@yielded/auth 0.1.0-beta.1

package/dist/http/endpoints/request-email-otp.d.mts

@@ -0,0 +1,8 @@
+import { AuthRateLimited, AuthUnavailable, InvalidAuthRequest } from "../../Errors.mjs";
+import { RequestEmailOtpPayload } from "../models.mjs";
+import { HttpApiEndpoint } from "effect/unstable/httpapi";
+//#region src/http/endpoints/request-email-otp.d.ts
+declare const RequestEmailOtpEndpoint: HttpApiEndpoint.HttpApiEndpoint<"requestEmailOtp", "POST", "/auth/email-otp", never, never, import("effect/Schema").toCodecJson<typeof RequestEmailOtpPayload>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Void>, import("effect/Schema").toCodecJson<typeof InvalidAuthRequest | typeof AuthRateLimited | typeof AuthUnavailable>, never, never>;
+//#endregion
+export { RequestEmailOtpEndpoint };
+//# sourceMappingURL=request-email-otp.d.mts.map

package/dist/http/endpoints/request-email-otp.mjs

@@ -0,0 +1,17 @@
+import { AuthRateLimited, AuthUnavailable, InvalidAuthRequest } from "../../Errors.mjs";
+import { RequestEmailOtpPayload } from "../models.mjs";
+import { HttpApiEndpoint, HttpApiSchema } from "effect/unstable/httpapi";
+//#region src/http/endpoints/request-email-otp.ts
+const RequestEmailOtpEndpoint = HttpApiEndpoint.post("requestEmailOtp", "/auth/email-otp", {
+	payload: RequestEmailOtpPayload,
+	success: HttpApiSchema.Empty(202),
+	error: [
+		InvalidAuthRequest,
+		AuthRateLimited,
+		AuthUnavailable
+	]
+});
+//#endregion
+export { RequestEmailOtpEndpoint };
+
+//# sourceMappingURL=request-email-otp.mjs.map

package/dist/http/endpoints/request-email-otp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-email-otp.mjs","names":[],"sources":["../../../src/http/endpoints/request-email-otp.ts"],"sourcesContent":["import { HttpApiEndpoint, HttpApiSchema } from \"effect/unstable/httpapi\";\n\nimport { AuthRateLimited, AuthUnavailable, InvalidAuthRequest } from \"../../Errors\";\nimport { RequestEmailOtpPayload } from \"../models\";\n\nexport const RequestEmailOtpEndpoint = HttpApiEndpoint.post(\"requestEmailOtp\", \"/auth/email-otp\", {\n  payload: RequestEmailOtpPayload,\n  success: HttpApiSchema.Empty(202),\n  error: [InvalidAuthRequest, AuthRateLimited, AuthUnavailable],\n});\n"],"mappings":";;;;AAKA,MAAa,0BAA0B,gBAAgB,KAAK,mBAAmB,mBAAmB;CAChG,SAAS;CACT,SAAS,cAAc,MAAM,GAAG;CAChC,OAAO;EAAC;EAAoB;EAAiB;CAAe;AAC9D,CAAC"}

package/dist/http/endpoints/set-password.d.mts

@@ -0,0 +1,9 @@
+import { AuthRateLimited, AuthUnavailable, InvalidAuthRequest, InvalidCredentials } from "../../Errors.mjs";
+import { SetPasswordPayload } from "../models.mjs";
+import { SessionMiddleware } from "../security.mjs";
+import { HttpApiEndpoint, HttpApiSchema } from "effect/unstable/httpapi";
+//#region src/http/endpoints/set-password.d.ts
+declare const SetPasswordEndpoint: HttpApiEndpoint.HttpApiEndpoint<"setPassword", "POST", "/auth/password", never, never, import("effect/Schema").toCodecJson<typeof SetPasswordPayload>, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, import("effect/Schema").toCodecJson<typeof InvalidCredentials | typeof InvalidAuthRequest | typeof AuthRateLimited | typeof AuthUnavailable>, SessionMiddleware, never>;
+//#endregion
+export { SetPasswordEndpoint };
+//# sourceMappingURL=set-password.d.mts.map

package/dist/http/endpoints/set-password.mjs

@@ -0,0 +1,19 @@
+import { AuthRateLimited, AuthUnavailable, InvalidAuthRequest, InvalidCredentials } from "../../Errors.mjs";
+import { SetPasswordPayload } from "../models.mjs";
+import { SessionMiddleware } from "../security.mjs";
+import { HttpApiEndpoint, HttpApiSchema } from "effect/unstable/httpapi";
+//#region src/http/endpoints/set-password.ts
+const SetPasswordEndpoint = HttpApiEndpoint.post("setPassword", "/auth/password", {
+	payload: SetPasswordPayload,
+	success: HttpApiSchema.NoContent,
+	error: [
+		InvalidAuthRequest,
+		InvalidCredentials,
+		AuthRateLimited,
+		AuthUnavailable
+	]
+}).middleware(SessionMiddleware);
+//#endregion
+export { SetPasswordEndpoint };
+
+//# sourceMappingURL=set-password.mjs.map

