@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/password-native.mjs

@@ -0,0 +1,292 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { allocatePasswordNextSecurityRevision, allocatePasswordValue, passwordEvidenceSatisfiedAt, passwordProofRedemptionMatches, snapshotPasswordMutation, validatePasswordMutation } from "./password-policy.mjs";
+import { requireStandalone } from "./standalone.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlCommitReceipt, registerSqlPostcondition } from "./sql-commit.mjs";
+import { makeNativeProofStore } from "./proof-native.mjs";
+import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials.mjs";
+import { Crypto, DateTime, Effect, Option, Redacted, Schema } from "effect";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import * as P from "@yielded/auth/Password";
+import { ProofRedemptionInput } from "@yielded/auth/Proofs";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/password-native.ts
+const unavailable = () => P.PasswordUnavailable.make({});
+const ensure = (condition) => {
+	if (!condition) throw unavailable();
+};
+const makeNativePasswordServices = Effect.fnUntraced(function* (tables, mapping, proofs) {
+	const batch = yield* SqlBatchCommit;
+	const sql = (yield* SqlClient).withoutTransforms();
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const parent = yield* Effect.serviceOption(CurrentSqlCommit);
+	const s = mapping.subject, i = mapping.identifier, c = mapping.credential, a = mapping.authorityCredential;
+	const subject = tables(s.table).as("password_subject");
+	const identifier = tables(i.table).as("password_identifier");
+	const credential = tables(c.table).as("password_credential");
+	const authority = tables(a.table).as("password_authority");
+	const rawSubject = tables(s.table), rawPassword = tables(c.table), rawAuthority = tables(a.table);
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const lock = sql.onDialectOrElse({
+		sqlite: () => sql``,
+		orElse: () => sql`for update`
+	});
+	const exact = (table, key, value) => exactSqlText(sql, table.column(key), table.value(key, value));
+	const subjectKey = (table, key, nativeId) => sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+	const run = (work) => batch === void 0 ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto))) : executor.batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto))).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const read = Effect.fnUntraced(function* (moduleId, subjectId, wanted, locked) {
+		const nativeId = yield* mapping.subjectId.toNative(subjectId);
+		const joined = wanted !== void 0;
+		const rows = yield* sql`select ${subject.fields("password_subject_")}, ${identifier.fields("password_identifier_")}, ${credential.fields("password_credential_")}${joined ? sql`, ${authority.fields("password_authority_")}` : sql``}, ${now} as engine_now
+      from ${subject.name}
+      left join ${identifier.name} on ${subjectKey(identifier, i.subjectId, nativeId)} ${wanted === void 0 ? sql`` : sql`and ${exact(identifier, i.namespace, wanted.namespace)} and ${exact(identifier, i.value, wanted.value)}`}
+      left join ${credential.name} on ${subjectKey(credential, c.subjectId, nativeId)} and ${exact(credential, c.moduleId, moduleId)}
+      ${joined ? sql`left join ${authority.name} on ${subjectKey(authority, a.subjectId, nativeId)}` : sql``}
+      where ${subjectKey(subject, s.id, nativeId)} order by ${identifier.column(i.namespace)}, ${identifier.column(i.value)}${joined ? sql`, ${authority.column(a.credentialId)}` : sql``} limit 4097`;
+		const authorityRows = joined ? rows : yield* sql`select ${authority.fields("password_authority_")} from ${authority.name} where ${subjectKey(authority, a.subjectId, nativeId)} order by ${authority.column(a.credentialId)} limit 4097`;
+		ensure(rows.length <= 4096 && authorityRows.length <= 4096);
+		if (rows[0] === void 0) return void 0;
+		const subjectRow = subject.decode(rows[0], "password_subject_");
+		const decodedId = yield* mapping.subjectId.toSubject(subjectRow[s.id]);
+		ensure(decodedId === subjectId && (locked === void 0 || subjectRow[s.securityRevision] === locked[s.securityRevision]));
+		const password = credential.decode(rows[0], "password_credential_");
+		const passwordRow = password[c.credentialId] === null ? void 0 : password;
+		const factors = /* @__PURE__ */ new Map();
+		let identifierRow;
+		for (const row of authorityRows) {
+			const factor = authority.decode(row, "password_authority_");
+			if (factor[a.credentialId] !== null && (a.status === void 0 || a.isActiveStatus?.(factor[a.status]) === true)) {
+				ensure(mapping.subjectId.equals(factor[a.subjectId], nativeId));
+				const id = yield* Schema.decodeUnknownEffect(Schema.String)(factor[a.credentialId]);
+				const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(factor[a.revision]);
+				const old = factors.get(id);
+				ensure(old === void 0 || old.revision === revision);
+				factors.set(id, {
+					credentialId: id,
+					revision,
+					active: true
+				});
+			}
+		}
+		for (const row of rows) {
+			const entry = identifier.decode(row, "password_identifier_");
+			if (entry[i.namespace] !== null && mapping.subjectId.equals(entry[i.subjectId], nativeId) && mapping.identifier.isCurrent(entry)) identifierRow ??= entry;
+		}
+		ensure(factors.size <= 64);
+		const revision = {
+			subjectId,
+			securityRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(subjectRow[s.securityRevision]),
+			credentials: [...factors.values()].map(({ credentialId, revision }) => ({
+				credentialId,
+				revision
+			}))
+		};
+		const snapshot = identifierRow === void 0 || passwordRow === void 0 ? void 0 : yield* mapping.credential.decode({
+			moduleId,
+			subject: subjectRow,
+			identifier: identifierRow,
+			credential: passwordRow
+		}).pipe(Effect.flatMap(P.snapshotPasswordCredential));
+		if (snapshot !== void 0) ensure(snapshot.revision.subjectId === subjectId && snapshot.credentialId === passwordRow?.[c.credentialId]);
+		return {
+			nativeId,
+			subjectRow,
+			identifierRow,
+			passwordRow,
+			revision,
+			snapshot: snapshot === void 0 ? void 0 : {
+				...snapshot,
+				revision
+			},
+			now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now))
+		};
+	});
+	const prepare = (value, project) => Effect.gen(function* () {
+		const receipt = project(value, yield* CurrentCommitJournal);
+		ensure(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+		yield* registerSqlCommitReceipt(receipt);
+		return receipt;
+	});
+	const mutation = (original, action, project, redemption) => run(Effect.gen(function* () {
+		const input = yield* snapshotPasswordMutation(original);
+		const nativeId = yield* mapping.subjectId.toNative(input.expectedRevision.subjectId);
+		const rows = yield* sql`select ${rawSubject.fields("password_lock_")} from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} limit 2 ${batch === void 0 ? lock : sql``}`;
+		if (rows.length === 0) return yield* prepare("rejected", project);
+		ensure(rows.length === 1);
+		const locked = rawSubject.decode(rows[0], "password_lock_");
+		const state = yield* read(input.moduleId, input.expectedRevision.subjectId, input.credential?.identifier, locked);
+		if (state === void 0) return yield* prepare("rejected", project);
+		const requirement = yield* s.decodeActionRequirement(state.subjectRow, action);
+		if ((yield* validatePasswordMutation(mapping, input, action, {
+			subject: {
+				active: s.isActiveStatus(state.subjectRow[s.status]),
+				securityRevision: state.revision.securityRevision
+			},
+			identifierCurrent: state.identifierRow !== void 0,
+			credentials: state.revision.credentials.map((entry) => ({
+				...entry,
+				active: true
+			})),
+			snapshot: Effect.succeed(state.snapshot),
+			requirement: Effect.succeed(requirement)
+		}, state.now)) === void 0 || (action === "add-password" ? state.passwordRow !== void 0 : state.snapshot === void 0 || input.credential === void 0 || !samePasswordCredentialSnapshot(state.snapshot, input.credential))) return yield* prepare("rejected", project);
+		let proofValidity = sql`1 = 1`;
+		if (redemption !== void 0) {
+			if (proofs === void 0) return yield* unavailable();
+			const captured = {
+				...redemption,
+				input: yield* Schema.decodeEffect(ProofRedemptionInput)(redemption.input)
+			};
+			if (!passwordProofRedemptionMatches({
+				...input,
+				redemption: captured
+			})) return yield* prepare("rejected", project);
+			const redeemed = yield* (yield* makeNativeProofStore(tables, proofs, batch !== void 0)).redeemLocked(captured.input);
+			const proofReceipt = captured.prepare(redeemed.decision, yield* CurrentCommitJournal, (value) => value);
+			yield* registerSqlCommitReceipt(proofReceipt);
+			if (redeemed.decision === "rejected") return yield* prepare("rejected", project);
+			proofValidity = redeemed.validUntil;
+		}
+		const mode = "interactive";
+		const credentialId = input.credential?.credentialId ?? (yield* allocatePasswordValue(mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync));
+		const credentialRevision = yield* allocatePasswordValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const verifierVersion = yield* allocatePasswordValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const nextSecurityRevision = yield* allocatePasswordNextSecurityRevision(mapping, mode, input.expectedRevision.securityRevision);
+		ensure(nextSecurityRevision !== input.expectedRevision.securityRevision && credentialRevision !== input.credential?.credentialRevision && verifierVersion !== input.credential?.verifierVersion);
+		const freshUntil = (requirement) => {
+			return [...new Set(input.authorization.evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis))].filter((time) => time > state.now).sort((a, b) => a - b).find((time) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time));
+		};
+		const requestedDeadline = freshUntil(input.authorization.requirement), currentDeadline = freshUntil(requirement);
+		ensure(requestedDeadline !== void 0 && currentDeadline !== void 0);
+		const deadline = Math.min(requestedDeadline, currentDeadline);
+		const freshness = sql`${now} >= ${state.now} and ${now} < ${deadline} and ${proofValidity}`;
+		const stage = Effect.fnUntraced(function* (statement) {
