@yielded/auth 0.1.0-beta.1

package/dist/password/methods/definition.mjs

@@ -0,0 +1,56 @@
+import { snapshotPasswordMethodPolicy } from "./policy.mjs";
+import { snapshotProofConfiguration } from "../../proofs/module.mjs";
+import { makePasswordSignIn } from "./signIn.mjs";
+import { makePasswordMethod } from "./module.mjs";
+//#region src/password/methods/definition.ts
+const captureSignIn = (_namespace, input) => {
+	return { options: Object.freeze({
+		...input,
+		policy: input.policy === void 0 ? void 0 : snapshotPasswordMethodPolicy(input.policy)
+	}) };
+};
+const bindSignIn = (binding, captured) => {
+	const { options } = captured;
+	return makePasswordSignIn(binding.namespace, {
+		...options,
+		sessions: binding.sessions
+	});
+};
+const signIn = (namespace, input) => {
+	const captured = captureSignIn(namespace, input);
+	const bind = (binding) => bindSignIn(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+const captureManagement = (_namespace, input) => {
+	return { options: Object.freeze({
+		...input,
+		policy: snapshotPasswordMethodPolicy(input.policy),
+		reset: snapshotProofConfiguration(input.reset)
+	}) };
+};
+const bindManagement = (binding, captured) => {
+	const { options } = captured;
+	return makePasswordMethod(binding.namespace, {
+		...options,
+		sessions: binding.sessions
+	});
+};
+const management = (namespace, input) => {
+	const captured = captureManagement(namespace, input);
+	const bind = (binding) => bindManagement(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+/** Existing-account sign-in is the default; registration and password changes are explicit. */
+function make(options = {}) {
+	return "registration" in options ? management(options.namespace, options) : signIn(options.namespace, options);
+}
+//#endregion
+export { make };
+
+//# sourceMappingURL=definition.mjs.map

