@yielded/auth 0.1.0-beta.1

package/dist/email/module.mjs

@@ -0,0 +1,415 @@
+import { Email, TokenDigest } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConflict, SessionInvalid, StaleAuthentication } from "../sessions/errors.mjs";
+import { AuthenticationFlowId } from "../sessions/models.mjs";
+import { cryptoLayer, defaultLayer, hooksLayer } from "../auth/defaults.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { makeAuthStrategy } from "../auth/AuthStrategy.mjs";
+import { EmailSignInTargets } from "./EmailSignInTargets.mjs";
+import { EmailActionRequired, EmailConfigurationError, EmailMethodUnsupported, EmailRejected, EmailUnavailable } from "./errors.mjs";
+import { ProofInvalid, ProofRequestConflict } from "../proofs/errors.mjs";
+import { SafeReturnTarget } from "./models.mjs";
+import { snapshotEmailCredential, snapshotEmailRevision } from "./snapshot.mjs";
+import { ProofBinding, ProofContinuation, ProofContinuationId, ProofId, ProofPurpose, ProofReference, ProofRequestId, ProofRequestReceipt } from "../proofs/models.mjs";
+import { RequestBindingCredential, RequestBindingFlowId, RequestBindingPublic } from "../operations/requestBindingModels.mjs";
+import { makeRequestBinding } from "../operations/requestBinding.mjs";
+import { readProofCommit } from "../proofs/dispatch.mjs";
+import { makeProofModule } from "../proofs/module.mjs";
+import { EmailReturnTargets } from "./EmailReturnTargets.mjs";
+import { makeEmailAddresses } from "./addresses.mjs";
+import { makeEmailRegistration } from "./registration.mjs";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Option, Schema } from "effect";
+//#region src/email/module.ts
+const EmailInput = Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email));
+const Secret = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));
+const SignInBase = {
+	flowId: RequestBindingFlowId,
+	requestBinding: RequestBindingCredential,
+	email: EmailInput,
+	returnTarget: Schema.String.check(Schema.isMaxLength(2048))
+};
+Schema.Struct(SignInBase);
+const RequestInput = Schema.Struct({
+	...SignInBase,
+	requestId: ProofRequestId,
+	locale: Schema.NonEmptyString.check(Schema.isMaxLength(64))
+});
+const ResendInput = Schema.Struct({
+	...RequestInput.fields,
+	supersedes: ProofId
+});
+const AttemptInput = Schema.Struct({
+	...SignInBase,
+	reference: ProofReference,
+	secret: Secret
+});
+const CompleteInput = Schema.Struct({
+	...SignInBase,
+	continuationId: ProofContinuationId,
+	credential: Secret
+});
+const AttemptResult = Schema.Struct({ continuation: ProofContinuation });
+const Failure = Schema.Union([
+	EmailRejected,
+	EmailUnavailable,
+	EmailActionRequired,
+	EmailMethodUnsupported,
+	HookDenied
+]);
+const noAmbient = Effect.fn("Email.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* EmailMethodUnsupported.make({});
+});
+const read = (receipt) => receipt.read.pipe(Effect.mapError(() => EmailUnavailable.make({})));
+/** Unknown completion/receipt failures may follow a durable write. */
+const completionFailure = (error) => {
+	if (Schema.is(HookDenied)(error)) return error;
+	if (Schema.is(SessionCapabilityUnsupported)(error)) return EmailMethodUnsupported.make({});
+	if (Schema.is(Schema.Union([
+		SessionCapabilityUnsupported,
+		SessionInvalid,
+		SessionConflict,
+		PendingAuthenticationInvalid,
+		StaleAuthentication,
+		ProofInvalid,
+		ProofRequestConflict
+	]))(error)) return EmailRejected.make({});
+	return EmailUnavailable.make({});
+};
+const tupleCodec = Schema.fromJsonString(Schema.Array(Schema.String));
+/** Separate capability Layers keep sign-in-only installations free of registration,
+* address mutation and notification dependencies. Proof/session authorities remain
+* consumer-owned; this factory installs no storage or implicit mail sender.
+*/
+const makeEmailSignInModule = (moduleId, options) => {
+	const sessions = options.sessions;
+	const binding = makeRequestBinding(moduleId, "email-entry");
+	const ClaimsForEmail = Context.Service(`effect-auth/email/${moduleId}/Claims`);
+	const Begin = makeOperation(`${moduleId}/flow/begin`, {
+		payload: Schema.Struct({ flowId: RequestBindingFlowId }),
+		success: RequestBindingPublic,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const beginLayer = Begin.credentialHandlerLayer(Effect.fn("Email.Begin")(function* (request) {
+		yield* noAmbient();
+		return yield* (yield* binding.RequestBinding).issue(request.flowId).pipe(Effect.mapError((error) => error._tag === "RequestBindingInvalid" ? EmailRejected.make({}) : EmailUnavailable.make({})));
+	}));
+	const makeSignIn = (mode) => {
+		const proof = makeProofModule(`${moduleId}/${mode}-sign-in`, {
+			...options.proof,
+			purpose: ProofPurpose.make(mode === "code" ? "email-code-sign-in" : "email-magic-link-sign-in"),
+			binding: ProofBinding,
+			channel: "email"
+		});
+		const CompletionResult = Schema.Struct({
+			completion: sessions.CompletionResult,
+			returnTarget: SafeReturnTarget
+		});
+		const SignIn = Context.Service(`effect-auth/email/${moduleId}/${mode}/SignIn`);
+		const layer = Layer.effect(SignIn, Effect.gen(function* () {
+			if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._:/-]{1,128}$/)))(moduleId)) return yield* EmailConfigurationError.make({});
+			const binder = yield* binding.RequestBinding;
+			const targets = yield* EmailSignInTargets;
+			const returns = yield* EmailReturnTargets;
+			const proofs = yield* proof.Proofs;
+			const claims = yield* ClaimsForEmail;
+			const completion = yield* sessions.AuthenticationCompletion;
+			const authority = yield* AuthenticationAuthority;
+			const crypto = yield* Crypto.Crypto;
+			const bound = Effect.fn("Email.signInBinding")(function* (request) {
+				const verified = yield* binder.verify(request.flowId, request.requestBinding).pipe(Effect.mapError(() => EmailRejected.make({})));
+				const returnTarget = yield* returns.resolve(request.returnTarget);
+				const identifier = LoginIdentifier.make({
+					namespace: "email",
+					value: request.email
+				});
+				const candidate = yield* targets.lookup({
+					moduleId,
+					identifier
+				});
+				let target = Option.none();
+				if (Option.isSome(candidate)) {
+					const snapshot = yield* snapshotEmailCredential(candidate.value);
