@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/Password.js

@@ -0,0 +1,641 @@
+import { Context, Data, Duration, Effect, Encoding, Layer, Option, Redacted, Result, } from "effect";
+import { AuthFlow, AuthResult } from "./AuthFlow.js";
+import { Challenge } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import { CredentialId, Email, UserId } from "./Identifiers.js";
+import { addMillis, currentUnixMillis, timingSafeEqualString, } from "./Internal.js";
+import { AuthMailer } from "./Mailer.js";
+import { CredentialStore, SessionStore, UserStore } from "./Storage.js";
+export class PasswordHashError extends Data.TaggedError("PasswordHashError") {
+}
+export class PasswordHasher extends Context.Service()("auth/PasswordHasher") {
+}
+(function (PasswordHasher) {
+    PasswordHasher.make = (service) => PasswordHasher.of(service);
+})(PasswordHasher || (PasswordHasher = {}));
+const textEncoder = new TextEncoder();
+const passwordHashPrefix = "pbkdf2-sha256";
+const getWebCrypto = (options, operation) => Effect.gen(function* () {
+    const crypto = options.webCrypto ?? globalThis.crypto;
+    if (crypto === undefined) {
+        return yield* new PasswordHashError({
+            operation,
+            message: "Web Crypto is not available",
+        });
+    }
+    return crypto;
+});
+const decodeBase64Url = (value, operation) => Result.match(Encoding.decodeBase64Url(value), {
+    onSuccess: Effect.succeed,
+    onFailure: (cause) => Effect.fail(new PasswordHashError({
+        operation,
+        message: "Invalid password hash encoding",
+        cause,
+    })),
+});
+const parsePasswordHash = (hash) => {
+    const [prefix, iterations, salt, derivedKey] = hash.split("$");
+    if (prefix !== passwordHashPrefix ||
+        iterations === undefined ||
+        salt === undefined ||
+        derivedKey === undefined) {
+        return undefined;
+    }
+    const parsedIterations = Number(iterations);
+    if (!Number.isInteger(parsedIterations) || parsedIterations <= 0) {
+        return undefined;
+    }
+    return {
+        iterations: parsedIterations,
+        salt,
+        derivedKey,
+    };
+};
+const derivePbkdf2Sha256 = (input) => Effect.tryPromise({
+    try: async () => {
+        const key = await input.webCrypto.subtle.importKey("raw", textEncoder.encode(Redacted.value(input.password)), { name: "PBKDF2" }, false, ["deriveBits"]);
+        const bits = await input.webCrypto.subtle.deriveBits({
+            name: "PBKDF2",
+            hash: "SHA-256",
+            salt: input.salt,
+            iterations: input.iterations,
+        }, key, input.hashBytes * 8);
+        return new Uint8Array(bits);
+    },
+    catch: (cause) => new PasswordHashError({
+        operation: input.operation,
+        message: "Failed to derive PBKDF2 password hash",
+        cause,
+    }),
+});
+export const makePbkdf2PasswordHasher = (dependencies) => {
+    const iterations = dependencies.iterations ?? 210_000;
+    const saltBytes = dependencies.saltBytes ?? 16;
+    const hashBytes = dependencies.hashBytes ?? 32;
+    return PasswordHasher.make({
+        hash: Effect.fn("auth.password_hash.pbkdf2.hash")(function* (input) {
+            const webCrypto = yield* getWebCrypto(dependencies, "hash");
+            const salt = yield* dependencies.crypto.randomBytes(saltBytes).pipe(Effect.mapError((cause) => new PasswordHashError({
+                operation: "hash",
+                message: "Failed to generate password salt",
+                cause,
+            })));
+            const derivedKey = yield* derivePbkdf2Sha256({
+                webCrypto,
+                password: input.password,
+                salt,
+                iterations,
+                hashBytes,
+                operation: "hash",
+            });
+            return [
+                passwordHashPrefix,
+                String(iterations),
+                Encoding.encodeBase64Url(salt),
+                Encoding.encodeBase64Url(derivedKey),
+            ].join("$");
+        }),
+        verify: Effect.fn("auth.password_hash.pbkdf2.verify")(function* (input) {
+            const parsed = parsePasswordHash(input.hash);
+            if (parsed === undefined) {
+                return yield* new PasswordHashError({
+                    operation: "verify",
+                    message: "Invalid password hash format",
+                });
+            }
+            const webCrypto = yield* getWebCrypto(dependencies, "verify");
+            const salt = yield* decodeBase64Url(parsed.salt, "verify");
+            const expected = yield* decodeBase64Url(parsed.derivedKey, "verify");