package/dist/http/endpoints/set-password.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-password.mjs","names":[],"sources":["../../../src/http/endpoints/set-password.ts"],"sourcesContent":["import { HttpApiEndpoint, HttpApiSchema } from \"effect/unstable/httpapi\";\n\nimport {\n  AuthRateLimited,\n  AuthUnavailable,\n  InvalidAuthRequest,\n  InvalidCredentials,\n} from \"../../Errors\";\nimport { SetPasswordPayload } from \"../models\";\nimport { SessionMiddleware } from \"../security\";\n\nexport const SetPasswordEndpoint = HttpApiEndpoint.post(\"setPassword\", \"/auth/password\", {\n  payload: SetPasswordPayload,\n  success: HttpApiSchema.NoContent,\n  // Wrong current passwords share the sign-in failure accounting, so a\n  // locked credential answers 429 here as well.\n  error: [InvalidAuthRequest, InvalidCredentials, AuthRateLimited, AuthUnavailable],\n}).middleware(SessionMiddleware);\n"],"mappings":";;;;;AAWA,MAAa,sBAAsB,gBAAgB,KAAK,eAAe,kBAAkB;CACvF,SAAS;CACT,SAAS,cAAc;CAGvB,OAAO;EAAC;EAAoB;EAAoB;EAAiB;CAAe;AAClF,CAAC,CAAC,CAAC,WAAW,iBAAiB"}

package/dist/http/endpoints/sign-out.d.mts

@@ -0,0 +1,6 @@
+import { HttpApiEndpoint, HttpApiSchema } from "effect/unstable/httpapi";
+//#region src/http/endpoints/sign-out.d.ts
+declare const SignOutEndpoint: HttpApiEndpoint.HttpApiEndpoint<"signOut", "POST", "/auth/sign-out", never, never, never, never, import("effect/Schema").toCodecJson<HttpApiSchema.NoContent>, never, never, never>;
+//#endregion
+export { SignOutEndpoint };
+//# sourceMappingURL=sign-out.d.mts.map

package/dist/http/endpoints/sign-out.mjs

@@ -0,0 +1,7 @@
+import { HttpApiEndpoint, HttpApiSchema } from "effect/unstable/httpapi";
+//#region src/http/endpoints/sign-out.ts
+const SignOutEndpoint = HttpApiEndpoint.post("signOut", "/auth/sign-out", { success: HttpApiSchema.NoContent });
+//#endregion
+export { SignOutEndpoint };
+
+//# sourceMappingURL=sign-out.mjs.map

package/dist/http/endpoints/sign-out.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out.mjs","names":[],"sources":["../../../src/http/endpoints/sign-out.ts"],"sourcesContent":["import { HttpApiEndpoint, HttpApiSchema } from \"effect/unstable/httpapi\";\n\nexport const SignOutEndpoint = HttpApiEndpoint.post(\"signOut\", \"/auth/sign-out\", {\n  success: HttpApiSchema.NoContent,\n});\n"],"mappings":";;AAEA,MAAa,kBAAkB,gBAAgB,KAAK,WAAW,kBAAkB,EAC/E,SAAS,cAAc,UACzB,CAAC"}

package/dist/http/endpoints/verify-email-otp.d.mts

@@ -0,0 +1,9 @@
+import { AuthUnavailable, InvalidAuthRequest, InvalidEmailOtp } from "../../Errors.mjs";
+import { ExistingSessionResult, RegistrationRequiredResult, VerifyEmailOtpPayload } from "../models.mjs";
+import { ChallengeMiddleware } from "../security.mjs";
+import { HttpApiEndpoint } from "effect/unstable/httpapi";
+//#region src/http/endpoints/verify-email-otp.d.ts
+declare const VerifyEmailOtpEndpoint: HttpApiEndpoint.HttpApiEndpoint<"verifyEmailOtp", "POST", "/auth/email-otp/verify", never, never, import("effect/Schema").toCodecJson<typeof VerifyEmailOtpPayload>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Union<readonly [typeof ExistingSessionResult, typeof RegistrationRequiredResult]>>, import("effect/Schema").toCodecJson<typeof InvalidEmailOtp | typeof InvalidAuthRequest | typeof AuthUnavailable>, ChallengeMiddleware, never>;
+//#endregion
+export { VerifyEmailOtpEndpoint };
+//# sourceMappingURL=verify-email-otp.d.mts.map

