@yielded/auth 0.1.0-beta.1

package/dist/email/registration.mjs

@@ -0,0 +1,243 @@
+import { Email, TokenDigest } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { EmailMethodUnsupported, EmailRejected, EmailUnavailable } from "./errors.mjs";
+import { EmailCommandId } from "./models.mjs";
+import { ProofContinuation, ProofContinuationId, ProofId, ProofReference, ProofRequestId, ProofRequestReceipt } from "../proofs/models.mjs";
+import { RequestBindingCredential, RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import { readProofCommit } from "../proofs/dispatch.mjs";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Schema } from "effect";
+//#region src/email/registration.ts
+const Failure = Schema.Union([
+	EmailRejected,
+	EmailUnavailable,
+	EmailMethodUnsupported,
+	HookDenied
+]);
+const Success = Schema.Union([Schema.TaggedStruct("RegistrationAccepted", {}), Schema.TaggedStruct("ProvisioningPending", { reference: Schema.NonEmptyString.check(Schema.isMaxLength(256)) })]);
+const AttemptSuccess = Schema.Struct({ continuation: ProofContinuation });
+const noAmbient = Effect.fn("EmailRegistration.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* EmailMethodUnsupported.make({});
+});
+const tuple = Schema.fromJsonString(Schema.Array(Schema.String));
+const makeEmailRegistration = (moduleId, registration, proof, binder) => {
+	const RegistrationCodec = registration;
+	const base = {
+		flowId: RequestBindingFlowId,
+		requestBinding: RequestBindingCredential,
+		email: Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email)),
+		registration: RegistrationCodec
+	};
+	Schema.Struct(base);
+	const RequestInput = Schema.Struct({
+		...base,
+		requestId: ProofRequestId,
+		locale: Schema.NonEmptyString.check(Schema.isMaxLength(64))
+	});
+	const ResendInput = Schema.Struct({
+		...RequestInput.fields,
+		supersedes: ProofId
+	});
+	const AttemptInput = Schema.Struct({
+		...base,
+		reference: ProofReference,
+		secret: Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)))
+	});
+	const CompleteInput = Schema.Struct({
+		...base,
+		commandId: EmailCommandId,
+		continuationId: ProofContinuationId,
+		credential: Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)))
+	});
+	const RegistrationAuthority = Context.Service(`effect-auth/email/${moduleId}/RegistrationAuthority`);
+	const Registrations = Context.Service(`effect-auth/email/${moduleId}/Registrations`);
+	const layer = Layer.effect(Registrations, Effect.gen(function* () {
+		const bindings = yield* binder.RequestBinding;
+		const proofs = yield* proof.Proofs;
+		const authority = yield* RegistrationAuthority;
+		const hooks = yield* LifecycleHooks;
+		const crypto = yield* Crypto.Crypto;
+		const services = yield* Effect.context();
+		const dataCodec = Schema.toCodecJson(Schema.toType(RegistrationCodec));
+		const snapshotData = (data) => Schema.encodeEffect(dataCodec)(data).pipe(Effect.flatMap(Schema.decodeEffect(dataCodec)), Effect.provide(services), Effect.mapError(() => EmailRejected.make({})));
+		const bound = Effect.fn("EmailRegistration.binding")(function* (input) {
+			const verified = yield* bindings.verify(input.flowId, input.requestBinding).pipe(Effect.mapError(() => EmailRejected.make({})));
+			const identifier = Object.freeze(LoginIdentifier.make({
+				namespace: "email",
+				value: input.email
+			}));
+			const data = yield* snapshotData(input.registration);
+			const inspected = yield* authority.inspect({
+				identifier,
+				registration: yield* snapshotData(data)
+			});
+			const fingerprint = yield* Schema.decodeEffect(TokenDigest.check(Schema.isMaxLength(256)))(inspected.fingerprint).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+			const encoded = yield* Schema.encodeEffect(tuple)([
+				"effect-auth/email-registration/v1",
+				moduleId,
+				input.flowId,
+				verified.verifier,
+				identifier.value,
+				fingerprint
+			]).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+			const digest = yield* crypto.digest("SHA-256", new TextEncoder().encode(encoded)).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+			const binding = {
+				_tag: "Identifier",
+				identifier,
+				flowId: input.flowId,
+				contextDigest: TokenDigest.make(Encoding.encodeBase64Url(digest))
+			};
+			return {
+				data,
+				identifier,
+				fingerprint,
+				eligible: inspected.eligible,
+				binding
+			};
+		});
+		return Registrations.of({
+			request: Effect.fn("EmailRegistration.request")(function* (input, supersedes) {
+				yield* noAmbient();
+				const current = yield* bound(input);
+				const dispatch = yield* proofs.prepareIssue({
+					requestId: input.requestId,
+					binding: current.binding,
+					locale: input.locale,
+					eligible: current.eligible,
+					...supersedes === void 0 ? {} : { supersedes }
+				}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(() => EmailUnavailable.make({})));
+				yield* dispatch.dispatch.pipe(Effect.mapError(() => EmailUnavailable.make({})));
+				return dispatch.receipt;
+			}),
+			attempt: Effect.fn("EmailRegistration.attempt")(function* (input) {
+				yield* noAmbient();
+				const current = yield* bound(input);
+				const result = yield* proofs.prepareAttempt({
+					reference: input.reference,
+					credential: input.secret,
+					binding: current.binding
+				}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(() => EmailRejected.make({})));
+				if (result.value._tag === "Rejected") return yield* EmailRejected.make({});
+				return {
+					value: { continuation: result.value.continuation },
+					credentialCommands: result.credentialCommands
+				};
+			}),
+			planComplete: Effect.fn("EmailRegistration.planComplete")(function* (input) {
+				yield* noAmbient();
+				const current = yield* bound(input);
+				const completion = yield* proofs.planComplete({
+					continuationId: input.continuationId,
+					credential: input.credential,
+					binding: current.binding
+				}).pipe(Effect.mapError(() => EmailRejected.make({})));
+				const snapshot = lifecycleSnapshot({
+					action: "registration",
+					operation: `${moduleId}/email-registration`,
+					method: "email-code",
+					identifiers: [current.identifier]
+				});
+				yield* hooks.before(snapshot);
+				const bytes = yield* crypto.randomBytes(32).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+				const event = lifecycleEvent({