+            const derivedKey = yield* derivePbkdf2Sha256({
+                webCrypto,
+                password: input.password,
+                salt,
+                iterations: parsed.iterations,
+                hashBytes: expected.byteLength,
+                operation: "verify",
+            });
+            return yield* timingSafeEqualString(dependencies.crypto, Encoding.encodeBase64Url(derivedKey), parsed.derivedKey).pipe(Effect.mapError((cause) => new PasswordHashError({
+                operation: "verify",
+                message: "Failed to compare password hash",
+                cause,
+            })));
+        }),
+    });
+};
+export const Pbkdf2PasswordHasherLive = (options) => Layer.effect(PasswordHasher)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const resolvedOptions = options ?? {};
+    return makePbkdf2PasswordHasher({
+        ...resolvedOptions,
+        crypto,
+    });
+}));
+export class PasswordLogin extends Context.Service()("auth/login/Password") {
+}
+(function (PasswordLogin) {
+    PasswordLogin.make = (service) => PasswordLogin.of(service);
+})(PasswordLogin || (PasswordLogin = {}));
+export const makePasswordLogin = (dependencies) => PasswordLogin.make({
+    signIn: Effect.fn("auth.password.sign_in")(function* (input) {
+        yield* Effect.annotateCurrentSpan("auth.method", "password");
+        const user = yield* dependencies.users.findByEmail(input.email);
+        if (Option.isNone(user)) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        if (user.value.disabledAt !== undefined) {
+            yield* Effect.annotateCurrentSpan("auth.result", "AccountDisabled");
+            return AuthResult.AccountDisabled();
+        }
+        const credential = yield* dependencies.credentials.findPasswordByUserId(user.value.id);
+        if (Option.isNone(credential) ||
+            credential.value.revokedAt !== undefined) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        const verified = yield* dependencies.hasher.verify({
+            hash: credential.value.passwordHash,
+            password: input.password,
+        });
+        if (!verified) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        return yield* dependencies.authFlow.completePrimaryFactor({
+            userId: user.value.id,
+            email: user.value.email,
+            intent: "sign-in",
+            method: "password",
+            amr: ["pwd"],
+            aal: "aal1",
+            claims: { emailVerified: user.value.emailVerified },
+            ...(input.trustedDeviceToken === undefined
+                ? {}
+                : { trustedDeviceToken: input.trustedDeviceToken }),
+            ...(input.request === undefined ? {} : { request: input.request }),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        });
+    }),
+});
+export const PasswordLoginLive = Layer.effect(PasswordLogin)(Effect.gen(function* () {
+    const users = yield* UserStore;
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    const authFlow = yield* AuthFlow;
+    return makePasswordLogin({
+        users,
+        credentials,
+        hasher,
+        authFlow,
+    });
+}));
+export class EmailAlreadyRegisteredError extends Data.TaggedError("EmailAlreadyRegisteredError") {
+}
+export class PasswordRegistration extends Context.Service()("auth/registration/Password") {
+}
+(function (PasswordRegistration) {
+    PasswordRegistration.make = (service) => PasswordRegistration.of(service);
+})(PasswordRegistration || (PasswordRegistration = {}));
+export const makePasswordRegistration = (dependencies) => {
+    const userIdBytes = dependencies.userIdBytes ?? 16;
+    const credentialIdBytes = dependencies.credentialIdBytes ?? 16;
+    return PasswordRegistration.make({
+        signUp: Effect.fn("auth.password.sign_up")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.method", "password");
+            const existing = yield* dependencies.users.findByEmail(input.email);
+            if (Option.isSome(existing)) {
+                yield* Effect.annotateCurrentSpan("auth.result", "EmailAlreadyRegistered");
+                return yield* new EmailAlreadyRegisteredError({ email: input.email });
+            }
+            const now = yield* currentUnixMillis;
+            const emailVerified = input.emailVerified ?? false;
+            const userId = UserId(yield* dependencies.crypto.randomToken(userIdBytes));
+            const credentialId = CredentialId(yield* dependencies.crypto.randomToken(credentialIdBytes));
+            const passwordHash = yield* dependencies.hasher.hash({