+			if (batch === void 0) ensure((yield* executeSqlChange(sql, statement)) === 1);
+			else {
+				yield* appendSqlBatchStatement(sql`${statement}`);
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+			}
+		});
+		if (batch !== void 0) {
+			if (s.d1ActiveStatusValue === void 0 || a.status !== void 0 && a.d1ActiveStatusValue === void 0) return yield* unavailable();
+			const factors = state.revision.credentials.map((factor) => sql`exists(select 1 from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, factor.credentialId)} and ${exact(rawAuthority, a.revision, factor.revision)} ${a.status === void 0 ? sql`` : sql`and ${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`})`);
+			const active = a.status === void 0 ? sql`1 = 1` : sql`${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`;
+			const condition = sql.and([
+				sql`exists(select 1 from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, input.expectedRevision.securityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, s.d1ActiveStatusValue)})`,
+				sql`(select count(*) from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${active}) = ${factors.length}`,
+				...factors,
+				freshness
+			]);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+			if (input.credential !== void 0) {
+				if (i.d1CurrentCondition === void 0) return yield* unavailable();
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`exists(select 1 from ${tables(i.table).name} where ${exact(tables(i.table), i.namespace, input.credential.identifier.namespace)} and ${exact(tables(i.table), i.value, input.credential.identifier.value)} and ${subjectKey(tables(i.table), i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition({
+					identifier: input.credential.identifier,
+					nativeSubjectId: nativeId
+				}))})`));
+			}
+		}
+		const revisions = {
+			credentialId,
+			credentialRevision,
+			verifierVersion
+		};
+		if (input.credential === void 0) {
+			yield* stage(sql`${rawPassword.insert(c.encodeInsert({
+				moduleId: input.moduleId,
+				subjectId: nativeId,
+				replacement: input.replacement,
+				...revisions
+			}))}`);
+			yield* stage(sql`${rawAuthority.insert(a.encodeInsert({
+				subjectId: nativeId,
+				credentialId,
+				revision: credentialRevision
+			}))}`);
+		} else {
+			const old = input.credential;
+			yield* stage(sql`${rawPassword.update(c.encodeReplacement({
+				replacement: input.replacement,
+				credentialRevision,
+				verifierVersion
+			}))} where ${subjectKey(rawPassword, c.subjectId, nativeId)} and ${exact(rawPassword, c.moduleId, input.moduleId)} and ${exact(rawPassword, c.credentialId, old.credentialId)} and ${exact(rawPassword, c.credentialRevision, old.credentialRevision)} and ${exact(rawPassword, c.verifierVersion, old.verifierVersion)} and ${exact(rawPassword, c.verifier, Redacted.value(old.verifier))} and ${exact(rawPassword, c.normalization, old.normalization)} and ${freshness}`);
+			yield* stage(sql`${rawAuthority.update(a.encodeRevision(credentialRevision))} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, old.credentialId)} and ${exact(rawAuthority, a.revision, old.credentialRevision)}`);
+		}
+		const expectedFactors = state.revision.credentials.filter((factor) => factor.credentialId !== credentialId).concat({
+			credentialId,
+			revision: credentialRevision
+		});
+		const finalPassword = sql`exists(select 1 from ${rawPassword.name} where ${subjectKey(rawPassword, c.subjectId, nativeId)} and ${exact(rawPassword, c.moduleId, input.moduleId)} and ${exact(rawPassword, c.credentialId, credentialId)} and ${exact(rawPassword, c.credentialRevision, credentialRevision)} and ${exact(rawPassword, c.verifierVersion, verifierVersion)} and ${exact(rawPassword, c.verifier, Redacted.value(input.replacement.verifier))} and ${exact(rawPassword, c.normalization, input.replacement.normalization)})`;
+		const canGuardResult = (a.status === void 0 || a.d1ActiveStatusValue !== void 0) && (input.credential === void 0 || i.d1CurrentCondition !== void 0);
+		let resultingState;
+		if (canGuardResult) {
+			const active = a.status === void 0 ? sql`1 = 1` : sql`${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`;
+			const conditions = [
+				finalPassword,
+				freshness,
+				sql`(select count(*) from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${active}) = ${expectedFactors.length}`,
+				...expectedFactors.map((factor) => sql`exists(select 1 from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, factor.credentialId)} and ${exact(rawAuthority, a.revision, factor.revision)} and ${active})`)
+			];
+			if (input.credential !== void 0) {
+				const expected = input.credential;
+				const identifierTable = tables(i.table);
+				ensure(i.d1CurrentCondition !== void 0);
+				conditions.push(sql`exists(select 1 from ${identifierTable.name} where ${exact(identifierTable, i.namespace, expected.identifier.namespace)} and ${exact(identifierTable, i.value, expected.identifier.value)} and ${subjectKey(identifierTable, i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition({
+					identifier: expected.identifier,
+					nativeSubjectId: nativeId
+				}))})`, sql`exists(select 1 from ${identifierTable.name} where ${exact(identifierTable, i.namespace, expected.identifier.namespace)} and ${exact(identifierTable, i.value, expected.identifier.value)} and ${subjectKey(identifierTable, i.subjectId, nativeId)} and ${exact(identifierTable, i.bindingRevision, expected.identifierBindingRevision)} and ${expected.identifierVerifiedAtMillis === void 0 ? sql`${identifierTable.column(i.verifiedAt)} is null` : sql`${identifierTable.column(i.verifiedAt)} = ${identifierTable.value(i.verifiedAt, mapping.clock.encodeInstant(expected.identifierVerifiedAtMillis))}`})`);
+			}
+			resultingState = sql.and(conditions);
+		}
+		yield* stage(sql`${rawSubject.update({ [s.securityRevision]: nextSecurityRevision })} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, input.expectedRevision.securityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, locked[s.status])} and ${freshness} and ${resultingState ?? sql`1 = 1`}`);
+		if (batch !== void 0) {
+			ensure(resultingState !== void 0);
+			yield* registerSqlBatchPostcondition({
+				name: "password-replacement-authority",
+				statement: sqlBatchAssertion(sql, sql.and([resultingState, sql`exists(select 1 from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, nextSecurityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, s.d1ActiveStatusValue)})`]))
+			});
+		} else if (Option.isSome(parent) || resultingState === void 0) yield* registerSqlPostcondition({
+			name: "password-replacement-authority",
+			check: Effect.gen(function* () {
+				const final = yield* read(input.moduleId, input.expectedRevision.subjectId, input.credential?.identifier);
+				ensure(final !== void 0 && s.isActiveStatus(final.subjectRow[s.status]) && final.revision.securityRevision === nextSecurityRevision && final.revision.credentials.length === expectedFactors.length && expectedFactors.every((factor) => final.revision.credentials.some((entry) => entry.credentialId === factor.credentialId && entry.revision === factor.revision)) && final.now >= state.now && final.now < deadline);
+				const password = final.passwordRow;
+				ensure(password !== void 0 && password[c.credentialId] === credentialId && password[c.credentialRevision] === credentialRevision && password[c.verifierVersion] === verifierVersion && password[c.verifier] === Redacted.value(input.replacement.verifier) && password[c.normalization] === input.replacement.normalization);
+				if (input.credential !== void 0) ensure(final.snapshot !== void 0 && final.snapshot.identifierBindingRevision === input.credential.identifierBindingRevision && final.snapshot.identifierVerifiedAtMillis === input.credential.identifierVerifiedAtMillis);
+			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+				operation: "decode",
+				cause
+			})))
+		});
+		return yield* prepare("changed", project);
+	}));
+	return { passwordPersistence: {
+		...yield* makePasswordCredentials(tables, mapping, {
+			mode: "interactive",
+			locking: false,
+			coordinated: Option.isSome(parent),
+			standaloneGuard: requireStandalone(unavailable, sql.transactionService)
+		}),
+		readForSubject: (input) => executor.read(Effect.map(read(input.moduleId, input.subjectId), (state) => state === void 0 || !s.isActiveStatus(state.subjectRow[s.status]) ? Option.none() : Option.fromUndefinedOr(state.snapshot))),
+		recoveryTarget: (input) => executor.read(Effect.gen(function* () {
+			const rows = yield* sql`select ${identifier.fields("password_recovery_")} from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} limit 2`;
+			if (rows.length === 0) return Option.none();
+			ensure(rows.length === 1);
+			const row = identifier.decode(rows[0], "password_recovery_");
+			if (!i.isCurrent(row)) return Option.none();
+			const subjectId = yield* mapping.subjectId.toSubject(row[i.subjectId]);
+			const state = yield* read(input.moduleId, subjectId, input.identifier);
+			return state === void 0 || !s.isActiveStatus(state.subjectRow[s.status]) || state.snapshot?.identifierVerifiedAtMillis === void 0 ? Option.none() : Option.some(state.snapshot);
+		})),
+		addIfAbsent: (input, project) => mutation(input, "add-password", project),
+		replaceIfCurrent: (input, project) => mutation(input, "change-password", project),
+		resetWithProof: (input, project) => mutation(input, "reset-password", project, input.redemption)
+	} };
+});
+//#endregion
+export { makeNativePasswordServices };
+
+//# sourceMappingURL=password-native.mjs.map