+					id: LifecycleEventId.make(Encoding.encodeBase64Url(bytes)),
+					occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+					snapshot
+				});
+				const commandId = input.commandId;
+				const commit = Effect.gen(function* () {
+					return yield* (yield* RegistrationAuthority).registerWithProof({
+						moduleId,
+						commandId,
+						identifier: current.identifier,
+						registration: current.data,
+						fingerprint: current.fingerprint,
+						completion
+					}, (decision, journal) => {
+						if (decision._tag === "Registered") journal.stage(event);
+						return journal.prepare({
+							value: decision._tag === "Registered" ? { _tag: "RegistrationAccepted" } : decision,
+							credentialCommands: decision._tag === "Rejected" ? [] : [{
+								_tag: "Clear",
+								slot: "proof-continuation"
+							}, {
+								_tag: "Clear",
+								slot: "request-binding"
+							}]
+						});
+					});
+				});
+				return Object.freeze({ commit });
+			})
+		});
+	}));
+	const Request = makeOperation(`${moduleId}/registration/request`, {
+		payload: RequestInput,
+		success: ProofRequestReceipt,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "idempotent"
+	});
+	const Resend = makeOperation(`${moduleId}/registration/resend`, {
+		payload: ResendInput,
+		success: ProofRequestReceipt,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "idempotent"
+	});
+	const Attempt = makeOperation(`${moduleId}/registration/attempt`, {
+		payload: AttemptInput,
+		success: AttemptSuccess,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/registration/complete`, {
+		payload: CompleteInput,
+		success: Success,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const handlersLayer = Layer.mergeAll(Request.handlerLayer(Effect.fn("EmailRegistration.Request")(function* (input) {
+		return yield* (yield* Registrations).request(input);
+	})), Resend.handlerLayer(Effect.fn("EmailRegistration.Resend")(function* (input) {
+		return yield* (yield* Registrations).request(input, input.supersedes);
+	})), Attempt.credentialHandlerLayer(Effect.fn("EmailRegistration.Attempt")(function* (input) {
+		return yield* (yield* Registrations).attempt(input);
+	})), Complete.credentialHandlerLayer(Effect.fn("EmailRegistration.Complete")(function* (input) {
+		const result = yield* (yield* (yield* (yield* Registrations).planComplete(input)).commit).read.pipe(Effect.mapError(() => EmailUnavailable.make({})));
+		if (result.value._tag === "Rejected") return yield* EmailRejected.make({});
+		return {
+			value: result.value,
+			credentialCommands: result.credentialCommands
+		};
+	})));
+	return Object.freeze({
+		RegistrationAuthority,
+		Registrations,
+		layer,
+		proof,
+		handlersLayer,
+		operations: {
+			Request,
+			Resend,
+			Attempt,
+			Complete
+		},
+		group: operationGroup(Request, Resend, Attempt, Complete)
+	});
+};
+//#endregion
+export { makeEmailRegistration };
+
+//# sourceMappingURL=registration.mjs.map

package/dist/email/registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.mjs","names":[],"sources":["../../src/email/registration.ts"],"sourcesContent":["import { Context, Crypto, DateTime, Effect, Encoding, Layer, Schema, type Types } from \"effect\";\n\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport { LoginIdentifier } from \"../identity/models\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport type { makeRequestBinding } from \"../operations/requestBinding\";\nimport { RequestBindingCredential, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport type { ProofCompletionPlan } from \"../proofs/completion\";\nimport { readProofCommit } from \"../proofs/dispatch\";\nimport type { ProofBinding } from \"../proofs/models\";\nimport {\n  ProofContinuation,\n  ProofContinuationId,\n  ProofId,\n  ProofReference,\n  ProofRequestId,\n  ProofRequestReceipt,\n} from \"../proofs/models\";\nimport type { makeProofModule } from \"../proofs/module\";\nimport { Email, TokenDigest } from \"../Schema\";\nimport type { PrepareEmailCommit } from \"./EmailAddressPersistence\";\nimport { EmailMethodUnsupported, EmailRejected, EmailUnavailable } from \"./errors\";\nimport { EmailCommandId, type EmailRegistrationDecision } from \"./models\";\n\nconst Failure = Schema.Union([EmailRejected, EmailUnavailable, EmailMethodUnsupported, HookDenied]);\n\ntype Failure = typeof Failure.Type;\n\nconst Success = Schema.Union([\n  Schema.TaggedStruct(\"RegistrationAccepted\", {}),\n  Schema.TaggedStruct(\"ProvisioningPending\", {\n    reference: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  }),\n]);\n\nconst AttemptSuccess = Schema.Struct({ continuation: ProofContinuation });\n\nconst noAmbient = Effect.fn(\"EmailRegistration.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* EmailMethodUnsupported.make({});\n});\n\nconst tuple = Schema.fromJsonString(Schema.Array(Schema.String));\n\nexport interface RegistrationModule<Id extends string, Kind extends string, Registration> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n  readonly registration: Types.Invariant<Registration>;\n}\n\nexport const makeEmailRegistration = <\n  const Id extends string,\n  const ProofModuleId extends string,\n  Registration extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  registration: Registration,\n  proof: ReturnType<typeof makeProofModule<ProofModuleId, typeof ProofBinding>>,\n  binder: ReturnType<typeof makeRequestBinding<Id, \"email-entry\">>,\n) => {\n  const RegistrationCodec: Schema.Codec<\n    Registration[\"Type\"],\n    Registration[\"Encoded\"],\n    Registration[\"DecodingServices\"],\n    Registration[\"EncodingServices\"]\n  > = registration;\n\n  const base = {\n    flowId: RequestBindingFlowId,\n    requestBinding: RequestBindingCredential,\n    email: Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email)),\n    registration: RegistrationCodec,\n  };\n\n  const BindingInput = Schema.Struct(base);\n\n  const RequestInput = Schema.Struct({\n    ...base,\n    requestId: ProofRequestId,\n    locale: Schema.NonEmptyString.check(Schema.isMaxLength(64)),\n  });\n\n  const ResendInput = Schema.Struct({ ...RequestInput.fields, supersedes: ProofId });\n\n  const AttemptInput = Schema.Struct({\n    ...base,\n    reference: ProofReference,\n    secret: Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096))),\n  });\n\n  const CompleteInput = Schema.Struct({\n    ...base,\n    commandId: EmailCommandId,\n    continuationId: ProofContinuationId,\n    credential: Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096))),\n  });\n\n  const RegistrationAuthority = Context.Service<\n    RegistrationModule<Id, \"authority\", Registration[\"Type\"]>,\n    {\n      /** Deterministic versioned digest of the entire validated application intent.