package/dist/http/endpoints/verify-email-otp.mjs

@@ -0,0 +1,18 @@
+import { AuthUnavailable, InvalidAuthRequest, InvalidEmailOtp } from "../../Errors.mjs";
+import { VerifyEmailOtpPayload, VerifyEmailOtpResult } from "../models.mjs";
+import { ChallengeMiddleware } from "../security.mjs";
+import { HttpApiEndpoint } from "effect/unstable/httpapi";
+//#region src/http/endpoints/verify-email-otp.ts
+const VerifyEmailOtpEndpoint = HttpApiEndpoint.post("verifyEmailOtp", "/auth/email-otp/verify", {
+	payload: VerifyEmailOtpPayload,
+	success: VerifyEmailOtpResult,
+	error: [
+		InvalidAuthRequest,
+		InvalidEmailOtp,
+		AuthUnavailable
+	]
+}).middleware(ChallengeMiddleware);
+//#endregion
+export { VerifyEmailOtpEndpoint };
+
+//# sourceMappingURL=verify-email-otp.mjs.map

package/dist/http/endpoints/verify-email-otp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-email-otp.mjs","names":[],"sources":["../../../src/http/endpoints/verify-email-otp.ts"],"sourcesContent":["import { HttpApiEndpoint } from \"effect/unstable/httpapi\";\n\nimport { AuthUnavailable, InvalidAuthRequest, InvalidEmailOtp } from \"../../Errors\";\nimport { VerifyEmailOtpPayload, VerifyEmailOtpResult } from \"../models\";\nimport { ChallengeMiddleware } from \"../security\";\n\nexport const VerifyEmailOtpEndpoint = HttpApiEndpoint.post(\n  \"verifyEmailOtp\",\n  \"/auth/email-otp/verify\",\n  {\n    payload: VerifyEmailOtpPayload,\n    success: VerifyEmailOtpResult,\n    error: [InvalidAuthRequest, InvalidEmailOtp, AuthUnavailable],\n  },\n).middleware(ChallengeMiddleware);\n"],"mappings":";;;;;AAMA,MAAa,yBAAyB,gBAAgB,KACpD,kBACA,0BACA;CACE,SAAS;CACT,SAAS;CACT,OAAO;EAAC;EAAoB;EAAiB;CAAe;AAC9D,CACF,CAAC,CAAC,WAAW,mBAAmB"}

package/dist/http/models.d.mts

@@ -0,0 +1,49 @@
+import { SessionSummary } from "../Schema.mjs";
+import { Schema } from "effect";
+//#region src/http/models.d.ts
+declare const RequestEmailOtpPayload_base: Schema.Class<RequestEmailOtpPayload, Schema.Struct<{
+  readonly email: Schema.String;
+}>, {}>;
+declare class RequestEmailOtpPayload extends RequestEmailOtpPayload_base {}
+declare const VerifyEmailOtpPayload_base: Schema.Class<VerifyEmailOtpPayload, Schema.Struct<{
+  readonly code: Schema.Redacted<Schema.String>;
+}>, {}>;
+declare class VerifyEmailOtpPayload extends VerifyEmailOtpPayload_base {}
+declare const PasswordSignInPayload_base: Schema.Class<PasswordSignInPayload, Schema.Struct<{
+  readonly email: Schema.String;
+  readonly password: Schema.Redacted<Schema.String>;
+}>, {}>;
+declare class PasswordSignInPayload extends PasswordSignInPayload_base {}
+declare const SetPasswordPayload_base: Schema.Class<SetPasswordPayload, Schema.Struct<{
+  /** Required whenever the subject already has a password credential. */
+  readonly currentPassword: Schema.optionalKey<Schema.Redacted<Schema.String>>;
+  readonly newPassword: Schema.Redacted<Schema.String>;
+}>, {}>;
+declare class SetPasswordPayload extends SetPasswordPayload_base {}
+declare const ExistingSessionResult_base: Schema.Class<ExistingSessionResult, Schema.TaggedStruct<"ExistingSession", {
+  readonly session: typeof SessionSummary;
+}>, {}>;
+declare class ExistingSessionResult extends ExistingSessionResult_base {}
+declare const RegistrationRequiredResult_base: Schema.Class<RegistrationRequiredResult, Schema.TaggedStruct<"RegistrationRequired", {
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly registrationExpiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+declare class RegistrationRequiredResult extends RegistrationRequiredResult_base {}
+declare const VerifyEmailOtpResult: Schema.Union<readonly [typeof ExistingSessionResult, typeof RegistrationRequiredResult]>;
+type VerifyEmailOtpResult = typeof VerifyEmailOtpResult.Type;
+declare const SessionStateAnonymous_base: Schema.Class<SessionStateAnonymous, Schema.TaggedStruct<"Anonymous", {}>, {}>;
+declare class SessionStateAnonymous extends SessionStateAnonymous_base {}
+declare const SessionStateRegistrationRequired_base: Schema.Class<SessionStateRegistrationRequired, Schema.TaggedStruct<"RegistrationRequired", {
+  readonly email: Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>;
+  readonly registrationExpiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+declare class SessionStateRegistrationRequired extends SessionStateRegistrationRequired_base {}
+declare const SessionStateAuthenticated_base: Schema.Class<SessionStateAuthenticated, Schema.TaggedStruct<"Authenticated", {
+  readonly session: typeof SessionSummary;
+}>, {}>;
+declare class SessionStateAuthenticated extends SessionStateAuthenticated_base {}
+declare const SessionState: Schema.Union<readonly [typeof SessionStateAnonymous, typeof SessionStateRegistrationRequired, typeof SessionStateAuthenticated]>;
+type SessionState = typeof SessionState.Type;
+//#endregion
+export { ExistingSessionResult, PasswordSignInPayload, RegistrationRequiredResult, RequestEmailOtpPayload, SessionState, SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired, SetPasswordPayload, VerifyEmailOtpPayload, VerifyEmailOtpResult };
+//# sourceMappingURL=models.d.mts.map

