: SecurityRevision,
+	verifiedAtMillis: Schema.Int,
+	credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+	credentialRevision: SecurityRevision,
+	revision: AuthenticationRevision
+});
+const EmailAction = Schema.Literals(["verify-address", "change-address"]);
+/** Target-mailbox possession is NOT authorization to change a subject's identifier. */
+const EmailActionChallenge = Schema.Struct({
+	moduleId: Schema.NonEmptyString,
+	action: EmailAction,
+	commandId: EmailCommandId,
+	revision: AuthenticationRevision,
+	sourceCredentialId: Schema.optionalKey(Schema.NonEmptyString),
+	target: LoginIdentifier,
+	bindingDigest: TokenDigest
+});
+//#endregion
+export { EmailAction, EmailActionChallenge, EmailCommandId, EmailCredentialSnapshot, SafeReturnTarget };
+
+//# sourceMappingURL=models.mjs.map

package/dist/email/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/email/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { LoginIdentifier } from \"../identity/models\";\nimport { TokenDigest } from \"../Schema\";\nimport { AuthenticationRevision, SecurityRevision } from \"../sessions/models\";\n\nexport const EmailCommandId = Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(\n  Schema.brand(\"effect-auth/EmailCommandId\"),\n);\n\nexport type EmailCommandId = typeof EmailCommandId.Type;\n\nexport const SafeReturnTarget = Schema.NonEmptyString.check(Schema.isMaxLength(2048)).pipe(\n  Schema.brand(\"effect-auth/SafeReturnTarget\"),\n);\n\nexport type SafeReturnTarget = typeof SafeReturnTarget.Type;\n\nexport const EmailCredentialSnapshot = Schema.Struct({\n  moduleId: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  identifier: LoginIdentifier,\n  identifierRevision: SecurityRevision,\n  verifiedAtMillis: Schema.Int,\n  credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  credentialRevision: SecurityRevision,\n  revision: AuthenticationRevision,\n});\n\nexport type EmailCredentialSnapshot = typeof EmailCredentialSnapshot.Type;\nexport const EmailAction = Schema.Literals([\"verify-address\", \"change-address\"]);\nexport type EmailAction = typeof EmailAction.Type;\n\n/** Target-mailbox possession is NOT authorization to change a subject's identifier. */\nexport const EmailActionChallenge = Schema.Struct({\n  moduleId: Schema.NonEmptyString,\n  action: EmailAction,\n  commandId: EmailCommandId,\n  revision: AuthenticationRevision,\n  sourceCredentialId: Schema.optionalKey(Schema.NonEmptyString),\n  target: LoginIdentifier,\n  bindingDigest: TokenDigest,\n});\n\nexport type EmailActionChallenge = typeof EmailActionChallenge.Type;\nexport type EmailAddressDecision = \"changed\" | \"rejected\";\n\nexport type EmailRegistrationDecision =\n  | { readonly _tag: \"Registered\" }\n  | { readonly _tag: \"Rejected\" }\n  | { readonly _tag: \"ProvisioningPending\"; readonly reference: string };\n"],"mappings":";;;;;AAMA,MAAa,iBAAiB,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KACjF,OAAO,MAAM,4BAA4B,CAC3C;AAIA,MAAa,mBAAmB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,KACpF,OAAO,MAAM,8BAA8B,CAC7C;AAIA,MAAa,0BAA0B,OAAO,OAAO;CACnD,UAAU,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC7D,YAAY;CACZ,oBAAoB;CACpB,kBAAkB,OAAO;CACzB,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACjE,oBAAoB;CACpB,UAAU;AACZ,CAAC;AAGD,MAAa,cAAc,OAAO,SAAS,CAAC,kBAAkB,gBAAgB,CAAC;;AAI/E,MAAa,uBAAuB,OAAO,OAAO;CAChD,UAAU,OAAO;CACjB,QAAQ;CACR,WAAW;CACX,UAAU;CACV,oBAAoB,OAAO,YAAY,OAAO,cAAc;CAC5D,QAAQ;CACR,eAAe;AACjB,CAAC"}