\n       * Snapshot data retained for the owner must not be mutated by this callback.\n       * No raw JSON fingerprinting or consumer codec transformation replay is assumed.\n       */\n      readonly inspect: (input: {\n        readonly identifier: LoginIdentifier;\n        readonly registration: Registration[\"Type\"];\n      }) => Effect.Effect<\n        { readonly fingerprint: TokenDigest; readonly eligible: boolean },\n        EmailUnavailable\n      >;\n      /** One physical owner consumes completion and creates subject + verified identifier\n       * + active email credential, or a protected pending reconciliation intent. No orphan\n       * subject/upsert/session issuance. Exact command/intent uniqueness prevents adopting\n       * a prior subject or replacing pending intent; pending reference is nonauthorizing.\n       */\n      readonly registerWithProof: <A>(\n        input: {\n          readonly moduleId: string;\n          readonly commandId: EmailCommandId;\n          readonly identifier: LoginIdentifier;\n          readonly registration: Registration[\"Type\"];\n          readonly fingerprint: TokenDigest;\n          readonly completion: ProofCompletionPlan;\n        },\n        prepare: PrepareEmailCommit<EmailRegistrationDecision, A>,\n      ) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;\n    }\n  >(`effect-auth/email/${moduleId}/RegistrationAuthority`);\n\n  type Result = AuthOperationResult<typeof Success.Type | { readonly _tag: \"Rejected\" }>;\n  type Plan = {\n    readonly commit: Effect.Effect<\n      PreparedCommit<Result>,\n      EmailUnavailable,\n      typeof RegistrationAuthority.Identifier\n    >;\n  };\n\n  const Registrations = Context.Service<\n    RegistrationModule<Id, \"registration\", Registration[\"Type\"]>,\n    {\n      readonly request: (\n        input: typeof RequestInput.Type,\n        supersedes?: ProofId,\n      ) => Effect.Effect<ProofRequestReceipt, Failure>;\n      readonly attempt: (\n        input: typeof AttemptInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof AttemptSuccess.Type>, Failure>;\n      readonly planComplete: (input: typeof CompleteInput.Type) => Effect.Effect<Plan, Failure>;\n    }\n  >(`effect-auth/email/${moduleId}/Registrations`);\n\n  const layer = Layer.effect(\n    Registrations,\n    Effect.gen(function* () {\n      const bindings = yield* binder.RequestBinding;\n      const proofs = yield* proof.Proofs;\n      const authority = yield* RegistrationAuthority;\n      const hooks = yield* LifecycleHooks;\n      const crypto = yield* Crypto.Crypto;\n\n      const services = yield* Effect.context<\n        Registration[\"DecodingServices\"] | Registration[\"EncodingServices\"]\n      >();\n\n      // Derive from Type so wire transformations are not replayed. JSON projection\n      // detaches mutable built-ins (including DateTime); opaque declared Type values\n      // without a derived JSON representation fail safely rather than share graphs.\n      const dataCodec = Schema.toCodecJson(Schema.toType(RegistrationCodec));\n\n      const snapshotData = (data: Registration[\"Type\"]) =>\n        Schema.encodeEffect(dataCodec)(data).pipe(\n          Effect.flatMap(Schema.decodeEffect(dataCodec)),\n          Effect.provide(services),\n          Effect.mapError(() => EmailRejected.make({})),\n        );\n\n      const bound = Effect.fn(\"EmailRegistration.binding\")(function* (\n        input: typeof BindingInput.Type,\n      ) {\n        const verified = yield* bindings\n          .verify(input.flowId, input.requestBinding)\n          .pipe(Effect.mapError(() => EmailRejected.make({})));\n\n        const identifier = Object.freeze(\n          LoginIdentifier.make({ namespace: \"email\", value: input.email }),\n        );\n\n        const data = yield* snapshotData(input.registration);\n\n        const inspected = yield* authority.inspect({\n          identifier,\n          registration: yield* snapshotData(data),\n        });\n\n        const fingerprint = yield* Schema.decodeEffect(TokenDigest.check(Schema.isMaxLength(256)))(\n          inspected.fingerprint,\n        ).pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n        const encoded = yield* Schema.encodeEffect(tuple)([\n          \"effect-auth/email-registration/v1\",\n          moduleId,\n          input.flowId,\n          verified.verifier,\n          identifier.value,\n          fingerprint,\n        ]).pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n        const digest = yield* crypto\n          .digest(\"SHA-256\", new TextEncoder().encode(encoded))\n          .pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n        const binding: ProofBinding = {\n          _tag: \"Identifier\",\n          identifier,\n          flowId: input.flowId,\n          contextDigest: TokenDigest.make(Encoding.encodeBase64Url(digest)),\n        };\n\n        return { data, identifier, fingerprint, eligible: inspected.eligible, binding };\n      });\n\n      return Registrations.of({\n        request: Effect.fn(\"EmailRegistration.request\")(function* (input, supersedes) {\n          yield* noAmbient();\n          const current = yield* bound(input);\n\n          const dispatch = yield* proofs\n            .prepareIssue({\n              requestId: input.requestId,\n              binding: current.binding,\n              locale: input.locale,\n              eligible: current.eligible,\n              ...