package/dist/internal/password-native.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-native.mjs","names":[],"sources":["../../src/internal/password-native.ts"],"sourcesContent":["import { CurrentCommitJournal, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport * as P from \"@yielded/auth/Password\";\nimport { ProofRedemptionInput } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { SecurityRevision, type AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option, Redacted, Schema, Crypto } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyPasswordPersistenceMapping } from \"./models/password-model\";\nimport type { AnyProofPersistenceMapping } from \"./models/proof-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { makePasswordCredentials, samePasswordCredentialSnapshot } from \"./password-credentials\";\nimport {\n  allocatePasswordNextSecurityRevision,\n  allocatePasswordValue,\n  passwordEvidenceSatisfiedAt,\n  passwordProofRedemptionMatches,\n  snapshotPasswordMutation,\n  validatePasswordMutation,\n} from \"./password-policy\";\nimport { makeNativeProofStore } from \"./proof-native\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlCommitReceipt,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n} from \"./sql-commit\";\nimport { requireStandalone } from \"./standalone\";\n\nconst unavailable = () => P.PasswordUnavailable.make({});\n\nconst ensure: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition) throw unavailable();\n};\n\nexport const makeNativePasswordServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: AnyPasswordPersistenceMapping,\n  proofs?: AnyProofPersistenceMapping,\n): Effect.fn.Return<\n  { readonly passwordPersistence: P.PasswordPersistence[\"Service\"] },\n  P.PasswordUnavailable,\n  SqlClient | LifecycleHooks | Crypto.Crypto | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n  const sql = (yield* SqlClient).withoutTransforms();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const parent = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const s = mapping.subject,\n    i = mapping.identifier,\n    c = mapping.credential,\n    a = mapping.authorityCredential;\n\n  const subject = tables(s.table).as(\"password_subject\");\n  const identifier = tables(i.table).as(\"password_identifier\");\n  const credential = tables(c.table).as(\"password_credential\");\n  const authority = tables(a.table).as(\"password_authority\");\n\n  const rawSubject = tables(s.table),\n    rawPassword = tables(c.table),\n    rawAuthority = tables(a.table);\n\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const subjectKey = (table: SqlTable, key: string, nativeId: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n  const run = <A, E, R>(work: Effect.Effect<A, E, R>) =>\n    batch === undefined\n      ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))\n      : executor\n          .batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const read = Effect.fnUntraced(function* (\n    moduleId: string,\n    subjectId: SubjectId,\n    wanted?: LoginIdentifier,\n    locked?: Record<string, unknown>,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    // Without one wanted identifier, retired identifiers would multiply authority\n    // rows; read authority separately so the result grows linearly.\n    const joined = wanted !== undefined;\n\n    const rows =\n      yield* sql`select ${subject.fields(\"password_subject_\")}, ${identifier.fields(\"password_identifier_\")}, ${credential.fields(\"password_credential_\")}${joined ? sql`, ${authority.fields(\"password_authority_\")}` : sql``}, ${now} as engine_now\n      from ${subject.name}\n      left join ${identifier.name} on ${subjectKey(identifier, i.subjectId, nativeId)} ${wanted === undefined ? sql`` : sql`and ${exact(identifier, i.namespace, wanted.namespace)} and ${exact(identifier, i.value, wanted.value)}`}\n      left join ${credential.name} on ${subjectKey(credential, c.subjectId, nativeId)} and ${exact(credential, c.moduleId, moduleId)}\n      ${joined ? sql`left join ${authority.name} on ${subjectKey(authority, a.subjectId, nativeId)}` : sql``}\n      where ${subjectKey(subject, s.id, nativeId)} order by ${identifier.column(i.namespace)}, ${identifier.column(i.value)}${joined ? sql`, ${authority.column(a.credentialId)}` : sql``} limit 4097`;\n\n    const authorityRows = joined\n      ? rows\n      : yield* sql`select ${authority.fields(\"password_authority_\")} from ${authority.name} where ${subjectKey(authority, a.subjectId, nativeId)} order by ${authority.column(a.credentialId)} limit 4097`;\n\n    ensure(rows.length <= 4096 && authorityRows.length <= 4096);\n    if (rows[0] === undefined) return undefined;\n    const subjectRow = subject.decode(rows[0], \"password_subject_\");\n    const decodedId = yield* mapping.subjectId.toSubject(subjectRow[s.id]);\n\n    ensure(\n      decodedId === subjectId &&\n        (locked === undefined || subjectRow[s.securityRevision] === locked[s.securityRevision]),\n    );\n    const password = credential.decode(rows[0], \"password_credential_\");\n    const passwordRow = password[c.credentialId] === null ? undefined : password;\n\n    const factors = new Map<\n      string,\n      {\n        readonly credentialId: string;\n        readonly revision: SecurityRevision;\n        readonly active: boolean;\n      }\n    >();\n\n    let identifierRow: Record<string, unknown> | undefined;\n\n    for (const row of authorityRows) {\n      const factor = authority.decode(row, \"password_authority_\");\n\n      if (\n        factor[a.credentialId] !== null &&\n        (a.status === undefined || a.isActiveStatus?.(factor[a.status]) === true)\n      ) {\n        ensure(mapping.subjectId.equals(factor[a.subjectId], nativeId));\n        const id = yield* Schema.decodeUnknownEffect(Schema.String)(factor[a.credentialId]);\n        const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(factor[a.revision]);\n        const old = factors.get(id);\n\n        ensure(old === undefined || old.revision === revision);\n        factors.set(id, { credentialId: id, revision, active: true });\n      }\n    }\n    for (const row of rows) {\n      const entry = identifier.decode(row, \"password_identifier_\");\n\n      if (\n        entry[i.namespace] !== null &&\n        mapping.subjectId.equals(entry[i.subjectId], nativeId) &&\n        mapping.identifier.isCurrent(entry)\n      )\n        identifierRow ??= entry;\n    }\n    ensure(factors.size <= 64);\n\n    const revision = {\n      subjectId,\n      securityRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(\n        subjectRow[s.securityRevision],\n      ),\n      credentials: [...factors.values()].map(({ credentialId, revision }) => ({\n        credentialId,\n        revision,\n      })),\n    };\n\n    const snapshot =\n      identifierRow === undefined || passwordRow === undefined\n        ? undefined\n        : yield* mapping.credential\n            .decode({\n              moduleId,\n              subject: subjectRow,\n              identifier: identifierRow,\n              credential: passwordRow,\n            })\n            .pipe(Effect.flatMap(P.snapshotPasswordCredential));\n\n    if (snapshot !== undefined)\n      ensure(\n        snapshot.revision.subjectId === subjectId &&\n          snapshot.credentialId === passwordRow?.[c.credentialId],\n      );\n\n    return {\n      nativeId,\n      subjectRow,\n      identifierRow,\n      passwordRow,\n      revision,\n      snapshot: snapshot === undefined ? undefined : { ...snapshot, revision },\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now)),\n    };\n  });\n\n  const prepare = <V, A>(value: V, project: P.PreparePasswordCommit<V, A>) =>\n    Effect.gen(function* () {\n      const journal = yield* CurrentCommitJournal;\n\n      const receipt = project(value, journal);\n\n      ensure(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n      yield* registerSqlCommitReceipt(receipt);\n\n      return receipt;\n    });\n\n  const mutation = <A>(\n    original: P.PasswordMutationInput,\n    action: P.PasswordAction,\n    project: P.PreparePasswordCommit<P.PasswordMutationDecision, A>,\n    redemption?: Parameters<P.PasswordPersistence[\"Service\"][\"resetWithProof\"]>[0][\"redemption\"],\n  ) =>\n    run(\n      Effect.gen(function* () {\n        const input = yield* snapshotPasswordMutation(original);\n        const nativeId = yield* mapping.subjectId.toNative(input.expectedRevision.subjectId);\n\n        const rows =\n          yield* sql`select ${rawSubject.fields(\"password_lock_\")} from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} limit 2 ${batch === undefined ? lock : sql``}`;\n\n        if (rows.length === 0) return yield* prepare(\"rejected\" as const, project);\n        ensure(rows.length === 1);\n        const locked = rawSubject.decode(rows[0]!, \"password_lock_\");\n\n        const state = yield* read(\n          input.moduleId,\n          input.expectedRevision.subjectId,\n          input.credential?.identifier,\n          locked,\n        );\n\n        if (state === undefined) return yield* prepare(\"rejected\" as const, project);\n        const requirement = yield* s.decodeActionRequirement(state.subjectRow, action);\n\n        const valid = yield* validatePasswordMutation(\n          mapping,\n          input,\n          action,\n          {\n            subject: {\n              active: s.isActiveStatus(state.subjectRow[s.status]),\n              securityRevision: state.revision.securityRevision,\n            },\n            identifierCurrent: state.identifierRow !== undefined,\n            credentials: state.revision.credentials.map((entry) => ({ ...entry, active: true })),\n            snapshot: Effect.succeed(state.snapshot),\n            requirement: Effect.succeed(requirement),\n          },\n          state.now,\n        );\n\n        if (\n          valid === undefined ||\n          (action === \"add-password\"\n            ? state.passwordRow !== undefined\n            : state.snapshot === undefined ||\n              input.credential === undefined ||\n              !samePasswordCredentialSnapshot(state.snapshot, input.credential))\n        )\n          return yield* prepare(\"rejected\" as const, project);\n        let proofValidity = sql`1 = 1`;\n\n        if (redemption !== undefined) {\n          if (proofs === undefined) return yield* unavailable();\n\n          const captured = {\n            ...redemption,\n            input: yield* Schema.decodeEffect(ProofRedemptionInput)(redemption.input),\n          };\n\n          if (!passwordProofRedemptionMatches({ ...input, redemption: captured }))\n            return yield* prepare(\"rejected\" as const, project);\n          // Inherit the physical owner; application owners retain the exact consumed\n          // proof absence check after their callback.\n          const proof = yield* makeNativeProofStore(tables, proofs, batch !