@yielded/auth 0.1.0-beta.1

package/dist/identity/IdentityMutation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityMutation.mjs","names":[],"sources":["../../src/identity/IdentityMutation.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { SubjectId } from \"../Schema\";\nimport type {\n  CredentialId,\n  IdentityConflict,\n  IdentityUnavailable,\n  LastSignInMethod,\n  LoginIdentifier,\n  SubjectInactive,\n} from \"./models\";\n\n/**\n * Narrow removal capability. The authoritative adapter checks active status,\n * ownership and the remaining usable sign-in methods in the SAME atomic write.\n * A read/count followed by deletion is insufficient under concurrent removals.\n * Removing a credential also removes its retained secrets and dependent proofs.\n * Identifier removal/rebinding/verification changes that invalidate captured login\n * authority MUST atomically bump subject securityRevision. AuthenticationRevision\n * deliberately has no identifier-binding revision: deleting dependent proofs alone\n * cannot invalidate password evidence already captured before verification.\n */\nexport class IdentityMutation extends Context.Service<\n  IdentityMutation,\n  {\n    readonly removeIdentifier: (\n      subjectId: SubjectId,\n      identifier: LoginIdentifier,\n    ) => Effect.Effect<\n      void,\n      IdentityConflict | LastSignInMethod | SubjectInactive | IdentityUnavailable\n    >;\n    readonly removeCredential: (\n      subjectId: SubjectId,\n      credentialId: CredentialId,\n    ) => Effect.Effect<\n      void,\n      IdentityConflict | LastSignInMethod | SubjectInactive | IdentityUnavailable\n    >;\n  }\n>()(\"effect-auth/IdentityMutation\") {}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAa,mBAAb,cAAsC,QAAQ,QAkB5C,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC"}

package/dist/identity/IdentityRepository.d.mts

@@ -0,0 +1,20 @@
+import { SubjectId } from "../Schema.mjs";
+import { CredentialSummary, ExternalIdentity, IdentifierBinding, IdentityUnavailable, LoginIdentifier, SubjectSnapshot } from "./models.mjs";
+import { Context, Effect, Option } from "effect";
+//#region src/identity/IdentityRepository.d.ts
+declare const IdentityRepository_base: Context.ServiceClass<IdentityRepository, "effect-auth/IdentityRepository", {
+  readonly findSubject: (subjectId: SubjectId) => Effect.Effect<Option.Option<SubjectSnapshot>, IdentityUnavailable>;
+  readonly findIdentifier: (identifier: LoginIdentifier) => Effect.Effect<Option.Option<IdentifierBinding>, IdentityUnavailable>;
+  /** Resolve the full configured provider + issuer + external subject tuple. */
+  readonly findExternalIdentity: (identity: ExternalIdentity) => Effect.Effect<Option.Option<SubjectId>, IdentityUnavailable>;
+  readonly listIdentifiers: (subjectId: SubjectId) => Effect.Effect<ReadonlyArray<IdentifierBinding>, IdentityUnavailable>;
+  readonly listCredentials: (subjectId: SubjectId) => Effect.Effect<ReadonlyArray<CredentialSummary>, IdentityUnavailable>;
+}>;
+/**
+ * Application identity queries. No profile fields, email requirement, table
+ * layout, or account-creation side effect is implied by resolving an identity.
+ */
+declare class IdentityRepository extends IdentityRepository_base {}
+//#endregion
+export { IdentityRepository };
+//# sourceMappingURL=IdentityRepository.d.mts.map

package/dist/identity/IdentityRepository.mjs

@@ -0,0 +1,11 @@
+import { Context } from "effect";
+//#region src/identity/IdentityRepository.ts
+/**
+* Application identity queries. No profile fields, email requirement, table
+* layout, or account-creation side effect is implied by resolving an identity.
+*/
+var IdentityRepository = class extends Context.Service()("effect-auth/IdentityRepository") {};
+//#endregion
+export { IdentityRepository };
+
+//# sourceMappingURL=IdentityRepository.mjs.map

package/dist/identity/IdentityRepository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityRepository.mjs","names":[],"sources":["../../src/identity/IdentityRepository.ts"],"sourcesContent":["import { Context, type Effect, type Option } from \"effect\";\n\nimport type { SubjectId } from \"../Schema\";\nimport type {\n  CredentialSummary,\n  ExternalIdentity,\n  IdentifierBinding,\n  IdentityUnavailable,\n  LoginIdentifier,\n  SubjectSnapshot,\n} from \"./models\";\n\n/**\n * Application identity queries. No profile fields, email requirement, table\n * layout, or account-creation side effect is implied by resolving an identity.\n */\nexport class IdentityRepository extends Context.Service<\n  IdentityRepository,\n  {\n    readonly findSubject: (\n      subjectId: SubjectId,\n    ) => Effect.Effect<Option.Option<SubjectSnapshot>, IdentityUnavailable>;\n    readonly findIdentifier: (\n      identifier: LoginIdentifier,\n    ) => Effect.Effect<Option.Option<IdentifierBinding>, IdentityUnavailable>;\n    /** Resolve the full configured provider + issuer + external subject tuple. */\n    readonly findExternalIdentity: (\n      identity: ExternalIdentity,\n    ) => Effect.Effect<Option.Option<SubjectId>, IdentityUnavailable>;\n    readonly listIdentifiers: (\n      subjectId: SubjectId,\n    ) => Effect.Effect<ReadonlyArray<IdentifierBinding>, IdentityUnavailable>;\n    readonly listCredentials: (\n      subjectId: SubjectId,\n    ) => Effect.Effect<ReadonlyArray<CredentialSummary>, IdentityUnavailable>;\n  }\n>()(\"effect-auth/IdentityRepository\") {}\n"],"mappings":";;;;;;AAgBA,IAAa,qBAAb,cAAwC,QAAQ,QAoB9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/identity/SubjectLifecycle.d.mts