+                password: input.password,
+            });
+            yield* dependencies.users.insert({
+                id: userId,
+                email: input.email,
+                emailVerified,
+                createdAt: now,
+                updatedAt: now,
+                metadata: input.metadata,
+            });
+            yield* dependencies.credentials.insertPassword({
+                id: credentialId,
+                userId,
+                passwordHash,
+                createdAt: now,
+                updatedAt: now,
+            });
+            yield* Effect.annotateCurrentSpan("auth.result", "registered");
+            return yield* dependencies.authFlow.completePrimaryFactor({
+                userId,
+                email: input.email,
+                intent: "sign-up",
+                method: "password",
+                amr: ["pwd"],
+                aal: "aal1",
+                claims: { emailVerified },
+                ...(input.request === undefined ? {} : { request: input.request }),
+                ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+            });
+        }),
+    });
+};
+export const PasswordRegistrationLive = Layer.effect(PasswordRegistration)(Effect.gen(function* () {
+    const users = yield* UserStore;
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    const authFlow = yield* AuthFlow;
+    const crypto = yield* Crypto;
+    return makePasswordRegistration({
+        users,
+        credentials,
+        hasher,
+        authFlow,
+        crypto,
+    });
+}));
+export class PasswordResetStartError extends Data.TaggedError("PasswordResetStartError") {
+}
+export class PasswordResetVerifyError extends Data.TaggedError("PasswordResetVerifyError") {
+}
+export class PasswordReset extends Context.Service()("auth/password/Reset") {
+}
+(function (PasswordReset) {
+    PasswordReset.make = (service) => PasswordReset.of(service);
+})(PasswordReset || (PasswordReset = {}));
+export const defaultPasswordResetTtl = Duration.minutes(15);
+export const defaultPasswordResetSecretBytes = 32;
+const passwordResetUserIdFromMetadata = (metadata) => {
+    const userId = metadata?.userId;
+    return typeof userId === "string" && userId.length > 0
+        ? UserId(userId)
+        : undefined;
+};
+const passwordResetTtlMillis = (ttl) => {
+    const millis = Duration.toMillis(ttl);
+    return Number.isFinite(millis) && millis > 0
+        ? Effect.succeed(millis)
+        : Effect.fail(new PasswordResetStartError({
+            message: "Password reset ttl must be a positive finite duration",
+        }));
+};
+const passwordResetStartSecret = (crypto, input, secretBytes) => {
+    if (input.secret !== undefined) {
+        return Effect.succeed(Redacted.make(Redacted.value(input.secret).trim()));
+    }
+    return crypto.randomToken(secretBytes).pipe(Effect.map(Redacted.make), Effect.mapError((cause) => new PasswordResetStartError({
+        message: "Failed to generate password reset secret",
+        cause,
+    })));
+};
+const passwordResetVerifySecret = (secret) => Redacted.make(Redacted.value(secret).trim());
+const makePasswordResetUrl = (dependencies, input) => Effect.try({
+    try: () => dependencies.makeUrl(input),
+    catch: (cause) => new PasswordResetStartError({
+        message: "Failed to build password reset URL",
+        cause,
+    }),
+});
+const invalidatePasswordResetChallenge = (challenge, id) => challenge
+    .consume(id)
+    .pipe(Effect.catchTag("ChallengeConsumeError", () => Effect.void));
+export const makePasswordReset = (dependencies) => {
+    const ttl = dependencies.ttl ?? defaultPasswordResetTtl;
+    const secretBytes = dependencies.secretBytes ?? defaultPasswordResetSecretBytes;
+    const credentialIdBytes = dependencies.credentialIdBytes ?? 16;
+    return PasswordReset.make({
+        start: Effect.fn("auth.password_reset.start")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.method", "password-reset");
+            const resolvedTtl = input.ttl ?? ttl;
+            const expiresIn = yield* passwordResetTtlMillis(resolvedTtl);
+            const now = yield* currentUnixMillis;
+            const genericStarted = {
+                email: input.email,
+                expiresAt: addMillis(now, expiresIn),
+            };
+            const userOption = yield* dependencies.users.findByEmail(input.email).pipe(Effect.mapError((cause) => new PasswordResetStartError({
+                message: "Failed to load user for password reset",
+                cause,
+            })));
+            if (Option.isNone(userOption)) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PasswordResetIgnored");
