@yielded/auth 0.1.0-beta.1

package/dist/passkey/simplewebauthn/protocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/passkey/simplewebauthn/protocol.ts"],"sourcesContent":["import {\n  generateAuthenticationOptions,\n  generateRegistrationOptions,\n  verifyAuthenticationResponse,\n  verifyRegistrationResponse,\n} from \"@simplewebauthn/server\";\nimport {\n  decodeAttestationObject,\n  decodeClientDataJSON,\n  decodeCredentialPublicKey,\n  isoCBOR,\n  parseAuthenticatorData,\n} from \"@simplewebauthn/server/helpers\";\nimport type { Context } from \"effect\";\nimport { Cause, DateTime, Effect, Encoding, Layer, Redacted, Schema } from \"effect\";\n\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport type { PasskeyConfigurationError } from \"../errors\";\nimport { PasskeyProtocolRejected, PasskeyUnavailable } from \"../errors\";\nimport {\n  PasskeyAssertion,\n  PasskeyAssertionVerified,\n  PasskeyAttestation,\n  PasskeyAuthenticationOptions,\n  PasskeyCeremony,\n  PasskeyChallenge,\n  PasskeyCounter,\n  PasskeyCredential,\n  PasskeyDescriptor,\n  PasskeyLabel,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationVerified,\n  PasskeyUserHandle,\n} from \"../models\";\nimport { PasskeyProtocol } from \"../PasskeyProtocol\";\nimport { samePasskey, snapshotPasskey } from \"../snapshot\";\nimport { captureSimpleWebAuthnProfiles } from \"./configuration\";\nimport type { SimpleWebAuthnPasskeyProtocolOptions } from \"./models\";\n\ntype Protocol = Context.Service.Shape<typeof PasskeyProtocol>;\ntype Input<K extends keyof Protocol> = Parameters<Protocol[K]>[0];\nconst rejected = () => PasskeyProtocolRejected.make({});\nconst unavailable = () => PasskeyUnavailable.make({});\n\nconst unexpected = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.catchCause((cause): Effect.Effect<never, E | PasskeyUnavailable> =>\n      Cause.hasDies(cause)\n        ? reportAuthFailure(\"passkey-protocol\", cause).pipe(\n            Effect.andThen(Effect.fail(unavailable())),\n          )\n        : Effect.failCause(cause),\n    ),\n  );\n\nconst maintained = <A>(call: () => Promise<A>) =>\n  Effect.tryPromise(call).pipe(\n    Effect.onError((cause) => reportAuthFailure(\"passkey-protocol\", cause)),\n    Effect.mapError(unavailable),\n  );\n\nconst parsed = <A>(call: () => A) => Effect.try({ try: call, catch: rejected });\n\nconst decode = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  input: unknown,\n) =>\n  // Maintained JSON/CBOR parsers and their map lookups return untyped wire data.\n  // eslint-disable-next-line no-restricted-properties\n  Schema.decodeUnknownEffect(schema)(input).pipe(Effect.mapError(rejected));\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  input: S[\"Type\"],\n) => snapshotPasskey(schema, input).pipe(Effect.mapError(rejected));\n\nconst sameBytes = (left: Uint8Array, right: Uint8Array) =>\n  left.length === right.length && left.every((byte, index) => byte === right[index]);\n\nconst binary = (minimum: number, maximum: number) =>\n  Schema.String.check(\n    Schema.isMaxLength(Math.ceil((maximum * 4) / 3)),\n    Schema.makeFilter((value) => {\n      const result = Encoding.decodeBase64Url(value);\n\n      return (\n        result._tag === \"Success\" &&\n        result.success.length >= minimum &&\n        result.success.length <= maximum &&\n        Encoding.encodeBase64Url(result.success) === value\n      );\n    }),\n  );\n\nconst bytes = Effect.fn(\"simpleWebAuthnBytes\")(function* (value: string) {\n  const result = Encoding.decodeBase64Url(value);\n\n  if (result._tag === \"Failure\") return yield* rejected();\n\n  return new Uint8Array(result.success);\n});\n\nconst duration = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 300000 }));\n\nconst prepareAuthenticationInput = Schema.Struct({\n  profile: PasskeyProfile,\n  challenge: PasskeyChallenge,\n  timeoutMillis: duration,\n  allowedCredentials: Schema.Array(PasskeyDescriptor).check(Schema.isMaxLength(64)),\n});\n\nconst prepareRegistrationInput = Schema.Struct({\n  profile: PasskeyProfile,\n  challenge: PasskeyChallenge,\n  timeoutMillis: duration,\n  userHandle: PasskeyUserHandle,\n  name: PasskeyLabel,\n  displayName: PasskeyLabel,\n  excludedCredentials: Schema.Array(PasskeyDescriptor).check(Schema.isMaxLength(64)),\n});\n\nconst authenticationInput = Schema.Struct({\n  ceremony: PasskeyCeremony,\n  credential: PasskeyCredential,\n  response: PasskeyAssertion,\n});\n\nconst registrationInput = Schema.Struct({\n  ceremony: PasskeyCeremony,\n  response: PasskeyAttestation,\n});\n\nconst envelope = {\n  id: PasskeyProtocolCredentialId,\n  rawId: PasskeyProtocolCredentialId,\n  type: Schema.Literal(\"public-key\"),\n};\n\nconst authenticationResponse = Schema.Struct({\n  ...envelope,\n  response: Schema.Struct({\n    clientDataJSON: binary(1, 8192),\n    authenticatorData: binary(37, 16384),\n    signature: binary(1, 1024),\n    userHandle: Schema.optionalKey(Schema.NullOr(PasskeyUserHandle)),\n  }),\n});\n\nconst registrationResponse = Schema.Struct({\n  ...envelope,\n  response: Schema.Struct({ clientDataJSON: binary(1, 8192), attestationObject: binary(1, 65536) }),\n});\n\nconst clientData = Schema.Struct({\n  type: Schema.String,\n  challenge: PasskeyChallenge,\n  origin: Schema.String.check(Schema.isMaxLength(2048)),\n  crossOrigin: Schema.optionalKey(Schema.Boolean),\n  topOrigin: Schema.optionalKey(Schema.Unknown),\n});\n\ntype CborData =\n  | string\n  | number\n  | boolean\n  | null\n  | Uint8Array\n  | ReadonlyArray<CborData>\n  | ReadonlyMap<string | number, CborData>;\n\nconst cborLeaf = Schema.Union([\n  Schema.String.check(Schema.isMaxLength(8192)),\n  Schema.Number.check(Schema.isFinite()),\n  Schema.Boolean,\n  Schema.Null,\n  Schema.Uint8Array.check(Schema.makeFilter((value) => value.length <= 16384)),\n]);\n\nconst cborValue = (depth: number): Schema.Codec<CborData> => {\n  if (depth === 0) return cborLeaf;\n  const child = cborValue(depth - 1);\n\n  return Schema.Union([\n    cborLeaf,\n    Schema.Array(child).check(Schema.isMaxLength(64)),\n    Schema.ReadonlyMap(\n      Schema.Union([Schema.String.check(Schema.isMaxLength(128)), Schema.Int]),\n      child,\n    ).check(Schema.makeFilter((value) => value.size <= 32)),\n  ]);\n};\n\nconst cborMap = Schema.ReadonlyMap(\n  Schema.Union([Schema.String.check(Schema.isMaxLength(128)), Schema.Int]),\n  cborValue(4),\n).check(Schema.makeFilter((value) => value.size <= 32));\n\nconst encodeCbor = (value: CborData) => {\n  // The maintained encoder reads these Schema-validated Maps/arrays; its type\n  // requires mutable collections although no mutation is performed.\n  return isoCBOR.encode(value as Parameters<typeof isoCBOR.encode>[0]);\n};\n\nconst exactMap = Effect.fn(\"simpleWebAuthnExactMap\")(function* (input: Uint8Array, value: unknown) {\n  const result = yield* decode(cborMap, value);\n  const encoded = yield* parsed(() => encodeCbor(result));\n\n  if (!sameBytes(input, encoded)) return yield* rejected();\n\n  return result;\n});\n\nconst byteValue = (minimum: number, maximum: number) =>\n  Schema.Uint8Array.check(\n    Schema.makeFilter((value) => value.length >= minimum && value.length <= maximum),\n  );\n\nconst fresh = Effect.fn(\"simpleWebAuthnFresh\")(function* (ceremony: PasskeyCeremony) {\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (\n    ceremony.issuedAtMillis > now ||\n    now >= ceremony.expiresAtMillis ||\n    now >= ceremony.requestBindingExpiresAtMillis ||\n    ceremony.expiresAtMillis <= ceremony.issuedAtMillis\n  )\n    return yield* rejected();\n});\n\nconst checkClient = Effect.fn(\"simpleWebAuthnClientData\")(function* (\n  value: string,\n  ceremony: PasskeyCeremony,\n  type: \"webauthn.create\" | \"webauthn.get\",\n) {\n  const client = yield* decode(clientData, yield* parsed(() => decodeClientDataJSON(value)));\n\n  if (\n    client.type !== type ||\n    client.challenge !== ceremony.challenge ||\n    !ceremony.profile.origins.includes(client.origin) ||\n    client.crossOrigin === true ||\n    \"topOrigin\" in client\n  )\n    return yield* rejected();\n\n  return client;\n});\n\nconst checkAuthenticator = Effect.fn(\"simpleWebAuthnAuthenticatorData\")(function* (\n  original: Uint8Array,\n  registration: boolean,\n  profile: PasskeyProfile,\n) {\n  if (\n    original.length < 37 ||\n    original.length > 16384 ||\n    Boolean(original[32]! & 64) !== registration\n  )\n    return yield* rejected();\n  let prefix = 37;\n\n  if (registration) {\n    if (original.length < 55) return yield* rejected();\n\n    const length = new DataView(\n      original.buffer,\n      original.byteOffset,\n      original.byteLength,\n    ).getUint16(53, false);\n\n    if (length < 1 || length > 1023 || original.length < 55 + length) return yield* rejected();\n    prefix = 55 + length;\n  }\n  const result = yield* parsed(() => parseAuthenticatorData(new Uint8Array(original)));\n\n  if (\n    !result.flags.up ||\n    (profile.userVerification === \"required\" && !result.flags.uv) ||\n    (result.flags.bs && !result.flags.be) ||\n    result.flags.at !== registration ||\n    result.flags.flagsInt !== original[32]\n  )\n    return yield* rejected();\n  yield* decode(PasskeyCounter, result.counter);\n  const chunks: Uint8Array[] = [original.slice(0, prefix)];\n\n  if (registration) {\n    const id = yield* decode(byteValue(1, 1023), result.credentialID);\n    const key = yield* decode(byteValue(1, 8192), result.credentialPublicKey);\n\n    if (!sameBytes(id, original.slice(55, prefix))) return yield* rejected();\n    chunks.push(key);\n  }\n  if (result.flags.ed) {\n    const extension = yield* decode(byteValue(1, 16384), result.extensionsDataBuffer);\n\n    yield* exactMap(\n      extension,\n      yield* parsed(() => isoCBOR.decodeFirst<unknown>(new Uint8Array(extension))),\n    );\n    chunks.push(extension);\n  } else if (result.extensionsDataBuffer !== undefined) return yield* rejected();\n  const length = chunks.reduce((sum, chunk) => sum + chunk.length, 0);\n\n  if (length !== original.length) return yield* rejected();\n  let offset = 0;\n\n  for (const chunk of chunks) {\n    if (!sameBytes(chunk, original.slice(offset, offset + chunk.length))) return yield* rejected();\n    offset += chunk.length;\n  }\n\n  const rpHash = new Uint8Array(\n    yield* maintained(() =>\n      globalThis.crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(profile.rpId)),\n    ),\n  );\n\n  if (!sameBytes(rpHash, original.slice(0, 32))) return yield* rejected();\n\n  return result;\n});\n\nconst checkKey = Effect.fn(\"simpleWebAuthnPublicKey\")(function* (\n  input: Uint8Array,\n  allowed: ReadonlyArray<-7 | -257>,\n  expected?: -7 | -257,\n) {\n  const map = yield* exactMap(\n    input,\n    yield* parsed(() => decodeCredentialPublicKey(new Uint8Array(input))),\n  );\n\n  const algorithmId = yield* decode(Schema.Literals([-7, -257]), map.get(3));\n\n  if (!allowed.includes(algorithmId) || (expected !== undefined && algorithmId !== expected))\n    return yield* rejected();\n  let jwk: JsonWebKey;\n  let algorithm: EcKeyImportParams | RsaHashedImportParams;\n\n  if (algorithmId === -7) {\n    if (\n      map.size !== 5 ||\n      ![1, 3, -1, -2, -3].every((key) => map.has(key)) ||\n      map.get(1) !== 2 ||\n      map.get(-1) !== 1\n    )\n      return yield* rejected();\n    const x = yield* decode(byteValue(32, 32), map.get(-2));\n    const y = yield* decode(byteValue(32, 32), map.get(-3));\n\n    jwk = {\n      kty: \"EC\",\n      crv: \"P-256\",\n      x: Encoding.encodeBase64Url(x),\n      y: Encoding.encodeBase64Url(y),\n      ext: false,\n    };\n    algorithm = { name: \"ECDSA\", namedCurve: \"P-256\" };\n  } else {\n    if (map.size !== 4 || ![1, 3, -1, -2].every((key) => map.has(key)) || map.get(1) !== 3)\n      return yield* rejected();\n    const n = yield* decode(byteValue(256, 512), map.get(-1));\n    const e = yield* decode(byteValue(1, 4), map.get(-2));\n    const exponent = e.reduce((value, byte) => value * 256 + byte, 0);\n\n    if (\n      n[0]! < 128 ||\n      (n[n.length - 1]! & 1) === 0 ||\n      e[0] === 0 ||\n      exponent < 3 ||\n      exponent % 2 !