@yielded/auth 0.1.0-beta.1

package/dist/password/methods/module.mjs

@@ -0,0 +1,553 @@
+import { Email } from "../../Schema.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { HookDenied, lifecycleEvent, lifecycleSnapshot } from "../../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../../operations/operation.mjs";
+import { SessionInvalidationWindow, sessionInvalidationWindow } from "../../sessions/invalidation.mjs";
+import { AuthenticationFlowId } from "../../sessions/models.mjs";
+import { LifecycleHooks } from "../../hooks/LifecycleHooks.mjs";
+import { cryptoLayer, defaultLayer, hooksLayer } from "../../auth/defaults.mjs";
+import { hasCommitScope } from "../../hooks/commit.mjs";
+import { assessAuthentication, snapshotAuthenticationEvidence } from "../../sessions/assurance.mjs";
+import { AuthenticationAuthority } from "../../sessions/AuthenticationAuthority.mjs";
+import { makeAuthStrategy } from "../../auth/AuthStrategy.mjs";
+import { NewPasswordRejected, PasswordCheckUnavailable } from "../errors.mjs";
+import { PasswordActionRequired, PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import { PasswordSignInInput } from "./contracts.mjs";
+import { ProofBinding, ProofContinuation, ProofContinuationId, ProofPurpose, ProofReference, ProofRequestId, ProofRequestReceipt } from "../../proofs/models.mjs";
+import { PasswordPersistence } from "./PasswordPersistence.mjs";
+import { PasswordActionChallenge, PasswordCommandId } from "./models.mjs";
+import { snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "./snapshot.mjs";
+import { snapshotPasswordMethodPolicy, validatePasswordMethodPolicy } from "./policy.mjs";
+import { readProofCommit } from "../../proofs/dispatch.mjs";
+import { makeProofModule } from "../../proofs/module.mjs";
+import { NewPasswordCheck } from "../NewPasswordCheck.mjs";
+import { PasswordActionEvidence } from "./PasswordActionEvidence.mjs";
+import { PasswordHashing } from "../PasswordHashing.mjs";
+import { hashingLayer, newPasswordLayer } from "../defaults.mjs";
+import { passwordCompletionFailure } from "./verification.mjs";
+import { makePasswordPreparation } from "./preparation.mjs";
+import { makePasswordPrepared } from "./prepared.mjs";
+import { makePasswordSignIn } from "./signIn.mjs";
+import { Context, Crypto, Effect, Layer, Option, Redacted, Schema } from "effect";
+//#region src/password/methods/module.ts
+const BoundedEmail = Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email));
+const Password = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(65536)));
+const OpaqueProof = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));
+const FlowId = AuthenticationFlowId.check(Schema.isMaxLength(256));
+const RegisterResult = Schema.Union([Schema.TaggedStruct("RegistrationAccepted", {}), Schema.TaggedStruct("ProvisioningPending", { reference: Schema.NonEmptyString.check(Schema.isMaxLength(256)) })]);
+const MutationResult = Schema.Struct({ invalidation: SessionInvalidationWindow });
+const Status = Schema.Struct({ hasPassword: Schema.Boolean });
+const Cleanup = Schema.Struct({
+	removed: Schema.Natural,
+	hasMore: Schema.Boolean
+});
+const noAmbient = Effect.fn("Passwords.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* PasswordMethodUnsupported.make({});
+});
+const read = (receipt) => receipt.read.pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+/** Public email/password method. Trusted claims/provisioning/action capabilities
+* are explicit; no product account model, implicit login or MFA bypass is supplied.