package/dist/password/methods/definition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.mjs","names":[],"sources":["../../../src/password/methods/definition.ts"],"sourcesContent":["import type {\n  BindingOf,\n  ClaimsCodec,\n  StrategyBinding,\n  StrategyDefinition,\n  StrategyTypeLambda,\n} from \"../../auth/definition\";\nimport type { ProofKeyring, ProofSecretPolicy } from \"../../proofs/crypto\";\nimport { snapshotProofConfiguration } from \"../../proofs/module\";\nimport type { ProofPolicy } from \"../../proofs/policy\";\nimport { makePasswordMethod } from \"./module\";\nimport { type PasswordMethodPolicy, snapshotPasswordMethodPolicy } from \"./policy\";\nimport { makePasswordSignIn } from \"./signIn\";\n\nexport interface PasswordOptions<Namespace extends string | undefined = undefined> {\n  readonly namespace?: Namespace;\n  readonly policy?: PasswordMethodPolicy;\n}\n\nexport interface PasswordManagementOptions<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined = undefined,\n> extends PasswordOptions<Namespace> {\n  readonly registration: Registration;\n  readonly policy: PasswordMethodPolicy;\n  readonly reset: {\n    readonly template: string;\n    readonly secret: ProofSecretPolicy;\n    readonly policy: ProofPolicy;\n    readonly keys?: ProofKeyring;\n  };\n}\n\nconst captureSignIn = <const Namespace extends string | undefined = undefined>(\n  _namespace: Namespace,\n  input: PasswordOptions<Namespace>,\n) => {\n  const options = Object.freeze({\n    ...input,\n    policy: input.policy === undefined ? undefined : snapshotPasswordMethodPolicy(input.policy),\n  });\n\n  return { options };\n};\n\nconst bindSignIn = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureSignIn<Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makePasswordSignIn<Id, SessionId, Claims>(binding.namespace, {\n    ...options,\n    sessions: binding.sessions,\n  });\n};\n\nexport interface SignInStrategy<\n  Namespace extends string | undefined = undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindSignIn<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst signIn = <const Namespace extends string | undefined = undefined>(\n  namespace: Namespace,\n  input: PasswordOptions<Namespace>,\n) => {\n  const captured = captureSignIn<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindSignIn<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<SignInStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nconst captureManagement = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  _namespace: Namespace,\n  input: PasswordManagementOptions<Registration, Namespace>,\n) => {\n  const options = Object.freeze({\n    ...input,\n    policy: snapshotPasswordMethodPolicy(input.policy),\n    reset: snapshotProofConfiguration(input.reset),\n  });\n\n  return { options };\n};\n\nconst bindManagement = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureManagement<Registration, Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makePasswordMethod<Id, SessionId, Claims, Registration>(binding.namespace, {\n    ...options,\n    sessions: binding.sessions,\n  });\n};\n\nexport interface ManagementStrategy<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined = undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindManagement<\n      Registration,\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst management = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  namespace: Namespace,\n  input: PasswordManagementOptions<Registration, Namespace>,\n) => {\n  const captured = captureManagement<Registration, Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindManagement<Registration, Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<ManagementStrategy<Registration, Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function make<Registration extends ClaimsCodec, const Namespace extends string>(\n  options: PasswordManagementOptions<Registration, Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof management<Registration, Namespace>>;\n\nexport function make<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  options: PasswordManagementOptions<Registration, Namespace>,\n): ReturnType<typeof management<Registration, Namespace | undefined>>;\n\nexport function make<const Namespace extends string>(\n  options: PasswordOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof signIn<Namespace>>;\n\nexport function make<const Namespace extends string | undefined = undefined>(\n  options?: PasswordOptions<Namespace>,\n): ReturnType<typeof signIn<Namespace | undefined>>;\n\n/** Existing-account sign-in is the default; registration and password changes are explicit. */\nexport function make<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(options: PasswordOptions<Namespace> | PasswordManagementOptions<Registration, Namespace> = {}) {\n  return \"registration\" in options\n    ? management(options.namespace, options)\n    : signIn(options.namespace, options);\n}\n"],"mappings":";;;;;AAiCA,MAAM,iBACJ,YACA,UACG;CAMH,OAAO,EAAE,SALO,OAAO,OAAO;EAC5B,GAAG;EACH,QAAQ,MAAM,WAAW,KAAA,IAAY,KAAA,IAAY,6BAA6B,MAAM,MAAM;CAC5F,CAEe,EAAE;AACnB;AAEA,MAAM,cAMJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,mBAA0C,QAAQ,WAAW;EAClE,GAAG;EACH,UAAU,QAAQ;CACpB,CAAC;AACH;AAeA,MAAM,UACJ,WACA,UACG;CACH,MAAM,WAAW,cAAyB,WAAW,KAAK;CAE1D,MAAM,QAKJ,YACG,WAA6C,SAAS,QAAQ;CAOnE,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAEA,MAAM,qBAIJ,YACA,UACG;CAOH,OAAO,EAAE,SANO,OAAO,OAAO;EAC5B,GAAG;EACH,QAAQ,6BAA6B,MAAM,MAAM;EACjD,OAAO,2BAA2B,MAAM,KAAK;CAC/C,CAEe,EAAE;AACnB;AAEA,MAAM,kBAOJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,mBAAwD,QAAQ,WAAW;EAChF,GAAG;EACH,UAAU,QAAQ;CACpB,CAAC;AACH;AAiBA,MAAM,cAIJ,WACA,UACG;CACH,MAAM,WAAW,kBAA2C,WAAW,KAAK;CAE5E,MAAM,QAKJ,YACG,eAA+D,SAAS,QAAQ;CAOrF,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;;AAsBA,SAAgB,KAGd,UAA2F,CAAC,GAAG;CAC/F,OAAO,kBAAkB,UACrB,WAAW,QAAQ,WAAW,OAAO,IACrC,OAAO,QAAQ,WAAW,OAAO;AACvC"}