package/dist/http/models.mjs

@@ -0,0 +1,35 @@
+import { Email, SessionSummary } from "../Schema.mjs";
+import { Schema } from "effect";
+//#region src/http/models.ts
+var RequestEmailOtpPayload = class extends Schema.Class("effect-auth/http/RequestEmailOtpPayload")({ email: Schema.String }) {};
+var VerifyEmailOtpPayload = class extends Schema.Class("effect-auth/http/VerifyEmailOtpPayload")({ code: Schema.Redacted(Schema.String) }) {};
+var PasswordSignInPayload = class extends Schema.Class("effect-auth/http/PasswordSignInPayload")({
+	email: Schema.String,
+	password: Schema.Redacted(Schema.String)
+}) {};
+var SetPasswordPayload = class extends Schema.Class("effect-auth/http/SetPasswordPayload")({
+	/** Required whenever the subject already has a password credential. */
+	currentPassword: Schema.optionalKey(Schema.Redacted(Schema.String)),
+	newPassword: Schema.Redacted(Schema.String)
+}) {};
+var ExistingSessionResult = class extends Schema.TaggedClass()("ExistingSession", { session: SessionSummary }) {};
+var RegistrationRequiredResult = class extends Schema.TaggedClass()("RegistrationRequired", {
+	email: Email,
+	registrationExpiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+const VerifyEmailOtpResult = Schema.Union([ExistingSessionResult, RegistrationRequiredResult]);
+var SessionStateAnonymous = class extends Schema.TaggedClass()("Anonymous", {}) {};
+var SessionStateRegistrationRequired = class extends Schema.TaggedClass()("RegistrationRequired", {
+	email: Email,
+	registrationExpiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+var SessionStateAuthenticated = class extends Schema.TaggedClass()("Authenticated", { session: SessionSummary }) {};
+const SessionState = Schema.Union([
+	SessionStateAnonymous,
+	SessionStateRegistrationRequired,
+	SessionStateAuthenticated
+]);
+//#endregion
+export { ExistingSessionResult, PasswordSignInPayload, RegistrationRequiredResult, RequestEmailOtpPayload, SessionState, SessionStateAnonymous, SessionStateAuthenticated, SessionStateRegistrationRequired, SetPasswordPayload, VerifyEmailOtpPayload, VerifyEmailOtpResult };
+
+//# sourceMappingURL=models.mjs.map

