@yielded/auth 0.1.0-beta.1

package/dist/password/methods/preparedModels.mjs

@@ -0,0 +1,278 @@
+import { SubjectId, TokenDigest } from "../../Schema.mjs";
+import { LoginIdentifier } from "../../identity/models.mjs";
+import { SessionInvalidationWindow } from "../../sessions/invalidation.mjs";
+import { AssuranceAlternative, AuthenticationEvidence, AuthenticationProof, AuthenticationRequirement, AuthenticationRevision, SecurityRevision } from "../../sessions/models.mjs";
+import { snapshotAuthenticationEvidence } from "../../sessions/assurance.mjs";
+import { PasswordMethodConfigurationError, PasswordUnavailable } from "./errors.mjs";
+import { ProofBinding, ProofContinuationId } from "../../proofs/models.mjs";
+import { PasswordAction, PasswordActionChallenge, PasswordCommandId, PasswordCredentialSnapshot, PasswordReplacement } from "./models.mjs";
+import { snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "./snapshot.mjs";
+import { PasswordAttemptPolicy } from "./policy.mjs";
+import { DateTime, Effect, Predicate, Redacted, Schema } from "effect";
+//#region src/password/methods/preparedModels.ts
+const Label = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+const Instant = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 864e13
+}));
+const Opaque = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+const PasswordPreparedIntentId = Opaque.pipe(Schema.brand("effect-auth/PasswordPreparedIntentId"));
+const PasswordPreparedCredential = Schema.RedactedFromValue(Opaque);
+const PasswordPreparedVersion = Label.pipe(Schema.brand("effect-auth/PasswordPreparedVersion"));
+const PasswordPreparedConfiguration = Schema.Struct({
+	generation: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	})),
+	lifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 9e5
+	})),
+	preparationLifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	})),
+	retentionMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 2592e6
+	})),
+	maximumPendingPerSubject: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e3
+	})),
+	admission: Schema.Struct({
+		identifier: PasswordAttemptPolicy.fields.identifier,
+		subject: PasswordAttemptPolicy.fields.subject,
+		action: PasswordAttemptPolicy.fields.action
+	})
+});
+const validatePasswordPreparedConfiguration = Effect.fn("validatePasswordPreparedConfiguration")(function* (input) {
+	const p = yield* Schema.decodeEffect(PasswordPreparedConfiguration)(input).pipe(Effect.mapError(() => PasswordMethodConfigurationError.make({})));
+	if (p.retentionMillis < Math.max(p.preparationLifetimeMillis + p.lifetimeMillis, p.admission.identifier.windowMillis, p.admission.subject.windowMillis, p.admission.action.windowMillis)) return yield* PasswordMethodConfigurationError.make({});
+	return freezePlain(p);
+});
+const PasswordPreparedRequirement = Schema.Struct({
+	...AuthenticationRequirement.fields,
+	maximumAgeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 864e5
+	})),
+	alternatives: Schema.NonEmptyArray(Schema.Struct({
+		...AssuranceAlternative.fields,
+		factors: AssuranceAlternative.fields.factors.check(Schema.isMaxLength(3)),
+		minimumCredentials: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 64
+		}))
+	})).check(Schema.isMaxLength(16))
+});
+const BoundedRevision = Schema.Struct({
+	...AuthenticationRevision.fields,
+	subjectId: SubjectId.check(Schema.isMaxLength(256)),
+	securityRevision: SecurityRevision.check(Schema.isMaxLength(256)),
+	credentials: Schema.Array(Schema.Struct({
+		credentialId: Label,
+		revision: SecurityRevision.check(Schema.isMaxLength(256))
+	})).check(Schema.isMaxLength(64))
+});
+const BoundedEvidence = Schema.Struct({
+	...AuthenticationEvidence.fields,
+	revision: BoundedRevision,
+	flowId: AuthenticationEvidence.fields.flowId.check(Schema.isMaxLength(256)),
+	bindingDigest: TokenDigest.check(Schema.isMaxLength(256)),
+	proofs: Schema.NonEmptyArray(Schema.Struct({
+		...AuthenticationProof.fields,
+		method: Label,
+		credentialId: Label,
+		factors: AuthenticationProof.fields.factors.check(Schema.isMaxLength(3))
+	})).check(Schema.isMaxLength(64))
+});
+const BoundedIdentifier = Schema.Struct({
+	namespace: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+	value: Schema.NonEmptyString.check(Schema.isMaxLength(1024))
+}).pipe(Schema.decodeTo(LoginIdentifier));
+const BoundedCredential = Schema.Struct({
+	...PasswordCredentialSnapshot.fields,
+	moduleId: Label,
+	revision: BoundedRevision,
+	credentialId: Label,
+	credentialRevision: SecurityRevision.check(Schema.isMaxLength(256)),
+	verifierVersion: SecurityRevision.check(Schema.isMaxLength(256)),
+	identifier: BoundedIdentifier,
+	identifierBindingRevision: SecurityRevision.check(Schema.isMaxLength(256))
+});
+const BoundedChallenge = Schema.Struct({
+	...PasswordActionChallenge.fields,
+	moduleId: Label,
+	revision: BoundedRevision,
+	targetCredentialId: Schema.optionalKey(Label),
+	bindingDigest: TokenDigest.check(Schema.isMaxLength(256))
+});
+const PasswordPreparedReset = Schema.Struct({
+	continuationId: ProofContinuationId,
+	binding: ProofBinding
+});
+const ReservationFields = {
+	moduleId: Label,
+	generation: PasswordPreparedConfiguration.fields.generation,
+	intentId: PasswordPreparedIntentId,
+	version: PasswordPreparedVersion,
+	commandId: PasswordCommandId,
+	action: PasswordAction,
+	revision: BoundedRevision,
+	credential: Schema.optionalKey(BoundedCredential),
+	capturedRequirement: PasswordPreparedRequirement,
+	reset: Schema.optionalKey(PasswordPreparedReset),
+	invalidation: SessionInvalidationWindow,
+	createdAtMillis: Instant,
+	preparationExpiresAtMillis: Instant,
+	retainUntilMillis: Instant
+};
+const PasswordPreparedReservation = Schema.TaggedStruct("Preparing", ReservationFields);
+const PasswordPreparedReady = Schema.TaggedStruct("Ready", {
+	...ReservationFields,
+	replacement: PasswordReplacement,
+	challenge: BoundedChallenge,
+	baseEvidence: Schema.optionalKey(BoundedEvidence),
+	digest: TokenDigest.check(Schema.isMaxLength(256)),
+	issuedAtMillis: Instant,
+	expiresAtMillis: Instant
+});
+const PasswordPreparedResult = Schema.Union([Schema.TaggedStruct("Prepared", {
+	intentId: PasswordPreparedIntentId,
+	expiresAtMillis: Instant
+}), Schema.TaggedStruct("AlreadyExists", {})]);
+/** Explicit private persistence codec: encodes the Redacted PHC verifier, never a
+* plaintext password. Do not log this value or expose it through an operation. */
+const PasswordPreparedReadyJson = Schema.fromJsonString(PasswordPreparedReady);
+const BoundedRecord = Schema.String.check(Schema.isMaxLength(131072));
+const encodePasswordPreparedReady = Effect.fn("encodePasswordPreparedReady")(function* (value) {
+	if (!bounded(value) || !Schema.is(Schema.toType(PasswordPreparedReady))(value) || !relationships(value)) return yield* PasswordUnavailable.make({});
+	return yield* Schema.encodeEffect(PasswordPreparedReadyJson)(value).pipe(Effect.flatMap(Schema.decodeEffect(BoundedRecord)), Effect.mapError(() => PasswordUnavailable.make({})));
+});
+const decodePasswordPreparedReady = (value) => Schema.decodeEffect(BoundedRecord)(value).pipe(Effect.flatMap(Schema.decodeEffect(PasswordPreparedReadyJson)), Effect.flatMap(snapshotPasswordPreparedReady), Effect.mapError(() => PasswordUnavailable.make({})));
+const freezePlain = (value) => {
+	if (value !== null && typeof value === "object") {
+		const prototype = Object.getPrototypeOf(value);
+		if (Schema.is(LoginIdentifier)(value)) Object.freeze(value);
+		if (Array.isArray(value) || prototype === Object.prototype) {
+			for (const item of Object.values(value)) freezePlain(item);
+			Object.freeze(value);
+		}
+	}
+	return value;
+};
+/** Conservative JSON upper bound before codec traversal/allocation: each UTF-16
