@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/Assurance.js

@@ -0,0 +1,764 @@
+import { Context, Data, Effect, Layer, Result, Schema } from "effect";
+import { CredentialIdSchema, OAuthProviderIdSchema, UnixMillisSchema, } from "./Identifiers.js";
+export const assuranceLevels = ["aal1", "aal2", "aal3"];
+const assuranceRank = {
+    aal1: 1,
+    aal2: 2,
+    aal3: 3,
+};
+export const rankAssurance = (level) => assuranceRank[level];
+export const assuranceAtLeast = (actual, required) => rankAssurance(actual) >= rankAssurance(required);
+export const strongerAssurance = (left, right) => (assuranceAtLeast(left, right) ? left : right);
+export const canonicalAuthMethodReferences = [
+    "pwd",
+    "email_otp",
+    "magic_link",
+    "oauth",
+    "totp",
+    "passkey",
+    "recovery_code",
+];
+export class AuthenticationEvidenceTimeError extends Data.TaggedError("AuthenticationEvidenceTimeError") {
+}
+/** Maximum time authentication evidence may lead the server clock by default. */
+export const defaultAuthenticationEvidenceFutureSkewMillis = 60_000;
+export const validateAuthenticationEvidenceTimestamps = (events, serverNow, maximumFutureSkewMillis = defaultAuthenticationEvidenceFutureSkewMillis) => {
+    const latestAccepted = Number(serverNow) + maximumFutureSkewMillis;
+    for (const event of events) {
+        if (Number(event.verifiedAt) > latestAccepted) {
+            return Result.fail(new AuthenticationEvidenceTimeError({
+                eventType: event.type,
+                verifiedAt: event.verifiedAt,
+                serverNow,
+                maximumFutureSkewMillis,
+            }));
+        }
+    }
+    return Result.void;
+};
+const NonEmptyString = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));
+export const maximumCustomEvidenceProperties = 32;
+export const maximumCustomEvidencePropertyKeyLength = 128;
+export const maximumCustomEvidenceStringPropertyLength = 2048;
+export const maximumCustomAuthMethodReferenceLength = 128;
+const CustomEvidenceStringProperty = Schema.String.check(Schema.isMaxLength(maximumCustomEvidenceStringPropertyLength));
+const CustomEvidencePropertiesSchema = Schema.Record(Schema.String, Schema.Union([Schema.Boolean, Schema.Finite, CustomEvidenceStringProperty])).check(Schema.makeFilter((properties) => {
+    const keys = Object.keys(properties);
+    if (keys.length > maximumCustomEvidenceProperties) {
+        return `Expected at most ${maximumCustomEvidenceProperties} custom evidence properties`;
+    }
+    return keys.every((key) => key.length >= 1 && key.length <= maximumCustomEvidencePropertyKeyLength)
+        ? undefined
+        : `Expected custom evidence property keys to contain 1..${maximumCustomEvidencePropertyKeyLength} characters`;
+}));
+const NonNegativeInteger = Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0));
+const VerifiedAt = UnixMillisSchema.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0));
+const Base = { version: Schema.Literal(1), verifiedAt: VerifiedAt };
+export const AuthenticationEvent = Schema.Union([
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("password"),
+        credentialId: CredentialIdSchema,
+    }),
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("email_otp"),
+        identityId: NonEmptyString,
+    }),
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("magic_link"),
+        identityId: NonEmptyString,
+    }),
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("oauth"),
+        providerId: OAuthProviderIdSchema,
+        providerAccountId: NonEmptyString,
+    }),
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("totp"),
+        factorId: CredentialIdSchema,
+        acceptedCounter: NonNegativeInteger,
+    }),
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("passkey"),
+        credentialId: CredentialIdSchema,
+        userVerification: Schema.Literals(["verified", "not-verified", "unknown"]),
+        authenticatorAttachment: Schema.optional(Schema.Literals(["platform", "cross-platform"])),
+        backedUp: Schema.optional(Schema.Boolean),
+        backupEligible: Schema.optional(Schema.Boolean),
+        signCount: Schema.optional(NonNegativeInteger),
+        aaguid: Schema.optional(NonEmptyString),
+    }),
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("recovery_code"),
+        codeId: CredentialIdSchema,
+    }),
+    Schema.Struct({
+        ...Base,
+        type: Schema.Literal("custom"),
+        policyId: NonEmptyString,
+        policyVersion: NonNegativeInteger.check(Schema.isGreaterThan(0)),
+        kind: NonEmptyString,
+        properties: CustomEvidencePropertiesSchema,