@@ -0,0 +1,58 @@
+import { SubjectId } from "../Schema.mjs";
+import { IdentityUnavailable } from "./models.mjs";
+import { Context, Effect, Schema } from "effect";
+//#region src/identity/SubjectLifecycle.d.ts
+declare const InvalidationUnsupported_base: Schema.Class<InvalidationUnsupported, Schema.TaggedStruct<"InvalidationUnsupported", {}>, import("effect/Cause").YieldableError>;
+declare class InvalidationUnsupported extends InvalidationUnsupported_base {}
+declare const ImmediatelyInvalidated_base: Schema.Class<ImmediatelyInvalidated, Schema.TaggedStruct<"ImmediatelyInvalidated", {}>, {}>;
+/** No issued bearer remains valid for this subject after the commit. */
+declare class ImmediatelyInvalidated extends ImmediatelyInvalidated_base {}
+declare const ExpiresBy_base: Schema.Class<ExpiresBy, Schema.TaggedStruct<"ExpiresBy", {
+  readonly instant: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+/**
+ * Pure stateless verification may accept old tokens until this instant. The
+ * adapter must prevent fresh primary authentication. Any stateless renewal of
+ * an existing token must remain bounded by this same instant, not extend it.
+ */
+declare class ExpiresBy extends ExpiresBy_base {}
+declare const SubjectInvalidation: Schema.Union<readonly [typeof ImmediatelyInvalidated, typeof ExpiresBy]>;
+declare const SubjectCleanupComplete_base: Schema.Class<SubjectCleanupComplete, Schema.TaggedStruct<"SubjectCleanupComplete", {
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly invalidation: Schema.Union<readonly [typeof ImmediatelyInvalidated, typeof ExpiresBy]>;
+}>, {}>;
+declare class SubjectCleanupComplete extends SubjectCleanupComplete_base {}
+declare const SubjectCleanupPending_base: Schema.Class<SubjectCleanupPending, Schema.TaggedStruct<"SubjectCleanupPending", {
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly invalidation: Schema.Union<readonly [typeof ImmediatelyInvalidated, typeof ExpiresBy]>;
+  readonly recoveryReference: Schema.brand<Schema.NonEmptyString, "effect-auth/RecoveryReference">;
+}>, {}>;
+/**
+ * The account is already blocked from new auth, but retained material in another
+ * authority still needs cleanup. The consumer retries using recoveryReference.
+ */
+declare class SubjectCleanupPending extends SubjectCleanupPending_base {}
+declare const SubjectCleanupResult: Schema.Union<readonly [typeof SubjectCleanupComplete, typeof SubjectCleanupPending]>;
+interface SubjectTerminationInput {
+  readonly subjectId: SubjectId;
+  readonly requestId: string;
+  readonly invalidation: "immediate" | "allow-expiry";
+}
+declare const SubjectLifecycle_base: Context.ServiceClass<SubjectLifecycle, "effect-auth/SubjectLifecycle", {
+  readonly disable: (input: SubjectTerminationInput) => Effect.Effect<typeof SubjectCleanupResult.Type, InvalidationUnsupported | IdentityUnavailable>;
+  readonly delete: (input: SubjectTerminationInput) => Effect.Effect<typeof SubjectCleanupResult.Type, InvalidationUnsupported | IdentityUnavailable>;
+}>;
+/**
+ * Consumer-selected coordination of account disable/delete, credential and
+ * proof cleanup, external token cleanup, and the session strategy's invalidation.
+ * Workspace membership, profile and billing data remain application-owned.
+ *
+ * Operations are idempotent by requestId. Validate requested invalidation before
+ * writes; a stateless composition must reject `immediate` unless the consumer
+ * provides state-assisted validity. No implementation may return Complete while
+ * enabled credential/proof/token stores still permit future authentication.
+ */
+declare class SubjectLifecycle extends SubjectLifecycle_base {}
+//#endregion
+export { ExpiresBy, ImmediatelyInvalidated, InvalidationUnsupported, SubjectCleanupComplete, SubjectCleanupPending, SubjectCleanupResult, SubjectInvalidation, SubjectLifecycle, SubjectTerminationInput };
+//# sourceMappingURL=SubjectLifecycle.d.mts.map

package/dist/identity/SubjectLifecycle.mjs

@@ -0,0 +1,43 @@
+import { SubjectId } from "../Schema.mjs";
+import { RecoveryReference } from "./models.mjs";
+import { Context, Schema } from "effect";
+//#region src/identity/SubjectLifecycle.ts
+var InvalidationUnsupported = class extends Schema.TaggedError()("InvalidationUnsupported", {}) {};
+/** No issued bearer remains valid for this subject after the commit. */
+var ImmediatelyInvalidated = class extends Schema.TaggedClass()("ImmediatelyInvalidated", {}) {};
+/**
+* Pure stateless verification may accept old tokens until this instant. The
+* adapter must prevent fresh primary authentication. Any stateless renewal of
+* an existing token must remain bounded by this same instant, not extend it.
+*/
+var ExpiresBy = class extends Schema.TaggedClass()("ExpiresBy", { instant: Schema.DateTimeUtcFromMillis }) {};
+const SubjectInvalidation = Schema.Union([ImmediatelyInvalidated, ExpiresBy]);
+var SubjectCleanupComplete = class extends Schema.TaggedClass()("SubjectCleanupComplete", {
+	subjectId: SubjectId,
+	invalidation: SubjectInvalidation
+}) {};
+/**
+* The account is already blocked from new auth, but retained material in another
+* authority still needs cleanup. The consumer retries using recoveryReference.
+*/
+var SubjectCleanupPending = class extends Schema.TaggedClass()("SubjectCleanupPending", {
+	subjectId: SubjectId,
+	invalidation: SubjectInvalidation,
+	recoveryReference: RecoveryReference
+}) {};
+const SubjectCleanupResult = Schema.Union([SubjectCleanupComplete, SubjectCleanupPending]);
+/**
+* Consumer-selected coordination of account disable/delete, credential and
+* proof cleanup, external token cleanup, and the session strategy's invalidation.
+* Workspace membership, profile and billing data remain application-owned.
+*
+* Operations are idempotent by requestId. Validate requested invalidation before
+* writes; a stateless composition must reject `immediate` unless the consumer
+* provides state-assisted validity. No implementation may return Complete while
+* enabled credential/proof/token stores still permit future authentication.
+*/
+var SubjectLifecycle = class extends Context.Service()("effect-auth/SubjectLifecycle") {};
+//#endregion
+export { ExpiresBy, ImmediatelyInvalidated, InvalidationUnsupported, SubjectCleanupComplete, SubjectCleanupPending, SubjectCleanupResult, SubjectInvalidation, SubjectLifecycle };
+
+//# sourceMappingURL=SubjectLifecycle.mjs.map