+*/
+const makePasswordWithManagement = (moduleId, input) => {
+	const sessions = input.sessions;
+	const RegistrationCodec = input.registration;
+	const policyInput = snapshotPasswordMethodPolicy(input.policy);
+	const reset = makeProofModule(`${moduleId}/reset`, {
+		...input.reset,
+		purpose: ProofPurpose.make("password-reset"),
+		binding: ProofBinding,
+		channel: "email"
+	});
+	const RegistrationAuthority = Context.Service(`effect-auth/password/${moduleId}/RegistrationAuthority`);
+	const ClaimsForPassword = Context.Service(`effect-auth/password/${moduleId}/Claims`);
+	const RegisterInput = Schema.Struct({
+		requestId: PasswordCommandId,
+		email: BoundedEmail,
+		newPassword: Password,
+		registration: RegistrationCodec
+	});
+	const SignInInput = Schema.Struct({
+		flowId: FlowId,
+		...PasswordSignInInput.fields
+	});
+	const ActionInput = {
+		commandId: PasswordCommandId,
+		newPassword: Password,
+		actionProof: Schema.optionalKey(OpaqueProof)
+	};
+	const AddInput = Schema.Struct(ActionInput);
+	const ChangeInput = Schema.Struct({
+		...ActionInput,
+		currentPassword: Password
+	});
+	const ResetBase = {
+		flowId: FlowId,
+		email: BoundedEmail
+	};
+	const RequestResetInput = Schema.Struct({
+		...ResetBase,
+		requestId: ProofRequestId,
+		locale: Schema.NonEmptyString.check(Schema.isMaxLength(64))
+	});
+	const VerifyResetInput = Schema.Struct({
+		...ResetBase,
+		reference: ProofReference,
+		secret: OpaqueProof
+	});
+	const CompleteResetInput = Schema.Struct({
+		...ResetBase,
+		...ActionInput,
+		continuationId: ProofContinuationId,
+		credential: OpaqueProof
+	});
+	const Failure = Schema.Union([
+		PasswordRejected,
+		PasswordUnavailable,
+		PasswordActionRequired,
+		PasswordMethodUnsupported,
+		NewPasswordRejected,
+		PasswordCheckUnavailable,
+		HookDenied
+	]);
+	const Passwords = Context.Service(`effect-auth/password/${moduleId}/Method`);
+	const layer = Layer.effect(Passwords, Effect.gen(function* () {
+		if (!Schema.is(Schema.NonEmptyString.check(Schema.isMaxLength(128)))(moduleId)) return yield* PasswordMethodConfigurationError.make({});
+		const policy = yield* validatePasswordMethodPolicy(policyInput);
+		const store = yield* PasswordPersistence;
+		const hasher = yield* PasswordHashing;
+		const checker = yield* NewPasswordCheck;
+		const actionEvidence = yield* PasswordActionEvidence;
+		const claims = yield* ClaimsForPassword;
+		const authority = yield* AuthenticationAuthority;
+		const completion = yield* sessions.AuthenticationCompletion;
+		const strategy = yield* sessions.SessionStrategy;
+		const proofs = yield* reset.Proofs;
+		const hooks = yield* LifecycleHooks;
+		const crypto = yield* Crypto.Crypto;
+		const services = yield* Effect.context();
+		const registrationCodec = Schema.toCodecIso(RegistrationCodec);
+		const preparationServices = Context.make(PasswordPersistence, store).pipe(Context.add(PasswordHashing, hasher), Context.add(NewPasswordCheck, checker), Context.add(AuthenticationAuthority, authority), Context.add(LifecycleHooks, hooks), Context.add(Crypto.Crypto, crypto));
+		const preparation = makePasswordPreparation({
+			moduleId,
+			policy
+		});
+		const { digest, identifier, newReplacement, event, verifyPassword } = {
+			identifier: preparation.identifier,
+			digest: (...args) => preparation.digest(...args).pipe(Effect.provide(preparationServices)),
+			newReplacement: (...args) => preparation.newReplacement(...args).pipe(Effect.provide(preparationServices)),
+			event: (...args) => preparation.event(...args).pipe(Effect.provide(preparationServices)),
+			verifyPassword: (...args) => preparation.verifyPassword(...args).pipe(Effect.provide(preparationServices))
+		};
+		const recoveryBinding = Effect.fn("Passwords.recoveryBinding")(function* (request) {
+			const id = identifier(request.email);
+			const target = yield* store.recoveryTarget({
+				moduleId,
+				identifier: id
+			}).pipe(Effect.flatMap((value) => Option.isNone(value) ? Effect.succeed(Option.none()) : snapshotPasswordCredential(value.value).pipe(Effect.map(Option.some))));
