@yielded/auth 0.1.0-beta.1

package/dist/password/configuration.d.mts

@@ -0,0 +1,43 @@
+import { PasswordConfigurationError } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/password/configuration.d.ts
+declare const PasswordHashingConfig: Schema.Struct<{
+  readonly memoryKiB: Schema.Int;
+  readonly passes: Schema.Int;
+  readonly parallelism: Schema.Int;
+  readonly maximumMemoryKiB: Schema.Int;
+  readonly maximumPasses: Schema.Int;
+  readonly maximumParallelism: Schema.Int;
+  readonly maximumMemoryPasses: Schema.Int;
+  readonly maximumLegacyIterations: Schema.Int;
+  readonly maximumPasswordBytes: Schema.Int;
+}>;
+type PasswordHashingConfig = typeof PasswordHashingConfig.Type;
+/** OWASP Argon2id minimum profile. Host CPU/memory allowances must fit this cost;
+ * runtime failures never cause an automatic downgrade. Limits are per permit.
+ */
+declare const defaultPasswordHashingConfig: PasswordHashingConfig;
+declare const validatePasswordHashingConfig: (input: {
+  readonly memoryKiB: number;
+  readonly passes: number;
+  readonly parallelism: number;
+  readonly maximumMemoryKiB: number;
+  readonly maximumPasses: number;
+  readonly maximumParallelism: number;
+  readonly maximumMemoryPasses: number;
+  readonly maximumLegacyIterations: number;
+  readonly maximumPasswordBytes: number;
+}) => Effect.Effect<Readonly<{
+  readonly memoryKiB: number;
+  readonly passes: number;
+  readonly parallelism: number;
+  readonly maximumMemoryKiB: number;
+  readonly maximumPasses: number;
+  readonly maximumParallelism: number;
+  readonly maximumMemoryPasses: number;
+  readonly maximumLegacyIterations: number;
+  readonly maximumPasswordBytes: number;
+}>, PasswordConfigurationError, never>;
+//#endregion
+export { PasswordHashingConfig, defaultPasswordHashingConfig, validatePasswordHashingConfig };
+//# sourceMappingURL=configuration.d.mts.map

package/dist/password/configuration.mjs

@@ -0,0 +1,64 @@
+import { PasswordConfigurationError } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/password/configuration.ts
+const PasswordHashingConfig = Schema.Struct({
+	memoryKiB: Schema.Int.check(Schema.isBetween({
+		minimum: 19456,
+		maximum: 65536
+	})),
+	passes: Schema.Int.check(Schema.isBetween({
+		minimum: 2,
+		maximum: 6
+	})),
+	parallelism: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 4
+	})),
+	maximumMemoryKiB: Schema.Int.check(Schema.isBetween({
+		minimum: 19456,
+		maximum: 65536
+	})),
+	maximumPasses: Schema.Int.check(Schema.isBetween({
+		minimum: 2,
+		maximum: 6
+	})),
+	maximumParallelism: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 4
+	})),
+	maximumMemoryPasses: Schema.Int.check(Schema.isBetween({
+		minimum: 38912,
+		maximum: 393216
+	})),
+	maximumLegacyIterations: Schema.Int.check(Schema.isBetween({
+		minimum: 6e5,
+		maximum: 2e6
+	})),
+	maximumPasswordBytes: Schema.Int.check(Schema.isBetween({
+		minimum: 256,
+		maximum: 65536
+	}))
+});
+/** OWASP Argon2id minimum profile. Host CPU/memory allowances must fit this cost;
+* runtime failures never cause an automatic downgrade. Limits are per permit.
+*/
+const defaultPasswordHashingConfig = Object.freeze({
+	memoryKiB: 19456,
+	passes: 2,
+	parallelism: 1,
+	maximumMemoryKiB: 65536,
+	maximumPasses: 6,
+	maximumParallelism: 4,
+	maximumMemoryPasses: 131072,
+	maximumLegacyIterations: 1e6,
+	maximumPasswordBytes: 16384
+});
+const validatePasswordHashingConfig = Effect.fn("validatePasswordHashingConfig")(function* (input) {
+	const config = yield* Schema.decodeEffect(PasswordHashingConfig)(input).pipe(Effect.mapError(() => PasswordConfigurationError.make({ component: "hashing" })));
+	if (config.memoryKiB > config.maximumMemoryKiB || config.passes > config.maximumPasses || config.parallelism > config.maximumParallelism || config.memoryKiB * config.passes > config.maximumMemoryPasses) return yield* PasswordConfigurationError.make({ component: "hashing" });
+	return Object.freeze(config);
+});
+//#endregion
+export { PasswordHashingConfig, defaultPasswordHashingConfig, validatePasswordHashingConfig };
+
+//# sourceMappingURL=configuration.mjs.map