== 1\n    )\n      return yield* rejected();\n    jwk = {\n      kty: \"RSA\",\n      alg: \"RS256\",\n      n: Encoding.encodeBase64Url(n),\n      e: Encoding.encodeBase64Url(e),\n      ext: false,\n    };\n    algorithm = { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" };\n  }\n  yield* maintained(() =>\n    globalThis.crypto.subtle.importKey(\"jwk\", jwk, algorithm, false, [\"verify\"]),\n  );\n\n  return algorithmId;\n});\n\nexport const makeSimpleWebAuthnPasskeyProtocol = Effect.fn(\"makeSimpleWebAuthnPasskeyProtocol\")(\n  function* (\n    options: SimpleWebAuthnPasskeyProtocolOptions,\n  ): Effect.fn.Return<Protocol, PasskeyConfigurationError> {\n    const select = yield* captureSimpleWebAuthnProfiles(options);\n\n    const prepareAuthentication = Effect.fn(\"SimpleWebAuthnPasskeyProtocol.prepareAuthentication\")(\n      function* (input: Input<\"prepareAuthentication\">) {\n        const fixed = yield* capture(prepareAuthenticationInput, input);\n        const profile = yield* select(fixed.profile);\n        const challenge = yield* bytes(fixed.challenge);\n\n        const result = yield* maintained(() =>\n          generateAuthenticationOptions({\n            rpID: profile.rpId,\n            challenge,\n            timeout: fixed.timeoutMillis,\n            userVerification: profile.userVerification,\n            allowCredentials: fixed.allowedCredentials.map((value) => ({ ...value })),\n          }),\n        );\n\n        const value = yield* decode(PasskeyAuthenticationOptions, {\n          challenge: result.challenge,\n          rpId: result.rpId,\n          timeout: result.timeout,\n          userVerification: result.userVerification,\n          allowCredentials: result.allowCredentials ?? [],\n        });\n\n        if (\n          !(yield* samePasskey(PasskeyAuthenticationOptions, value, {\n            challenge: fixed.challenge,\n            rpId: profile.rpId,\n            timeout: fixed.timeoutMillis,\n            userVerification: profile.userVerification,\n            allowCredentials: fixed.allowedCredentials,\n          }))\n        )\n          return yield* unavailable();\n\n        return yield* capture(PasskeyAuthenticationOptions, value);\n      },\n      unexpected,\n    );\n\n    const prepareRegistration = Effect.fn(\"SimpleWebAuthnPasskeyProtocol.prepareRegistration\")(\n      function* (input: Input<\"prepareRegistration\">) {\n        const fixed = yield* capture(prepareRegistrationInput, input);\n        const profile = yield* select(fixed.profile);\n\n        const challenge = yield* bytes(fixed.challenge),\n          userID = yield* bytes(fixed.userHandle);\n\n        const result = yield* maintained(() =>\n          generateRegistrationOptions({\n            rpName: profile.rpName,\n            rpID: profile.rpId,\n            userName: fixed.name,\n            userDisplayName: fixed.displayName,\n            userID,\n            challenge,\n            timeout: fixed.timeoutMillis,\n            attestationType: \"none\",\n            supportedAlgorithmIDs: [...profile.algorithms],\n            authenticatorSelection: {\n              residentKey: profile.residentKey,\n              userVerification: profile.userVerification,\n            },\n            excludeCredentials: fixed.excludedCredentials.map((value) => ({ ...value })),\n          }),\n        );\n\n        const value = yield* decode(PasskeyRegistrationOptions, {\n          challenge: result.challenge,\n          rp: result.rp,\n          user: result.user,\n          pubKeyCredParams: result.pubKeyCredParams,\n          timeout: result.timeout,\n          attestation: result.attestation,\n          authenticatorSelection: result.authenticatorSelection,\n          excludeCredentials: result.excludeCredentials ?? [],\n        });\n\n        const expected = {\n          challenge: fixed.challenge,\n          rp: { id: profile.rpId, name: profile.rpName },\n          user: { id: fixed.userHandle, name: fixed.name, displayName: fixed.displayName },\n          pubKeyCredParams: profile.algorithms.map((alg) => ({ type: \"public-key\", alg })),\n          timeout: fixed.timeoutMillis,\n          attestation: \"none\",\n          authenticatorSelection: {\n            residentKey: profile.residentKey,\n            userVerification: profile.userVerification,\n          },\n          excludeCredentials: fixed.excludedCredentials,\n        };\n\n        if (\n          !(yield* samePasskey(\n            PasskeyRegistrationOptions,\n            value,\n            yield* decode(PasskeyRegistrationOptions, expected),\n          ))\n        )\n          return yield* unavailable();\n\n        return yield* capture(PasskeyRegistrationOptions, value);\n      },\n      unexpected,\n    );\n\n    const verifyRegistration = Effect.fn(\"SimpleWebAuthnPasskeyProtocol.verifyRegistration\")(\n      function* (input: Input<\"verifyRegistration\">) {\n        const fixed = yield* capture(registrationInput, input),\n          ceremony = fixed.ceremony;\n\n        const profile = yield* select(ceremony.profile);\n\n        if (\n          (ceremony.purpose !== \"registration\" || ceremony.context._tag !== \"Registration\") &&\n          (ceremony.purpose !== \"enrollment\" || ceremony.context._tag !== \"Enrollment\")\n        )\n          return yield* rejected();\n        yield* fresh(ceremony);\n\n        const wire = yield* decode(\n          Schema.fromJsonString(registrationResponse),\n          Redacted.value(fixed.response),\n        );\n\n        if (wire.id !== wire.rawId) return yield* rejected();\n\n        const client = yield* checkClient(\n          wire.response.clientDataJSON,\n          ceremony,\n          \"webauthn.create\",\n        );\n\n        const attestationBytes = yield* bytes(wire.response.attestationObject);\n\n        const attestation = yield* exactMap(\n          attestationBytes,\n          yield* parsed(() => decodeAttestationObject(new Uint8Array(attestationBytes))),\n        );\n\n        if (\n          attestation.size !== 3 ||\n          attestation.get(\"fmt\") !== \"none\" ||\n          !attestation.has(\"attStmt\") ||\n          !attestation.has(\"authData\")\n        )\n          return yield* rejected();\n        const statement = yield* decode(cborMap, attestation.get(\"attStmt\"));\n\n        if (statement.size !== 0) return yield* rejected();\n        const authenticatorBytes = yield* decode(byteValue(37, 16384), attestation.get(\"authData\"));\n        const auth = yield* checkAuthenticator(authenticatorBytes, true, profile);\n        const id = yield* decode(byteValue(1, 1023), auth.credentialID);\n        const key = yield* decode(byteValue(1, 8192), auth.credentialPublicKey);\n\n        if (Encoding.encodeBase64Url(id) !== wire.id) return yield* rejected();\n        const algorithm = yield* checkKey(key, profile.algorithms);\n\n        const result = yield* maintained(() =>\n          verifyRegistrationResponse({\n            response: { ...wire, clientExtensionResults: {} },\n            expectedChallenge: ceremony.challenge,\n            expectedOrigin: [...profile.origins],\n            expectedRPID: profile.rpId,\n            expectedType: \"webauthn.create\",\n            requireUserPresence: true,\n            requireUserVerification: profile.userVerification === \"required\",\n            supportedAlgorithmIDs: [...profile.algorithms],\n          }),\n        );\n\n        if (!result.verified || result.registrationInfo === undefined) return yield* rejected();\n        const info = result.registrationInfo;\n\n        if (\n          info.fmt !== \"none\" ||\n          info.origin !== client.origin ||\n          info.rpID !== profile.rpId ||\n          info.credential.id !== wire.id ||\n          !sameBytes(info.credential.publicKey, key) ||\n          info.credential.counter !== auth.counter ||\n          info.userVerified !== auth.flags.uv ||\n          (info.credentialDeviceType === \"multiDevice\") !== auth.flags.be ||\n          info.credentialBackedUp !== auth.flags.bs\n        )\n          return yield* rejected();\n        yield* fresh(ceremony);\n\n        return yield* capture(\n          PasskeyRegistrationVerified,\n          yield* decode(PasskeyRegistrationVerified, {\n            protocolCredentialId: info.credential.id,\n            publicKey: Encoding.encodeBase64Url(info.credential.publicKey),\n            algorithm,\n            counter: info.credential.counter,\n            userVerified: info.userVerified,\n            backupEligible: info.credentialDeviceType === \"multiDevice\",\n            backupState: info.credentialBackedUp,\n          }),\n        );\n      },\n      unexpected,\n    );\n\n    const verifyAuthentication = Effect.fn(\"SimpleWebAuthnPasskeyProtocol.verifyAuthentication\")(\n      function* (input: Input<\"verifyAuthentication\">) {\n        const fixed = yield* capture(authenticationInput, input),\n          ceremony = fixed.ceremony,\n          credential = fixed.credential;\n\n        const profile = yield* select(ceremony.profile),\n          original = yield* select(credential.profile);\n\n        const contexts = {\n          \"sign-in\": \"SignIn\",\n          pending: \"Pending\",\n          \"step-up\": \"StepUp\",\n          action: \"Action\",\n        } as const;\n\n        if (\n          ceremony.purpose === \"registration\" ||\n          ceremony.purpose === \"enrollment\" ||\n          contexts[ceremony.purpose] !== ceremony.context._tag ||\n          !credential.active ||\n          credential.rpId !== profile.rpId ||\n          original.rpId !== profile.rpId ||\n          !original.algorithms.includes(credential.algorithm) ||\n          !profile.algorithms.includes(credential.algorithm)\n        )\n          return yield* rejected();\n        yield* fresh(ceremony);\n\n        const wire = yield* decode(\n          Schema.fromJsonString(authenticationResponse),\n          Redacted.value(fixed.response),\n        );\n\n        const userHandle = wire.response.userHandle ?? undefined;\n\n        if (\n          wire.id !== wire.rawId ||\n          wire.id !== credential.protocolCredentialId ||\n          (userHandle !== undefined && userHandle !== credential.userHandle) ||\n          (ceremony.context._tag === \"SignIn\" && userHandle === undefined) ||\n          (ceremony.allowedCredentials.length > 0 &&\n            !ceremony.allowedCredentials.some((value) => value.id === wire.id))\n        )\n          return yield* rejected();\n        const client = yield* checkClient(wire.response.clientDataJSON, ceremony, \"webauthn.get\");\n\n        const auth = yield* checkAuthenticator(\n          yield* bytes(wire.response.authenticatorData),\n          false,\n          profile,\n        );\n\n        if (\n          auth.flags.be !== credential.backupEligible ||\n          (!credential.backupEligible &&\n            (credential.counter > 0 || auth.counter > 0) &&\n            auth.counter <= credential.counter)\n        )\n          return yield* rejected();\n        const publicKey = yield* bytes(credential.publicKey);\n\n        yield* checkKey(publicKey, profile.algorithms, credential.algorithm);\n\n        const result = yield* maintained(() =>\n          verifyAuthenticationResponse({\n            response: {\n              ...wire,\n              response: { ...wire.response, userHandle },\n              clientExtensionResults: {},\n            },\n            expectedChallenge: ceremony.challenge,\n            expectedOrigin: [...profile.origins],\n            expectedRPID: profile.rpId,\n            expectedType: \"webauthn.get\",\n            requireUserVerification: profile.userVerification === \"required\",\n            credential: {\n              id: credential.protocolCredentialId,\n              publicKey,\n              counter: credential.backupEligible ? 0 : credential.counter,\n            },\n          }),\n        );\n\n        if (!result.verified) return yield* rejected();\n        const info = result.authenticationInfo;\n\n        if (\n          info.credentialID !== wire.id ||\n          info.origin !== client.origin ||\n          info.rpID !== profile.rpId ||\n          info.newCounter !== auth.counter ||\n          info.userVerified !== auth.flags.uv ||\n          (info.credentialDeviceType === \"multiDevice\") !== credential.backupEligible ||\n          info.credentialBackedUp !== auth.flags.bs\n        )\n          return yield* rejected();\n        yield* fresh(ceremony);\n\n        return yield* capture(\n          PasskeyAssertionVerified,\n          yield* decode(PasskeyAssertionVerified, {\n            protocolCredentialId: info.credentialID,\n            ...