package/dist/identity/SubjectLifecycle.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubjectLifecycle.mjs","names":[],"sources":["../../src/identity/SubjectLifecycle.ts"],"sourcesContent":["import { Context, type Effect, Schema } from \"effect\";\n\nimport { SubjectId } from \"../Schema\";\nimport { type IdentityUnavailable, RecoveryReference } from \"./models\";\n\nexport class InvalidationUnsupported extends Schema.TaggedError<InvalidationUnsupported>()(\n  \"InvalidationUnsupported\",\n  {},\n) {}\n\n/** No issued bearer remains valid for this subject after the commit. */\nexport class ImmediatelyInvalidated extends Schema.TaggedClass<ImmediatelyInvalidated>()(\n  \"ImmediatelyInvalidated\",\n  {},\n) {}\n\n/**\n * Pure stateless verification may accept old tokens until this instant. The\n * adapter must prevent fresh primary authentication. Any stateless renewal of\n * an existing token must remain bounded by this same instant, not extend it.\n */\nexport class ExpiresBy extends Schema.TaggedClass<ExpiresBy>()(\"ExpiresBy\", {\n  instant: Schema.DateTimeUtcFromMillis,\n}) {}\n\nexport const SubjectInvalidation = Schema.Union([ImmediatelyInvalidated, ExpiresBy]);\n\nexport class SubjectCleanupComplete extends Schema.TaggedClass<SubjectCleanupComplete>()(\n  \"SubjectCleanupComplete\",\n  { subjectId: SubjectId, invalidation: SubjectInvalidation },\n) {}\n\n/**\n * The account is already blocked from new auth, but retained material in another\n * authority still needs cleanup. The consumer retries using recoveryReference.\n */\nexport class SubjectCleanupPending extends Schema.TaggedClass<SubjectCleanupPending>()(\n  \"SubjectCleanupPending\",\n  {\n    subjectId: SubjectId,\n    invalidation: SubjectInvalidation,\n    recoveryReference: RecoveryReference,\n  },\n) {}\n\nexport const SubjectCleanupResult = Schema.Union([SubjectCleanupComplete, SubjectCleanupPending]);\n\nexport interface SubjectTerminationInput {\n  readonly subjectId: SubjectId;\n  readonly requestId: string;\n  readonly invalidation: \"immediate\" | \"allow-expiry\";\n}\n\n/**\n * Consumer-selected coordination of account disable/delete, credential and\n * proof cleanup, external token cleanup, and the session strategy's invalidation.\n * Workspace membership, profile and billing data remain application-owned.\n *\n * Operations are idempotent by requestId. Validate requested invalidation before\n * writes; a stateless composition must reject `immediate` unless the consumer\n * provides state-assisted validity. No implementation may return Complete while\n * enabled credential/proof/token stores still permit future authentication.\n */\nexport class SubjectLifecycle extends Context.Service<\n  SubjectLifecycle,\n  {\n    readonly disable: (\n      input: SubjectTerminationInput,\n    ) => Effect.Effect<\n      typeof SubjectCleanupResult.Type,\n      InvalidationUnsupported | IdentityUnavailable\n    >;\n    readonly delete: (\n      input: SubjectTerminationInput,\n    ) => Effect.Effect<\n      typeof SubjectCleanupResult.Type,\n      InvalidationUnsupported | IdentityUnavailable\n    >;\n  }\n>()(\"effect-auth/SubjectLifecycle\") {}\n"],"mappings":";;;;AAKA,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,CAAC,CACH,CAAC,CAAC,CAAC;;AAGH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,CACH,CAAC,CAAC,CAAC;;;;;;AAOH,IAAa,YAAb,cAA+B,OAAO,YAAuB,CAAC,CAAC,aAAa,EAC1E,SAAS,OAAO,sBAClB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,sBAAsB,OAAO,MAAM,CAAC,wBAAwB,SAAS,CAAC;AAEnF,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA;CAAE,WAAW;CAAW,cAAc;AAAoB,CAC5D,CAAC,CAAC,CAAC;;;;;AAMH,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA;CACE,WAAW;CACX,cAAc;CACd,mBAAmB;AACrB,CACF,CAAC,CAAC,CAAC;AAEH,MAAa,uBAAuB,OAAO,MAAM,CAAC,wBAAwB,qBAAqB,CAAC;;;;;;;;;;;AAkBhG,IAAa,mBAAb,cAAsC,QAAQ,QAgB5C,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC"}

package/dist/identity/SubjectProvisioner.d.mts

@@ -0,0 +1,37 @@
+import { IdentityConflict, IdentityUnavailable, LoginIdentifier, ProvisioningResult } from "./models.mjs";
+import { Context, DateTime, Effect } from "effect";
+//#region src/identity/SubjectProvisioner.d.ts
+/**
+ * Trusted method input after its registration proof/policy has been checked.
+ * This is a service input, never a remotely exposed registration payload.
+ * Omit verifiedAt for password-only registration with an unverified identifier.
+ */
+type SubjectProvisioningInput = {
+  readonly requestId: string;
+} & ({
+  readonly identifier?: never;
+  readonly verifiedAt?: never;
+} | {
+  readonly identifier: LoginIdentifier;
+  readonly verifiedAt?: DateTime.Utc;
+});
+declare const SubjectProvisioner_base: Context.ServiceClass<SubjectProvisioner, "effect-auth/SubjectProvisioner", {
+  readonly provision: (input: SubjectProvisioningInput) => Effect.Effect<ProvisioningResult, IdentityConflict | IdentityUnavailable>;
+}>;
+/**
+ * Application authority for subject creation and initial identifier binding.
+ *
+ * Repeating a requestId with the same input must resolve the same subject;
+ * repeating it with different input must fail. Identifier uniqueness and
+ * provisioning commit together when they share an authority. Cross-authority
+ * implementations return ProvisioningPending until reconciliation is complete,
+ * never an authenticated result for a partially provisioned account.
+ *
+ * This port does not create a session or bind method-specific credentials. The
+ * method's registration coordinator owns that atomic boundary (or exposes its
+ * pending recovery outcome) before it can issue an authenticated result.
+ */
+declare class SubjectProvisioner extends SubjectProvisioner_base {}
+//#endregion
+export { SubjectProvisioner, SubjectProvisioningInput };
+//# sourceMappingURL=SubjectProvisioner.d.mts.map

package/dist/identity/SubjectProvisioner.mjs

@@ -0,0 +1,20 @@
+import { Context } from "effect";
+//#region src/identity/SubjectProvisioner.ts
+/**
+* Application authority for subject creation and initial identifier binding.
+*
+* Repeating a requestId with the same input must resolve the same subject;
+* repeating it with different input must fail. Identifier uniqueness and
+* provisioning commit together when they share an authority. Cross-authority
+* implementations return ProvisioningPending until reconciliation is complete,
+* never an authenticated result for a partially provisioned account.
+*
+* This port does not create a session or bind method-specific credentials. The
+* method's registration coordinator owns that atomic boundary (or exposes its
+* pending recovery outcome) before it can issue an authenticated result.
+*/
+var SubjectProvisioner = class extends Context.Service()("effect-auth/SubjectProvisioner") {};
+//#endregion
+export { SubjectProvisioner };
+
+//# sourceMappingURL=SubjectProvisioner.mjs.map