+					const current = yield* authority.capture(snapshot.revision.subjectId, [snapshot.credentialId]).pipe(Effect.map(Option.some), Effect.catchTag("StaleAuthentication", () => Effect.succeed(Option.none())), Effect.mapError(() => EmailUnavailable.make({})));
+					if (Option.isSome(current)) {
+						const captured = snapshotEmailRevision(current.value);
+						if (snapshot.moduleId === moduleId && snapshot.identifier.namespace === "email" && snapshot.identifier.value === identifier.value && captured.subjectId === snapshot.revision.subjectId && captured.securityRevision === snapshot.revision.securityRevision && captured.credentials.some((item) => item.credentialId === snapshot.credentialId && item.revision === snapshot.credentialRevision)) target = Option.some(Object.freeze({
+							...snapshot,
+							revision: captured
+						}));
+					}
+				}
+				const message = yield* Schema.encodeEffect(tupleCodec)([
+					"effect-auth/email-sign-in/v1",
+					moduleId,
+					mode,
+					request.flowId,
+					verified.verifier,
+					identifier.value,
+					returnTarget
+				]).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+				const bytes = yield* crypto.digest("SHA-256", new TextEncoder().encode(message)).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+				const base = {
+					flowId: request.flowId,
+					contextDigest: TokenDigest.make(Encoding.encodeBase64Url(bytes)),
+					identifier
+				};
+				const proofBinding = Option.isSome(target) ? {
+					_tag: "Subject",
+					...base,
+					revision: target.value.revision
+				} : {
+					_tag: "Identifier",
+					...base
+				};
+				return {
+					target,
+					binding: proofBinding,
+					returnTarget
+				};
+			});
+			return SignIn.of({
+				request: Effect.fn("Email.signInRequest")(function* (request, supersedes) {
+					yield* noAmbient();
+					const current = yield* bound(request);
+					const dispatch = yield* proofs.prepareIssue({
+						requestId: request.requestId,
+						binding: current.binding,
+						locale: request.locale,
+						eligible: Option.isSome(current.target),
+						...supersedes === void 0 ? {} : { supersedes }
+					}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(() => EmailUnavailable.make({})));
+					yield* dispatch.dispatch.pipe(Effect.mapError(() => EmailUnavailable.make({})));
+					return dispatch.receipt;
+				}),
+				attempt: Effect.fn("Email.signInAttempt")(function* (request) {
+					yield* noAmbient();
+					const current = yield* bound(request);
+					const result = yield* proofs.prepareAttempt({
+						binding: current.binding,
+						reference: request.reference,
+						credential: request.secret
+					}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(completionFailure));
+					if (result.value._tag === "Rejected") return yield* EmailRejected.make({});
+					return {
+						value: { continuation: result.value.continuation },
+						credentialCommands: result.credentialCommands
+					};
+				}),
+				complete: Effect.fn("Email.signInComplete")(function* (request) {
+					yield* noAmbient();
+					const current = yield* bound(request);
+					if (Option.isNone(current.target)) return yield* EmailRejected.make({});
+					const verifiedAt = yield* DateTime.now;
+					if ((yield* proofs.prepareComplete({
+						binding: current.binding,
+						continuationId: request.continuationId,
+						credential: request.credential
+					}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(completionFailure))) !== "completed") return yield* EmailRejected.make({});
+					const evidence = {
+						flowId: AuthenticationFlowId.make(request.flowId),
+						bindingDigest: current.binding.contextDigest,
+						revision: current.target.value.revision,
+						proofs: [{
+							method: mode === "code" ? "email-code" : "magic-link",
+							credentialId: current.target.value.credentialId,
+							factors: ["possession"],
+							userVerified: false,
+							phishingResistant: false,
+							verifiedAt
+						}]
+					};
+					const applicationClaims = yield* claims.resolve(yield* snapshotEmailCredential(current.target.value));
+					const established = yield* completion.prepare({
+						evidence,
+						claims: applicationClaims
+					}).pipe(Effect.flatMap(read), Effect.mapError(completionFailure));
+					return {
+						value: {
+							completion: established.value,
+							returnTarget: current.returnTarget
+						},
+						credentialCommands: [
+							...established.credentialCommands,
+							{
+								_tag: "Clear",
+								slot: "proof-continuation"
+							},
+							{
+								_tag: "Clear",
+								slot: "request-binding"
+							}
+						]
+					};
+				})
+			});
+		}));
+		const Request = makeOperation(`${moduleId}/${mode}/sign-in/request`, {
+			payload: RequestInput,
+			success: ProofRequestReceipt,
+			error: Failure,
+			access: "any",
+			exposure: "public",
+			replay: "idempotent"
+		});
+		const Resend = makeOperation(`${moduleId}/${mode}/sign-in/resend`, {
+			payload: ResendInput,
+			success: ProofRequestReceipt,
+			error: Failure,
+			access: "any",
+			exposure: "public",
+			replay: "idempotent"
+		});
+		const Attempt = makeOperation(`${moduleId}/${mode}/sign-in/attempt`, {
+			payload: AttemptInput,
+			success: AttemptResult,
+			error: Failure,
+			access: "any",
+			exposure: "public",
+			replay: "single-use",
+			credentials: true
+		});
+		const Complete = makeOperation(`${moduleId}/${mode}/sign-in/complete`, {
+			payload: CompleteInput,
+			success: CompletionResult,
+			error: Failure,
+			access: "any",
+			exposure: "public",
+			replay: "single-use",
+			credentials: true
+		});
+		const handlersLayer = Layer.mergeAll(Request.handlerLayer(Effect.fn("Email.Request")(function* (input) {
+			return yield* (yield* SignIn).request(input);
+		})), Resend.handlerLayer(Effect.fn("Email.Resend")(function* (input) {
+			return yield* (yield* SignIn).request(input, input.supersedes);
+		})), Attempt.credentialHandlerLayer(Effect.fn("Email.Attempt")(function* (input) {
+			return yield* (yield* SignIn).attempt(input);
+		})), Complete.credentialHandlerLayer(Effect.fn("Email.Complete")(function* (input) {
+			return yield* (yield* SignIn).complete(input);
+		})));
+		return Object.freeze({
+			strategy: makeAuthStrategy({