package/dist/password/configuration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/password/configuration.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport { PasswordConfigurationError } from \"./errors\";\n\nexport const PasswordHashingConfig = Schema.Struct({\n  memoryKiB: Schema.Int.check(Schema.isBetween({ minimum: 19456, maximum: 65536 })),\n  passes: Schema.Int.check(Schema.isBetween({ minimum: 2, maximum: 6 })),\n  parallelism: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 4 })),\n  maximumMemoryKiB: Schema.Int.check(Schema.isBetween({ minimum: 19456, maximum: 65536 })),\n  maximumPasses: Schema.Int.check(Schema.isBetween({ minimum: 2, maximum: 6 })),\n  maximumParallelism: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 4 })),\n  maximumMemoryPasses: Schema.Int.check(Schema.isBetween({ minimum: 38912, maximum: 393216 })),\n  maximumLegacyIterations: Schema.Int.check(\n    Schema.isBetween({ minimum: 600000, maximum: 2000000 }),\n  ),\n  maximumPasswordBytes: Schema.Int.check(Schema.isBetween({ minimum: 256, maximum: 65536 })),\n});\n\nexport type PasswordHashingConfig = typeof PasswordHashingConfig.Type;\n\n/** OWASP Argon2id minimum profile. Host CPU/memory allowances must fit this cost;\n * runtime failures never cause an automatic downgrade. Limits are per permit.\n */\nexport const defaultPasswordHashingConfig: PasswordHashingConfig = Object.freeze({\n  memoryKiB: 19456,\n  passes: 2,\n  parallelism: 1,\n  maximumMemoryKiB: 65536,\n  maximumPasses: 6,\n  maximumParallelism: 4,\n  maximumMemoryPasses: 131072,\n  maximumLegacyIterations: 1000000,\n  maximumPasswordBytes: 16384,\n});\n\nexport const validatePasswordHashingConfig = Effect.fn(\"validatePasswordHashingConfig\")(function* (\n  input: PasswordHashingConfig,\n) {\n  const config = yield* Schema.decodeEffect(PasswordHashingConfig)(input).pipe(\n    Effect.mapError(() => PasswordConfigurationError.make({ component: \"hashing\" })),\n  );\n\n  if (\n    config.memoryKiB > config.maximumMemoryKiB ||\n    config.passes > config.maximumPasses ||\n    config.parallelism > config.maximumParallelism ||\n    config.memoryKiB * config.passes > config.maximumMemoryPasses\n  )\n    return yield* PasswordConfigurationError.make({ component: \"hashing\" });\n\n  return Object.freeze(config);\n});\n"],"mappings":";;;AAIA,MAAa,wBAAwB,OAAO,OAAO;CACjD,WAAW,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAO,SAAS;CAAM,CAAC,CAAC;CAChF,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC,CAAC;CACrE,aAAa,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC,CAAC;CAC1E,kBAAkB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAO,SAAS;CAAM,CAAC,CAAC;CACvF,eAAe,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC,CAAC;CAC5E,oBAAoB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC,CAAC;CACjF,qBAAqB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAO,SAAS;CAAO,CAAC,CAAC;CAC3F,yBAAyB,OAAO,IAAI,MAClC,OAAO,UAAU;EAAE,SAAS;EAAQ,SAAS;CAAQ,CAAC,CACxD;CACA,sBAAsB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAK,SAAS;CAAM,CAAC,CAAC;AAC3F,CAAC;;;;AAOD,MAAa,+BAAsD,OAAO,OAAO;CAC/E,WAAW;CACX,QAAQ;CACR,aAAa;CACb,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,qBAAqB;CACrB,yBAAyB;CACzB,sBAAsB;AACxB,CAAC;AAED,MAAa,gCAAgC,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACtF,OACA;CACA,MAAM,SAAS,OAAO,OAAO,aAAa,qBAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,KACtE,OAAO,eAAe,2BAA2B,KAAK,EAAE,WAAW,UAAU,CAAC,CAAC,CACjF;CAEA,IACE,OAAO,YAAY,OAAO,oBAC1B,OAAO,SAAS,OAAO,iBACvB,OAAO,cAAc,OAAO,sBAC5B,OAAO,YAAY,OAAO,SAAS,OAAO,qBAE1C,OAAO,OAAO,2BAA2B,KAAK,EAAE,WAAW,UAAU,CAAC;CAExE,OAAO,OAAO,OAAO,MAAM;AAC7B,CAAC"}

package/dist/password/defaults.mjs

@@ -0,0 +1,13 @@
+import { cryptoLayer, defaultLayer } from "../auth/defaults.mjs";
+import { NewPasswordCheck } from "./NewPasswordCheck.mjs";
+import { PasswordKdfAdmission } from "./PasswordKdfAdmission.mjs";
+import { PasswordHashing } from "./PasswordHashing.mjs";
+import { Layer } from "effect";
+//#region src/password/defaults.ts
+const admissionLayer = defaultLayer(PasswordKdfAdmission, PasswordKdfAdmission.layer());
+const hashingLayer = defaultLayer(PasswordHashing, PasswordHashing.portableLayer().pipe(Layer.provide(admissionLayer))).pipe(Layer.provide(cryptoLayer));
+const newPasswordLayer = defaultLayer(NewPasswordCheck, NewPasswordCheck.layer());
+//#endregion
+export { hashingLayer, newPasswordLayer };
+
+//# sourceMappingURL=defaults.mjs.map

package/dist/password/defaults.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.mjs","names":[],"sources":["../../src/password/defaults.ts"],"sourcesContent":["import { Layer } from \"effect\";\n\nimport { cryptoLayer, defaultLayer } from \"../auth/defaults\";\nimport { NewPasswordCheck } from \"./NewPasswordCheck\";\nimport { PasswordHashing } from \"./PasswordHashing\";\nimport { PasswordKdfAdmission } from \"./PasswordKdfAdmission\";\n\nconst admissionLayer = defaultLayer(PasswordKdfAdmission, PasswordKdfAdmission.layer());\n\nexport const hashingLayer = defaultLayer(\n  PasswordHashing,\n  PasswordHashing.portableLayer().pipe(Layer.provide(admissionLayer)),\n).pipe(Layer.provide(cryptoLayer));\n\nexport const newPasswordLayer = defaultLayer(NewPasswordCheck, NewPasswordCheck.layer());\n"],"mappings":";;;;;;AAOA,MAAM,iBAAiB,aAAa,sBAAsB,qBAAqB,MAAM,CAAC;AAEtF,MAAa,eAAe,aAC1B,iBACA,gBAAgB,cAAc,CAAC,CAAC,KAAK,MAAM,QAAQ,cAAc,CAAC,CACpE,CAAC,CAAC,KAAK,MAAM,QAAQ,WAAW,CAAC;AAEjC,MAAa,mBAAmB,aAAa,kBAAkB,iBAAiB,MAAM,CAAC"}

package/dist/password/encoding.mjs

@@ -0,0 +1,64 @@
+import { PasswordVerifierInvalid } from "./errors.mjs";
+import { Effect, Encoding, Result, Schema } from "effect";
+//#region src/password/encoding.ts
+const Decimal = Schema.String.check(Schema.isPattern(/^[1-9][0-9]{0,7}$/)).pipe(Schema.decodeTo(Schema.FiniteFromString));
+const Base64 = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(86), Schema.isPattern(/^[A-Za-z0-9+/]+$/));
+const Base64Url = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(86), Schema.isPattern(/^[A-Za-z0-9_-]+$/));
+const Phc = Schema.TemplateLiteralParser([
+	"$argon2id$v=19$m=",
+	Decimal,
+	",t=",
+	Decimal,
+	",p=",
+	Decimal,
+	"$",
+	Base64,
+	"$",
+	Base64
+]);
+const Legacy = Schema.TemplateLiteralParser([
+	"pbkdf2-sha256$",
+	Decimal,
+	"$",
+	Base64Url,
+	"$",
+	Base64Url
+]);
+const Bounded = Schema.String.check(Schema.isMaxLength(512));
+const phcBase64 = (bytes) => Encoding.encodeBase64(bytes).replace(/=+$/u, "");
+const decodeBytes = Effect.fn("PasswordHash.decodeBytes")(function* (input, url, minimum, maximum) {
+	const decoded = Result.getOrUndefined(url ? Encoding.decodeBase64Url(input) : Encoding.decodeBase64(input.padEnd(Math.ceil(input.length / 4) * 4, "=")));
+	if (decoded === void 0) return yield* PasswordVerifierInvalid.make({ reason: "malformed" });
+	if (decoded.length < minimum || decoded.length > maximum || (url ? Encoding.encodeBase64Url(decoded) : phcBase64(decoded)) !== input) return yield* PasswordVerifierInvalid.make({ reason: "malformed" });
+	return decoded;
+});
+/** Invoke under admission: parse bounded metadata and reject costs before decoding
+* salt/output or allocating KDF memory. Only supported exact encodings are accepted.
+*/
+const parsePasswordHash = Effect.fn("parsePasswordHash")(function* (input, config) {
+	yield* Schema.decodeEffect(Bounded)(input).pipe(Effect.mapError(() => PasswordVerifierInvalid.make({ reason: "malformed" })));
+	if (input.startsWith("$argon2id$")) {
+		const [, memoryKiB, , passes, , parallelism, , salt, , expected] = yield* Schema.decodeUnknownEffect(Phc)(input).pipe(Effect.mapError(() => PasswordVerifierInvalid.make({ reason: "malformed" })));
+		if (memoryKiB < 8 * parallelism || memoryKiB > config.maximumMemoryKiB || passes > config.maximumPasses || parallelism > config.maximumParallelism || memoryKiB * passes > config.maximumMemoryPasses) return yield* PasswordVerifierInvalid.make({ reason: "work-limit" });
+		return {
+			_tag: "Argon2id",
+			memoryKiB,
+			passes,
+			parallelism,
+			salt: yield* decodeBytes(salt, false, 8, 48),
+			expected: yield* decodeBytes(expected, false, 16, 64)
+		};
+	}
+	const [, iterations, , salt, , expected] = yield* Schema.decodeUnknownEffect(Legacy)(input).pipe(Effect.mapError(() => PasswordVerifierInvalid.make({ reason: "malformed" })));
+	if (iterations > config.maximumLegacyIterations) return yield* PasswordVerifierInvalid.make({ reason: "work-limit" });
+	return {
+		_tag: "LegacyPbkdf2",
+		iterations,
+		salt: yield* decodeBytes(salt, true, 1, 64),
+		expected: yield* decodeBytes(expected, true, 32, 32)
+	};
+});
+//#endregion
+export { parsePasswordHash, phcBase64 };
+
+//# sourceMappingURL=encoding.mjs.map