package/dist/identity/SubjectProvisioner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubjectProvisioner.mjs","names":[],"sources":["../../src/identity/SubjectProvisioner.ts"],"sourcesContent":["import { Context, type DateTime, type Effect } from \"effect\";\n\nimport type {\n  IdentityConflict,\n  IdentityUnavailable,\n  LoginIdentifier,\n  ProvisioningResult,\n} from \"./models\";\n\n/**\n * Trusted method input after its registration proof/policy has been checked.\n * This is a service input, never a remotely exposed registration payload.\n * Omit verifiedAt for password-only registration with an unverified identifier.\n */\nexport type SubjectProvisioningInput = { readonly requestId: string } & (\n  | { readonly identifier?: never; readonly verifiedAt?: never }\n  | { readonly identifier: LoginIdentifier; readonly verifiedAt?: DateTime.Utc }\n);\n\n/**\n * Application authority for subject creation and initial identifier binding.\n *\n * Repeating a requestId with the same input must resolve the same subject;\n * repeating it with different input must fail. Identifier uniqueness and\n * provisioning commit together when they share an authority. Cross-authority\n * implementations return ProvisioningPending until reconciliation is complete,\n * never an authenticated result for a partially provisioned account.\n *\n * This port does not create a session or bind method-specific credentials. The\n * method's registration coordinator owns that atomic boundary (or exposes its\n * pending recovery outcome) before it can issue an authenticated result.\n */\nexport class SubjectProvisioner extends Context.Service<\n  SubjectProvisioner,\n  {\n    readonly provision: (\n      input: SubjectProvisioningInput,\n    ) => Effect.Effect<ProvisioningResult, IdentityConflict | IdentityUnavailable>;\n  }\n>()(\"effect-auth/SubjectProvisioner\") {}\n"],"mappings":";;;;;;;;;;;;;;;AAgCA,IAAa,qBAAb,cAAwC,QAAQ,QAO9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/identity/codecs.d.mts

@@ -0,0 +1,34 @@
+import { Effect, Schema } from "effect";
+//#region src/identity/codecs.d.ts
+declare const IdentityCodecError_base: Schema.Class<IdentityCodecError, Schema.TaggedStruct<"IdentityCodecError", {
+  readonly reason: Schema.Literals<readonly ["invalid-key", "lossy-key"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Adapter failures deliberately omit the native key and rejected wire input. */
+declare class IdentityCodecError extends IdentityCodecError_base {}
+/**
+ * A consumer's native key remains native in its database. Only the auth boundary
+ * uses SubjectId. Neither direction may silently normalize or truncate a key.
+ * ID generation belongs to the consumer, including database-generated keys.
+ */
+declare const subjectIdCodec: <A>(schema: Schema.Codec<A, string>) => {
+  readonly toNative: (subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => Effect.Effect<A, IdentityCodecError, never>;
+  readonly toSubject: (native: A) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SubjectId">, IdentityCodecError, never>;
+};
+/** Keeps the consumer's UUID version, spelling, and database column unchanged. */
+declare const stringSubjectId: {
+  readonly toNative: (subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => Effect.Effect<string, IdentityCodecError, never>;
+  readonly toSubject: (native: string) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SubjectId">, IdentityCodecError, never>;
+};
+/** Rejects unsafe JS integers and noncanonical aliases such as `01` and `1e2`. */
+declare const numericSubjectId: {
+  readonly toNative: (subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => Effect.Effect<number, IdentityCodecError, never>;
+  readonly toSubject: (native: number) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SubjectId">, IdentityCodecError, never>;
+};
+/** Use for SQL bigint keys that exceed JavaScript's safe integer range. */
+declare const bigintSubjectId: {
+  readonly toNative: (subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">) => Effect.Effect<bigint, IdentityCodecError, never>;
+  readonly toSubject: (native: bigint) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SubjectId">, IdentityCodecError, never>;
+};
+//#endregion
+export { IdentityCodecError, bigintSubjectId, numericSubjectId, stringSubjectId, subjectIdCodec };
+//# sourceMappingURL=codecs.d.mts.map

package/dist/identity/codecs.mjs

@@ -0,0 +1,40 @@
+import { SubjectId } from "../Schema.mjs";
+import { Effect, Schema } from "effect";
+//#region src/identity/codecs.ts
+/** Adapter failures deliberately omit the native key and rejected wire input. */
+var IdentityCodecError = class extends Schema.TaggedError()("IdentityCodecError", { reason: Schema.Literals(["invalid-key", "lossy-key"]) }) {};
+/**
+* A consumer's native key remains native in its database. Only the auth boundary
+* uses SubjectId. Neither direction may silently normalize or truncate a key.
+* ID generation belongs to the consumer, including database-generated keys.
+*/
+const subjectIdCodec = (schema) => {
+	const decode = Schema.decodeEffect(schema);
+	const encode = Schema.encodeEffect(schema);
+	const decodeSubject = Schema.decodeEffect(SubjectId);
+	const equivalent = Schema.toEquivalence(schema);
+	const invalid = () => IdentityCodecError.make({ reason: "invalid-key" });
+	return {
+		toNative: Effect.fn("subjectIdCodec.toNative")(function* (subjectId) {
+			const native = yield* decode(subjectId).pipe(Effect.mapError(invalid));
+			if ((yield* encode(native).pipe(Effect.mapError(invalid))) !== subjectId) return yield* IdentityCodecError.make({ reason: "lossy-key" });
+			return native;
+		}),
+		toSubject: Effect.fn("subjectIdCodec.toSubject")(function* (native) {
+			const wire = yield* encode(native).pipe(Effect.mapError(invalid));
+			const roundTrip = yield* decode(wire).pipe(Effect.mapError(invalid));
+			if (!equivalent(native, roundTrip)) return yield* IdentityCodecError.make({ reason: "lossy-key" });
+			return yield* decodeSubject(wire).pipe(Effect.mapError(invalid));
+		})
+	};
+};
+/** Keeps the consumer's UUID version, spelling, and database column unchanged. */
+const stringSubjectId = subjectIdCodec(Schema.NonEmptyString);
+/** Rejects unsafe JS integers and noncanonical aliases such as `01` and `1e2`. */
+const numericSubjectId = subjectIdCodec(Schema.FiniteFromString.check(Schema.isInt()));
+/** Use for SQL bigint keys that exceed JavaScript's safe integer range. */
+const bigintSubjectId = subjectIdCodec(Schema.BigIntFromString);
+//#endregion
+export { IdentityCodecError, bigintSubjectId, numericSubjectId, stringSubjectId, subjectIdCodec };
+
+//# sourceMappingURL=codecs.mjs.map