+    }),
+]);
+export const maximumSessionAuthenticationEvents = 32;
+export const AuthenticationEvents = Schema.Array(AuthenticationEvent).check(Schema.isMaxLength(maximumSessionAuthenticationEvents));
+export const parseAuthenticationEvent = Schema.decodeUnknownSync(AuthenticationEvent);
+export const parseAuthenticationEvents = Schema.decodeUnknownSync(AuthenticationEvents);
+const immutable = (evidence) => Object.freeze(evidence);
+export const passwordEvidence = (evidence) => immutable({ version: 1, type: "password", ...evidence });
+export const emailOtpEvidence = (evidence) => immutable({ version: 1, type: "email_otp", ...evidence });
+export const magicLinkEvidence = (evidence) => immutable({ version: 1, type: "magic_link", ...evidence });
+export const oauthEvidence = (evidence) => immutable({ version: 1, type: "oauth", ...evidence });
+export const totpEvidence = (evidence) => immutable({ version: 1, type: "totp", ...evidence });
+export const passkeyEvidence = (evidence) => immutable({ version: 1, type: "passkey", ...evidence });
+export const recoveryCodeEvidence = (evidence) => immutable({ version: 1, type: "recovery_code", ...evidence });
+const parseCustomEvidence = Schema.decodeUnknownSync(AuthenticationEvent, {
+    onExcessProperty: "error",
+});
+export const customEvidence = (evidence) => {
+    const parsed = parseCustomEvidence({
+        version: 1,
+        type: "custom",
+        ...evidence,
+    });
+    if (parsed.type !== "custom") {
+        throw new TypeError("Expected custom authentication evidence");
+    }
+    return immutable({
+        ...parsed,
+        properties: Object.freeze({ ...parsed.properties }),
+    });
+};
+export class CustomEvidencePolicyError extends Data.TaggedError("CustomEvidencePolicyError") {
+}
+export class CustomEvidencePolicyConfigurationError extends Data.TaggedError("CustomEvidencePolicyConfigurationError") {
+}
+const CustomEvidencePolicyTypeId = Symbol.for("@effect-auth/core/Assurance/CustomEvidencePolicy");
+const configurationError = (reason, policyId, policyVersion, cause) => new CustomEvidencePolicyConfigurationError({
+    reason,
+    policyId: typeof policyId === "string" ? policyId : "<invalid>",
+    policyVersion: typeof policyVersion === "number" ? policyVersion : Number.NaN,
+    ...(cause === undefined ? {} : { cause }),
+});
+const policyError = (reason, evidence, cause) => new CustomEvidencePolicyError({
+    reason,
+    policyId: evidence.policyId,
+    policyVersion: evidence.policyVersion,
+    ...(cause === undefined ? {} : { cause }),
+});
+const isFlatPropertyAst = (ast) => {
+    if (ast.encoding !== undefined ||
+        ast.context?.isOptional === true ||
+        ast.context?.isMutable === true ||
+        ast.context?.defaultValue !== undefined) {
+        return false;
+    }
+    switch (ast._tag) {
+        case "Boolean":
+        case "String":
+        case "Number": {
+            return true;
+        }
+        case "Literal": {
+            return (typeof ast.literal === "boolean" ||
+                typeof ast.literal === "string" ||
+                (typeof ast.literal === "number" && Number.isFinite(ast.literal)));
+        }
+        case "Enum": {
+            return ast.enums.every(([, value]) => typeof value === "string" ||
+                (typeof value === "number" && Number.isFinite(value)));
+        }
+        case "TemplateLiteral": {
+            return ast.parts.every(isFlatPropertyAst);
+        }
+        case "Union": {
+            return ast.types.length > 0 && ast.types.every(isFlatPropertyAst);
+        }
+        default: {
+            return false;
+        }
+    }
+};
+const isValidCustomEvidencePropertiesSchema = (properties) => {
+    if (typeof properties !== "object" ||
+        properties === null ||
+        !("fields" in properties) ||
+        !("ast" in properties)) {
+        return false;
+    }
+    const schema = properties;
+    const fieldKeys = Reflect.ownKeys(schema.fields);
+    return (schema.ast._tag === "Objects" &&
+        schema.ast.encoding === undefined &&
+        schema.ast.indexSignatures.length === 0 &&
+        schema.ast.propertySignatures.length === fieldKeys.length &&
+        fieldKeys.length <= maximumCustomEvidenceProperties &&
+        schema.ast.propertySignatures.every((field) => typeof field.name === "string" &&
+            field.name.length >= 1 &&
+            field.name.length <= maximumCustomEvidencePropertyKeyLength &&
+            isFlatPropertyAst(field.type)));
+};
+const validateDefinitionMetadata = (definition) => {
+    if (typeof definition.policyId !== "string" ||