+                return genericStarted;
+            }
+            const user = userOption.value;
+            if (user.disabledAt !== undefined) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PasswordResetIgnored");
+                return genericStarted;
+            }
+            const credentialOption = yield* dependencies.credentials
+                .findPasswordByUserId(user.id)
+                .pipe(Effect.mapError((cause) => new PasswordResetStartError({
+                message: "Failed to load password credential for reset",
+                cause,
+            })));
+            if (Option.isSome(credentialOption) &&
+                credentialOption.value.revokedAt !== undefined) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PasswordResetIgnored");
+                return genericStarted;
+            }
+            const secret = yield* passwordResetStartSecret(dependencies.crypto, input, secretBytes);
+            const issued = yield* dependencies.challenge
+                .issue({
+                type: "reset-password",
+                subject: user.email,
+                ttl: resolvedTtl,
+                secret,
+                metadata: {
+                    ...input.metadata,
+                    userId: user.id,
+                },
+            })
+                .pipe(Effect.mapError((cause) => new PasswordResetStartError({
+                message: "Failed to issue password reset challenge",
+                cause,
+            })));
+            const started = {
+                email: user.email,
+                expiresAt: issued.expiresAt,
+            };
+            const url = yield* makePasswordResetUrl(dependencies, {
+                ...started,
+                challengeId: issued.id,
+                secret,
+                locale: input.locale,
+                metadata: input.metadata,
+            }).pipe(Effect.matchEffect({
+                onSuccess: Effect.succeed,
+                onFailure: (error) => invalidatePasswordResetChallenge(dependencies.challenge, issued.id).pipe(Effect.flatMap(() => Effect.fail(error))),
+            }));
+            yield* dependencies.authMailer
+                .send({
+                _tag: "PasswordReset",
+                to: user.email,
+                challengeId: issued.id,
+                url,
+                expiresAt: issued.expiresAt,
+                locale: input.locale,
+                metadata: input.metadata,
+            })
+                .pipe(Effect.matchEffect({
+                onSuccess: () => Effect.void,
+                onFailure: (cause) => invalidatePasswordResetChallenge(dependencies.challenge, issued.id).pipe(Effect.flatMap(() => Effect.fail(new PasswordResetStartError({
+                    message: "Failed to send password reset email",
+                    cause,
+                })))),
+            }));
+            yield* Effect.annotateCurrentSpan("auth.result", "PasswordResetStarted");
+            return started;
+        }),
+        verify: Effect.fn("auth.password_reset.verify")(function* (input) {
+            yield* Effect.annotateCurrentSpan("auth.method", "password-reset");
+            const verified = yield* dependencies.challenge
+                .verify({
+                challengeId: input.challengeId,
+                type: "reset-password",
+                secret: passwordResetVerifySecret(input.secret),
+            })
+                .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Invalid password reset challenge",
+                cause,
+            })));
+            const userId = passwordResetUserIdFromMetadata(verified.metadata);
+            if (userId === undefined) {
+                return yield* new PasswordResetVerifyError({
+                    message: "Password reset challenge is missing user metadata",
+                });
+            }
+            const userOption = yield* dependencies.users.findById(userId).pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Failed to load user for password reset",
+                cause,
+            })));
+            if (Option.isNone(userOption) ||
+                userOption.value.disabledAt !== undefined ||
+                userOption.value.email !== Email(verified.subject)) {
+                return yield* new PasswordResetVerifyError({
+                    message: "Invalid password reset challenge",
+                });
+            }
+            const credentialOption = yield* dependencies.credentials
+                .findPasswordByUserId(userId)