+			const base = {
+				flowId: request.flowId,
+				contextDigest: yield* digest([
+					"effect-auth/password-reset/v1",
+					moduleId,
+					request.flowId,
+					request.email
+				]),
+				identifier: id
+			};
+			if (Option.isNone(target)) return {
+				binding: {
+					_tag: "Identifier",
+					...base
+				},
+				target
+			};
+			if (target.value.identifierVerifiedAtMillis === void 0 || target.value.identifier.value !== request.email || target.value.identifier.namespace !== "email" || target.value.moduleId !== moduleId) return yield* PasswordUnavailable.make({});
+			return {
+				binding: {
+					_tag: "Subject",
+					...base,
+					revision: target.value.revision
+				},
+				target
+			};
+		});
+		const planMutation = Effect.fn("Passwords.planMutation")(function* (action, invocation, request, expectedRevision, credential, currentPasswordEvidence, recovery) {
+			if (policy.requireImmediateInvalidation && strategy.capabilities.subjectInvalidation !== "immediate") return yield* PasswordMethodUnsupported.make({});
+			expectedRevision = snapshotPasswordRevision(expectedRevision);
+			const replacement = yield* newReplacement(request.newPassword, credential?.identifier.value);
+			const privateBinding = yield* digest([
+				"effect-auth/password-action/v1",
+				moduleId,
+				action,
+				request.commandId,
+				expectedRevision.subjectId,
+				expectedRevision.securityRevision,
+				credential?.credentialId ?? "",
+				...[...expectedRevision.credentials].sort((a, b) => a.credentialId < b.credentialId ? -1 : a.credentialId > b.credentialId ? 1 : 0).flatMap((item) => [item.credentialId, item.revision]),
+				replacement.normalization,
+				Redacted.value(replacement.verifier)
+			]);
+			const validatedChallenge = PasswordActionChallenge.make({
+				moduleId,
+				action,
+				commandId: request.commandId,
+				revision: expectedRevision,
+				...credential === void 0 ? {} : { targetCredentialId: credential.credentialId },
+				bindingDigest: privateBinding
+			});
+			const challenge = Object.freeze({
+				...validatedChallenge,
+				revision: snapshotPasswordRevision(validatedChallenge.revision)
+			});
+			const granted = yield* actionEvidence.verify({
+				challenge,
+				invocation,
+				proof: request.actionProof,
+				currentPasswordEvidence,
+				recovery: recovery?.input
+			});
+			const evidenceValue = yield* snapshotAuthenticationEvidence(granted.evidence).pipe(Effect.mapError(() => PasswordActionRequired.make({})));
+			const evidence = {
+				...evidenceValue,
+				revision: snapshotPasswordRevision(evidenceValue.revision)
+			};
+			if (evidence.flowId !== AuthenticationFlowId.make(request.commandId) || evidence.bindingDigest !== privateBinding || evidence.revision.subjectId !== expectedRevision.subjectId || evidence.revision.securityRevision !== expectedRevision.securityRevision || expectedRevision.credentials.some((item) => !evidence.revision.credentials.some((verified) => verified.credentialId === item.credentialId && verified.revision === item.revision))) return yield* PasswordActionRequired.make({});
+			const requirement = yield* snapshotPasswordRequirement({
+				...granted.requirement,
+				maximumAgeMillis: Math.min(granted.requirement.maximumAgeMillis, policy.maximumEvidenceAgeMillis)
+			});
+			if (!(yield* assessAuthentication(evidence, requirement).pipe(Effect.mapError(() => PasswordActionRequired.make({})))).satisfied) return yield* PasswordActionRequired.make({});
+			const authorization = {
+				challenge,
+				evidence,
+				requirement
+			};
+			const invalidation = sessionInvalidationWindow(action === "reset-password" ? "password-reset" : "credential-change", strategy.capabilities, strategy.policy);
+			const changed = yield* event("credential-change", credential?.identifier ?? LoginIdentifier.make({
+				namespace: "subject",
+				value: expectedRevision.subjectId
+			}), expectedRevision.subjectId);
+			return {
+				input: {
+					moduleId,
+					commandId: request.commandId,
+					expectedRevision,
+					credential,
+					replacement,