+        definition.policyId.length === 0 ||
+        definition.policyId.length > 256) {
+        return Result.fail(configurationError("invalid_policy_id", definition.policyId, definition.policyVersion));
+    }
+    if (typeof definition.policyVersion !== "number" ||
+        !Number.isSafeInteger(definition.policyVersion) ||
+        definition.policyVersion <= 0) {
+        return Result.fail(configurationError("invalid_policy_version", definition.policyId, definition.policyVersion));
+    }
+    if (typeof definition.kind !== "string" ||
+        definition.kind.length === 0 ||
+        definition.kind.length > 256) {
+        return Result.fail(configurationError("invalid_policy_kind", definition.policyId, definition.policyVersion));
+    }
+    if (!isValidCustomEvidencePropertiesSchema(definition.properties) ||
+        typeof definition.evaluate !== "function") {
+        return Result.fail(configurationError("invalid_policy_metadata", definition.policyId, definition.policyVersion, new TypeError("Custom evidence policies require at most 32 flat, required, transformation-free property fields and an evaluator")));
+    }
+    return Result.void;
+};
+const decodeBoundedCustomEvidenceProperties = Schema.decodeUnknownResult(CustomEvidencePropertiesSchema, { errors: "all", onExcessProperty: "error" });
+const safeDecodeProperties = (decode, input) => {
+    const attempted = Result.try(() => decode(input));
+    return Result.isFailure(attempted)
+        ? Result.fail(attempted.failure)
+        : attempted.success;
+};
+export const defineCustomEvidence = (definition) => {
+    Result.getOrThrow(validateDefinitionMetadata(definition));
+    const typedPropertiesSchema = Schema.toType(definition.properties);
+    const decodeTypedProperties = Schema.decodeUnknownResult(typedPropertiesSchema, { errors: "all", onExcessProperty: "error" });
+    const internals = {
+        validateProperties: (properties) => {
+            const bounded = safeDecodeProperties(decodeBoundedCustomEvidenceProperties, properties);
+            if (Result.isFailure(bounded)) {
+                return bounded;
+            }
+            const decoded = safeDecodeProperties(decodeTypedProperties, bounded.success);
+            return Result.isFailure(decoded)
+                ? decoded
+                : Result.succeed(Object.freeze({ ...decoded.success }));
+        },
+        evaluate: (properties) => definition.evaluate(properties),
+    };
+    const policy = Object.freeze({
+        policyId: definition.policyId,
+        policyVersion: definition.policyVersion,
+        kind: definition.kind,
+        [CustomEvidencePolicyTypeId]: Object.freeze(internals),
+    });
+    const make = (input) => {
+        const properties = Result.getOrThrow(internals.validateProperties(input.properties));
+        return customEvidence({
+            verifiedAt: input.verifiedAt,
+            policyId: definition.policyId,
+            policyVersion: definition.policyVersion,
+            kind: definition.kind,
+            properties,
+        });
+    };
+    return Object.freeze({ policy, make });
+};
+export class CustomEvidencePolicies extends Context.Service()("auth/CustomEvidencePolicies") {
+}
+export const emptyCustomEvidencePolicyRegistry = Object.freeze({ resolve: () => undefined });
+const isCustomEvidencePolicy = (policy) => {
+    if (typeof policy !== "object" ||
+        policy === null ||
+        !(CustomEvidencePolicyTypeId in policy)) {
+        return false;
+    }
+    const internals = policy[CustomEvidencePolicyTypeId];
+    return (typeof internals === "object" &&
+        internals !== null &&
+        "validateProperties" in internals &&
+        typeof internals.validateProperties === "function" &&
+        "evaluate" in internals &&
+        typeof internals.evaluate === "function");
+};
+export const makeCustomEvidencePolicyRegistryResult = (policies) => {
+    const registered = new Map();
+    for (const policy of policies) {
+        const metadata = Result.try(() => ({
+            policyId: policy.policyId,
+            policyVersion: policy.policyVersion,
+            kind: policy.kind,
+            valid: isCustomEvidencePolicy(policy),
+        }));
+        if (Result.isFailure(metadata)) {
+            return Result.fail(configurationError("invalid_policy_metadata", "<invalid>", Number.NaN, metadata.failure));
+        }
+        const { kind, policyId, policyVersion, valid } = metadata.success;
+        if (typeof policyId !== "string" ||
+            policyId.length === 0 ||
+            policyId.length > 256) {