== undefined);\n          const redeemed = yield* proof.redeemLocked(captured.input);\n\n          const proofReceipt = captured.prepare(\n            redeemed.decision,\n            yield* CurrentCommitJournal,\n            (value) => value,\n          );\n\n          yield* registerSqlCommitReceipt(proofReceipt);\n          if (redeemed.decision === \"rejected\") return yield* prepare(\"rejected\" as const, project);\n          proofValidity = redeemed.validUntil;\n        }\n        const mode = \"interactive\";\n\n        const credentialId =\n          input.credential?.credentialId ??\n          (yield* allocatePasswordValue(\n            mode,\n            mapping.allocateCredentialId,\n            mapping.allocateCredentialIdSync,\n          ));\n\n        const credentialRevision = yield* allocatePasswordValue(\n          mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const verifierVersion = yield* allocatePasswordValue(\n          mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const nextSecurityRevision = yield* allocatePasswordNextSecurityRevision(\n          mapping,\n          mode,\n          input.expectedRevision.securityRevision,\n        );\n\n        ensure(\n          nextSecurityRevision !== input.expectedRevision.securityRevision &&\n            credentialRevision !== input.credential?.credentialRevision &&\n            verifierVersion !== input.credential?.verifierVersion,\n        );\n\n        const freshUntil = (requirement: AuthenticationRequirement) => {\n          const deadlines = [\n            ...new Set(\n              input.authorization.evidence.proofs.map(\n                (proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis,\n              ),\n            ),\n          ]\n            .filter((time) => time > state.now)\n            .sort((a, b) => a - b);\n\n          return deadlines.find(\n            (time) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time),\n          );\n        };\n\n        const requestedDeadline = freshUntil(input.authorization.requirement),\n          currentDeadline = freshUntil(requirement);\n\n        ensure(requestedDeadline !== undefined && currentDeadline !== undefined);\n        const deadline = Math.min(requestedDeadline, currentDeadline);\n        const freshness = sql`${now} >= ${state.now} and ${now} < ${deadline} and ${proofValidity}`;\n\n        const stage = Effect.fnUntraced(function* (statement: Fragment) {\n          if (batch === undefined) ensure((yield* executeSqlChange(sql, statement)) === 1);\n          else {\n            yield* appendSqlBatchStatement(sql`${statement}`);\n            yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n          }\n        });\n\n        if (batch !== undefined) {\n          if (\n            s.d1ActiveStatusValue === undefined ||\n            (a.status !== undefined && a.d1ActiveStatusValue === undefined)\n          )\n            return yield* unavailable();\n\n          const factors = state.revision.credentials.map(\n            (factor) =>\n              sql`exists(select 1 from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, factor.credentialId)} and ${exact(rawAuthority, a.revision, factor.revision)} ${a.status === undefined ? sql`` : sql`and ${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`})`,\n          );\n\n          const active =\n            a.status === undefined\n              ? sql`1 = 1`\n              : sql`${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`;\n\n          const condition = sql.and([\n            sql`exists(select 1 from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, input.expectedRevision.securityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, s.d1ActiveStatusValue)})`,\n            sql`(select count(*) from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${active}) = ${factors.length}`,\n            ...factors,\n            freshness,\n          ]);\n\n          yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));\n          if (input.credential !== undefined) {\n            if (i.d1CurrentCondition === undefined) return yield* unavailable();\n            yield* appendSqlBatchStatement(\n              sqlBatchAssertion(\n                sql,\n                sql`exists(select 1 from ${tables(i.table).name} where ${exact(tables(i.table), i.namespace, input.credential.identifier.namespace)} and ${exact(tables(i.table), i.value, input.credential.identifier.value)} and ${subjectKey(tables(i.table), i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition({ identifier: input.credential.identifier, nativeSubjectId: nativeId }))})`,\n              ),\n            );\n          }\n        }\n        const revisions = { credentialId, credentialRevision, verifierVersion };\n\n        if (input.credential === undefined) {\n          yield* stage(\n            sql`${rawPassword.insert(c.encodeInsert({ moduleId: input.moduleId, subjectId: nativeId, replacement: input.replacement, ...revisions }))}`,\n          );\n          yield* stage(\n            sql`${rawAuthority.insert(a.encodeInsert({ subjectId: nativeId, credentialId, revision: credentialRevision }))}`,\n          );\n        } else {\n          const old = input.credential;\n\n          yield* stage(\n            sql`${rawPassword.update(c.encodeReplacement({ replacement: input.replacement, credentialRevision, verifierVersion }))} where ${subjectKey(rawPassword, c.subjectId, nativeId)} and ${exact(rawPassword, c.moduleId, input.moduleId)} and ${exact(rawPassword, c.credentialId, old.credentialId)} and ${exact(rawPassword, c.credentialRevision, old.credentialRevision)} and ${exact(rawPassword, c.verifierVersion, old.verifierVersion)} and ${exact(rawPassword, c.verifier, Redacted.value(old.verifier))} and ${exact(rawPassword, c.normalization, old.normalization)} and ${freshness}`,\n          );\n          yield* stage(\n            sql`${rawAuthority.update(a.encodeRevision(credentialRevision))} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, old.credentialId)} and ${exact(rawAuthority, a.revision, old.credentialRevision)}`,\n          );\n        }\n\n        const expectedFactors = state.revision.credentials\n          .filter((factor) => factor.credentialId !== credentialId)\n          .concat({ credentialId, revision: credentialRevision });\n\n        const finalPassword = sql`exists(select 1 from ${rawPassword.name} where ${subjectKey(rawPassword, c.subjectId, nativeId)} and ${exact(rawPassword, c.moduleId, input.moduleId)} and ${exact(rawPassword, c.credentialId, credentialId)} and ${exact(rawPassword, c.credentialRevision, credentialRevision)} and ${exact(rawPassword, c.verifierVersion, verifierVersion)} and ${exact(rawPassword, c.verifier, Redacted.value(input.replacement.verifier))} and ${exact(rawPassword, c.normalization, input.replacement.normalization)})`;\n\n        const canGuardResult =\n          (a.status === undefined || a.d1ActiveStatusValue !== undefined) &&\n          (input.credential === undefined || i.d1CurrentCondition !== undefined);\n\n        let resultingState: Fragment | undefined;\n\n        if (canGuardResult) {\n          const active =\n            a.status === undefined\n              ? sql`1 = 1`\n              : sql`${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`;\n\n          const conditions: Array<Fragment> = [\n            finalPassword,\n            freshness,\n            sql`(select count(*) from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${active}) = ${expectedFactors.length}`,\n            ...expectedFactors.map(\n              (factor) =>\n                sql`exists(select 1 from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, factor.credentialId)} and ${exact(rawAuthority, a.revision, factor.revision)} and ${active})`,\n            ),\n          ];\n\n          if (input.credential !== undefined) {\n            const expected = input.credential;\n            const identifierTable = tables(i.table);\n\n            ensure(i.d1CurrentCondition !== undefined);\n            conditions.push(\n              sql`exists(select 1 from ${identifierTable.name} where ${exact(identifierTable, i.namespace, expected.identifier.namespace)} and ${exact(identifierTable, i.value, expected.identifier.value)} and ${subjectKey(identifierTable, i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition({ identifier: expected.identifier, nativeSubjectId: nativeId }))})`,\n              sql`exists(select 1 from ${identifierTable.name} where ${exact(identifierTable, i.namespace, expected.identifier.namespace)} and ${exact(identifierTable, i.value, expected.identifier.value)} and ${subjectKey(identifierTable, i.subjectId, nativeId)} and ${exact(identifierTable, i.bindingRevision, expected.identifierBindingRevision)} and ${expected.identifierVerifiedAtMillis === undefined ? sql`${identifierTable.column(i.verifiedAt)} is null` : sql`${identifierTable.column(i.verifiedAt)} = ${identifierTable.value(i.verifiedAt, mapping.clock.encodeInstant(expected.identifierVerifiedAtMillis))}`})`,\n            );\n          }\n          resultingState = sql.and(conditions);\n        }\n        yield* stage(\n          sql`${rawSubject.update({ [s.securityRevision]: nextSecurityRevision })} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, input.expectedRevision.securityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, locked[s.status])} and ${freshness} and ${resultingState ?? sql`1 = 1`}`,\n        );\n        if (batch !== undefined) {\n          ensure(resultingState !== undefined);\n          yield* registerSqlBatchPostcondition({\n            name: \"password-replacement-authority\",\n            statement: sqlBatchAssertion(\n              sql,\n              sql.and([\n                resultingState,\n                sql`exists(select 1 from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, nextSecurityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, s.d1ActiveStatusValue)})`,\n              ]),\n            ),\n          });\n        } else if (Option.isSome(parent) || resultingState === undefined)\n          yield* registerSqlPostcondition({\n            name: \"password-replacement-authority\",\n            check: Effect.gen(function* () {\n              const final = yield* read(\n                input.moduleId,\n                input.expectedRevision.subjectId,\n                input.credential?.identifier,\n              );\n\n              ensure(\n                final !