package/dist/http/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/http/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { Email, SessionSummary } from \"../Schema\";\n\nexport class RequestEmailOtpPayload extends Schema.Class<RequestEmailOtpPayload>(\n  \"effect-auth/http/RequestEmailOtpPayload\",\n)({\n  // Kept as the wire string so the handler can map Email schema failures into\n  // the endpoint's stable InvalidAuthRequest body instead of a generic parser response.\n  email: Schema.String,\n}) {}\n\nexport class VerifyEmailOtpPayload extends Schema.Class<VerifyEmailOtpPayload>(\n  \"effect-auth/http/VerifyEmailOtpPayload\",\n)({\n  code: Schema.Redacted(Schema.String),\n}) {}\n\nexport class PasswordSignInPayload extends Schema.Class<PasswordSignInPayload>(\n  \"effect-auth/http/PasswordSignInPayload\",\n)({\n  // Kept as the wire string so the handler can map Email schema failures into\n  // the endpoint's stable InvalidAuthRequest body instead of a generic parser response.\n  email: Schema.String,\n  password: Schema.Redacted(Schema.String),\n}) {}\n\nexport class SetPasswordPayload extends Schema.Class<SetPasswordPayload>(\n  \"effect-auth/http/SetPasswordPayload\",\n)({\n  /** Required whenever the subject already has a password credential. */\n  currentPassword: Schema.optionalKey(Schema.Redacted(Schema.String)),\n  newPassword: Schema.Redacted(Schema.String),\n}) {}\n\nexport class ExistingSessionResult extends Schema.TaggedClass<ExistingSessionResult>()(\n  \"ExistingSession\",\n  { session: SessionSummary },\n) {}\n\nexport class RegistrationRequiredResult extends Schema.TaggedClass<RegistrationRequiredResult>()(\n  \"RegistrationRequired\",\n  {\n    email: Email,\n    registrationExpiresAt: Schema.DateTimeUtcFromMillis,\n  },\n) {}\n\nexport const VerifyEmailOtpResult = Schema.Union([\n  ExistingSessionResult,\n  RegistrationRequiredResult,\n]);\n\nexport type VerifyEmailOtpResult = typeof VerifyEmailOtpResult.Type;\n\nexport class SessionStateAnonymous extends Schema.TaggedClass<SessionStateAnonymous>()(\n  \"Anonymous\",\n  {},\n) {}\n\nexport class SessionStateRegistrationRequired extends Schema.TaggedClass<SessionStateRegistrationRequired>()(\n  \"RegistrationRequired\",\n  {\n    email: Email,\n    registrationExpiresAt: Schema.DateTimeUtcFromMillis,\n  },\n) {}\n\nexport class SessionStateAuthenticated extends Schema.TaggedClass<SessionStateAuthenticated>()(\n  \"Authenticated\",\n  { session: SessionSummary },\n) {}\n\nexport const SessionState = Schema.Union([\n  SessionStateAnonymous,\n  SessionStateRegistrationRequired,\n  SessionStateAuthenticated,\n]);\n\nexport type SessionState = typeof SessionState.Type;\n"],"mappings":";;;AAIA,IAAa,yBAAb,cAA4C,OAAO,MACjD,yCACF,CAAC,CAAC,EAGA,OAAO,OAAO,OAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,wCACF,CAAC,CAAC,EACA,MAAM,OAAO,SAAS,OAAO,MAAM,EACrC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,wCACF,CAAC,CAAC;CAGA,OAAO,OAAO;CACd,UAAU,OAAO,SAAS,OAAO,MAAM;AACzC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,qCACF,CAAC,CAAC;;CAEA,iBAAiB,OAAO,YAAY,OAAO,SAAS,OAAO,MAAM,CAAC;CAClE,aAAa,OAAO,SAAS,OAAO,MAAM;AAC5C,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,mBACA,EAAE,SAAS,eAAe,CAC5B,CAAC,CAAC,CAAC;AAEH,IAAa,6BAAb,cAAgD,OAAO,YAAwC,CAAC,CAC9F,wBACA;CACE,OAAO;CACP,uBAAuB,OAAO;AAChC,CACF,CAAC,CAAC,CAAC;AAEH,MAAa,uBAAuB,OAAO,MAAM,CAC/C,uBACA,0BACF,CAAC;AAID,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,aACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,mCAAb,cAAsD,OAAO,YAA8C,CAAC,CAC1G,wBACA;CACE,OAAO;CACP,uBAAuB,OAAO;AAChC,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,iBACA,EAAE,SAAS,eAAe,CAC5B,CAAC,CAAC,CAAC;AAEH,MAAa,eAAe,OAAO,MAAM;CACvC;CACA;CACA;AACF,CAAC"}