+            return Result.fail(configurationError("invalid_policy_id", policyId, policyVersion));
+        }
+        if (!Number.isSafeInteger(policyVersion) || policyVersion <= 0) {
+            return Result.fail(configurationError("invalid_policy_version", policyId, policyVersion));
+        }
+        if (typeof kind !== "string" || kind.length === 0 || kind.length > 256) {
+            return Result.fail(configurationError("invalid_policy_kind", policyId, policyVersion));
+        }
+        if (!valid) {
+            return Result.fail(configurationError("invalid_policy_metadata", policyId, policyVersion));
+        }
+        const key = `${policyId}\u0000${policyVersion}`;
+        if (registered.has(key)) {
+            return Result.fail(configurationError("duplicate_policy", policyId, policyVersion));
+        }
+        registered.set(key, policy);
+    }
+    return Result.succeed(Object.freeze({
+        resolve: (policyId, policyVersion) => registered.get(`${policyId}\u0000${policyVersion}`),
+    }));
+};
+/**
+ * Compatibility constructor for existing synchronous call sites. New code should
+ * use makeCustomEvidencePolicyRegistryResult with defineCustomEvidence policies.
+ */
+export const makeCustomEvidencePolicyRegistry = (policies) => Result.getOrThrow(makeCustomEvidencePolicyRegistryResult(policies));
+(function (CustomEvidencePolicies) {
+    CustomEvidencePolicies.make = (policies) => Effect.fromResult(makeCustomEvidencePolicyRegistryResult(policies)).pipe(Effect.map(CustomEvidencePolicies.of));
+})(CustomEvidencePolicies || (CustomEvidencePolicies = {}));
+export const CustomEvidencePoliciesLive = (policies) => Layer.effect(CustomEvidencePolicies)(CustomEvidencePolicies.make(policies));
+const CustomEvidencePolicyResultSchema = Schema.Union([
+    Schema.Struct({
+        role: Schema.Literal("primary"),
+        level: Schema.Literal("aal1"),
+        amr: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximumCustomAuthMethodReferenceLength)),
+    }),
+    Schema.Struct({
+        role: Schema.Literal("independent-second-factor"),
+        level: Schema.Literal("aal1"),
+        amr: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximumCustomAuthMethodReferenceLength)),
+    }),
+    Schema.Struct({
+        role: Schema.Literal("multi-factor"),
+        level: Schema.Literals(["aal2", "aal3"]),
+        amr: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximumCustomAuthMethodReferenceLength)),
+    }),
+]);
+const decodeCustomEvidencePolicyResult = Schema.decodeUnknownResult(CustomEvidencePolicyResultSchema, { errors: "all", onExcessProperty: "error" });
+const reservedCustomAuthMethodReferences = new Set(canonicalAuthMethodReferences);
+const evaluateCustomEvidenceResult = (evidence, registry) => {
+    const resolved = Result.try(() => registry.resolve(evidence.policyId, evidence.policyVersion));
+    if (Result.isFailure(resolved)) {
+        return Result.fail(policyError("unregistered_policy", evidence, resolved.failure));
+    }
+    const policy = resolved.success;
+    if (policy === undefined) {
+        return Result.fail(policyError("unregistered_policy", evidence));
+    }
+    if (!isCustomEvidencePolicy(policy)) {
+        return Result.fail(policyError("unregistered_policy", evidence));
+    }
+    const internals = policy[CustomEvidencePolicyTypeId];
+    if (evidence.kind !== policy.kind) {
+        return Result.fail(policyError("kind_mismatch", evidence, {
+            expected: policy.kind,
+            actual: evidence.kind,
+        }));
+    }
+    const properties = internals.validateProperties(evidence.properties);
+    if (Result.isFailure(properties)) {
+        return Result.fail(policyError("invalid_properties", evidence, properties.failure));
+    }
+    const evaluated = Result.try({
+        try: () => internals.evaluate(properties.success),
+        catch: (cause) => policyError("invalid_result", evidence, cause),
+    });
+    if (Result.isFailure(evaluated)) {
+        return Result.fail(evaluated.failure);
+    }
+    const decodedAttempt = Result.try(() => decodeCustomEvidencePolicyResult(evaluated.success));
+    if (Result.isFailure(decodedAttempt)) {
+        return Result.fail(policyError("invalid_result", evidence, decodedAttempt.failure));
+    }
+    const decoded = decodedAttempt.success;
+    if (Result.isFailure(decoded)) {
+        return Result.fail(policyError("invalid_result", evidence, decoded.failure));
+    }
+    if (reservedCustomAuthMethodReferences.has(decoded.success.amr)) {
+        return Result.fail(policyError("reserved_amr", evidence));
+    }
+    return Result.succeed(Object.freeze(decoded.success));
+};