(userHandle === undefined ? {} : { userHandle }),\n            counter: info.newCounter,\n            userVerified: info.userVerified,\n            backupEligible: info.credentialDeviceType === \"multiDevice\",\n            backupState: info.credentialBackedUp,\n          }),\n        );\n      },\n      unexpected,\n    );\n\n    return PasskeyProtocol.of({\n      prepareAuthentication,\n      prepareRegistration,\n      verifyRegistration,\n      verifyAuthentication,\n    });\n  },\n);\n\nexport const layerSimpleWebAuthnPasskeyProtocol = (\n  options: SimpleWebAuthnPasskeyProtocolOptions,\n): Layer.Layer<PasskeyProtocol, PasskeyConfigurationError> =>\n  Layer.effect(PasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol(options));\n"],"mappings":";;;;;;;;;;AA2CA,MAAM,iBAAiB,wBAAwB,KAAK,CAAC,CAAC;AACtD,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AAEpD,MAAM,cAAuB,WAC3B,OAAO,KACL,OAAO,YAAY,UACjB,MAAM,QAAQ,KAAK,IACf,kBAAkB,oBAAoB,KAAK,CAAC,CAAC,KAC3C,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,CAC3C,IACA,OAAO,UAAU,KAAK,CAC5B,CACF;AAEF,MAAM,cAAiB,SACrB,OAAO,WAAW,IAAI,CAAC,CAAC,KACtB,OAAO,SAAS,UAAU,kBAAkB,oBAAoB,KAAK,CAAC,GACtE,OAAO,SAAS,WAAW,CAC7B;AAEF,MAAM,UAAa,SAAkB,OAAO,IAAI;CAAE,KAAK;CAAM,OAAO;AAAS,CAAC;AAE9E,MAAM,UACJ,QACA,UAIA,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,CAAC;AAE1E,MAAM,WACJ,QACA,UACG,gBAAgB,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,QAAQ,CAAC;AAElE,MAAM,aAAa,MAAkB,UACnC,KAAK,WAAW,MAAM,UAAU,KAAK,OAAO,MAAM,UAAU,SAAS,MAAM,MAAM;AAEnF,MAAM,UAAU,SAAiB,YAC/B,OAAO,OAAO,MACZ,OAAO,YAAY,KAAK,KAAM,UAAU,IAAK,CAAC,CAAC,GAC/C,OAAO,YAAY,UAAU;CAC3B,MAAM,SAAS,SAAS,gBAAgB,KAAK;CAE7C,OACE,OAAO,SAAS,aAChB,OAAO,QAAQ,UAAU,WACzB,OAAO,QAAQ,UAAU,WACzB,SAAS,gBAAgB,OAAO,OAAO,MAAM;AAEjD,CAAC,CACH;AAEF,MAAM,QAAQ,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAe;CACvE,MAAM,SAAS,SAAS,gBAAgB,KAAK;CAE7C,IAAI,OAAO,SAAS,WAAW,OAAO,OAAO,SAAS;CAEtD,OAAO,IAAI,WAAW,OAAO,OAAO;AACtC,CAAC;AAED,MAAM,WAAW,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAO,CAAC,CAAC;AAEnF,MAAM,6BAA6B,OAAO,OAAO;CAC/C,SAAS;CACT,WAAW;CACX,eAAe;CACf,oBAAoB,OAAO,MAAM,iBAAiB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,2BAA2B,OAAO,OAAO;CAC7C,SAAS;CACT,WAAW;CACX,eAAe;CACf,YAAY;CACZ,MAAM;CACN,aAAa;CACb,qBAAqB,OAAO,MAAM,iBAAiB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU;CACV,YAAY;CACZ,UAAU;AACZ,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU;CACV,UAAU;AACZ,CAAC;AAED,MAAM,WAAW;CACf,IAAI;CACJ,OAAO;CACP,MAAM,OAAO,QAAQ,YAAY;AACnC;AAEA,MAAM,yBAAyB,OAAO,OAAO;CAC3C,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,gBAAgB,OAAO,GAAG,IAAI;EAC9B,mBAAmB,OAAO,IAAI,KAAK;EACnC,WAAW,OAAO,GAAG,IAAI;EACzB,YAAY,OAAO,YAAY,OAAO,OAAO,iBAAiB,CAAC;CACjE,CAAC;AACH,CAAC;AAED,MAAM,uBAAuB,OAAO,OAAO;CACzC,GAAG;CACH,UAAU,OAAO,OAAO;EAAE,gBAAgB,OAAO,GAAG,IAAI;EAAG,mBAAmB,OAAO,GAAG,KAAK;CAAE,CAAC;AAClG,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,MAAM,OAAO;CACb,WAAW;CACX,QAAQ,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;CACpD,aAAa,OAAO,YAAY,OAAO,OAAO;CAC9C,WAAW,OAAO,YAAY,OAAO,OAAO;AAC9C,CAAC;AAWD,MAAM,WAAW,OAAO,MAAM;CAC5B,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;CAC5C,OAAO,OAAO,MAAM,OAAO,SAAS,CAAC;CACrC,OAAO;CACP,OAAO;CACP,OAAO,WAAW,MAAM,OAAO,YAAY,UAAU,MAAM,UAAU,KAAK,CAAC;AAC7E,CAAC;AAED,MAAM,aAAa,UAA0C;CAC3D,IAAI,UAAU,GAAG,OAAO;CACxB,MAAM,QAAQ,UAAU,QAAQ,CAAC;CAEjC,OAAO,OAAO,MAAM;EAClB;EACA,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;EAChD,OAAO,YACL,OAAO,MAAM,CAAC,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,GACvE,KACF,CAAC,CAAC,MAAM,OAAO,YAAY,UAAU,MAAM,QAAQ,EAAE,CAAC;CACxD,CAAC;AACH;AAEA,MAAM,UAAU,OAAO,YACrB,OAAO,MAAM,CAAC,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,GACvE,UAAU,CAAC,CACb,CAAC,CAAC,MAAM,OAAO,YAAY,UAAU,MAAM,QAAQ,EAAE,CAAC;AAEtD,MAAM,cAAc,UAAoB;CAGtC,OAAO,QAAQ,OAAO,KAA6C;AACrE;AAEA,MAAM,WAAW,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAmB,OAAgB;CACjG,MAAM,SAAS,OAAO,OAAO,SAAS,KAAK;CAC3C,MAAM,UAAU,OAAO,aAAa,WAAW,MAAM,CAAC;CAEtD,IAAI,CAAC,UAAU,OAAO,OAAO,GAAG,OAAO,OAAO,SAAS;CAEvD,OAAO;AACT,CAAC;AAED,MAAM,aAAa,SAAiB,YAClC,OAAO,WAAW,MAChB,OAAO,YAAY,UAAU,MAAM,UAAU,WAAW,MAAM,UAAU,OAAO,CACjF;AAEF,MAAM,QAAQ,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,UAA2B;CACnF,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,IACE,SAAS,iBAAiB,OAC1B,OAAO,SAAS,mBAChB,OAAO,SAAS,iCAChB,SAAS,mBAAmB,SAAS,gBAErC,OAAO,OAAO,SAAS;AAC3B,CAAC;AAED,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,OACA,UACA,MACA;CACA,MAAM,SAAS,OAAO,OAAO,YAAY,OAAO,aAAa,qBAAqB,KAAK,CAAC,CAAC;CAEzF,IACE,OAAO,SAAS,QAChB,OAAO,cAAc,SAAS,aAC9B,CAAC,SAAS,QAAQ,QAAQ,SAAS,OAAO,MAAM,KAChD,OAAO,gBAAgB,QACvB,eAAe,QAEf,OAAO,OAAO,SAAS;CAEzB,OAAO;AACT,CAAC;AAED,MAAM,qBAAqB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACtE,UACA,cACA,SACA;CACA,IACE,SAAS,SAAS,MAClB,SAAS,SAAS,SAClB,QAAQ,SAAS,MAAO,EAAE,MAAM,cAEhC,OAAO,OAAO,SAAS;CACzB,IAAI,SAAS;CAEb,IAAI,cAAc;EAChB,IAAI,SAAS,SAAS,IAAI,OAAO,OAAO,SAAS;EAEjD,MAAM,SAAS,IAAI,SACjB,SAAS,QACT,SAAS,YACT,SAAS,UACX,CAAC,CAAC,UAAU,IAAI,KAAK;EAErB,IAAI,SAAS,KAAK,SAAS,QAAQ,SAAS,SAAS,KAAK,QAAQ,OAAO,OAAO,SAAS;EACzF,SAAS,KAAK;CAChB;CACA,MAAM,SAAS,OAAO,aAAa,uBAAuB,IAAI,WAAW,QAAQ,CAAC,CAAC;CAEnF,IACE,CAAC,OAAO,MAAM,MACb,QAAQ,qBAAqB,cAAc,CAAC,OAAO,MAAM,MACzD,OAAO,MAAM,MAAM,CAAC,OAAO,MAAM,MAClC,OAAO,MAAM,OAAO,gBACpB,OAAO,MAAM,aAAa,SAAS,KAEnC,OAAO,OAAO,SAAS;CACzB,OAAO,OAAO,gBAAgB,OAAO,OAAO;CAC5C,MAAM,SAAuB,CAAC,SAAS,MAAM,GAAG,MAAM,CAAC;CAEvD,IAAI,cAAc;EAChB,MAAM,KAAK,OAAO,OAAO,UAAU,GAAG,IAAI,GAAG,OAAO,YAAY;EAChE,MAAM,MAAM,OAAO,OAAO,UAAU,GAAG,IAAI,GAAG,OAAO,mBAAmB;EAExE,IAAI,CAAC,UAAU,IAAI,SAAS,MAAM,IAAI,MAAM,CAAC,GAAG,OAAO,OAAO,SAAS;EACvE,OAAO,KAAK,GAAG;CACjB;CACA,IAAI,OAAO,MAAM,IAAI;EACnB,MAAM,YAAY,OAAO,OAAO,UAAU,GAAG,KAAK,GAAG,OAAO,oBAAoB;EAEhF,OAAO,SACL,WACA,OAAO,aAAa,QAAQ,YAAqB,IAAI,WAAW,SAAS,CAAC,CAAC,CAC7E;EACA,OAAO,KAAK,SAAS;CACvB,OAAO,IAAI,OAAO,yBAAyB,KAAA,GAAW,OAAO,OAAO,SAAS;CAG7E,IAFe,OAAO,QAAQ,KAAK,UAAU,MAAM,MAAM,QAAQ,CAExD,MAAM,SAAS,QAAQ,OAAO,OAAO,SAAS;CACvD,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,CAAC,UAAU,OAAO,SAAS,MAAM,QAAQ,SAAS,MAAM,MAAM,CAAC,GAAG,OAAO,OAAO,SAAS;EAC7F,UAAU,MAAM;CAClB;CAEA,MAAM,SAAS,IAAI,WACjB,OAAO,iBACL,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,IAAI,CAAC,CACnF,CACF;CAEA,IAAI,CAAC,UAAU,QAAQ,SAAS,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,OAAO,SAAS;CAEtE,OAAO;AACT,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,OACA,SACA,UACA;CACA,MAAM,MAAM,OAAO,SACjB,OACA,OAAO,aAAa,0BAA0B,IAAI,WAAW,KAAK,CAAC,CAAC,CACtE;CAEA,MAAM,cAAc,OAAO,OAAO,OAAO,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;CAEzE,IAAI,CAAC,QAAQ,SAAS,WAAW,KAAM,aAAa,KAAA,KAAa,gBAAgB,UAC/E,OAAO,OAAO,SAAS;CACzB,IAAI;CACJ,IAAI;CAEJ,IAAI,gBAAgB,IAAI;EACtB,IACE,IAAI,SAAS,KACb,CAAC;GAAC;GAAG;GAAG;GAAI;GAAI;EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,IAAI,GAAG,CAAC,KAC/C,IAAI,IAAI,CAAC,MAAM,KACf,IAAI,IAAI,EAAE,MAAM,GAEhB,OAAO,OAAO,SAAS;EACzB,MAAM,IAAI,OAAO,OAAO,UAAU,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;EACtD,MAAM,IAAI,OAAO,OAAO,UAAU,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;EAEtD,MAAM;GACJ,KAAK;GACL,KAAK;GACL,GAAG,SAAS,gBAAgB,CAAC;GAC7B,GAAG,SAAS,gBAAgB,CAAC;GAC7B,KAAK;EACP;EACA,YAAY;GAAE,MAAM;GAAS,YAAY;EAAQ;CACnD,OAAO;EACL,IAAI,IAAI,SAAS,KAAK,CAAC;GAAC;GAAG;GAAG;GAAI;EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,GACnF,OAAO,OAAO,SAAS;EACzB,MAAM,IAAI,OAAO,OAAO,UAAU,KAAK,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;EACxD,MAAM,IAAI,OAAO,OAAO,UAAU,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;EACpD,MAAM,WAAW,EAAE,QAAQ,OAAO,SAAS,QAAQ,MAAM,MAAM,CAAC;EAEhE,IACE,EAAE,KAAM,QACP,EAAE,EAAE,SAAS,KAAM,OAAO,KAC3B,EAAE,OAAO,KACT,WAAW,KACX,WAAW,MAAM,GAEjB,OAAO,OAAO,SAAS;EACzB,MAAM;GACJ,KAAK;GACL,KAAK;GACL,GAAG,SAAS,gBAAgB,CAAC;GAC7B,GAAG,SAAS,gBAAgB,CAAC;GAC7B,KAAK;EACP;EACA,YAAY;GAAE,MAAM;GAAqB,MAAM;EAAU;CAC3D;CACA,OAAO,iBACL,WAAW,OAAO,OAAO,UAAU,OAAO,KAAK,WAAW,OAAO,CAAC,QAAQ,CAAC,CAC7E;CAEA,OAAO;AACT,CAAC;AAED,MAAa,oCAAoC,OAAO,GAAG,mCAAmC,CAAC,CAC7F,WACE,SACuD;CACvD,MAAM,SAAS,OAAO,8BAA8B,OAAO;CAE3D,MAAM,wBAAwB,OAAO,GAAG,qDAAqD,CAAC,CAC5F,WAAW,OAAuC;EAChD,MAAM,QAAQ,OAAO,QAAQ,4BAA4B,KAAK;EAC9D,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO;EAC3C,MAAM,YAAY,OAAO,MAAM,MAAM,SAAS;EAE9C,MAAM,SAAS,OAAO,iBACpB,8BAA8B;GAC5B,MAAM,QAAQ;GACd;GACA,SAAS,MAAM;GACf,kBAAkB,QAAQ;GAC1B,kBAAkB,MAAM,mBAAmB,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;EAC1E,CAAC,CACH;EAEA,MAAM,QAAQ,OAAO,OAAO,8BAA8B;GACxD,WAAW,OAAO;GAClB,MAAM,OAAO;GACb,SAAS,OAAO;GAChB,kBAAkB,OAAO;GACzB,kBAAkB,OAAO,oBAAoB,CAAC;EAChD,CAAC;EAED,IACE,EAAE,OAAO,YAAY,8BAA8B,OAAO;GACxD,WAAW,MAAM;GACjB,MAAM,QAAQ;GACd,SAAS,MAAM;GACf,kBAAkB,QAAQ;GAC1B,kBAAkB,MAAM;EAC1B,CAAC,IAED,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,QAAQ,8BAA8B,KAAK;CAC3D,GACA,UACF;CAEA,MAAM,sBAAsB,OAAO,GAAG,mDAAmD,CAAC,CACxF,WAAW,OAAqC;EAC9C,MAAM,QAAQ,OAAO,QAAQ,0BAA0B,KAAK;EAC5D,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO;EAE3C,MAAM,YAAY,OAAO,MAAM,MAAM,SAAS,GAC5C,SAAS,OAAO,MAAM,MAAM,UAAU;EAExC,MAAM,SAAS,OAAO,iBACpB,4BAA4B;GAC1B,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,UAAU,MAAM;GAChB,iBAAiB,MAAM;GACvB;GACA;GACA,SAAS,MAAM;GACf,iBAAiB;GACjB,uBAAuB,CAAC,GAAG,QAAQ,UAAU;GAC7C,wBAAwB;IACtB,aAAa,QAAQ;IACrB,kBAAkB,QAAQ;GAC5B;GACA,oBAAoB,MAAM,oBAAoB,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;EAC7E,CAAC,CACH;EAEA,MAAM,QAAQ,OAAO,OAAO,4BAA4B;GACtD,WAAW,OAAO;GAClB,IAAI,OAAO;GACX,MAAM,OAAO;GACb,kBAAkB,OAAO;GACzB,SAAS,OAAO;GAChB,aAAa,OAAO;GACpB,wBAAwB,OAAO;GAC/B,oBAAoB,OAAO,sBAAsB,CAAC;EACpD,CAAC;EAED,MAAM,WAAW;GACf,WAAW,MAAM;GACjB,IAAI;IAAE,IAAI,QAAQ;IAAM,MAAM,QAAQ;GAAO;GAC7C,MAAM;IAAE,IAAI,MAAM;IAAY,MAAM,MAAM;IAAM,aAAa,MAAM;GAAY;GAC/E,kBAAkB,QAAQ,WAAW,KAAK,SAAS;IAAE,MAAM;IAAc;GAAI,EAAE;GAC/E,SAAS,MAAM;GACf,aAAa;GACb,wBAAwB;IACtB,aAAa,QAAQ;IACrB,kBAAkB,QAAQ;GAC5B;GACA,oBAAoB,MAAM;EAC5B;EAEA,IACE,EAAE,OAAO,YACP,4BACA,OACA,OAAO,OAAO,4BAA4B,QAAQ,CACpD,IAEA,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,QAAQ,4BAA4B,KAAK;CACzD,GACA,UACF;CAEA,MAAM,qBAAqB,OAAO,GAAG,kDAAkD,CAAC,CACtF,WAAW,OAAoC;EAC7C,MAAM,QAAQ,OAAO,QAAQ,mBAAmB,KAAK,GACnD,WAAW,MAAM;EAEnB,MAAM,UAAU,OAAO,OAAO,SAAS,OAAO;EAE9C,KACG,SAAS,YAAY,kBAAkB,SAAS,QAAQ,SAAS,oBACjE,SAAS,YAAY,gBAAgB,SAAS,QAAQ,SAAS,eAEhE,OAAO,OAAO,SAAS;EACzB,OAAO,MAAM,QAAQ;EAErB,MAAM,OAAO,OAAO,OAClB,OAAO,eAAe,oBAAoB,GAC1C,SAAS,MAAM,MAAM,QAAQ,CAC/B;EAEA,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO,OAAO,SAAS;EAEnD,MAAM,SAAS,OAAO,YACpB,KAAK,SAAS,gBACd,UACA,iBACF;EAEA,MAAM,mBAAmB,OAAO,MAAM,KAAK,SAAS,iBAAiB;EAErE,MAAM,cAAc,OAAO,SACzB,kBACA,OAAO,aAAa,wBAAwB,IAAI,WAAW,gBAAgB,CAAC,CAAC,CAC/E;EAEA,IACE,YAAY,SAAS,KACrB,YAAY,IAAI,KAAK,MAAM,UAC3B,CAAC,YAAY,IAAI,SAAS,KAC1B,CAAC,YAAY,IAAI,UAAU,GAE3B,OAAO,OAAO,SAAS;EAGzB,KAAI,OAFqB,OAAO,SAAS,YAAY,IAAI,SAAS,CAAC,EAAA,CAErD,SAAS,GAAG,OAAO,OAAO,SAAS;EACjD,MAAM,qBAAqB,OAAO,OAAO,UAAU,IAAI,KAAK,GAAG,YAAY,IAAI,UAAU,CAAC;EAC1F,MAAM,OAAO,OAAO,mBAAmB,oBAAoB,MAAM,OAAO;EACxE,MAAM,KAAK,OAAO,OAAO,UAAU,GAAG,IAAI,GAAG,KAAK,YAAY;EAC9D,MAAM,MAAM,OAAO,OAAO,UAAU,GAAG,IAAI,GAAG,KAAK,mBAAmB;EAEtE,IAAI,SAAS,gBAAgB,EAAE,MAAM,KAAK,IAAI,OAAO,OAAO,SAAS;EACrE,MAAM,YAAY,OAAO,SAAS,KAAK,QAAQ,UAAU;EAEzD,MAAM,SAAS,OAAO,iBACpB,2BAA2B;GACzB,UAAU;IAAE,GAAG;IAAM,wBAAwB,CAAC;GAAE;GAChD,mBAAmB,SAAS;GAC5B,gBAAgB,CAAC,GAAG,QAAQ,OAAO;GACnC,cAAc,QAAQ;GACtB,cAAc;GACd,qBAAqB;GACrB,yBAAyB,QAAQ,qBAAqB;GACtD,uBAAuB,CAAC,GAAG,QAAQ,UAAU;EAC/C,CAAC,CACH;EAEA,IAAI,CAAC,OAAO,YAAY,OAAO,qBAAqB,KAAA,GAAW,OAAO,OAAO,SAAS;EACtF,MAAM,OAAO,OAAO;EAEpB,IACE,KAAK,QAAQ,UACb,KAAK,WAAW,OAAO,UACvB,KAAK,SAAS,QAAQ,QACtB,KAAK,WAAW,OAAO,KAAK,MAC5B,CAAC,UAAU,KAAK,WAAW,WAAW,GAAG,KACzC,KAAK,WAAW,YAAY,KAAK,WACjC,KAAK,iBAAiB,KAAK,MAAM,MAChC,KAAK,yBAAyB,kBAAmB,KAAK,MAAM,MAC7D,KAAK,uBAAuB,KAAK,MAAM,IAEvC,OAAO,OAAO,SAAS;EACzB,OAAO,MAAM,QAAQ;EAErB,OAAO,OAAO,QACZ,6BACA,OAAO,OAAO,6BAA6B;GACzC,sBAAsB,KAAK,WAAW;GACtC,WAAW,SAAS,gBAAgB,KAAK,WAAW,SAAS;GAC7D;GACA,SAAS,KAAK,WAAW;GACzB,cAAc,KAAK;GACnB,gBAAgB,KAAK,yBAAyB;GAC9C,aAAa,KAAK;EACpB,CAAC,CACH;CACF,GACA,UACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,oDAAoD,CAAC,CAC1F,WAAW,OAAsC;EAC/C,MAAM,QAAQ,OAAO,QAAQ,qBAAqB,KAAK,GACrD,WAAW,MAAM,UACjB,aAAa,MAAM;EAErB,MAAM,UAAU,OAAO,OAAO,SAAS,OAAO,GAC5C,WAAW,OAAO,OAAO,WAAW,OAAO;EAS7C,IACE,SAAS,YAAY,kBACrB,SAAS,YAAY,gBACrB;GATA,WAAW;GACX,SAAS;GACT,WAAW;GACX,QAAQ;EAMD,EAAE,SAAS,aAAa,SAAS,QAAQ,QAChD,CAAC,WAAW,UACZ,WAAW,SAAS,QAAQ,QAC5B,SAAS,SAAS,QAAQ,QAC1B,CAAC,SAAS,WAAW,SAAS,WAAW,SAAS,KAClD,CAAC,QAAQ,WAAW,SAAS,WAAW,SAAS,GAEjD,OAAO,OAAO,SAAS;EACzB,OAAO,MAAM,QAAQ;EAErB,MAAM,OAAO,OAAO,OAClB,OAAO,eAAe,sBAAsB,GAC5C,SAAS,MAAM,MAAM,QAAQ,CAC/B;EAEA,MAAM,aAAa,KAAK,SAAS,cAAc,KAAA;EAE/C,IACE,KAAK,OAAO,KAAK,SACjB,KAAK,OAAO,WAAW,wBACtB,eAAe,KAAA,KAAa,eAAe,WAAW,cACtD,SAAS,QAAQ,SAAS,YAAY,eAAe,KAAA,KACrD,SAAS,mBAAmB,SAAS,KACpC,CAAC,SAAS,mBAAmB,MAAM,UAAU,MAAM,OAAO,KAAK,EAAE,GAEnE,OAAO,OAAO,SAAS;EACzB,MAAM,SAAS,OAAO,YAAY,KAAK,SAAS,gBAAgB,UAAU,cAAc;EAExF,MAAM,OAAO,OAAO,mBAClB,OAAO,MAAM,KAAK,SAAS,iBAAiB,GAC5C,OACA,OACF;EAEA,IACE,KAAK,MAAM,OAAO,WAAW,kBAC5B,CAAC,WAAW,mBACV,WAAW,UAAU,KAAK,KAAK,UAAU,MAC1C,KAAK,WAAW,WAAW,SAE7B,OAAO,OAAO,SAAS;EACzB,MAAM,YAAY,OAAO,MAAM,WAAW,SAAS;EAEnD,OAAO,SAAS,WAAW,QAAQ,YAAY,WAAW,SAAS;EAEnE,MAAM,SAAS,OAAO,iBACpB,6BAA6B;GAC3B,UAAU;IACR,GAAG;IACH,UAAU;KAAE,GAAG,KAAK;KAAU;IAAW;IACzC,wBAAwB,CAAC;GAC3B;GACA,mBAAmB,SAAS;GAC5B,gBAAgB,CAAC,GAAG,QAAQ,OAAO;GACnC,cAAc,QAAQ;GACtB,cAAc;GACd,yBAAyB,QAAQ,qBAAqB;GACtD,YAAY;IACV,IAAI,WAAW;IACf;IACA,SAAS,WAAW,iBAAiB,IAAI,WAAW;GACtD;EACF,CAAC,CACH;EAEA,IAAI,CAAC,OAAO,UAAU,OAAO,OAAO,SAAS;EAC7C,MAAM,OAAO,OAAO;EAEpB,IACE,KAAK,iBAAiB,KAAK,MAC3B,KAAK,WAAW,OAAO,UACvB,KAAK,SAAS,QAAQ,QACtB,KAAK,eAAe,KAAK,WACzB,KAAK,iBAAiB,KAAK,MAAM,MAChC,KAAK,yBAAyB,kBAAmB,WAAW,kBAC7D,KAAK,uBAAuB,KAAK,MAAM,IAEvC,OAAO,OAAO,SAAS;EACzB,OAAO,MAAM,QAAQ;EAErB,OAAO,OAAO,QACZ,0BACA,OAAO,OAAO,0BAA0B;GACtC,sBAAsB,KAAK;GAC3B,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,SAAS,KAAK;GACd,cAAc,KAAK;GACnB,gBAAgB,KAAK,yBAAyB;GAC9C,aAAa,KAAK;EACpB,CAAC,CACH;CACF,GACA,UACF;CAEA,OAAO,gBAAgB,GAAG;EACxB;EACA;EACA;EACA;CACF,CAAC;AACH,CACF;AAEA,MAAa,sCACX,YAEA,MAAM,OAAO,iBAAiB,kCAAkC,OAAO,CAAC"}