package/dist/password/encoding.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.mjs","names":[],"sources":["../../src/password/encoding.ts"],"sourcesContent":["import { Effect, Encoding, Result, Schema } from \"effect\";\n\nimport type { PasswordHashingConfig } from \"./configuration\";\nimport { PasswordVerifierInvalid } from \"./errors\";\n\nconst Decimal = Schema.String.check(Schema.isPattern(/^[1-9][0-9]{0,7}$/)).pipe(\n  Schema.decodeTo(Schema.FiniteFromString),\n);\n\nconst Base64 = Schema.String.check(\n  Schema.isMinLength(1),\n  Schema.isMaxLength(86),\n  Schema.isPattern(/^[A-Za-z0-9+/]+$/),\n);\n\nconst Base64Url = Schema.String.check(\n  Schema.isMinLength(1),\n  Schema.isMaxLength(86),\n  Schema.isPattern(/^[A-Za-z0-9_-]+$/),\n);\n\nconst Phc = Schema.TemplateLiteralParser([\n  \"$argon2id$v=19$m=\",\n  Decimal,\n  \",t=\",\n  Decimal,\n  \",p=\",\n  Decimal,\n  \"$\",\n  Base64,\n  \"$\",\n  Base64,\n]);\n\nconst Legacy = Schema.TemplateLiteralParser([\n  \"pbkdf2-sha256$\",\n  Decimal,\n  \"$\",\n  Base64Url,\n  \"$\",\n  Base64Url,\n]);\n\nconst Bounded = Schema.String.check(Schema.isMaxLength(512));\n\nexport type ParsedPasswordHash =\n  | {\n      readonly _tag: \"Argon2id\";\n      readonly memoryKiB: number;\n      readonly passes: number;\n      readonly parallelism: number;\n      readonly salt: Uint8Array;\n      readonly expected: Uint8Array;\n    }\n  | {\n      readonly _tag: \"LegacyPbkdf2\";\n      readonly iterations: number;\n      readonly salt: Uint8Array;\n      readonly expected: Uint8Array;\n    };\n\nexport const phcBase64 = (bytes: Uint8Array) => Encoding.encodeBase64(bytes).replace(/=+$/u, \"\");\n\nconst decodeBytes = Effect.fn(\"PasswordHash.decodeBytes\")(function* (\n  input: string,\n  url: boolean,\n  minimum: number,\n  maximum: number,\n) {\n  const decoded = Result.getOrUndefined(\n    url\n      ? Encoding.decodeBase64Url(input)\n      : Encoding.decodeBase64(input.padEnd(Math.ceil(input.length / 4) * 4, \"=\")),\n  );\n\n  if (decoded === undefined) return yield* PasswordVerifierInvalid.make({ reason: \"malformed\" });\n  if (\n    decoded.length < minimum ||\n    decoded.length > maximum ||\n    (url ? Encoding.encodeBase64Url(decoded) : phcBase64(decoded)) !== input\n  )\n    return yield* PasswordVerifierInvalid.make({ reason: \"malformed\" });\n\n  return decoded;\n});\n\n/** Invoke under admission: parse bounded metadata and reject costs before decoding\n * salt/output or allocating KDF memory. Only supported exact encodings are accepted.\n */\nexport const parsePasswordHash = Effect.fn(\"parsePasswordHash\")(function* (\n  input: string,\n  config: PasswordHashingConfig,\n): Effect.fn.Return<ParsedPasswordHash, PasswordVerifierInvalid> {\n  yield* Schema.decodeEffect(Bounded)(input).pipe(\n    Effect.mapError(() => PasswordVerifierInvalid.make({ reason: \"malformed\" })),\n  );\n  if (input.startsWith(\"$argon2id$\")) {\n    const [, memoryKiB, , passes, , parallelism, , salt, , expected] =\n      // eslint-disable-next-line no-restricted-properties -- Persisted verifier strings have not yet proved this template literal encoding.\n      yield* Schema.decodeUnknownEffect(Phc)(input).pipe(\n        Effect.mapError(() => PasswordVerifierInvalid.make({ reason: \"malformed\" })),\n      );\n\n    if (\n      memoryKiB < 8 * parallelism ||\n      memoryKiB > config.maximumMemoryKiB ||\n      passes > config.maximumPasses ||\n      parallelism > config.maximumParallelism ||\n      memoryKiB * passes > config.maximumMemoryPasses\n    )\n      return yield* PasswordVerifierInvalid.make({ reason: \"work-limit\" });\n\n    return {\n      _tag: \"Argon2id\",\n      memoryKiB,\n      passes,\n      parallelism,\n      salt: yield* decodeBytes(salt, false, 8, 48),\n      expected: yield* decodeBytes(expected, false, 16, 64),\n    };\n  }\n\n  // eslint-disable-next-line no-restricted-properties -- Persisted legacy verifier strings are an untrusted storage boundary.\n  const [, iterations, , salt, , expected] = yield* Schema.decodeUnknownEffect(Legacy)(input).pipe(\n    Effect.mapError(() => PasswordVerifierInvalid.make({ reason: \"malformed\" })),\n  );\n\n  if (iterations > config.maximumLegacyIterations)\n    return yield* PasswordVerifierInvalid.make({ reason: \"work-limit\" });\n\n  return {\n    _tag: \"LegacyPbkdf2\",\n    iterations,\n    salt: yield* decodeBytes(salt, true, 1, 64),\n    expected: yield* decodeBytes(expected, true, 32, 32),\n  };\n});\n"],"mappings":";;;AAKA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,mBAAmB,CAAC,CAAC,CAAC,KACzE,OAAO,SAAS,OAAO,gBAAgB,CACzC;AAEA,MAAM,SAAS,OAAO,OAAO,MAC3B,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,GACrB,OAAO,UAAU,kBAAkB,CACrC;AAEA,MAAM,YAAY,OAAO,OAAO,MAC9B,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,GACrB,OAAO,UAAU,kBAAkB,CACrC;AAEA,MAAM,MAAM,OAAO,sBAAsB;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,SAAS,OAAO,sBAAsB;CAC1C;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;AAkB3D,MAAa,aAAa,UAAsB,SAAS,aAAa,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAE/F,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,OACA,KACA,SACA,SACA;CACA,MAAM,UAAU,OAAO,eACrB,MACI,SAAS,gBAAgB,KAAK,IAC9B,SAAS,aAAa,MAAM,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC,CAC9E;CAEA,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,YAAY,CAAC;CAC7F,IACE,QAAQ,SAAS,WACjB,QAAQ,SAAS,YAChB,MAAM,SAAS,gBAAgB,OAAO,IAAI,UAAU,OAAO,OAAO,OAEnE,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,YAAY,CAAC;CAEpE,OAAO;AACT,CAAC;;;;AAKD,MAAa,oBAAoB,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC9D,OACA,QAC+D;CAC/D,OAAO,OAAO,aAAa,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KACzC,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,YAAY,CAAC,CAAC,CAC7E;CACA,IAAI,MAAM,WAAW,YAAY,GAAG;EAClC,MAAM,GAAG,aAAa,UAAU,eAAe,QAAQ,YAErD,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAC5C,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,YAAY,CAAC,CAAC,CAC7E;EAEF,IACE,YAAY,IAAI,eAChB,YAAY,OAAO,oBACnB,SAAS,OAAO,iBAChB,cAAc,OAAO,sBACrB,YAAY,SAAS,OAAO,qBAE5B,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,aAAa,CAAC;EAErE,OAAO;GACL,MAAM;GACN;GACA;GACA;GACA,MAAM,OAAO,YAAY,MAAM,OAAO,GAAG,EAAE;GAC3C,UAAU,OAAO,YAAY,UAAU,OAAO,IAAI,EAAE;EACtD;CACF;CAGA,MAAM,GAAG,cAAc,QAAQ,YAAY,OAAO,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAC1F,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,YAAY,CAAC,CAAC,CAC7E;CAEA,IAAI,aAAa,OAAO,yBACtB,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,aAAa,CAAC;CAErE,OAAO;EACL,MAAM;EACN;EACA,MAAM,OAAO,YAAY,MAAM,MAAM,GAAG,EAAE;EAC1C,UAAU,OAAO,YAAY,UAAU,MAAM,IAAI,EAAE;CACrD;AACF,CAAC"}