(supersedes === undefined ? {} : { supersedes }),\n            })\n            .pipe(\n              Effect.flatMap(readProofCommit),\n              Effect.mapError(() => EmailUnavailable.make({})),\n            );\n\n          yield* dispatch.dispatch.pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n          return dispatch.receipt;\n        }),\n        attempt: Effect.fn(\"EmailRegistration.attempt\")(function* (input) {\n          yield* noAmbient();\n          const current = yield* bound(input);\n\n          const result = yield* proofs\n            .prepareAttempt({\n              reference: input.reference,\n              credential: input.secret,\n              binding: current.binding,\n            })\n            .pipe(\n              Effect.flatMap(readProofCommit),\n              Effect.mapError(() => EmailRejected.make({})),\n            );\n\n          if (result.value._tag === \"Rejected\") return yield* EmailRejected.make({});\n\n          return {\n            value: { continuation: result.value.continuation },\n            credentialCommands: result.credentialCommands,\n          };\n        }),\n        planComplete: Effect.fn(\"EmailRegistration.planComplete\")(function* (input) {\n          yield* noAmbient();\n          const current = yield* bound(input);\n\n          const completion = yield* proofs\n            .planComplete({\n              continuationId: input.continuationId,\n              credential: input.credential,\n              binding: current.binding,\n            })\n            .pipe(Effect.mapError(() => EmailRejected.make({})));\n\n          const snapshot = lifecycleSnapshot({\n            action: \"registration\",\n            operation: `${moduleId}/email-registration`,\n            method: \"email-code\",\n            identifiers: [current.identifier],\n          });\n\n          yield* hooks.before(snapshot);\n\n          const bytes = yield* crypto\n            .randomBytes(32)\n            .pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n          const event = lifecycleEvent({\n            id: LifecycleEventId.make(Encoding.encodeBase64Url(bytes)),\n            occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n            snapshot,\n          });\n\n          const commandId = input.commandId;\n\n          const commit = Effect.gen(function* () {\n            const owner = yield* RegistrationAuthority;\n\n            return yield* owner.registerWithProof(\n              {\n                moduleId,\n                commandId,\n                identifier: current.identifier,\n                registration: current.data,\n                fingerprint: current.fingerprint,\n                completion,\n              },\n              (decision, journal) => {\n                if (decision._tag === \"Registered\") journal.stage(event);\n\n                return journal.prepare<Result>({\n                  value:\n                    decision._tag === \"Registered\" ? { _tag: \"RegistrationAccepted\" } : decision,\n                  credentialCommands:\n                    decision._tag === \"Rejected\"\n                      ? []\n                      : [\n                          { _tag: \"Clear\", slot: \"proof-continuation\" },\n                          { _tag: \"Clear\", slot: \"request-binding\" },\n                        ],\n                });\n              },\n            );\n          });\n\n          return Object.freeze({ commit });\n        }),\n      });\n    }),\n  );\n\n  const Request = makeOperation(`${moduleId}/registration/request`, {\n    payload: RequestInput,\n    success: ProofRequestReceipt,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n  });\n\n  const Resend = makeOperation(`${moduleId}/registration/resend`, {\n    payload: ResendInput,\n    success: ProofRequestReceipt,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n  });\n\n  const Attempt = makeOperation(`${moduleId}/registration/attempt`, {\n    payload: AttemptInput,\n    success: AttemptSuccess,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/registration/complete`, {\n    payload: CompleteInput,\n    success: Success,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    Request.handlerLayer(\n      Effect.fn(\"EmailRegistration.Request\")(function* (input) {\n        return yield* (yield* Registrations).request(input);\n      }),\n    ),\n    Resend.handlerLayer(\n      Effect.fn(\"EmailRegistration.Resend\")(function* (input) {\n        return yield* (yield* Registrations).request(input, input.supersedes);\n      }),\n    ),\n    Attempt.credentialHandlerLayer(\n      Effect.fn(\"EmailRegistration.Attempt\")(function* (input) {\n        return yield* (yield* Registrations).attempt(input);\n      }),\n    ),\n    Complete.credentialHandlerLayer(\n      Effect.fn(\"EmailRegistration.Complete\")(function* (input) {\n        const plan = yield* (yield* Registrations).planComplete(input);\n        const receipt = yield* plan.commit;\n        const result = yield* receipt.read.pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n        if (result.value._tag === \"Rejected\") return yield* EmailRejected.make({});\n\n        return { value: result.value, credentialCommands: result.credentialCommands };\n      }),\n    ),\n  );\n\n  return Object.freeze({\n    RegistrationAuthority,\n    Registrations,\n    layer,\n    proof,\n    handlersLayer,\n    operations: { Request, Resend, Attempt, Complete },\n    group: operationGroup(Request, Resend, Attempt, Complete),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;AA2BA,MAAM,UAAU,OAAO,MAAM;CAAC;CAAe;CAAkB;CAAwB;AAAU,CAAC;AAIlG,MAAM,UAAU,OAAO,MAAM,CAC3B,OAAO,aAAa,wBAAwB,CAAC,CAAC,GAC9C,OAAO,aAAa,uBAAuB,EACzC,WAAW,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,EAChE,CAAC,CACH,CAAC;AAED,MAAM,iBAAiB,OAAO,OAAO,EAAE,cAAc,kBAAkB,CAAC;AAExE,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,aAAa;CACtE,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,QAAQ,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;AAQ/D,MAAa,yBAKX,UACA,cACA,OACA,WACG;CACH,MAAM,oBAKF;CAEJ,MAAM,OAAO;EACX,QAAQ;EACR,gBAAgB;EAChB,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,KAAK,CAAC;EAC/E,cAAc;CAChB;CAEqB,OAAO,OAAO,IAAI;CAEvC,MAAM,eAAe,OAAO,OAAO;EACjC,GAAG;EACH,WAAW;EACX,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;CAC5D,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAAE,GAAG,aAAa;EAAQ,YAAY;CAAQ,CAAC;CAEjF,MAAM,eAAe,OAAO,OAAO;EACjC,GAAG;EACH,WAAW;EACX,QAAQ,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAChF,CAAC;CAED,MAAM,gBAAgB,OAAO,OAAO;EAClC,GAAG;EACH,WAAW;EACX,gBAAgB;EAChB,YAAY,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACpF,CAAC;CAED,MAAM,wBAAwB,QAAQ,QA+BpC,qBAAqB,SAAS,uBAAuB;CAWvD,MAAM,gBAAgB,QAAQ,QAY5B,qBAAqB,SAAS,eAAe;CAE/C,MAAM,QAAQ,MAAM,OAClB,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO;EAC/B,MAAM,SAAS,OAAO,MAAM;EAC5B,MAAM,YAAY,OAAO;EACzB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO,OAAO;EAE7B,MAAM,WAAW,OAAO,OAAO,QAE7B;EAKF,MAAM,YAAY,OAAO,YAAY,OAAO,OAAO,iBAAiB,CAAC;EAErE,MAAM,gBAAgB,SACpB,OAAO,aAAa,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KACnC,OAAO,QAAQ,OAAO,aAAa,SAAS,CAAC,GAC7C,OAAO,QAAQ,QAAQ,GACvB,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;EAEF,MAAM,QAAQ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACnD,OACA;GACA,MAAM,WAAW,OAAO,SACrB,OAAO,MAAM,QAAQ,MAAM,cAAc,CAAC,CAC1C,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;GAErD,MAAM,aAAa,OAAO,OACxB,gBAAgB,KAAK;IAAE,WAAW;IAAS,OAAO,MAAM;GAAM,CAAC,CACjE;GAEA,MAAM,OAAO,OAAO,aAAa,MAAM,YAAY;GAEnD,MAAM,YAAY,OAAO,UAAU,QAAQ;IACzC;IACA,cAAc,OAAO,aAAa,IAAI;GACxC,CAAC;GAED,MAAM,cAAc,OAAO,OAAO,aAAa,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,CACxF,UAAU,WACZ,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAEvD,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;IAChD;IACA;IACA,MAAM;IACN,SAAS;IACT,WAAW;IACX;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAExD,MAAM,SAAS,OAAO,OACnB,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CACpD,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAExD,MAAM,UAAwB;IAC5B,MAAM;IACN;IACA,QAAQ,MAAM;IACd,eAAe,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;GAClE;GAEA,OAAO;IAAE;IAAM;IAAY;IAAa,UAAU,UAAU;IAAU;GAAQ;EAChF,CAAC;EAED,OAAO,cAAc,GAAG;GACtB,SAAS,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,OAAO,YAAY;IAC5E,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,MAAM,KAAK;IAElC,MAAM,WAAW,OAAO,OACrB,aAAa;KACZ,WAAW,MAAM;KACjB,SAAS,QAAQ;KACjB,QAAQ,MAAM;KACd,UAAU,QAAQ;KAClB,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACnD,CAAC,CAAC,CACD,KACC,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEF,OAAO,SAAS,SAAS,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9E,OAAO,SAAS;GAClB,CAAC;GACD,SAAS,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,OAAO;IAChE,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,MAAM,KAAK;IAElC,MAAM,SAAS,OAAO,OACnB,eAAe;KACd,WAAW,MAAM;KACjB,YAAY,MAAM;KAClB,SAAS,QAAQ;IACnB,CAAC,CAAC,CACD,KACC,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;IAEF,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAEzE,OAAO;KACL,OAAO,EAAE,cAAc,OAAO,MAAM,aAAa;KACjD,oBAAoB,OAAO;IAC7B;GACF,CAAC;GACD,cAAc,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAAW,OAAO;IAC1E,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,MAAM,KAAK;IAElC,MAAM,aAAa,OAAO,OACvB,aAAa;KACZ,gBAAgB,MAAM;KACtB,YAAY,MAAM;KAClB,SAAS,QAAQ;IACnB,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;IAErD,MAAM,WAAW,kBAAkB;KACjC,QAAQ;KACR,WAAW,GAAG,SAAS;KACvB,QAAQ;KACR,aAAa,CAAC,QAAQ,UAAU;IAClC,CAAC;IAED,OAAO,MAAM,OAAO,QAAQ;IAE5B,MAAM,QAAQ,OAAO,OAClB,YAAY,EAAE,CAAC,CACf,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,QAAQ,eAAe;KAC3B,IAAI,iBAAiB,KAAK,SAAS,gBAAgB,KAAK,CAAC;KACzD,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;KAC5D;IACF,CAAC;IAED,MAAM,YAAY,MAAM;IAExB,MAAM,SAAS,OAAO,IAAI,aAAa;KAGrC,OAAO,QAAO,OAFO,sBAAA,CAED,kBAClB;MACE;MACA;MACA,YAAY,QAAQ;MACpB,cAAc,QAAQ;MACtB,aAAa,QAAQ;MACrB;KACF,IACC,UAAU,YAAY;MACrB,IAAI,SAAS,SAAS,cAAc,QAAQ,MAAM,KAAK;MAEvD,OAAO,QAAQ,QAAgB;OAC7B,OACE,SAAS,SAAS,eAAe,EAAE,MAAM,uBAAuB,IAAI;OACtE,oBACE,SAAS,SAAS,aACd,CAAC,IACD,CACE;QAAE,MAAM;QAAS,MAAM;OAAqB,GAC5C;QAAE,MAAM;QAAS,MAAM;OAAkB,CAC3C;MACR,CAAC;KACH,CACF;IACF,CAAC;IAED,OAAO,OAAO,OAAO,EAAE,OAAO,CAAC;GACjC,CAAC;EACH,CAAC;CACH,CAAC,CACH;CAEA,MAAM,UAAU,cAAc,GAAG,SAAS,wBAAwB;EAChE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,uBAAuB;EAC9D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,UAAU,cAAc,GAAG,SAAS,wBAAwB;EAChE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,yBAAyB;EAClE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,QAAQ,aACN,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,OAAO;EACvD,OAAO,QAAQ,OAAO,cAAA,CAAe,QAAQ,KAAK;CACpD,CAAC,CACH,GACA,OAAO,aACL,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,OAAO;EACtD,OAAO,QAAQ,OAAO,cAAA,CAAe,QAAQ,OAAO,MAAM,UAAU;CACtE,CAAC,CACH,GACA,QAAQ,uBACN,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,OAAO;EACvD,OAAO,QAAQ,OAAO,cAAA,CAAe,QAAQ,KAAK;CACpD,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAAO;EAGxD,MAAM,SAAS,QAAO,QADC,QADF,OAAO,cAAA,CAAe,aAAa,KAAK,EAAA,CACjC,OAAA,CACE,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;EAExF,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;EAEzE,OAAO;GAAE,OAAO,OAAO;GAAO,oBAAoB,OAAO;EAAmB;CAC9E,CAAC,CACH,CACF;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA,YAAY;GAAE;GAAS;GAAQ;GAAS;EAAS;EACjD,OAAO,eAAe,SAAS,QAAQ,SAAS,QAAQ;CAC1D,CAAC;AACH"}

package/dist/email/snapshot.mjs

@@ -0,0 +1,37 @@
+import { LoginIdentifier } from "../identity/models.mjs";
+import { AuthenticationRequirement } from "../sessions/models.mjs";
+import { EmailUnavailable } from "./errors.mjs";
+import { EmailCredentialSnapshot } from "./models.mjs";
+import { Array, Effect, Schema } from "effect";
+//#region src/email/snapshot.ts
+const snapshotEmailRevision = (value) => Object.freeze({
+	subjectId: value.subjectId,
+	securityRevision: value.securityRevision,
+	credentials: Object.freeze(value.credentials.map((item) => Object.freeze({
+		credentialId: item.credentialId,
+		revision: item.revision
+	})))
+});
+const codec = Schema.toCodecIso(EmailCredentialSnapshot);
+const snapshotEmailCredential = Effect.fn("Email.snapshotCredential")(function* (input) {
+	const value = yield* Schema.encodeEffect(codec)(input).pipe(Effect.flatMap(Schema.decodeEffect(codec)), Effect.mapError(() => EmailUnavailable.make({})));
+	return Object.freeze({
+		...value,
+		identifier: Object.freeze(LoginIdentifier.make(value.identifier)),
+		revision: snapshotEmailRevision(value.revision)
+	});
+});
+const snapshotEmailRequirement = Effect.fn("Email.snapshotRequirement")(function* (input) {
+	const value = yield* Schema.decodeEffect(AuthenticationRequirement)(input).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+	return Object.freeze({
+		...value,
+		alternatives: Object.freeze(Array.map(value.alternatives, (item) => Object.freeze({
+			...item,