package/dist/passkey/snapshot.mjs

@@ -0,0 +1,31 @@
+import { PasskeyUnavailable } from "./errors.mjs";
+import { DateTime, Effect, Predicate, Schema } from "effect";
+//#region src/passkey/snapshot.ts
+const freezePasskey = (value) => {
+	if (!Predicate.isObjectOrArray(value) || Object.isFrozen(value)) return;
+	if (DateTime.isDateTime(value)) Object.freeze(DateTime.toPartsUtc(value));
+	for (const child of Object.values(value)) freezePasskey(child);
+	Object.freeze(value);
+};
+const snapshotPasskeySync = (schema, value) => {
+	try {
+		const codec = Schema.toCodecJson(Schema.toType(schema));
+		const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));
+		freezePasskey(result);
+		return result;
+	} catch {
+		throw PasskeyUnavailable.make({});
+	}
+};
+const snapshotPasskey = (schema, value) => Effect.try({
+	try: () => snapshotPasskeySync(schema, value),
+	catch: () => PasskeyUnavailable.make({})
+});
+const samePasskey = (schema, left, right) => Effect.gen(function* () {
+	const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+	return (yield* Schema.encodeEffect(codec)(left)) === (yield* Schema.encodeEffect(codec)(right));
+}).pipe(Effect.mapError(() => PasskeyUnavailable.make({})));
+//#endregion
+export { freezePasskey, samePasskey, snapshotPasskey, snapshotPasskeySync };
+
+//# sourceMappingURL=snapshot.mjs.map

package/dist/passkey/snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../src/passkey/snapshot.ts"],"sourcesContent":["import { DateTime, Effect, Predicate, Schema } from \"effect\";\n\nimport { PasskeyUnavailable } from \"./errors\";\n\nexport const freezePasskey = (value: unknown): void => {\n  if (!Predicate.isObjectOrArray(value) || Object.isFrozen(value)) return;\n  if (DateTime.isDateTime(value)) Object.freeze(DateTime.toPartsUtc(value));\n  for (const child of Object.values(value)) freezePasskey(child);\n  Object.freeze(value);\n};\n\nexport const snapshotPasskeySync = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n): S[\"Type\"] => {\n  try {\n    const codec = Schema.toCodecJson(Schema.toType(schema));\n    const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));\n\n    freezePasskey(result);\n\n    return result;\n  } catch {\n    throw PasskeyUnavailable.make({});\n  }\n};\n\nexport const snapshotPasskey = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) =>\n  Effect.try({\n    try: () => snapshotPasskeySync(schema, value),\n    catch: () => PasskeyUnavailable.make({}),\n  });\n\nexport const samePasskey = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  left: S[\"Type\"],\n  right: S[\"Type\"],\n) =>\n  Effect.gen(function* () {\n    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n    const a = yield* Schema.encodeEffect(codec)(left);\n    const b = yield* Schema.encodeEffect(codec)(right);\n\n    return a === b;\n  }).pipe(Effect.mapError(() => PasskeyUnavailable.make({})));\n"],"mappings":";;;AAIA,MAAa,iBAAiB,UAAyB;CACrD,IAAI,CAAC,UAAU,gBAAgB,KAAK,KAAK,OAAO,SAAS,KAAK,GAAG;CACjE,IAAI,SAAS,WAAW,KAAK,GAAG,OAAO,OAAO,SAAS,WAAW,KAAK,CAAC;CACxE,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,cAAc,KAAK;CAC7D,OAAO,OAAO,KAAK;AACrB;AAEA,MAAa,uBACX,QACA,UACc;CACd,IAAI;EACF,MAAM,QAAQ,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC;EACtD,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,CAAC;EAEvE,cAAc,MAAM;EAEpB,OAAO;CACT,QAAQ;EACN,MAAM,mBAAmB,KAAK,CAAC,CAAC;CAClC;AACF;AAEA,MAAa,mBACX,QACA,UAEA,OAAO,IAAI;CACT,WAAW,oBAAoB,QAAQ,KAAK;CAC5C,aAAa,mBAAmB,KAAK,CAAC,CAAC;AACzC,CAAC;AAEH,MAAa,eACX,QACA,MACA,UAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAI7E,QAAO,OAHU,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,QAGnC,OAFI,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK;AAGnD,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC"}