+                .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Failed to load password credential for reset",
+                cause,
+            })));
+            if (Option.isSome(credentialOption) &&
+                credentialOption.value.revokedAt !== undefined) {
+                return yield* new PasswordResetVerifyError({
+                    message: "Password credential not found",
+                });
+            }
+            const now = yield* currentUnixMillis;
+            const passwordHash = yield* dependencies.hasher
+                .hash({ password: input.password })
+                .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Failed to hash password reset password",
+                cause,
+            })));
+            if (Option.isSome(credentialOption)) {
+                const updated = yield* dependencies.credentials
+                    .updatePassword({
+                    userId,
+                    passwordHash,
+                    updatedAt: now,
+                })
+                    .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                    message: "Failed to update password credential",
+                    cause,
+                })));
+                if (Option.isNone(updated)) {
+                    return yield* new PasswordResetVerifyError({
+                        message: "Password credential not found",
+                    });
+                }
+            }
+            else {
+                const credentialId = CredentialId(yield* dependencies.crypto.randomToken(credentialIdBytes).pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                    message: "Failed to generate password credential id",
+                    cause,
+                }))));
+                yield* dependencies.credentials
+                    .insertPassword({
+                    id: credentialId,
+                    userId,
+                    passwordHash,
+                    createdAt: now,
+                    updatedAt: now,
+                })
+                    .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                    message: "Failed to create password credential",
+                    cause,
+                })));
+            }
+            yield* dependencies.sessionStore
+                .revokeAllForUser({
+                userId,
+                revokedAt: now,
+                reason: "password_reset",
+            })
+                .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Failed to revoke sessions after password reset",
+                cause,
+            })));
+            yield* Effect.annotateCurrentSpan("auth.result", "PasswordResetVerified");
+        }),
+    });
+};
+export const PasswordResetLive = (options) => Layer.effect(PasswordReset)(Effect.gen(function* () {
+    const challenge = yield* Challenge;
+    const users = yield* UserStore;
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    const crypto = yield* Crypto;
+    const authMailer = yield* AuthMailer;
+    const sessionStore = yield* SessionStore;
+    return makePasswordReset({
+        ...options,
+        challenge,
+        users,
+        credentials,
+        hasher,
+        crypto,
+        authMailer,
+        sessionStore,
+    });
+}));
+export const PasswordResetFeatureLive = (options) => {
+    const { passwordHasher, ...resetOptions } = options;
+    return PasswordResetLive(resetOptions).pipe(Layer.provideMerge(Pbkdf2PasswordHasherLive(passwordHasher)));
+};
+export class PasswordSetError extends Data.TaggedError("PasswordSetError") {
+}
+export class PasswordChangeError extends Data.TaggedError("PasswordChangeError") {
+}
+export class PasswordManagement extends Context.Service()("auth/password/Management") {
+}
+(function (PasswordManagement) {
+    PasswordManagement.make = (service) => PasswordManagement.of(service);
+})(PasswordManagement || (PasswordManagement = {}));
+export const makePasswordManagement = (dependencies) => {
+    const credentialIdBytes = dependencies.credentialIdBytes ?? 16;
+    return PasswordManagement.make({
+        set: Effect.fn("auth.password.set")(function* (input) {
+            const credential = yield* dependencies.credentials
+                .findPasswordByUserId(input.userId)
+                .pipe(Effect.mapError((cause) => new PasswordSetError({
+                reason: "internal",
+                message: "Failed to load password credential",
+                cause,
+            })));
+            if (Option.isSome(credential)) {
+                return yield* new PasswordSetError({