package/dist/http/security.d.mts

@@ -0,0 +1,91 @@
+import { PendingRegistration } from "../Schema.mjs";
+import { AuthUnavailable, InvalidEmailOtp, InvalidRegistration, Unauthorized } from "../Errors.mjs";
+import { CurrentSession } from "../internal/CurrentSession.mjs";
+import { Context, Redacted } from "effect";
+import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
+//#region src/http/security.d.ts
+declare const challengeCookieName = "__Host-effect-auth-challenge";
+declare const registrationCookieName = "__Host-effect-auth-registration";
+declare const sessionCookieName = "__Host-effect-auth-session";
+/**
+ * Response header mirroring the session token whenever a session cookie is
+ * set. Native clients cannot read HttpOnly cookies (and refuse `Secure`
+ * cookies over plain http in development), so they store this value and send
+ * it back as `Authorization: Bearer <token>`. Same convention as BetterAuth's
+ * bearer plugin.
+ */
+declare const authTokenHeaderName = "set-auth-token";
+/**
+ * Header twins of the challenge and registration cookies, for the same
+ * cookie-less clients the bearer transport serves. The sign-in flow spans
+ * requests (request code → verify → maybe register), and each hop's
+ * intermediate token otherwise rides a SameSite cookie the client never
+ * carries. Responses mirror the token in `set-auth-*`; clients echo it back
+ * in the matching `x-auth-*` request header.
+ */
+declare const authChallengeHeaderName = "set-auth-challenge";
+declare const authRegistrationHeaderName = "set-auth-registration";
+declare const challengeHeaderName = "x-auth-challenge";
+declare const registrationHeaderName = "x-auth-registration";
+declare const SessionSecurity: HttpApiSecurity.ApiKey;
+/** Bearer transport for the same session token the cookie carries. */
+declare const SessionBearerSecurity: HttpApiSecurity.Http;
+declare const ChallengeSecurity: HttpApiSecurity.ApiKey;
+declare const ChallengeHeaderSecurity: HttpApiSecurity.ApiKey;
+declare const RegistrationSecurity: HttpApiSecurity.ApiKey;
+declare const RegistrationHeaderSecurity: HttpApiSecurity.ApiKey;
+declare const CurrentRegistration_base: Context.ServiceClass<CurrentRegistration, "effect-auth/http/CurrentRegistration", {
+  readonly registration: PendingRegistration;
+  readonly token: Redacted.Redacted<string>;
+}>;
+declare class CurrentRegistration extends CurrentRegistration_base {}
+declare const CurrentChallenge_base: Context.ServiceClass<CurrentChallenge, "effect-auth/http/CurrentChallenge", Redacted.Redacted<string>>;
+declare class CurrentChallenge extends CurrentChallenge_base {}
+declare const SessionMiddleware_base: HttpApiMiddleware.ServiceClass<SessionMiddleware, "effect-auth/http/SessionMiddleware", {
+  requires: never;
+  provides: CurrentSession;
+  error: readonly [typeof Unauthorized, typeof AuthUnavailable];
+  clientError: never;
+  requiredForClient: false;
+  security: {
+    readonly session: HttpApiSecurity.ApiKey;
+    readonly sessionBearer: HttpApiSecurity.Http;
+  };
+}, HttpApiMiddleware.HttpApiMiddlewareSecurity<{
+  readonly session: HttpApiSecurity.ApiKey;
+  readonly sessionBearer: HttpApiSecurity.Http;
+}, CurrentSession, readonly [typeof Unauthorized, typeof AuthUnavailable], never>>;
+declare class SessionMiddleware extends SessionMiddleware_base {}
+declare const RegistrationMiddleware_base: HttpApiMiddleware.ServiceClass<RegistrationMiddleware, "effect-auth/http/RegistrationMiddleware", {
+  requires: never;
+  provides: CurrentRegistration;
+  error: readonly [typeof InvalidRegistration, typeof AuthUnavailable];
+  clientError: never;
+  requiredForClient: false;
+  security: {
+    readonly registration: HttpApiSecurity.ApiKey;
+    readonly registrationHeader: HttpApiSecurity.ApiKey;
+  };
+}, HttpApiMiddleware.HttpApiMiddlewareSecurity<{
+  readonly registration: HttpApiSecurity.ApiKey;
+  readonly registrationHeader: HttpApiSecurity.ApiKey;
+}, CurrentRegistration, readonly [typeof InvalidRegistration, typeof AuthUnavailable], never>>;
+declare class RegistrationMiddleware extends RegistrationMiddleware_base {}
+declare const ChallengeMiddleware_base: HttpApiMiddleware.ServiceClass<ChallengeMiddleware, "effect-auth/http/ChallengeMiddleware", {
+  requires: never;
+  provides: CurrentChallenge;
+  error: readonly [typeof InvalidEmailOtp];
+  clientError: never;
+  requiredForClient: false;
+  security: {
+    readonly challenge: HttpApiSecurity.ApiKey;
+    readonly challengeHeader: HttpApiSecurity.ApiKey;
+  };
+}, HttpApiMiddleware.HttpApiMiddlewareSecurity<{
+  readonly challenge: HttpApiSecurity.ApiKey;
+  readonly challengeHeader: HttpApiSecurity.ApiKey;
+}, CurrentChallenge, readonly [typeof InvalidEmailOtp], never>>;
+declare class ChallengeMiddleware extends ChallengeMiddleware_base {}
+//#endregion
+export { ChallengeHeaderSecurity, ChallengeMiddleware, ChallengeSecurity, CurrentChallenge, CurrentRegistration, CurrentSession, RegistrationHeaderSecurity, RegistrationMiddleware, RegistrationSecurity, SessionBearerSecurity, SessionMiddleware, SessionSecurity, authChallengeHeaderName, authRegistrationHeaderName, authTokenHeaderName, challengeCookieName, challengeHeaderName, registrationCookieName, registrationHeaderName, sessionCookieName };
+//# sourceMappingURL=security.d.mts.map