package/dist/password/errors.d.mts

@@ -0,0 +1,28 @@
+import { Schema } from "effect";
+//#region src/password/errors.d.ts
+declare const PasswordHashingUnavailable_base: Schema.Class<PasswordHashingUnavailable, Schema.TaggedStruct<"PasswordHashingUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordHashingUnavailable extends PasswordHashingUnavailable_base {}
+declare const PasswordKdfBusy_base: Schema.Class<PasswordKdfBusy, Schema.TaggedStruct<"PasswordKdfBusy", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordKdfBusy extends PasswordKdfBusy_base {}
+declare const PasswordInputInvalid_base: Schema.Class<PasswordInputInvalid, Schema.TaggedStruct<"PasswordInputInvalid", {
+  readonly reason: Schema.Literals<readonly ["too-long", "ill-formed"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class PasswordInputInvalid extends PasswordInputInvalid_base {}
+declare const PasswordVerifierInvalid_base: Schema.Class<PasswordVerifierInvalid, Schema.TaggedStruct<"PasswordVerifierInvalid", {
+  readonly reason: Schema.Literals<readonly ["malformed", "work-limit"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Internal verifier diagnostics; authentication operations must use a uniform public failure. */
+declare class PasswordVerifierInvalid extends PasswordVerifierInvalid_base {}
+declare const PasswordConfigurationError_base: Schema.Class<PasswordConfigurationError, Schema.TaggedStruct<"PasswordConfigurationError", {
+  readonly component: Schema.Literals<readonly ["hashing", "admission", "policy"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class PasswordConfigurationError extends PasswordConfigurationError_base {}
+declare const NewPasswordRejected_base: Schema.Class<NewPasswordRejected, Schema.TaggedStruct<"NewPasswordRejected", {
+  readonly reason: Schema.Literals<readonly ["too-short", "too-long", "ill-formed", "compromised", "common", "contextual"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class NewPasswordRejected extends NewPasswordRejected_base {}
+declare const PasswordCheckUnavailable_base: Schema.Class<PasswordCheckUnavailable, Schema.TaggedStruct<"PasswordCheckUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordCheckUnavailable extends PasswordCheckUnavailable_base {}
+//#endregion
+export { NewPasswordRejected, PasswordCheckUnavailable, PasswordConfigurationError, PasswordHashingUnavailable, PasswordInputInvalid, PasswordKdfBusy, PasswordVerifierInvalid };
+//# sourceMappingURL=errors.d.mts.map