+				beginSignIn: Begin.invoke,
+				signIn: Request.invoke,
+				resendSignIn: Resend.invoke,
+				verifySignIn: Attempt.invoke,
+				completeSignIn: Complete.invoke
+			}, Layer.merge(beginLayer, handlersLayer).pipe(Layer.provide(defaultLayer(SignIn, layer)), Layer.provide(defaultLayer(proof.Proofs, proof.emailLayer)), Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)), Layer.provide([cryptoLayer, hooksLayer])), { completion: true }),
+			SignIn,
+			layer,
+			proof,
+			operations: {
+				Request,
+				Resend,
+				Attempt,
+				Complete
+			},
+			handlersLayer
+		});
+	};
+	return Object.freeze({
+		...makeSignIn(options.mode),
+		binding,
+		Begin,
+		beginLayer,
+		ClaimsForEmail
+	});
+};
+/** Explicit contracts for applications assembling multiple email capabilities together. */
+const makeEmailAccountModule = (moduleId, options) => {
+	const sessions = options.sessions;
+	const { binding, Begin, beginLayer, ClaimsForEmail } = makeEmailSignInModule(moduleId, {
+		sessions,
+		mode: "code",
+		proof: options.code
+	});
+	const registrationProof = makeProofModule(`${moduleId}/registration`, {
+		...options.code,
+		purpose: ProofPurpose.make("email-code-registration"),
+		binding: ProofBinding,
+		channel: "email"
+	});
+	const verifyProof = makeProofModule(`${moduleId}/verify-address`, {
+		...options.code,
+		purpose: ProofPurpose.make("email-address-verification"),
+		binding: ProofBinding,
+		channel: "email"
+	});
+	const changeProof = makeProofModule(`${moduleId}/change-address`, {
+		...options.code,
+		purpose: ProofPurpose.make("email-address-change"),
+		binding: ProofBinding,
+		channel: "email"
+	});
+	const registration = (codec) => {
+		const module = makeEmailRegistration(moduleId, codec, registrationProof, binding);
+		return Object.freeze({
+			...module,
+			strategy: makeAuthStrategy({
+				beginRegistration: Begin.invoke,
+				register: module.operations.Request.invoke,
+				resendRegistration: module.operations.Resend.invoke,
+				verifyRegistration: module.operations.Attempt.invoke,
+				completeRegistration: module.operations.Complete.invoke
+			}, Layer.merge(beginLayer, module.handlersLayer).pipe(Layer.provide(defaultLayer(module.Registrations, module.layer)), Layer.provide(defaultLayer(registrationProof.Proofs, registrationProof.emailLayer)), Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)), Layer.provide([cryptoLayer, hooksLayer])))
+		});
+	};
+	const addresses = (policy) => {
+		const module = makeEmailAddresses(moduleId, binding, verifyProof, changeProof, sessions, policy);
+		return Object.freeze({
+			...module,
+			strategy: makeAuthStrategy({
+				beginEmailAddress: Begin.invoke,
+				requestEmailVerification: module.verify.operations.Request.invoke,
+				resendEmailVerification: module.verify.operations.Resend.invoke,
+				verifyEmailAddress: module.verify.operations.Attempt.invoke,
+				completeEmailVerification: module.verify.operations.Complete.invoke,
+				requestEmailChange: module.change.operations.Request.invoke,
+				resendEmailChange: module.change.operations.Resend.invoke,
+				verifyEmailChange: module.change.operations.Attempt.invoke,
+				completeEmailChange: module.change.operations.Complete.invoke
+			}, Layer.mergeAll(beginLayer, module.verify.handlersLayer, module.change.handlersLayer).pipe(Layer.provide(defaultLayer(module.Addresses, module.layer)), Layer.provide([defaultLayer(verifyProof.Proofs, verifyProof.emailLayer), defaultLayer(changeProof.Proofs, changeProof.emailLayer)]), Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)), Layer.provide([cryptoLayer, hooksLayer])))
+		});
+	};
+	return Object.freeze({
+		binding,
+		Begin,
+		beginLayer,
+		ClaimsForEmail,
+		registration,
+		addresses
+	});
+};
+/** Explicit contracts for hosts exposing code, link and account operations together. */
+const makeEmailMethod = (moduleId, options) => {
+	const accounts = makeEmailAccountModule(moduleId, options);
+	const code = makeEmailSignInModule(moduleId, {
+		sessions: options.sessions,
+		mode: "code",
+		proof: options.code
+	});
+	const link = makeEmailSignInModule(moduleId, {
+		sessions: options.sessions,
+		mode: "link",
+		proof: {
+			...options.link,
+			secret: { _tag: "Token" }
+		}
+	});
+	return Object.freeze({
+		...accounts,
+		code,
+		link,
+		group: operationGroup(accounts.Begin, ...Object.values(code.operations), ...Object.values(link.operations))
+	});
+};
+//#endregion
+export { makeEmailAccountModule, makeEmailMethod, makeEmailSignInModule };
+
+//# sourceMappingURL=module.mjs.map

package/dist/email/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":[],"sources":["../../src/email/module.ts"],"sourcesContent":["import {\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Layer,\n  Option,\n  Schema,\n  type Types,\n} from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { HookDenied } from \"../hooks/models\";\nimport { LoginIdentifier } from \"../identity/models\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport {\n  makeRequestBinding,\n  RequestBindingCredential,\n  RequestBindingFlowId,\n  RequestBindingPublic,\n} from \"../operations/requestBinding\";\nimport type { ProofKeyring, ProofSecretPolicy } from \"../proofs/crypto\";\nimport { readProofCommit } from \"../proofs/dispatch\";\nimport { ProofInvalid, ProofRequestConflict } from \"../proofs/errors\";\nimport {\n  ProofBinding,\n  ProofContinuation,\n  ProofContinuationId,\n  ProofId,\n  ProofPurpose,\n  ProofReference,\n  ProofRequestId,\n  ProofRequestReceipt,\n} from \"../proofs/models\";\nimport { makeProofModule } from \"../proofs/module\";\nimport type { ProofPolicy } from \"../proofs/policy\";\nimport { Email, TokenDigest } from \"../Schema\";\nimport { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport {\n  SessionCapabilityUnsupported,\n  SessionInvalid,\n  SessionConflict,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n} from \"../sessions/errors\";\nimport type { AuthenticationEvidence } from \"../sessions/models\";\nimport { AuthenticationFlowId } from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport { makeEmailAddresses, type EmailAddressPolicy } from \"./addresses\";\nimport { EmailReturnTargets } from \"./EmailReturnTargets\";\nimport { EmailSignInTargets } from \"./EmailSignInTargets\";\nimport {\n  EmailActionRequired,\n  EmailConfigurationError,\n  EmailMethodUnsupported,\n  EmailRejected,\n  EmailUnavailable,\n} from \"./errors\";\nimport { SafeReturnTarget, type EmailCredentialSnapshot } from \"./models\";\nimport { makeEmailRegistration } from \"./registration\";\nimport { snapshotEmailCredential, snapshotEmailRevision } from \"./snapshot\";\n\nconst EmailInput = Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email));\nconst Secret = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));\nconst FlowInput = { flowId: RequestBindingFlowId, requestBinding: RequestBindingCredential };\n\nconst SignInBase = {\n  ...FlowInput,\n  email: EmailInput,\n  returnTarget: Schema.String.check(Schema.isMaxLength(2048)),\n};\n\nconst SignInBindingInput = Schema.Struct(SignInBase);\n\nconst RequestInput = Schema.Struct({\n  ...SignInBase,\n  requestId: ProofRequestId,\n  locale: Schema.NonEmptyString.check(Schema.isMaxLength(64)),\n});\n\nconst ResendInput = Schema.Struct({ ...RequestInput.fields, supersedes: ProofId });\nconst AttemptInput = Schema.Struct({ ...SignInBase, reference: ProofReference, secret: Secret });\n\nconst CompleteInput = Schema.Struct({\n  ...SignInBase,\n  continuationId: ProofContinuationId,\n  credential: Secret,\n});\n\nconst AttemptResult = Schema.Struct({ continuation: ProofContinuation });\n\nconst Failure = Schema.Union([\n  EmailRejected,\n  EmailUnavailable,\n  EmailActionRequired,\n  EmailMethodUnsupported,\n  HookDenied,\n]);\n\ntype Failure = typeof Failure.Type;\n\nconst noAmbient = Effect.fn(\"Email.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* EmailMethodUnsupported.make({});\n});\n\nconst read = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n/** Unknown completion/receipt failures may follow a durable write. */\nconst completionFailure = (\n  error: unknown,\n): EmailRejected | EmailUnavailable | EmailMethodUnsupported | HookDenied => {\n  if (Schema.is(HookDenied)(error)) return error;\n  if (Schema.is(SessionCapabilityUnsupported)(error)) return EmailMethodUnsupported.make({});\n  if (\n    Schema.is(\n      Schema.Union([\n        SessionCapabilityUnsupported,\n        SessionInvalid,\n        SessionConflict,\n        PendingAuthenticationInvalid,\n        StaleAuthentication,\n        ProofInvalid,\n        ProofRequestConflict,\n      ]),\n    )(error)\n  )\n    return EmailRejected.make({});\n\n  return EmailUnavailable.make({});\n};\n\nconst tupleCodec = Schema.fromJsonString(Schema.Array(Schema.String));\n\nexport interface EmailModule<Id extends string, Kind extends string, Claims> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n  readonly claims: Types.Invariant<Claims>;\n}\n\n/** Separate capability Layers keep sign-in-only installations free of registration,\n * address mutation and notification dependencies. Proof/session authorities remain\n * consumer-owned; this factory installs no storage or implicit mail sender.\n */\nexport const makeEmailSignInModule = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  const Mode extends \"code\" | \"link\",\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n    readonly mode: Mode;\n    readonly proof: {\n      readonly template: string;\n      readonly secret: ProofSecretPolicy;\n      readonly keys?: ProofKeyring;\n      readonly policy: ProofPolicy;\n    };\n  },\n) => {\n  const sessions = options.sessions;\n  const binding = makeRequestBinding(moduleId, \"email-entry\");\n\n  const ClaimsForEmail = Context.Service<\n    EmailModule<Id, \"claims\", Claims[\"Type\"]>,\n    {\n      readonly resolve: (\n        credential: EmailCredentialSnapshot,\n      ) => Effect.Effect<Claims[\"Type\"], EmailUnavailable>;\n    }\n  >(`effect-auth/email/${moduleId}/Claims`);\n\n  const Begin = makeOperation(`${moduleId}/flow/begin`, {\n    payload: Schema.Struct({ flowId: RequestBindingFlowId }),\n    success: RequestBindingPublic,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const beginLayer = Begin.credentialHandlerLayer(\n    Effect.fn(\"Email.Begin\")(function* (request) {\n      yield* noAmbient();\n\n      return yield* (yield* binding.RequestBinding)\n        .issue(request.flowId)\n        .pipe(\n          Effect.mapError((error) =>\n            error._tag === \"RequestBindingInvalid\"\n              ? EmailRejected.make({})\n              : EmailUnavailable.make({}),\n          ),\n        );\n    }),\n  );\n\n  const makeSignIn = <const Mode extends \"code\" | \"link\">(mode: Mode) => {\n    const proof = makeProofModule(`${moduleId}/${mode}-sign-in`, {\n      ...options.proof,\n      purpose: ProofPurpose.make(\n        mode === \"code\" ? \"email-code-sign-in\" : \"email-magic-link-sign-in\",\n      ),\n      binding: ProofBinding,\n      channel: \"email\",\n    });\n\n    const CompletionResult = Schema.Struct({\n      completion: sessions.CompletionResult,\n      returnTarget: SafeReturnTarget,\n    });\n\n    const SignIn = Context.Service<\n      EmailModule<Id, `${Mode}-sign-in`, Claims[\"Type\"]>,\n      {\n        readonly request: (\n          input: typeof RequestInput.Type,\n          supersedes?: ProofId,\n        ) => Effect.Effect<ProofRequestReceipt, Failure>;\n        readonly attempt: (\n          input: typeof AttemptInput.Type,\n        ) => Effect.Effect<AuthOperationResult<typeof AttemptResult.Type>, Failure>;\n        readonly complete: (\n          input: typeof CompleteInput.Type,\n        ) => Effect.Effect<AuthOperationResult<typeof CompletionResult.Type>, Failure>;\n      }\n    >(`effect-auth/email/${moduleId}/${mode}/SignIn`);\n\n    const layer = Layer.effect(\n      SignIn,\n      Effect.gen(function* () {\n        if (\n          !Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._:/-]{1,128}$/)))(moduleId)\n        )\n          return yield* EmailConfigurationError.make({});\n        const binder = yield* binding.RequestBinding;\n        const targets = yield* EmailSignInTargets;\n        const returns = yield* EmailReturnTargets;\n        const proofs = yield* proof.Proofs;\n        const claims = yield* ClaimsForEmail;\n        const completion = yield* sessions.AuthenticationCompletion;\n        const authority = yield* AuthenticationAuthority;\n        const crypto = yield* Crypto.Crypto;\n\n        const bound = Effect.fn(\"Email.signInBinding\")(function* (\n          request: typeof SignInBindingInput.Type,\n        ) {\n          const verified = yield* binder\n            .verify(request.flowId, request.requestBinding)\n            .pipe(Effect.mapError(() => EmailRejected.make({})));\n\n          const returnTarget = yield* returns.resolve(request.returnTarget);\n          const identifier = LoginIdentifier.make({ namespace: \"email\", value: request.email });\n          const candidate = yield* targets.lookup({ moduleId, identifier });\n          let target: Option.Option<EmailCredentialSnapshot> = Option.none();\n\n          if (Option.isSome(candidate)) {\n            const snapshot = yield* snapshotEmailCredential(candidate.value);\n\n            const current = yield* authority\n              .capture(snapshot.revision.subjectId, [snapshot.credentialId])\n              .pipe(\n                Effect.map(Option.some),\n                Effect.catchTag(\"StaleAuthentication\", () => Effect.succeed(Option.none())),\n                Effect.mapError(() => EmailUnavailable.make({})),\n              );\n\n            if (Option.isSome(current)) {\n              const captured = snapshotEmailRevision(current.value);\n\n              if (\n                snapshot.moduleId === moduleId &&\n                snapshot.identifier.namespace === \"email\" &&\n                snapshot.identifier.value === identifier.value &&\n                captured.subjectId === snapshot.revision.subjectId &&\n                captured.securityRevision === snapshot.revision.securityRevision &&\n                captured.credentials.some(\n                  (item) =>\n                    item.credentialId === snapshot.credentialId &&\n                    item.revision === snapshot.credentialRevision,\n                )\n              )\n                target = Option.some(Object.freeze({ ...snapshot, revision: captured }));\n            }\n          }\n\n          const message = yield* Schema.encodeEffect(tupleCodec)([\n            \"effect-auth/email-sign-in/v1\",\n            moduleId,\n            mode,\n            request.flowId,\n            verified.verifier,\n            identifier.value,\n            returnTarget,\n          ]).pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n          const bytes = yield* crypto\n            .digest(\"SHA-256\", new TextEncoder().encode(message))\n            .pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n          const base = {\n            flowId: request.flowId,\n            contextDigest: TokenDigest.make(Encoding.encodeBase64Url(bytes)),\n            identifier,\n          };\n\n          const proofBinding: ProofBinding = Option.isSome(target)\n            ? { _tag: \"Subject\", ...base, revision: target.value.revision }\n            : { _tag: \"Identifier\", ...base };\n\n          return { target, binding: proofBinding, returnTarget };\n        });\n\n        return SignIn.of({\n          request: Effect.fn(\"Email.signInRequest\")(function* (request, supersedes) {\n            yield* noAmbient();\n            const current = yield* bound(request);\n\n            const dispatch = yield* proofs\n              .prepareIssue({\n                requestId: request.requestId,\n                binding: current.binding,\n                locale: request.locale,\n                eligible: Option.isSome(current.target),\n                ...(supersedes === undefined ? {} : { supersedes }),\n              })\n              .pipe(\n                Effect.flatMap(readProofCommit),\n                Effect.mapError(() => EmailUnavailable.make({})),\n              );\n\n            yield* dispatch.dispatch.pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n            return dispatch.receipt;\n          }),\n          attempt: Effect.fn(\"Email.signInAttempt\")(function* (request) {\n            yield* noAmbient();\n            const current = yield* bound(request);\n\n            const result = yield* proofs\n              .prepareAttempt({\n                binding: current.binding,\n                reference: request.reference,\n                credential: request.secret,\n              })\n              .pipe(Effect.flatMap(readProofCommit), Effect.mapError(completionFailure));\n\n            if (result.value._tag === \"Rejected\") return yield* EmailRejected.make({});\n\n            return {\n              value: { continuation: result.value.continuation },\n              credentialCommands: result.credentialCommands,\n            };\n          }),\n          complete: Effect.fn(\"Email.signInComplete\")(function* (request) {\n            yield* noAmbient();\n            const current = yield* bound(request);\n\n            if (Option.isNone(current.target)) return yield* EmailRejected.make({});\n            // Verifying the restricted continuation starts here. Never timestamp the\n            // later claims/crypto/session work, or refresh the captured semantic revision.\n            const verifiedAt = yield* DateTime.now;\n\n            const consumed = yield* proofs\n              .prepareComplete({\n                binding: current.binding,\n                continuationId: request.continuationId,\n                credential: request.credential,\n              })\n              .pipe(Effect.flatMap(readProofCommit), Effect.mapError(completionFailure));\n\n            if (consumed !== \"completed\") return yield* EmailRejected.make({});\n\n            const evidence: AuthenticationEvidence = {\n              flowId: AuthenticationFlowId.make(request.flowId),\n              bindingDigest: current.binding.contextDigest,\n              revision: current.target.value.revision,\n              proofs: [\n                {\n                  method: mode === \"code\" ? \"email-code\" : \"magic-link\",\n                  credentialId: current.target.value.credentialId,\n                  factors: [\"possession\"],\n                  userVerified: false,\n                  phishingResistant: false,\n                  verifiedAt,\n                },\n              ],\n            };\n\n            const applicationClaims = yield* claims.resolve(\n              yield* snapshotEmailCredential(current.target.value),\n            );\n\n            // Proof consumption has committed. Session failure burns this proof and\n            // requires a fresh request; no cross-owner atomicity is claimed here.