+					authorization,
+					invalidation
+				},
+				prepare: (decision, journal) => {
+					if (decision === "changed") journal.stage(changed);
+					return journal.prepare({
+						value: decision === "changed" ? { invalidation } : { _tag: "Rejected" },
+						credentialCommands: decision === "changed" ? [
+							{
+								_tag: "Clear",
+								slot: "session"
+							},
+							{
+								_tag: "Clear",
+								slot: "pending-proof"
+							},
+							...action === "reset-password" ? [{
+								_tag: "Clear",
+								slot: "proof-continuation"
+							}] : []
+						] : []
+					});
+				}
+			};
+		});
+		return Passwords.of({
+			planRegister: Effect.fn("Passwords.planRegister")(function* (request) {
+				yield* noAmbient();
+				const data = yield* Schema.encodeEffect(registrationCodec)(request.registration).pipe(Effect.flatMap(Schema.decodeEffect(registrationCodec)), Effect.provide(services), Effect.mapError(() => PasswordRejected.make({})));
+				const replacement = yield* newReplacement(request.newPassword, request.email);
+				const id = identifier(request.email);
+				const created = yield* event("registration", id);
+				return { commit: Effect.gen(function* () {
+					return yield* (yield* RegistrationAuthority).register({
+						moduleId,
+						requestId: request.requestId,
+						identifier: id,
+						registration: data,
+						replacement
+					}, (decision, journal) => {
+						if (decision._tag === "Created") journal.stage(lifecycleEvent({
+							...created,
+							snapshot: lifecycleSnapshot({
+								...created.snapshot,
+								subjectId: decision.subjectId
+							})
+						}));
+						return journal.prepare(decision._tag === "Pending" ? {
+							_tag: "ProvisioningPending",
+							reference: decision.reference
+						} : { _tag: "RegistrationAccepted" });
+					});
+				}) };
+			}),
+			signIn: Effect.fn("Passwords.signIn")(function* (request) {
+				const verified = yield* verifyPassword(request, "sign-in");
+				const values = yield* claims.resolve(yield* snapshotPasswordCredential(verified.credential));
+				return yield* completion.prepare({
+					evidence: verified.evidence,
+					claims: values
+				}).pipe(Effect.flatMap(read), Effect.mapError(passwordCompletionFailure));
+			}),
+			planAdd: Effect.fn("Passwords.planAdd")(function* (invocation, request) {
+				yield* noAmbient();
+				if (invocation._tag !== "Authenticated") return yield* PasswordRejected.make({});
+				const caller = invocation;
+				const existing = yield* store.readForSubject({
+					moduleId,
+					subjectId: caller.subjectId
+				});
+				if (Option.isSome(existing)) return yield* PasswordRejected.make({});
+				const revision = snapshotPasswordRevision(yield* authority.capture(caller.subjectId, []).pipe(Effect.mapError(() => PasswordRejected.make({}))));
+				const plan = yield* planMutation("add-password", invocation, request, revision);
+				return { commit: Effect.gen(function* () {
+					return yield* (yield* PasswordPersistence).addIfAbsent(plan.input, plan.prepare);
+				}) };
+			}),
+			planChange: Effect.fn("Passwords.planChange")(function* (invocation, request) {
+				yield* noAmbient();
+				if (invocation._tag !== "Authenticated") return yield* PasswordRejected.make({});
+				const caller = invocation;
+				const existing = yield* store.readForSubject({
+					moduleId,
+					subjectId: caller.subjectId
+				});
+				if (Option.isNone(existing)) return yield* PasswordRejected.make({});
+				const verified = yield* verifyPassword({
+					flowId: AuthenticationFlowId.make(request.commandId),
+					email: existing.value.identifier.value,
+					password: request.currentPassword
+				}, "change", caller.subjectId);
+				const plan = yield* planMutation("change-password", invocation, request, verified.evidence.revision, verified.credential, verified.evidence);
+				return { commit: Effect.gen(function* () {
+					return yield* (yield* PasswordPersistence).replaceIfCurrent(plan.input, plan.prepare);
+				}) };
+			}),
+			requestReset: Effect.fn("Passwords.requestReset")(function* (request) {