+* unit may need six escaped bytes. Count keys, delimiters and numeric instants;
+* bounded iteration stops without first allocating Object.keys/JSON text. */
+const withinRecordBudget = (input) => {
+	let remaining = 131072, nodes = 0;
+	const visit = (value, depth) => {
+		if (++nodes > 4096 || depth > 16) return false;
+		if (Redacted.isRedacted(value)) return visit(Redacted.value(value), depth + 1);
+		if (DateTime.isDateTime(value)) {
+			remaining -= 24;
+			return remaining >= 0;
+		}
+		if (typeof value === "string") {
+			remaining -= value.length * 6 + 2;
+			return remaining >= 0;
+		}
+		if (value === null || typeof value !== "object") {
+			remaining -= 24;
+			return remaining >= 0;
+		}
+		remaining -= 2;
+		if (remaining < 0) return false;
+		if (Array.isArray(value)) {
+			if (value.length > 256) return false;
+			for (const item of value) {
+				remaining--;
+				if (!visit(item, depth + 1)) return false;
+			}
+			return remaining >= 0;
+		}
+		for (const key in value) {
+			if (!Object.hasOwn(value, key)) continue;
+			remaining -= key.length * 6 + 4;
+			if (remaining < 0 || !visit(Reflect.get(value, key), depth + 1)) return false;
+		}
+		return remaining >= 0;
+	};
+	return visit(input, 0);
+};
+const bounded = (input) => {
+	if (!withinRecordBudget(input) || !Predicate.isObject(input)) return false;
+	const revision = (value) => Predicate.isObject(value) && Array.isArray(value.credentials) && value.credentials.length <= 64 && Schema.is(Schema.toType(BoundedRevision))(value) && new Set(value.credentials.map((c) => c.credentialId)).size === value.credentials.length;
+	const requirement = input.capturedRequirement;
+	if (!revision(input.revision) || !Predicate.isObject(requirement) || !Array.isArray(requirement.alternatives) || requirement.alternatives.length > 16 || requirement.alternatives.some((a) => !Predicate.isObject(a) || !Array.isArray(a.factors) || a.factors.length > 3)) return false;
+	if (input.credential !== void 0 && (!Predicate.isObject(input.credential) || !revision(input.credential.revision))) return false;
+	if (input.challenge !== void 0 && (!Predicate.isObject(input.challenge) || !revision(input.challenge.revision))) return false;
+	if (input.baseEvidence !== void 0) {
+		const e = input.baseEvidence;
+		if (!Predicate.isObject(e) || !revision(e.revision) || !Array.isArray(e.proofs) || e.proofs.length > 64) return false;
+	}
+	if (input.reset !== void 0) {
+		if (!Predicate.isObject(input.reset) || !Predicate.isObject(input.reset.binding)) return false;
+		const b = input.reset.binding;
+		if (b.revision !== void 0 && !revision(b.revision)) return false;
+		if (b.initiatorRevision !== void 0 && !revision(b.initiatorRevision)) return false;
+		if (!Predicate.isObject(b.identifier) || !Schema.is(Schema.String.check(Schema.isMaxLength(1024)))(b.identifier.value) || !Schema.is(Label)(b.flowId) || !Schema.is(Label)(b.contextDigest)) return false;
+	}
+	return true;
+};
+const sameRevision = (a, b) => a.subjectId === b.subjectId && a.securityRevision === b.securityRevision && a.credentials.length === b.credentials.length && a.credentials.every((c) => b.credentials.some((d) => c.credentialId === d.credentialId && c.revision === d.revision));
+const relationships = (value) => {
+	if (value.preparationExpiresAtMillis <= value.createdAtMillis || value.retainUntilMillis < value.preparationExpiresAtMillis) return false;
+	if (value.action === "add-password" ? value.credential !== void 0 || value.reset !== void 0 : value.credential === void 0) return false;
+	if (value.action === "reset-password" !== (value.reset !== void 0)) return false;
+	if (value.credential !== void 0) {
+		const c = value.credential;
+		if (c.moduleId !== value.moduleId || !sameRevision(c.revision, value.revision) || !value.revision.credentials.some((r) => r.credentialId === c.credentialId && r.revision === c.credentialRevision)) return false;
+	}
+	if (value.reset !== void 0 && (value.reset.binding._tag !== "Subject" || !sameRevision(value.reset.binding.revision, value.revision) || value.reset.binding.identifier.namespace !== value.credential?.identifier.namespace || value.reset.binding.identifier.value !== value.credential?.identifier.value)) return false;
+	if (value._tag === "Ready") {
+		const c = value.challenge;
+		if (c.moduleId !== value.moduleId || c.commandId !== value.commandId || c.action !== value.action || c.targetCredentialId !== value.credential?.credentialId || !sameRevision(c.revision, value.revision)) return false;
+		if (value.issuedAtMillis < value.createdAtMillis || value.issuedAtMillis >= value.preparationExpiresAtMillis || value.expiresAtMillis <= value.issuedAtMillis || value.expiresAtMillis > value.retainUntilMillis) return false;
+		if (value.action === "change-password" !== (value.baseEvidence !== void 0)) return false;
+		if (value.baseEvidence !== void 0) {
+			const e = value.baseEvidence;
+			if (!sameRevision(e.revision, value.revision) || String(e.flowId) !== String(value.commandId) || e.bindingDigest !== c.bindingDigest || e.proofs.some((p) => !e.revision.credentials.some((r) => r.credentialId === p.credentialId))) return false;
+		}
+	}
+	return true;
+};
+const snapshotPasswordPreparedReservation = Effect.fn("snapshotPasswordPreparedReservation")(function* (input) {
+	if (!bounded(input) || !Schema.is(Schema.toType(PasswordPreparedReservation))(input) || !relationships(input)) return yield* PasswordUnavailable.make({});
+	const codec = Schema.fromJsonString(PasswordPreparedReservation);
+	const value = yield* Schema.encodeEffect(codec)(input).pipe(Effect.flatMap(Schema.decodeEffect(BoundedRecord)), Effect.flatMap(Schema.decodeEffect(codec)), Effect.mapError(() => PasswordUnavailable.make({})));
+	return freezePlain({
+		...value,
+		revision: snapshotPasswordRevision(value.revision),
+		capturedRequirement: yield* snapshotPasswordRequirement(value.capturedRequirement),
+		...value.credential === void 0 ? {} : { credential: yield* snapshotPasswordCredential(value.credential) }
+	});
+});
+const snapshotPasswordPreparedReady = Effect.fn("snapshotPasswordPreparedReady")(function* (input) {
+	if (!bounded(input) || !Schema.is(Schema.toType(PasswordPreparedReady))(input) || !relationships(input)) return yield* PasswordUnavailable.make({});
+	const value = yield* encodePasswordPreparedReady(input).pipe(Effect.flatMap(Schema.decodeEffect(PasswordPreparedReadyJson)), Effect.mapError(() => PasswordUnavailable.make({})));
+	const baseEvidence = value.baseEvidence === void 0 ? void 0 : yield* snapshotAuthenticationEvidence(value.baseEvidence).pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	if (baseEvidence?.proofs.some((p) => DateTime.toEpochMillis(p.verifiedAt) > now)) return yield* PasswordUnavailable.make({});
+	return freezePlain({
+		...value,
+		revision: snapshotPasswordRevision(value.revision),
+		challenge: {
+			...value.challenge,
+			revision: snapshotPasswordRevision(value.challenge.revision)
+		},
+		capturedRequirement: yield* snapshotPasswordRequirement(value.capturedRequirement),
+		...value.credential === void 0 ? {} : { credential: yield* snapshotPasswordCredential(value.credential) },
+		...baseEvidence === void 0 ? {} : { baseEvidence }
+	});
+});
+//#endregion
+export { PasswordPreparedConfiguration, PasswordPreparedCredential, PasswordPreparedIntentId, PasswordPreparedReady, PasswordPreparedReadyJson, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordPreparedResult, PasswordPreparedVersion, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation, validatePasswordPreparedConfiguration };
+
+//# sourceMappingURL=preparedModels.mjs.map