package/dist/identity/codecs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"codecs.mjs","names":[],"sources":["../../src/identity/codecs.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport { SubjectId } from \"../Schema\";\n\n/** Adapter failures deliberately omit the native key and rejected wire input. */\nexport class IdentityCodecError extends Schema.TaggedError<IdentityCodecError>()(\n  \"IdentityCodecError\",\n  { reason: Schema.Literals([\"invalid-key\", \"lossy-key\"]) },\n) {}\n\n/**\n * A consumer's native key remains native in its database. Only the auth boundary\n * uses SubjectId. Neither direction may silently normalize or truncate a key.\n * ID generation belongs to the consumer, including database-generated keys.\n */\nexport const subjectIdCodec = <A>(schema: Schema.Codec<A, string>) => {\n  const decode = Schema.decodeEffect(schema);\n  const encode = Schema.encodeEffect(schema);\n  const decodeSubject = Schema.decodeEffect(SubjectId);\n  const equivalent = Schema.toEquivalence(schema);\n  const invalid = () => IdentityCodecError.make({ reason: \"invalid-key\" });\n\n  return {\n    toNative: Effect.fn(\"subjectIdCodec.toNative\")(function* (subjectId: SubjectId) {\n      const native = yield* decode(subjectId).pipe(Effect.mapError(invalid));\n      const roundTrip = yield* encode(native).pipe(Effect.mapError(invalid));\n\n      if (roundTrip !== subjectId) {\n        return yield* IdentityCodecError.make({ reason: \"lossy-key\" });\n      }\n\n      return native;\n    }),\n    toSubject: Effect.fn(\"subjectIdCodec.toSubject\")(function* (native: A) {\n      const wire = yield* encode(native).pipe(Effect.mapError(invalid));\n      const roundTrip = yield* decode(wire).pipe(Effect.mapError(invalid));\n\n      if (!equivalent(native, roundTrip)) {\n        return yield* IdentityCodecError.make({ reason: \"lossy-key\" });\n      }\n\n      return yield* decodeSubject(wire).pipe(Effect.mapError(invalid));\n    }),\n  } as const;\n};\n\n/** Keeps the consumer's UUID version, spelling, and database column unchanged. */\nexport const stringSubjectId = subjectIdCodec(Schema.NonEmptyString);\n\n/** Rejects unsafe JS integers and noncanonical aliases such as `01` and `1e2`. */\nexport const numericSubjectId = subjectIdCodec(Schema.FiniteFromString.check(Schema.isInt()));\n\n/** Use for SQL bigint keys that exceed JavaScript's safe integer range. */\nexport const bigintSubjectId = subjectIdCodec(Schema.BigIntFromString);\n"],"mappings":";;;;AAKA,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,EAAE,QAAQ,OAAO,SAAS,CAAC,eAAe,WAAW,CAAC,EAAE,CAC1D,CAAC,CAAC,CAAC;;;;;;AAOH,MAAa,kBAAqB,WAAoC;CACpE,MAAM,SAAS,OAAO,aAAa,MAAM;CACzC,MAAM,SAAS,OAAO,aAAa,MAAM;CACzC,MAAM,gBAAgB,OAAO,aAAa,SAAS;CACnD,MAAM,aAAa,OAAO,cAAc,MAAM;CAC9C,MAAM,gBAAgB,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC;CAEvE,OAAO;EACL,UAAU,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,WAAsB;GAC9E,MAAM,SAAS,OAAO,OAAO,SAAS,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;GAGrE,KAAI,OAFqB,OAAO,MAAM,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC,OAEnD,WAChB,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,YAAY,CAAC;GAG/D,OAAO;EACT,CAAC;EACD,WAAW,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,QAAW;GACrE,MAAM,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;GAChE,MAAM,YAAY,OAAO,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;GAEnE,IAAI,CAAC,WAAW,QAAQ,SAAS,GAC/B,OAAO,OAAO,mBAAmB,KAAK,EAAE,QAAQ,YAAY,CAAC;GAG/D,OAAO,OAAO,cAAc,IAAI,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;EACjE,CAAC;CACH;AACF;;AAGA,MAAa,kBAAkB,eAAe,OAAO,cAAc;;AAGnE,MAAa,mBAAmB,eAAe,OAAO,iBAAiB,MAAM,OAAO,MAAM,CAAC,CAAC;;AAG5F,MAAa,kBAAkB,eAAe,OAAO,gBAAgB"}

package/dist/identity/models.d.mts

@@ -0,0 +1,62 @@
+import { Schema } from "effect";
+//#region src/identity/models.d.ts
+declare const LoginIdentifier_base: Schema.Class<LoginIdentifier, Schema.Struct<{
+  readonly namespace: Schema.NonEmptyString;
+  readonly value: Schema.NonEmptyString;
+}>, {}>;
+/** Namespace and normalization are supplied by the method/consumer, not email. */
+declare class LoginIdentifier extends LoginIdentifier_base {}
+declare const ExternalIdentity_base: Schema.Class<ExternalIdentity, Schema.Struct<{
+  readonly provider: Schema.NonEmptyString;
+  readonly issuer: Schema.NonEmptyString;
+  readonly subject: Schema.NonEmptyString;
+}>, {}>;
+/** Stable provider identity. Matching profile email addresses do not imply a link. */
+declare class ExternalIdentity extends ExternalIdentity_base {}
+/** A non-secret reference; never a bearer credential or a recovery code. */
+declare const CredentialId: Schema.brand<Schema.NonEmptyString, "effect-auth/CredentialId">;
+type CredentialId = typeof CredentialId.Type;
+declare const IdentifierBinding_base: Schema.Class<IdentifierBinding, Schema.Struct<{
+  readonly identifier: typeof LoginIdentifier;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly verifiedAt: Schema.Option<Schema.DateTimeUtcFromMillis>;
+}>, {}>;
+declare class IdentifierBinding extends IdentifierBinding_base {}
+declare const CredentialSummary_base: Schema.Class<CredentialSummary, Schema.Struct<{
+  readonly id: Schema.brand<Schema.NonEmptyString, "effect-auth/CredentialId">;
+  readonly method: Schema.NonEmptyString;
+  readonly createdAt: Schema.DateTimeUtcFromMillis;
+  /** A second factor by itself must not count as a remaining sign-in method. */
+  readonly usableForSignIn: Schema.Boolean;
+}>, {}>;
+declare class CredentialSummary extends CredentialSummary_base {}
+declare const SubjectSnapshot_base: Schema.Class<SubjectSnapshot, Schema.Struct<{
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly status: Schema.Literals<readonly ["active", "disabled", "deleting"]>;
+}>, {}>;
+declare class SubjectSnapshot extends SubjectSnapshot_base {}
+/** Consumer-owned reconciliation key; not a token that grants authentication. */
+declare const RecoveryReference: Schema.brand<Schema.NonEmptyString, "effect-auth/RecoveryReference">;
+declare const SubjectProvisioned_base: Schema.Class<SubjectProvisioned, Schema.TaggedStruct<"SubjectProvisioned", {
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+}>, {}>;
+declare class SubjectProvisioned extends SubjectProvisioned_base {}
+declare const ProvisioningPending_base: Schema.Class<ProvisioningPending, Schema.TaggedStruct<"ProvisioningPending", {
+  readonly recoveryReference: Schema.brand<Schema.NonEmptyString, "effect-auth/RecoveryReference">;
+}>, {}>;
+/** No session may be issued until the consumer resolves this outcome. */
+declare class ProvisioningPending extends ProvisioningPending_base {}
+declare const ProvisioningResult: Schema.Union<readonly [typeof SubjectProvisioned, typeof ProvisioningPending]>;
+type ProvisioningResult = typeof ProvisioningResult.Type;
+declare const IdentityConflict_base: Schema.Class<IdentityConflict, Schema.TaggedStruct<"IdentityConflict", {}>, import("effect/Cause").YieldableError>;
+/** Expected identity failures contain no identifier value or database diagnostics. */
+declare class IdentityConflict extends IdentityConflict_base {}
+declare const IdentityUnavailable_base: Schema.Class<IdentityUnavailable, Schema.TaggedStruct<"IdentityUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class IdentityUnavailable extends IdentityUnavailable_base {}
+declare const LastSignInMethod_base: Schema.Class<LastSignInMethod, Schema.TaggedStruct<"LastSignInMethod", {}>, import("effect/Cause").YieldableError>;
+declare class LastSignInMethod extends LastSignInMethod_base {}
+declare const SubjectInactive_base: Schema.Class<SubjectInactive, Schema.TaggedStruct<"SubjectInactive", {}>, import("effect/Cause").YieldableError>;
+declare class SubjectInactive extends SubjectInactive_base {}
+//#endregion
+export { CredentialId, CredentialSummary, ExternalIdentity, IdentifierBinding, IdentityConflict, IdentityUnavailable, LastSignInMethod, LoginIdentifier, ProvisioningPending, ProvisioningResult, RecoveryReference, SubjectInactive, SubjectProvisioned, SubjectSnapshot };
+//# sourceMappingURL=models.d.mts.map

