@yielded/auth 0.1.0-beta.1

package/dist/password/methods/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":[],"sources":["../../../src/password/methods/module.ts"],"sourcesContent":["import { Context, Crypto, Effect, Layer, Option, Redacted, Schema, type Types } from \"effect\";\n\nimport { makeAuthStrategy } from \"../../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../../auth/defaults\";\nimport { hasCommitScope, type PreparedCommit } from \"../../hooks/commit\";\nimport { LifecycleHooks } from \"../../hooks/LifecycleHooks\";\nimport { HookDenied, lifecycleEvent, lifecycleSnapshot } from \"../../hooks/models\";\nimport { LoginIdentifier } from \"../../identity/models\";\nimport { type AuthInvocation } from \"../../operations/context\";\nimport type { AuthOperationResult } from \"../../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../../operations/operation\";\nimport type { ProofKeyring, ProofSecretPolicy } from \"../../proofs/crypto\";\nimport { readProofCommit } from \"../../proofs/dispatch\";\nimport {\n  ProofBinding,\n  ProofContinuation,\n  ProofContinuationId,\n  ProofPurpose,\n  ProofReference,\n  ProofRequestId,\n  ProofRequestReceipt,\n} from \"../../proofs/models\";\nimport { makeProofModule } from \"../../proofs/module\";\nimport type { ProofPolicy } from \"../../proofs/policy\";\nimport type { SubjectId } from \"../../Schema\";\nimport { Email } from \"../../Schema\";\nimport { assessAuthentication, snapshotAuthenticationEvidence } from \"../../sessions/assurance\";\nimport { AuthenticationAuthority } from \"../../sessions/AuthenticationAuthority\";\nimport { SessionInvalidationWindow, sessionInvalidationWindow } from \"../../sessions/invalidation\";\nimport type { AuthenticationEvidence } from \"../../sessions/models\";\nimport { AuthenticationFlowId } from \"../../sessions/models\";\nimport type { makeSessionModule } from \"../../sessions/module\";\nimport { hashingLayer, newPasswordLayer } from \"../defaults\";\nimport { NewPasswordRejected, PasswordCheckUnavailable } from \"../errors\";\nimport { NewPasswordCheck } from \"../NewPasswordCheck\";\nimport { PasswordHashing } from \"../PasswordHashing\";\nimport { PasswordSignInInput } from \"./contracts\";\nimport {\n  PasswordActionRequired,\n  PasswordMethodConfigurationError,\n  PasswordMethodUnsupported,\n  PasswordRejected,\n  PasswordUnavailable,\n} from \"./errors\";\nimport {\n  PasswordActionChallenge,\n  PasswordCommandId,\n  type PasswordAction,\n  type PasswordActionAuthorization,\n  type PasswordCredentialSnapshot,\n  type PasswordReplacement,\n} from \"./models\";\nimport { PasswordActionEvidence } from \"./PasswordActionEvidence\";\nimport {\n  PasswordPersistence,\n  type PreparePasswordCommit,\n  type PasswordMutationInput,\n} from \"./PasswordPersistence\";\nimport {\n  type PasswordMethodPolicy,\n  snapshotPasswordMethodPolicy,\n  validatePasswordMethodPolicy,\n} from \"./policy\";\nimport { makePasswordPreparation } from \"./preparation\";\nimport { makePasswordPrepared } from \"./prepared\";\nimport type { PasswordPreparedConfiguration } from \"./preparedModels\";\nimport { makePasswordSignIn, type PasswordSignInOptions } from \"./signIn\";\nimport {\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n} from \"./snapshot\";\nimport { passwordCompletionFailure } from \"./verification\";\n\nexport interface MethodService<Id extends string, Kind extends string> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n}\n\nconst BoundedEmail = Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email));\nconst Password = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(65536)));\nconst OpaqueProof = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));\nconst FlowId = AuthenticationFlowId.check(Schema.isMaxLength(256));\n\nconst RegisterResult = Schema.Union([\n  Schema.TaggedStruct(\"RegistrationAccepted\", {}),\n  Schema.TaggedStruct(\"ProvisioningPending\", {\n    reference: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  }),\n]);\n\nexport type PasswordRegistrationDecision =\n  | { readonly _tag: \"Created\"; readonly subjectId: SubjectId }\n  | { readonly _tag: \"Suppressed\" }\n  | { readonly _tag: \"Pending\"; readonly reference: string };\n\nconst MutationResult = Schema.Struct({ invalidation: SessionInvalidationWindow });\nconst Status = Schema.Struct({ hasPassword: Schema.Boolean });\nconst Cleanup = Schema.Struct({ removed: Schema.Natural, hasMore: Schema.Boolean });\n\nconst noAmbient = Effect.fn(\"Passwords.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* PasswordMethodUnsupported.make({});\n});\n\nconst read = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => PasswordUnavailable.make({})));\n\n/** Public email/password method. Trusted claims/provisioning/action capabilities\n * are explicit; no product account model, implicit login or MFA bypass is supplied.\n */\nconst makePasswordWithManagement = <\n  const Id extends string,\n  const SessionModuleId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  Registration extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  input: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionModuleId, Claims>>;\n    readonly registration: Registration;\n    readonly policy: PasswordMethodPolicy;\n    readonly reset: {\n      readonly template: string;\n      readonly secret: ProofSecretPolicy;\n      readonly policy: ProofPolicy;\n      readonly keys?: ProofKeyring;\n    };\n  },\n) => {\n  const sessions = input.sessions;\n\n  const RegistrationCodec: Schema.Codec<\n    Registration[\"Type\"],\n    Registration[\"Encoded\"],\n    Registration[\"DecodingServices\"],\n    Registration[\"EncodingServices\"]\n  > = input.registration;\n\n  const policyInput = snapshotPasswordMethodPolicy(input.policy);\n\n  const reset = makeProofModule(`${moduleId}/reset`, {\n    ...input.reset,\n    purpose: ProofPurpose.make(\"password-reset\"),\n    binding: ProofBinding,\n    channel: \"email\",\n  });\n\n  type Completion = typeof sessions.CompletionResult.Type;\n\n  const RegistrationAuthority = Context.Service<\n    MethodService<Id, \"registration\"> & {\n      readonly registration: Types.Invariant<Registration[\"Type\"]>;\n    },\n    {\n      /** Join application provisioning + unverified identifier + create-if-absent\n       * password under one owner, or persist a protected recovery intent and Pending.\n       * Request binding includes exact private credential intent; public requestId\n       * alone cannot adopt another request's subject. Never upsert an existing login.\n       * Every retry has a fresh salt: verifier equality cannot prove password equality.\n       * Retain the original protected intent; replays never replace it or expose its\n       * subject. Return uniform Accepted/Pending metadata or suppress the replay.\n       * A pending reference is non-authorizing and cannot resume/adopt that intent.\n       */\n      readonly register: <A>(\n        input: {\n          readonly moduleId: string;\n          readonly requestId: string;\n          readonly identifier: LoginIdentifier;\n          readonly registration: Registration[\"Type\"];\n          readonly replacement: PasswordReplacement;\n        },\n        prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>,\n      ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n    }\n  >(`effect-auth/password/${moduleId}/RegistrationAuthority`);\n\n  const ClaimsForPassword = Context.Service<\n    MethodService<Id, \"claims\"> & { readonly claims: Types.Invariant<Claims[\"Type\"]> },\n    {\n      readonly resolve: (\n        credential: PasswordCredentialSnapshot,\n      ) => Effect.Effect<Claims[\"Type\"], PasswordUnavailable>;\n    }\n  >(`effect-auth/password/${moduleId}/Claims`);\n\n  const RegisterInput = Schema.Struct({\n    requestId: PasswordCommandId,\n    email: BoundedEmail,\n    newPassword: Password,\n    registration: RegistrationCodec,\n  });\n\n  const SignInInput = Schema.Struct({ flowId: FlowId, ...PasswordSignInInput.fields });\n\n  const ActionInput = {\n    commandId: PasswordCommandId,\n    newPassword: Password,\n    actionProof: Schema.optionalKey(OpaqueProof),\n  };\n\n  const AddInput = Schema.Struct(ActionInput);\n  const ChangeInput = Schema.Struct({ ...ActionInput, currentPassword: Password });\n  const ResetBase = { flowId: FlowId, email: BoundedEmail };\n\n  const RequestResetInput = Schema.Struct({\n    ...ResetBase,\n    