+const evidenceAssuranceSemanticsResult = (evidence, registry) => {
+    if (evidence.type === "custom") {
+        const evaluated = evaluateCustomEvidenceResult(evidence, registry);
+        if (Result.isFailure(evaluated)) {
+            return Result.fail(evaluated.failure);
+        }
+        const result = evaluated.success;
+        return Result.succeed({
+            amr: result.amr,
+            level: result.level,
+            primaryEstablished: result.role === "primary" || result.role === "multi-factor",
+            independentSecondFactor: result.role === "independent-second-factor" ||
+                result.role === "multi-factor",
+            multiFactor: result.role === "multi-factor",
+        });
+    }
+    if (evidence.type === "passkey") {
+        const multiFactor = evidence.userVerification === "verified";
+        return Result.succeed({
+            amr: "passkey",
+            level: multiFactor ? "aal2" : "aal1",
+            primaryEstablished: true,
+            independentSecondFactor: multiFactor,
+            multiFactor,
+        });
+    }
+    if (evidence.type === "totp") {
+        return Result.succeed({
+            amr: "totp",
+            level: "aal1",
+            primaryEstablished: false,
+            independentSecondFactor: true,
+            multiFactor: false,
+        });
+    }
+    if (evidence.type === "recovery_code") {
+        return Result.succeed({
+            amr: "recovery_code",
+            level: "aal1",
+            primaryEstablished: false,
+            independentSecondFactor: false,
+            multiFactor: false,
+        });
+    }
+    return Result.succeed({
+        amr: evidence.type === "password" ? "pwd" : evidence.type,
+        level: "aal1",
+        primaryEstablished: true,
+        independentSecondFactor: false,
+        multiFactor: false,
+    });
+};
+export const authenticationMethodForResult = (evidence, customEvidencePolicies) => {
+    const semantics = evidenceAssuranceSemanticsResult(evidence, customEvidencePolicies);
+    return Result.isFailure(semantics)
+        ? Result.fail(semantics.failure)
+        : Result.succeed(semantics.success.amr);
+};
+export const authenticationMethodFor = (evidence, customEvidencePolicies = emptyCustomEvidencePolicyRegistry) => Result.getOrThrow(authenticationMethodForResult(evidence, customEvidencePolicies));
+export const authenticationFactorId = (evidence) => {
+    switch (evidence.type) {
+        case "password":
+        case "passkey": {
+            return evidence.credentialId;
+        }
+        case "totp": {
+            return evidence.factorId;
+        }
+        case "recovery_code": {
+            return evidence.codeId;
+        }
+        default: {
+            return undefined;
+        }
+    }
+};
+export const authenticationEventMatchesMethodResult = (evidence, method, customEvidencePolicies) => {
+    const actual = authenticationMethodForResult(evidence, customEvidencePolicies);
+    return Result.isFailure(actual)
+        ? Result.fail(actual.failure)
+        : Result.succeed(actual.success === method);
+};
+export const authenticationEventMatchesMethod = (evidence, method, customEvidencePolicies = emptyCustomEvidencePolicyRegistry) => Result.getOrThrow(authenticationEventMatchesMethodResult(evidence, method, customEvidencePolicies));
+export const latestAuthenticationEvent = (events, predicate) => {
+    let latest;
+    for (const event of events) {
+        if (predicate(event) &&
+            (latest === undefined || event.verifiedAt > latest.verifiedAt)) {
+            latest = event;
+        }
+    }
+    return latest;
+};
+export const latestMethodAuthenticationEventResult = (events, method, customEvidencePolicies) => {
+    let latest;
+    for (const event of events) {
+        const matches = authenticationEventMatchesMethodResult(event, method, customEvidencePolicies);
+        if (Result.isFailure(matches)) {
+            return Result.fail(matches.failure);
+        }
+        if (matches.success &&
+            (latest === undefined || event.verifiedAt > latest.verifiedAt)) {
+            latest = event;
+        }
+    }
+    return Result.succeed(latest);
+};
+export const latestMethodAuthenticationEvent = (events, method, customEvidencePolicies = emptyCustomEvidencePolicyRegistry) => Result.getOrThrow(latestMethodAuthenticationEventResult(events, method, customEvidencePolicies));
+export const latestFactorAuthenticationEventResult = (events, method, factorId, customEvidencePolicies) => {
+    let latest;
+    for (const event of events) {