package/dist/identity/models.mjs

@@ -0,0 +1,51 @@
+import { SubjectId } from "../Schema.mjs";
+import { Schema } from "effect";
+//#region src/identity/models.ts
+/** Namespace and normalization are supplied by the method/consumer, not email. */
+var LoginIdentifier = class extends Schema.Class("effect-auth/LoginIdentifier")({
+	namespace: Schema.NonEmptyString,
+	value: Schema.NonEmptyString
+}) {};
+/** Stable provider identity. Matching profile email addresses do not imply a link. */
+var ExternalIdentity = class extends Schema.Class("effect-auth/ExternalIdentity")({
+	provider: Schema.NonEmptyString,
+	issuer: Schema.NonEmptyString,
+	subject: Schema.NonEmptyString
+}) {};
+/** A non-secret reference; never a bearer credential or a recovery code. */
+const CredentialId = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/CredentialId"));
+var IdentifierBinding = class extends Schema.Class("effect-auth/IdentifierBinding")({
+	identifier: LoginIdentifier,
+	subjectId: SubjectId,
+	verifiedAt: Schema.Option(Schema.DateTimeUtcFromMillis)
+}) {};
+var CredentialSummary = class extends Schema.Class("effect-auth/CredentialSummary")({
+	id: CredentialId,
+	method: Schema.NonEmptyString,
+	createdAt: Schema.DateTimeUtcFromMillis,
+	/** A second factor by itself must not count as a remaining sign-in method. */
+	usableForSignIn: Schema.Boolean
+}) {};
+var SubjectSnapshot = class extends Schema.Class("effect-auth/SubjectSnapshot")({
+	subjectId: SubjectId,
+	status: Schema.Literals([
+		"active",
+		"disabled",
+		"deleting"
+	])
+}) {};
+/** Consumer-owned reconciliation key; not a token that grants authentication. */
+const RecoveryReference = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/RecoveryReference"));
+var SubjectProvisioned = class extends Schema.TaggedClass()("SubjectProvisioned", { subjectId: SubjectId }) {};
+/** No session may be issued until the consumer resolves this outcome. */
+var ProvisioningPending = class extends Schema.TaggedClass()("ProvisioningPending", { recoveryReference: RecoveryReference }) {};
+const ProvisioningResult = Schema.Union([SubjectProvisioned, ProvisioningPending]);
+/** Expected identity failures contain no identifier value or database diagnostics. */
+var IdentityConflict = class extends Schema.TaggedError()("IdentityConflict", {}) {};
+var IdentityUnavailable = class extends Schema.TaggedError()("IdentityUnavailable", {}) {};
+var LastSignInMethod = class extends Schema.TaggedError()("LastSignInMethod", {}) {};
+var SubjectInactive = class extends Schema.TaggedError()("SubjectInactive", {}) {};
+//#endregion
+export { CredentialId, CredentialSummary, ExternalIdentity, IdentifierBinding, IdentityConflict, IdentityUnavailable, LastSignInMethod, LoginIdentifier, ProvisioningPending, ProvisioningResult, RecoveryReference, SubjectInactive, SubjectProvisioned, SubjectSnapshot };
+
+//# sourceMappingURL=models.mjs.map