package/dist/password/methods/preparedModels.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"preparedModels.mjs","names":[],"sources":["../../../src/password/methods/preparedModels.ts"],"sourcesContent":["import { DateTime, Effect, Predicate, Redacted, Schema } from \"effect\";\n\nimport { LoginIdentifier } from \"../../identity/models\";\nimport { ProofBinding, ProofContinuationId } from \"../../proofs/models\";\nimport { SubjectId, TokenDigest } from \"../../Schema\";\nimport { snapshotAuthenticationEvidence } from \"../../sessions/assurance\";\nimport { SessionInvalidationWindow } from \"../../sessions/invalidation\";\nimport {\n  AuthenticationEvidence,\n  AuthenticationProof,\n  AuthenticationRequirement,\n  AssuranceAlternative,\n  AuthenticationRevision,\n  SecurityRevision,\n} from \"../../sessions/models\";\nimport { PasswordMethodConfigurationError, PasswordUnavailable } from \"./errors\";\nimport {\n  PasswordAction,\n  PasswordActionChallenge,\n  PasswordCommandId,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n} from \"./models\";\nimport { PasswordAttemptPolicy } from \"./policy\";\nimport {\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n} from \"./snapshot\";\n\nconst Label = Schema.NonEmptyString.check(Schema.isMaxLength(256));\nconst Instant = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000000 }));\nconst Opaque = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));\n\nexport const PasswordPreparedIntentId = Opaque.pipe(\n  Schema.brand(\"effect-auth/PasswordPreparedIntentId\"),\n);\n\nexport type PasswordPreparedIntentId = typeof PasswordPreparedIntentId.Type;\nexport const PasswordPreparedCredential = Schema.RedactedFromValue(Opaque);\nexport type PasswordPreparedCredential = typeof PasswordPreparedCredential.Type;\n\nexport const PasswordPreparedVersion = Label.pipe(\n  Schema.brand(\"effect-auth/PasswordPreparedVersion\"),\n);\n\nexport type PasswordPreparedVersion = typeof PasswordPreparedVersion.Type;\n\nexport const PasswordPreparedConfiguration = Schema.Struct({\n  generation: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 900000 })),\n  preparationLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),\n  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 2592000000 })),\n  maximumPendingPerSubject: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  admission: Schema.Struct({\n    identifier: PasswordAttemptPolicy.fields.identifier,\n    subject: PasswordAttemptPolicy.fields.subject,\n    action: PasswordAttemptPolicy.fields.action,\n  }),\n});\n\nexport type PasswordPreparedConfiguration = typeof PasswordPreparedConfiguration.Type;\n\nexport const validatePasswordPreparedConfiguration = Effect.fn(\n  \"validatePasswordPreparedConfiguration\",\n)(function* (input: PasswordPreparedConfiguration) {\n  const p = yield* Schema.decodeEffect(PasswordPreparedConfiguration)(input).pipe(\n    Effect.mapError(() => PasswordMethodConfigurationError.make({})),\n  );\n\n  if (\n    p.retentionMillis <\n    Math.max(\n      p.preparationLifetimeMillis + p.lifetimeMillis,\n      p.admission.identifier.windowMillis,\n      p.admission.subject.windowMillis,\n      p.admission.action.windowMillis,\n    )\n  )\n    return yield* PasswordMethodConfigurationError.make({});\n\n  return freezePlain(p);\n});\n\nexport const PasswordPreparedRequirement = Schema.Struct({\n  ...AuthenticationRequirement.fields,\n  maximumAgeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 86400000 })),\n  alternatives: Schema.NonEmptyArray(\n    Schema.Struct({\n      ...AssuranceAlternative.fields,\n      factors: AssuranceAlternative.fields.factors.check(Schema.isMaxLength(3)),\n      minimumCredentials: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n    }),\n  ).check(Schema.isMaxLength(16)),\n});\n\nexport type PasswordPreparedRequirement = typeof PasswordPreparedRequirement.Type;\n\nconst BoundedRevision = Schema.Struct({\n  ...AuthenticationRevision.fields,\n  subjectId: SubjectId.check(Schema.isMaxLength(256)),\n  securityRevision: SecurityRevision.check(Schema.isMaxLength(256)),\n  credentials: Schema.Array(\n    Schema.Struct({\n      credentialId: Label,\n      revision: SecurityRevision.check(Schema.isMaxLength(256)),\n    }),\n  ).check(Schema.isMaxLength(64)),\n});\n\nconst BoundedEvidence = Schema.Struct({\n  ...AuthenticationEvidence.fields,\n  revision: BoundedRevision,\n  flowId: AuthenticationEvidence.fields.flowId.check(Schema.isMaxLength(256)),\n  bindingDigest: TokenDigest.check(Schema.isMaxLength(256)),\n  proofs: Schema.NonEmptyArray(\n    Schema.Struct({\n      ...AuthenticationProof.fields,\n      method: Label,\n      credentialId: Label,\n      factors: AuthenticationProof.fields.factors.check(Schema.isMaxLength(3)),\n    }),\n  ).check(Schema.isMaxLength(64)),\n});\n\nconst BoundedIdentifier = Schema.Struct({\n  namespace: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  value: Schema.NonEmptyString.check(Schema.isMaxLength(1024)),\n}).pipe(Schema.decodeTo(LoginIdentifier));\n\nconst BoundedCredential = Schema.Struct({\n  ...PasswordCredentialSnapshot.fields,\n  moduleId: Label,\n  revision: BoundedRevision,\n  credentialId: Label,\n  credentialRevision: SecurityRevision.check(Schema.isMaxLength(256)),\n  verifierVersion: SecurityRevision.check(Schema.isMaxLength(256)),\n  identifier: BoundedIdentifier,\n  identifierBindingRevision: SecurityRevision.check(Schema.isMaxLength(256)),\n});\n\nconst BoundedChallenge = Schema.Struct({\n  ...PasswordActionChallenge.fields,\n  moduleId: Label,\n  revision: BoundedRevision,\n  targetCredentialId: Schema.optionalKey(Label),\n  bindingDigest: TokenDigest.check(Schema.isMaxLength(256)),\n});\n\nexport const PasswordPreparedReset = Schema.Struct({\n  continuationId: ProofContinuationId,\n  binding: ProofBinding,\n});\n\nexport type PasswordPreparedReset = typeof PasswordPreparedReset.Type;\n\nconst ReservationFields = {\n  moduleId: Label,\n  generation: PasswordPreparedConfiguration.fields.generation,\n  intentId: PasswordPreparedIntentId,\n  version: PasswordPreparedVersion,\n  commandId: PasswordCommandId,\n  action: PasswordAction,\n  revision: BoundedRevision,\n  credential: Schema.optionalKey(BoundedCredential),\n  capturedRequirement: PasswordPreparedRequirement,\n  reset: Schema.optionalKey(PasswordPreparedReset),\n  invalidation: SessionInvalidationWindow,\n  createdAtMillis: Instant,\n  preparationExpiresAtMillis: Instant,\n  retainUntilMillis: Instant,\n};\n\nexport const PasswordPreparedReservation = Schema.TaggedStruct(\"Preparing\", ReservationFields);\nexport type PasswordPreparedReservation = typeof PasswordPreparedReservation.Type;\n\nexport const PasswordPreparedReady = Schema.TaggedStruct(\"Ready\", {\n  ...ReservationFields,\n  replacement: PasswordReplacement,\n  challenge: BoundedChallenge,\n  baseEvidence: Schema.optionalKey(BoundedEvidence),\n  digest: TokenDigest.check(Schema.isMaxLength(256)),\n  issuedAtMillis: Instant,\n  expiresAtMillis: Instant,\n});\n\nexport type PasswordPreparedReady = typeof PasswordPreparedReady.Type;\n\nexport const PasswordPreparedResult = Schema.Union([\n  Schema.TaggedStruct(\"Prepared\", { intentId: PasswordPreparedIntentId, expiresAtMillis: Instant }),\n  Schema.TaggedStruct(\"AlreadyExists\", {}),\n]);\n\nexport type PasswordPreparedResult = typeof PasswordPreparedResult.Type;\n\nexport interface PasswordPreparedContext {\n  readonly intentId: PasswordPreparedIntentId;\n  readonly action: PasswordAction;\n  readonly challenge: typeof BoundedChallenge.Type;\n  readonly capturedRequirement: PasswordPreparedRequirement;\n  readonly baseEvidence?: AuthenticationEvidence;\n  readonly expiresAtMillis: number;\n}\n\n/** Explicit private persistence codec: encodes the Redacted PHC verifier, never a\n * plaintext password. Do not log this value or expose it through an operation. */\nexport const PasswordPreparedReadyJson = Schema.fromJsonString(PasswordPreparedReady);\nconst BoundedRecord = Schema.String.check(Schema.isMaxLength(131072));\n\nexport const encodePasswordPreparedReady = Effect.fn(\"encodePasswordPreparedReady\")(function* (\n  value: PasswordPreparedReady,\n) {\n  if (\n    !bounded(value) ||\n    !Schema.is(Schema.toType(PasswordPreparedReady))(value) ||\n    !relationships(value)\n  )\n    return yield* PasswordUnavailable.make({});\n\n  return yield* Schema.encodeEffect(PasswordPreparedReadyJson)(value).pipe(\n    Effect.flatMap(Schema.decodeEffect(BoundedRecord)),\n    Effect.mapError(() => PasswordUnavailable.make({})),\n  );\n});\n\nexport const decodePasswordPreparedReady = (value: string) =>\n  Schema.decodeEffect(BoundedRecord)(value).pipe(\n    Effect.flatMap(Schema.decodeEffect(PasswordPreparedReadyJson)),\n    Effect.flatMap(snapshotPasswordPreparedReady),\n    Effect.mapError(() => PasswordUnavailable.make({})),\n  );\n\nconst freezePlain = <A>(value: A): A => {\n  if (value !