requestId: ProofRequestId,\n    locale: Schema.NonEmptyString.check(Schema.isMaxLength(64)),\n  });\n\n  const VerifyResetInput = Schema.Struct({\n    ...ResetBase,\n    reference: ProofReference,\n    secret: OpaqueProof,\n  });\n\n  const CompleteResetInput = Schema.Struct({\n    ...ResetBase,\n    ...ActionInput,\n    continuationId: ProofContinuationId,\n    credential: OpaqueProof,\n  });\n\n  const Failure = Schema.Union([\n    PasswordRejected,\n    PasswordUnavailable,\n    PasswordActionRequired,\n    PasswordMethodUnsupported,\n    NewPasswordRejected,\n    PasswordCheckUnavailable,\n    HookDenied,\n  ]);\n\n  type Failure = typeof Failure.Type;\n  type MutationValue = AuthOperationResult<\n    typeof MutationResult.Type | { readonly _tag: \"Rejected\" }\n  >;\n  type Mutation = {\n    readonly input: PasswordMutationInput;\n    readonly prepare: PreparePasswordCommit<\"changed\" | \"rejected\", MutationValue>;\n  };\n  type Plan<A, Owner = PasswordPersistence> = {\n    readonly commit: Effect.Effect<PreparedCommit<A>, Failure, Owner>;\n  };\n\n  const Passwords = Context.Service<\n    MethodService<Id, \"method\"> & {\n      readonly claims: Types.Invariant<Claims[\"Type\"]>;\n      readonly registration: Types.Invariant<Registration[\"Type\"]>;\n    },\n    {\n      readonly planRegister: (\n        input: typeof RegisterInput.Type,\n      ) => Effect.Effect<\n        Plan<typeof RegisterResult.Type, typeof RegistrationAuthority.Identifier>,\n        Failure\n      >;\n      readonly signIn: (\n        input: typeof SignInInput.Type,\n      ) => Effect.Effect<AuthOperationResult<Completion>, Failure>;\n      readonly planAdd: (\n        invocation: AuthInvocation,\n        input: typeof AddInput.Type,\n      ) => Effect.Effect<Plan<MutationValue>, Failure>;\n      readonly planChange: (\n        invocation: AuthInvocation,\n        input: typeof ChangeInput.Type,\n      ) => Effect.Effect<Plan<MutationValue>, Failure>;\n      readonly requestReset: (\n        input: typeof RequestResetInput.Type,\n      ) => Effect.Effect<ProofRequestReceipt, Failure>;\n      readonly verifyReset: (\n        input: typeof VerifyResetInput.Type,\n      ) => Effect.Effect<\n        AuthOperationResult<{ readonly continuation: ProofContinuation }>,\n        Failure\n      >;\n      readonly planReset: (\n        invocation: AuthInvocation,\n        input: typeof CompleteResetInput.Type,\n      ) => Effect.Effect<Plan<MutationValue>, Failure>;\n      readonly status: (invocation: AuthInvocation) => Effect.Effect<typeof Status.Type, Failure>;\n      readonly cleanup: (limit: number) => Effect.Effect<typeof Cleanup.Type, Failure>;\n    }\n  >(`effect-auth/password/${moduleId}/Method`);\n\n  const layer = Layer.effect(\n    Passwords,\n    Effect.gen(function* () {\n      if (!Schema.is(Schema.NonEmptyString.check(Schema.isMaxLength(128)))(moduleId))\n        return yield* PasswordMethodConfigurationError.make({});\n      const policy = yield* validatePasswordMethodPolicy(policyInput);\n      const store = yield* PasswordPersistence;\n      const hasher = yield* PasswordHashing;\n      const checker = yield* NewPasswordCheck;\n      const actionEvidence = yield* PasswordActionEvidence;\n      const claims = yield* ClaimsForPassword;\n      const authority = yield* AuthenticationAuthority;\n      const completion = yield* sessions.AuthenticationCompletion;\n      const strategy = yield* sessions.SessionStrategy;\n      const proofs = yield* reset.Proofs;\n      const hooks = yield* LifecycleHooks;\n      const crypto = yield* Crypto.Crypto;\n\n      const services = yield* Effect.context<\n        Registration[\"DecodingServices\"] | Registration[\"EncodingServices\"]\n      >();\n\n      const registrationCodec = Schema.toCodecIso(RegistrationCodec);\n\n      const preparationServices = Context.make(PasswordPersistence, store).pipe(\n        Context.add(PasswordHashing, hasher),\n        Context.add(NewPasswordCheck, checker),\n        Context.add(AuthenticationAuthority, authority),\n        Context.add(LifecycleHooks, hooks),\n        Context.add(Crypto.Crypto, crypto),\n      );\n\n      const preparation = makePasswordPreparation({ moduleId, policy });\n\n      const shared = {\n        identifier: preparation.identifier,\n        digest: (...args: Parameters<typeof preparation.digest>) =>\n          preparation.digest(...args).pipe(Effect.provide(preparationServices)),\n        newReplacement: (...args: Parameters<typeof preparation.newReplacement>) =>\n          preparation.newReplacement(...args).pipe(Effect.provide(preparationServices)),\n        event: (...args: Parameters<typeof preparation.event>) =>\n          preparation.event(...args).pipe(Effect.provide(preparationServices)),\n        verifyPassword: (...args: Parameters<typeof preparation.verifyPassword>) =>\n          preparation.verifyPassword(...args).pipe(Effect.provide(preparationServices)),\n      };\n\n      const { digest, identifier, newReplacement, event, verifyPassword } = shared;\n\n      const recoveryBinding = Effect.fn(\"Passwords.recoveryBinding\")(function* (request: {\n        readonly flowId: AuthenticationFlowId;\n        readonly email: Email;\n      }) {\n        const id = identifier(request.email);\n\n        const target = yield* store\n          .recoveryTarget({ moduleId, identifier: id })\n          .pipe(\n            Effect.flatMap((value) =>\n              Option.isNone(value)\n                ? Effect.succeed(Option.none<PasswordCredentialSnapshot>())\n                : snapshotPasswordCredential(value.value).pipe(Effect.map(Option.some)),\n            ),\n          );\n\n        const base = {\n          flowId: request.flowId,\n          contextDigest: yield* digest([\n            \"effect-auth/password-reset/v1\",\n            moduleId,\n            request.flowId,\n            request.email,\n          ]),\n          identifier: id,\n        };\n\n        if (Option.isNone(target))\n          return { binding: { _tag: \"Identifier\" as const, ...base }, target };\n        if (\n          target.value.identifierVerifiedAtMillis === undefined ||\n          target.value.identifier.value !== request.email ||\n          target.value.identifier.namespace !== \"email\" ||\n          target.value.moduleId !== moduleId\n        )\n          return yield* PasswordUnavailable.make({});\n\n        return {\n          binding: { _tag: \"Subject\" as const, ...base, revision: target.value.revision },\n          target,\n        };\n      });\n\n      const planMutation = Effect.fn(\"Passwords.planMutation\")(function* (\n        action: PasswordAction,\n        invocation: AuthInvocation,\n        request: typeof AddInput.Type,\n        expectedRevision: AuthenticationEvidence[\"revision\"],\n        credential?: PasswordCredentialSnapshot,\n        currentPasswordEvidence?: AuthenticationEvidence,\n        recovery?: import(\"../../proofs/completion\").ProofCompletionPlan,\n      ): Effect.fn.Return<Mutation, Failure> {\n        if (\n          policy.requireImmediateInvalidation &&\n          strategy.capabilities.subjectInvalidation !== \"immediate\"\n        )\n          return yield* PasswordMethodUnsupported.make({});\n        expectedRevision = snapshotPasswordRevision(expectedRevision);\n\n        const replacement = yield* newReplacement(\n          request.newPassword,\n          credential?.identifier.value as Email | undefined,\n        );\n\n        const privateBinding = yield* digest([\n          \"effect-auth/password-action/v1\",\n          moduleId,\n          action,\n          request.commandId,\n          expectedRevision.subjectId,\n          expectedRevision.securityRevision,\n          credential?.credentialId ?? \"\",\n          ...[...expectedRevision.credentials]\n            .sort((a, b) =>\n              a.credentialId < b.credentialId ? -1 : a.credentialId > b.credentialId ? 1 : 0,\n            )\n            .flatMap((item) => [item.credentialId, item.revision]),\n          replacement.normalization,\n          Redacted.value(replacement.verifier),\n        ]);\n\n        const validatedChallenge = PasswordActionChallenge.make({\n          moduleId,\n          action,\n          commandId: request.commandId,\n          revision: expectedRevision,\n          ...