package/dist/password/errors.mjs

@@ -0,0 +1,25 @@
+import { Schema } from "effect";
+//#region src/password/errors.ts
+var PasswordHashingUnavailable = class extends Schema.TaggedError()("PasswordHashingUnavailable", {}) {};
+var PasswordKdfBusy = class extends Schema.TaggedError()("PasswordKdfBusy", {}) {};
+var PasswordInputInvalid = class extends Schema.TaggedError()("PasswordInputInvalid", { reason: Schema.Literals(["too-long", "ill-formed"]) }) {};
+/** Internal verifier diagnostics; authentication operations must use a uniform public failure. */
+var PasswordVerifierInvalid = class extends Schema.TaggedError()("PasswordVerifierInvalid", { reason: Schema.Literals(["malformed", "work-limit"]) }) {};
+var PasswordConfigurationError = class extends Schema.TaggedError()("PasswordConfigurationError", { component: Schema.Literals([
+	"hashing",
+	"admission",
+	"policy"
+]) }) {};
+var NewPasswordRejected = class extends Schema.TaggedError()("NewPasswordRejected", { reason: Schema.Literals([
+	"too-short",
+	"too-long",
+	"ill-formed",
+	"compromised",
+	"common",
+	"contextual"
+]) }) {};
+var PasswordCheckUnavailable = class extends Schema.TaggedError()("PasswordCheckUnavailable", {}) {};
+//#endregion
+export { NewPasswordRejected, PasswordCheckUnavailable, PasswordConfigurationError, PasswordHashingUnavailable, PasswordInputInvalid, PasswordKdfBusy, PasswordVerifierInvalid };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/password/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../src/password/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport class PasswordHashingUnavailable extends Schema.TaggedError<PasswordHashingUnavailable>()(\n  \"PasswordHashingUnavailable\",\n  {},\n) {}\n\nexport class PasswordKdfBusy extends Schema.TaggedError<PasswordKdfBusy>()(\"PasswordKdfBusy\", {}) {}\n\nexport class PasswordInputInvalid extends Schema.TaggedError<PasswordInputInvalid>()(\n  \"PasswordInputInvalid\",\n  { reason: Schema.Literals([\"too-long\", \"ill-formed\"]) },\n) {}\n\n/** Internal verifier diagnostics; authentication operations must use a uniform public failure. */\nexport class PasswordVerifierInvalid extends Schema.TaggedError<PasswordVerifierInvalid>()(\n  \"PasswordVerifierInvalid\",\n  { reason: Schema.Literals([\"malformed\", \"work-limit\"]) },\n) {}\n\nexport class PasswordConfigurationError extends Schema.TaggedError<PasswordConfigurationError>()(\n  \"PasswordConfigurationError\",\n  { component: Schema.Literals([\"hashing\", \"admission\", \"policy\"]) },\n) {}\n\nexport class NewPasswordRejected extends Schema.TaggedError<NewPasswordRejected>()(\n  \"NewPasswordRejected\",\n  {\n    reason: Schema.Literals([\n      \"too-short\",\n      \"too-long\",\n      \"ill-formed\",\n      \"compromised\",\n      \"common\",\n      \"contextual\",\n    ]),\n  },\n) {}\n\nexport class PasswordCheckUnavailable extends Schema.TaggedError<PasswordCheckUnavailable>()(\n  \"PasswordCheckUnavailable\",\n  {},\n) {}\n"],"mappings":";;AAEA,IAAa,6BAAb,cAAgD,OAAO,YAAwC,CAAC,CAC9F,8BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnG,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA,EAAE,QAAQ,OAAO,SAAS,CAAC,YAAY,YAAY,CAAC,EAAE,CACxD,CAAC,CAAC,CAAC;;AAGH,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,EAAE,QAAQ,OAAO,SAAS,CAAC,aAAa,YAAY,CAAC,EAAE,CACzD,CAAC,CAAC,CAAC;AAEH,IAAa,6BAAb,cAAgD,OAAO,YAAwC,CAAC,CAC9F,8BACA,EAAE,WAAW,OAAO,SAAS;CAAC;CAAW;CAAa;AAAQ,CAAC,EAAE,CACnE,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,2BAAb,cAA8C,OAAO,YAAsC,CAAC,CAC1F,4BACA,CAAC,CACH,CAAC,CAAC,CAAC"}

package/dist/password/methods/PasswordActionEvidence.d.mts

@@ -0,0 +1,38 @@
+import { AuthInvocation } from "../../operations/context.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement } from "../../sessions/models.mjs";
+import { PasswordActionRequired, PasswordUnavailable } from "./errors.mjs";
+import { PasswordActionChallenge } from "./models.mjs";
+import { ProofCompletionInput } from "../../proofs/ProofPersistence.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/password/methods/PasswordActionEvidence.d.ts
+declare const PasswordActionEvidence_base: Context.ServiceClass<PasswordActionEvidence, "effect-auth/PasswordActionEvidence", {
+  readonly verify: (input: {
+    readonly challenge: PasswordActionChallenge;
+    readonly invocation: AuthInvocation;
+    readonly proof?: Redacted.Redacted<string>;
+    readonly currentPasswordEvidence?: AuthenticationEvidence;
+    readonly recovery?: ProofCompletionInput;
+  }) => Effect.Effect<{
+    readonly evidence: AuthenticationEvidence;
+    readonly requirement: AuthenticationRequirement;
+  }, PasswordActionRequired | PasswordUnavailable>;
+}>;
+/** Independently verify action-specific evidence against this exact challenge.
+ * proof means fresh independently verifiable input for THIS call. Hashing uses
+ * a new salt each retry: a grant bound to an earlier challenge cannot be resumed
+ * here. Such a workflow requires a separately persisted replacement intent.
+ * Consume replay-sensitive factor input in its OWN authority before returning.
+ * A later rejected password mutation does not refund that factor; retries need
+ * fresh evidence. Mere replay-counter/code consumption preserves semantic factor
+ * revision; factor replacement/revocation changes it and wins the final password CAS.
+ * This port has no atomic factor-consumption/password-write plan.
+ * No default permits mutation. Login-pending credentials are not action grants.
+ * A session is usable only with current revision/factor authority; an unexpired
+ * pure-stateless caller alone does not prove current credential-change authority.
+ * Current recovery policy may accept a reset continuation for a single-factor
+ * subject, but it must never erase/bypass enabled MFA. No client factor assertions.
+ */
+declare class PasswordActionEvidence extends PasswordActionEvidence_base {}
+//#endregion
+export { PasswordActionEvidence };
+//# sourceMappingURL=PasswordActionEvidence.d.mts.map

package/dist/password/methods/PasswordActionEvidence.mjs

@@ -0,0 +1,22 @@
+import { Context } from "effect";
+//#region src/password/methods/PasswordActionEvidence.ts
+/** Independently verify action-specific evidence against this exact challenge.
+* proof means fresh independently verifiable input for THIS call. Hashing uses
+* a new salt each retry: a grant bound to an earlier challenge cannot be resumed
+* here. Such a workflow requires a separately persisted replacement intent.
+* Consume replay-sensitive factor input in its OWN authority before returning.
+* A later rejected password mutation does not refund that factor; retries need
+* fresh evidence. Mere replay-counter/code consumption preserves semantic factor
+* revision; factor replacement/revocation changes it and wins the final password CAS.
+* This port has no atomic factor-consumption/password-write plan.
+* No default permits mutation. Login-pending credentials are not action grants.
+* A session is usable only with current revision/factor authority; an unexpired
+* pure-stateless caller alone does not prove current credential-change authority.
+* Current recovery policy may accept a reset continuation for a single-factor
+* subject, but it must never erase/bypass enabled MFA. No client factor assertions.
+*/
+var PasswordActionEvidence = class extends Context.Service()("effect-auth/PasswordActionEvidence") {};
+//#endregion
+export { PasswordActionEvidence };
+
+//# sourceMappingURL=PasswordActionEvidence.mjs.map