== undefined &&\n                  s.isActiveStatus(final.subjectRow[s.status]) &&\n                  final.revision.securityRevision === nextSecurityRevision &&\n                  final.revision.credentials.length === expectedFactors.length &&\n                  expectedFactors.every((factor) =>\n                    final.revision.credentials.some(\n                      (entry) =>\n                        entry.credentialId === factor.credentialId &&\n                        entry.revision === factor.revision,\n                    ),\n                  ) &&\n                  final.now >= state.now &&\n                  final.now < deadline,\n              );\n              const password = final.passwordRow;\n\n              ensure(\n                password !== undefined &&\n                  password[c.credentialId] === credentialId &&\n                  password[c.credentialRevision] === credentialRevision &&\n                  password[c.verifierVersion] === verifierVersion &&\n                  password[c.verifier] === Redacted.value(input.replacement.verifier) &&\n                  password[c.normalization] === input.replacement.normalization,\n              );\n              if (input.credential !== undefined)\n                ensure(\n                  final.snapshot !== undefined &&\n                    final.snapshot.identifierBindingRevision ===\n                      input.credential.identifierBindingRevision &&\n                    final.snapshot.identifierVerifiedAtMillis ===\n                      input.credential.identifierVerifiedAtMillis,\n                );\n            }).pipe(\n              Effect.mapError((cause) =>\n                PersistenceMappingError.make({ operation: \"decode\", cause }),\n              ),\n            ),\n          });\n\n        return yield* prepare(\"changed\" as const, project);\n      }),\n    );\n\n  const credentials = yield* makePasswordCredentials(tables, mapping, {\n    mode: \"interactive\",\n    locking: false,\n    coordinated: Option.isSome(parent),\n    standaloneGuard: requireStandalone(unavailable, sql.transactionService),\n  });\n\n  const passwordPersistence: P.PasswordPersistence[\"Service\"] = {\n    ...credentials,\n    readForSubject: (input) =>\n      executor.read(\n        Effect.map(read(input.moduleId, input.subjectId), (state) =>\n          state === undefined || !s.isActiveStatus(state.subjectRow[s.status])\n            ? Option.none()\n            : Option.fromUndefinedOr(state.snapshot),\n        ),\n      ),\n    recoveryTarget: (input) =>\n      executor.read(\n        Effect.gen(function* () {\n          const rows =\n            yield* sql`select ${identifier.fields(\"password_recovery_\")} from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} limit 2`;\n\n          if (rows.length === 0) return Option.none();\n          ensure(rows.length === 1);\n          const row = identifier.decode(rows[0]!, \"password_recovery_\");\n\n          if (!i.isCurrent(row)) return Option.none();\n          const subjectId = yield* mapping.subjectId.toSubject(row[i.subjectId]);\n          const state = yield* read(input.moduleId, subjectId, input.identifier);\n\n          return state === undefined ||\n            !s.isActiveStatus(state.subjectRow[s.status]) ||\n            state.snapshot?.identifierVerifiedAtMillis === undefined\n            ? Option.none()\n            : Option.some(state.snapshot);\n        }),\n      ),\n    addIfAbsent: (input, project) => mutation(input, \"add-password\", project),\n    replaceIfCurrent: (input, project) => mutation(input, \"change-password\", project),\n    resetWithProof: (input, project) =>\n      mutation(input, \"reset-password\", project, input.redemption),\n  };\n\n  return { passwordPersistence };\n});\n"],"mappings":";;;;;;;;;;;;;;;AAqCA,MAAM,oBAAoB,EAAE,oBAAoB,KAAK,CAAC,CAAC;AAEvD,MAAM,UAAqD,cAAc;CACvE,IAAI,CAAC,WAAW,MAAM,YAAY;AACpC;AAEA,MAAa,6BAA6B,OAAO,WAAW,WAC1D,QACA,SACA,QAKA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,SAAS,OAAO,OAAO,cAAc,gBAAgB;CAE3D,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,YACZ,IAAI,QAAQ,YACZ,IAAI,QAAQ;CAEd,MAAM,UAAU,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,kBAAkB;CACrD,MAAM,aAAa,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,qBAAqB;CAC3D,MAAM,aAAa,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,qBAAqB;CAC3D,MAAM,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,oBAAoB;CAEzD,MAAM,aAAa,OAAO,EAAE,KAAK,GAC/B,cAAc,OAAO,EAAE,KAAK,GAC5B,eAAe,OAAO,EAAE,KAAK;CAE/B,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,OAAO,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC;CAEvF,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,cAAc,OAAiB,KAAa,aAChD,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;CAExD,MAAM,OAAgB,SACpB,UAAU,KAAA,IACN,SAAS,IAAI,KAAK,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC,CAAC,IACpE,SACG,MAAM,KAAK,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC,CAAC,CAAC,CAC9D,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,OAAO,OAAO,WAAW,WAC7B,UACA,WACA,QACA,QACA;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAI5D,MAAM,SAAS,WAAW,KAAA;EAE1B,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,mBAAmB,EAAE,IAAI,WAAW,OAAO,sBAAsB,EAAE,IAAI,WAAW,OAAO,sBAAsB,IAAI,SAAS,GAAG,KAAK,UAAU,OAAO,qBAAqB,MAAM,GAAG,GAAG,IAAI,IAAI;aAC1N,QAAQ,KAAK;kBACR,WAAW,KAAK,MAAM,WAAW,YAAY,EAAE,WAAW,QAAQ,EAAE,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,MAAM,YAAY,EAAE,WAAW,OAAO,SAAS,EAAE,OAAO,MAAM,YAAY,EAAE,OAAO,OAAO,KAAK,IAAI;kBACnN,WAAW,KAAK,MAAM,WAAW,YAAY,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,UAAU,QAAQ,EAAE;QAC7H,SAAS,GAAG,aAAa,UAAU,KAAK,MAAM,WAAW,WAAW,EAAE,WAAW,QAAQ,MAAM,GAAG,GAAG;cAC/F,WAAW,SAAS,EAAE,IAAI,QAAQ,EAAE,YAAY,WAAW,OAAO,EAAE,SAAS,EAAE,IAAI,WAAW,OAAO,EAAE,KAAK,IAAI,SAAS,GAAG,KAAK,UAAU,OAAO,EAAE,YAAY,MAAM,GAAG,GAAG;EAEtL,MAAM,gBAAgB,SAClB,OACA,OAAO,GAAG,UAAU,UAAU,OAAO,qBAAqB,EAAE,QAAQ,UAAU,KAAK,SAAS,WAAW,WAAW,EAAE,WAAW,QAAQ,EAAE,YAAY,UAAU,OAAO,EAAE,YAAY,EAAE;EAE1L,OAAO,KAAK,UAAU,QAAQ,cAAc,UAAU,IAAI;EAC1D,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,aAAa,QAAQ,OAAO,KAAK,IAAI,mBAAmB;EAC9D,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,WAAW,EAAE,GAAG;EAErE,OACE,cAAc,cACX,WAAW,KAAA,KAAa,WAAW,EAAE,sBAAsB,OAAO,EAAE,kBACzE;EACA,MAAM,WAAW,WAAW,OAAO,KAAK,IAAI,sBAAsB;EAClE,MAAM,cAAc,SAAS,EAAE,kBAAkB,OAAO,KAAA,IAAY;EAEpE,MAAM,0BAAU,IAAI,IAOlB;EAEF,IAAI;EAEJ,KAAK,MAAM,OAAO,eAAe;GAC/B,MAAM,SAAS,UAAU,OAAO,KAAK,qBAAqB;GAE1D,IACE,OAAO,EAAE,kBAAkB,SAC1B,EAAE,WAAW,KAAA,KAAa,EAAE,iBAAiB,OAAO,EAAE,OAAO,MAAM,OACpE;IACA,OAAO,QAAQ,UAAU,OAAO,OAAO,EAAE,YAAY,QAAQ,CAAC;IAC9D,MAAM,KAAK,OAAO,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,OAAO,EAAE,aAAa;IAClF,MAAM,WAAW,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAAC,OAAO,EAAE,SAAS;IACvF,MAAM,MAAM,QAAQ,IAAI,EAAE;IAE1B,OAAO,QAAQ,KAAA,KAAa,IAAI,aAAa,QAAQ;IACrD,QAAQ,IAAI,IAAI;KAAE,cAAc;KAAI;KAAU,QAAQ;IAAK,CAAC;GAC9D;EACF;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,QAAQ,WAAW,OAAO,KAAK,sBAAsB;GAE3D,IACE,MAAM,EAAE,eAAe,QACvB,QAAQ,UAAU,OAAO,MAAM,EAAE,YAAY,QAAQ,KACrD,QAAQ,WAAW,UAAU,KAAK,GAElC,kBAAkB;EACtB;EACA,OAAO,QAAQ,QAAQ,EAAE;EAEzB,MAAM,WAAW;GACf;GACA,kBAAkB,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CACnE,WAAW,EAAE,iBACf;GACA,aAAa,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,gBAAgB;IACtE;IACA;GACF,EAAE;EACJ;EAEA,MAAM,WACJ,kBAAkB,KAAA,KAAa,gBAAgB,KAAA,IAC3C,KAAA,IACA,OAAO,QAAQ,WACZ,OAAO;GACN;GACA,SAAS;GACT,YAAY;GACZ,YAAY;EACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,EAAE,0BAA0B,CAAC;EAE1D,IAAI,aAAa,KAAA,GACf,OACE,SAAS,SAAS,cAAc,aAC9B,SAAS,iBAAiB,cAAc,EAAE,aAC9C;EAEF,OAAO;GACL;GACA;GACA;GACA;GACA;GACA,UAAU,aAAa,KAAA,IAAY,KAAA,IAAY;IAAE,GAAG;IAAU;GAAS;GACvE,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EACxE;CACF,CAAC;CAED,MAAM,WAAiB,OAAU,YAC/B,OAAO,IAAI,aAAa;EAGtB,MAAM,UAAU,QAAQ,OAAO,OAFR,oBAEe;EAEtC,OAAO,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;EAC1E,OAAO,yBAAyB,OAAO;EAEvC,OAAO;CACT,CAAC;CAEH,MAAM,YACJ,UACA,QACA,SACA,eAEA,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,yBAAyB,QAAQ;EACtD,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,iBAAiB,SAAS;EAEnF,MAAM,OACJ,OAAO,GAAG,UAAU,WAAW,OAAO,gBAAgB,EAAE,QAAQ,WAAW,KAAK,SAAS,WAAW,YAAY,EAAE,IAAI,QAAQ,EAAE,WAAW,UAAU,KAAA,IAAY,OAAO,GAAG;EAE7K,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,QAAQ,YAAqB,OAAO;EACzE,OAAO,KAAK,WAAW,CAAC;EACxB,MAAM,SAAS,WAAW,OAAO,KAAK,IAAK,gBAAgB;EAE3D,MAAM,QAAQ,OAAO,KACnB,MAAM,UACN,MAAM,iBAAiB,WACvB,MAAM,YAAY,YAClB,MACF;EAEA,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,QAAQ,YAAqB,OAAO;EAC3E,MAAM,cAAc,OAAO,EAAE,wBAAwB,MAAM,YAAY,MAAM;EAmB7E,KACE,OAlBmB,yBACnB,SACA,OACA,QACA;GACE,SAAS;IACP,QAAQ,EAAE,eAAe,MAAM,WAAW,EAAE,OAAO;IACnD,kBAAkB,MAAM,SAAS;GACnC;GACA,mBAAmB,MAAM,kBAAkB,KAAA;GAC3C,aAAa,MAAM,SAAS,YAAY,KAAK,WAAW;IAAE,GAAG;IAAO,QAAQ;GAAK,EAAE;GACnF,UAAU,OAAO,QAAQ,MAAM,QAAQ;GACvC,aAAa,OAAO,QAAQ,WAAW;EACzC,GACA,MAAM,GACR,OAGY,KAAA,MACT,WAAW,iBACR,MAAM,gBAAgB,KAAA,IACtB,MAAM,aAAa,KAAA,KACnB,MAAM,eAAe,KAAA,KACrB,CAAC,+BAA+B,MAAM,UAAU,MAAM,UAAU,IAEpE,OAAO,OAAO,QAAQ,YAAqB,OAAO;EACpD,IAAI,gBAAgB,GAAG;EAEvB,IAAI,eAAe,KAAA,GAAW;GAC5B,IAAI,WAAW,KAAA,GAAW,OAAO,OAAO,YAAY;GAEpD,MAAM,WAAW;IACf,GAAG;IACH,OAAO,OAAO,OAAO,aAAa,oBAAoB,CAAC,CAAC,WAAW,KAAK;GAC1E;GAEA,IAAI,CAAC,+BAA+B;IAAE,GAAG;IAAO,YAAY;GAAS,CAAC,GACpE,OAAO,OAAO,QAAQ,YAAqB,OAAO;GAIpD,MAAM,WAAW,QAAO,OADH,qBAAqB,QAAQ,QAAQ,UAAU,KAAA,CAAS,EAAA,CAC/C,aAAa,SAAS,KAAK;GAEzD,MAAM,eAAe,SAAS,QAC5B,SAAS,UACT,OAAO,uBACN,UAAU,KACb;GAEA,OAAO,yBAAyB,YAAY;GAC5C,IAAI,SAAS,aAAa,YAAY,OAAO,OAAO,QAAQ,YAAqB,OAAO;GACxF,gBAAgB,SAAS;EAC3B;EACA,MAAM,OAAO;EAEb,MAAM,eACJ,MAAM,YAAY,iBACjB,OAAO,sBACN,MACA,QAAQ,sBACR,QAAQ,wBACV;EAEF,MAAM,qBAAqB,OAAO,sBAChC,MACA,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBAAkB,OAAO,sBAC7B,MACA,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,uBAAuB,OAAO,qCAClC,SACA,MACA,MAAM,iBAAiB,gBACzB;EAEA,OACE,yBAAyB,MAAM,iBAAiB,oBAC9C,uBAAuB,MAAM,YAAY,sBACzC,oBAAoB,MAAM,YAAY,eAC1C;EAEA,MAAM,cAAc,gBAA2C;GAW7D,OAVkB,CAChB,GAAG,IAAI,IACL,MAAM,cAAc,SAAS,OAAO,KACjC,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