package/dist/password/methods/errors.d.mts

@@ -0,0 +1,15 @@
+import { Schema } from "effect";
+//#region src/password/methods/errors.d.ts
+declare const PasswordRejected_base: Schema.Class<PasswordRejected, Schema.TaggedStruct<"PasswordRejected", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordRejected extends PasswordRejected_base {}
+declare const PasswordUnavailable_base: Schema.Class<PasswordUnavailable, Schema.TaggedStruct<"PasswordUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordUnavailable extends PasswordUnavailable_base {}
+declare const PasswordActionRequired_base: Schema.Class<PasswordActionRequired, Schema.TaggedStruct<"PasswordActionRequired", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordActionRequired extends PasswordActionRequired_base {}
+declare const PasswordMethodUnsupported_base: Schema.Class<PasswordMethodUnsupported, Schema.TaggedStruct<"PasswordMethodUnsupported", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordMethodUnsupported extends PasswordMethodUnsupported_base {}
+declare const PasswordMethodConfigurationError_base: Schema.Class<PasswordMethodConfigurationError, Schema.TaggedStruct<"PasswordMethodConfigurationError", {}>, import("effect/Cause").YieldableError>;
+declare class PasswordMethodConfigurationError extends PasswordMethodConfigurationError_base {}
+//#endregion
+export { PasswordActionRequired, PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable };
+//# sourceMappingURL=errors.d.mts.map

package/dist/password/methods/errors.mjs

@@ -0,0 +1,11 @@
+import { Schema } from "effect";
+//#region src/password/methods/errors.ts
+var PasswordRejected = class extends Schema.TaggedError()("PasswordRejected", {}) {};
+var PasswordUnavailable = class extends Schema.TaggedError()("PasswordUnavailable", {}) {};
+var PasswordActionRequired = class extends Schema.TaggedError()("PasswordActionRequired", {}) {};
+var PasswordMethodUnsupported = class extends Schema.TaggedError()("PasswordMethodUnsupported", {}) {};
+var PasswordMethodConfigurationError = class extends Schema.TaggedError()("PasswordMethodConfigurationError", {}) {};
+//#endregion
+export { PasswordActionRequired, PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/password/methods/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/password/methods/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport class PasswordRejected extends Schema.TaggedError<PasswordRejected>()(\n  \"PasswordRejected\",\n  {},\n) {}\n\nexport class PasswordUnavailable extends Schema.TaggedError<PasswordUnavailable>()(\n  \"PasswordUnavailable\",\n  {},\n) {}\n\nexport class PasswordActionRequired extends Schema.TaggedError<PasswordActionRequired>()(\n  \"PasswordActionRequired\",\n  {},\n) {}\n\nexport class PasswordMethodUnsupported extends Schema.TaggedError<PasswordMethodUnsupported>()(\n  \"PasswordMethodUnsupported\",\n  {},\n) {}\n\nexport class PasswordMethodConfigurationError extends Schema.TaggedError<PasswordMethodConfigurationError>()(\n  \"PasswordMethodConfigurationError\",\n  {},\n) {}\n"],"mappings":";;AAEA,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAC1E,oBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,mCAAb,cAAsD,OAAO,YAA8C,CAAC,CAC1G,oCACA,CAAC,CACH,CAAC,CAAC,CAAC"}