package/dist/password/methods/PasswordActionEvidence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordActionEvidence.mjs","names":[],"sources":["../../../src/password/methods/PasswordActionEvidence.ts"],"sourcesContent":["import { Context, type Effect, type Redacted } from \"effect\";\n\nimport type { AuthInvocation } from \"../../operations/context\";\nimport type { ProofCompletionInput } from \"../../proofs/ProofPersistence\";\nimport type { AuthenticationEvidence, AuthenticationRequirement } from \"../../sessions/models\";\nimport type { PasswordActionRequired, PasswordUnavailable } from \"./errors\";\nimport type { PasswordActionChallenge } from \"./models\";\n\n/** Independently verify action-specific evidence against this exact challenge.\n * proof means fresh independently verifiable input for THIS call. Hashing uses\n * a new salt each retry: a grant bound to an earlier challenge cannot be resumed\n * here. Such a workflow requires a separately persisted replacement intent.\n * Consume replay-sensitive factor input in its OWN authority before returning.\n * A later rejected password mutation does not refund that factor; retries need\n * fresh evidence. Mere replay-counter/code consumption preserves semantic factor\n * revision; factor replacement/revocation changes it and wins the final password CAS.\n * This port has no atomic factor-consumption/password-write plan.\n * No default permits mutation. Login-pending credentials are not action grants.\n * A session is usable only with current revision/factor authority; an unexpired\n * pure-stateless caller alone does not prove current credential-change authority.\n * Current recovery policy may accept a reset continuation for a single-factor\n * subject, but it must never erase/bypass enabled MFA. No client factor assertions.\n */\nexport class PasswordActionEvidence extends Context.Service<\n  PasswordActionEvidence,\n  {\n    readonly verify: (input: {\n      readonly challenge: PasswordActionChallenge;\n      readonly invocation: AuthInvocation;\n      readonly proof?: Redacted.Redacted<string>;\n      readonly currentPasswordEvidence?: AuthenticationEvidence;\n      readonly recovery?: ProofCompletionInput;\n    }) => Effect.Effect<\n      {\n        readonly evidence: AuthenticationEvidence;\n        readonly requirement: AuthenticationRequirement;\n      },\n      PasswordActionRequired | PasswordUnavailable\n    >;\n  }\n>()(\"effect-auth/PasswordActionEvidence\") {}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuBA,IAAa,yBAAb,cAA4C,QAAQ,QAiBlD,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC"}

package/dist/password/methods/PasswordPersistence.d.mts

@@ -0,0 +1,102 @@
+import { SubjectId } from "../../Schema.mjs";
+import { AuthenticationRevision, SecurityRevision } from "../../sessions/models.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { CommitJournal, PreparedCommit } from "../../hooks/commit.mjs";
+import { SessionInvalidationWindow } from "../../sessions/invalidation.mjs";
+import { PasswordUnavailable } from "./errors.mjs";
+import { PasswordActionAuthorization, PasswordAttemptAdmission, PasswordAttemptDecision, PasswordAttemptId, PasswordCommandId, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordReplacement } from "./models.mjs";
+import { ProofCompletionInput } from "../../proofs/ProofPersistence.mjs";
+import { ProofCompletionPlan } from "../../proofs/completion.mjs";
+import { EncodedPasswordHash } from "../models.mjs";
+import { PasswordAttemptPolicy } from "./policy.mjs";
+import { Context, Effect, Option, Redacted } from "effect";
+//#region src/password/methods/PasswordPersistence.d.ts
+type PreparePasswordCommit<Value, A> = (value: Value, journal: CommitJournal) => PreparedCommit<A>;
+interface PasswordMutationInput {
+  readonly moduleId: string;
+  readonly commandId: PasswordCommandId;
+  readonly expectedRevision: AuthenticationRevision;
+  readonly credential?: PasswordCredentialSnapshot;
+  readonly replacement: PasswordReplacement;
+  readonly authorization: PasswordActionAuthorization;
+  readonly invalidation: SessionInvalidationWindow;
+}
+declare const PasswordPersistence_base: Context.ServiceClass<PasswordPersistence, "effect-auth/PasswordPersistence", {
+  /** Charge existence-independent identifier/action + known-subject rolling windows
+   * and bounded in-flight admissions before KDF. Capture active subject, identifier,
+   * actual credential and semantic revisions atomically (shared authority.capture
+   * predicate). Unknown/disabled/missing/corrupt/subject-limited return no verifier.
+   * Denial shape never reveals which bucket. No refund on interruption/abandonment;
+   * expired pending attempts remain conservatively charged through window horizons.
+   */
+  readonly admitAttempt: <A>(input: {
+    readonly moduleId: string;
+    readonly action: "sign-in" | "change";
+    readonly identifier: LoginIdentifier;
+    readonly subjectId?: SubjectId;
+    readonly policy: PasswordAttemptPolicy;
+  }, prepare: PreparePasswordCommit<PasswordAttemptAdmission, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Single-use settlement. verified requires SAME captured semantic revisions and
+   * attempt ownership. Rehash CAS includes old verifier/version, changes verifierVersion
+   * only and never semantic/security revisions or a newer credential's counters.
+   * A CAS miss cannot become unconditional replacement. This does NOT issue auth.
+   * Later session approval compares this same subject securityRevision. Identifier
+   * remove/rebind/verification changes that invalidate login MUST bump it atomically;
+   * identifierBindingRevision alone is not represented in AuthenticationRevision.
+   */
+  readonly settleAttempt: <A>(input: {
+    readonly moduleId: string;
+    readonly attemptId: PasswordAttemptId;
+    readonly captured?: PasswordCredentialSnapshot;
+    readonly outcome: PasswordAttemptDecision;
+    readonly rehash?: {
+      readonly expectedVersion: SecurityRevision;
+      readonly expectedVerifier: Redacted.Redacted<EncodedPasswordHash>;
+      readonly nextVerifier: Redacted.Redacted<EncodedPasswordHash>;
+    };
+  }, prepare: PreparePasswordCommit<PasswordAttemptDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  readonly readForSubject: (input: {
+    readonly moduleId: string;
+    readonly subjectId: SubjectId;
+  }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+  /** Only eligible verified identifiers; return None for absent/inactive/ineligible. */
+  readonly recoveryTarget: (input: {
+    readonly moduleId: string;
+    readonly identifier: LoginIdentifier;
+  }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+  /** Require absence, current revisions/action+factor policy/fresh clock. */
+  readonly addIfAbsent: <A>(input: PasswordMutationInput, prepare: PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Exact credential CAS, current action policy/freshness; bump semantic credential
+   * and subject security revisions + pending/session invalidation in SAME authority.
+   */
+  readonly replaceIfCurrent: <A>(input: PasswordMutationInput, prepare: PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Authoritative nonconsuming preflight before exposing new-password policy
+   * results or doing KDF work. Final resetWithProof repeats every predicate/CAS.
+   */
+  readonly checkReset: (input: ProofCompletionInput) => Effect.Effect<boolean, PasswordUnavailable>;
+  /** Compose proof predicates + replacement/invalidation atomically. Never call an
+   * independently committing ProofPersistence.complete. completed iff ALL apply.
+   * D1 preplans before batch; exact lost guard discards success journal before a
+   * separate zero-write rejected receipt. Unknown SQL failure remains unavailable.
+   */
+  readonly resetWithProof: <A>(input: PasswordMutationInput & {
+    readonly completion: ProofCompletionPlan;
+  }, prepare: PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  readonly cleanupAttempts: <A>(input: {
+    readonly moduleId: string;
+    readonly limit: number;
+  }, prepare: PreparePasswordCommit<{
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+}>;
+/** Semantic authority. All mutations prepare before root physical commit and
+ * join only an explicitly matching outer authority. Prepared method plans expose
+ * a commit Effect that resolves its authority from Effect context at execution.
+ * Provide the transaction-bound implementation there. A root service must reject ambient
+ * use it cannot join before writes. No generic get/put/upsert.
+ */
+declare class PasswordPersistence extends PasswordPersistence_base {}
+//#endregion
+export { PasswordMutationInput, PasswordPersistence, PreparePasswordCommit };
+//# sourceMappingURL=PasswordPersistence.d.mts.map