package/dist/passkey/stepUp.mjs

@@ -0,0 +1,101 @@
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { PasskeyFailure, PasskeyMethodUnsupported, PasskeyRejected, PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyAuthenticationStarted, PasskeyBegin, PasskeyComplete, PasskeyTarget } from "./models.mjs";
+import { snapshotPasskey } from "./snapshot.mjs";
+import { makePasskeyCeremony, passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit } from "./actions.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/passkey/stepUp.ts
+const credential = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384)));
+const makePasskeyStepUp = (moduleId, source, sessions) => {
+	const ceremony = makePasskeyCeremony(moduleId, source, "step-up");
+	const BeginInput = Schema.Struct({
+		...PasskeyBegin.fields,
+		stepUpCredential: credential
+	});
+	const CompleteInput = Schema.Struct({
+		...PasskeyComplete.fields,
+		stepUpCredential: credential,
+		sourceCredential: credential
+	});
+	const StepUp = Context.Service(`effect-auth/PasskeyStepUp/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(StepUp, Effect.gen(function* () {
+		const runtime = yield* ceremony.make, stepUp = yield* sessions.SessionStepUp;
+		const services = yield* Effect.context();
+		const target = Effect.fn("PasskeyStepUp.target")(function* (invocation, token) {
+			if (invocation._tag !== "Authenticated") return yield* PasskeyRejected.make({});
+			const context = yield* stepUp.context(token).pipe(Effect.mapError((error) => error._tag === "HookDenied" ? error : error._tag === "SessionUnavailable" ? PasskeyUnavailable.make({}) : error._tag === "SessionCapabilityUnsupported" ? PasskeyMethodUnsupported.make({}) : PasskeyRejected.make({})));
+			if (context.revision.subjectId !== invocation.subjectId) return yield* PasskeyRejected.make({});
+			return yield* snapshotPasskey(PasskeyTarget, {
+				...context,
+				moduleId: sessions.moduleId,
+				kind: "session-step-up",
+				commandId: context.flowId
+			});
+		}, passkeyUnexpected);
+		return StepUp.of({
+			begin: Effect.fn("PasskeyStepUp.begin")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(BeginInput), input);
+				yield* passkeyNoAmbient();
+				const fixed = yield* target(invocation, input.stepUpCredential), captured = yield* runtime.exclusions(input.profileId, fixed.revision.subjectId).pipe(Effect.provide(services));
+				return yield* runtime.beginAuthentication(input, {
+					_tag: "StepUp",
+					target: fixed
+				}, captured.credentials);
+			}, passkeyUnexpected),
+			complete: Effect.fn("PasskeyStepUp.complete")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);
+				yield* passkeyNoAmbient();
+				const fixed = yield* target(invocation, input.stepUpCredential);
+				const verified = yield* runtime.authentication(input, {
+					_tag: "StepUp",
+					target: fixed
+				}).pipe(Effect.provide(services), Effect.catchTag("PasskeyRejected", () => Effect.gen(function* () {
+					yield* readPasskeyCommit(yield* stepUp.rejectCredential(input.stepUpCredential).pipe(Effect.mapError(() => PasskeyUnavailable.make({}))));
+					return yield* PasskeyRejected.make({});
+				})));
+				const result = yield* readPasskeyCommit(yield* stepUp.prepareComplete({
+					sourceCredential: input.sourceCredential,
+					stepUpCredential: input.stepUpCredential,
+					additional: verified.evidence
+				}).pipe(Effect.mapError((error) => error._tag === "HookDenied" ? error : error._tag === "SessionUnavailable" ? PasskeyUnavailable.make({}) : error._tag === "SessionCapabilityUnsupported" ? PasskeyMethodUnsupported.make({}) : PasskeyRejected.make({}))));
+				return {
+					value: result.value,
+					credentialCommands: [...verified.credentialCommands, ...result.credentialCommands]
+				};
+			}, passkeyUnexpected)
+		});
+	}));
+	const Begin = makeOperation(`${moduleId}/passkey/step-up/begin`, {
+		payload: BeginInput,
+		success: PasskeyAuthenticationStarted,
+		error: PasskeyFailure,
+		exposure: "public",
+		access: "authenticated",
+		replay: "single-use",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/passkey/step-up/complete`, {
+		payload: CompleteInput,
+		success: sessions.Session,
+		error: PasskeyFailure,
+		exposure: "public",
+		access: "authenticated",
+		replay: "single-use",
+		credentials: true
+	});
+	return Object.freeze({
+		StepUp,
+		binding: ceremony.binding,
+		layer,
+		operations: Object.freeze({
+			Begin,
+			Complete
+		}),
+		group: operationGroup(Begin, Complete),
+		handlersLayer: Layer.mergeAll(Begin.credentialHandlerLayer((input, invocation) => Effect.flatMap(StepUp, (service) => service.begin(invocation, input))), Complete.credentialHandlerLayer((input, invocation) => Effect.flatMap(StepUp, (service) => service.complete(invocation, input))))
+	});
+};
+//#endregion
+export { makePasskeyStepUp };
+
+//# sourceMappingURL=stepUp.mjs.map

package/dist/passkey/stepUp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepUp.mjs","names":[],"sources":["../../src/passkey/stepUp.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema, type Types } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport type { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport {\n  passkeyUnexpected,\n  makePasskeyCeremony,\n  passkeyNoAmbient,\n  readPasskeyCommit,\n} from \"./actions\";\nimport type { PasskeyConfigurationError } from \"./errors\";\nimport {\n  PasskeyFailure,\n  PasskeyMethodUnsupported,\n  PasskeyRejected,\n  PasskeyUnavailable,\n} from \"./errors\";\nimport {\n  PasskeyAuthenticationStarted,\n  PasskeyBegin,\n  PasskeyComplete,\n  PasskeyTarget,\n} from \"./models\";\nimport type { PasskeyCredentials } from \"./PasskeyCredentials\";\nimport type { PasskeyEnrollmentContext } from \"./PasskeyEnrollmentContext\";\nimport type { PasskeyMethodPolicy } from \"./policy\";\nimport { snapshotPasskey } from \"./snapshot\";\nconst credential = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384)));\n\nexport const makePasskeyStepUp = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,\n  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,\n) => {\n  const ceremony = makePasskeyCeremony(moduleId, source, \"step-up\");\n  const BeginInput = Schema.Struct({ ...PasskeyBegin.fields, stepUpCredential: credential });\n\n  const CompleteInput = Schema.Struct({\n    ...PasskeyComplete.fields,\n    stepUpCredential: credential,\n    sourceCredential: credential,\n  });\n\n  const StepUp = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"passkey-step-up\";\n      readonly claims: Types.Invariant<Claims[\"Type\"]>;\n    },\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof BeginInput.Type,\n      ) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: typeof CompleteInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof sessions.Session.Type>, PasskeyFailure>;\n    }\n  >(`effect-auth/PasskeyStepUp/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(\n    StepUp,\n    Effect.gen(function* () {\n      const runtime = yield* ceremony.make,\n        stepUp = yield* sessions.SessionStepUp;\n\n      const services = yield* Effect.context<\n        PasskeyCredentials | PasskeyEnrollmentContext | AuthenticationAuthority\n      >();\n\n      const target = Effect.fn(\"PasskeyStepUp.target\")(function* (\n        invocation: AuthInvocation,\n        token: typeof credential.Type,\n      ) {\n        if (invocation._tag !== \"Authenticated\") return yield* PasskeyRejected.make({});\n\n        const context = yield* stepUp\n          .context(token)\n          .pipe(\n            Effect.mapError((error) =>\n              error._tag === \"HookDenied\"\n                ? error\n                : error._tag === \"SessionUnavailable\"\n                  ? PasskeyUnavailable.make({})\n                  : error._tag === \"SessionCapabilityUnsupported\"\n                    ? PasskeyMethodUnsupported.make({})\n                    : PasskeyRejected.make({}),\n            ),\n          );\n\n        if (context.revision.subjectId !== invocation.subjectId)\n          return yield* PasskeyRejected.make({});\n\n        return yield* snapshotPasskey(PasskeyTarget, {\n          ...context,\n          moduleId: sessions.moduleId,\n          kind: \"session-step-up\",\n          commandId: context.flowId,\n        });\n      }, passkeyUnexpected);\n\n      return StepUp.of({\n        begin: Effect.fn(\"PasskeyStepUp.begin\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(BeginInput), input);\n          yield* passkeyNoAmbient();\n\n          const fixed = yield* target(invocation, input.stepUpCredential),\n            captured = yield* runtime\n              .exclusions(input.profileId, fixed.revision.subjectId)\n              .pipe(Effect.provide(services));\n\n          return yield* runtime.beginAuthentication(\n            input,\n            { _tag: \"StepUp\", target: fixed },\n            captured.credentials,\n          );\n        }, passkeyUnexpected),\n        complete: Effect.fn(\"PasskeyStepUp.complete\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);\n          yield* passkeyNoAmbient();\n          const fixed = yield* target(invocation, input.stepUpCredential);\n\n          const verified = yield* runtime\n            .authentication(input, { _tag: \"StepUp\", target: fixed })\n            .pipe(\n              Effect.provide(services),\n              Effect.catchTag(\"PasskeyRejected\", () =>\n                Effect.gen(function* () {\n                  yield* readPasskeyCommit(\n                    yield* stepUp\n                      .rejectCredential(input.stepUpCredential)\n                      .pipe(Effect.mapError(() => PasskeyUnavailable.make({}))),\n                  );\n\n                  return yield* PasskeyRejected.make({});\n                }),\n              ),\n            );\n\n          const result = yield* readPasskeyCommit(\n            yield* stepUp\n              .prepareComplete({\n                sourceCredential: input.sourceCredential,\n                stepUpCredential: input.stepUpCredential,\n                additional: verified.evidence,\n              })\n              .pipe(\n                Effect.mapError((error) =>\n                  error._tag === \"HookDenied\"\n                    ? error\n                    : error._tag === \"SessionUnavailable\"\n                      ? PasskeyUnavailable.make({})\n                      : error._tag === \"SessionCapabilityUnsupported\"\n                        ? PasskeyMethodUnsupported.make({})\n                        : PasskeyRejected.make({}),\n                ),\n              ),\n          );\n\n          return {\n            value: result.value,\n            credentialCommands: [...verified.credentialCommands, ...result.credentialCommands],\n          };\n        }, passkeyUnexpected),\n      });\n    }),\n  );\n\n  const Begin = makeOperation(`${moduleId}/passkey/step-up/begin`, {\n    payload: BeginInput,\n    success: PasskeyAuthenticationStarted,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/passkey/step-up/complete`, {\n    payload: CompleteInput,\n    success: sessions.Session,\n    error: PasskeyFailure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  return Object.freeze({\n    StepUp,\n    binding: ceremony.binding,\n    layer,\n    operations: Object.freeze({ Begin, Complete }),\n    group: operationGroup(Begin, Complete),\n    handlersLayer: Layer.mergeAll(\n      Begin.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(StepUp, (service) => service.begin(invocation, input)),\n      ),\n      Complete.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(StepUp, (service) => service.complete(invocation, input)),\n      ),\n    ),\n  });\n};\n"],"mappings":";;;;;;;AA8BA,MAAM,aAAa,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAElG,MAAa,qBAKX,UACA,QACA,aACG;CACH,MAAM,WAAW,oBAAoB,UAAU,QAAQ,SAAS;CAChE,MAAM,aAAa,OAAO,OAAO;EAAE,GAAG,aAAa;EAAQ,kBAAkB;CAAW,CAAC;CAEzF,MAAM,gBAAgB,OAAO,OAAO;EAClC,GAAG,gBAAgB;EACnB,kBAAkB;EAClB,kBAAkB;CACpB,CAAC;CAED,MAAM,SAAS,QAAQ,QAgBrB,6BAA6B,SAAS,OAAO,GAAG,UAAU;CAE5D,MAAM,QAAQ,MAAM,OAClB,QACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,SAAS,MAC9B,SAAS,OAAO,SAAS;EAE3B,MAAM,WAAW,OAAO,OAAO,QAE7B;EAEF,MAAM,SAAS,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC/C,YACA,OACA;GACA,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GAE9E,MAAM,UAAU,OAAO,OACpB,QAAQ,KAAK,CAAC,CACd,KACC,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,mBAAmB,KAAK,CAAC,CAAC,IAC1B,MAAM,SAAS,iCACb,yBAAyB,KAAK,CAAC,CAAC,IAChC,gBAAgB,KAAK,CAAC,CAAC,CACjC,CACF;GAEF,IAAI,QAAQ,SAAS,cAAc,WAAW,WAC5C,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GAEvC,OAAO,OAAO,gBAAgB,eAAe;IAC3C,GAAG;IACH,UAAU,SAAS;IACnB,MAAM;IACN,WAAW,QAAQ;GACrB,CAAC;EACH,GAAG,iBAAiB;EAEpB,OAAO,OAAO,GAAG;GACf,OAAO,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,YAAY,OAAO;IACpE,QAAQ,OAAO,gBAAgB,OAAO,OAAO,UAAU,GAAG,KAAK;IAC/D,OAAO,iBAAiB;IAExB,MAAM,QAAQ,OAAO,OAAO,YAAY,MAAM,gBAAgB,GAC5D,WAAW,OAAO,QACf,WAAW,MAAM,WAAW,MAAM,SAAS,SAAS,CAAC,CACrD,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAElC,OAAO,OAAO,QAAQ,oBACpB,OACA;KAAE,MAAM;KAAU,QAAQ;IAAM,GAChC,SAAS,WACX;GACF,GAAG,iBAAiB;GACpB,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,YAAY,OAAO;IAC1E,QAAQ,OAAO,gBAAgB,OAAO,OAAO,aAAa,GAAG,KAAK;IAClE,OAAO,iBAAiB;IACxB,MAAM,QAAQ,OAAO,OAAO,YAAY,MAAM,gBAAgB;IAE9D,MAAM,WAAW,OAAO,QACrB,eAAe,OAAO;KAAE,MAAM;KAAU,QAAQ;IAAM,CAAC,CAAC,CACxD,KACC,OAAO,QAAQ,QAAQ,GACvB,OAAO,SAAS,yBACd,OAAO,IAAI,aAAa;KACtB,OAAO,kBACL,OAAO,OACJ,iBAAiB,MAAM,gBAAgB,CAAC,CACxC,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAC5D;KAEA,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACvC,CAAC,CACH,CACF;IAEF,MAAM,SAAS,OAAO,kBACpB,OAAO,OACJ,gBAAgB;KACf,kBAAkB,MAAM;KACxB,kBAAkB,MAAM;KACxB,YAAY,SAAS;IACvB,CAAC,CAAC,CACD,KACC,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,mBAAmB,KAAK,CAAC,CAAC,IAC1B,MAAM,SAAS,iCACb,yBAAyB,KAAK,CAAC,CAAC,IAChC,gBAAgB,KAAK,CAAC,CAAC,CACjC,CACF,CACJ;IAEA,OAAO;KACL,OAAO,OAAO;KACd,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,GAAG,OAAO,kBAAkB;IACnF;GACF,GAAG,iBAAiB;EACtB,CAAC;CACH,CAAC,CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,yBAAyB;EAC/D,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,4BAA4B;EACrE,SAAS;EACT,SAAS,SAAS;EAClB,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,SAAS;EAClB;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;EAAS,CAAC;EAC7C,OAAO,eAAe,OAAO,QAAQ;EACrC,eAAe,MAAM,SACnB,MAAM,wBAAwB,OAAO,eACnC,OAAO,QAAQ,SAAS,YAAY,QAAQ,MAAM,YAAY,KAAK,CAAC,CACtE,GACA,SAAS,wBAAwB,OAAO,eACtC,OAAO,QAAQ,SAAS,YAAY,QAAQ,SAAS,YAAY,KAAK,CAAC,CACzE,CACF;CACF,CAAC;AACH"}