,YAAY,gBACpE,CACF,CACF,CAAC,CACE,QAAQ,SAAS,OAAO,MAAM,GAAG,CAAC,CAClC,MAAM,GAAG,MAAM,IAAI,CAEP,CAAC,CAAC,MACd,SAAS,CAAC,4BAA4B,MAAM,cAAc,UAAU,aAAa,IAAI,CACxF;EACF;EAEA,MAAM,oBAAoB,WAAW,MAAM,cAAc,WAAW,GAClE,kBAAkB,WAAW,WAAW;EAE1C,OAAO,sBAAsB,KAAA,KAAa,oBAAoB,KAAA,CAAS;EACvE,MAAM,WAAW,KAAK,IAAI,mBAAmB,eAAe;EAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,MAAM,MAAM,IAAI,OAAO,IAAI,KAAK,SAAS,OAAO;EAE5E,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB;GAC9D,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO,iBAAiB,KAAK,SAAS,OAAO,CAAC;QAC1E;IACH,OAAO,wBAAwB,GAAG,GAAG,WAAW;IAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;GAC3E;EACF,CAAC;EAED,IAAI,UAAU,KAAA,GAAW;GACvB,IACE,EAAE,wBAAwB,KAAA,KACzB,EAAE,WAAW,KAAA,KAAa,EAAE,wBAAwB,KAAA,GAErD,OAAO,OAAO,YAAY;GAE5B,MAAM,UAAU,MAAM,SAAS,YAAY,KACxC,WACC,GAAG,wBAAwB,aAAa,KAAK,SAAS,WAAW,cAAc,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,cAAc,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,MAAM,cAAc,EAAE,UAAU,OAAO,QAAQ,EAAE,GAAG,EAAE,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,aAAa,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,MAAM,EAAE,QAAQ,EAAE,mBAAmB,IAAI,EACzW;GAEA,MAAM,SACJ,EAAE,WAAW,KAAA,IACT,GAAG,UACH,GAAG,GAAG,aAAa,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,MAAM,EAAE,QAAQ,EAAE,mBAAmB;GAEjG,MAAM,YAAY,IAAI,IAAI;IACxB,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,YAAY,EAAE,IAAI,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,EAAE,OAAO,WAAW,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IAC3Q,GAAG,yBAAyB,aAAa,KAAK,SAAS,WAAW,cAAc,EAAE,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,QAAQ;IACnI,GAAG;IACH;GACF,CAAC;GAED,OAAO,wBAAwB,kBAAkB,KAAK,SAAS,CAAC;GAChE,IAAI,MAAM,eAAe,KAAA,GAAW;IAClC,IAAI,EAAE,uBAAuB,KAAA,GAAW,OAAO,OAAO,YAAY;IAClE,OAAO,wBACL,kBACE,KACA,GAAG,wBAAwB,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,SAAS,MAAM,OAAO,EAAE,KAAK,GAAG,EAAE,WAAW,MAAM,WAAW,WAAW,SAAS,EAAE,OAAO,MAAM,OAAO,EAAE,KAAK,GAAG,EAAE,OAAO,MAAM,WAAW,WAAW,KAAK,EAAE,OAAO,WAAW,OAAO,EAAE,KAAK,GAAG,EAAE,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,mBAAmB;KAAE,YAAY,MAAM,WAAW;KAAY,iBAAiB;IAAS,CAAC,CAAC,EAAE,EACjY,CACF;GACF;EACF;EACA,MAAM,YAAY;GAAE;GAAc;GAAoB;EAAgB;EAEtE,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,OAAO,MACL,GAAG,GAAG,YAAY,OAAO,EAAE,aAAa;IAAE,UAAU,MAAM;IAAU,WAAW;IAAU,aAAa,MAAM;IAAa,GAAG;GAAU,CAAC,CAAC,GAC1I;GACA,OAAO,MACL,GAAG,GAAG,aAAa,OAAO,EAAE,aAAa;IAAE,WAAW;IAAU;IAAc,UAAU;GAAmB,CAAC,CAAC,GAC/G;EACF,OAAO;GACL,MAAM,MAAM,MAAM;GAElB,OAAO,MACL,GAAG,GAAG,YAAY,OAAO,EAAE,kBAAkB;IAAE,aAAa,MAAM;IAAa;IAAoB;GAAgB,CAAC,CAAC,EAAE,SAAS,WAAW,aAAa,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,aAAa,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,aAAa,EAAE,cAAc,IAAI,YAAY,EAAE,OAAO,MAAM,aAAa,EAAE,oBAAoB,IAAI,kBAAkB,EAAE,OAAO,MAAM,aAAa,EAAE,iBAAiB,IAAI,eAAe,EAAE,OAAO,MAAM,aAAa,EAAE,UAAU,SAAS,MAAM,IAAI,QAAQ,CAAC,EAAE,OAAO,MAAM,aAAa,EAAE,eAAe,IAAI,aAAa,EAAE,OAAO,WACtjB;GACA,OAAO,MACL,GAAG,GAAG,aAAa,OAAO,EAAE,eAAe,kBAAkB,CAAC,EAAE,SAAS,WAAW,cAAc,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,cAAc,EAAE,cAAc,IAAI,YAAY,EAAE,OAAO,MAAM,cAAc,EAAE,UAAU,IAAI,kBAAkB,GACrP;EACF;EAEA,MAAM,kBAAkB,MAAM,SAAS,YACpC,QAAQ,WAAW,OAAO,iBAAiB,YAAY,CAAC,CACxD,OAAO;GAAE;GAAc,UAAU;EAAmB,CAAC;EAExD,MAAM,gBAAgB,GAAG,wBAAwB,YAAY,KAAK,SAAS,WAAW,aAAa,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,aAAa,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,aAAa,EAAE,cAAc,YAAY,EAAE,OAAO,MAAM,aAAa,EAAE,oBAAoB,kBAAkB,EAAE,OAAO,MAAM,aAAa,EAAE,iBAAiB,eAAe,EAAE,OAAO,MAAM,aAAa,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,EAAE,OAAO,MAAM,aAAa,EAAE,eAAe,MAAM,YAAY,aAAa,EAAE;EAExgB,MAAM,kBACH,EAAE,WAAW,KAAA,KAAa,EAAE,wBAAwB,KAAA,OACpD,MAAM,eAAe,KAAA,KAAa,EAAE,uBAAuB,KAAA;EAE9D,IAAI;EAEJ,IAAI,gBAAgB;GAClB,MAAM,SACJ,EAAE,WAAW,KAAA,IACT,GAAG,UACH,GAAG,GAAG,aAAa,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,MAAM,EAAE,QAAQ,EAAE,mBAAmB;GAEjG,MAAM,aAA8B;IAClC;IACA;IACA,GAAG,yBAAyB,aAAa,KAAK,SAAS,WAAW,cAAc,EAAE,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,gBAAgB;IAC3I,GAAG,gBAAgB,KAChB,WACC,GAAG,wBAAwB,aAAa,KAAK,SAAS,WAAW,cAAc,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,cAAc,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,MAAM,cAAc,EAAE,UAAU,OAAO,QAAQ,EAAE,OAAO,OAAO,EAChP;GACF;GAEA,IAAI,MAAM,eAAe,KAAA,GAAW;IAClC,MAAM,WAAW,MAAM;IACvB,MAAM,kBAAkB,OAAO,EAAE,KAAK;IAEtC,OAAO,EAAE,uBAAuB,KAAA,CAAS;IACzC,WAAW,KACT,GAAG,wBAAwB,gBAAgB,KAAK,SAAS,MAAM,iBAAiB,EAAE,WAAW,SAAS,WAAW,SAAS,EAAE,OAAO,MAAM,iBAAiB,EAAE,OAAO,SAAS,WAAW,KAAK,EAAE,OAAO,WAAW,iBAAiB,EAAE,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,mBAAmB;KAAE,YAAY,SAAS;KAAY,iBAAiB;IAAS,CAAC,CAAC,EAAE,IACvW,GAAG,wBAAwB,gBAAgB,KAAK,SAAS,MAAM,iBAAiB,EAAE,WAAW,SAAS,WAAW,SAAS,EAAE,OAAO,MAAM,iBAAiB,EAAE,OAAO,SAAS,WAAW,KAAK,EAAE,OAAO,WAAW,iBAAiB,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,iBAAiB,EAAE,iBAAiB,SAAS,yBAAyB,EAAE,OAAO,SAAS,+BAA+B,KAAA,IAAY,GAAG,GAAG,gBAAgB,OAAO,EAAE,UAAU,EAAE,YAAY,GAAG,GAAG,gBAAgB,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,MAAM,EAAE,YAAY,QAAQ,MAAM,cAAc,SAAS,0BAA0B,CAAC,IAAI,EACzlB;GACF;GACA,iBAAiB,IAAI,IAAI,UAAU;EACrC;EACA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO,GAAG,EAAE,mBAAmB,qBAAqB,CAAC,EAAE,SAAS,WAAW,YAAY,EAAE,IAAI,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,EAAE,OAAO,WAAW,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,EAAE,QAAQ,OAAO,EAAE,OAAO,EAAE,OAAO,UAAU,OAAO,kBAAkB,GAAG,SAClV;EACA,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,mBAAmB,KAAA,CAAS;GACnC,OAAO,8BAA8B;IACnC,MAAM;IACN,WAAW,kBACT,KACA,IAAI,IAAI,CACN,gBACA,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,YAAY,EAAE,IAAI,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,kBAAkB,oBAAoB,EAAE,OAAO,WAAW,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EAC1P,CAAC,CACH;GACF,CAAC;EACH,OAAO,IAAI,OAAO,OAAO,MAAM,KAAK,mBAAmB,KAAA,GACrD,OAAO,yBAAyB;GAC9B,MAAM;GACN,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,QAAQ,OAAO,KACnB,MAAM,UACN,MAAM,iBAAiB,WACvB,MAAM,YAAY,UACpB;IAEA,OACE,UAAU,KAAA,KACR,EAAE,eAAe,MAAM,WAAW,EAAE,OAAO,KAC3C,MAAM,SAAS,qBAAqB,wBACpC,MAAM,SAAS,YAAY,WAAW,gBAAgB,UACtD,gBAAgB,OAAO,WACrB,MAAM,SAAS,YAAY,MACxB,UACC,MAAM,iBAAiB,OAAO,gBAC9B,MAAM,aAAa,OAAO,QAC9B,CACF,KACA,MAAM,OAAO,MAAM,OACnB,MAAM,MAAM,QAChB;IACA,MAAM,WAAW,MAAM;IAEvB,OACE,aAAa,KAAA,KACX,SAAS,EAAE,kBAAkB,gBAC7B,SAAS,EAAE,wBAAwB,sBACnC,SAAS,EAAE,qBAAqB,mBAChC,SAAS,EAAE,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KAClE,SAAS,EAAE,mBAAmB,MAAM,YAAY,aACpD;IACA,IAAI,MAAM,eAAe,KAAA,GACvB,OACE,MAAM,aAAa,KAAA,KACjB,MAAM,SAAS,8BACb,MAAM,WAAW,6BACnB,MAAM,SAAS,+BACb,MAAM,WAAW,0BACvB;GACJ,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAC7D,CACF;EACF,CAAC;EAEH,OAAO,OAAO,QAAQ,WAAoB,OAAO;CACnD,CAAC,CACH;CA8CF,OAAO,EAAE,qBAAA;EApCP,GAAG,OARsB,wBAAwB,QAAQ,SAAS;GAClE,MAAM;GACN,SAAS;GACT,aAAa,OAAO,OAAO,MAAM;GACjC,iBAAiB,kBAAkB,aAAa,IAAI,kBAAkB;EACxE,CAAC;EAIC,iBAAiB,UACf,SAAS,KACP,OAAO,IAAI,KAAK,MAAM,UAAU,MAAM,SAAS,IAAI,UACjD,UAAU,KAAA,KAAa,CAAC,EAAE,eAAe,MAAM,WAAW,EAAE,OAAO,IAC/D,OAAO,KAAK,IACZ,OAAO,gBAAgB,MAAM,QAAQ,CAC3C,CACF;EACF,iBAAiB,UACf,SAAS,KACP,OAAO,IAAI,aAAa;GACtB,MAAM,OACJ,OAAO,GAAG,UAAU,WAAW,OAAO,oBAAoB,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,EAAE,OAAO,MAAM,YAAY,EAAE,OAAO,MAAM,WAAW,KAAK,EAAE;GAEpN,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,KAAK;GAC1C,OAAO,KAAK,WAAW,CAAC;GACxB,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,oBAAoB;GAE5D,IAAI,CAAC,EAAE,UAAU,GAAG,GAAG,OAAO,OAAO,KAAK;GAC1C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;GACrE,MAAM,QAAQ,OAAO,KAAK,MAAM,UAAU,WAAW,MAAM,UAAU;GAErE,OAAO,UAAU,KAAA,KACf,CAAC,EAAE,eAAe,MAAM,WAAW,EAAE,OAAO,KAC5C,MAAM,UAAU,+BAA+B,KAAA,IAC7C,OAAO,KAAK,IACZ,OAAO,KAAK,MAAM,QAAQ;EAChC,CAAC,CACH;EACF,cAAc,OAAO,YAAY,SAAS,OAAO,gBAAgB,OAAO;EACxE,mBAAmB,OAAO,YAAY,SAAS,OAAO,mBAAmB,OAAO;EAChF,iBAAiB,OAAO,YACtB,SAAS,OAAO,kBAAkB,SAAS,MAAM,UAAU;CAGpC,EAAE;AAC/B,CAAC"}

package/dist/internal/password-policy.mjs

@@ -0,0 +1,93 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { DateTime, Effect, Redacted } from "effect";
+import { PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
+import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
+//#region src/internal/password-policy.ts
+const unavailable = () => PasswordUnavailable.make({});
+const samePasswordIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
+const samePasswordCredential = (left, right) => left.moduleId === right.moduleId && left.revision.subjectId === right.revision.subjectId && left.revision.securityRevision === right.revision.securityRevision && left.credentialId === right.credentialId && left.credentialRevision === right.credentialRevision && left.verifierVersion === right.verifierVersion && left.normalization === right.normalization && left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis && left.revision.credentials.length === right.revision.credentials.length && left.revision.credentials.every((entry) => right.revision.credentials.some((other) => other.credentialId === entry.credentialId && other.revision === entry.revision)) && left.identifierBindingRevision === right.identifierBindingRevision && samePasswordIdentifier(left.identifier, right.identifier) && Redacted.value(left.verifier) === Redacted.value(right.verifier);
+const passwordEvidenceSatisfiedAt = (evidence, requirement, now) => {
+	if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
+	const revisions = /* @__PURE__ */ new Map();
+	for (const item of evidence.revision.credentials) {
+		if (revisions.has(item.credentialId)) return false;
+		revisions.set(item.credentialId, item.revision);
+	}
+	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
+	if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
+	const eligible = evidence.proofs.filter((proof) => {
+		const age = now - DateTime.toEpochMillis(proof.verifiedAt);
+		return age >= 0 && age < requirement.maximumAgeMillis;
+	});
+	const factors = new Set(eligible.flatMap((proof) => proof.factors));
+	const credentials = new Set(eligible.map((proof) => proof.credentialId));
+	return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && credentials.size >= alternative.minimumCredentials && eligible.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
+};
+const snapshotPasswordMutation = Effect.fn("PasswordPersistence.snapshotMutation")(function* (input) {