package/dist/password/methods/PasswordPersistence.mjs

@@ -0,0 +1,13 @@
+import { Context } from "effect";
+//#region src/password/methods/PasswordPersistence.ts
+/** Semantic authority. All mutations prepare before root physical commit and
+* join only an explicitly matching outer authority. Prepared method plans expose
+* a commit Effect that resolves its authority from Effect context at execution.
+* Provide the transaction-bound implementation there. A root service must reject ambient
+* use it cannot join before writes. No generic get/put/upsert.
+*/
+var PasswordPersistence = class extends Context.Service()("effect-auth/PasswordPersistence") {};
+//#endregion
+export { PasswordPersistence };
+
+//# sourceMappingURL=PasswordPersistence.mjs.map

package/dist/password/methods/PasswordPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordPersistence.mjs","names":[],"sources":["../../../src/password/methods/PasswordPersistence.ts"],"sourcesContent":["import { Context, type Effect, type Option, type Redacted } from \"effect\";\n\nimport type { CommitJournal, PreparedCommit } from \"../../hooks/commit\";\nimport type { LoginIdentifier } from \"../../identity/models\";\nimport type { ProofCompletionPlan } from \"../../proofs/completion\";\nimport type { ProofCompletionInput } from \"../../proofs/ProofPersistence\";\nimport type { SubjectId } from \"../../Schema\";\nimport type { SessionInvalidationWindow } from \"../../sessions/invalidation\";\nimport type { AuthenticationRevision, SecurityRevision } from \"../../sessions/models\";\nimport type { EncodedPasswordHash } from \"../models\";\nimport type { PasswordUnavailable } from \"./errors\";\nimport type {\n  PasswordActionAuthorization,\n  PasswordAttemptAdmission,\n  PasswordAttemptDecision,\n  PasswordAttemptId,\n  PasswordCommandId,\n  PasswordCredentialSnapshot,\n  PasswordMutationDecision,\n  PasswordReplacement,\n} from \"./models\";\nimport type { PasswordAttemptPolicy } from \"./policy\";\n\nexport type PreparePasswordCommit<Value, A> = (\n  value: Value,\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\nexport interface PasswordMutationInput {\n  readonly moduleId: string;\n  readonly commandId: PasswordCommandId;\n  readonly expectedRevision: AuthenticationRevision;\n  readonly credential?: PasswordCredentialSnapshot;\n  readonly replacement: PasswordReplacement;\n  readonly authorization: PasswordActionAuthorization;\n  readonly invalidation: SessionInvalidationWindow;\n}\n\n/** Semantic authority. All mutations prepare before root physical commit and\n * join only an explicitly matching outer authority. Prepared method plans expose\n * a commit Effect that resolves its authority from Effect context at execution.\n * Provide the transaction-bound implementation there. A root service must reject ambient\n * use it cannot join before writes. No generic get/put/upsert.\n */\nexport class PasswordPersistence extends Context.Service<\n  PasswordPersistence,\n  {\n    /** Charge existence-independent identifier/action + known-subject rolling windows\n     * and bounded in-flight admissions before KDF. Capture active subject, identifier,\n     * actual credential and semantic revisions atomically (shared authority.capture\n     * predicate). Unknown/disabled/missing/corrupt/subject-limited return no verifier.\n     * Denial shape never reveals which bucket. No refund on interruption/abandonment;\n     * expired pending attempts remain conservatively charged through window horizons.\n     */\n    readonly admitAttempt: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly action: \"sign-in\" | \"change\";\n        readonly identifier: LoginIdentifier;\n        readonly subjectId?: SubjectId;\n        readonly policy: PasswordAttemptPolicy;\n      },\n      prepare: PreparePasswordCommit<PasswordAttemptAdmission, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n    /** Single-use settlement. verified requires SAME captured semantic revisions and\n     * attempt ownership. Rehash CAS includes old verifier/version, changes verifierVersion\n     * only and never semantic/security revisions or a newer credential's counters.\n     * A CAS miss cannot become unconditional replacement. This does NOT issue auth.\n     * Later session approval compares this same subject securityRevision. Identifier\n     * remove/rebind/verification changes that invalidate login MUST bump it atomically;\n     * identifierBindingRevision alone is not represented in AuthenticationRevision.\n     */\n    readonly settleAttempt: <A>(\n      input: {\n        readonly moduleId: string;\n        readonly attemptId: PasswordAttemptId;\n        readonly captured?: PasswordCredentialSnapshot;\n        readonly outcome: PasswordAttemptDecision;\n        readonly rehash?: {\n          readonly expectedVersion: SecurityRevision;\n          readonly expectedVerifier: Redacted.Redacted<EncodedPasswordHash>;\n          readonly nextVerifier: Redacted.Redacted<EncodedPasswordHash>;\n        };\n      },\n      prepare: PreparePasswordCommit<PasswordAttemptDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n    readonly readForSubject: (input: {\n      readonly moduleId: string;\n      readonly subjectId: SubjectId;\n    }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;\n    /** Only eligible verified identifiers; return None for absent/inactive/ineligible. */\n    readonly recoveryTarget: (input: {\n      readonly moduleId: string;\n      readonly identifier: LoginIdentifier;\n    }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;\n    /** Require absence, current revisions/action+factor policy/fresh clock. */\n    readonly addIfAbsent: <A>(\n      input: PasswordMutationInput,\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n    /** Exact credential CAS, current action policy/freshness; bump semantic credential\n     * and subject security revisions + pending/session invalidation in SAME authority.\n     */\n    readonly replaceIfCurrent: <A>(\n      input: PasswordMutationInput,\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n    /** Authoritative nonconsuming preflight before exposing new-password policy\n     * results or doing KDF work. Final resetWithProof repeats every predicate/CAS.\n     */\n    readonly checkReset: (\n      input: ProofCompletionInput,\n    ) => Effect.Effect<boolean, PasswordUnavailable>;\n    /** Compose proof predicates + replacement/invalidation atomically. Never call an\n     * independently committing ProofPersistence.complete. completed iff ALL apply.\n     * D1 preplans before batch; exact lost guard discards success journal before a\n     * separate zero-write rejected receipt. Unknown SQL failure remains unavailable.\n     */\n    readonly resetWithProof: <A>(\n      input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n    readonly cleanupAttempts: <A>(\n      input: { readonly moduleId: string; readonly limit: number },\n      prepare: PreparePasswordCommit<{ readonly removed: number; readonly hasMore: boolean }, A>,\n    ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n  }\n>()(\"effect-auth/PasswordPersistence\") {}\n"],"mappings":";;;;;;;;AA4CA,IAAa,sBAAb,cAAyC,QAAQ,QAmF/C,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC"}