package/dist/http/security.mjs

@@ -0,0 +1,77 @@
+import { AuthUnavailable, InvalidEmailOtp, InvalidRegistration, Unauthorized } from "../Errors.mjs";
+import { CurrentSession } from "../internal/CurrentSession.mjs";
+import { Context } from "effect";
+import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
+//#region src/http/security.ts
+const challengeCookieName = "__Host-effect-auth-challenge";
+const registrationCookieName = "__Host-effect-auth-registration";
+const sessionCookieName = "__Host-effect-auth-session";
+/**
+* Response header mirroring the session token whenever a session cookie is
+* set. Native clients cannot read HttpOnly cookies (and refuse `Secure`
+* cookies over plain http in development), so they store this value and send
+* it back as `Authorization: Bearer <token>`. Same convention as BetterAuth's
+* bearer plugin.
+*/
+const authTokenHeaderName = "set-auth-token";
+/**
+* Header twins of the challenge and registration cookies, for the same
+* cookie-less clients the bearer transport serves. The sign-in flow spans
+* requests (request code → verify → maybe register), and each hop's
+* intermediate token otherwise rides a SameSite cookie the client never
+* carries. Responses mirror the token in `set-auth-*`; clients echo it back
+* in the matching `x-auth-*` request header.
+*/
+const authChallengeHeaderName = "set-auth-challenge";
+const authRegistrationHeaderName = "set-auth-registration";
+const challengeHeaderName = "x-auth-challenge";
+const registrationHeaderName = "x-auth-registration";
+const SessionSecurity = HttpApiSecurity.apiKey({
+	key: sessionCookieName,
+	in: "cookie"
+});
+/** Bearer transport for the same session token the cookie carries. */
+const SessionBearerSecurity = HttpApiSecurity.bearer;
+const ChallengeSecurity = HttpApiSecurity.apiKey({
+	key: challengeCookieName,
+	in: "cookie"
+});
+const ChallengeHeaderSecurity = HttpApiSecurity.apiKey({
+	key: challengeHeaderName,
+	in: "header"
+});
+const RegistrationSecurity = HttpApiSecurity.apiKey({
+	key: registrationCookieName,
+	in: "cookie"
+});
+const RegistrationHeaderSecurity = HttpApiSecurity.apiKey({
+	key: registrationHeaderName,
+	in: "header"
+});
+var CurrentRegistration = class extends Context.Service()("effect-auth/http/CurrentRegistration") {};
+var CurrentChallenge = class extends Context.Service()("effect-auth/http/CurrentChallenge") {};
+var SessionMiddleware = class extends HttpApiMiddleware.Service()("effect-auth/http/SessionMiddleware", {
+	security: {
+		session: SessionSecurity,
+		sessionBearer: SessionBearerSecurity
+	},
+	error: [Unauthorized, AuthUnavailable]
+}) {};
+var RegistrationMiddleware = class extends HttpApiMiddleware.Service()("effect-auth/http/RegistrationMiddleware", {
+	security: {
+		registration: RegistrationSecurity,
+		registrationHeader: RegistrationHeaderSecurity
+	},
+	error: [InvalidRegistration, AuthUnavailable]
+}) {};
+var ChallengeMiddleware = class extends HttpApiMiddleware.Service()("effect-auth/http/ChallengeMiddleware", {
+	security: {
+		challenge: ChallengeSecurity,
+		challengeHeader: ChallengeHeaderSecurity
+	},
+	error: [InvalidEmailOtp]
+}) {};
+//#endregion
+export { ChallengeHeaderSecurity, ChallengeMiddleware, ChallengeSecurity, CurrentChallenge, CurrentRegistration, CurrentSession, RegistrationHeaderSecurity, RegistrationMiddleware, RegistrationSecurity, SessionBearerSecurity, SessionMiddleware, SessionSecurity, authChallengeHeaderName, authRegistrationHeaderName, authTokenHeaderName, challengeCookieName, challengeHeaderName, registrationCookieName, registrationHeaderName, sessionCookieName };
+
+//# sourceMappingURL=security.mjs.map