package/dist/password/CompromisedPasswords.d.mts

@@ -0,0 +1,26 @@
+import { PasswordCheckUnavailable } from "./errors.mjs";
+import { Context, Effect, Redacted, Schema } from "effect";
+//#region src/password/CompromisedPasswords.d.ts
+/** Request-specific local screening hints. Never log these or implicitly send
+ * them to a remote breached-password service. Context is not authorization.
+ */
+declare const PasswordScreeningContext: Schema.Struct<{
+  readonly accountName: Schema.optionalKey<Schema.String>;
+  readonly serviceName: Schema.optionalKey<Schema.String>;
+}>;
+type PasswordScreeningContext = typeof PasswordScreeningContext.Type;
+declare const PasswordScreening: Schema.Union<readonly [Schema.TaggedStruct<"Allowed", {}>, Schema.TaggedStruct<"Rejected", {
+  readonly reason: Schema.Literals<readonly ["compromised", "common", "contextual"]>;
+}>]>;
+type PasswordScreening = typeof PasswordScreening.Type;
+declare const CompromisedPasswords_base: Context.ServiceClass<CompromisedPasswords, "effect-auth/CompromisedPasswords", {
+  readonly check: (password: Redacted.Redacted<string>, context: PasswordScreeningContext) => Effect.Effect<PasswordScreening, PasswordCheckUnavailable>;
+}>;
+/** Required consumer capability for new passwords. No implicit network call or
+ * permissive default. Remote adapters must explicitly document any disclosure.
+ * A common/compromised corpus and contextual rules belong to this capability.
+ */
+declare class CompromisedPasswords extends CompromisedPasswords_base {}
+//#endregion
+export { CompromisedPasswords, PasswordScreening, PasswordScreeningContext };
+//# sourceMappingURL=CompromisedPasswords.d.mts.map

package/dist/password/CompromisedPasswords.mjs

@@ -0,0 +1,23 @@
+import { Context, Schema } from "effect";
+//#region src/password/CompromisedPasswords.ts
+/** Request-specific local screening hints. Never log these or implicitly send
+* them to a remote breached-password service. Context is not authorization.
+*/
+const PasswordScreeningContext = Schema.Struct({
+	accountName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+	serviceName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256)))
+});
+const PasswordScreening = Schema.Union([Schema.TaggedStruct("Allowed", {}), Schema.TaggedStruct("Rejected", { reason: Schema.Literals([
+	"compromised",
+	"common",
+	"contextual"
+]) })]);
+/** Required consumer capability for new passwords. No implicit network call or
+* permissive default. Remote adapters must explicitly document any disclosure.
+* A common/compromised corpus and contextual rules belong to this capability.
+*/
+var CompromisedPasswords = class extends Context.Service()("effect-auth/CompromisedPasswords") {};
+//#endregion
+export { CompromisedPasswords, PasswordScreening, PasswordScreeningContext };
+
+//# sourceMappingURL=CompromisedPasswords.mjs.map

package/dist/password/CompromisedPasswords.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CompromisedPasswords.mjs","names":[],"sources":["../../src/password/CompromisedPasswords.ts"],"sourcesContent":["import { Context, type Effect, Schema, type Redacted } from \"effect\";\n\nimport type { PasswordCheckUnavailable } from \"./errors\";\n\n/** Request-specific local screening hints. Never log these or implicitly send\n * them to a remote breached-password service. Context is not authorization.\n */\nexport const PasswordScreeningContext = Schema.Struct({\n  accountName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  serviceName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n});\n\nexport type PasswordScreeningContext = typeof PasswordScreeningContext.Type;\n\nexport const PasswordScreening = Schema.Union([\n  Schema.TaggedStruct(\"Allowed\", {}),\n  Schema.TaggedStruct(\"Rejected\", {\n    reason: Schema.Literals([\"compromised\", \"common\", \"contextual\"]),\n  }),\n]);\n\nexport type PasswordScreening = typeof PasswordScreening.Type;\n\n/** Required consumer capability for new passwords. No implicit network call or\n * permissive default. Remote adapters must explicitly document any disclosure.\n * A common/compromised corpus and contextual rules belong to this capability.\n */\nexport class CompromisedPasswords extends Context.Service<\n  CompromisedPasswords,\n  {\n    readonly check: (\n      password: Redacted.Redacted<string>,\n      context: PasswordScreeningContext,\n    ) => Effect.Effect<PasswordScreening, PasswordCheckUnavailable>;\n  }\n>()(\"effect-auth/CompromisedPasswords\") {}\n"],"mappings":";;;;;AAOA,MAAa,2BAA2B,OAAO,OAAO;CACpD,aAAa,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CAC5E,aAAa,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAC9E,CAAC;AAID,MAAa,oBAAoB,OAAO,MAAM,CAC5C,OAAO,aAAa,WAAW,CAAC,CAAC,GACjC,OAAO,aAAa,YAAY,EAC9B,QAAQ,OAAO,SAAS;CAAC;CAAe;CAAU;AAAY,CAAC,EACjE,CAAC,CACH,CAAC;;;;;AAQD,IAAa,uBAAb,cAA0C,QAAQ,QAQhD,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC"}

package/dist/password/NewPasswordCheck.d.mts

@@ -0,0 +1,21 @@
+import { NewPasswordRejected, PasswordCheckUnavailable, PasswordConfigurationError } from "./errors.mjs";
+import { CompromisedPasswords, PasswordScreeningContext } from "./CompromisedPasswords.mjs";
+import { PasswordNormalization, PasswordPolicy } from "./policy.mjs";
+import { Context, Effect, Layer, Redacted } from "effect";
+//#region src/password/NewPasswordCheck.d.ts
+interface CheckedNewPassword {
+  readonly password: Redacted.Redacted<string>;
+  readonly normalization: PasswordNormalization;
+}
+declare const NewPasswordCheck_base: Context.ServiceClass<NewPasswordCheck, "effect-auth/NewPasswordCheck", {
+  readonly check: (password: Redacted.Redacted<string>, context?: PasswordScreeningContext) => Effect.Effect<CheckedNewPassword, NewPasswordRejected | PasswordCheckUnavailable>;
+}>;
+/** Apply only to new credentials. Persist normalization beside the verifier;
+ * login uses that stored mode, while legacy verification/rehash retains none.
+ */
+declare class NewPasswordCheck extends NewPasswordCheck_base {
+  static readonly layer: (input?: PasswordPolicy) => Layer.Layer<NewPasswordCheck, PasswordConfigurationError, CompromisedPasswords>;
+}
+//#endregion
+export { CheckedNewPassword, NewPasswordCheck };
+//# sourceMappingURL=NewPasswordCheck.d.mts.map

package/dist/password/NewPasswordCheck.mjs

@@ -0,0 +1,39 @@
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { NewPasswordRejected, PasswordCheckUnavailable } from "./errors.mjs";
+import { defaultPasswordPolicy, validatePasswordPolicy } from "./policy.mjs";
+import { CompromisedPasswords, PasswordScreening, PasswordScreeningContext } from "./CompromisedPasswords.mjs";
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/password/NewPasswordCheck.ts
+/** Apply only to new credentials. Persist normalization beside the verifier;
+* login uses that stored mode, while legacy verification/rehash retains none.
+*/
+var NewPasswordCheck = class NewPasswordCheck extends Context.Service()("effect-auth/NewPasswordCheck") {
+	static layer = (input = defaultPasswordPolicy) => {
+		const snapshot = { ...input };
+		return Layer.effect(this, Effect.gen(function* () {
+			const policy = yield* validatePasswordPolicy(snapshot);
+			const screening = (yield* CompromisedPasswords).check;
+			return NewPasswordCheck.of({ check: Effect.fn("NewPasswordCheck.check")(function* (password, context = {}) {
+				const checkedContext = Object.freeze(yield* Schema.decodeEffect(PasswordScreeningContext)(context).pipe(Effect.mapError(() => PasswordCheckUnavailable.make({}))));
+				const raw = Redacted.value(password);
+				yield* Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(policy.maximumBytes)))(raw).pipe(Effect.mapError(() => NewPasswordRejected.make({ reason: "too-long" })));
+				yield* Schema.decodeEffect(Schema.String.check(Schema.isPattern(/^[^\uD800-\uDFFF]*$/u)))(raw).pipe(Effect.mapError(() => NewPasswordRejected.make({ reason: "ill-formed" })));
+				const value = policy.normalization === "NFC" ? raw.normalize("NFC") : raw;
+				const length = [...value].length;
+				if (length < (policy.assurance === "single-factor" ? 15 : 8)) return yield* NewPasswordRejected.make({ reason: "too-short" });
+				if (length > policy.maximumCodePoints || new TextEncoder().encode(value).byteLength > policy.maximumBytes) return yield* NewPasswordRejected.make({ reason: "too-long" });
+				const normalized = Redacted.make(value);
+				const result = yield* Effect.suspend(() => screening(normalized, checkedContext)).pipe(Effect.flatMap(Schema.decodeEffect(PasswordScreening)), Effect.catchCause((cause) => reportAuthFailure("password-screening", cause).pipe(Effect.andThen(Effect.fail(PasswordCheckUnavailable.make({}))))));
+				if (result._tag === "Rejected") return yield* NewPasswordRejected.make({ reason: result.reason });
+				return Object.freeze({
+					password: normalized,
+					normalization: policy.normalization
+				});
+			}) });
+		}));
+	};
+};
+//#endregion
+export { NewPasswordCheck };
+
+//# sourceMappingURL=NewPasswordCheck.mjs.map

package/dist/password/NewPasswordCheck.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"NewPasswordCheck.mjs","names":[],"sources":["../../src/password/NewPasswordCheck.ts"],"sourcesContent":["import { Context, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport {\n  CompromisedPasswords,\n  PasswordScreening,\n  PasswordScreeningContext,\n} from \"./CompromisedPasswords\";\nimport { NewPasswordRejected, PasswordCheckUnavailable } from \"./errors\";\nimport {\n  defaultPasswordPolicy,\n  validatePasswordPolicy,\n  type PasswordNormalization,\n  type PasswordPolicy,\n} from \"./policy\";\n\nexport interface CheckedNewPassword {\n  readonly password: Redacted.Redacted<string>;\n  readonly normalization: PasswordNormalization;\n}\n\n/** Apply only to new credentials. Persist normalization beside the verifier;\n * login uses that stored mode, while legacy verification/rehash retains none.\n */\nexport class NewPasswordCheck extends Context.Service<\n  NewPasswordCheck,\n  {\n    readonly check: (\n      password: Redacted.Redacted<string>,\n      context?: PasswordScreeningContext,\n    ) => Effect.Effect<CheckedNewPassword, NewPasswordRejected | PasswordCheckUnavailable>;\n  }\n>()(\"effect-auth/NewPasswordCheck\") {\n  static readonly layer = (input: PasswordPolicy = defaultPasswordPolicy) => {\n    const snapshot = { ...input };\n\n    return Layer.effect(\n      this,\n      Effect.gen(function* () {\n        const policy = yield* validatePasswordPolicy(snapshot);\n        const screening = (yield* CompromisedPasswords).check;\n\n        return NewPasswordCheck.of({\n          check: Effect.fn(\"NewPasswordCheck.check\")(function* (password, context = {}) {\n            const checkedContext = Object.freeze(\n              yield* Schema.decodeEffect(PasswordScreeningContext)(context).pipe(\n                Effect.mapError(() => PasswordCheckUnavailable.make({})),\n              ),\n            );\n\n            const raw = Redacted.value(password);\n\n            yield* Schema.decodeEffect(\n              Schema.String.check(Schema.isMaxLength(policy.maximumBytes)),\n            )(raw).pipe(Effect.mapError(() => NewPasswordRejected.make({ reason: \"too-long\" })));\n            yield* Schema.decodeEffect(\n              Schema.String.check(Schema.isPattern(/^[^\\uD800-\\uDFFF]*$/u)),\n            )(raw).pipe(Effect.mapError(() => NewPasswordRejected.make({ reason: \"ill-formed\" })));\n            const value = policy.normalization === \"NFC\" ? raw.normalize(\"NFC\") : raw;\n            const length = [...value].length;\n\n            if (length < (policy.assurance === \"single-factor\" ? 15 : 8))\n              return yield* NewPasswordRejected.make({ reason: \"too-short\" });\n            if (\n              length > policy.maximumCodePoints ||\n              new TextEncoder().encode(value).byteLength > policy.maximumBytes\n            )\n              return yield* NewPasswordRejected.make({ reason: \"too-long\" });\n            const normalized = Redacted.make(value);\n\n            const result = yield* Effect.suspend(() => screening(normalized, checkedContext)).pipe(\n              Effect.flatMap(Schema.decodeEffect(PasswordScreening)),\n              Effect.catchCause((cause) =>\n                reportAuthFailure(\"password-screening\", cause).pipe(\n                  Effect.andThen(Effect.fail(PasswordCheckUnavailable.make({}))),\n                ),\n              ),\n            );\n\n            if (result._tag === \"Rejected\")\n              return yield* NewPasswordRejected.make({ reason: result.reason });\n\n            return Object.freeze({ password: normalized, normalization: policy.normalization });\n          }),\n        });\n      }),\n    );\n  };\n}\n"],"mappings":";;;;;;;;;AAwBA,IAAa,mBAAb,MAAa,yBAAyB,QAAQ,QAQ5C,CAAC,CAAC,8BAA8B,CAAC,CAAC;CAClC,OAAgB,SAAS,QAAwB,0BAA0B;EACzE,MAAM,WAAW,EAAE,GAAG,MAAM;EAE5B,OAAO,MAAM,OACX,MACA,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,uBAAuB,QAAQ;GACrD,MAAM,aAAa,OAAO,qBAAA,CAAsB;GAEhD,OAAO,iBAAiB,GAAG,EACzB,OAAO,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,UAAU,UAAU,CAAC,GAAG;IAC5E,MAAM,iBAAiB,OAAO,OAC5B,OAAO,OAAO,aAAa,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,KAC5D,OAAO,eAAe,yBAAyB,KAAK,CAAC,CAAC,CAAC,CACzD,CACF;IAEA,MAAM,MAAM,SAAS,MAAM,QAAQ;IAEnC,OAAO,OAAO,aACZ,OAAO,OAAO,MAAM,OAAO,YAAY,OAAO,YAAY,CAAC,CAC7D,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CAAC;IACnF,OAAO,OAAO,aACZ,OAAO,OAAO,MAAM,OAAO,UAAU,sBAAsB,CAAC,CAC9D,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,KAAK,EAAE,QAAQ,aAAa,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,OAAO,kBAAkB,QAAQ,IAAI,UAAU,KAAK,IAAI;IACtE,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC;IAE1B,IAAI,UAAU,OAAO,cAAc,kBAAkB,KAAK,IACxD,OAAO,OAAO,oBAAoB,KAAK,EAAE,QAAQ,YAAY,CAAC;IAChE,IACE,SAAS,OAAO,qBAChB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,aAAa,OAAO,cAEpD,OAAO,OAAO,oBAAoB,KAAK,EAAE,QAAQ,WAAW,CAAC;IAC/D,MAAM,aAAa,SAAS,KAAK,KAAK;IAEtC,MAAM,SAAS,OAAO,OAAO,cAAc,UAAU,YAAY,cAAc,CAAC,CAAC,CAAC,KAChF,OAAO,QAAQ,OAAO,aAAa,iBAAiB,CAAC,GACrD,OAAO,YAAY,UACjB,kBAAkB,sBAAsB,KAAK,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,KAAK,yBAAyB,KAAK,CAAC,CAAC,CAAC,CAAC,CAC/D,CACF,CACF;IAEA,IAAI,OAAO,SAAS,YAClB,OAAO,OAAO,oBAAoB,KAAK,EAAE,QAAQ,OAAO,OAAO,CAAC;IAElE,OAAO,OAAO,OAAO;KAAE,UAAU;KAAY,eAAe,OAAO;IAAc,CAAC;GACpF,CAAC,EACH,CAAC;EACH,CAAC,CACH;CACF;AACF"}