package/dist/password/methods/PasswordPreparedPersistence.d.mts

@@ -0,0 +1,111 @@
+import { SubjectId } from "../../Schema.mjs";
+import { AuthenticationRequirement } from "../../sessions/models.mjs";
+import { PreparedCommit } from "../../hooks/commit.mjs";
+import { SessionInvalidationWindow } from "../../sessions/invalidation.mjs";
+import { PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import { PasswordAction, PasswordCommandId, PasswordMutationDecision } from "./models.mjs";
+import { ProofCompletionInput } from "../../proofs/ProofPersistence.mjs";
+import { ProofCompletionPlan } from "../../proofs/completion.mjs";
+import { PasswordMutationInput, PreparePasswordCommit } from "./PasswordPersistence.mjs";
+import { PasswordPreparedConfiguration, PasswordPreparedIntentId, PasswordPreparedReady, PasswordPreparedReservation, PasswordPreparedReset } from "./preparedModels.mjs";
+import { Effect } from "effect";
+//#region src/password/methods/PasswordPreparedPersistence.d.ts
+interface PasswordPreparedMutation {
+  readonly intent: PasswordPreparedReady;
+  readonly mutation: PasswordMutationInput;
+  readonly capturedRequirement: AuthenticationRequirement;
+  readonly currentRequirement: AuthenticationRequirement;
+  readonly nowMillis: number;
+}
+type PasswordPreparedReserveDecision = {
+  readonly _tag: "Existing";
+} | {
+  readonly _tag: "Reserved";
+  readonly reservation: PasswordPreparedReservation;
+};
+/** Optional semantic authority, separate from ordinary PasswordPersistence. Every
+ * callback is synchronous preparation before the actual root commit. A self-owned
+ * method rejects an ambient owner it cannot join. Never compose independently
+ * committed password, intent or proof writes to implement these commands.
+ */
+interface PasswordPreparedPersistence {
+  /** Committed admission before KDF. Enforce module/command uniqueness across all
+   * actions and subjects through retention, action+subject rolling budgets and
+   * active Preparing+Ready cap. For the admission identifier bucket use the
+   * known canonical credential identifier, or the subject key for Add; the
+   * admission counters and reservation must commit under the SAME authority.
+   * Cap/budget denial is PasswordUnavailable, never Existing; no denial charge
+   * commit is required. Return Existing only after the action's authority check. A winner
+   * captures current subject/credential revisions and authoritative ACTION policy
+   * in the same owner. Change/Reset require an existing exact credential; Add absence.
+   * Reset repeats supplied proof preflight but does not consume it. No takeover or
+   * resume of Preparing; a crashed winner needs a new command. */
+  readonly reserve: <A>(input: {
+    readonly moduleId: string;
+    readonly generation: number;
+    readonly intentId: PasswordPreparedIntentId;
+    readonly commandId: PasswordCommandId;
+    readonly action: PasswordAction;
+    readonly subjectId: SubjectId;
+    readonly nowMillis: number;
+    readonly policy: PasswordPreparedConfiguration;
+    readonly invalidation: SessionInvalidationWindow;
+    readonly reset?: PasswordPreparedReset;
+    readonly completion?: ProofCompletionInput;
+  }, prepare: PreparePasswordCommit<PasswordPreparedReserveDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Exact Preparing version/current revision/lease CAS; attach immutable material,
+   * never overwrite or return another Ready. A changed transition owns this matching
+   * digest and bearer. Unknown commit remains unavailable, never reissues a bearer. */
+  readonly publishReady: <A>(input: {
+    readonly reservation: PasswordPreparedReservation;
+    readonly ready: PasswordPreparedReady;
+    readonly nowMillis: number;
+  }, prepare: PreparePasswordCommit<"published" | "rejected", A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Ready only: recheck module/generation/digest/time, active subject, identifier,
+   * semantic and verifier CAS plus current ACTION policy. No Claims decoder. */
+  readonly context: (input: {
+    readonly moduleId: string;
+    readonly generation: number;
+    readonly digest: PasswordPreparedReady["digest"];
+    readonly nowMillis: number;
+  }) => Effect.Effect<{
+    readonly record: PasswordPreparedReady;
+    readonly currentRequirement: AuthenticationRequirement;
+  }, PasswordRejected | PasswordUnavailable>;
+  /** ONE owner consumes exact Ready/version/digest, applies Add/Replace, semantic
+   * revision bumps, required invalidation and command marker. At commit clock check
+   * provider AND captured AND current action requirements, all original revision
+   * entries and Change proof timestamps. Re-read under subject→identifier→sorted
+   * credentials→intent lock order. Exact zero-write postconditions roll back all.
+   * Every authoritative ACTION-policy change must atomically bump subject
+   * securityRevision; this fences queued D1 changes without a policy-only read.
+   * Native/D1 known losers may create an adapter-owned rejected receipt; never replay
+   * a consumer callback or an unknown batch. */
+  readonly complete: <A>(input: PasswordPreparedMutation, prepare: PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Same transition plus original exact proof continuation consume. The supplied
+   * plan was recreated with its original bearer, not serialized from the intent. */
+  readonly resetWithProof: <A>(input: PasswordPreparedMutation & {
+    readonly completion: ProofCompletionPlan;
+  }, prepare: PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Cancel only this live digest/version. Retain command tombstone/admission through
+   * retainUntil; cancellation never makes old command IDs available for takeover. */
+  readonly cancel: <A>(input: {
+    readonly record: PasswordPreparedReady;
+    readonly nowMillis: number;
+  }, prepare: PreparePasswordCommit<boolean, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+  /** Bounded, authoritative hasMore. Erase expired sensitive material while retaining
+   * command tombstones and active admission charges until their independent horizons.
+   * Touch at most limit distinct records, including erase-only tombstones. removed
+   * counts fully deleted rows; hasMore covers remaining due erasure OR deletion. */
+  readonly cleanup: <A>(input: {
+    readonly moduleId: string;
+    readonly limit: number;
+    readonly nowMillis: number;
+  }, prepare: PreparePasswordCommit<{
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+}
+//#endregion
+export { PasswordPreparedMutation, PasswordPreparedPersistence, PasswordPreparedReserveDecision };
+//# sourceMappingURL=PasswordPreparedPersistence.d.mts.map