== null && typeof value === \"object\") {\n    const prototype = Object.getPrototypeOf(value);\n\n    if (Schema.is(LoginIdentifier)(value)) Object.freeze(value);\n    if (Array.isArray(value) || prototype === Object.prototype) {\n      for (const item of Object.values(value)) freezePlain(item);\n      Object.freeze(value);\n    }\n  }\n\n  return value;\n};\n\n/** Conservative JSON upper bound before codec traversal/allocation: each UTF-16\n * unit may need six escaped bytes. Count keys, delimiters and numeric instants;\n * bounded iteration stops without first allocating Object.keys/JSON text. */\nconst withinRecordBudget = (input: unknown) => {\n  let remaining = 131072,\n    nodes = 0;\n\n  const visit = (value: unknown, depth: number): boolean => {\n    if (++nodes > 4096 || depth > 16) return false;\n    if (Redacted.isRedacted(value)) return visit(Redacted.value(value), depth + 1);\n    if (DateTime.isDateTime(value)) {\n      remaining -= 24;\n\n      return remaining >= 0;\n    }\n    if (typeof value === \"string\") {\n      remaining -= value.length * 6 + 2;\n\n      return remaining >= 0;\n    }\n    if (value === null || typeof value !== \"object\") {\n      remaining -= 24;\n\n      return remaining >= 0;\n    }\n    remaining -= 2;\n    if (remaining < 0) return false;\n    if (Array.isArray(value)) {\n      if (value.length > 256) return false;\n      for (const item of value) {\n        remaining--;\n        if (!visit(item, depth + 1)) return false;\n      }\n\n      return remaining >= 0;\n    }\n    for (const key in value) {\n      if (!Object.hasOwn(value, key)) continue;\n      remaining -= key.length * 6 + 4;\n      if (remaining < 0 || !visit(Reflect.get(value, key), depth + 1)) return false;\n    }\n\n    return remaining >= 0;\n  };\n\n  return visit(input, 0);\n};\n\nconst bounded = (input: unknown) => {\n  if (!withinRecordBudget(input) || !Predicate.isObject(input)) return false;\n\n  const revision = (value: unknown) =>\n    Predicate.isObject(value) &&\n    Array.isArray(value.credentials) &&\n    value.credentials.length <= 64 &&\n    Schema.is(Schema.toType(BoundedRevision))(value) &&\n    new Set(value.credentials.map((c) => c.credentialId)).size === value.credentials.length;\n\n  const requirement = input.capturedRequirement;\n\n  if (\n    !revision(input.revision) ||\n    !Predicate.isObject(requirement) ||\n    !Array.isArray(requirement.alternatives) ||\n    requirement.alternatives.length > 16 ||\n    requirement.alternatives.some(\n      (a) => !Predicate.isObject(a) || !Array.isArray(a.factors) || a.factors.length > 3,\n    )\n  )\n    return false;\n  if (\n    input.credential !== undefined &&\n    (!Predicate.isObject(input.credential) || !revision(input.credential.revision))\n  )\n    return false;\n  if (\n    input.challenge !== undefined &&\n    (!Predicate.isObject(input.challenge) || !revision(input.challenge.revision))\n  )\n    return false;\n  if (input.baseEvidence !== undefined) {\n    const e = input.baseEvidence;\n\n    if (\n      !Predicate.isObject(e) ||\n      !revision(e.revision) ||\n      !Array.isArray(e.proofs) ||\n      e.proofs.length > 64\n    )\n      return false;\n  }\n  if (input.reset !== undefined) {\n    if (!Predicate.isObject(input.reset) || !Predicate.isObject(input.reset.binding)) return false;\n    const b = input.reset.binding;\n\n    if (b.revision !== undefined && !revision(b.revision)) return false;\n    if (b.initiatorRevision !== undefined && !revision(b.initiatorRevision)) return false;\n    if (\n      !Predicate.isObject(b.identifier) ||\n      !Schema.is(Schema.String.check(Schema.isMaxLength(1024)))(b.identifier.value) ||\n      !Schema.is(Label)(b.flowId) ||\n      !Schema.is(Label)(b.contextDigest)\n    )\n      return false;\n  }\n\n  return true;\n};\n\nconst sameRevision = (a: AuthenticationRevision, b: AuthenticationRevision) =>\n  a.subjectId === b.subjectId &&\n  a.securityRevision === b.securityRevision &&\n  a.credentials.length === b.credentials.length &&\n  a.credentials.every((c) =>\n    b.credentials.some((d) => c.credentialId === d.credentialId && c.revision === d.revision),\n  );\n\nconst relationships = (value: PasswordPreparedReservation | PasswordPreparedReady) => {\n  if (\n    value.preparationExpiresAtMillis <= value.createdAtMillis ||\n    value.retainUntilMillis < value.preparationExpiresAtMillis\n  )\n    return false;\n  if (\n    value.action === \"add-password\"\n      ? value.credential !== undefined || value.reset !== undefined\n      : value.credential === undefined\n  )\n    return false;\n  if ((value.action === \"reset-password\") !== (value.reset !== undefined)) return false;\n  if (value.credential !== undefined) {\n    const c = value.credential;\n\n    if (\n      c.moduleId !== value.moduleId ||\n      !sameRevision(c.revision, value.revision) ||\n      !value.revision.credentials.some(\n        (r) => r.credentialId === c.credentialId && r.revision === c.credentialRevision,\n      )\n    )\n      return false;\n  }\n  if (\n    value.reset !== undefined &&\n    (value.reset.binding._tag !== \"Subject\" ||\n      !sameRevision(value.reset.binding.revision, value.revision) ||\n      value.reset.binding.identifier.namespace !== value.credential?.identifier.namespace ||\n      value.reset.binding.identifier.value !== value.credential?.identifier.value)\n  )\n    return false;\n  if (value._tag === \"Ready\") {\n    const c = value.challenge;\n\n    if (\n      c.moduleId !== value.moduleId ||\n      c.commandId !== value.commandId ||\n      c.action !== value.action ||\n      c.targetCredentialId !== value.credential?.credentialId ||\n      !sameRevision(c.revision, value.revision)\n    )\n      return false;\n    if (\n      value.issuedAtMillis < value.createdAtMillis ||\n      value.issuedAtMillis >= value.preparationExpiresAtMillis ||\n      value.expiresAtMillis <= value.issuedAtMillis ||\n      value.expiresAtMillis > value.retainUntilMillis\n    )\n      return false;\n    if ((value.action === \"change-password\") !== (value.baseEvidence !== undefined)) return false;\n    if (value.baseEvidence !== undefined) {\n      const e = value.baseEvidence;\n\n      if (\n        !sameRevision(e.revision, value.revision) ||\n        String(e.flowId) !== String(value.commandId) ||\n        e.bindingDigest !