package/dist/password/PasswordHashing.d.mts

@@ -0,0 +1,24 @@
+import { PasswordConfigurationError, PasswordHashingUnavailable, PasswordInputInvalid, PasswordKdfBusy, PasswordVerifierInvalid } from "./errors.mjs";
+import { PasswordHashingConfig } from "./configuration.mjs";
+import { EncodedPasswordHash, PasswordVerification } from "./models.mjs";
+import { PasswordKdfAdmission } from "./PasswordKdfAdmission.mjs";
+import { Context, Crypto, Effect, Layer, Redacted } from "effect";
+//#region src/password/PasswordHashing.d.ts
+type HashFailure = PasswordHashingUnavailable | PasswordInputInvalid | PasswordKdfBusy;
+declare const PasswordHashing_base: Context.ServiceClass<PasswordHashing, "effect-auth/PasswordHashing", {
+  readonly hash: (password: Redacted.Redacted<string>) => Effect.Effect<Redacted.Redacted<EncodedPasswordHash>, HashFailure>;
+  readonly verify: (password: Redacted.Redacted<string>, verifier: Redacted.Redacted<EncodedPasswordHash>) => Effect.Effect<PasswordVerification, HashFailure | PasswordVerifierInvalid>;
+  /** One current-cost derivation, including on the first unknown-identifier attempt. */
+  readonly dummy: (password: Redacted.Redacted<string>) => Effect.Effect<void, HashFailure>;
+}>;
+/** Byte-preserving KDF capability. Text normalization belongs to trusted credential
+ * provenance, never the algorithm identifier. Rehash legacy passwords with mode none.
+ * Replacements must retain admission until actual work completion, including native
+ * callbacks. Portable async KDFs yield microtasks; they are not off-thread workers.
+ */
+declare class PasswordHashing extends PasswordHashing_base {
+  static readonly portableLayer: (input?: PasswordHashingConfig) => Layer.Layer<PasswordHashing, PasswordConfigurationError, Crypto.Crypto | PasswordKdfAdmission>;
+}
+//#endregion
+export { PasswordHashing };
+//# sourceMappingURL=PasswordHashing.d.mts.map

package/dist/password/PasswordHashing.mjs

@@ -0,0 +1,96 @@
+import { PasswordHashingUnavailable, PasswordInputInvalid } from "./errors.mjs";
+import { EncodedPasswordHash } from "./models.mjs";
+import { defaultPasswordHashingConfig, validatePasswordHashingConfig } from "./configuration.mjs";
+import { parsePasswordHash, phcBase64 } from "./encoding.mjs";
+import { PasswordKdfAdmission } from "./PasswordKdfAdmission.mjs";
+import { Context, Crypto, Effect, Layer, Redacted, Schema } from "effect";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { equalBytes } from "@noble/ciphers/utils.js";
+import { argon2idAsync } from "@noble/hashes/argon2.js";
+import { pbkdf2Async } from "@noble/hashes/pbkdf2.js";
+//#region src/password/PasswordHashing.ts
+const encoder = new TextEncoder();
+/** Byte-preserving KDF capability. Text normalization belongs to trusted credential
+* provenance, never the algorithm identifier. Rehash legacy passwords with mode none.
+* Replacements must retain admission until actual work completion, including native
+* callbacks. Portable async KDFs yield microtasks; they are not off-thread workers.
+*/
+var PasswordHashing = class PasswordHashing extends Context.Service()("effect-auth/PasswordHashing") {
+	static portableLayer = (input = defaultPasswordHashingConfig) => {
+		const snapshot = { ...input };
+		return Layer.effect(this, Effect.gen(function* () {
+			const config = yield* validatePasswordHashingConfig(snapshot);
+			const admission = yield* PasswordKdfAdmission;
+			const crypto = yield* Crypto.Crypto;
+			const passwordBytes = Effect.fn("PasswordHashing.passwordBytes")(function* (password) {
+				const value = Redacted.value(password);
+				yield* Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(config.maximumPasswordBytes)))(value).pipe(Effect.mapError(() => PasswordInputInvalid.make({ reason: "too-long" })));
+				const buffer = new Uint8Array(config.maximumPasswordBytes);
+				const encoded = encoder.encodeInto(value, buffer);
+				if (encoded.read !== value.length) {
+					buffer.fill(0);
+					return yield* PasswordInputInvalid.make({ reason: "too-long" });
+				}
+				return buffer.subarray(0, encoded.written);
+			});
+			const derive = (password, salt, memoryKiB, passes, parallelism, length) => Effect.tryPromise({
+				try: () => argon2idAsync(password, salt, {
+					m: memoryKiB,
+					t: passes,
+					p: parallelism,
+					version: 19,
+					dkLen: length,
+					maxmem: config.maximumMemoryKiB * 1024,
+					asyncTick: 10
+				}),
+				catch: () => PasswordHashingUnavailable.make({})
+			});
+			const withPassword = (password, prepare, body) => admission.run(Effect.gen(function* () {
+				const prepared = yield* prepare;
+				const bytes = yield* passwordBytes(password);
+				return yield* body(bytes, prepared).pipe(Effect.ensuring(Effect.sync(() => bytes.fill(0))));
+			}));
+			return PasswordHashing.of({
+				hash: (password) => withPassword(password, Effect.void, (bytes) => Effect.gen(function* () {
+					const salt = yield* crypto.randomBytes(16).pipe(Effect.mapError(() => PasswordHashingUnavailable.make({})));
+					const output = yield* derive(bytes, salt, config.memoryKiB, config.passes, config.parallelism, 32);
+					try {
+						return Redacted.make(EncodedPasswordHash.make(`$argon2id$v=19$m=${config.memoryKiB},t=${config.passes},p=${config.parallelism}$${phcBase64(salt)}$${phcBase64(output)}`));
+					} finally {
+						output.fill(0);
+						salt.fill(0);
+					}
+				})),
+				verify: (password, verifier) => withPassword(password, parsePasswordHash(Redacted.value(verifier), config), (bytes, parsed) => Effect.gen(function* () {
+					const output = yield* parsed._tag === "Argon2id" ? derive(bytes, parsed.salt, parsed.memoryKiB, parsed.passes, parsed.parallelism, parsed.expected.length) : Effect.tryPromise({
+						try: () => pbkdf2Async(sha256, bytes, parsed.salt, {
+							c: parsed.iterations,
+							dkLen: 32,
+							asyncTick: 10
+						}),
+						catch: () => PasswordHashingUnavailable.make({})
+					});
+					try {
+						const matches = equalBytes(output, parsed.expected);
+						const upgrade = parsed._tag === "LegacyPbkdf2" || parsed.memoryKiB < config.memoryKiB || parsed.passes < config.passes || parsed.salt.length < 16 || parsed.expected.length < 32;
+						return {
+							matches,
+							needsRehash: matches && upgrade
+						};
+					} finally {
+						output.fill(0);
+						parsed.expected.fill(0);
+						parsed.salt.fill(0);
+					}
+				})),
+				dummy: (password) => withPassword(password, Effect.void, (bytes) => derive(bytes, /* @__PURE__ */ new Uint8Array(16), config.memoryKiB, config.passes, config.parallelism, 32).pipe(Effect.flatMap((output) => Effect.sync(() => {
+					output.fill(0);
+				}))))
+			});
+		}));
+	};
+};
+//#endregion
+export { PasswordHashing };
+
+//# sourceMappingURL=PasswordHashing.mjs.map