+			factors: Object.freeze([...item.factors])
+		})))
+	});
+});
+//#endregion
+export { snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision };
+
+//# sourceMappingURL=snapshot.mjs.map

package/dist/email/snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../src/email/snapshot.ts"],"sourcesContent":["import { Array, Effect, Schema } from \"effect\";\n\nimport { LoginIdentifier } from \"../identity/models\";\nimport { AuthenticationRequirement, type AuthenticationRevision } from \"../sessions/models\";\nimport { EmailUnavailable } from \"./errors\";\nimport { EmailCredentialSnapshot } from \"./models\";\n\nexport const snapshotEmailRevision = (value: AuthenticationRevision): AuthenticationRevision =>\n  Object.freeze({\n    subjectId: value.subjectId,\n    securityRevision: value.securityRevision,\n    credentials: Object.freeze(\n      value.credentials.map((item) =>\n        Object.freeze({ credentialId: item.credentialId, revision: item.revision }),\n      ),\n    ),\n  });\n\nconst codec = Schema.toCodecIso(EmailCredentialSnapshot);\n\nexport const snapshotEmailCredential = Effect.fn(\"Email.snapshotCredential\")(function* (\n  input: EmailCredentialSnapshot,\n) {\n  const value = yield* Schema.encodeEffect(codec)(input).pipe(\n    Effect.flatMap(Schema.decodeEffect(codec)),\n    Effect.mapError(() => EmailUnavailable.make({})),\n  );\n\n  return Object.freeze({\n    ...value,\n    identifier: Object.freeze(LoginIdentifier.make(value.identifier)),\n    revision: snapshotEmailRevision(value.revision),\n  });\n});\n\nexport const snapshotEmailRequirement = Effect.fn(\"Email.snapshotRequirement\")(function* (\n  input: AuthenticationRequirement,\n) {\n  const value = yield* Schema.decodeEffect(AuthenticationRequirement)(input).pipe(\n    Effect.mapError(() => EmailUnavailable.make({})),\n  );\n\n  return Object.freeze({\n    ...value,\n    alternatives: Object.freeze(\n      Array.map(value.alternatives, (item) =>\n        Object.freeze({ ...item, factors: Object.freeze([...item.factors]) }),\n      ),\n    ),\n  });\n});\n"],"mappings":";;;;;;AAOA,MAAa,yBAAyB,UACpC,OAAO,OAAO;CACZ,WAAW,MAAM;CACjB,kBAAkB,MAAM;CACxB,aAAa,OAAO,OAClB,MAAM,YAAY,KAAK,SACrB,OAAO,OAAO;EAAE,cAAc,KAAK;EAAc,UAAU,KAAK;CAAS,CAAC,CAC5E,CACF;AACF,CAAC;AAEH,MAAM,QAAQ,OAAO,WAAW,uBAAuB;AAEvD,MAAa,0BAA0B,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC3E,OACA;CACA,MAAM,QAAQ,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KACrD,OAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,GACzC,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,YAAY,OAAO,OAAO,gBAAgB,KAAK,MAAM,UAAU,CAAC;EAChE,UAAU,sBAAsB,MAAM,QAAQ;CAChD,CAAC;AACH,CAAC;AAED,MAAa,2BAA2B,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC7E,OACA;CACA,MAAM,QAAQ,OAAO,OAAO,aAAa,yBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,KACzE,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,cAAc,OAAO,OACnB,MAAM,IAAI,MAAM,eAAe,SAC7B,OAAO,OAAO;GAAE,GAAG;GAAM,SAAS,OAAO,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;EAAE,CAAC,CACtE,CACF;CACF,CAAC;AACH,CAAC"}

package/dist/hooks/LifecycleHooks.d.mts

@@ -0,0 +1,34 @@
+import { HookConfigurationError, HookDelivery, HookDeliveryFailed, HookDenied, LifecycleEvent, LifecycleSnapshot } from "./models.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/hooks/LifecycleHooks.d.ts
+interface HookHandlers<R = never, E = HookDeliveryFailed> {
+  readonly before?: (snapshot: LifecycleSnapshot) => Effect.Effect<void, HookDenied, R>;
+  readonly after?: (event: LifecycleEvent) => Effect.Effect<void, E, R>;
+}
+type HookContributionId<Tag extends string> = Tag extends string ? {
+  readonly _tag: "effect-auth/HookContribution";
+  readonly id: Tag;
+} : never;
+/** Each contribution owns a distinct service key; only composeHooks creates LifecycleHooks. */
+declare const hookContribution: <const Tag extends string>(id: Tag) => Readonly<{
+  id: Tag;
+  resolve: Effect.Effect<HookHandlers<never, HookDeliveryFailed>, never, HookContributionId<Tag>>;
+  layer: <R, E>(handlers: HookHandlers<R, E>) => Layer.Layer<HookContributionId<Tag>, never, Exclude<R, import("effect/Scope").Scope>>;
+}>;
+interface HookContribution<Tag extends string> {
+  readonly id: Tag;
+  readonly resolve: Effect.Effect<HookHandlers, never, HookContributionId<Tag>>;
+}
+type AnyHookContribution = HookContribution<string>;
+declare const LifecycleHooks_base: Context.ServiceClass<LifecycleHooks, "effect-auth/LifecycleHooks", {
+  readonly before: (snapshot: LifecycleSnapshot) => Effect.Effect<void, HookDenied>;
+  /** Runs in declaration order, collecting failures and continuing with later hooks. */
+  readonly after: (event: LifecycleEvent) => Effect.Effect<ReadonlyArray<HookDelivery>>;
+}>;
+declare class LifecycleHooks extends LifecycleHooks_base {
+  static readonly empty: Layer.Layer<LifecycleHooks, never, never>;
+}
+declare const composeHooks: <const Tag extends string>(...contributions: ReadonlyArray<HookContribution<Tag>>) => Layer.Layer<LifecycleHooks, HookConfigurationError, Exclude<HookContributionId<Tag>, import("effect/Scope").Scope>>;
+//#endregion
+export { AnyHookContribution, HookContribution, HookContributionId, HookHandlers, LifecycleHooks, composeHooks, hookContribution };
+//# sourceMappingURL=LifecycleHooks.d.mts.map

package/dist/hooks/LifecycleHooks.mjs

@@ -0,0 +1,74 @@
+import { HookConfigurationError, HookDeliveryFailed, lifecycleEvent, lifecycleSnapshot } from "./models.mjs";
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { Cause, Context, Effect, Layer } from "effect";
+//#region src/hooks/LifecycleHooks.ts
+/** Each contribution owns a distinct service key; only composeHooks creates LifecycleHooks. */
+const hookContribution = (id) => {
+	const service = Context.Service(`effect-auth/hooks/${id}`);
+	const layer = (handlers) => {
+		const { before, after } = handlers;
+		return Layer.effect(service, Effect.gen(function* () {
+			const services = yield* Effect.context();
+			return {
+				before: before === void 0 ? void 0 : (snapshot) => before(snapshot).pipe(Effect.provide(services)),
+				after: after === void 0 ? void 0 : (event) => after(event).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => HookDeliveryFailed.make({})))), Effect.provide(services))
+			};
+		}));
+	};
+	return Object.freeze({