== c.bindingDigest ||\n        e.proofs.some((p) => !e.revision.credentials.some((r) => r.credentialId === p.credentialId))\n      )\n        return false;\n    }\n  }\n\n  return true;\n};\n\nexport const snapshotPasswordPreparedReservation = Effect.fn(\"snapshotPasswordPreparedReservation\")(\n  function* (input: PasswordPreparedReservation) {\n    if (\n      !bounded(input) ||\n      !Schema.is(Schema.toType(PasswordPreparedReservation))(input) ||\n      !relationships(input)\n    )\n      return yield* PasswordUnavailable.make({});\n    const codec = Schema.fromJsonString(PasswordPreparedReservation);\n\n    const value = yield* Schema.encodeEffect(codec)(input).pipe(\n      Effect.flatMap(Schema.decodeEffect(BoundedRecord)),\n      Effect.flatMap(Schema.decodeEffect(codec)),\n      Effect.mapError(() => PasswordUnavailable.make({})),\n    );\n\n    return freezePlain({\n      ...value,\n      revision: snapshotPasswordRevision(value.revision),\n      capturedRequirement: yield* snapshotPasswordRequirement(value.capturedRequirement),\n      ...(value.credential === undefined\n        ? {}\n        : { credential: yield* snapshotPasswordCredential(value.credential) }),\n    });\n  },\n);\n\nexport const snapshotPasswordPreparedReady = Effect.fn(\"snapshotPasswordPreparedReady\")(function* (\n  input: PasswordPreparedReady,\n) {\n  if (\n    !bounded(input) ||\n    !Schema.is(Schema.toType(PasswordPreparedReady))(input) ||\n    !relationships(input)\n  )\n    return yield* PasswordUnavailable.make({});\n\n  const value = yield* encodePasswordPreparedReady(input).pipe(\n    Effect.flatMap(Schema.decodeEffect(PasswordPreparedReadyJson)),\n    Effect.mapError(() => PasswordUnavailable.make({})),\n  );\n\n  const baseEvidence =\n    value.baseEvidence === undefined\n      ? undefined\n      : yield* snapshotAuthenticationEvidence(value.baseEvidence).pipe(\n          Effect.mapError(() => PasswordUnavailable.make({})),\n        );\n\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  if (baseEvidence?.proofs.some((p) => DateTime.toEpochMillis(p.verifiedAt) > now))\n    return yield* PasswordUnavailable.make({});\n\n  return freezePlain({\n    ...value,\n    revision: snapshotPasswordRevision(value.revision),\n    challenge: { ...value.challenge, revision: snapshotPasswordRevision(value.challenge.revision) },\n    capturedRequirement: yield* snapshotPasswordRequirement(value.capturedRequirement),\n    ...(value.credential === undefined\n      ? {}\n      : { credential: yield* snapshotPasswordCredential(value.credential) }),\n    ...(baseEvidence === undefined ? {} : { baseEvidence }),\n  });\n});\n"],"mappings":";;;;;;;;;;;;AA8BA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AACjE,MAAM,UAAU,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAiB,CAAC,CAAC;AAC5F,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,uCAAuC,CAAC;AAE5F,MAAa,2BAA2B,OAAO,KAC7C,OAAO,MAAM,sCAAsC,CACrD;AAGA,MAAa,6BAA6B,OAAO,kBAAkB,MAAM;AAGzE,MAAa,0BAA0B,MAAM,KAC3C,OAAO,MAAM,qCAAqC,CACpD;AAIA,MAAa,gCAAgC,OAAO,OAAO;CACzD,YAAY,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CAC/F,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CACrF,2BAA2B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CAChG,iBAAiB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAW,CAAC,CAAC;CAC1F,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAK,CAAC,CAAC;CAC1F,WAAW,OAAO,OAAO;EACvB,YAAY,sBAAsB,OAAO;EACzC,SAAS,sBAAsB,OAAO;EACtC,QAAQ,sBAAsB,OAAO;CACvC,CAAC;AACH,CAAC;AAID,MAAa,wCAAwC,OAAO,GAC1D,uCACF,CAAC,CAAC,WAAW,OAAsC;CACjD,MAAM,IAAI,OAAO,OAAO,aAAa,6BAA6B,CAAC,CAAC,KAAK,CAAC,CAAC,KACzE,OAAO,eAAe,iCAAiC,KAAK,CAAC,CAAC,CAAC,CACjE;CAEA,IACE,EAAE,kBACF,KAAK,IACH,EAAE,4BAA4B,EAAE,gBAChC,EAAE,UAAU,WAAW,cACvB,EAAE,UAAU,QAAQ,cACpB,EAAE,UAAU,OAAO,YACrB,GAEA,OAAO,OAAO,iCAAiC,KAAK,CAAC,CAAC;CAExD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAa,8BAA8B,OAAO,OAAO;CACvD,GAAG,0BAA0B;CAC7B,kBAAkB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAS,CAAC,CAAC;CACtF,cAAc,OAAO,cACnB,OAAO,OAAO;EACZ,GAAG,qBAAqB;EACxB,SAAS,qBAAqB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;EACxE,oBAAoB,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAG,CAAC,CAAC;CACpF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAChC,CAAC;AAID,MAAM,kBAAkB,OAAO,OAAO;CACpC,GAAG,uBAAuB;CAC1B,WAAW,UAAU,MAAM,OAAO,YAAY,GAAG,CAAC;CAClD,kBAAkB,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;CAChE,aAAa,OAAO,MAClB,OAAO,OAAO;EACZ,cAAc;EACd,UAAU,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,GAAG,uBAAuB;CAC1B,UAAU;CACV,QAAQ,uBAAuB,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1E,eAAe,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;CACxD,QAAQ,OAAO,cACb,OAAO,OAAO;EACZ,GAAG,oBAAoB;EACvB,QAAQ;EACR,cAAc;EACd,SAAS,oBAAoB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;CACzE,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,WAAW,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC9D,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC;AAC7D,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,eAAe,CAAC;AAExC,MAAM,oBAAoB,OAAO,OAAO;CACtC,GAAG,2BAA2B;CAC9B,UAAU;CACV,UAAU;CACV,cAAc;CACd,oBAAoB,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;CAClE,iBAAiB,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;CAC/D,YAAY;CACZ,2BAA2B,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;AAC3E,CAAC;AAED,MAAM,mBAAmB,OAAO,OAAO;CACrC,GAAG,wBAAwB;CAC3B,UAAU;CACV,UAAU;CACV,oBAAoB,OAAO,YAAY,KAAK;CAC5C,eAAe,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;AAC1D,CAAC;AAED,MAAa,wBAAwB,OAAO,OAAO;CACjD,gBAAgB;CAChB,SAAS;AACX,CAAC;AAID,MAAM,oBAAoB;CACxB,UAAU;CACV,YAAY,8BAA8B,OAAO;CACjD,UAAU;CACV,SAAS;CACT,WAAW;CACX,QAAQ;CACR,UAAU;CACV,YAAY,OAAO,YAAY,iBAAiB;CAChD,qBAAqB;CACrB,OAAO,OAAO,YAAY,qBAAqB;CAC/C,cAAc;CACd,iBAAiB;CACjB,4BAA4B;CAC5B,mBAAmB;AACrB;AAEA,MAAa,8BAA8B,OAAO,aAAa,aAAa,iBAAiB;AAG7F,MAAa,wBAAwB,OAAO,aAAa,SAAS;CAChE,GAAG;CACH,aAAa;CACb,WAAW;CACX,cAAc,OAAO,YAAY,eAAe;CAChD,QAAQ,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;CACjD,gBAAgB;CAChB,iBAAiB;AACnB,CAAC;AAID,MAAa,yBAAyB,OAAO,MAAM,CACjD,OAAO,aAAa,YAAY;CAAE,UAAU;CAA0B,iBAAiB;AAAQ,CAAC,GAChG,OAAO,aAAa,iBAAiB,CAAC,CAAC,CACzC,CAAC;;;AAeD,MAAa,4BAA4B,OAAO,eAAe,qBAAqB;AACpF,MAAM,gBAAgB,OAAO,OAAO,MAAM,OAAO,YAAY,MAAM,CAAC;AAEpE,MAAa,8BAA8B,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAClF,OACA;CACA,IACE,CAAC,QAAQ,KAAK,KACd,CAAC,OAAO,GAAG,OAAO,OAAO,qBAAqB,CAAC,CAAC,CAAC,KAAK,KACtD,CAAC,cAAc,KAAK,GAEpB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,OAAO,OAAO,OAAO,aAAa,yBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,KAClE,OAAO,QAAQ,OAAO,aAAa,aAAa,CAAC,GACjD,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;AACF,CAAC;AAED,MAAa,+BAA+B,UAC1C,OAAO,aAAa,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KACxC,OAAO,QAAQ,OAAO,aAAa,yBAAyB,CAAC,GAC7D,OAAO,QAAQ,6BAA6B,GAC5C,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;AAEF,MAAM,eAAkB,UAAgB;CACtC,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,MAAM,YAAY,OAAO,eAAe,KAAK;EAE7C,IAAI,OAAO,GAAG,eAAe,CAAC,CAAC,KAAK,GAAG,OAAO,OAAO,KAAK;EAC1D,IAAI,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO,WAAW;GAC1D,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,GAAG,YAAY,IAAI;GACzD,OAAO,OAAO,KAAK;EACrB;CACF;CAEA,OAAO;AACT;;;;AAKA,MAAM,sBAAsB,UAAmB;CAC7C,IAAI,YAAY,QACd,QAAQ;CAEV,MAAM,SAAS,OAAgB,UAA2B;EACxD,IAAI,EAAE,QAAQ,QAAQ,QAAQ,IAAI,OAAO;EACzC,IAAI,SAAS,WAAW,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,CAAC;EAC7E,IAAI,SAAS,WAAW,KAAK,GAAG;GAC9B,aAAa;GAEb,OAAO,aAAa;EACtB;EACA,IAAI,OAAO,UAAU,UAAU;GAC7B,aAAa,MAAM,SAAS,IAAI;GAEhC,OAAO,aAAa;EACtB;EACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;GAC/C,aAAa;GAEb,OAAO,aAAa;EACtB;EACA,aAAa;EACb,IAAI,YAAY,GAAG,OAAO;EAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,IAAI,MAAM,SAAS,KAAK,OAAO;GAC/B,KAAK,MAAM,QAAQ,OAAO;IACxB;IACA,IAAI,CAAC,MAAM,MAAM,QAAQ,CAAC,GAAG,OAAO;GACtC;GAEA,OAAO,aAAa;EACtB;EACA,KAAK,MAAM,OAAO,OAAO;GACvB,IAAI,CAAC,OAAO,OAAO,OAAO,GAAG,GAAG;GAChC,aAAa,IAAI,SAAS,IAAI;GAC9B,IAAI,YAAY,KAAK,CAAC,MAAM,QAAQ,IAAI,OAAO,GAAG,GAAG,QAAQ,CAAC,GAAG,OAAO;EAC1E;EAEA,OAAO,aAAa;CACtB;CAEA,OAAO,MAAM,OAAO,CAAC;AACvB;AAEA,MAAM,WAAW,UAAmB;CAClC,IAAI,CAAC,mBAAmB,KAAK,KAAK,CAAC,UAAU,SAAS,KAAK,GAAG,OAAO;CAErE,MAAM,YAAY,UAChB,UAAU,SAAS,KAAK,KACxB,MAAM,QAAQ,MAAM,WAAW,KAC/B,MAAM,YAAY,UAAU,MAC5B,OAAO,GAAG,OAAO,OAAO,eAAe,CAAC,CAAC,CAAC,KAAK,KAC/C,IAAI,IAAI,MAAM,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY;CAEnF,MAAM,cAAc,MAAM;CAE1B,IACE,CAAC,SAAS,MAAM,QAAQ,KACxB,CAAC,UAAU,SAAS,WAAW,KAC/B,CAAC,MAAM,QAAQ,YAAY,YAAY,KACvC,YAAY,aAAa,SAAS,MAClC,YAAY,aAAa,MACtB,MAAM,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK,EAAE,QAAQ,SAAS,CACnF,GAEA,OAAO;CACT,IACE,MAAM,eAAe,KAAA,MACpB,CAAC,UAAU,SAAS,MAAM,UAAU,KAAK,CAAC,SAAS,MAAM,WAAW,QAAQ,IAE7E,OAAO;CACT,IACE,MAAM,cAAc,KAAA,MACnB,CAAC,UAAU,SAAS,MAAM,SAAS,KAAK,CAAC,SAAS,MAAM,UAAU,QAAQ,IAE3E,OAAO;CACT,IAAI,MAAM,iBAAiB,KAAA,GAAW;EACpC,MAAM,IAAI,MAAM;EAEhB,IACE,CAAC,UAAU,SAAS,CAAC,KACrB,CAAC,SAAS,EAAE,QAAQ,KACpB,CAAC,MAAM,QAAQ,EAAE,MAAM,KACvB,EAAE,OAAO,SAAS,IAElB,OAAO;CACX;CACA,IAAI,MAAM,UAAU,KAAA,GAAW;EAC7B,IAAI,CAAC,UAAU,SAAS,MAAM,KAAK,KAAK,CAAC,UAAU,SAAS,MAAM,MAAM,OAAO,GAAG,OAAO;EACzF,MAAM,IAAI,MAAM,MAAM;EAEtB,IAAI,EAAE,aAAa,KAAA,KAAa,CAAC,SAAS,EAAE,QAAQ,GAAG,OAAO;EAC9D,IAAI,EAAE,sBAAsB,KAAA,KAAa,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO;EAChF,IACE,CAAC,UAAU,SAAS,EAAE,UAAU,KAChC,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,KAC5E,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,MAAM,KAC1B,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,GAEjC,OAAO;CACX;CAEA,OAAO;AACT;AAEA,MAAM,gBAAgB,GAA2B,MAC/C,EAAE,cAAc,EAAE,aAClB,EAAE,qBAAqB,EAAE,oBACzB,EAAE,YAAY,WAAW,EAAE,YAAY,UACvC,EAAE,YAAY,OAAO,MACnB,EAAE,YAAY,MAAM,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,CAC1F;AAEF,MAAM,iBAAiB,UAA+D;CACpF,IACE,MAAM,8BAA8B,MAAM,mBAC1C,MAAM,oBAAoB,MAAM,4BAEhC,OAAO;CACT,IACE,MAAM,WAAW,iBACb,MAAM,eAAe,KAAA,KAAa,MAAM,UAAU,KAAA,IAClD,MAAM,eAAe,KAAA,GAEzB,OAAO;CACT,IAAK,MAAM,WAAW,sBAAuB,MAAM,UAAU,KAAA,IAAY,OAAO;CAChF,IAAI,MAAM,eAAe,KAAA,GAAW;EAClC,MAAM,IAAI,MAAM;EAEhB,IACE,EAAE,aAAa,MAAM,YACrB,CAAC,aAAa,EAAE,UAAU,MAAM,QAAQ,KACxC,CAAC,MAAM,SAAS,YAAY,MACzB,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAC/D,GAEA,OAAO;CACX;CACA,IACE,MAAM,UAAU,KAAA,MACf,MAAM,MAAM,QAAQ,SAAS,aAC5B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,MAAM,QAAQ,KAC1D,MAAM,MAAM,QAAQ,WAAW,cAAc,MAAM,YAAY,WAAW,aAC1E,MAAM,MAAM,QAAQ,WAAW,UAAU,MAAM,YAAY,WAAW,QAExE,OAAO;CACT,IAAI,MAAM,SAAS,SAAS;EAC1B,MAAM,IAAI,MAAM;EAEhB,IACE,EAAE,aAAa,MAAM,YACrB,EAAE,cAAc,MAAM,aACtB,EAAE,WAAW,MAAM,UACnB,EAAE,uBAAuB,MAAM,YAAY,gBAC3C,CAAC,aAAa,EAAE,UAAU,MAAM,QAAQ,GAExC,OAAO;EACT,IACE,MAAM,iBAAiB,MAAM,mBAC7B,MAAM,kBAAkB,MAAM,8BAC9B,MAAM,mBAAmB,MAAM,kBAC/B,MAAM,kBAAkB,MAAM,mBAE9B,OAAO;EACT,IAAK,MAAM,WAAW,uBAAwB,MAAM,iBAAiB,KAAA,IAAY,OAAO;EACxF,IAAI,MAAM,iBAAiB,KAAA,GAAW;GACpC,MAAM,IAAI,MAAM;GAEhB,IACE,CAAC,aAAa,EAAE,UAAU,MAAM,QAAQ,KACxC,OAAO,EAAE,MAAM,MAAM,OAAO,MAAM,SAAS,KAC3C,EAAE,kBAAkB,EAAE,iBACtB,EAAE,OAAO,MAAM,MAAM,CAAC,EAAE,SAAS,YAAY,MAAM,MAAM,EAAE,iBAAiB,EAAE,YAAY,CAAC,GAE3F,OAAO;EACX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,OAAoC;CAC7C,IACE,CAAC,QAAQ,KAAK,KACd,CAAC,OAAO,GAAG,OAAO,OAAO,2BAA2B,CAAC,CAAC,CAAC,KAAK,KAC5D,CAAC,cAAc,KAAK,GAEpB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAC3C,MAAM,QAAQ,OAAO,eAAe,2BAA2B;CAE/D,MAAM,QAAQ,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KACrD,OAAO,QAAQ,OAAO,aAAa,aAAa,CAAC,GACjD,OAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,GACzC,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAEA,OAAO,YAAY;EACjB,GAAG;EACH,UAAU,yBAAyB,MAAM,QAAQ;EACjD,qBAAqB,OAAO,4BAA4B,MAAM,mBAAmB;EACjF,GAAI,MAAM,eAAe,KAAA,IACrB,CAAC,IACD,EAAE,YAAY,OAAO,2BAA2B,MAAM,UAAU,EAAE;CACxE,CAAC;AACH,CACF;AAEA,MAAa,gCAAgC,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACtF,OACA;CACA,IACE,CAAC,QAAQ,KAAK,KACd,CAAC,OAAO,GAAG,OAAO,OAAO,qBAAqB,CAAC,CAAC,CAAC,KAAK,KACtD,CAAC,cAAc,KAAK,GAEpB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,QAAQ,OAAO,4BAA4B,KAAK,CAAC,CAAC,KACtD,OAAO,QAAQ,OAAO,aAAa,yBAAyB,CAAC,GAC7D,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAEA,MAAM,eACJ,MAAM,iBAAiB,KAAA,IACnB,KAAA,IACA,OAAO,+BAA+B,MAAM,YAAY,CAAC,CAAC,KACxD,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAEN,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,IAAI,cAAc,OAAO,MAAM,MAAM,SAAS,cAAc,EAAE,UAAU,IAAI,GAAG,GAC7E,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,OAAO,YAAY;EACjB,GAAG;EACH,UAAU,yBAAyB,MAAM,QAAQ;EACjD,WAAW;GAAE,GAAG,MAAM;GAAW,UAAU,yBAAyB,MAAM,UAAU,QAAQ;EAAE;EAC9F,qBAAqB,OAAO,4BAA4B,MAAM,mBAAmB;EACjF,GAAI,MAAM,eAAe,KAAA,IACrB,CAAC,IACD,EAAE,YAAY,OAAO,2BAA2B,MAAM,UAAU,EAAE;EACtE,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;CACvD,CAAC;AACH,CAAC"}

package/dist/password/methods/signIn.d.mts

@@ -0,0 +1,180 @@
+import { AssuranceRequired, AuthenticationRequired, InvalidOperationInput, OperationForbidden, OperationPrivateOutputUnsupported } from "../../operations/errors.mjs";
+import { AuthenticationAssurance } from "../../operations/context.mjs";
+import { AuthOperation, OperationHandler } from "../../operations/operation.mjs";
+import { HookDenied } from "../../hooks/models.mjs";
+import { AuthenticationAuthority } from "../../sessions/AuthenticationAuthority.mjs";
+import "../../Operations.mjs";
+import { SessionApiError } from "../../auth/session.mjs";
+import { AuthRequest } from "../../auth/AuthRequest.mjs";
+import { AuthConfigurationError } from "../../auth/AuthConfigurationError.mjs";
+import "../../Auth.mjs";
+import { ModuleService, makeSessionModule } from "../../sessions/module.mjs";
+import "../../Sessions.mjs";
+import { PasswordConfigurationError } from "../errors.mjs";
+import { PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import { PasswordCredentialSnapshot } from "./models.mjs";
+import { PasswordHashing } from "../PasswordHashing.mjs";
+import { PasswordMethodPolicy } from "./policy.mjs";
+import { PasswordPersistence } from "./PasswordPersistence.mjs";
+import { Context, Crypto, Effect, Layer, Schema, Types } from "effect";
+//#region src/password/methods/signIn.d.ts
+interface PasswordSignInOptions<SessionId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>> {
+  readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;
+  readonly policy?: PasswordMethodPolicy;
+  readonly features?: {
+    readonly signIn: true;
+  };
+}
+/** A sign-in-only installation never acquires account creation or password mutation services. */
+declare const makePasswordSignIn: <const Id extends string, const SessionId extends string, Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(moduleId: Id, options: PasswordSignInOptions<SessionId, Claims>) => Readonly<{
+  ClaimsForPassword: Context.Service<{
+    readonly moduleId: Id;
+    readonly kind: "claims";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }, {
+    readonly resolve: (credential: PasswordCredentialSnapshot) => Effect.Effect<Claims["Type"], PasswordUnavailable>;
+  }>;
+  layer: Layer.Layer<OperationHandler<`${Id}/sign-in`, {
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly password: import("effect/Redacted").Redacted<string>;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: import("effect/DateTime").Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, PasswordConfigurationError | PasswordMethodConfigurationError, AuthenticationAuthority | ModuleService<SessionId, "completion", Claims["Type"]> | PasswordPersistence | {
+    readonly moduleId: Id;
+    readonly kind: "claims";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }>;
+  handlersLayer: Layer.Layer<OperationHandler<`${Id}/sign-in`, {
+    readonly email: string & import("effect/Brand").Brand<"effect-auth/Email">;
+    readonly password: import("effect/Redacted").Redacted<string>;
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  }, {
+    readonly _tag: "Authenticated";