+	const expectedRevision = snapshotPasswordRevision(input.expectedRevision);
+	const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
+	const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);
+	const credential = input.credential === void 0 ? void 0 : yield* snapshotPasswordCredential(input.credential);
+	return Object.freeze({
+		...input,
+		expectedRevision,
+		replacement: Object.freeze({
+			verifier: Redacted.make(Redacted.value(input.replacement.verifier)),
+			normalization: input.replacement.normalization
+		}),
+		invalidation: Object.freeze({ ...input.invalidation }),
+		...credential === void 0 ? {} : { credential },
+		authorization: Object.freeze({
+			challenge: Object.freeze({
+				...input.authorization.challenge,
+				revision: snapshotPasswordRevision(input.authorization.challenge.revision)
+			}),
+			evidence,
+			requirement
+		})
+	});
+});
+const passwordProofRedemptionMatches = (input) => {
+	const completion = input.redemption.input;
+	const binding = completion.binding;
+	if (completion.moduleId !== `${input.moduleId}/reset` || completion.purpose !== "password-reset" || binding._tag !== "Subject" || input.credential === void 0 || binding.revision.subjectId !== input.expectedRevision.subjectId || binding.revision.securityRevision !== input.expectedRevision.securityRevision || !samePasswordIdentifier(binding.identifier, input.credential.identifier)) return false;
+	const expected = [...input.expectedRevision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+	const actual = [...binding.revision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+	return expected.length === actual.length && expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
+};
+const allocatePasswordValue = (mode, asynchronous, synchronous) => mode !== "synchronous" && asynchronous !== void 0 ? asynchronous : synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+	try: synchronous,
+	catch: (cause) => PersistenceMappingError.make({
+		operation: "mapping",
+		cause
+	})
+});
+const allocatePasswordNextSecurityRevision = (policy, mode, current) => allocatePasswordValue(mode, policy.subject.nextSecurityRevision?.(current) ?? policy.allocateRevision, policy.subject.nextSecurityRevisionSync === void 0 ? policy.allocateRevisionSync : () => policy.subject.nextSecurityRevisionSync(current));
+const passwordMutationEvidenceMatches = (input) => !input.expectedRevision.credentials.some((expected) => !input.authorization.evidence.revision.credentials.some((actual) => actual.credentialId === expected.credentialId && actual.revision === expected.revision));
+const validatePasswordMutation = Effect.fnUntraced(function* (policy, input, action, current, now) {
+	if (current.subject === void 0 || !current.subject.active || current.subject.securityRevision !== input.expectedRevision.securityRevision) return void 0;
+	const { challenge, evidence } = input.authorization;
+	if (challenge.moduleId !== input.moduleId || challenge.action !== action || challenge.commandId !== input.commandId || challenge.revision.subjectId !== input.expectedRevision.subjectId || challenge.revision.securityRevision !== input.expectedRevision.securityRevision || evidence.flowId !== input.commandId || evidence.bindingDigest !== challenge.bindingDigest || evidence.revision.subjectId !== input.expectedRevision.subjectId || evidence.revision.securityRevision !== input.expectedRevision.securityRevision || action === "add-password" && (input.credential !== void 0 || challenge.targetCredentialId !== void 0)) return void 0;
+	if (!passwordMutationEvidenceMatches(input)) return void 0;
+	if (input.credential !== void 0 && !current.identifierCurrent) return void 0;
+	const expected = new Map([...input.expectedRevision.credentials, ...evidence.revision.credentials].map((item) => [item.credentialId, item]));
+	if (current.credentials.length !== expected.size) return void 0;
+	for (const credential of current.credentials) {
+		const wanted = expected.get(credential.credentialId);
+		if (wanted === void 0 || credential.revision !== wanted.revision || !credential.active) return void 0;
+		expected.delete(wanted.credentialId);
+	}
+	if (expected.size !== 0) return void 0;
+	if (input.credential !== void 0) {
+		const snapshot = yield* current.snapshot;
+		if (snapshot === void 0 || !samePasswordCredential(snapshot, input.credential)) return void 0;
+	}
+	const requirement = yield* current.requirement;
+	if (!passwordEvidenceSatisfiedAt(evidence, input.authorization.requirement, now) || !passwordEvidenceSatisfiedAt(evidence, requirement, now)) return void 0;
+	if (input.invalidation.existingSessions === "immediate" && policy.sessionInvalidation !== "same-authority-immediate") return void 0;
+	return now;
+});
+//#endregion
+export { allocatePasswordNextSecurityRevision, allocatePasswordValue, passwordEvidenceSatisfiedAt, passwordMutationEvidenceMatches, passwordProofRedemptionMatches, samePasswordCredential, samePasswordIdentifier, snapshotPasswordMutation, validatePasswordMutation };
+
+//# sourceMappingURL=password-policy.mjs.map

package/dist/internal/password-policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.mjs","names":[],"sources":["../../src/internal/password-policy.ts"],"sourcesContent":["import type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordCredentialSnapshot,\n  type PasswordMutationInput,\n} from \"@yielded/auth/Password\";\nimport type { ProofRedemptionPlan } from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Redacted } from \"effect\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyProofPersistenceMapping } from \"./models/proof-model\";\n\nconst unavailable = () => PasswordUnavailable.make({});\n\nexport const samePasswordIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n  left.namespace === right.namespace && left.value === right.value;\n\nexport const samePasswordCredential = (\n  left: PasswordCredentialSnapshot,\n  right: PasswordCredentialSnapshot,\n) =>\n  left.moduleId === right.moduleId &&\n  left.revision.subjectId === right.revision.subjectId &&\n  left.revision.securityRevision === right.revision.securityRevision &&\n  left.credentialId === right.credentialId &&\n  left.credentialRevision === right.credentialRevision &&\n  left.verifierVersion === right.verifierVersion &&\n  left.normalization === right.normalization &&\n  left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis &&\n  left.revision.credentials.length === right.revision.credentials.length &&\n  left.revision.credentials.every((entry) =>\n    right.revision.credentials.some(\n      (other) => other.credentialId === entry.credentialId && other.revision === entry.revision,\n    ),\n  ) &&\n  left.identifierBindingRevision === right.identifierBindingRevision &&\n  samePasswordIdentifier(left.identifier, right.identifier) &&\n  Redacted.value(left.verifier) === Redacted.value(right.verifier);\n\nexport const passwordEvidenceSatisfiedAt = (\n  evidence: AuthenticationEvidence,\n  requirement: AuthenticationRequirement,\n  now: number,\n): boolean => {\n  if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n  const revisions = new Map<string, string>();\n\n  for (const item of evidence.revision.credentials) {\n    if (revisions.has(item.credentialId)) return false;\n    revisions.set(item.credentialId, item.revision);\n  }\n  if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n  if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;\n\n  const eligible = evidence.proofs.filter((proof) => {\n    const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n    return age >= 0 && age < requirement.maximumAgeMillis;\n  });\n\n  const factors = new Set(eligible.flatMap((proof) => proof.factors));\n  const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      credentials.size >= alternative.minimumCredentials &&\n      eligible.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const snapshotPasswordMutation = Effect.fn(\"PasswordPersistence.snapshotMutation\")(\n  function* (input: PasswordMutationInput) {\n    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n    const credential =\n      input.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(input.credential);\n\n    return Object.freeze({\n      ...input,\n      expectedRevision,\n      replacement: Object.freeze({\n        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n        normalization: input.replacement.normalization,\n      }),\n      invalidation: Object.freeze({ ...input.invalidation }),\n      ...(credential === undefined ? {} : { credential }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  },\n);\n\nexport const passwordProofRedemptionMatches = (\n  input: PasswordMutationInput & { readonly redemption: ProofRedemptionPlan },\n) => {\n  const completion = input.redemption.input;\n  const binding = completion.binding;\n\n  if (\n    completion.moduleId !== `${input.moduleId}/reset` ||\n    completion.purpose !== \"password-reset\" ||\n    binding._tag !== \"Subject\" ||\n    input.credential === undefined ||\n    binding.revision.subjectId !== input.expectedRevision.subjectId ||\n    binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n    !samePasswordIdentifier(binding.identifier, input.credential.identifier)\n  )\n    return false;\n\n  const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n    left.credentialId.localeCompare(right.credentialId),\n  );\n\n  const actual = [...binding.revision.credentials].sort((left, right) =>\n    left.credentialId.localeCompare(right.credentialId),\n  );\n\n  return (\n    expected.length === actual.length &&\n    expected.every(\n      (item, index) =>\n        item.credentialId === actual[index]!.credentialId &&\n        item.revision === actual[index]!.revision,\n    )\n  );\n};\n\nexport interface PasswordWorkflowPolicy {\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly subject: {\n    readonly nextSecurityRevision?: (\n      current: SecurityRevision,\n    ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  };\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n}\n\nexport interface PasswordWorkflowOptions {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly coordinated?: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly proof?: AnyProofPersistenceMapping;\n}\n\nexport const allocatePasswordValue = <A>(\n  mode: PasswordWorkflowOptions[\"mode\"],\n  asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n  synchronous: (() => A) | undefined,\n): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> =>\n  mode !