package/dist/password/methods/models.d.mts

@@ -0,0 +1,70 @@
+import { AuthenticationEvidence, AuthenticationRequirement } from "../../sessions/models.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { Schema } from "effect";
+//#region src/password/methods/models.d.ts
+declare const PasswordCommandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+type PasswordCommandId = typeof PasswordCommandId.Type;
+declare const PasswordAttemptId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordAttemptId">;
+type PasswordAttemptId = typeof PasswordAttemptId.Type;
+declare const PasswordReplacement: Schema.Struct<{
+  readonly verifier: Schema.RedactedFromValue<Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">>;
+  readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+}>;
+type PasswordReplacement = typeof PasswordReplacement.Type;
+/** Storage/private value. Verifier version changes on rehash; semantic revisions do not. */
+declare const PasswordCredentialSnapshot: Schema.Struct<{
+  readonly moduleId: Schema.NonEmptyString;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly credentialId: Schema.NonEmptyString;
+  readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly verifierVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly verifier: Schema.RedactedFromValue<Schema.brand<Schema.String, "effect-auth/EncodedPasswordHash">>;
+  readonly normalization: Schema.Literals<readonly ["none", "NFC"]>;
+  readonly identifier: typeof LoginIdentifier;
+  readonly identifierBindingRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly identifierVerifiedAtMillis: Schema.optionalKey<Schema.Int>;
+}>;
+type PasswordCredentialSnapshot = typeof PasswordCredentialSnapshot.Type;
+declare const PasswordAction: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+type PasswordAction = typeof PasswordAction.Type;
+/** Server-internal exact mutation binding, never a public credential or password hash. */
+declare const PasswordActionChallenge: Schema.Struct<{
+  readonly moduleId: Schema.NonEmptyString;
+  readonly action: Schema.Literals<readonly ["add-password", "change-password", "reset-password"]>;
+  readonly commandId: Schema.brand<Schema.NonEmptyString, "effect-auth/PasswordCommandId">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly targetCredentialId: Schema.optionalKey<Schema.NonEmptyString>;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>;
+type PasswordActionChallenge = typeof PasswordActionChallenge.Type;
+interface PasswordActionAuthorization {
+  readonly challenge: PasswordActionChallenge;
+  readonly evidence: AuthenticationEvidence;
+  readonly requirement: AuthenticationRequirement;
+}
+type PasswordAttemptAdmission = {
+  readonly _tag: "Admitted";
+  readonly attemptId: PasswordAttemptId;
+  readonly credential?: PasswordCredentialSnapshot;
+} | {
+  readonly _tag: "Denied";
+};
+type PasswordAttemptDecision = "verified" | "rejected";
+type PasswordMutationDecision = "changed" | "rejected";
+//#endregion
+export { PasswordAction, PasswordActionAuthorization, PasswordActionChallenge, PasswordAttemptAdmission, PasswordAttemptDecision, PasswordAttemptId, PasswordCommandId, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordReplacement };
+//# sourceMappingURL=models.d.mts.map

package/dist/password/methods/models.mjs

@@ -0,0 +1,44 @@
+import { TokenDigest } from "../../Schema.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { AuthenticationRevision, SecurityRevision } from "../../sessions/models.mjs";
+import { EncodedPasswordHash } from "../models.mjs";
+import { PasswordNormalization } from "../policy.mjs";
+import { Schema } from "effect";
+//#region src/password/methods/models.ts
+const PasswordCommandId = Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(Schema.brand("effect-auth/PasswordCommandId"));
+const PasswordAttemptId = Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(Schema.brand("effect-auth/PasswordAttemptId"));
+const PasswordReplacement = Schema.Struct({
+	verifier: Schema.RedactedFromValue(EncodedPasswordHash),
+	normalization: PasswordNormalization
+});
+/** Storage/private value. Verifier version changes on rehash; semantic revisions do not. */
+const PasswordCredentialSnapshot = Schema.Struct({
+	moduleId: Schema.NonEmptyString,
+	revision: AuthenticationRevision,
+	credentialId: Schema.NonEmptyString,
+	credentialRevision: SecurityRevision,
+	verifierVersion: SecurityRevision,
+	verifier: Schema.RedactedFromValue(EncodedPasswordHash),
+	normalization: PasswordNormalization,
+	identifier: LoginIdentifier,
+	identifierBindingRevision: SecurityRevision,
+	identifierVerifiedAtMillis: Schema.optionalKey(Schema.Int)
+});
+const PasswordAction = Schema.Literals([
+	"add-password",
+	"change-password",
+	"reset-password"
+]);
+/** Server-internal exact mutation binding, never a public credential or password hash. */
+const PasswordActionChallenge = Schema.Struct({
+	moduleId: Schema.NonEmptyString,
+	action: PasswordAction,
+	commandId: PasswordCommandId,
+	revision: AuthenticationRevision,
+	targetCredentialId: Schema.optionalKey(Schema.NonEmptyString),
+	bindingDigest: TokenDigest
+});
+//#endregion
+export { PasswordAction, PasswordActionChallenge, PasswordAttemptId, PasswordCommandId, PasswordCredentialSnapshot, PasswordReplacement };
+
+//# sourceMappingURL=models.mjs.map