+		id,
+		resolve: Effect.service(service),
+		layer
+	});
+};
+var LifecycleHooks = class LifecycleHooks extends Context.Service()("effect-auth/LifecycleHooks") {
+	static empty = Layer.succeed(LifecycleHooks, {
+		before: () => Effect.void,
+		after: () => Effect.succeed([])
+	});
+};
+const composeHooks = (...contributions) => {
+	const entries = contributions.map(({ id, resolve }) => Object.freeze({
+		id,
+		resolve
+	}));
+	return Layer.effect(LifecycleHooks, Effect.gen(function* () {
+		const ids = /* @__PURE__ */ new Set();
+		for (const contribution of entries) {
+			if (ids.has(contribution.id)) return yield* HookConfigurationError.make({
+				reason: "duplicate-contribution",
+				contribution: contribution.id
+			});
+			ids.add(contribution.id);
+		}
+		const handlers = yield* Effect.forEach(entries, (contribution) => Effect.map(contribution.resolve, (handler) => ({
+			id: contribution.id,
+			handler
+		})));
+		return {
+			before: Effect.fn("LifecycleHooks.before")(function* (input) {
+				const snapshot = lifecycleSnapshot(input);
+				for (const { handler } of handlers) if (handler.before !== void 0) yield* handler.before(snapshot);
+			}),
+			after: Effect.fn("LifecycleHooks.after")(function* (input) {
+				const event = lifecycleEvent(input);
+				const reports = [];
+				for (const { id, handler } of handlers) {
+					if (handler.after === void 0) continue;
+					const exit = yield* Effect.exit(Effect.suspend(() => handler.after(event)));
+					if (exit._tag === "Failure") yield* reportAuthFailure("after-hook", exit.cause);
+					reports.push({
+						eventId: event.id,
+						contribution: id,
+						status: exit._tag === "Success" ? "delivered" : "failed"
+					});
+				}
+				return reports;
+			}, Effect.uninterruptible)
+		};
+	}));
+};
+//#endregion
+export { LifecycleHooks, composeHooks, hookContribution };
+
+//# sourceMappingURL=LifecycleHooks.mjs.map

package/dist/hooks/LifecycleHooks.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"LifecycleHooks.mjs","names":[],"sources":["../../src/hooks/LifecycleHooks.ts"],"sourcesContent":["import { Cause, Context, Effect, Layer } from \"effect\";\n\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport {\n  HookConfigurationError,\n  HookDeliveryFailed,\n  type HookDelivery,\n  type HookDenied,\n  type LifecycleEvent,\n  type LifecycleSnapshot,\n  lifecycleEvent,\n  lifecycleSnapshot,\n} from \"./models\";\n\nexport interface HookHandlers<R = never, E = HookDeliveryFailed> {\n  readonly before?: (snapshot: LifecycleSnapshot) => Effect.Effect<void, HookDenied, R>;\n  readonly after?: (event: LifecycleEvent) => Effect.Effect<void, E, R>;\n}\n\nexport type HookContributionId<Tag extends string> = Tag extends string\n  ? {\n      readonly _tag: \"effect-auth/HookContribution\";\n      readonly id: Tag;\n    }\n  : never;\n\n/** Each contribution owns a distinct service key; only composeHooks creates LifecycleHooks. */\nexport const hookContribution = <const Tag extends string>(id: Tag) => {\n  const service = Context.Service<HookContributionId<Tag>, HookHandlers>(`effect-auth/hooks/${id}`);\n\n  const layer = <R, E>(handlers: HookHandlers<R, E>) => {\n    const { before, after } = handlers;\n\n    return Layer.effect(\n      service,\n      Effect.gen(function* () {\n        const services = yield* Effect.context<R>();\n\n        return {\n          before:\n            before === undefined\n              ? undefined\n              : (snapshot: LifecycleSnapshot) => before(snapshot).pipe(Effect.provide(services)),\n          after:\n            after === undefined\n              ? undefined\n              : (event: LifecycleEvent) =>\n                  after(event).pipe(\n                    Effect.catchCause((cause) =>\n                      Effect.failCause(Cause.map(cause, () => HookDeliveryFailed.make({}))),\n                    ),\n                    Effect.provide(services),\n                  ),\n        };\n      }),\n    );\n  };\n\n  return Object.freeze({ id, resolve: Effect.service(service), layer });\n};\n\nexport interface HookContribution<Tag extends string> {\n  readonly id: Tag;\n  readonly resolve: Effect.Effect<HookHandlers, never, HookContributionId<Tag>>;\n}\n\nexport type AnyHookContribution = HookContribution<string>;\n\nexport class LifecycleHooks extends Context.Service<\n  LifecycleHooks,\n  {\n    readonly before: (snapshot: LifecycleSnapshot) => Effect.Effect<void, HookDenied>;\n    /** Runs in declaration order, collecting failures and continuing with later hooks. */\n    readonly after: (event: LifecycleEvent) => Effect.Effect<ReadonlyArray<HookDelivery>>;\n  }\n>()(\"effect-auth/LifecycleHooks\") {\n  static readonly empty = Layer.succeed(LifecycleHooks, {\n    before: () => Effect.void,\n    after: () => Effect.succeed([]),\n  });\n}\n\nexport const composeHooks = <const Tag extends string>(\n  ...contributions: ReadonlyArray<HookContribution<Tag>>\n) => {\n  const entries = contributions.map(({ id, resolve }) => Object.freeze({ id, resolve }));\n\n  return Layer.effect(\n    LifecycleHooks,\n    Effect.gen(function* () {\n      const ids = new Set<string>();\n\n      for (const contribution of entries) {\n        if (ids.has(contribution.id))\n          return yield* HookConfigurationError.make({\n            reason: \"duplicate-contribution\",\n            contribution: contribution.id,\n          });\n        ids.add(contribution.id);\n      }\n\n      const handlers = yield* Effect.forEach(entries, (contribution) =>\n        Effect.map(contribution.resolve, (handler) => ({ id: contribution.id, handler })),\n      );\n\n      return {\n        before: Effect.fn(\"LifecycleHooks.before\")(function* (input: LifecycleSnapshot) {\n          const snapshot = lifecycleSnapshot(input);\n\n          for (const { handler } of handlers) {\n            if (handler.before !== undefined) yield* handler.before(snapshot);\n          }\n        }),\n        after: Effect.fn(\"LifecycleHooks.after\")(function* (input: LifecycleEvent) {\n          const event = lifecycleEvent(input);\n          const reports: HookDelivery[] = [];\n\n          for (const { id, handler } of handlers) {\n            if (handler.after === undefined) continue;\n            const exit = yield* Effect.exit(Effect.suspend(() => handler.after!