== \"synchronous\" && asynchronous !== undefined\n    ? asynchronous\n    : synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => PersistenceMappingError.make({ operation: \"mapping\", cause }),\n        });\n\nexport const allocatePasswordNextSecurityRevision = (\n  policy: PasswordWorkflowPolicy,\n  mode: PasswordWorkflowOptions[\"mode\"],\n  current: SecurityRevision,\n) =>\n  allocatePasswordValue(\n    mode,\n    policy.subject.nextSecurityRevision?.(current) ?? policy.allocateRevision,\n    policy.subject.nextSecurityRevisionSync === undefined\n      ? policy.allocateRevisionSync\n      : () => policy.subject.nextSecurityRevisionSync!(current),\n  );\n\nexport const passwordMutationEvidenceMatches = (input: PasswordMutationInput) =>\n  !input.expectedRevision.credentials.some(\n    (expected) =>\n      !input.authorization.evidence.revision.credentials.some(\n        (actual) =>\n          actual.credentialId === expected.credentialId && actual.revision === expected.revision,\n      ),\n  );\n\nexport const validatePasswordMutation = Effect.fnUntraced(function* (\n  policy: PasswordWorkflowPolicy,\n  input: PasswordMutationInput,\n  action: PasswordAction,\n  current: Pick<\n    PasswordMutationRead,\n    \"subject\" | \"identifierCurrent\" | \"credentials\" | \"snapshot\" | \"requirement\"\n  >,\n  now: number,\n) {\n  if (\n    current.subject === undefined ||\n    !current.subject.active ||\n    current.subject.securityRevision !== input.expectedRevision.securityRevision\n  )\n    return undefined;\n  const { challenge, evidence } = input.authorization;\n\n  if (\n    challenge.moduleId !== input.moduleId ||\n    challenge.action !== action ||\n    challenge.commandId !== input.commandId ||\n    challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n    challenge.revision.securityRevision !== input.expectedRevision.securityRevision ||\n    (evidence.flowId as string) !== (input.commandId as string) ||\n    evidence.bindingDigest !== challenge.bindingDigest ||\n    evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n    evidence.revision.securityRevision !== input.expectedRevision.securityRevision ||\n    (action === \"add-password\" &&\n      (input.credential !== undefined || challenge.targetCredentialId !== undefined))\n  )\n    return undefined;\n  if (!passwordMutationEvidenceMatches(input)) return undefined;\n  if (input.credential !== undefined && !current.identifierCurrent) return undefined;\n\n  const expected = new Map(\n    [...input.expectedRevision.credentials, ...evidence.revision.credentials].map((item) => [\n      item.credentialId,\n      item,\n    ]),\n  );\n\n  if (current.credentials.length !== expected.size) return undefined;\n  for (const credential of current.credentials) {\n    const wanted = expected.get(credential.credentialId);\n\n    if (wanted === undefined || credential.revision !== wanted.revision || !credential.active)\n      return undefined;\n    expected.delete(wanted.credentialId);\n  }\n  if (expected.size !== 0) return undefined;\n  if (input.credential !== undefined) {\n    const snapshot = yield* current.snapshot;\n\n    if (snapshot === undefined || !samePasswordCredential(snapshot, input.credential))\n      return undefined;\n  }\n  const requirement = yield* current.requirement;\n\n  if (\n    !passwordEvidenceSatisfiedAt(evidence, input.authorization.requirement, now) ||\n    !passwordEvidenceSatisfiedAt(evidence, requirement, now)\n  )\n    return undefined;\n  if (\n    input.invalidation.existingSessions === \"immediate\" &&\n    policy.sessionInvalidation !== \"same-authority-immediate\"\n  )\n    return undefined;\n\n  return now;\n});\n\n/** Decoded subject-first snapshot used only for this action's policy decision. */\nexport interface PasswordMutationRead {\n  readonly subject:\n    | { readonly active: boolean; readonly securityRevision: SecurityRevision }\n    | undefined;\n  readonly identifierCurrent: boolean;\n  readonly credentials: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n    readonly active: boolean;\n  }>;\n  readonly snapshot: Effect.Effect<\n    PasswordCredentialSnapshot | undefined,\n    PasswordUnavailable | PersistenceMappingError\n  >;\n  readonly requirement: Effect.Effect<\n    AuthenticationRequirement,\n    PasswordUnavailable | PersistenceMappingError\n  >;\n}\n"],"mappings":";;;;;AAsBA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAa,0BAA0B,MAAuB,UAC5D,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;AAE7D,MAAa,0BACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,SAAS,cAAc,MAAM,SAAS,aAC3C,KAAK,SAAS,qBAAqB,MAAM,SAAS,oBAClD,KAAK,iBAAiB,MAAM,gBAC5B,KAAK,uBAAuB,MAAM,sBAClC,KAAK,oBAAoB,MAAM,mBAC/B,KAAK,kBAAkB,MAAM,iBAC7B,KAAK,+BAA+B,MAAM,8BAC1C,KAAK,SAAS,YAAY,WAAW,MAAM,SAAS,YAAY,UAChE,KAAK,SAAS,YAAY,OAAO,UAC/B,MAAM,SAAS,YAAY,MACxB,UAAU,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,aAAa,MAAM,QACnF,CACF,KACA,KAAK,8BAA8B,MAAM,6BACzC,uBAAuB,KAAK,YAAY,MAAM,UAAU,KACxD,SAAS,MAAM,KAAK,QAAQ,MAAM,SAAS,MAAM,MAAM,QAAQ;AAEjE,MAAa,+BACX,UACA,aACA,QACY;CACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;CACrF,MAAM,4BAAY,IAAI,IAAoB;CAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;EAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;EAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;CAChD;CACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;CAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAAG,OAAO;CAE5F,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;EACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;EAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;CACvC,CAAC;CAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;CAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;CAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,2BAA2B,OAAO,GAAG,sCAAsC,CAAC,CACvF,WAAW,OAA8B;CACvC,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;CAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;CAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;CAExD,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA,aAAa,OAAO,OAAO;GACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;GAClE,eAAe,MAAM,YAAY;EACnC,CAAC;EACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;EACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EACjD,eAAe,OAAO,OAAO;GAC3B,WAAW,OAAO,OAAO;IACvB,GAAG,MAAM,cAAc;IACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;GAC3E,CAAC;GACD;GACA;EACF,CAAC;CACH,CAAC;AACH,CACF;AAEA,MAAa,kCACX,UACG;CACH,MAAM,aAAa,MAAM,WAAW;CACpC,MAAM,UAAU,WAAW;CAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,uBAAuB,QAAQ,YAAY,MAAM,WAAW,UAAU,GAEvE,OAAO;CAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;CAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;CAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;AAEJ;AAwBA,MAAa,yBACX,MACA,cACA,gBAEA,SAAS,iBAAiB,iBAAiB,KAAA,IACvC,eACA,gBAAgB,KAAA,IACd,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;CACT,KAAK;CACL,QAAQ,UAAU,wBAAwB,KAAK;EAAE,WAAW;EAAW;CAAM,CAAC;AAChF,CAAC;AAET,MAAa,wCACX,QACA,MACA,YAEA,sBACE,MACA,OAAO,QAAQ,uBAAuB,OAAO,KAAK,OAAO,kBACzD,OAAO,QAAQ,6BAA6B,KAAA,IACxC,OAAO,6BACD,OAAO,QAAQ,yBAA0B,OAAO,CAC5D;AAEF,MAAa,mCAAmC,UAC9C,CAAC,MAAM,iBAAiB,YAAY,MACjC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBAAgB,OAAO,aAAa,SAAS,QAClF,CACJ;AAEF,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,OACA,QACA,SAIA,KACA;CACA,IACE,QAAQ,YAAY,KAAA,KACpB,CAAC,QAAQ,QAAQ,UACjB,QAAQ,QAAQ,qBAAqB,MAAM,iBAAiB,kBAE5D,OAAO,KAAA;CACT,MAAM,EAAE,WAAW,aAAa,MAAM;CAEtC,IACE,UAAU,aAAa,MAAM,YAC7B,UAAU,WAAW,UACrB,UAAU,cAAc,MAAM,aAC9B,UAAU,SAAS,cAAc,MAAM,iBAAiB,aACxD,UAAU,SAAS,qBAAqB,MAAM,iBAAiB,oBAC9D,SAAS,WAAuB,MAAM,aACvC,SAAS,kBAAkB,UAAU,iBACrC,SAAS,SAAS,cAAc,MAAM,iBAAiB,aACvD,SAAS,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,WAAW,mBACT,MAAM,eAAe,KAAA,KAAa,UAAU,uBAAuB,KAAA,IAEtE,OAAO,KAAA;CACT,IAAI,CAAC,gCAAgC,KAAK,GAAG,OAAO,KAAA;CACpD,IAAI,MAAM,eAAe,KAAA,KAAa,CAAC,QAAQ,mBAAmB,OAAO,KAAA;CAEzE,MAAM,WAAW,IAAI,IACnB,CAAC,GAAG,MAAM,iBAAiB,aAAa,GAAG,SAAS,SAAS,WAAW,CAAC,CAAC,KAAK,SAAS,CACtF,KAAK,cACL,IACF,CAAC,CACH;CAEA,IAAI,QAAQ,YAAY,WAAW,SAAS,MAAM,OAAO,KAAA;CACzD,KAAK,MAAM,cAAc,QAAQ,aAAa;EAC5C,MAAM,SAAS,SAAS,IAAI,WAAW,YAAY;EAEnD,IAAI,WAAW,KAAA,KAAa,WAAW,aAAa,OAAO,YAAY,CAAC,WAAW,QACjF,OAAO,KAAA;EACT,SAAS,OAAO,OAAO,YAAY;CACrC;CACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;CAChC,IAAI,MAAM,eAAe,KAAA,GAAW;EAClC,MAAM,WAAW,OAAO,QAAQ;EAEhC,IAAI,aAAa,KAAA,KAAa,CAAC,uBAAuB,UAAU,MAAM,UAAU,GAC9E,OAAO,KAAA;CACX;CACA,MAAM,cAAc,OAAO,QAAQ;CAEnC,IACE,CAAC,4BAA4B,UAAU,MAAM,cAAc,aAAa,GAAG,KAC3E,CAAC,4BAA4B,UAAU,aAAa,GAAG,GAEvD,OAAO,KAAA;CACT,IACE,MAAM,aAAa,qBAAqB,eACxC,OAAO,wBAAwB,4BAE/B,OAAO,KAAA;CAET,OAAO;AACT,CAAC"}

package/dist/internal/password-registration-native.d.mts

@@ -0,0 +1,22 @@
+import "./mapping-error.mjs";
+import { AnyPasswordRegistrationMapping } from "./models/password-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { PasswordRegistrationAuthority } from "./registration-contract.mjs";
+import "./sql-commit.mjs";
+import { Cause, Crypto, Effect, Schema } from "effect";
+import { Fragment } from "effect/sql/Statement";
+import { CurrentCommitJournal, LifecycleHooks } from "@yielded/auth/Hooks";
+import { PasswordRegistrationDecision, PasswordReplacement, PasswordUnavailable, PreparePasswordCommit } from "@yielded/auth/Password";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+import { LoginIdentifier } from "@yielded/auth/Identity";
+import { SubjectId } from "@yielded/auth/Schema";
+//#region src/internal/password-registration-native.d.ts
+export declare const makeNativePasswordRegistrationServices: <Registration>(tables: NativeSqlTables, mapping: AnyPasswordRegistrationMapping<Registration>, batch?: {
+  readonly client: SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  readonly registrationAuthority: PasswordRegistrationAuthority<Registration>;
+}, PasswordUnavailable, Crypto.Crypto | LifecycleHooks | SqlClient>;
+//#endregion
+//# sourceMappingURL=password-registration-native.d.mts.map