+    readonly session: {
+      readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly assurance: AuthenticationAssurance;
+      readonly issuedAt: import("effect/DateTime").Utc;
+      readonly expiresAt: import("effect/DateTime").Utc;
+      readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+      readonly claims: Claims["Type"];
+    };
+  } | {
+    readonly _tag: "PendingAuthentication";
+    readonly expiresAt: import("effect/DateTime").Utc;
+  }, AssuranceRequired | AuthenticationRequired | HookDenied | InvalidOperationInput | OperationForbidden | OperationPrivateOutputUnsupported | PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable>, PasswordMethodConfigurationError, AuthenticationAuthority | Crypto.Crypto | ModuleService<SessionId, "completion", Claims["Type"]> | PasswordHashing | PasswordPersistence | {
+    readonly moduleId: Id;
+    readonly kind: "claims";
+    readonly claims: Types.Invariant<Claims["Type"]>;
+  }>;
+  operations: {
+    SignIn: AuthOperation<`${Id}/sign-in`, Schema.Struct<{
+      readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+      readonly password: Schema.RedactedFromValue<Schema.String>;
+      readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+      readonly session: Schema.Struct<{
+        readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly assurance: typeof AuthenticationAssurance;
+        readonly issuedAt: Schema.DateTimeUtcFromMillis;
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+        readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+      }>;
+    }>, Schema.TaggedStruct<"PendingAuthentication", {
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>]>, Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordMethodUnsupported, typeof HookDenied]>, never, {
+      readonly payload: Schema.Struct<{
+        readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+        readonly password: Schema.RedactedFromValue<Schema.String>;
+        readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+      }>;
+      readonly success: Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+        readonly session: Schema.Struct<{
+          readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly assurance: typeof AuthenticationAssurance;
+          readonly issuedAt: Schema.DateTimeUtcFromMillis;
+          readonly expiresAt: Schema.DateTimeUtcFromMillis;
+          readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+          readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+        }>;
+      }>, Schema.TaggedStruct<"PendingAuthentication", {
+        readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      }>]>;
+      readonly error: Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordMethodUnsupported, typeof HookDenied]>;
+      readonly access: "any";
+      readonly exposure: "public";
+      readonly replay: "non-idempotent";
+      readonly credentials: true;
+    }>;
+  };
+  group: import("effect/unstable/rpc/RpcGroup").RpcGroup<import("effect/unstable/rpc/Rpc").Rpc<`${Id}/sign-in`, Schema.Struct<{
+    readonly email: Schema.compose<Schema.decodeTo<Schema.brand<Schema.String, "effect-auth/Email">, Schema.String, never, never>, Schema.String>;
+    readonly password: Schema.RedactedFromValue<Schema.String>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  }>, Schema.Union<readonly [Schema.TaggedStruct<"Authenticated", {
+    readonly session: Schema.Struct<{
+      readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly assurance: typeof AuthenticationAssurance;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+      readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+      readonly claims: Schema.Codec<Claims["Type"], Claims["Encoded"], Claims["DecodingServices"], Claims["EncodingServices"]>;
+    }>;
+  }>, Schema.TaggedStruct<"PendingAuthentication", {
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>]>, Schema.Union<readonly [Schema.Union<readonly [typeof PasswordRejected, typeof PasswordUnavailable, typeof PasswordMethodUnsupported, typeof HookDenied]>, Schema.Union<readonly [typeof InvalidOperationInput, typeof AuthenticationRequired, typeof OperationForbidden, typeof AssuranceRequired, typeof OperationPrivateOutputUnsupported]>]>, never, never>>;
+  strategy: Readonly<{
+    completion: boolean;
+    make: Effect.Effect<{
+      readonly signIn: (input: Omit<{
+        readonly email: string;
+        readonly password: string;
+        readonly flowId: string;
+      }, "flowId">) => Effect.Effect<{
+        readonly _tag: "Authenticated";
+        readonly session: {
+          readonly sessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+          readonly assurance: AuthenticationAssurance;
+          readonly issuedAt: import("effect/DateTime").Utc;
+          readonly expiresAt: import("effect/DateTime").Utc;
+          readonly absoluteExpiresAt: import("effect/DateTime").Utc;
+          readonly claims: Claims["Type"];
+        };
+      } | {
+        readonly _tag: "PendingAuthentication";
+        readonly expiresAt: import("effect/DateTime").Utc;
+      }, PasswordMethodUnsupported | PasswordRejected | PasswordUnavailable | SessionApiError, AuthRequest>;
+    }, AuthConfigurationError | PasswordConfigurationError | PasswordMethodConfigurationError, AuthenticationAuthority | Layer.CurrentMemoMap | ModuleService<SessionId, "completion", Claims["Type"]> | PasswordPersistence | import("effect/Scope").Scope | {
+      readonly moduleId: Id;
+      readonly kind: "claims";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    }>;
+  }>;
+}>;
+//#endregion
+export { PasswordSignInOptions, makePasswordSignIn };
+//# sourceMappingURL=signIn.d.mts.map

package/dist/password/methods/signIn.mjs

@@ -0,0 +1,73 @@
+import { HookDenied } from "../../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../../operations/operation.mjs";
+import { AuthenticationFlowId } from "../../sessions/models.mjs";
+import { cryptoLayer } from "../../auth/defaults.mjs";
+import { makeAuthStrategy } from "../../auth/AuthStrategy.mjs";
+import { PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./errors.mjs";
+import { PasswordSignInInput } from "./contracts.mjs";
+import { snapshotPasswordCredential } from "./snapshot.mjs";
+import { defaultPasswordMethodPolicy, snapshotPasswordMethodPolicy, validatePasswordMethodPolicy } from "./policy.mjs";
+import { hashingLayer } from "../defaults.mjs";
+import { makePasswordVerification, passwordCompletionFailure, readPasswordCommit } from "./verification.mjs";
+import { Context, Crypto, Effect, Layer, Schema } from "effect";
+//#region src/password/methods/signIn.ts
+/** A sign-in-only installation never acquires account creation or password mutation services. */
+const makePasswordSignIn = (moduleId, options) => {
+	const { sessions } = options;
+	const source = options.policy ?? defaultPasswordMethodPolicy;
+	const policy = validatePasswordMethodPolicy(snapshotPasswordMethodPolicy(source));
+	const ClaimsForPassword = Context.Service(`effect-auth/password/${moduleId}/Claims`);
+	const Input = Schema.Struct({
+		flowId: AuthenticationFlowId.check(Schema.isMaxLength(256)),
+		...PasswordSignInInput.fields
+	});
+	const SignIn = makeOperation(`${moduleId}/sign-in`, {
+		payload: Input,
+		success: sessions.CompletionResult,
+		error: Schema.Union([
+			PasswordRejected,
+			PasswordUnavailable,
+			PasswordMethodUnsupported,
+			HookDenied
+		]),
+		access: "any",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const handlersLayer = Layer.unwrap(Effect.gen(function* () {
+		yield* Schema.decodeEffect(Schema.NonEmptyString.check(Schema.isMaxLength(128)))(moduleId).pipe(Effect.mapError(() => PasswordMethodConfigurationError.make({})));