+				yield* noAmbient();
+				const bound = yield* recoveryBinding(request);
+				const dispatch = yield* proofs.prepareIssue({
+					requestId: request.requestId,
+					binding: bound.binding,
+					locale: request.locale,
+					eligible: Option.isSome(bound.target)
+				}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(() => PasswordUnavailable.make({})));
+				yield* dispatch.dispatch.pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+				return dispatch.receipt;
+			}),
+			verifyReset: Effect.fn("Passwords.verifyReset")(function* (request) {
+				yield* noAmbient();
+				const bound = yield* recoveryBinding(request);
+				const result = yield* proofs.prepareAttempt({
+					reference: request.reference,
+					binding: bound.binding,
+					credential: request.secret
+				}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(() => PasswordRejected.make({})));
+				if (result.value._tag === "Rejected") return yield* PasswordRejected.make({});
+				return {
+					value: { continuation: result.value.continuation },
+					credentialCommands: result.credentialCommands
+				};
+			}),
+			planReset: Effect.fn("Passwords.planReset")(function* (invocation, request) {
+				yield* noAmbient();
+				const bound = yield* recoveryBinding(request);
+				if (Option.isNone(bound.target)) return yield* PasswordRejected.make({});
+				const proof = yield* proofs.planComplete({
+					continuationId: request.continuationId,
+					binding: bound.binding,
+					credential: request.credential
+				}).pipe(Effect.mapError(() => PasswordRejected.make({})));
+				if (!(yield* store.checkReset(proof.input))) return yield* PasswordRejected.make({});
+				const plan = yield* planMutation("reset-password", invocation, request, bound.target.value.revision, bound.target.value, void 0, proof);
+				return { commit: Effect.gen(function* () {
+					return yield* (yield* PasswordPersistence).resetWithProof({
+						...plan.input,
+						completion: proof
+					}, plan.prepare);
+				}) };
+			}),
+			status: Effect.fn("Passwords.status")(function* (invocation) {
+				if (invocation._tag !== "Authenticated") return yield* PasswordRejected.make({});
+				const caller = invocation;
+				return { hasPassword: Option.isSome(yield* store.readForSubject({
+					moduleId,
+					subjectId: caller.subjectId
+				})) };
+			}),
+			cleanup: Effect.fn("Passwords.cleanup")(function* (limit) {
+				yield* noAmbient();
+				yield* Schema.decodeEffect(Schema.Int.check(Schema.isBetween({
+					minimum: 1,
+					maximum: 1e3
+				})))(limit).pipe(Effect.mapError(() => PasswordRejected.make({})));
+				return yield* read(yield* store.cleanupAttempts({
+					moduleId,
+					limit
+				}, (result, journal) => journal.prepare(result)));
+			})
+		});
+	}));
+	const Register = makeOperation(`${moduleId}/register`, {
+		payload: RegisterInput,
+		success: RegisterResult,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "idempotent"
+	});
+	const SignIn = makeOperation(`${moduleId}/sign-in`, {
+		payload: SignInInput,
+		success: sessions.CompletionResult,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const AddPassword = makeOperation(`${moduleId}/add-password`, {
+		payload: AddInput,
+		success: MutationResult,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const ChangePassword = makeOperation(`${moduleId}/change-password`, {
+		payload: ChangeInput,
+		success: MutationResult,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const RequestReset = makeOperation(`${moduleId}/request-reset`, {
+		payload: RequestResetInput,
+		success: ProofRequestReceipt,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "idempotent"
+	});
+	const VerifyReset = makeOperation(`${moduleId}/verify-reset`, {
+		payload: VerifyResetInput,
+		success: Schema.Struct({ continuation: ProofContinuation }),
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const CompleteReset = makeOperation(`${moduleId}/complete-reset`, {
+		payload: CompleteResetInput,