+        const matches = authenticationEventMatchesMethodResult(event, method, customEvidencePolicies);
+        if (Result.isFailure(matches)) {
+            return Result.fail(matches.failure);
+        }
+        if (matches.success &&
+            authenticationFactorId(event) === factorId &&
+            (latest === undefined || event.verifiedAt > latest.verifiedAt)) {
+            latest = event;
+        }
+    }
+    return Result.succeed(latest);
+};
+export const latestFactorAuthenticationEvent = (events, method, factorId, customEvidencePolicies = emptyCustomEvidencePolicyRegistry) => Result.getOrThrow(latestFactorAuthenticationEventResult(events, method, factorId, customEvidencePolicies));
+const collectEventSemanticsResult = (events, registry) => {
+    const collected = [];
+    for (const event of events) {
+        const semantics = evidenceAssuranceSemanticsResult(event, registry);
+        if (Result.isFailure(semantics)) {
+            return Result.fail(semantics.failure);
+        }
+        collected.push({ event, semantics: semantics.success });
+    }
+    return Result.succeed(collected);
+};
+const laterEvent = (left, right) => left === undefined
+    ? right
+    : right === undefined || left.event.verifiedAt >= right.event.verifiedAt
+        ? left
+        : right;
+const latestSemanticEvent = (events, predicate) => {
+    let latest;
+    for (const entry of events) {
+        if (predicate(entry) &&
+            (latest === undefined || entry.event.verifiedAt > latest.event.verifiedAt)) {
+            latest = entry;
+        }
+    }
+    return latest;
+};
+export const latestAssuranceAuthenticationEventResult = (events, required, customEvidencePolicies) => {
+    const collected = collectEventSemanticsResult(events, customEvidencePolicies);
+    if (Result.isFailure(collected)) {
+        return Result.fail(collected.failure);
+    }
+    const entries = collected.success;
+    if (required !== "aal1" &&
+        entries.some(({ event }) => event.type === "recovery_code")) {
+        return Result.succeed(undefined);
+    }
+    if (required === "aal1") {
+        return Result.succeed(latestSemanticEvent(entries, ({ semantics }) => semantics.primaryEstablished)?.event);
+    }
+    const multiFactor = latestSemanticEvent(entries, ({ semantics }) => semantics.multiFactor && assuranceAtLeast(semantics.level, required));
+    if (required === "aal3") {
+        return Result.succeed(multiFactor?.event);
+    }
+    const primary = latestSemanticEvent(entries, ({ semantics }) => semantics.primaryEstablished && !semantics.multiFactor);
+    const independent = latestSemanticEvent(entries, ({ semantics }) => semantics.independentSecondFactor && !semantics.multiFactor);
+    const composed = primary === undefined || independent === undefined
+        ? undefined
+        : laterEvent(primary, independent);
+    return Result.succeed(laterEvent(multiFactor, composed)?.event);
+};
+export const latestAssuranceAuthenticationEvent = (events, required, customEvidencePolicies = emptyCustomEvidencePolicyRegistry) => Result.getOrThrow(latestAssuranceAuthenticationEventResult(events, required, customEvidencePolicies));
+export const deriveAssuranceResult = (events, options = {}) => {
+    const registry = options.customEvidencePolicies ?? emptyCustomEvidencePolicyRegistry;
+    const collected = collectEventSemanticsResult(events, registry);
+    if (Result.isFailure(collected)) {
+        return Result.fail(collected.failure);
+    }
+    let level = "aal1";
+    let primaryEstablished = false;
+    let hasIndependentSecondFactor = false;
+    let recoveryRemediation = false;
+    let authenticatedAt;
+    const methods = new Set();
+    for (const { event, semantics } of collected.success) {
+        methods.add(semantics.amr);
+        authenticatedAt =
+            authenticatedAt === undefined || event.verifiedAt > authenticatedAt
+                ? event.verifiedAt
+                : authenticatedAt;
+        level = strongerAssurance(level, semantics.level);
+        primaryEstablished ||= semantics.primaryEstablished;
+        hasIndependentSecondFactor ||= semantics.independentSecondFactor;
+        if (event.type === "recovery_code") {
+            recoveryRemediation = true;
+        }
+    }
+    if (primaryEstablished && hasIndependentSecondFactor) {
+        level = strongerAssurance(level, "aal2");
+    }
+    if (recoveryRemediation && assuranceAtLeast(level, "aal2")) {
+        level = "aal1";
+    }
+    const builtIns = canonicalAuthMethodReferences.filter((method) => methods.delete(method));
+    // ES2022 does not provide toSorted; both arrays are fresh local copies.
+    // oxlint-disable-next-line unicorn/no-array-sort
+    const custom = [...methods].sort();
+    return Result.succeed(Object.freeze({
+        level,
+        amr: Object.freeze([...builtIns, ...custom]),
+        ...(authenticatedAt === undefined ? {} : { authenticatedAt }),
+        primaryEstablished,
+        recoveryRemediation,
+    }));
+};
+export const deriveAssurance = (events, options = {}) => Result.getOrThrow(deriveAssuranceResult(events, options));
+const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const stableEventKey = (event, semantics) => {
+    const properties = event.type === "custom"
+        ? Object.keys(event.properties)
+            // ES2022 does not provide toSorted; this is a fresh local array.
+            // oxlint-disable-next-line unicorn/no-array-sort
+            .sort(compareStrings)
+            .map((key) => [key, event.properties[key]])
+        : undefined;
+    return JSON.stringify([
+        event.type,
+        semantics.amr,
+        event.verifiedAt,
+        event.type === "password" || event.type === "passkey"
+            ? event.credentialId
+            : event.type === "totp"
+                ? event.factorId
+                : event.type === "recovery_code"
+                    ? event.codeId
+                    : event.type === "email_otp" || event.type === "magic_link"
+                        ? event.identityId
+                        : event.type === "oauth"
+                            ? [event.providerId, event.providerAccountId]
+                            : [
+                                event.policyId,
+                                event.policyVersion,
+                                event.kind,
+                                semantics.level,
+                                semantics.primaryEstablished,
+                                semantics.independentSecondFactor,
+                                properties,
+                            ],
+    ]);
+};
+const compactionKey = ({ event, semantics }) => {
+    const factor = authenticationFactorId(event);
+    if (factor !== undefined) {
+        return `factor:${event.type}:${factor}`;
+    }
+    return event.type === "custom"
+        ? `custom:${event.policyId}:${event.policyVersion}:${event.kind}:${semantics.amr}:${semantics.level}:${semantics.primaryEstablished}:${semantics.independentSecondFactor}`
+        : `method:${event.type}`;
+};
+const compactionImportance = ({ event, semantics, }) => event.type === "recovery_code"
+    ? 500
+    : semantics.multiFactor
+        ? semantics.level === "aal3"
+            ? 400
+            : 350
+        : semantics.independentSecondFactor
+            ? 250
+            : semantics.primaryEstablished
+                ? 200
+                : 100;
+export const compactAuthenticationEventsResult = (events, maximumEvents, customEvidencePolicies) => {
+    if (!Number.isSafeInteger(maximumEvents) || maximumEvents < 0) {
+        throw new RangeError("maximumEvents must be a non-negative safe integer");
+    }
+    const collected = collectEventSemanticsResult(events, customEvidencePolicies);
+    if (Result.isFailure(collected)) {
+        return Result.fail(collected.failure);
+    }
+    if (maximumEvents === 0) {
+        return Result.succeed(Object.freeze([]));
+    }
+    const sorted = [...collected.success];
+    // ES2022 does not provide toSorted; this array is a fresh local copy.