(event)));\n\n            if (exit._tag === \"Failure\") yield* reportAuthFailure(\"after-hook\", exit.cause);\n\n            reports.push({\n              eventId: event.id,\n              contribution: id,\n              status: exit._tag === \"Success\" ? \"delivered\" : \"failed\",\n            });\n          }\n\n          return reports;\n        }, Effect.uninterruptible),\n      };\n    }),\n  );\n};\n"],"mappings":";;;;;AA2BA,MAAa,oBAA8C,OAAY;CACrE,MAAM,UAAU,QAAQ,QAA+C,qBAAqB,IAAI;CAEhG,MAAM,SAAe,aAAiC;EACpD,MAAM,EAAE,QAAQ,UAAU;EAE1B,OAAO,MAAM,OACX,SACA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,OAAO,QAAW;GAE1C,OAAO;IACL,QACE,WAAW,KAAA,IACP,KAAA,KACC,aAAgC,OAAO,QAAQ,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC;IACrF,OACE,UAAU,KAAA,IACN,KAAA,KACC,UACC,MAAM,KAAK,CAAC,CAAC,KACX,OAAO,YAAY,UACjB,OAAO,UAAU,MAAM,IAAI,aAAa,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CACtE,GACA,OAAO,QAAQ,QAAQ,CACzB;GACV;EACF,CAAC,CACH;CACF;CAEA,OAAO,OAAO,OAAO;EAAE;EAAI,SAAS,OAAO,QAAQ,OAAO;EAAG;CAAM,CAAC;AACtE;AASA,IAAa,iBAAb,MAAa,uBAAuB,QAAQ,QAO1C,CAAC,CAAC,4BAA4B,CAAC,CAAC;CAChC,OAAgB,QAAQ,MAAM,QAAQ,gBAAgB;EACpD,cAAc,OAAO;EACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;CAChC,CAAC;AACH;AAEA,MAAa,gBACX,GAAG,kBACA;CACH,MAAM,UAAU,cAAc,KAAK,EAAE,IAAI,cAAc,OAAO,OAAO;EAAE;EAAI;CAAQ,CAAC,CAAC;CAErF,OAAO,MAAM,OACX,gBACA,OAAO,IAAI,aAAa;EACtB,MAAM,sBAAM,IAAI,IAAY;EAE5B,KAAK,MAAM,gBAAgB,SAAS;GAClC,IAAI,IAAI,IAAI,aAAa,EAAE,GACzB,OAAO,OAAO,uBAAuB,KAAK;IACxC,QAAQ;IACR,cAAc,aAAa;GAC7B,CAAC;GACH,IAAI,IAAI,aAAa,EAAE;EACzB;EAEA,MAAM,WAAW,OAAO,OAAO,QAAQ,UAAU,iBAC/C,OAAO,IAAI,aAAa,UAAU,aAAa;GAAE,IAAI,aAAa;GAAI;EAAQ,EAAE,CAClF;EAEA,OAAO;GACL,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAA0B;IAC9E,MAAM,WAAW,kBAAkB,KAAK;IAExC,KAAK,MAAM,EAAE,aAAa,UACxB,IAAI,QAAQ,WAAW,KAAA,GAAW,OAAO,QAAQ,OAAO,QAAQ;GAEpE,CAAC;GACD,OAAO,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAuB;IACzE,MAAM,QAAQ,eAAe,KAAK;IAClC,MAAM,UAA0B,CAAC;IAEjC,KAAK,MAAM,EAAE,IAAI,aAAa,UAAU;KACtC,IAAI,QAAQ,UAAU,KAAA,GAAW;KACjC,MAAM,OAAO,OAAO,OAAO,KAAK,OAAO,cAAc,QAAQ,MAAO,KAAK,CAAC,CAAC;KAE3E,IAAI,KAAK,SAAS,WAAW,OAAO,kBAAkB,cAAc,KAAK,KAAK;KAE9E,QAAQ,KAAK;MACX,SAAS,MAAM;MACf,cAAc;MACd,QAAQ,KAAK,SAAS,YAAY,cAAc;KAClD,CAAC;IACH;IAEA,OAAO;GACT,GAAG,OAAO,eAAe;EAC3B;CACF,CAAC,CACH;AACF"}

package/dist/hooks/commit.d.mts

@@ -0,0 +1,66 @@
+import { HookConfigurationError, HookDelivery, LifecycleEvent, LifecycleEventId } from "./models.mjs";
+import { LifecycleHooks } from "./LifecycleHooks.mjs";
+import { AtomicContribution, CommitMode } from "./transactions.mjs";
+import { Cause, Context, Effect, Schema } from "effect";
+//#region src/hooks/commit.d.ts
+declare const CommitPending_base: Schema.Class<CommitPending, Schema.TaggedStruct<"CommitPending", {}>, Cause.YieldableError>;
+declare class CommitPending extends CommitPending_base {}
+declare const CommitDiscarded_base: Schema.Class<CommitDiscarded, Schema.TaggedStruct<"CommitDiscarded", {}>, Cause.YieldableError>;
+declare class CommitDiscarded extends CommitDiscarded_base {}
+/** No value is exposed until the outermost transaction authority has committed. */
+interface PreparedCommit<A> {
+  readonly _tag: "PreparedCommit";
+  readonly read: Effect.Effect<A, CommitPending | CommitDiscarded>;
+}
+interface CommitJournal {
+  readonly prepare: <A>(value: A) => PreparedCommit<A>;
+  /** Stage only work belonging to this transaction/savepoint, before its commit returns. */
+  readonly stage: (event: LifecycleEvent) => void;
+  /** Call only after staging this event's outbox write in the same transaction/batch. */
+  readonly defer: (event: LifecycleEvent) => void;
+}
+declare const CurrentCommitJournal_base: Context.ServiceClass<CurrentCommitJournal, "effect-auth/hooks/CurrentCommitJournal", CommitJournal>;
+/** Current journal for internal transaction operations. Public commit-owner
+ * continuations still receive the journal explicitly at the native boundary. */
+declare class CurrentCommitJournal extends CurrentCommitJournal_base {}
+/** Public operations may reject unsupported ambient execution before any mutation. */
+declare const hasCommitScope: Effect.Effect<boolean, never, never>;
+type CommitResult<A> = {
+  readonly _tag: "PendingCommit";
+  readonly value: A;
+} | {
+  readonly _tag: "Committed";
+  readonly value: A;
+  readonly delivery: ReadonlyArray<HookDelivery>;
+  readonly deferred: ReadonlyArray<LifecycleEventId>;
+};
+/**
+ * `owner` must resolve only after its real transaction or batch commits. Nested
+ * calls inherit the outer journal; their events are discarded on failure and
+ * cannot dispatch until the outermost owner succeeds. Wrap a caught savepoint
+ * rollback in its own coordinateCommit call so its events are discarded too.
+ * Direct delivery is best effort: a process crash loses staged memory and no
+ * retry is automatic. Once the owner returns, interruption is masked during
+ * dispatch; that makes reporting coherent, not durable. An outbox owner stages
+ * its writes before calling journal.defer and owns worker retries/deduplication.
+ */
+declare const coordinateCommit: <A, E, R>(owner: (journal: CommitJournal) => Effect.Effect<A, E, R>, options: {
+  readonly mode: CommitMode;
+  readonly contributions?: ReadonlyArray<AtomicContribution>;
+}) => Effect.Effect<CommitResult<A>, E | HookConfigurationError, Exclude<R, CurrentCommitJournal> | LifecycleHooks>;
+/**
+ * An outbox implementation stages this immutable event in the same authority's
+ * transaction/batch. A delivery worker later calls LifecycleHooks.after(event),
+ * retaining the same ID on every attempt and deduplicating each contribution.
+ * Delivery is at least once when the consumer provides persistence and retries;
+ * this interface alone supplies no persistence or exactly-once guarantee.
+ */
+interface EventOutbox<E = never, R = never> {
+  readonly stage: (event: LifecycleEvent) => Effect.Effect<void, E, R>;
+}
+interface BatchEventOutbox<Statement> {
+  readonly statements: (event: LifecycleEvent) => ReadonlyArray<Statement>;
+}
+//#endregion
+export { BatchEventOutbox, CommitDiscarded, CommitJournal, CommitPending, CommitResult, CurrentCommitJournal, EventOutbox, PreparedCommit, coordinateCommit, hasCommitScope };
+//# sourceMappingURL=commit.d.mts.map