+		const configured = yield* policy;
+		return SignIn.credentialHandlerLayer(Effect.fn("Passwords.signIn")(function* (request) {
+			const { verifyPassword } = makePasswordVerification({
+				moduleId,
+				policy: configured
+			});
+			const verified = yield* verifyPassword(request, "sign-in");
+			const claims = yield* (yield* ClaimsForPassword).resolve(yield* snapshotPasswordCredential(verified.credential));
+			return yield* (yield* sessions.AuthenticationCompletion).prepare({
+				evidence: verified.evidence,
+				claims
+			}).pipe(Effect.flatMap(readPasswordCommit), Effect.mapError(passwordCompletionFailure));
+		}));
+	}));
+	const layer = handlersLayer.pipe(Layer.provide(hashingLayer), Layer.provide(cryptoLayer));
+	return Object.freeze({
+		ClaimsForPassword,
+		layer,
+		handlersLayer,
+		operations: { SignIn },
+		group: operationGroup(SignIn),
+		strategy: makeAuthStrategy({ signIn: Effect.fn("Passwords.signInRequest")(function* (invocation, request) {
+			const flowId = yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(Effect.mapError(() => PasswordUnavailable.make({})));
+			return yield* SignIn.invoke(invocation, {
+				...request,
+				flowId
+			});
+		}) }, layer.pipe(Layer.provideMerge(cryptoLayer)), { completion: true })
+	});
+};
+//#endregion
+export { makePasswordSignIn };
+
+//# sourceMappingURL=signIn.mjs.map

package/dist/password/methods/signIn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signIn.mjs","names":[],"sources":["../../../src/password/methods/signIn.ts"],"sourcesContent":["import { Context, Crypto, Effect, Layer, Schema, type Types } from \"effect\";\n\nimport { makeAuthStrategy } from \"../../auth/AuthStrategy\";\nimport { cryptoLayer } from \"../../auth/defaults\";\nimport { HookDenied } from \"../../hooks/models\";\nimport type { AuthInvocation } from \"../../operations/context\";\nimport { makeOperation, operationGroup } from \"../../operations/operation\";\nimport { AuthenticationFlowId } from \"../../sessions/models\";\nimport type { makeSessionModule } from \"../../sessions/module\";\nimport { hashingLayer } from \"../defaults\";\nimport { PasswordSignInInput } from \"./contracts\";\nimport {\n  PasswordMethodConfigurationError,\n  PasswordMethodUnsupported,\n  PasswordRejected,\n  PasswordUnavailable,\n} from \"./errors\";\nimport type { PasswordCredentialSnapshot } from \"./models\";\nimport {\n  defaultPasswordMethodPolicy,\n  snapshotPasswordMethodPolicy,\n  validatePasswordMethodPolicy,\n  type PasswordMethodPolicy,\n} from \"./policy\";\nimport { snapshotPasswordCredential } from \"./snapshot\";\nimport {\n  makePasswordVerification,\n  readPasswordCommit,\n  passwordCompletionFailure,\n} from \"./verification\";\n\nexport interface PasswordSignInOptions<\n  SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n> {\n  readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n  readonly policy?: PasswordMethodPolicy;\n  readonly features?: { readonly signIn: true };\n}\n\n/** A sign-in-only installation never acquires account creation or password mutation services. */\nexport const makePasswordSignIn = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: PasswordSignInOptions<SessionId, Claims>,\n) => {\n  const { sessions } = options;\n  const source = options.policy ?? defaultPasswordMethodPolicy;\n  const policy = validatePasswordMethodPolicy(snapshotPasswordMethodPolicy(source));\n\n  const ClaimsForPassword = Context.Service<\n    {\n      readonly moduleId: Id;\n      readonly kind: \"claims\";\n      readonly claims: Types.Invariant<Claims[\"Type\"]>;\n    },\n    {\n      readonly resolve: (\n        credential: PasswordCredentialSnapshot,\n      ) => Effect.Effect<Claims[\"Type\"], PasswordUnavailable>;\n    }\n  >(`effect-auth/password/${moduleId}/Claims`);\n\n  const Input = Schema.Struct({\n    flowId: AuthenticationFlowId.check(Schema.isMaxLength(256)),\n    ...PasswordSignInInput.fields,\n  });\n\n  const SignIn = makeOperation(`${moduleId}/sign-in`, {\n    payload: Input,\n    success: sessions.CompletionResult,\n    error: Schema.Union([\n      PasswordRejected,\n      PasswordUnavailable,\n      PasswordMethodUnsupported,\n      HookDenied,\n    ]),\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const handlersLayer = Layer.unwrap(\n    Effect.gen(function* () {\n      yield* Schema.decodeEffect(Schema.NonEmptyString.check(Schema.isMaxLength(128)))(\n        moduleId,\n      ).pipe(Effect.mapError(() => PasswordMethodConfigurationError.make({})));\n      const configured = yield* policy;\n\n      return SignIn.credentialHandlerLayer(\n        Effect.fn(\"Passwords.signIn\")(function* (request) {\n          const { verifyPassword } = makePasswordVerification({ moduleId, policy: configured });\n          const verified = yield* verifyPassword(request, \"sign-in\");\n\n          const claims = yield* (yield* ClaimsForPassword).resolve(\n            yield* snapshotPasswordCredential(verified.credential),\n          );\n\n          return yield* (yield* sessions.AuthenticationCompletion)\n            .prepare({ evidence: verified.evidence, claims })\n            .pipe(Effect.flatMap(readPasswordCommit), Effect.mapError(passwordCompletionFailure));\n        }),\n      );\n    }),\n  );\n\n  const layer = handlersLayer.pipe(Layer.provide(hashingLayer), Layer.provide(cryptoLayer));\n\n  return Object.freeze({\n    ClaimsForPassword,\n    layer,\n    handlersLayer,\n    operations: { SignIn },\n    group: operationGroup(SignIn),\n    strategy: makeAuthStrategy(\n      {\n        signIn: Effect.fn(\"Passwords.signInRequest\")(function* (\n          invocation: AuthInvocation,\n          request: Omit<typeof Input.Encoded, \"flowId\">,\n        ) {\n          const flowId = yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(\n            Effect.mapError(() => PasswordUnavailable.make({})),\n          );\n\n          return yield* SignIn.invoke(invocation, { ...request, flowId });\n        }),\n      },\n      layer.pipe(Layer.provideMerge(cryptoLayer)),\n      { completion: true },\n    ),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;AAyCA,MAAa,sBAKX,UACA,YACG;CACH,MAAM,EAAE,aAAa;CACrB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,SAAS,6BAA6B,6BAA6B,MAAM,CAAC;CAEhF,MAAM,oBAAoB,QAAQ,QAWhC,wBAAwB,SAAS,QAAQ;CAE3C,MAAM,QAAQ,OAAO,OAAO;EAC1B,QAAQ,qBAAqB,MAAM,OAAO,YAAY,GAAG,CAAC;EAC1D,GAAG,oBAAoB;CACzB,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,WAAW;EAClD,SAAS;EACT,SAAS,SAAS;EAClB,OAAO,OAAO,MAAM;GAClB;GACA;GACA;GACA;EACF,CAAC;EACD,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,MAAM,OAC1B,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,aAAa,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,CAC9E,QACF,CAAC,CAAC,KAAK,OAAO,eAAe,iCAAiC,KAAK,CAAC,CAAC,CAAC,CAAC;EACvE,MAAM,aAAa,OAAO;EAE1B,OAAO,OAAO,uBACZ,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAAS;GAChD,MAAM,EAAE,mBAAmB,yBAAyB;IAAE;IAAU,QAAQ;GAAW,CAAC;GACpF,MAAM,WAAW,OAAO,eAAe,SAAS,SAAS;GAEzD,MAAM,SAAS,QAAQ,OAAO,kBAAA,CAAmB,QAC/C,OAAO,2BAA2B,SAAS,UAAU,CACvD;GAEA,OAAO,QAAQ,OAAO,SAAS,yBAAA,CAC5B,QAAQ;IAAE,UAAU,SAAS;IAAU;GAAO,CAAC,CAAC,CAChD,KAAK,OAAO,QAAQ,kBAAkB,GAAG,OAAO,SAAS,yBAAyB,CAAC;EACxF,CAAC,CACH;CACF,CAAC,CACH;CAEA,MAAM,QAAQ,cAAc,KAAK,MAAM,QAAQ,YAAY,GAAG,MAAM,QAAQ,WAAW,CAAC;CAExF,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA,YAAY,EAAE,OAAO;EACrB,OAAO,eAAe,MAAM;EAC5B,UAAU,iBACR,EACE,QAAQ,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3C,YACA,SACA;GACA,MAAM,SAAS,QAAQ,OAAO,OAAO,OAAA,CAAQ,aAAa,KACxD,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;GAEA,OAAO,OAAO,OAAO,OAAO,YAAY;IAAE,GAAG;IAAS;GAAO,CAAC;EAChE,CAAC,EACH,GACA,MAAM,KAAK,MAAM,aAAa,WAAW,CAAC,GAC1C,EAAE,YAAY,KAAK,CACrB;CACF,CAAC;AACH"}