\n            const established = yield* completion\n              .prepare({ evidence, claims: applicationClaims })\n              .pipe(Effect.flatMap(read), Effect.mapError(completionFailure));\n\n            return {\n              value: { completion: established.value, returnTarget: current.returnTarget },\n              credentialCommands: [\n                ...established.credentialCommands,\n                { _tag: \"Clear\", slot: \"proof-continuation\" },\n                { _tag: \"Clear\", slot: \"request-binding\" },\n              ],\n            };\n          }),\n        });\n      }),\n    );\n\n    const Request = makeOperation(`${moduleId}/${mode}/sign-in/request`, {\n      payload: RequestInput,\n      success: ProofRequestReceipt,\n      error: Failure,\n      access: \"any\",\n      exposure: \"public\",\n      replay: \"idempotent\",\n    });\n\n    const Resend = makeOperation(`${moduleId}/${mode}/sign-in/resend`, {\n      payload: ResendInput,\n      success: ProofRequestReceipt,\n      error: Failure,\n      access: \"any\",\n      exposure: \"public\",\n      replay: \"idempotent\",\n    });\n\n    const Attempt = makeOperation(`${moduleId}/${mode}/sign-in/attempt`, {\n      payload: AttemptInput,\n      success: AttemptResult,\n      error: Failure,\n      access: \"any\",\n      exposure: \"public\",\n      replay: \"single-use\",\n      credentials: true,\n    });\n\n    const Complete = makeOperation(`${moduleId}/${mode}/sign-in/complete`, {\n      payload: CompleteInput,\n      success: CompletionResult,\n      error: Failure,\n      access: \"any\",\n      exposure: \"public\",\n      replay: \"single-use\",\n      credentials: true,\n    });\n\n    const handlersLayer = Layer.mergeAll(\n      Request.handlerLayer(\n        Effect.fn(\"Email.Request\")(function* (input) {\n          return yield* (yield* SignIn).request(input);\n        }),\n      ),\n      Resend.handlerLayer(\n        Effect.fn(\"Email.Resend\")(function* (input) {\n          return yield* (yield* SignIn).request(input, input.supersedes);\n        }),\n      ),\n      Attempt.credentialHandlerLayer(\n        Effect.fn(\"Email.Attempt\")(function* (input) {\n          return yield* (yield* SignIn).attempt(input);\n        }),\n      ),\n      Complete.credentialHandlerLayer(\n        Effect.fn(\"Email.Complete\")(function* (input) {\n          return yield* (yield* SignIn).complete(input);\n        }),\n      ),\n    );\n\n    return Object.freeze({\n      strategy: makeAuthStrategy(\n        {\n          beginSignIn: Begin.invoke,\n          signIn: Request.invoke,\n          resendSignIn: Resend.invoke,\n          verifySignIn: Attempt.invoke,\n          completeSignIn: Complete.invoke,\n        },\n        Layer.merge(beginLayer, handlersLayer).pipe(\n          Layer.provide(defaultLayer(SignIn, layer)),\n          Layer.provide(defaultLayer(proof.Proofs, proof.emailLayer)),\n          Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n        { completion: true },\n      ),\n      SignIn,\n      layer,\n      proof,\n      operations: { Request, Resend, Attempt, Complete },\n      handlersLayer,\n    });\n  };\n\n  return Object.freeze({\n    ...makeSignIn(options.mode),\n    binding,\n    Begin,\n    beginLayer,\n    ClaimsForEmail,\n  });\n};\n\n/** Explicit contracts for applications assembling multiple email capabilities together. */\nexport const makeEmailAccountModule = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n    readonly code: {\n      readonly template: string;\n      readonly secret: Extract<ProofSecretPolicy, { readonly _tag: \"NumericCode\" }>;\n      readonly keys: ProofKeyring;\n      readonly policy: ProofPolicy;\n    };\n  },\n) => {\n  const sessions = options.sessions;\n  const code = makeEmailSignInModule(moduleId, { sessions, mode: \"code\", proof: options.code });\n  const { binding, Begin, beginLayer, ClaimsForEmail } = code;\n\n  const registrationProof = makeProofModule(`${moduleId}/registration`, {\n    ...options.code,\n    purpose: ProofPurpose.make(\"email-code-registration\"),\n    binding: ProofBinding,\n    channel: \"email\",\n  });\n\n  const verifyProof = makeProofModule(`${moduleId}/verify-address`, {\n    ...options.code,\n    purpose: ProofPurpose.make(\"email-address-verification\"),\n    binding: ProofBinding,\n    channel: \"email\",\n  });\n\n  const changeProof = makeProofModule(`${moduleId}/change-address`, {\n    ...options.code,\n    purpose: ProofPurpose.make(\"email-address-change\"),\n    binding: ProofBinding,\n    channel: \"email\",\n  });\n\n  const registration = <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(\n    codec: Registration,\n  ) => {\n    const module = makeEmailRegistration(moduleId, codec, registrationProof, binding);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          beginRegistration: Begin.invoke,\n          register: module.operations.Request.invoke,\n          resendRegistration: module.operations.Resend.invoke,\n          verifyRegistration: module.operations.Attempt.invoke,\n          completeRegistration: module.operations.Complete.invoke,\n        },\n        Layer.merge(beginLayer, module.handlersLayer).pipe(\n          Layer.provide(defaultLayer(module.Registrations, module.layer)),\n          Layer.provide(defaultLayer(registrationProof.Proofs, registrationProof.emailLayer)),\n          Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  const addresses = (policy: EmailAddressPolicy) => {\n    const module = makeEmailAddresses(\n      moduleId,\n      binding,\n      verifyProof,\n      changeProof,\n      sessions,\n      policy,\n    );\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          beginEmailAddress: Begin.invoke,\n          requestEmailVerification: module.verify.operations.Request.invoke,\n          resendEmailVerification: module.verify.operations.Resend.invoke,\n          verifyEmailAddress: module.verify.operations.Attempt.invoke,\n          completeEmailVerification: module.verify.operations.Complete.invoke,\n          requestEmailChange: module.change.operations.Request.invoke,\n          resendEmailChange: module.change.operations.Resend.invoke,\n          verifyEmailChange: module.change.operations.Attempt.invoke,\n          completeEmailChange: module.change.operations.Complete.invoke,\n        },\n        Layer.mergeAll(beginLayer, module.verify.handlersLayer, module.change.handlersLayer).pipe(\n          Layer.provide(defaultLayer(module.Addresses, module.layer)),\n          Layer.provide([\n            defaultLayer(verifyProof.Proofs, verifyProof.emailLayer),\n            defaultLayer(changeProof.Proofs, changeProof.emailLayer),\n          ]),\n          Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  return Object.freeze({\n    binding,\n    Begin,\n    beginLayer,\n    ClaimsForEmail,\n    registration,\n    addresses,\n  });\n};\n\n/** Explicit contracts for hosts exposing code, link and account operations together. */\nexport const makeEmailMethod = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: Parameters<typeof makeEmailAccountModule<Id, SessionId, Claims>>[1] & {\n    readonly link: { readonly template: string; readonly policy: ProofPolicy };\n  },\n) => {\n  const accounts = makeEmailAccountModule<Id, SessionId, Claims>(moduleId, options);\n\n  const code = makeEmailSignInModule<Id, SessionId, Claims, \"code\">(moduleId, {\n    sessions: options.sessions,\n    mode: \"code\",\n    proof: options.code,\n  });\n\n  const link = makeEmailSignInModule<Id, SessionId, Claims, \"link\">(moduleId, {\n    sessions: options.sessions,\n    mode: \"link\",\n    proof: { ...options.link, secret: { _tag: \"Token\" } },\n  });\n\n  return Object.freeze({\n    ...accounts,\n    code,\n    link,\n    group: operationGroup(\n      accounts.Begin,\n      ...Object.values(code.operations),\n      ...Object.values(link.operations),\n    ),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,MAAM,aAAa,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,KAAK,CAAC;AAC3F,MAAM,SAAS,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAGrF,MAAM,aAAa;CAFC,QAAQ;CAAsB,gBAAgB;CAIhE,OAAO;CACP,cAAc,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;AAC5D;AAE2B,OAAO,OAAO,UAAU;AAEnD,MAAM,eAAe,OAAO,OAAO;CACjC,GAAG;CACH,WAAW;CACX,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAAE,GAAG,aAAa;CAAQ,YAAY;AAAQ,CAAC;AACjF,MAAM,eAAe,OAAO,OAAO;CAAE,GAAG;CAAY,WAAW;CAAgB,QAAQ;AAAO,CAAC;AAE/F,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG;CACH,gBAAgB;CAChB,YAAY;AACd,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO,EAAE,cAAc,kBAAkB,CAAC;AAEvE,MAAM,UAAU,OAAO,MAAM;CAC3B;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,MAAM,YAAY,OAAO,GAAG,iBAAiB,CAAC,CAAC,aAAa;CAC1D,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,QAAW,YACf,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;;AAGpE,MAAM,qBACJ,UAC2E;CAC3E,IAAI,OAAO,GAAG,UAAU,CAAC,CAAC,KAAK,GAAG,OAAO;CACzC,IAAI,OAAO,GAAG,4BAA4B,CAAC,CAAC,KAAK,GAAG,OAAO,uBAAuB,KAAK,CAAC,CAAC;CACzF,IACE,OAAO,GACL,OAAO,MAAM;EACX;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH,CAAC,CAAC,KAAK,GAEP,OAAO,cAAc,KAAK,CAAC,CAAC;CAE9B,OAAO,iBAAiB,KAAK,CAAC,CAAC;AACjC;AAEA,MAAM,aAAa,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;;;;;AAYpE,MAAa,yBAMX,UACA,YAUG;CACH,MAAM,WAAW,QAAQ;CACzB,MAAM,UAAU,mBAAmB,UAAU,aAAa;CAE1D,MAAM,iBAAiB,QAAQ,QAO7B,qBAAqB,SAAS,QAAQ;CAExC,MAAM,QAAQ,cAAc,GAAG,SAAS,cAAc;EACpD,SAAS,OAAO,OAAO,EAAE,QAAQ,qBAAqB,CAAC;EACvD,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,aAAa,MAAM,uBACvB,OAAO,GAAG,aAAa,CAAC,CAAC,WAAW,SAAS;EAC3C,OAAO,UAAU;EAEjB,OAAO,QAAQ,OAAO,QAAQ,eAAA,CAC3B,MAAM,QAAQ,MAAM,CAAC,CACrB,KACC,OAAO,UAAU,UACf,MAAM,SAAS,0BACX,cAAc,KAAK,CAAC,CAAC,IACrB,iBAAiB,KAAK,CAAC,CAAC,CAC9B,CACF;CACJ,CAAC,CACH;CAEA,MAAM,cAAkD,SAAe;EACrE,MAAM,QAAQ,gBAAgB,GAAG,SAAS,GAAG,KAAK,WAAW;GAC3D,GAAG,QAAQ;GACX,SAAS,aAAa,KACpB,SAAS,SAAS,uBAAuB,0BAC3C;GACA,SAAS;GACT,SAAS;EACX,CAAC;EAED,MAAM,mBAAmB,OAAO,OAAO;GACrC,YAAY,SAAS;GACrB,cAAc;EAChB,CAAC;EAED,MAAM,SAAS,QAAQ,QAcrB,qBAAqB,SAAS,GAAG,KAAK,QAAQ;EAEhD,MAAM,QAAQ,MAAM,OAClB,QACA,OAAO,IAAI,aAAa;GACtB,IACE,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,2BAA2B,CAAC,CAAC,CAAC,CAAC,QAAQ,GAEvF,OAAO,OAAO,wBAAwB,KAAK,CAAC,CAAC;GAC/C,MAAM,SAAS,OAAO,QAAQ;GAC9B,MAAM,UAAU,OAAO;GACvB,MAAM,UAAU,OAAO;GACvB,MAAM,SAAS,OAAO,MAAM;GAC5B,MAAM,SAAS,OAAO;GACtB,MAAM,aAAa,OAAO,SAAS;GACnC,MAAM,YAAY,OAAO;GACzB,MAAM,SAAS,OAAO,OAAO;GAE7B,MAAM,QAAQ,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAC7C,SACA;IACA,MAAM,WAAW,OAAO,OACrB,OAAO,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAC9C,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;IAErD,MAAM,eAAe,OAAO,QAAQ,QAAQ,QAAQ,YAAY;IAChE,MAAM,aAAa,gBAAgB,KAAK;KAAE,WAAW;KAAS,OAAO,QAAQ;IAAM,CAAC;IACpF,MAAM,YAAY,OAAO,QAAQ,OAAO;KAAE;KAAU;IAAW,CAAC;IAChE,IAAI,SAAiD,OAAO,KAAK;IAEjE,IAAI,OAAO,OAAO,SAAS,GAAG;KAC5B,MAAM,WAAW,OAAO,wBAAwB,UAAU,KAAK;KAE/D,MAAM,UAAU,OAAO,UACpB,QAAQ,SAAS,SAAS,WAAW,CAAC,SAAS,YAAY,CAAC,CAAC,CAC7D,KACC,OAAO,IAAI,OAAO,IAAI,GACtB,OAAO,SAAS,6BAA6B,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,GAC1E,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;KAEF,IAAI,OAAO,OAAO,OAAO,GAAG;MAC1B,MAAM,WAAW,sBAAsB,QAAQ,KAAK;MAEpD,IACE,SAAS,aAAa,YACtB,SAAS,WAAW,cAAc,WAClC,SAAS,WAAW,UAAU,WAAW,SACzC,SAAS,cAAc,SAAS,SAAS,aACzC,SAAS,qBAAqB,SAAS,SAAS,oBAChD,SAAS,YAAY,MAClB,SACC,KAAK,iBAAiB,SAAS,gBAC/B,KAAK,aAAa,SAAS,kBAC/B,GAEA,SAAS,OAAO,KAAK,OAAO,OAAO;OAAE,GAAG;OAAU,UAAU;MAAS,CAAC,CAAC;KAC3E;IACF;IAEA,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC;KACrD;KACA;KACA;KACA,QAAQ;KACR,SAAS;KACT,WAAW;KACX;IACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,QAAQ,OAAO,OAClB,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CACpD,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,OAAO;KACX,QAAQ,QAAQ;KAChB,eAAe,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC;KAC/D;IACF;IAEA,MAAM,eAA6B,OAAO,OAAO,MAAM,IACnD;KAAE,MAAM;KAAW,GAAG;KAAM,UAAU,OAAO,MAAM;IAAS,IAC5D;KAAE,MAAM;KAAc,GAAG;IAAK;IAElC,OAAO;KAAE;KAAQ,SAAS;KAAc;IAAa;GACvD,CAAC;GAED,OAAO,OAAO,GAAG;IACf,SAAS,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,SAAS,YAAY;KACxE,OAAO,UAAU;KACjB,MAAM,UAAU,OAAO,MAAM,OAAO;KAEpC,MAAM,WAAW,OAAO,OACrB,aAAa;MACZ,WAAW,QAAQ;MACnB,SAAS,QAAQ;MACjB,QAAQ,QAAQ;MAChB,UAAU,OAAO,OAAO,QAAQ,MAAM;MACtC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;KACnD,CAAC,CAAC,CACD,KACC,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;KAEF,OAAO,SAAS,SAAS,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;KAE9E,OAAO,SAAS;IAClB,CAAC;IACD,SAAS,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,SAAS;KAC5D,OAAO,UAAU;KACjB,MAAM,UAAU,OAAO,MAAM,OAAO;KAEpC,MAAM,SAAS,OAAO,OACnB,eAAe;MACd,SAAS,QAAQ;MACjB,WAAW,QAAQ;MACnB,YAAY,QAAQ;KACtB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,iBAAiB,CAAC;KAE3E,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KAEzE,OAAO;MACL,OAAO,EAAE,cAAc,OAAO,MAAM,aAAa;MACjD,oBAAoB,OAAO;KAC7B;IACF,CAAC;IACD,UAAU,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,SAAS;KAC9D,OAAO,UAAU;KACjB,MAAM,UAAU,OAAO,MAAM,OAAO;KAEpC,IAAI,OAAO,OAAO,QAAQ,MAAM,GAAG,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KAGtE,MAAM,aAAa,OAAO,SAAS;KAUnC,KAAI,OARoB,OACrB,gBAAgB;MACf,SAAS,QAAQ;MACjB,gBAAgB,QAAQ;MACxB,YAAY,QAAQ;KACtB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,iBAAiB,CAAC,OAE1D,aAAa,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KAEjE,MAAM,WAAmC;MACvC,QAAQ,qBAAqB,KAAK,QAAQ,MAAM;MAChD,eAAe,QAAQ,QAAQ;MAC/B,UAAU,QAAQ,OAAO,MAAM;MAC/B,QAAQ,CACN;OACE,QAAQ,SAAS,SAAS,eAAe;OACzC,cAAc,QAAQ,OAAO,MAAM;OACnC,SAAS,CAAC,YAAY;OACtB,cAAc;OACd,mBAAmB;OACnB;MACF,CACF;KACF;KAEA,MAAM,oBAAoB,OAAO,OAAO,QACtC,OAAO,wBAAwB,QAAQ,OAAO,KAAK,CACrD;KAIA,MAAM,cAAc,OAAO,WACxB,QAAQ;MAAE;MAAU,QAAQ;KAAkB,CAAC,CAAC,CAChD,KAAK,OAAO,QAAQ,IAAI,GAAG,OAAO,SAAS,iBAAiB,CAAC;KAEhE,OAAO;MACL,OAAO;OAAE,YAAY,YAAY;OAAO,cAAc,QAAQ;MAAa;MAC3E,oBAAoB;OAClB,GAAG,YAAY;OACf;QAAE,MAAM;QAAS,MAAM;OAAqB;OAC5C;QAAE,MAAM;QAAS,MAAM;OAAkB;MAC3C;KACF;IACF,CAAC;GACH,CAAC;EACH,CAAC,CACH;EAEA,MAAM,UAAU,cAAc,GAAG,SAAS,GAAG,KAAK,mBAAmB;GACnE,SAAS;GACT,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;EACV,CAAC;EAED,MAAM,SAAS,cAAc,GAAG,SAAS,GAAG,KAAK,kBAAkB;GACjE,SAAS;GACT,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;EACV,CAAC;EAED,MAAM,UAAU,cAAc,GAAG,SAAS,GAAG,KAAK,mBAAmB;GACnE,SAAS;GACT,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;GACR,aAAa;EACf,CAAC;EAED,MAAM,WAAW,cAAc,GAAG,SAAS,GAAG,KAAK,oBAAoB;GACrE,SAAS;GACT,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;GACR,aAAa;EACf,CAAC;EAED,MAAM,gBAAgB,MAAM,SAC1B,QAAQ,aACN,OAAO,GAAG,eAAe,CAAC,CAAC,WAAW,OAAO;GAC3C,OAAO,QAAQ,OAAO,OAAA,CAAQ,QAAQ,KAAK;EAC7C,CAAC,CACH,GACA,OAAO,aACL,OAAO,GAAG,cAAc,CAAC,CAAC,WAAW,OAAO;GAC1C,OAAO,QAAQ,OAAO,OAAA,CAAQ,QAAQ,OAAO,MAAM,UAAU;EAC/D,CAAC,CACH,GACA,QAAQ,uBACN,OAAO,GAAG,eAAe,CAAC,CAAC,WAAW,OAAO;GAC3C,OAAO,QAAQ,OAAO,OAAA,CAAQ,QAAQ,KAAK;EAC7C,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO;GAC5C,OAAO,QAAQ,OAAO,OAAA,CAAQ,SAAS,KAAK;EAC9C,CAAC,CACH,CACF;EAEA,OAAO,OAAO,OAAO;GACnB,UAAU,iBACR;IACE,aAAa,MAAM;IACnB,QAAQ,QAAQ;IAChB,cAAc,OAAO;IACrB,cAAc,QAAQ;IACtB,gBAAgB,SAAS;GAC3B,GACA,MAAM,MAAM,YAAY,aAAa,CAAC,CAAC,KACrC,MAAM,QAAQ,aAAa,QAAQ,KAAK,CAAC,GACzC,MAAM,QAAQ,aAAa,MAAM,QAAQ,MAAM,UAAU,CAAC,GAC1D,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,GACA,EAAE,YAAY,KAAK,CACrB;GACA;GACA;GACA;GACA,YAAY;IAAE;IAAS;IAAQ;IAAS;GAAS;GACjD;EACF,CAAC;CACH;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG,WAAW,QAAQ,IAAI;EAC1B;EACA;EACA;EACA;CACF,CAAC;AACH;;AAGA,MAAa,0BAKX,UACA,YASG;CACH,MAAM,WAAW,QAAQ;CAEzB,MAAM,EAAE,SAAS,OAAO,YAAY,mBADvB,sBAAsB,UAAU;EAAE;EAAU,MAAM;EAAQ,OAAO,QAAQ;CAAK,CACjC;CAE1D,MAAM,oBAAoB,gBAAgB,GAAG,SAAS,gBAAgB;EACpE,GAAG,QAAQ;EACX,SAAS,aAAa,KAAK,yBAAyB;EACpD,SAAS;EACT,SAAS;CACX,CAAC;CAED,MAAM,cAAc,gBAAgB,GAAG,SAAS,kBAAkB;EAChE,GAAG,QAAQ;EACX,SAAS,aAAa,KAAK,4BAA4B;EACvD,SAAS;EACT,SAAS;CACX,CAAC;CAED,MAAM,cAAc,gBAAgB,GAAG,SAAS,kBAAkB;EAChE,GAAG,QAAQ;EACX,SAAS,aAAa,KAAK,sBAAsB;EACjD,SAAS;EACT,SAAS;CACX,CAAC;CAED,MAAM,gBACJ,UACG;EACH,MAAM,SAAS,sBAAsB,UAAU,OAAO,mBAAmB,OAAO;EAEhF,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,mBAAmB,MAAM;IACzB,UAAU,OAAO,WAAW,QAAQ;IACpC,oBAAoB,OAAO,WAAW,OAAO;IAC7C,oBAAoB,OAAO,WAAW,QAAQ;IAC9C,sBAAsB,OAAO,WAAW,SAAS;GACnD,GACA,MAAM,MAAM,YAAY,OAAO,aAAa,CAAC,CAAC,KAC5C,MAAM,QAAQ,aAAa,OAAO,eAAe,OAAO,KAAK,CAAC,GAC9D,MAAM,QAAQ,aAAa,kBAAkB,QAAQ,kBAAkB,UAAU,CAAC,GAClF,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,MAAM,aAAa,WAA+B;EAChD,MAAM,SAAS,mBACb,UACA,SACA,aACA,aACA,UACA,MACF;EAEA,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,mBAAmB,MAAM;IACzB,0BAA0B,OAAO,OAAO,WAAW,QAAQ;IAC3D,yBAAyB,OAAO,OAAO,WAAW,OAAO;IACzD,oBAAoB,OAAO,OAAO,WAAW,QAAQ;IACrD,2BAA2B,OAAO,OAAO,WAAW,SAAS;IAC7D,oBAAoB,OAAO,OAAO,WAAW,QAAQ;IACrD,mBAAmB,OAAO,OAAO,WAAW,OAAO;IACnD,mBAAmB,OAAO,OAAO,WAAW,QAAQ;IACpD,qBAAqB,OAAO,OAAO,WAAW,SAAS;GACzD,GACA,MAAM,SAAS,YAAY,OAAO,OAAO,eAAe,OAAO,OAAO,aAAa,CAAC,CAAC,KACnF,MAAM,QAAQ,aAAa,OAAO,WAAW,OAAO,KAAK,CAAC,GAC1D,MAAM,QAAQ,CACZ,aAAa,YAAY,QAAQ,YAAY,UAAU,GACvD,aAAa,YAAY,QAAQ,YAAY,UAAU,CACzD,CAAC,GACD,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH;;AAGA,MAAa,mBAKX,UACA,YAGG;CACH,MAAM,WAAW,uBAA8C,UAAU,OAAO;CAEhF,MAAM,OAAO,sBAAqD,UAAU;EAC1E,UAAU,QAAQ;EAClB,MAAM;EACN,OAAO,QAAQ;CACjB,CAAC;CAED,MAAM,OAAO,sBAAqD,UAAU;EAC1E,UAAU,QAAQ;EAClB,MAAM;EACN,OAAO;GAAE,GAAG,QAAQ;GAAM,QAAQ,EAAE,MAAM,QAAQ;EAAE;CACtD,CAAC;CAED,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA;EACA,OAAO,eACL,SAAS,OACT,GAAG,OAAO,OAAO,KAAK,UAAU,GAChC,GAAG,OAAO,OAAO,KAAK,UAAU,CAClC;CACF,CAAC;AACH"}

package/dist/email/registration.d.mts

@@ -0,0 +1,28 @@
+import "../Schema.mjs";
+import "../operations/credentials.mjs";
+import "../operations/operation.mjs";
+import "../identity/models.mjs";
+import "../hooks/models.mjs";
+import "../hooks/LifecycleHooks.mjs";
+import "../hooks/commit.mjs";
+import "../WebCrypto.mjs";
+import "../operations/requestBinding.mjs";
+import "../Operations.mjs";
+import "../Auth.mjs";
+import "./models.mjs";
+import "../proofs/models.mjs";
+import "../proofs/completion.mjs";
+import "../proofs/module.mjs";
+import "../Proofs.mjs";
+import "./errors.mjs";
+import "./EmailAddressPersistence.mjs";
+import { Context, Crypto, Effect, Layer, Schema, Types } from "effect";
+//#region src/email/registration.d.ts
+interface RegistrationModule<Id extends string, Kind extends string, Registration> {
+  readonly moduleId: Id;
+  readonly kind: Kind;
+  readonly registration: Types.Invariant<Registration>;
+}
+//#endregion
+export { RegistrationModule };
+//# sourceMappingURL=registration.d.mts.map