package/dist/http/security.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.mjs","names":[],"sources":["../../src/http/security.ts"],"sourcesContent":["import { type Redacted, Context } from \"effect\";\nimport { HttpApiMiddleware, HttpApiSecurity } from \"effect/unstable/httpapi\";\n\nimport { AuthUnavailable, InvalidEmailOtp, InvalidRegistration, Unauthorized } from \"../Errors\";\nimport type { CurrentSession } from \"../internal/CurrentSession\";\nimport type { PendingRegistration } from \"../Schema\";\n\nexport { CurrentSession } from \"../internal/CurrentSession\";\n\nexport const challengeCookieName = \"__Host-effect-auth-challenge\";\nexport const registrationCookieName = \"__Host-effect-auth-registration\";\nexport const sessionCookieName = \"__Host-effect-auth-session\";\n\n/**\n * Response header mirroring the session token whenever a session cookie is\n * set. Native clients cannot read HttpOnly cookies (and refuse `Secure`\n * cookies over plain http in development), so they store this value and send\n * it back as `Authorization: Bearer <token>`. Same convention as BetterAuth's\n * bearer plugin.\n */\nexport const authTokenHeaderName = \"set-auth-token\";\n/**\n * Header twins of the challenge and registration cookies, for the same\n * cookie-less clients the bearer transport serves. The sign-in flow spans\n * requests (request code → verify → maybe register), and each hop's\n * intermediate token otherwise rides a SameSite cookie the client never\n * carries. Responses mirror the token in `set-auth-*`; clients echo it back\n * in the matching `x-auth-*` request header.\n */\nexport const authChallengeHeaderName = \"set-auth-challenge\";\nexport const authRegistrationHeaderName = \"set-auth-registration\";\nexport const challengeHeaderName = \"x-auth-challenge\";\nexport const registrationHeaderName = \"x-auth-registration\";\n\nexport const SessionSecurity = HttpApiSecurity.apiKey({ key: sessionCookieName, in: \"cookie\" });\n/** Bearer transport for the same session token the cookie carries. */\nexport const SessionBearerSecurity = HttpApiSecurity.bearer;\n\nexport const ChallengeSecurity = HttpApiSecurity.apiKey({\n  key: challengeCookieName,\n  in: \"cookie\",\n});\n\nexport const ChallengeHeaderSecurity = HttpApiSecurity.apiKey({\n  key: challengeHeaderName,\n  in: \"header\",\n});\n\nexport const RegistrationSecurity = HttpApiSecurity.apiKey({\n  key: registrationCookieName,\n  in: \"cookie\",\n});\n\nexport const RegistrationHeaderSecurity = HttpApiSecurity.apiKey({\n  key: registrationHeaderName,\n  in: \"header\",\n});\n\nexport class CurrentRegistration extends Context.Service<\n  CurrentRegistration,\n  {\n    readonly registration: PendingRegistration;\n    readonly token: Redacted.Redacted<string>;\n  }\n>()(\"effect-auth/http/CurrentRegistration\") {}\n\nexport class CurrentChallenge extends Context.Service<\n  CurrentChallenge,\n  Redacted.Redacted<string>\n>()(\"effect-auth/http/CurrentChallenge\") {}\n\n// These cookies are HttpOnly browser credentials, so generated clients do not\n// inject them. The transport layer carries them with same-origin requests.\n// Sessions additionally accept the same token as an `Authorization: Bearer`\n// header for clients without a usable cookie store; the securities are tried\n// in record order and the first one whose handler succeeds wins.\nexport class SessionMiddleware extends HttpApiMiddleware.Service<\n  SessionMiddleware,\n  { provides: CurrentSession }\n>()(\"effect-auth/http/SessionMiddleware\", {\n  security: { session: SessionSecurity, sessionBearer: SessionBearerSecurity },\n  error: [Unauthorized, AuthUnavailable],\n}) {}\n\nexport class RegistrationMiddleware extends HttpApiMiddleware.Service<\n  RegistrationMiddleware,\n  { provides: CurrentRegistration }\n>()(\"effect-auth/http/RegistrationMiddleware\", {\n  security: {\n    registration: RegistrationSecurity,\n    registrationHeader: RegistrationHeaderSecurity,\n  },\n  error: [InvalidRegistration, AuthUnavailable],\n}) {}\n\nexport class ChallengeMiddleware extends HttpApiMiddleware.Service<\n  ChallengeMiddleware,\n  { provides: CurrentChallenge }\n>()(\"effect-auth/http/ChallengeMiddleware\", {\n  security: { challenge: ChallengeSecurity, challengeHeader: ChallengeHeaderSecurity },\n  error: [InvalidEmailOtp],\n}) {}\n"],"mappings":";;;;;AASA,MAAa,sBAAsB;AACnC,MAAa,yBAAyB;AACtC,MAAa,oBAAoB;;;;;;;;AASjC,MAAa,sBAAsB;;;;;;;;;AASnC,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,sBAAsB;AACnC,MAAa,yBAAyB;AAEtC,MAAa,kBAAkB,gBAAgB,OAAO;CAAE,KAAK;CAAmB,IAAI;AAAS,CAAC;;AAE9F,MAAa,wBAAwB,gBAAgB;AAErD,MAAa,oBAAoB,gBAAgB,OAAO;CACtD,KAAK;CACL,IAAI;AACN,CAAC;AAED,MAAa,0BAA0B,gBAAgB,OAAO;CAC5D,KAAK;CACL,IAAI;AACN,CAAC;AAED,MAAa,uBAAuB,gBAAgB,OAAO;CACzD,KAAK;CACL,IAAI;AACN,CAAC;AAED,MAAa,6BAA6B,gBAAgB,OAAO;CAC/D,KAAK;CACL,IAAI;AACN,CAAC;AAED,IAAa,sBAAb,cAAyC,QAAQ,QAM/C,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;AAE7C,IAAa,mBAAb,cAAsC,QAAQ,QAG5C,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC;AAO1C,IAAa,oBAAb,cAAuC,kBAAkB,QAGvD,CAAC,CAAC,sCAAsC;CACxC,UAAU;EAAE,SAAS;EAAiB,eAAe;CAAsB;CAC3E,OAAO,CAAC,cAAc,eAAe;AACvC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,yBAAb,cAA4C,kBAAkB,QAG5D,CAAC,CAAC,2CAA2C;CAC7C,UAAU;EACR,cAAc;EACd,oBAAoB;CACtB;CACA,OAAO,CAAC,qBAAqB,eAAe;AAC9C,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,sBAAb,cAAyC,kBAAkB,QAGzD,CAAC,CAAC,wCAAwC;CAC1C,UAAU;EAAE,WAAW;EAAmB,iBAAiB;CAAwB;CACnF,OAAO,CAAC,eAAe;AACzB,CAAC,CAAC,CAAC,CAAC"}