(credential === undefined ? {} : { targetCredentialId: credential.credentialId }),\n          bindingDigest: privateBinding,\n        });\n\n        const challenge = Object.freeze({\n          ...validatedChallenge,\n          revision: snapshotPasswordRevision(validatedChallenge.revision),\n        });\n\n        const granted = yield* actionEvidence.verify({\n          challenge,\n          invocation,\n          proof: request.actionProof,\n          currentPasswordEvidence,\n          recovery: recovery?.input,\n        });\n\n        const evidenceValue = yield* snapshotAuthenticationEvidence(granted.evidence).pipe(\n          Effect.mapError(() => PasswordActionRequired.make({})),\n        );\n\n        const evidence = {\n          ...evidenceValue,\n          revision: snapshotPasswordRevision(evidenceValue.revision),\n        };\n\n        if (\n          evidence.flowId !== AuthenticationFlowId.make(request.commandId) ||\n          evidence.bindingDigest !== privateBinding ||\n          evidence.revision.subjectId !== expectedRevision.subjectId ||\n          evidence.revision.securityRevision !== expectedRevision.securityRevision ||\n          expectedRevision.credentials.some(\n            (item) =>\n              !evidence.revision.credentials.some(\n                (verified) =>\n                  verified.credentialId === item.credentialId &&\n                  verified.revision === item.revision,\n              ),\n          )\n        )\n          return yield* PasswordActionRequired.make({});\n\n        const requirement = yield* snapshotPasswordRequirement({\n          ...granted.requirement,\n          maximumAgeMillis: Math.min(\n            granted.requirement.maximumAgeMillis,\n            policy.maximumEvidenceAgeMillis,\n          ),\n        });\n\n        if (\n          !(yield* assessAuthentication(evidence, requirement).pipe(\n            Effect.mapError(() => PasswordActionRequired.make({})),\n          )).satisfied\n        )\n          return yield* PasswordActionRequired.make({});\n        const authorization: PasswordActionAuthorization = { challenge, evidence, requirement };\n\n        const invalidation = sessionInvalidationWindow(\n          action === \"reset-password\" ? \"password-reset\" : \"credential-change\",\n          strategy.capabilities,\n          strategy.policy,\n        );\n\n        const changed = yield* event(\n          \"credential-change\",\n          credential?.identifier ??\n            LoginIdentifier.make({ namespace: \"subject\", value: expectedRevision.subjectId }),\n          expectedRevision.subjectId,\n        );\n\n        return {\n          input: {\n            moduleId,\n            commandId: request.commandId,\n            expectedRevision,\n            credential,\n            replacement,\n            authorization,\n            invalidation,\n          },\n          prepare: (decision, journal) => {\n            if (decision === \"changed\") journal.stage(changed);\n\n            // Rejection is a committed VALUE until the caller reads the root receipt.\n            return journal.prepare({\n              value: decision === \"changed\" ? { invalidation } : { _tag: \"Rejected\" as const },\n              credentialCommands:\n                decision === \"changed\"\n                  ? [\n                      { _tag: \"Clear\" as const, slot: \"session\" as const },\n                      { _tag: \"Clear\" as const, slot: \"pending-proof\" as const },\n                      ...(action === \"reset-password\"\n                        ? [{ _tag: \"Clear\" as const, slot: \"proof-continuation\" as const }]\n                        : []),\n                    ]\n                  : [],\n            });\n          },\n        };\n      });\n\n      return Passwords.of({\n        planRegister: Effect.fn(\"Passwords.planRegister\")(function* (request) {\n          yield* noAmbient();\n\n          const data = yield* Schema.encodeEffect(registrationCodec)(request.registration).pipe(\n            Effect.flatMap(Schema.decodeEffect(registrationCodec)),\n            Effect.provide(services),\n            Effect.mapError(() => PasswordRejected.make({})),\n          );\n\n          const replacement = yield* newReplacement(request.newPassword, request.email);\n          const id = identifier(request.email);\n          const created = yield* event(\"registration\", id);\n\n          const commit = Effect.gen(function* () {\n            const owner = yield* RegistrationAuthority;\n\n            return yield* owner.register(\n              {\n                moduleId,\n                requestId: request.requestId,\n                identifier: id,\n                registration: data,\n                replacement,\n              },\n              (decision, journal) => {\n                if (decision._tag === \"Created\")\n                  journal.stage(\n                    lifecycleEvent({\n                      ...created,\n                      snapshot: lifecycleSnapshot({\n                        ...created.snapshot,\n                        subjectId: decision.subjectId,\n                      }),\n                    }),\n                  );\n\n                return journal.prepare(\n                  decision._tag === \"Pending\"\n                    ? { _tag: \"ProvisioningPending\" as const, reference: decision.reference }\n                    : { _tag: \"RegistrationAccepted\" as const },\n                );\n              },\n            );\n          });\n\n          return { commit };\n        }),\n        signIn: Effect.fn(\"Passwords.signIn\")(function* (request) {\n          const verified = yield* verifyPassword(request, \"sign-in\");\n\n          const values = yield* claims.resolve(\n            yield* snapshotPasswordCredential(verified.credential),\n          );\n\n          // Settlement is already committed. No physical owner surrounds async session\n          // planning; final authority compares the SAME original semantic revisions.\n          return yield* completion\n            .prepare({ evidence: verified.evidence, claims: values })\n            .pipe(Effect.flatMap(read), Effect.mapError(passwordCompletionFailure));\n        }),\n        planAdd: Effect.fn(\"Passwords.planAdd\")(function* (invocation, request) {\n          yield* noAmbient();\n          if (invocation._tag !== \"Authenticated\") return yield* PasswordRejected.make({});\n          const caller = invocation;\n          const existing = yield* store.readForSubject({ moduleId, subjectId: caller.subjectId });\n\n          if (Option.isSome(existing)) return yield* PasswordRejected.make({});\n\n          const revision = snapshotPasswordRevision(\n            yield* authority\n              .capture(caller.subjectId, [])\n              .pipe(Effect.mapError(() => PasswordRejected.make({}))),\n          );\n\n          const plan = yield* planMutation(\"add-password\", invocation, request, revision);\n\n          const commit = Effect.gen(function* () {\n            const owner = yield* PasswordPersistence;\n\n            return yield* owner.addIfAbsent(plan.input, plan.prepare);\n          });\n\n          return { commit };\n        }),\n        planChange: Effect.fn(\"Passwords.planChange\")(function* (invocation, request) {\n          yield* noAmbient();\n          if (invocation._tag !