+		success: MutationResult,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const PasswordStatus = makeOperation(`${moduleId}/status`, {
+		payload: Schema.Void,
+		success: Status,
+		error: Failure,
+		access: "authenticated",
+		exposure: "public",
+		replay: "read-only"
+	});
+	const CleanupAttempts = makeOperation(`${moduleId}/cleanup`, {
+		payload: Schema.Struct({ limit: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 1e3
+		})) }),
+		success: Cleanup,
+		error: Failure,
+		access: "system",
+		replay: "idempotent"
+	});
+	const mutationResult = (result) => "invalidation" in result.value ? Effect.succeed({
+		value: result.value,
+		credentialCommands: result.credentialCommands
+	}) : Effect.fail(PasswordRejected.make({}));
+	const handlersLayer = Layer.mergeAll(Register.handlerLayer(Effect.fn("PasswordOperation.register")(function* (request) {
+		return yield* read(yield* (yield* (yield* Passwords).planRegister(request)).commit);
+	})), SignIn.credentialHandlerLayer(Effect.fn("PasswordOperation.signIn")(function* (request) {
+		return yield* (yield* Passwords).signIn(request);
+	})), AddPassword.credentialHandlerLayer(Effect.fn("PasswordOperation.add")(function* (request, invocation) {
+		return yield* read(yield* (yield* (yield* Passwords).planAdd(invocation, request)).commit).pipe(Effect.flatMap(mutationResult));
+	})), ChangePassword.credentialHandlerLayer(Effect.fn("PasswordOperation.change")(function* (request, invocation) {
+		return yield* read(yield* (yield* (yield* Passwords).planChange(invocation, request)).commit).pipe(Effect.flatMap(mutationResult));
+	})), RequestReset.handlerLayer(Effect.fn("PasswordOperation.requestReset")(function* (request) {
+		return yield* (yield* Passwords).requestReset(request);
+	})), VerifyReset.credentialHandlerLayer(Effect.fn("PasswordOperation.verifyReset")(function* (request) {
+		return yield* (yield* Passwords).verifyReset(request);
+	})), CompleteReset.credentialHandlerLayer(Effect.fn("PasswordOperation.reset")(function* (request, invocation) {
+		return yield* read(yield* (yield* (yield* Passwords).planReset(invocation, request)).commit).pipe(Effect.flatMap(mutationResult));
+	})), PasswordStatus.handlerLayer(Effect.fn("PasswordOperation.status")(function* (_, invocation) {
+		return yield* (yield* Passwords).status(invocation);
+	})), CleanupAttempts.handlerLayer(Effect.fn("PasswordOperation.cleanup")(function* (request) {
+		return yield* (yield* Passwords).cleanup(request.limit);
+	})));
+	const operations = {
+		Register,
+		SignIn,
+		AddPassword,
+		ChangePassword,
+		RequestReset,
+		VerifyReset,
+		CompleteReset,
+		PasswordStatus,
+		CleanupAttempts
+	};
+	return Object.freeze({
+		strategy: makeAuthStrategy({
+			signIn: Effect.fn("Passwords.signInRequest")(function* (invocation, request) {
+				const flowId = yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+				return yield* SignIn.invoke(invocation, {
+					...request,
+					flowId
+				});
+			}),
+			register: Register.invoke,
+			addPassword: AddPassword.invoke,
+			changePassword: ChangePassword.invoke,
+			requestReset: RequestReset.invoke,
+			verifyReset: VerifyReset.invoke,
+			completeReset: CompleteReset.invoke,
+			passwordStatus: PasswordStatus.invoke
+		}, handlersLayer.pipe(Layer.provide(defaultLayer(Passwords, layer)), Layer.provide(defaultLayer(reset.Proofs, reset.emailLayer)), Layer.provide([
+			hashingLayer,
+			newPasswordLayer,
+			hooksLayer
+		]), Layer.provideMerge(cryptoLayer)), { completion: true }),
+		prepared: (configuration) => makePasswordPrepared(moduleId, {
+			policy: policyInput,
+			strategy: sessions.SessionStrategy,
+			reset: reset.Proofs
+		}, configuration),
+		Passwords,
+		RegistrationAuthority,
+		ClaimsForPassword,
+		layer,
+		handlersLayer,
+		operations,
+		reset,
+		group: operationGroup(...Object.values(operations))
+	});
+};
+function makePasswordMethod(moduleId, options) {
+	return "registration" in options ? makePasswordWithManagement(moduleId, options) : makePasswordSignIn(moduleId, options);
+}
+//#endregion
+export { makePasswordMethod };
+
+//# sourceMappingURL=module.mjs.map