package/dist/identity/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/identity/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { SubjectId } from \"../Schema\";\n\n/** Namespace and normalization are supplied by the method/consumer, not email. */\nexport class LoginIdentifier extends Schema.Class<LoginIdentifier>(\"effect-auth/LoginIdentifier\")({\n  namespace: Schema.NonEmptyString,\n  value: Schema.NonEmptyString,\n}) {}\n\n/** Stable provider identity. Matching profile email addresses do not imply a link. */\nexport class ExternalIdentity extends Schema.Class<ExternalIdentity>(\n  \"effect-auth/ExternalIdentity\",\n)({\n  provider: Schema.NonEmptyString,\n  issuer: Schema.NonEmptyString,\n  subject: Schema.NonEmptyString,\n}) {}\n\n/** A non-secret reference; never a bearer credential or a recovery code. */\nexport const CredentialId = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/CredentialId\"));\nexport type CredentialId = typeof CredentialId.Type;\n\nexport class IdentifierBinding extends Schema.Class<IdentifierBinding>(\n  \"effect-auth/IdentifierBinding\",\n)({\n  identifier: LoginIdentifier,\n  subjectId: SubjectId,\n  verifiedAt: Schema.Option(Schema.DateTimeUtcFromMillis),\n}) {}\n\nexport class CredentialSummary extends Schema.Class<CredentialSummary>(\n  \"effect-auth/CredentialSummary\",\n)({\n  id: CredentialId,\n  method: Schema.NonEmptyString,\n  createdAt: Schema.DateTimeUtcFromMillis,\n  /** A second factor by itself must not count as a remaining sign-in method. */\n  usableForSignIn: Schema.Boolean,\n}) {}\n\nexport class SubjectSnapshot extends Schema.Class<SubjectSnapshot>(\"effect-auth/SubjectSnapshot\")({\n  subjectId: SubjectId,\n  status: Schema.Literals([\"active\", \"disabled\", \"deleting\"]),\n}) {}\n\n/** Consumer-owned reconciliation key; not a token that grants authentication. */\nexport const RecoveryReference = Schema.NonEmptyString.pipe(\n  Schema.brand(\"effect-auth/RecoveryReference\"),\n);\n\nexport class SubjectProvisioned extends Schema.TaggedClass<SubjectProvisioned>()(\n  \"SubjectProvisioned\",\n  { subjectId: SubjectId },\n) {}\n\n/** No session may be issued until the consumer resolves this outcome. */\nexport class ProvisioningPending extends Schema.TaggedClass<ProvisioningPending>()(\n  \"ProvisioningPending\",\n  { recoveryReference: RecoveryReference },\n) {}\n\nexport const ProvisioningResult = Schema.Union([SubjectProvisioned, ProvisioningPending]);\nexport type ProvisioningResult = typeof ProvisioningResult.Type;\n\n/** Expected identity failures contain no identifier value or database diagnostics. */\nexport class IdentityConflict extends Schema.TaggedError<IdentityConflict>()(\n  \"IdentityConflict\",\n  {},\n) {}\n\nexport class IdentityUnavailable extends Schema.TaggedError<IdentityUnavailable>()(\n  \"IdentityUnavailable\",\n  {},\n) {}\n\nexport class LastSignInMethod extends Schema.TaggedError<LastSignInMethod>()(\n  \"LastSignInMethod\",\n  {},\n) {}\n\nexport class SubjectInactive extends Schema.TaggedError<SubjectInactive>()(\"SubjectInactive\", {}) {}\n"],"mappings":";;;;AAKA,IAAa,kBAAb,cAAqC,OAAO,MAAuB,6BAA6B,CAAC,CAAC;CAChG,WAAW,OAAO;CAClB,OAAO,OAAO;AAChB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,8BACF,CAAC,CAAC;CACA,UAAU,OAAO;CACjB,QAAQ,OAAO;CACf,SAAS,OAAO;AAClB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,eAAe,OAAO,eAAe,KAAK,OAAO,MAAM,0BAA0B,CAAC;AAG/F,IAAa,oBAAb,cAAuC,OAAO,MAC5C,+BACF,CAAC,CAAC;CACA,YAAY;CACZ,WAAW;CACX,YAAY,OAAO,OAAO,OAAO,qBAAqB;AACxD,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,oBAAb,cAAuC,OAAO,MAC5C,+BACF,CAAC,CAAC;CACA,IAAI;CACJ,QAAQ,OAAO;CACf,WAAW,OAAO;;CAElB,iBAAiB,OAAO;AAC1B,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,kBAAb,cAAqC,OAAO,MAAuB,6BAA6B,CAAC,CAAC;CAChG,WAAW;CACX,QAAQ,OAAO,SAAS;EAAC;EAAU;EAAY;CAAU,CAAC;AAC5D,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,oBAAoB,OAAO,eAAe,KACrD,OAAO,MAAM,+BAA+B,CAC9C;AAEA,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,EAAE,WAAW,UAAU,CACzB,CAAC,CAAC,CAAC;;AAGH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,EAAE,mBAAmB,kBAAkB,CACzC,CAAC,CAAC,CAAC;AAEH,MAAa,qBAAqB,OAAO,MAAM,CAAC,oBAAoB,mBAAmB,CAAC;;AAIxF,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAC1E,oBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAC1E,oBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/identity/operations.d.mts