== \"Authenticated\") return yield* PasswordRejected.make({});\n          const caller = invocation;\n          const existing = yield* store.readForSubject({ moduleId, subjectId: caller.subjectId });\n\n          if (Option.isNone(existing)) return yield* PasswordRejected.make({});\n\n          const verified = yield* verifyPassword(\n            {\n              flowId: AuthenticationFlowId.make(request.commandId),\n              email: existing.value.identifier.value as Email,\n              password: request.currentPassword,\n            },\n            \"change\",\n            caller.subjectId,\n          );\n\n          const plan = yield* planMutation(\n            \"change-password\",\n            invocation,\n            request,\n            verified.evidence.revision,\n            verified.credential,\n            verified.evidence,\n          );\n\n          const commit = Effect.gen(function* () {\n            const owner = yield* PasswordPersistence;\n\n            return yield* owner.replaceIfCurrent(plan.input, plan.prepare);\n          });\n\n          return { commit };\n        }),\n        requestReset: Effect.fn(\"Passwords.requestReset\")(function* (request) {\n          yield* noAmbient();\n          const bound = yield* recoveryBinding(request);\n\n          const dispatch = yield* proofs\n            .prepareIssue({\n              requestId: request.requestId,\n              binding: bound.binding,\n              locale: request.locale,\n              eligible: Option.isSome(bound.target),\n            })\n            .pipe(\n              Effect.flatMap(readProofCommit),\n              Effect.mapError(() => PasswordUnavailable.make({})),\n            );\n\n          yield* dispatch.dispatch.pipe(Effect.mapError(() => PasswordUnavailable.make({})));\n\n          return dispatch.receipt;\n        }),\n        verifyReset: Effect.fn(\"Passwords.verifyReset\")(function* (request) {\n          yield* noAmbient();\n          const bound = yield* recoveryBinding(request);\n\n          const result = yield* proofs\n            .prepareAttempt({\n              reference: request.reference,\n              binding: bound.binding,\n              credential: request.secret,\n            })\n            .pipe(\n              Effect.flatMap(readProofCommit),\n              Effect.mapError(() => PasswordRejected.make({})),\n            );\n\n          if (result.value._tag === \"Rejected\") return yield* PasswordRejected.make({});\n\n          return {\n            value: { continuation: result.value.continuation },\n            credentialCommands: result.credentialCommands,\n          };\n        }),\n        planReset: Effect.fn(\"Passwords.planReset\")(function* (invocation, request) {\n          yield* noAmbient();\n          const bound = yield* recoveryBinding(request);\n\n          if (Option.isNone(bound.target)) return yield* PasswordRejected.make({});\n\n          const proof = yield* proofs\n            .planComplete({\n              continuationId: request.continuationId,\n              binding: bound.binding,\n              credential: request.credential,\n            })\n            .pipe(Effect.mapError(() => PasswordRejected.make({})));\n\n          if (!(yield* store.checkReset(proof.input))) return yield* PasswordRejected.make({});\n\n          const plan = yield* planMutation(\n            \"reset-password\",\n            invocation,\n            request,\n            bound.target.value.revision,\n            bound.target.value,\n            undefined,\n            proof,\n          );\n\n          const commit = Effect.gen(function* () {\n            const owner = yield* PasswordPersistence;\n\n            return yield* owner.resetWithProof({ ...plan.input, completion: proof }, plan.prepare);\n          });\n\n          return { commit };\n        }),\n        status: Effect.fn(\"Passwords.status\")(function* (invocation) {\n          if (invocation._tag !== \"Authenticated\") return yield* PasswordRejected.make({});\n          const caller = invocation;\n\n          return {\n            hasPassword: Option.isSome(\n              yield* store.readForSubject({ moduleId, subjectId: caller.subjectId }),\n            ),\n          };\n        }),\n        cleanup: Effect.fn(\"Passwords.cleanup\")(function* (limit) {\n          yield* noAmbient();\n          yield* Schema.decodeEffect(\n            Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n          )(limit).pipe(Effect.mapError(() => PasswordRejected.make({})));\n\n          return yield* read(\n            yield* store.cleanupAttempts({ moduleId, limit }, (result, journal) =>\n              journal.prepare(result),\n            ),\n          );\n        }),\n      });\n    }),\n  );\n\n  const Register = makeOperation(`${moduleId}/register`, {\n    payload: RegisterInput,\n    success: RegisterResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n  });\n\n  const SignIn = makeOperation(`${moduleId}/sign-in`, {\n    payload: SignInInput,\n    success: sessions.CompletionResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const AddPassword = makeOperation(`${moduleId}/add-password`, {\n    payload: AddInput,\n    success: MutationResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const ChangePassword = makeOperation(`${moduleId}/change-password`, {\n    payload: ChangeInput,\n    success: MutationResult,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const RequestReset = makeOperation(`${moduleId}/request-reset`, {\n    payload: RequestResetInput,\n    success: ProofRequestReceipt,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n  });\n\n  const VerifyReset = makeOperation(`${moduleId}/verify-reset`, {\n    payload: VerifyResetInput,\n    success: Schema.Struct({ continuation: ProofContinuation }),\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const CompleteReset = makeOperation(`${moduleId}/complete-reset`, {\n    payload: CompleteResetInput,\n    success: MutationResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const PasswordStatus = makeOperation(`${moduleId}/status`, {\n    payload: Schema.Void,\n    success: Status,\n    error: Failure,\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"read-only\",\n  });\n\n  const CleanupAttempts = makeOperation(`${moduleId}/cleanup`, {\n    payload: Schema.Struct({\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n    }),\n    success: Cleanup,\n    error: Failure,\n    access: \"system\",\n    replay: \"idempotent\",\n  });\n\n  const mutationResult = (\n    result: MutationValue,\n  ): Effect.Effect<AuthOperationResult<typeof MutationResult.Type>, PasswordRejected> =>\n    \"invalidation\" in result.value\n      ? Effect.succeed({ value: result.value, credentialCommands: result.credentialCommands })\n      : Effect.fail(PasswordRejected.make({}));\n\n  const handlersLayer = Layer.mergeAll(\n    Register.handlerLayer(\n      Effect.fn(\"PasswordOperation.register\")(function* (request) {\n        return yield* read(yield* (yield* (yield* Passwords).planRegister(request)).commit);\n      }),\n    ),\n    SignIn.credentialHandlerLayer(\n      Effect.fn(\"PasswordOperation.signIn\")(function* (request) {\n        return yield* (yield* Passwords).signIn(request);\n      }),\n    ),\n    AddPassword.credentialHandlerLayer(\n      Effect.fn(\"PasswordOperation.add\")(function* (request, invocation) {\n        return yield* read(\n          yield* (yield* (yield* Passwords).planAdd(invocation, request)).commit,\n        ).pipe(Effect.flatMap(mutationResult));\n      }),\n    ),\n    ChangePassword.credentialHandlerLayer(\n      Effect.fn(\"PasswordOperation.change\")(function* (request, invocation) {\n        return yield* read(\n          yield* (yield* (yield* Passwords).planChange(invocation, request)).commit,\n        ).pipe(Effect.flatMap(mutationResult));\n      }),\n    ),\n    RequestReset.handlerLayer(\n      Effect.fn(\"PasswordOperation.requestReset\")(function* (request) {\n        return yield* (yield* Passwords).requestReset(request);\n      }),\n    ),\n    VerifyReset.credentialHandlerLayer(\n      Effect.fn(\"PasswordOperation.verifyReset\")(function* (request) {\n        return yield* (yield* Passwords).verifyReset(request);\n      }),\n    ),\n    CompleteReset.credentialHandlerLayer(\n      Effect.fn(\"PasswordOperation.reset\")(function* (request, invocation) {\n        return yield* read(\n          yield* (yield* (yield* Passwords).planReset(invocation, request)).commit,\n        ).pipe(Effect.flatMap(mutationResult));\n      }),\n    ),\n    PasswordStatus.handlerLayer(\n      Effect.fn(\"PasswordOperation.status\")(function* (_, invocation) {\n        return yield* (yield* Passwords).status(invocation);\n      }),\n    ),\n    CleanupAttempts.handlerLayer(\n      Effect.fn(\"PasswordOperation.cleanup\")(function* (request) {\n        return yield* (yield* Passwords).cleanup(request.limit);\n      }),\n    ),\n  );\n\n  const operations = {\n    Register,\n    SignIn,\n    AddPassword,\n    ChangePassword,\n    RequestReset,\n    VerifyReset,\n    CompleteReset,\n    PasswordStatus,\n    CleanupAttempts,\n  };\n\n  return Object.freeze({\n    strategy: makeAuthStrategy(\n      {\n        signIn: Effect.fn(\"Passwords.signInRequest\")(function* (\n          invocation: AuthInvocation,\n          request: Omit<typeof SignInInput.Encoded, \"flowId\">,\n        ) {\n          const crypto = yield* Crypto.Crypto;\n\n          const flowId = yield* crypto.randomUUIDv4.pipe(\n            Effect.mapError(() => PasswordUnavailable.make({})),\n          );\n\n          return yield* SignIn.invoke(invocation, { ...request, flowId });\n        }),\n        register: Register.invoke,\n        addPassword: AddPassword.invoke,\n        changePassword: ChangePassword.invoke,\n        requestReset: RequestReset.invoke,\n        verifyReset: VerifyReset.invoke,\n        completeReset: CompleteReset.invoke,\n        passwordStatus: PasswordStatus.invoke,\n      },\n      handlersLayer.pipe(\n        Layer.provide(defaultLayer(Passwords, layer)),\n        Layer.provide(defaultLayer(reset.Proofs, reset.emailLayer)),\n        Layer.provide([hashingLayer, newPasswordLayer, hooksLayer]),\n        Layer.provideMerge(cryptoLayer),\n      ),\n      { completion: true },\n    ),\n    prepared: (configuration: PasswordPreparedConfiguration) =>\n      makePasswordPrepared(\n        moduleId,\n        { policy: policyInput, strategy: sessions.SessionStrategy, reset: reset.Proofs },\n        configuration,\n      ),\n    Passwords,\n    RegistrationAuthority,\n    ClaimsForPassword,\n    layer,\n    handlersLayer,\n    operations,\n    reset,\n    group: operationGroup(...Object.values(operations)),\n  });\n};\n\nexport function makePasswordMethod<\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  Registration extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: Parameters<typeof makePasswordWithManagement<Id, SessionId, Claims, Registration>>[1],\n): ReturnType<typeof makePasswordWithManagement<Id, SessionId, Claims, Registration>>;\n\nexport function makePasswordMethod<\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: PasswordSignInOptions<SessionId, Claims>,\n): ReturnType<typeof makePasswordSignIn<Id, SessionId, Claims>>;\n\nexport function makePasswordMethod<\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  Registration extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options:\n    | PasswordSignInOptions<SessionId, Claims>\n    | Parameters<typeof makePasswordWithManagement<Id, SessionId, Claims, Registration>>[1],\n) {\n  return \"registration\" in options\n    ? makePasswordWithManagement(moduleId, options)\n    : makePasswordSignIn(moduleId, options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EA,MAAM,eAAe,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,KAAK,CAAC;AAC7F,MAAM,WAAW,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AACxF,MAAM,cAAc,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC1F,MAAM,SAAS,qBAAqB,MAAM,OAAO,YAAY,GAAG,CAAC;AAEjE,MAAM,iBAAiB,OAAO,MAAM,CAClC,OAAO,aAAa,wBAAwB,CAAC,CAAC,GAC9C,OAAO,aAAa,uBAAuB,EACzC,WAAW,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,EAChE,CAAC,CACH,CAAC;AAOD,MAAM,iBAAiB,OAAO,OAAO,EAAE,cAAc,0BAA0B,CAAC;AAChF,MAAM,SAAS,OAAO,OAAO,EAAE,aAAa,OAAO,QAAQ,CAAC;AAC5D,MAAM,UAAU,OAAO,OAAO;CAAE,SAAS,OAAO;CAAS,SAAS,OAAO;AAAQ,CAAC;AAElF,MAAM,YAAY,OAAO,GAAG,qBAAqB,CAAC,CAAC,aAAa;CAC9D,IAAI,OAAO,gBAAgB,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,QAAW,YACf,QAAQ,KAAK,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC;;;;AAKvE,MAAM,8BAMJ,UACA,UAWG;CACH,MAAM,WAAW,MAAM;CAEvB,MAAM,oBAKF,MAAM;CAEV,MAAM,cAAc,6BAA6B,MAAM,MAAM;CAE7D,MAAM,QAAQ,gBAAgB,GAAG,SAAS,SAAS;EACjD,GAAG,MAAM;EACT,SAAS,aAAa,KAAK,gBAAgB;EAC3C,SAAS;EACT,SAAS;CACX,CAAC;CAID,MAAM,wBAAwB,QAAQ,QAyBpC,wBAAwB,SAAS,uBAAuB;CAE1D,MAAM,oBAAoB,QAAQ,QAOhC,wBAAwB,SAAS,QAAQ;CAE3C,MAAM,gBAAgB,OAAO,OAAO;EAClC,WAAW;EACX,OAAO;EACP,aAAa;EACb,cAAc;CAChB,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAAE,QAAQ;EAAQ,GAAG,oBAAoB;CAAO,CAAC;CAEnF,MAAM,cAAc;EAClB,WAAW;EACX,aAAa;EACb,aAAa,OAAO,YAAY,WAAW;CAC7C;CAEA,MAAM,WAAW,OAAO,OAAO,WAAW;CAC1C,MAAM,cAAc,OAAO,OAAO;EAAE,GAAG;EAAa,iBAAiB;CAAS,CAAC;CAC/E,MAAM,YAAY;EAAE,QAAQ;EAAQ,OAAO;CAAa;CAExD,MAAM,oBAAoB,OAAO,OAAO;EACtC,GAAG;EACH,WAAW;EACX,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;CAC5D,CAAC;CAED,MAAM,mBAAmB,OAAO,OAAO;EACrC,GAAG;EACH,WAAW;EACX,QAAQ;CACV,CAAC;CAED,MAAM,qBAAqB,OAAO,OAAO;EACvC,GAAG;EACH,GAAG;EACH,gBAAgB;EAChB,YAAY;CACd,CAAC;CAED,MAAM,UAAU,OAAO,MAAM;EAC3B;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CAcD,MAAM,YAAY,QAAQ,QAuCxB,wBAAwB,SAAS,QAAQ;CAE3C,MAAM,QAAQ,MAAM,OAClB,WACA,OAAO,IAAI,aAAa;EACtB,IAAI,CAAC,OAAO,GAAG,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAC3E,OAAO,OAAO,iCAAiC,KAAK,CAAC,CAAC;EACxD,MAAM,SAAS,OAAO,6BAA6B,WAAW;EAC9D,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,iBAAiB,OAAO;EAC9B,MAAM,SAAS,OAAO;EACtB,MAAM,YAAY,OAAO;EACzB,MAAM,aAAa,OAAO,SAAS;EACnC,MAAM,WAAW,OAAO,SAAS;EACjC,MAAM,SAAS,OAAO,MAAM;EAC5B,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO,OAAO;EAE7B,MAAM,WAAW,OAAO,OAAO,QAE7B;EAEF,MAAM,oBAAoB,OAAO,WAAW,iBAAiB;EAE7D,MAAM,sBAAsB,QAAQ,KAAK,qBAAqB,KAAK,CAAC,CAAC,KACnE,QAAQ,IAAI,iBAAiB,MAAM,GACnC,QAAQ,IAAI,kBAAkB,OAAO,GACrC,QAAQ,IAAI,yBAAyB,SAAS,GAC9C,QAAQ,IAAI,gBAAgB,KAAK,GACjC,QAAQ,IAAI,OAAO,QAAQ,MAAM,CACnC;EAEA,MAAM,cAAc,wBAAwB;GAAE;GAAU;EAAO,CAAC;EAchE,MAAM,EAAE,QAAQ,YAAY,gBAAgB,OAAO,mBAAmB;GAXpE,YAAY,YAAY;GACxB,SAAS,GAAG,SACV,YAAY,OAAO,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;GACtE,iBAAiB,GAAG,SAClB,YAAY,eAAe,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;GAC9E,QAAQ,GAAG,SACT,YAAY,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;GACrE,iBAAiB,GAAG,SAClB,YAAY,eAAe,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,QAAQ,mBAAmB,CAAC;EAGL;EAE3E,MAAM,kBAAkB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,SAGvE;GACD,MAAM,KAAK,WAAW,QAAQ,KAAK;GAEnC,MAAM,SAAS,OAAO,MACnB,eAAe;IAAE;IAAU,YAAY;GAAG,CAAC,CAAC,CAC5C,KACC,OAAO,SAAS,UACd,OAAO,OAAO,KAAK,IACf,OAAO,QAAQ,OAAO,KAAiC,CAAC,IACxD,2BAA2B,MAAM,KAAK,CAAC,CAAC,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,CAC1E,CACF;GAEF,MAAM,OAAO;IACX,QAAQ,QAAQ;IAChB,eAAe,OAAO,OAAO;KAC3B;KACA;KACA,QAAQ;KACR,QAAQ;IACV,CAAC;IACD,YAAY;GACd;GAEA,IAAI,OAAO,OAAO,MAAM,GACtB,OAAO;IAAE,SAAS;KAAE,MAAM;KAAuB,GAAG;IAAK;IAAG;GAAO;GACrE,IACE,OAAO,MAAM,+BAA+B,KAAA,KAC5C,OAAO,MAAM,WAAW,UAAU,QAAQ,SAC1C,OAAO,MAAM,WAAW,cAAc,WACtC,OAAO,MAAM,aAAa,UAE1B,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAE3C,OAAO;IACL,SAAS;KAAE,MAAM;KAAoB,GAAG;KAAM,UAAU,OAAO,MAAM;IAAS;IAC9E;GACF;EACF,CAAC;EAED,MAAM,eAAe,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACvD,QACA,YACA,SACA,kBACA,YACA,yBACA,UACqC;GACrC,IACE,OAAO,gCACP,SAAS,aAAa,wBAAwB,aAE9C,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;GACjD,mBAAmB,yBAAyB,gBAAgB;GAE5D,MAAM,cAAc,OAAO,eACzB,QAAQ,aACR,YAAY,WAAW,KACzB;GAEA,MAAM,iBAAiB,OAAO,OAAO;IACnC;IACA;IACA;IACA,QAAQ;IACR,iBAAiB;IACjB,iBAAiB;IACjB,YAAY,gBAAgB;IAC5B,GAAG,CAAC,GAAG,iBAAiB,WAAW,CAAC,CACjC,MAAM,GAAG,MACR,EAAE,eAAe,EAAE,eAAe,KAAK,EAAE,eAAe,EAAE,eAAe,IAAI,CAC/E,CAAC,CACA,SAAS,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC;IACvD,YAAY;IACZ,SAAS,MAAM,YAAY,QAAQ;GACrC,CAAC;GAED,MAAM,qBAAqB,wBAAwB,KAAK;IACtD;IACA;IACA,WAAW,QAAQ;IACnB,UAAU;IACV,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,oBAAoB,WAAW,aAAa;IAClF,eAAe;GACjB,CAAC;GAED,MAAM,YAAY,OAAO,OAAO;IAC9B,GAAG;IACH,UAAU,yBAAyB,mBAAmB,QAAQ;GAChE,CAAC;GAED,MAAM,UAAU,OAAO,eAAe,OAAO;IAC3C;IACA;IACA,OAAO,QAAQ;IACf;IACA,UAAU,UAAU;GACtB,CAAC;GAED,MAAM,gBAAgB,OAAO,+BAA+B,QAAQ,QAAQ,CAAC,CAAC,KAC5E,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD;GAEA,MAAM,WAAW;IACf,GAAG;IACH,UAAU,yBAAyB,cAAc,QAAQ;GAC3D;GAEA,IACE,SAAS,WAAW,qBAAqB,KAAK,QAAQ,SAAS,KAC/D,SAAS,kBAAkB,kBAC3B,SAAS,SAAS,cAAc,iBAAiB,aACjD,SAAS,SAAS,qBAAqB,iBAAiB,oBACxD,iBAAiB,YAAY,MAC1B,SACC,CAAC,SAAS,SAAS,YAAY,MAC5B,aACC,SAAS,iBAAiB,KAAK,gBAC/B,SAAS,aAAa,KAAK,QAC/B,CACJ,GAEA,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;GAE9C,MAAM,cAAc,OAAO,4BAA4B;IACrD,GAAG,QAAQ;IACX,kBAAkB,KAAK,IACrB,QAAQ,YAAY,kBACpB,OAAO,wBACT;GACF,CAAC;GAED,IACE,EAAE,OAAO,qBAAqB,UAAU,WAAW,CAAC,CAAC,KACnD,OAAO,eAAe,uBAAuB,KAAK,CAAC,CAAC,CAAC,CACvD,EAAA,CAAG,WAEH,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;GAC9C,MAAM,gBAA6C;IAAE;IAAW;IAAU;GAAY;GAEtF,MAAM,eAAe,0BACnB,WAAW,mBAAmB,mBAAmB,qBACjD,SAAS,cACT,SAAS,MACX;GAEA,MAAM,UAAU,OAAO,MACrB,qBACA,YAAY,cACV,gBAAgB,KAAK;IAAE,WAAW;IAAW,OAAO,iBAAiB;GAAU,CAAC,GAClF,iBAAiB,SACnB;GAEA,OAAO;IACL,OAAO;KACL;KACA,WAAW,QAAQ;KACnB;KACA;KACA;KACA;KACA;IACF;IACA,UAAU,UAAU,YAAY;KAC9B,IAAI,aAAa,WAAW,QAAQ,MAAM,OAAO;KAGjD,OAAO,QAAQ,QAAQ;MACrB,OAAO,aAAa,YAAY,EAAE,aAAa,IAAI,EAAE,MAAM,WAAoB;MAC/E,oBACE,aAAa,YACT;OACE;QAAE,MAAM;QAAkB,MAAM;OAAmB;OACnD;QAAE,MAAM;QAAkB,MAAM;OAAyB;OACzD,GAAI,WAAW,mBACX,CAAC;QAAE,MAAM;QAAkB,MAAM;OAA8B,CAAC,IAChE,CAAC;MACP,IACA,CAAC;KACT,CAAC;IACH;GACF;EACF,CAAC;EAED,OAAO,UAAU,GAAG;GAClB,cAAc,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,SAAS;IACpE,OAAO,UAAU;IAEjB,MAAM,OAAO,OAAO,OAAO,aAAa,iBAAiB,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,KAC/E,OAAO,QAAQ,OAAO,aAAa,iBAAiB,CAAC,GACrD,OAAO,QAAQ,QAAQ,GACvB,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,cAAc,OAAO,eAAe,QAAQ,aAAa,QAAQ,KAAK;IAC5E,MAAM,KAAK,WAAW,QAAQ,KAAK;IACnC,MAAM,UAAU,OAAO,MAAM,gBAAgB,EAAE;IAkC/C,OAAO,EAAE,QAhCM,OAAO,IAAI,aAAa;KAGrC,OAAO,QAAO,OAFO,sBAAA,CAED,SAClB;MACE;MACA,WAAW,QAAQ;MACnB,YAAY;MACZ,cAAc;MACd;KACF,IACC,UAAU,YAAY;MACrB,IAAI,SAAS,SAAS,WACpB,QAAQ,MACN,eAAe;OACb,GAAG;OACH,UAAU,kBAAkB;QAC1B,GAAG,QAAQ;QACX,WAAW,SAAS;OACtB,CAAC;MACH,CAAC,CACH;MAEF,OAAO,QAAQ,QACb,SAAS,SAAS,YACd;OAAE,MAAM;OAAgC,WAAW,SAAS;MAAU,IACtE,EAAE,MAAM,uBAAgC,CAC9C;KACF,CACF;IACF,CAEc,EAAE;GAClB,CAAC;GACD,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAAS;IACxD,MAAM,WAAW,OAAO,eAAe,SAAS,SAAS;IAEzD,MAAM,SAAS,OAAO,OAAO,QAC3B,OAAO,2BAA2B,SAAS,UAAU,CACvD;IAIA,OAAO,OAAO,WACX,QAAQ;KAAE,UAAU,SAAS;KAAU,QAAQ;IAAO,CAAC,CAAC,CACxD,KAAK,OAAO,QAAQ,IAAI,GAAG,OAAO,SAAS,yBAAyB,CAAC;GAC1E,CAAC;GACD,SAAS,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,YAAY,SAAS;IACtE,OAAO,UAAU;IACjB,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC/E,MAAM,SAAS;IACf,MAAM,WAAW,OAAO,MAAM,eAAe;KAAE;KAAU,WAAW,OAAO;IAAU,CAAC;IAEtF,IAAI,OAAO,OAAO,QAAQ,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAEnE,MAAM,WAAW,yBACf,OAAO,UACJ,QAAQ,OAAO,WAAW,CAAC,CAAC,CAAC,CAC7B,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CAC1D;IAEA,MAAM,OAAO,OAAO,aAAa,gBAAgB,YAAY,SAAS,QAAQ;IAQ9E,OAAO,EAAE,QANM,OAAO,IAAI,aAAa;KAGrC,OAAO,QAAO,OAFO,oBAAA,CAED,YAAY,KAAK,OAAO,KAAK,OAAO;IAC1D,CAEc,EAAE;GAClB,CAAC;GACD,YAAY,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,YAAY,SAAS;IAC5E,OAAO,UAAU;IACjB,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC/E,MAAM,SAAS;IACf,MAAM,WAAW,OAAO,MAAM,eAAe;KAAE;KAAU,WAAW,OAAO;IAAU,CAAC;IAEtF,IAAI,OAAO,OAAO,QAAQ,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAEnE,MAAM,WAAW,OAAO,eACtB;KACE,QAAQ,qBAAqB,KAAK,QAAQ,SAAS;KACnD,OAAO,SAAS,MAAM,WAAW;KACjC,UAAU,QAAQ;IACpB,GACA,UACA,OAAO,SACT;IAEA,MAAM,OAAO,OAAO,aAClB,mBACA,YACA,SACA,SAAS,SAAS,UAClB,SAAS,YACT,SAAS,QACX;IAQA,OAAO,EAAE,QANM,OAAO,IAAI,aAAa;KAGrC,OAAO,QAAO,OAFO,oBAAA,CAED,iBAAiB,KAAK,OAAO,KAAK,OAAO;IAC/D,CAEc,EAAE;GAClB,CAAC;GACD,cAAc,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,SAAS;IACpE,OAAO,UAAU;IACjB,MAAM,QAAQ,OAAO,gBAAgB,OAAO;IAE5C,MAAM,WAAW,OAAO,OACrB,aAAa;KACZ,WAAW,QAAQ;KACnB,SAAS,MAAM;KACf,QAAQ,QAAQ;KAChB,UAAU,OAAO,OAAO,MAAM,MAAM;IACtC,CAAC,CAAC,CACD,KACC,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;IAEF,OAAO,SAAS,SAAS,KAAK,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjF,OAAO,SAAS;GAClB,CAAC;GACD,aAAa,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAS;IAClE,OAAO,UAAU;IACjB,MAAM,QAAQ,OAAO,gBAAgB,OAAO;IAE5C,MAAM,SAAS,OAAO,OACnB,eAAe;KACd,WAAW,QAAQ;KACnB,SAAS,MAAM;KACf,YAAY,QAAQ;IACtB,CAAC,CAAC,CACD,KACC,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEF,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAE5E,OAAO;KACL,OAAO,EAAE,cAAc,OAAO,MAAM,aAAa;KACjD,oBAAoB,OAAO;IAC7B;GACF,CAAC;GACD,WAAW,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,YAAY,SAAS;IAC1E,OAAO,UAAU;IACjB,MAAM,QAAQ,OAAO,gBAAgB,OAAO;IAE5C,IAAI,OAAO,OAAO,MAAM,MAAM,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAEvE,MAAM,QAAQ,OAAO,OAClB,aAAa;KACZ,gBAAgB,QAAQ;KACxB,SAAS,MAAM;KACf,YAAY,QAAQ;IACtB,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,IAAI,EAAE,OAAO,MAAM,WAAW,MAAM,KAAK,IAAI,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAEnF,MAAM,OAAO,OAAO,aAClB,kBACA,YACA,SACA,MAAM,OAAO,MAAM,UACnB,MAAM,OAAO,OACb,KAAA,GACA,KACF;IAQA,OAAO,EAAE,QANM,OAAO,IAAI,aAAa;KAGrC,OAAO,QAAO,OAFO,oBAAA,CAED,eAAe;MAAE,GAAG,KAAK;MAAO,YAAY;KAAM,GAAG,KAAK,OAAO;IACvF,CAEc,EAAE;GAClB,CAAC;GACD,QAAQ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,YAAY;IAC3D,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC/E,MAAM,SAAS;IAEf,OAAO,EACL,aAAa,OAAO,OAClB,OAAO,MAAM,eAAe;KAAE;KAAU,WAAW,OAAO;IAAU,CAAC,CACvE,EACF;GACF,CAAC;GACD,SAAS,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,OAAO;IACxD,OAAO,UAAU;IACjB,OAAO,OAAO,aACZ,OAAO,IAAI,MAAM,OAAO,UAAU;KAAE,SAAS;KAAG,SAAS;IAAK,CAAC,CAAC,CAClE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,OAAO,KACZ,OAAO,MAAM,gBAAgB;KAAE;KAAU;IAAM,IAAI,QAAQ,YACzD,QAAQ,QAAQ,MAAM,CACxB,CACF;GACF,CAAC;EACH,CAAC;CACH,CAAC,CACH;CAEA,MAAM,WAAW,cAAc,GAAG,SAAS,YAAY;EACrD,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,WAAW;EAClD,SAAS;EACT,SAAS,SAAS;EAClB,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,cAAc,cAAc,GAAG,SAAS,gBAAgB;EAC5D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,iBAAiB,cAAc,GAAG,SAAS,mBAAmB;EAClE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,eAAe,cAAc,GAAG,SAAS,iBAAiB;EAC9D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,cAAc,cAAc,GAAG,SAAS,gBAAgB;EAC5D,SAAS;EACT,SAAS,OAAO,OAAO,EAAE,cAAc,kBAAkB,CAAC;EAC1D,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,cAAc,GAAG,SAAS,kBAAkB;EAChE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,iBAAiB,cAAc,GAAG,SAAS,UAAU;EACzD,SAAS,OAAO;EAChB,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,cAAc,GAAG,SAAS,WAAW;EAC3D,SAAS,OAAO,OAAO,EACrB,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC,EACzE,CAAC;EACD,SAAS;EACT,OAAO;EACP,QAAQ;EACR,QAAQ;CACV,CAAC;CAED,MAAM,kBACJ,WAEA,kBAAkB,OAAO,QACrB,OAAO,QAAQ;EAAE,OAAO,OAAO;EAAO,oBAAoB,OAAO;CAAmB,CAAC,IACrF,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC;CAE3C,MAAM,gBAAgB,MAAM,SAC1B,SAAS,aACP,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,SAAS;EAC1D,OAAO,OAAO,KAAK,QAAQ,QAAQ,OAAO,UAAA,CAAW,aAAa,OAAO,EAAA,CAAG,MAAM;CACpF,CAAC,CACH,GACA,OAAO,uBACL,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,SAAS;EACxD,OAAO,QAAQ,OAAO,UAAA,CAAW,OAAO,OAAO;CACjD,CAAC,CACH,GACA,YAAY,uBACV,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAS,YAAY;EACjE,OAAO,OAAO,KACZ,QAAQ,QAAQ,OAAO,UAAA,CAAW,QAAQ,YAAY,OAAO,EAAA,CAAG,MAClE,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC;CACvC,CAAC,CACH,GACA,eAAe,uBACb,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,SAAS,YAAY;EACpE,OAAO,OAAO,KACZ,QAAQ,QAAQ,OAAO,UAAA,CAAW,WAAW,YAAY,OAAO,EAAA,CAAG,MACrE,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC;CACvC,CAAC,CACH,GACA,aAAa,aACX,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAAW,SAAS;EAC9D,OAAO,QAAQ,OAAO,UAAA,CAAW,aAAa,OAAO;CACvD,CAAC,CACH,GACA,YAAY,uBACV,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,SAAS;EAC7D,OAAO,QAAQ,OAAO,UAAA,CAAW,YAAY,OAAO;CACtD,CAAC,CACH,GACA,cAAc,uBACZ,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,SAAS,YAAY;EACnE,OAAO,OAAO,KACZ,QAAQ,QAAQ,OAAO,UAAA,CAAW,UAAU,YAAY,OAAO,EAAA,CAAG,MACpE,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,CAAC;CACvC,CAAC,CACH,GACA,eAAe,aACb,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,GAAG,YAAY;EAC9D,OAAO,QAAQ,OAAO,UAAA,CAAW,OAAO,UAAU;CACpD,CAAC,CACH,GACA,gBAAgB,aACd,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,SAAS;EACzD,OAAO,QAAQ,OAAO,UAAA,CAAW,QAAQ,QAAQ,KAAK;CACxD,CAAC,CACH,CACF;CAEA,MAAM,aAAa;EACjB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CAEA,OAAO,OAAO,OAAO;EACnB,UAAU,iBACR;GACE,QAAQ,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3C,YACA,SACA;IAGA,MAAM,SAAS,QAAO,OAFA,OAAO,OAAA,CAEA,aAAa,KACxC,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;IAEA,OAAO,OAAO,OAAO,OAAO,YAAY;KAAE,GAAG;KAAS;IAAO,CAAC;GAChE,CAAC;GACD,UAAU,SAAS;GACnB,aAAa,YAAY;GACzB,gBAAgB,eAAe;GAC/B,cAAc,aAAa;GAC3B,aAAa,YAAY;GACzB,eAAe,cAAc;GAC7B,gBAAgB,eAAe;EACjC,GACA,cAAc,KACZ,MAAM,QAAQ,aAAa,WAAW,KAAK,CAAC,GAC5C,MAAM,QAAQ,aAAa,MAAM,QAAQ,MAAM,UAAU,CAAC,GAC1D,MAAM,QAAQ;GAAC;GAAc;GAAkB;EAAU,CAAC,GAC1D,MAAM,aAAa,WAAW,CAChC,GACA,EAAE,YAAY,KAAK,CACrB;EACA,WAAW,kBACT,qBACE,UACA;GAAE,QAAQ;GAAa,UAAU,SAAS;GAAiB,OAAO,MAAM;EAAO,GAC/E,aACF;EACF;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO,eAAe,GAAG,OAAO,OAAO,UAAU,CAAC;CACpD,CAAC;AACH;AAqBA,SAAgB,mBAMd,UACA,SAGA;CACA,OAAO,kBAAkB,UACrB,2BAA2B,UAAU,OAAO,IAC5C,mBAAmB,UAAU,OAAO;AAC1C"}

package/dist/password/methods/policy.d.mts

@@ -0,0 +1,84 @@
+import { PasswordMethodConfigurationError } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/password/methods/policy.d.ts
+declare const PasswordAttemptPolicy: Schema.Struct<{
+  readonly identifier: Schema.Struct<{
+    readonly limit: Schema.Int;
+    readonly windowMillis: Schema.Int;
+  }>;
+  readonly subject: Schema.Struct<{
+    readonly limit: Schema.Int;
+    readonly windowMillis: Schema.Int;
+  }>;
+  readonly action: Schema.Struct<{
+    readonly limit: Schema.Int;
+    readonly windowMillis: Schema.Int;