+    // oxlint-disable-next-line unicorn/no-array-sort
+    sorted.sort((left, right) => left.event.verifiedAt === right.event.verifiedAt
+        ? compareStrings(stableEventKey(left.event, left.semantics), stableEventKey(right.event, right.semantics))
+        : left.event.verifiedAt < right.event.verifiedAt
+            ? -1
+            : 1);
+    if (sorted.length <= maximumEvents) {
+        return Result.succeed(Object.freeze(sorted.map(({ event }) => event)));
+    }
+    // Retain the latest event for each stable method/factor. If cardinality exceeds
+    // the bound, older factor-specific evidence is deliberately absent so a
+    // factor freshness check fails rather than falling back to another factor.
+    const latestByKey = new Map();
+    for (const entry of sorted) {
+        latestByKey.set(compactionKey(entry), entry);
+    }
+    const retained = [...latestByKey.values()];
+    // oxlint-disable-next-line unicorn/no-array-sort
+    retained.sort((left, right) => compactionImportance(right) - compactionImportance(left) ||
+        (left.event.verifiedAt === right.event.verifiedAt
+            ? compareStrings(stableEventKey(left.event, left.semantics), stableEventKey(right.event, right.semantics))
+            : left.event.verifiedAt > right.event.verifiedAt
+                ? -1
+                : 1));
+    const selected = retained.slice(0, maximumEvents);
+    // oxlint-disable-next-line unicorn/no-array-sort
+    selected.sort((left, right) => left.event.verifiedAt === right.event.verifiedAt
+        ? compareStrings(stableEventKey(left.event, left.semantics), stableEventKey(right.event, right.semantics))
+        : left.event.verifiedAt < right.event.verifiedAt
+            ? -1
+            : 1);
+    return Result.succeed(Object.freeze(selected.map(({ event }) => event)));
+};
+const compatibilityCompactionKey = (event) => event.type === "custom"
+    ? JSON.stringify([
+        event.type,
+        event.policyId,
+        event.policyVersion,
+        event.kind,
+        Object.keys(event.properties)
+            // ES2022 does not provide toSorted; this is a fresh local array.
+            // oxlint-disable-next-line unicorn/no-array-sort
+            .sort(compareStrings)
+            .map((key) => [key, event.properties[key]]),
+    ])
+    : event.type;
+export const compactAuthenticationEvents = (events, maximumEvents = 32, customEvidencePolicies) => {
+    if (!Number.isSafeInteger(maximumEvents) || maximumEvents < 0) {
+        throw new RangeError("maximumEvents must be a non-negative safe integer");
+    }
+    if (customEvidencePolicies === undefined &&
+        events.length <= maximumEvents &&
+        events.some((event) => event.type === "custom")) {
+        const sorted = [...events];
+        // Compatibility for callers that compact before using their captured
+        // registry to derive assurance. No policy decision is needed without truncation.
+        // oxlint-disable-next-line unicorn/no-array-sort
+        sorted.sort((left, right) => left.verifiedAt === right.verifiedAt
+            ? compareStrings(compatibilityCompactionKey(left), compatibilityCompactionKey(right))
+            : left.verifiedAt < right.verifiedAt
+                ? -1
+                : 1);
+        return Result.getOrThrow(Result.succeed(Object.freeze(sorted)));
+    }
+    return Result.getOrThrow(compactAuthenticationEventsResult(events, maximumEvents, customEvidencePolicies ?? emptyCustomEvidencePolicyRegistry));
+};
+export const deriveMfaVerifiedAtResult = (events, customEvidencePolicies) => {
+    const collected = collectEventSemanticsResult(events, customEvidencePolicies);
+    if (Result.isFailure(collected)) {
+        return Result.fail(collected.failure);
+    }
+    const entries = collected.success;
+    const multiFactor = latestSemanticEvent(entries, ({ semantics }) => semantics.multiFactor);
+    const primary = latestSemanticEvent(entries, ({ semantics }) => semantics.primaryEstablished && !semantics.multiFactor);
+    const independent = latestSemanticEvent(entries, ({ semantics }) => semantics.independentSecondFactor && !semantics.multiFactor);
+    const composed = primary === undefined || independent === undefined
+        ? undefined
+        : laterEvent(primary, independent);
+    return Result.succeed(laterEvent(multiFactor, composed)?.event.verifiedAt);
+};
+export const deriveMfaVerifiedAt = (events, customEvidencePolicies = emptyCustomEvidencePolicyRegistry) => Result.getOrThrow(deriveMfaVerifiedAtResult(events, customEvidencePolicies));
+//# sourceMappingURL=Assurance.js.map