@@ -0,0 +1,118 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../operations/errors.mjs";
+import { AssuranceRequirement, AuthInvocation } from "../operations/context.mjs";
+import { AuthOperation, OperationHandler } from "../operations/operation.mjs";
+import { CredentialSummary, IdentifierBinding, IdentityConflict, IdentityUnavailable, LastSignInMethod, LoginIdentifier, SubjectInactive, SubjectSnapshot } from "./models.mjs";
+import "../Operations.mjs";
+import "../Auth.mjs";
+import { InvalidationUnsupported, SubjectCleanupComplete, SubjectCleanupPending, SubjectLifecycle } from "./SubjectLifecycle.mjs";
+import { IdentityMutation } from "./IdentityMutation.mjs";
+import { IdentityRepository } from "./IdentityRepository.mjs";
+import { Effect, Layer, Schema } from "effect";
+//#region src/identity/operations.d.ts
+declare const InspectIdentity: AuthOperation<"identity.inspect", Schema.Void, typeof SubjectSnapshot, Schema.Union<readonly [typeof SubjectInactive, typeof IdentityUnavailable]>, never, {
+  readonly payload: Schema.Void;
+  readonly success: typeof SubjectSnapshot;
+  readonly error: Schema.Union<readonly [typeof SubjectInactive, typeof IdentityUnavailable]>;
+  readonly access: "authenticated";
+  readonly exposure: "public";
+  readonly replay: "read-only";
+}>;
+declare const ListIdentifiers: AuthOperation<"identity.listIdentifiers", Schema.Void, Schema.$Array<typeof IdentifierBinding>, Schema.Union<readonly [typeof SubjectInactive, typeof IdentityUnavailable]>, never, {
+  readonly payload: Schema.Void;
+  readonly success: Schema.$Array<typeof IdentifierBinding>;
+  readonly error: Schema.Union<readonly [typeof SubjectInactive, typeof IdentityUnavailable]>;
+  readonly access: "authenticated";
+  readonly exposure: "public";
+  readonly replay: "read-only";
+}>;
+declare const ListCredentials: AuthOperation<"identity.listCredentials", Schema.Void, Schema.$Array<typeof CredentialSummary>, Schema.Union<readonly [typeof SubjectInactive, typeof IdentityUnavailable]>, never, {
+  readonly payload: Schema.Void;
+  readonly success: Schema.$Array<typeof CredentialSummary>;
+  readonly error: Schema.Union<readonly [typeof SubjectInactive, typeof IdentityUnavailable]>;
+  readonly access: "authenticated";
+  readonly exposure: "public";
+  readonly replay: "read-only";
+}>;
+declare const identityQueryLayer: Layer.Layer<OperationHandler<"identity.inspect", void, SubjectSnapshot, AssuranceRequired | AuthenticationRequired | IdentityUnavailable | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | SubjectInactive> | OperationHandler<"identity.listCredentials", void, readonly CredentialSummary[], AssuranceRequired | AuthenticationRequired | IdentityUnavailable | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | SubjectInactive> | OperationHandler<"identity.listIdentifiers", void, readonly IdentifierBinding[], AssuranceRequired | AuthenticationRequired | IdentityUnavailable | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | SubjectInactive>, never, IdentityRepository>;
+/** Configure the method/factor policy at the consumer's Layer composition boundary. */
+declare const makeIdentityChanges: (assurance: AssuranceRequirement) => {
+  readonly RemoveIdentifier: AuthOperation<"identity.removeIdentifier", Schema.Struct<{
+    readonly identifier: typeof LoginIdentifier;
+  }>, Schema.Void, Schema.Union<readonly [typeof IdentityConflict, typeof LastSignInMethod, typeof SubjectInactive, typeof IdentityUnavailable]>, never, {
+    readonly payload: Schema.Struct<{
+      readonly identifier: typeof LoginIdentifier;
+    }>;
+    readonly success: Schema.Void;
+    readonly error: Schema.Union<readonly [typeof IdentityConflict, typeof LastSignInMethod, typeof SubjectInactive, typeof IdentityUnavailable]>;
+    readonly access: "authenticated";
+    readonly exposure: "public";
+    readonly replay: "non-idempotent";
+    readonly authorize: (_: {
+      readonly identifier: LoginIdentifier;
+    }, context: AuthInvocation) => Effect.Effect<void, AssuranceRequired | AuthenticationRequired, never>;
+  }>;
+  readonly RemoveCredential: AuthOperation<"identity.removeCredential", Schema.Struct<{
+    readonly credentialId: Schema.brand<Schema.NonEmptyString, "effect-auth/CredentialId">;
+  }>, Schema.Void, Schema.Union<readonly [typeof IdentityConflict, typeof LastSignInMethod, typeof SubjectInactive, typeof IdentityUnavailable]>, never, {
+    readonly payload: Schema.Struct<{
+      readonly credentialId: Schema.brand<Schema.NonEmptyString, "effect-auth/CredentialId">;
+    }>;
+    readonly success: Schema.Void;
+    readonly error: Schema.Union<readonly [typeof IdentityConflict, typeof LastSignInMethod, typeof SubjectInactive, typeof IdentityUnavailable]>;
+    readonly access: "authenticated";
+    readonly exposure: "public";
+    readonly replay: "non-idempotent";
+    readonly authorize: (_: {
+      readonly credentialId: string & import("effect/Brand").Brand<"effect-auth/CredentialId">;
+    }, context: AuthInvocation) => Effect.Effect<void, AssuranceRequired | AuthenticationRequired, never>;
+  }>;
+  readonly layer: Layer.Layer<OperationHandler<"identity.removeCredential", {
+    readonly credentialId: string & import("effect/Brand").Brand<"effect-auth/CredentialId">;
+  }, void, AssuranceRequired | AuthenticationRequired | IdentityConflict | IdentityUnavailable | InvalidOperationInput | LastSignInMethod | OperationForbidden | OperationPrivateOutputUnsupported | SubjectInactive> | OperationHandler<"identity.removeIdentifier", {
+    readonly identifier: LoginIdentifier;
+  }, void, AssuranceRequired | AuthenticationRequired | IdentityConflict | IdentityUnavailable | InvalidOperationInput | LastSignInMethod | OperationForbidden | OperationPrivateOutputUnsupported | SubjectInactive>, never, IdentityMutation>;
+};
+/** System operations have contracts without being implicitly network-exposed. */
+declare const DisableSubject: AuthOperation<"identity.disableSubject", Schema.Struct<{
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly requestId: Schema.NonEmptyString;
+  readonly invalidation: Schema.Literals<readonly ["immediate", "allow-expiry"]>;
+}>, Schema.Union<readonly [typeof SubjectCleanupComplete, typeof SubjectCleanupPending]>, Schema.Union<readonly [typeof InvalidationUnsupported, typeof IdentityUnavailable]>, never, {
+  readonly payload: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly requestId: Schema.NonEmptyString;
+    readonly invalidation: Schema.Literals<readonly ["immediate", "allow-expiry"]>;
+  }>;
+  readonly success: Schema.Union<readonly [typeof SubjectCleanupComplete, typeof SubjectCleanupPending]>;
+  readonly error: Schema.Union<readonly [typeof InvalidationUnsupported, typeof IdentityUnavailable]>;
+  readonly access: "system";
+  readonly replay: "idempotent";
+}>;
+declare const DeleteSubject: AuthOperation<"identity.deleteSubject", Schema.Struct<{
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly requestId: Schema.NonEmptyString;
+  readonly invalidation: Schema.Literals<readonly ["immediate", "allow-expiry"]>;
+}>, Schema.Union<readonly [typeof SubjectCleanupComplete, typeof SubjectCleanupPending]>, Schema.Union<readonly [typeof InvalidationUnsupported, typeof IdentityUnavailable]>, never, {
+  readonly payload: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly requestId: Schema.NonEmptyString;
+    readonly invalidation: Schema.Literals<readonly ["immediate", "allow-expiry"]>;
+  }>;
+  readonly success: Schema.Union<readonly [typeof SubjectCleanupComplete, typeof SubjectCleanupPending]>;
+  readonly error: Schema.Union<readonly [typeof InvalidationUnsupported, typeof IdentityUnavailable]>;
+  readonly access: "system";
+  readonly replay: "idempotent";
+}>;
+/** Install only when the application supports account termination. */
+declare const subjectLifecycleLayer: Layer.Layer<OperationHandler<"identity.deleteSubject", {
+  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+  readonly requestId: string;
+  readonly invalidation: "allow-expiry" | "immediate";
+}, SubjectCleanupComplete | SubjectCleanupPending, AssuranceRequired | AuthenticationRequired | IdentityUnavailable | InvalidOperationInput | InvalidationUnsupported | OperationForbidden | OperationPrivateOutputUnsupported> | OperationHandler<"identity.disableSubject", {
+  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+  readonly requestId: string;
+  readonly invalidation: "allow-expiry" | "immediate";
+}, SubjectCleanupComplete | SubjectCleanupPending, AssuranceRequired | AuthenticationRequired | IdentityUnavailable | InvalidOperationInput | InvalidationUnsupported | OperationForbidden | OperationPrivateOutputUnsupported>, never, SubjectLifecycle>;
+//#endregion
+export { DeleteSubject, DisableSubject, InspectIdentity, ListCredentials, ListIdentifiers, identityQueryLayer, makeIdentityChanges, subjectLifecycleLayer };
+//# sourceMappingURL=operations.d.mts.map