+  }>;
+  readonly maximumPending: Schema.Int;
+  readonly attemptLifetimeMillis: Schema.Int;
+}>;
+type PasswordAttemptPolicy = typeof PasswordAttemptPolicy.Type;
+declare const PasswordMethodPolicy: Schema.Struct<{
+  readonly attempts: Schema.Struct<{
+    readonly identifier: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+    readonly subject: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+    readonly action: Schema.Struct<{
+      readonly limit: Schema.Int;
+      readonly windowMillis: Schema.Int;
+    }>;
+    readonly maximumPending: Schema.Int;
+    readonly attemptLifetimeMillis: Schema.Int;
+  }>;
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+  readonly requireImmediateInvalidation: Schema.Boolean;
+}>;
+type PasswordMethodPolicy = typeof PasswordMethodPolicy.Type;
+declare const defaultPasswordMethodPolicy: PasswordMethodPolicy;
+declare const validatePasswordMethodPolicy: (input: {
+  readonly attempts: {
+    readonly identifier: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly subject: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly action: {
+      readonly limit: number;
+      readonly windowMillis: number;
+    };
+    readonly maximumPending: number;
+    readonly attemptLifetimeMillis: number;
+  };
+  readonly maximumEvidenceAgeMillis: number;
+  readonly requireImmediateInvalidation: boolean;
+}) => Effect.Effect<Readonly<{
+  maximumEvidenceAgeMillis: number;
+  requireImmediateInvalidation: boolean;
+  attempts: Readonly<{
+    maximumPending: number;
+    attemptLifetimeMillis: number;
+    identifier: Readonly<{
+      limit: number;
+      windowMillis: number;
+    }>;
+    subject: Readonly<{
+      limit: number;
+      windowMillis: number;
+    }>;
+    action: Readonly<{
+      limit: number;
+      windowMillis: number;
+    }>;
+  }>;
+}>, PasswordMethodConfigurationError, never>;
+//#endregion
+export { PasswordAttemptPolicy, PasswordMethodPolicy, defaultPasswordMethodPolicy, validatePasswordMethodPolicy };
+//# sourceMappingURL=policy.d.mts.map

package/dist/password/methods/policy.mjs

@@ -0,0 +1,80 @@
+import { PasswordMethodConfigurationError } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/password/methods/policy.ts
+const Budget = Schema.Struct({
+	limit: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e6
+	})),
+	windowMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 864e5
+	}))
+});
+const PasswordAttemptPolicy = Schema.Struct({
+	identifier: Budget,
+	subject: Budget,
+	action: Budget,
+	maximumPending: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e3
+	})),
+	attemptLifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	}))
+});
+const PasswordMethodPolicy = Schema.Struct({
+	attempts: PasswordAttemptPolicy,
+	maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	})),
+	requireImmediateInvalidation: Schema.Boolean
+});
+const defaultPasswordMethodPolicy = Object.freeze({
+	maximumEvidenceAgeMillis: 6e4,
+	requireImmediateInvalidation: false,
+	attempts: Object.freeze({
+		identifier: Object.freeze({
+			limit: 10,
+			windowMillis: 6e4
+		}),
+		subject: Object.freeze({
+			limit: 10,
+			windowMillis: 6e4
+		}),
+		action: Object.freeze({
+			limit: 1e3,
+			windowMillis: 6e4
+		}),
+		maximumPending: 10,
+		attemptLifetimeMillis: 6e4
+	})
+});
+/** Capture only policy data; validation remains a typed layer-construction failure. */
+const snapshotPasswordMethodPolicy = (input) => Object.freeze({
+	...input,
+	attempts: Object.freeze({
+		...input?.attempts,
+		identifier: Object.freeze({ ...input?.attempts?.identifier }),
+		subject: Object.freeze({ ...input?.attempts?.subject }),
+		action: Object.freeze({ ...input?.attempts?.action })
+	})
+});
+const validatePasswordMethodPolicy = Effect.fn("validatePasswordMethodPolicy")(function* (input) {
+	const p = yield* Schema.decodeEffect(PasswordMethodPolicy)(input).pipe(Effect.mapError(() => PasswordMethodConfigurationError.make({})));
+	return Object.freeze({
+		...p,
+		attempts: Object.freeze({
+			...p.attempts,
+			identifier: Object.freeze({ ...p.attempts.identifier }),
+			subject: Object.freeze({ ...p.attempts.subject }),
+			action: Object.freeze({ ...p.attempts.action })
+		})
+	});
+});
+//#endregion
+export { PasswordAttemptPolicy, PasswordMethodPolicy, defaultPasswordMethodPolicy, snapshotPasswordMethodPolicy, validatePasswordMethodPolicy };
+
+//# sourceMappingURL=policy.mjs.map

package/dist/password/methods/policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../../src/password/methods/policy.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport { PasswordMethodConfigurationError } from \"./errors\";\n\nconst Budget = Schema.Struct({\n  limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000000 })),\n  windowMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 86400000 })),\n});\n\nexport const PasswordAttemptPolicy = Schema.Struct({\n  identifier: Budget,\n  subject: Budget,\n  action: Budget,\n  maximumPending: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  attemptLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),\n});\n\nexport type PasswordAttemptPolicy = typeof PasswordAttemptPolicy.Type;\n\nexport const PasswordMethodPolicy = Schema.Struct({\n  attempts: PasswordAttemptPolicy,\n  maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),\n  requireImmediateInvalidation: Schema.Boolean,\n});\n\nexport type PasswordMethodPolicy = typeof PasswordMethodPolicy.Type;\n\nexport const defaultPasswordMethodPolicy: PasswordMethodPolicy = Object.freeze({\n  maximumEvidenceAgeMillis: 60_000,\n  requireImmediateInvalidation: false,\n  attempts: Object.freeze({\n    identifier: Object.freeze({ limit: 10, windowMillis: 60_000 }),\n    subject: Object.freeze({ limit: 10, windowMillis: 60_000 }),\n    action: Object.freeze({ limit: 1000, windowMillis: 60_000 }),\n    maximumPending: 10,\n    attemptLifetimeMillis: 60_000,\n  }),\n});\n\n/** Capture only policy data; validation remains a typed layer-construction failure. */\nexport const snapshotPasswordMethodPolicy = (input: PasswordMethodPolicy): PasswordMethodPolicy =>\n  Object.freeze({\n    ...input,\n    attempts: Object.freeze({\n      ...input?.attempts,\n      identifier: Object.freeze({ ...input?.attempts?.identifier }),\n      subject: Object.freeze({ ...input?.attempts?.subject }),\n      action: Object.freeze({ ...input?.attempts?.action }),\n    }),\n  });\n\nexport const validatePasswordMethodPolicy = Effect.fn(\"validatePasswordMethodPolicy\")(function* (\n  input: PasswordMethodPolicy,\n) {\n  const p = yield* Schema.decodeEffect(PasswordMethodPolicy)(input).pipe(\n    Effect.mapError(() => PasswordMethodConfigurationError.make({})),\n  );\n\n  return Object.freeze({\n    ...p,\n    attempts: Object.freeze({\n      ...p.attempts,\n      identifier: Object.freeze({ ...p.attempts.identifier }),\n      subject: Object.freeze({ ...p.attempts.subject }),\n      action: Object.freeze({ ...p.attempts.action }),\n    }),\n  });\n});\n"],"mappings":";;;AAIA,MAAM,SAAS,OAAO,OAAO;CAC3B,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAQ,CAAC,CAAC;CAC1E,cAAc,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAS,CAAC,CAAC;AACvF,CAAC;AAED,MAAa,wBAAwB,OAAO,OAAO;CACjD,YAAY;CACZ,SAAS;CACT,QAAQ;CACR,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAK,CAAC,CAAC;CAChF,uBAAuB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;AAC9F,CAAC;AAID,MAAa,uBAAuB,OAAO,OAAO;CAChD,UAAU;CACV,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CAC/F,8BAA8B,OAAO;AACvC,CAAC;AAID,MAAa,8BAAoD,OAAO,OAAO;CAC7E,0BAA0B;CAC1B,8BAA8B;CAC9B,UAAU,OAAO,OAAO;EACtB,YAAY,OAAO,OAAO;GAAE,OAAO;GAAI,cAAc;EAAO,CAAC;EAC7D,SAAS,OAAO,OAAO;GAAE,OAAO;GAAI,cAAc;EAAO,CAAC;EAC1D,QAAQ,OAAO,OAAO;GAAE,OAAO;GAAM,cAAc;EAAO,CAAC;EAC3D,gBAAgB;EAChB,uBAAuB;CACzB,CAAC;AACH,CAAC;;AAGD,MAAa,gCAAgC,UAC3C,OAAO,OAAO;CACZ,GAAG;CACH,UAAU,OAAO,OAAO;EACtB,GAAG,OAAO;EACV,YAAY,OAAO,OAAO,EAAE,GAAG,OAAO,UAAU,WAAW,CAAC;EAC5D,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,UAAU,QAAQ,CAAC;EACtD,QAAQ,OAAO,OAAO,EAAE,GAAG,OAAO,UAAU,OAAO,CAAC;CACtD,CAAC;AACH,CAAC;AAEH,MAAa,+BAA+B,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACpF,OACA;CACA,MAAM,IAAI,OAAO,OAAO,aAAa,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,KAChE,OAAO,eAAe,iCAAiC,KAAK,CAAC,CAAC,CAAC,CACjE;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,UAAU,OAAO,OAAO;GACtB,GAAG,EAAE;GACL,YAAY,OAAO,OAAO,EAAE,GAAG,EAAE,SAAS,WAAW,CAAC;GACtD,SAAS,OAAO,OAAO,EAAE,GAAG,EAAE,SAAS,QAAQ,CAAC;GAChD,QAAQ,OAAO,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,CAAC;EAChD,CAAC;CACH,CAAC;AACH,CAAC"}