package/dist/password/methods/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/password/methods/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { LoginIdentifier } from \"../../identity/models\";\nimport { TokenDigest } from \"../../Schema\";\nimport type { AuthenticationEvidence, AuthenticationRequirement } from \"../../sessions/models\";\nimport { AuthenticationRevision, SecurityRevision } from \"../../sessions/models\";\nimport { EncodedPasswordHash } from \"../models\";\nimport { PasswordNormalization } from \"../policy\";\n\nexport const PasswordCommandId = Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(\n  Schema.brand(\"effect-auth/PasswordCommandId\"),\n);\n\nexport type PasswordCommandId = typeof PasswordCommandId.Type;\n\nexport const PasswordAttemptId = Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(\n  Schema.brand(\"effect-auth/PasswordAttemptId\"),\n);\n\nexport type PasswordAttemptId = typeof PasswordAttemptId.Type;\n\nexport const PasswordReplacement = Schema.Struct({\n  verifier: Schema.RedactedFromValue(EncodedPasswordHash),\n  normalization: PasswordNormalization,\n});\n\nexport type PasswordReplacement = typeof PasswordReplacement.Type;\n\n/** Storage/private value. Verifier version changes on rehash; semantic revisions do not. */\nexport const PasswordCredentialSnapshot = Schema.Struct({\n  moduleId: Schema.NonEmptyString,\n  revision: AuthenticationRevision,\n  credentialId: Schema.NonEmptyString,\n  credentialRevision: SecurityRevision,\n  verifierVersion: SecurityRevision,\n  verifier: Schema.RedactedFromValue(EncodedPasswordHash),\n  normalization: PasswordNormalization,\n  identifier: LoginIdentifier,\n  identifierBindingRevision: SecurityRevision,\n  identifierVerifiedAtMillis: Schema.optionalKey(Schema.Int),\n});\n\nexport type PasswordCredentialSnapshot = typeof PasswordCredentialSnapshot.Type;\n\nexport const PasswordAction = Schema.Literals([\n  \"add-password\",\n  \"change-password\",\n  \"reset-password\",\n]);\n\nexport type PasswordAction = typeof PasswordAction.Type;\n\n/** Server-internal exact mutation binding, never a public credential or password hash. */\nexport const PasswordActionChallenge = Schema.Struct({\n  moduleId: Schema.NonEmptyString,\n  action: PasswordAction,\n  commandId: PasswordCommandId,\n  revision: AuthenticationRevision,\n  targetCredentialId: Schema.optionalKey(Schema.NonEmptyString),\n  bindingDigest: TokenDigest,\n});\n\nexport type PasswordActionChallenge = typeof PasswordActionChallenge.Type;\n\nexport interface PasswordActionAuthorization {\n  readonly challenge: PasswordActionChallenge;\n  readonly evidence: AuthenticationEvidence;\n  readonly requirement: AuthenticationRequirement;\n}\n\nexport type PasswordAttemptAdmission =\n  | {\n      readonly _tag: \"Admitted\";\n      readonly attemptId: PasswordAttemptId;\n      readonly credential?: PasswordCredentialSnapshot;\n    }\n  | { readonly _tag: \"Denied\" };\n\nexport type PasswordAttemptDecision = \"verified\" | \"rejected\";\nexport type PasswordMutationDecision = \"changed\" | \"rejected\";\n"],"mappings":";;;;;;;AASA,MAAa,oBAAoB,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KACpF,OAAO,MAAM,+BAA+B,CAC9C;AAIA,MAAa,oBAAoB,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KACpF,OAAO,MAAM,+BAA+B,CAC9C;AAIA,MAAa,sBAAsB,OAAO,OAAO;CAC/C,UAAU,OAAO,kBAAkB,mBAAmB;CACtD,eAAe;AACjB,CAAC;;AAKD,MAAa,6BAA6B,OAAO,OAAO;CACtD,UAAU,OAAO;CACjB,UAAU;CACV,cAAc,OAAO;CACrB,oBAAoB;CACpB,iBAAiB;CACjB,UAAU,OAAO,kBAAkB,mBAAmB;CACtD,eAAe;CACf,YAAY;CACZ,2BAA2B;CAC3B,4BAA4B,OAAO,YAAY,OAAO,GAAG;AAC3D,CAAC;AAID,MAAa,iBAAiB,OAAO,SAAS;CAC5C;CACA;CACA;AACF,CAAC;;AAKD,MAAa,0BAA0B,OAAO,OAAO;CACnD,UAAU,OAAO;CACjB,QAAQ;CACR,WAAW;CACX,UAAU;CACV,oBAAoB,OAAO,YAAY,OAAO,cAAc;CAC5D,eAAe;AACjB,CAAC"}