package/dist/password/PasswordHashing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordHashing.mjs","names":[],"sources":["../../src/password/PasswordHashing.ts"],"sourcesContent":["/* eslint-disable import/extensions -- Noble exposes these package subpaths only with the .js suffix. */\nimport { equalBytes } from \"@noble/ciphers/utils.js\";\nimport { argon2idAsync } from \"@noble/hashes/argon2.js\";\nimport { pbkdf2Async } from \"@noble/hashes/pbkdf2.js\";\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { Context, Crypto, Effect, Layer, Redacted, Schema } from \"effect\";\n\nimport {\n  defaultPasswordHashingConfig,\n  validatePasswordHashingConfig,\n  type PasswordHashingConfig,\n} from \"./configuration\";\nimport { parsePasswordHash, phcBase64 } from \"./encoding\";\nimport {\n  PasswordHashingUnavailable,\n  PasswordInputInvalid,\n  type PasswordKdfBusy,\n  type PasswordVerifierInvalid,\n} from \"./errors\";\nimport { EncodedPasswordHash, type PasswordVerification } from \"./models\";\nimport { PasswordKdfAdmission } from \"./PasswordKdfAdmission\";\n\nconst encoder = new TextEncoder();\n\ntype HashFailure = PasswordHashingUnavailable | PasswordInputInvalid | PasswordKdfBusy;\n\n/** Byte-preserving KDF capability. Text normalization belongs to trusted credential\n * provenance, never the algorithm identifier. Rehash legacy passwords with mode none.\n * Replacements must retain admission until actual work completion, including native\n * callbacks. Portable async KDFs yield microtasks; they are not off-thread workers.\n */\nexport class PasswordHashing extends Context.Service<\n  PasswordHashing,\n  {\n    readonly hash: (\n      password: Redacted.Redacted<string>,\n    ) => Effect.Effect<Redacted.Redacted<EncodedPasswordHash>, HashFailure>;\n    readonly verify: (\n      password: Redacted.Redacted<string>,\n      verifier: Redacted.Redacted<EncodedPasswordHash>,\n    ) => Effect.Effect<PasswordVerification, HashFailure | PasswordVerifierInvalid>;\n    /** One current-cost derivation, including on the first unknown-identifier attempt. */\n    readonly dummy: (password: Redacted.Redacted<string>) => Effect.Effect<void, HashFailure>;\n  }\n>()(\"effect-auth/PasswordHashing\") {\n  static readonly portableLayer = (input: PasswordHashingConfig = defaultPasswordHashingConfig) => {\n    const snapshot = { ...input };\n\n    return Layer.effect(\n      this,\n      Effect.gen(function* () {\n        const config = yield* validatePasswordHashingConfig(snapshot);\n        const admission = yield* PasswordKdfAdmission;\n        const crypto = yield* Crypto.Crypto;\n\n        const passwordBytes = Effect.fn(\"PasswordHashing.passwordBytes\")(function* (\n          password: Redacted.Redacted<string>,\n        ) {\n          const value = Redacted.value(password);\n\n          yield* Schema.decodeEffect(\n            Schema.String.check(Schema.isMaxLength(config.maximumPasswordBytes)),\n          )(value).pipe(Effect.mapError(() => PasswordInputInvalid.make({ reason: \"too-long\" })));\n          const buffer = new Uint8Array(config.maximumPasswordBytes);\n          const encoded = encoder.encodeInto(value, buffer);\n\n          if (encoded.read !== value.length) {\n            buffer.fill(0);\n\n            return yield* PasswordInputInvalid.make({ reason: \"too-long\" });\n          }\n\n          return buffer.subarray(0, encoded.written);\n        });\n\n        const derive = (\n          password: Uint8Array,\n          salt: Uint8Array,\n          memoryKiB: number,\n          passes: number,\n          parallelism: number,\n          length: number,\n        ) =>\n          Effect.tryPromise({\n            try: () =>\n              argon2idAsync(password, salt, {\n                m: memoryKiB,\n                t: passes,\n                p: parallelism,\n                version: 19,\n                dkLen: length,\n                maxmem: config.maximumMemoryKiB * 1024,\n                asyncTick: 10,\n              }),\n            catch: () => PasswordHashingUnavailable.make({}),\n          });\n\n        const withPassword = <A, E, P, E2>(\n          password: Redacted.Redacted<string>,\n          prepare: Effect.Effect<P, E2>,\n          body: (bytes: Uint8Array, prepared: P) => Effect.Effect<A, E>,\n        ) =>\n          admission.run(\n            Effect.gen(function* () {\n              const prepared = yield* prepare;\n              const bytes = yield* passwordBytes(password);\n\n              return yield* body(bytes, prepared).pipe(\n                Effect.ensuring(Effect.sync(() => bytes.fill(0))),\n              );\n            }),\n          );\n\n        return PasswordHashing.of({\n          hash: (password) =>\n            withPassword(password, Effect.void, (bytes) =>\n              Effect.gen(function* () {\n                const salt = yield* crypto\n                  .randomBytes(16)\n                  .pipe(Effect.mapError(() => PasswordHashingUnavailable.make({})));\n\n                const output = yield* derive(\n                  bytes,\n                  salt,\n                  config.memoryKiB,\n                  config.passes,\n                  config.parallelism,\n                  32,\n                );\n\n                try {\n                  return Redacted.make(\n                    EncodedPasswordHash.make(\n                      `$argon2id$v=19$m=${config.memoryKiB},t=${config.passes},p=${config.parallelism}$${phcBase64(salt)}$${phcBase64(output)}`,\n                    ),\n                  );\n                } finally {\n                  output.fill(0);\n                  salt.fill(0);\n                }\n              }),\n            ),\n          verify: (password, verifier) =>\n            withPassword(\n              password,\n              parsePasswordHash(Redacted.value(verifier), config),\n              (bytes, parsed) =>\n                Effect.gen(function* () {\n                  const output = yield* parsed._tag === \"Argon2id\"\n                    ? derive(\n                        bytes,\n                        parsed.salt,\n                        parsed.memoryKiB,\n                        parsed.passes,\n                        parsed.parallelism,\n                        parsed.expected.length,\n                      )\n                    : Effect.tryPromise({\n                        try: () =>\n                          pbkdf2Async(sha256, bytes, parsed.salt, {\n                            c: parsed.iterations,\n                            dkLen: 32,\n                            asyncTick: 10,\n                          }),\n                        catch: () => PasswordHashingUnavailable.make({}),\n                      });\n\n                  try {\n                    // Maintained fixed-length byte comparison; JavaScript/JIT gives no hard timing guarantee.\n                    const matches = equalBytes(output, parsed.expected);\n\n                    // Parallelism is a scheduling profile, not compensation for weak memory/passes.\n                    const upgrade =\n                      parsed._tag === \"LegacyPbkdf2\" ||\n                      parsed.memoryKiB < config.memoryKiB ||\n                      parsed.passes < config.passes ||\n                      parsed.salt.length < 16 ||\n                      parsed.expected.length < 32;\n\n                    return { matches, needsRehash: matches && upgrade };\n                  } finally {\n                    output.fill(0);\n                    parsed.expected.fill(0);\n                    parsed.salt.fill(0);\n                  }\n                }),\n            ),\n          dummy: (password) =>\n            withPassword(password, Effect.void, (bytes) =>\n              derive(\n                bytes,\n                new Uint8Array(16),\n                config.memoryKiB,\n                config.passes,\n                config.parallelism,\n                32,\n              ).pipe(\n                Effect.flatMap((output) =>\n                  Effect.sync(() => {\n                    output.fill(0);\n                  }),\n                ),\n              ),\n            ),\n        });\n      }),\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,UAAU,IAAI,YAAY;;;;;;AAShC,IAAa,kBAAb,MAAa,wBAAwB,QAAQ,QAa3C,CAAC,CAAC,6BAA6B,CAAC,CAAC;CACjC,OAAgB,iBAAiB,QAA+B,iCAAiC;EAC/F,MAAM,WAAW,EAAE,GAAG,MAAM;EAE5B,OAAO,MAAM,OACX,MACA,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,QAAQ;GAC5D,MAAM,YAAY,OAAO;GACzB,MAAM,SAAS,OAAO,OAAO;GAE7B,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,UACA;IACA,MAAM,QAAQ,SAAS,MAAM,QAAQ;IAErC,OAAO,OAAO,aACZ,OAAO,OAAO,MAAM,OAAO,YAAY,OAAO,oBAAoB,CAAC,CACrE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,qBAAqB,KAAK,EAAE,QAAQ,WAAW,CAAC,CAAC,CAAC;IACtF,MAAM,SAAS,IAAI,WAAW,OAAO,oBAAoB;IACzD,MAAM,UAAU,QAAQ,WAAW,OAAO,MAAM;IAEhD,IAAI,QAAQ,SAAS,MAAM,QAAQ;KACjC,OAAO,KAAK,CAAC;KAEb,OAAO,OAAO,qBAAqB,KAAK,EAAE,QAAQ,WAAW,CAAC;IAChE;IAEA,OAAO,OAAO,SAAS,GAAG,QAAQ,OAAO;GAC3C,CAAC;GAED,MAAM,UACJ,UACA,MACA,WACA,QACA,aACA,WAEA,OAAO,WAAW;IAChB,WACE,cAAc,UAAU,MAAM;KAC5B,GAAG;KACH,GAAG;KACH,GAAG;KACH,SAAS;KACT,OAAO;KACP,QAAQ,OAAO,mBAAmB;KAClC,WAAW;IACb,CAAC;IACH,aAAa,2BAA2B,KAAK,CAAC,CAAC;GACjD,CAAC;GAEH,MAAM,gBACJ,UACA,SACA,SAEA,UAAU,IACR,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO;IACxB,MAAM,QAAQ,OAAO,cAAc,QAAQ;IAE3C,OAAO,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,KAClC,OAAO,SAAS,OAAO,WAAW,MAAM,KAAK,CAAC,CAAC,CAAC,CAClD;GACF,CAAC,CACH;GAEF,OAAO,gBAAgB,GAAG;IACxB,OAAO,aACL,aAAa,UAAU,OAAO,OAAO,UACnC,OAAO,IAAI,aAAa;KACtB,MAAM,OAAO,OAAO,OACjB,YAAY,EAAE,CAAC,CACf,KAAK,OAAO,eAAe,2BAA2B,KAAK,CAAC,CAAC,CAAC,CAAC;KAElE,MAAM,SAAS,OAAO,OACpB,OACA,MACA,OAAO,WACP,OAAO,QACP,OAAO,aACP,EACF;KAEA,IAAI;MACF,OAAO,SAAS,KACd,oBAAoB,KAClB,oBAAoB,OAAO,UAAU,KAAK,OAAO,OAAO,KAAK,OAAO,YAAY,GAAG,UAAU,IAAI,EAAE,GAAG,UAAU,MAAM,GACxH,CACF;KACF,UAAU;MACR,OAAO,KAAK,CAAC;MACb,KAAK,KAAK,CAAC;KACb;IACF,CAAC,CACH;IACF,SAAS,UAAU,aACjB,aACE,UACA,kBAAkB,SAAS,MAAM,QAAQ,GAAG,MAAM,IACjD,OAAO,WACN,OAAO,IAAI,aAAa;KACtB,MAAM,SAAS,OAAO,OAAO,SAAS,aAClC,OACE,OACA,OAAO,MACP,OAAO,WACP,OAAO,QACP,OAAO,aACP,OAAO,SAAS,MAClB,IACA,OAAO,WAAW;MAChB,WACE,YAAY,QAAQ,OAAO,OAAO,MAAM;OACtC,GAAG,OAAO;OACV,OAAO;OACP,WAAW;MACb,CAAC;MACH,aAAa,2BAA2B,KAAK,CAAC,CAAC;KACjD,CAAC;KAEL,IAAI;MAEF,MAAM,UAAU,WAAW,QAAQ,OAAO,QAAQ;MAGlD,MAAM,UACJ,OAAO,SAAS,kBAChB,OAAO,YAAY,OAAO,aAC1B,OAAO,SAAS,OAAO,UACvB,OAAO,KAAK,SAAS,MACrB,OAAO,SAAS,SAAS;MAE3B,OAAO;OAAE;OAAS,aAAa,WAAW;MAAQ;KACpD,UAAU;MACR,OAAO,KAAK,CAAC;MACb,OAAO,SAAS,KAAK,CAAC;MACtB,OAAO,KAAK,KAAK,CAAC;KACpB;IACF,CAAC,CACL;IACF,QAAQ,aACN,aAAa,UAAU,OAAO,OAAO,UACnC,OACE,uBACA,IAAI,WAAW,EAAE,GACjB,OAAO,WACP,OAAO,QACP,OAAO,aACP,EACF,CAAC,CAAC,KACA,OAAO,SAAS,WACd,OAAO,WAAW;KAChB,OAAO,KAAK,CAAC;IACf,CAAC,CACH,CACF,CACF;GACJ,CAAC;EACH,CAAC,CACH;CACF;AACF"}

package/dist/password/PasswordKdfAdmission.d.mts

@@ -0,0 +1,19 @@
+import { PasswordConfigurationError, PasswordKdfBusy } from "./errors.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/password/PasswordKdfAdmission.d.ts
+declare const PasswordKdfAdmission_base: Context.ServiceClass<PasswordKdfAdmission, "effect-auth/PasswordKdfAdmission", {
+  readonly run: <A, E, R>(work: Effect.Effect<A, E, R>) => Effect.Effect<A, E | PasswordKdfBusy, R>;
+}>;
+/** Share ONE Layer instance across hashers in a runtime. This bounds actual
+ * nonabortable work, not distributed guesses. Callbacks must finish only after
+ * their underlying computation finishes: an already-detached Promise is unsafe.
+ * Work includes allocation, derive, comparison and cleanup. No waiting queue.
+ */
+declare class PasswordKdfAdmission extends PasswordKdfAdmission_base {
+  static readonly layer: (options?: {
+    readonly concurrency: number;
+  }) => Layer.Layer<PasswordKdfAdmission, PasswordConfigurationError, never>;
+}
+//#endregion
+export { PasswordKdfAdmission };
+//# sourceMappingURL=PasswordKdfAdmission.d.mts.map

package/dist/password/PasswordKdfAdmission.mjs

@@ -0,0 +1,25 @@
+import { PasswordConfigurationError, PasswordKdfBusy } from "./errors.mjs";
+import { Context, Effect, Layer, Option, Schema, Semaphore } from "effect";
+//#region src/password/PasswordKdfAdmission.ts
+/** Share ONE Layer instance across hashers in a runtime. This bounds actual
+* nonabortable work, not distributed guesses. Callbacks must finish only after
+* their underlying computation finishes: an already-detached Promise is unsafe.
+* Work includes allocation, derive, comparison and cleanup. No waiting queue.
+*/
+var PasswordKdfAdmission = class PasswordKdfAdmission extends Context.Service()("effect-auth/PasswordKdfAdmission") {
+	static layer = (options = { concurrency: 1 }) => {
+		const concurrency = options.concurrency;
+		return Layer.effect(this, Effect.gen(function* () {
+			yield* Schema.decodeEffect(Schema.Int.check(Schema.isBetween({
+				minimum: 1,
+				maximum: 32
+			})))(concurrency).pipe(Effect.mapError(() => PasswordConfigurationError.make({ component: "admission" })));
+			const semaphore = yield* Semaphore.make(concurrency);
+			return PasswordKdfAdmission.of({ run: (work) => semaphore.withPermitsIfAvailable(1)(Effect.uninterruptible(work)).pipe(Effect.flatMap((result) => Option.isSome(result) ? Effect.succeed(result.value) : Effect.fail(PasswordKdfBusy.make({})))) });
+		}));
+	};
+};
+//#endregion
+export { PasswordKdfAdmission };
+
+//# sourceMappingURL=PasswordKdfAdmission.mjs.map

package/dist/password/PasswordKdfAdmission.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordKdfAdmission.mjs","names":[],"sources":["../../src/password/PasswordKdfAdmission.ts"],"sourcesContent":["import { Context, Effect, Layer, Option, Schema, Semaphore } from \"effect\";\n\nimport { PasswordConfigurationError, PasswordKdfBusy } from \"./errors\";\n\n/** Share ONE Layer instance across hashers in a runtime. This bounds actual\n * nonabortable work, not distributed guesses. Callbacks must finish only after\n * their underlying computation finishes: an already-detached Promise is unsafe.\n * Work includes allocation, derive, comparison and cleanup. No waiting queue.\n */\nexport class PasswordKdfAdmission extends Context.Service<\n  PasswordKdfAdmission,\n  {\n    readonly run: <A, E, R>(\n      work: Effect.Effect<A, E, R>,\n    ) => Effect.Effect<A, E | PasswordKdfBusy, R>;\n  }\n>()(\"effect-auth/PasswordKdfAdmission\") {\n  static readonly layer = (options: { readonly concurrency: number } = { concurrency: 1 }) => {\n    const concurrency = options.concurrency;\n\n    return Layer.effect(\n      this,\n      Effect.gen(function* () {\n        yield* Schema.decodeEffect(Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 32 })))(\n          concurrency,\n        ).pipe(Effect.mapError(() => PasswordConfigurationError.make({ component: \"admission\" })));\n        const semaphore = yield* Semaphore.make(concurrency);\n\n        return PasswordKdfAdmission.of({\n          run: <A, E, R>(work: Effect.Effect<A, E, R>) =>\n            semaphore\n              .withPermitsIfAvailable(1)(Effect.uninterruptible(work))\n              .pipe(\n                Effect.flatMap((result) =>\n                  Option.isSome(result)\n                    ? Effect.succeed(result.value)\n                    : Effect.fail(PasswordKdfBusy.make({})),\n                ),\n              ),\n        });\n      }),\n    );\n  };\n}\n"],"mappings":";;;;;;;;AASA,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAOhD,CAAC,CAAC,kCAAkC,CAAC,CAAC;CACtC,OAAgB,SAAS,UAA4C,EAAE,aAAa,EAAE,MAAM;EAC1F,MAAM,cAAc,QAAQ;EAE5B,OAAO,MAAM,OACX,MACA,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aAAa,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAG,CAAC,CAAC,CAAC,CAAC,CACzF,WACF,CAAC,CAAC,KAAK,OAAO,eAAe,2BAA2B,KAAK,EAAE,WAAW,YAAY,CAAC,CAAC,CAAC;GACzF,MAAM,YAAY,OAAO,UAAU,KAAK,WAAW;GAEnD,OAAO,qBAAqB,GAAG,EAC7B,MAAe,SACb,UACG,uBAAuB,CAAC,CAAC,CAAC,OAAO,gBAAgB,IAAI,CAAC,CAAC,CACvD,KACC,OAAO,SAAS,WACd,OAAO,OAAO,MAAM,IAChB,OAAO,QAAQ,OAAO,KAAK,IAC3B,OAAO,KAAK,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAC1C,CACF,EACN,CAAC;EACH,CAAC,CACH;CACF;AACF"}