+                    reason: credential.value.revokedAt === undefined
+                        ? "password_exists"
+                        : "password_revoked",
+                    message: "Password credential already exists",
+                });
+            }
+            const now = yield* currentUnixMillis;
+            const credentialId = CredentialId(yield* dependencies.crypto.randomToken(credentialIdBytes).pipe(Effect.mapError((cause) => new PasswordSetError({
+                reason: "internal",
+                message: "Failed to generate password credential id",
+                cause,
+            }))));
+            const passwordHash = yield* dependencies.hasher
+                .hash({ password: input.password })
+                .pipe(Effect.mapError((cause) => new PasswordSetError({
+                reason: "internal",
+                message: "Failed to hash password",
+                cause,
+            })));
+            yield* dependencies.credentials
+                .insertPassword({
+                id: credentialId,
+                userId: input.userId,
+                passwordHash,
+                createdAt: now,
+                updatedAt: now,
+                metadata: input.metadata,
+            })
+                .pipe(Effect.mapError((cause) => new PasswordSetError({
+                reason: "internal",
+                message: "Failed to create password credential",
+                cause,
+            })));
+        }),
+        change: Effect.fn("auth.password.change")(function* (input) {
+            const credential = yield* dependencies.credentials
+                .findPasswordByUserId(input.userId)
+                .pipe(Effect.mapError((cause) => new PasswordChangeError({
+                reason: "internal",
+                message: "Failed to load password credential",
+                cause,
+            })));
+            if (Option.isNone(credential)) {
+                return yield* new PasswordChangeError({
+                    reason: "password_missing",
+                    message: "Password credential not found",
+                });
+            }
+            if (credential.value.revokedAt !== undefined) {
+                return yield* new PasswordChangeError({
+                    reason: "password_revoked",
+                    message: "Password credential not found",
+                });
+            }
+            const verified = yield* dependencies.hasher
+                .verify({
+                hash: credential.value.passwordHash,
+                password: input.currentPassword,
+            })
+                .pipe(Effect.mapError((cause) => new PasswordChangeError({
+                reason: "internal",
+                message: "Failed to verify current password",
+                cause,
+            })));
+            if (!verified) {
+                return yield* new PasswordChangeError({
+                    reason: "invalid_current_password",
+                    message: "Current password is invalid",
+                });
+            }
+            const now = yield* currentUnixMillis;
+            const passwordHash = yield* dependencies.hasher
+                .hash({ password: input.newPassword })
+                .pipe(Effect.mapError((cause) => new PasswordChangeError({
+                reason: "internal",
+                message: "Failed to hash new password",
+                cause,
+            })));
+            const updated = yield* dependencies.credentials
+                .updatePassword({
+                userId: input.userId,
+                passwordHash,
+                updatedAt: now,
+            })
+                .pipe(Effect.mapError((cause) => new PasswordChangeError({
+                reason: "internal",
+                message: "Failed to update password credential",
+                cause,
+            })));
+            if (Option.isNone(updated)) {
+                return yield* new PasswordChangeError({
+                    reason: "password_missing",
+                    message: "Password credential not found",
+                });
+            }
+        }),
+    });
+};
+export const PasswordManagementLive = Layer.effect(PasswordManagement)(Effect.gen(function* () {
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    const crypto = yield* Crypto;
+    return makePasswordManagement({ credentials, hasher, crypto });
+}));
+export const PasswordFeatureLive = (options) => Layer.mergeAll(PasswordLoginLive, PasswordRegistrationLive, PasswordManagementLive).pipe(Layer.provideMerge(Pbkdf2PasswordHasherLive(options)));
+//# sourceMappingURL=Password.js.map