package/dist/password/methods/preparation.mjs

@@ -0,0 +1,54 @@
+import { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../../hooks/models.mjs";
+import { LifecycleHooks } from "../../hooks/LifecycleHooks.mjs";
+import { NewPasswordCheck } from "../NewPasswordCheck.mjs";
+import { PasswordHashing } from "../PasswordHashing.mjs";
+import { makePasswordVerification, passwordHashingDiagnostics, passwordUnexpected } from "./verification.mjs";
+import { Crypto, DateTime, Effect, Encoding } from "effect";
+//#region src/password/methods/preparation.ts
+/** Shared private preparation. Current-password verification always commits admission
+* and settlement, and captures its proof instant before later KDF work. */
+const makePasswordPreparation = ({ moduleId, policy }) => {
+	const { digest, identifier, verifyPassword } = makePasswordVerification({
+		moduleId,
+		policy
+	});
+	return {
+		digest,
+		identifier,
+		newReplacement: Effect.fn("Passwords.newReplacement")(function* (password, email) {
+			const checker = yield* NewPasswordCheck;
+			const hasher = yield* PasswordHashing;
+			const checked = yield* checker.check(password, {
+				serviceName: moduleId,
+				...email === void 0 ? {} : { accountName: email }
+			});
+			return {
+				normalization: checked.normalization,
+				verifier: yield* passwordUnexpected(hasher.hash(checked.password).pipe(passwordHashingDiagnostics))
+			};
+		}),
+		event: Effect.fn("Passwords.event")(function* (action, id, subjectId) {
+			const hooks = yield* LifecycleHooks;
+			const crypto = yield* Crypto.Crypto;
+			const snapshot = lifecycleSnapshot({
+				action,
+				operation: `${moduleId}/${action}`,
+				method: "password",
+				identifiers: [id],
+				...subjectId === void 0 ? {} : { subjectId }
+			});
+			yield* hooks.before(snapshot);
+			const idBytes = yield* passwordUnexpected(crypto.randomBytes(32));
+			return lifecycleEvent({
+				id: LifecycleEventId.make(Encoding.encodeBase64Url(idBytes)),
+				occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+				snapshot
+			});
+		}),
+		verifyPassword
+	};
+};
+//#endregion
+export { makePasswordPreparation };
+
+//# sourceMappingURL=preparation.mjs.map

package/dist/password/methods/preparation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"preparation.mjs","names":["unexpected"],"sources":["../../../src/password/methods/preparation.ts"],"sourcesContent":["import type { Redacted } from \"effect\";\nimport { Crypto, DateTime, Effect, Encoding } from \"effect\";\n\nimport { LifecycleHooks } from \"../../hooks/LifecycleHooks\";\nimport { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../../hooks/models\";\nimport type { LoginIdentifier } from \"../../identity/models\";\nimport type { Email, SubjectId } from \"../../Schema\";\nimport { NewPasswordCheck } from \"../NewPasswordCheck\";\nimport { PasswordHashing } from \"../PasswordHashing\";\nimport type { PasswordMethodPolicy } from \"./policy\";\nimport {\n  makePasswordVerification,\n  passwordHashingDiagnostics,\n  passwordUnexpected as unexpected,\n} from \"./verification\";\n\n/** Shared private preparation. Current-password verification always commits admission\n * and settlement, and captures its proof instant before later KDF work. */\nexport const makePasswordPreparation = ({\n  moduleId,\n  policy,\n}: {\n  readonly moduleId: string;\n  readonly policy: PasswordMethodPolicy;\n}) => {\n  const { digest, identifier, verifyPassword } = makePasswordVerification({ moduleId, policy });\n\n  const newReplacement = Effect.fn(\"Passwords.newReplacement\")(function* (\n    password: Redacted.Redacted<string>,\n    email?: Email,\n  ) {\n    const checker = yield* NewPasswordCheck;\n    const hasher = yield* PasswordHashing;\n\n    const checked = yield* checker.check(password, {\n      serviceName: moduleId,\n      ...(email === undefined ? {} : { accountName: email }),\n    });\n\n    return {\n      normalization: checked.normalization,\n      verifier: yield* unexpected(hasher.hash(checked.password).pipe(passwordHashingDiagnostics)),\n    };\n  });\n\n  const event = Effect.fn(\"Passwords.event\")(function* (\n    action: \"registration\" | \"credential-change\",\n    id: LoginIdentifier,\n    subjectId?: SubjectId,\n  ) {\n    const hooks = yield* LifecycleHooks;\n    const crypto = yield* Crypto.Crypto;\n\n    const snapshot = lifecycleSnapshot({\n      action,\n      operation: `${moduleId}/${action}`,\n      method: \"password\",\n      identifiers: [id],\n      ...(subjectId === undefined ? {} : { subjectId }),\n    });\n\n    yield* hooks.before(snapshot);\n    const idBytes = yield* unexpected(crypto.randomBytes(32));\n\n    return lifecycleEvent({\n      id: LifecycleEventId.make(Encoding.encodeBase64Url(idBytes)),\n      occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n      snapshot,\n    });\n  });\n\n  return { digest, identifier, newReplacement, event, verifyPassword };\n};\n"],"mappings":";;;;;;;;;AAkBA,MAAa,2BAA2B,EACtC,UACA,aAII;CACJ,MAAM,EAAE,QAAQ,YAAY,mBAAmB,yBAAyB;EAAE;EAAU;CAAO,CAAC;CA8C5F,OAAO;EAAE;EAAQ;EAAY,gBA5CN,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC3D,UACA,OACA;GACA,MAAM,UAAU,OAAO;GACvB,MAAM,SAAS,OAAO;GAEtB,MAAM,UAAU,OAAO,QAAQ,MAAM,UAAU;IAC7C,aAAa;IACb,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,MAAM;GACtD,CAAC;GAED,OAAO;IACL,eAAe,QAAQ;IACvB,UAAU,OAAOA,mBAAW,OAAO,KAAK,QAAQ,QAAQ,CAAC,CAAC,KAAK,0BAA0B,CAAC;GAC5F;EACF,CA4B0C;EAAG,OA1B/B,OAAO,GAAG,iBAAiB,CAAC,CAAC,WACzC,QACA,IACA,WACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,SAAS,OAAO,OAAO;GAE7B,MAAM,WAAW,kBAAkB;IACjC;IACA,WAAW,GAAG,SAAS,GAAG;IAC1B,QAAQ;IACR,aAAa,CAAC,EAAE;IAChB,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;GACjD,CAAC;GAED,OAAO,MAAM,OAAO,QAAQ;GAC5B,MAAM,UAAU,OAAOA,mBAAW,OAAO,YAAY,EAAE,CAAC;GAExD,OAAO,eAAe;IACpB,IAAI,iBAAiB,KAAK,SAAS,gBAAgB,OAAO,CAAC;IAC3D,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;IAC5D;GACF,CAAC;EACH,CAEiD;EAAG;CAAe;AACrE"}

package/dist/password/methods/prepared.d.mts

@@ -0,0 +1,53 @@
+import "../../operations/context.mjs";
+import { AuthOperationResult } from "../../operations/credentials.mjs";
+import "../../operations/operation.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement } from "../../sessions/models.mjs";
+import { HookDenied } from "../../hooks/models.mjs";
+import "../../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../../hooks/commit.mjs";
+import "../../sessions/AuthenticationAuthority.mjs";
+import "../../Operations.mjs";
+import "../../sessions/policy.mjs";
+import "../../Auth.mjs";
+import { NewPasswordRejected, PasswordCheckUnavailable } from "../errors.mjs";
+import { PasswordActionRequired, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import "../../proofs/models.mjs";
+import "../../proofs/errors.mjs";
+import "../../proofs/completion.mjs";
+import "../NewPasswordCheck.mjs";
+import "../PasswordHashing.mjs";
+import "./PasswordActionEvidence.mjs";
+import "./policy.mjs";
+import "./PasswordPersistence.mjs";
+import "./preparedModels.mjs";
+import { PasswordPreparedMutation } from "./PasswordPreparedPersistence.mjs";
+import { Context, Crypto, Effect, Layer, Redacted, Schema, Types } from "effect";
+//#region src/password/methods/prepared.d.ts
+interface ServiceId<Id extends string, Kind extends string> {
+  readonly moduleId: Id;
+  readonly kind: Kind;
+}
+declare const Failure: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordActionRequired, typeof PasswordMethodUnsupported, typeof NewPasswordRejected, typeof PasswordCheckUnavailable, typeof HookDenied]>;
+type Failure = typeof Failure.Type;
+declare const MutationResult: Schema.Struct<{
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+}>;
+type MutationValue = AuthOperationResult<typeof MutationResult.Type | {
+  readonly _tag: "Rejected";
+}>;
+interface PasswordPreparedCompletionPlan<R> {
+  readonly input: PasswordPreparedMutation;
+  readonly commit: Effect.Effect<PreparedCommit<MutationValue>, Failure, R>;
+}
+interface PasswordPreparedAuthorization {
+  readonly evidence: AuthenticationEvidence;
+  readonly requirement: AuthenticationRequirement;
+}
+//#endregion
+export { PasswordPreparedAuthorization, PasswordPreparedCompletionPlan, ServiceId };
+//# sourceMappingURL=prepared.d.mts.map