@yielded/auth 0.1.0-beta.1

package/dist/testing/conformance/AuthStore.mjs

@@ -0,0 +1,173 @@
+import { ChallengeId, ConsumeChallenge, ConsumeRegistration, KeyId, NewChallenge, NewRegistration, RegistrationId } from "../../Schema.mjs";
+import { AuthStore } from "../../AuthStore.mjs";
+import { check, emailOf, expectFailure, otpDigestOf, tokenDigestOf, uuidOf } from "./support.mjs";
+import { DateTime, Duration, Effect, Schema } from "effect";
+import { TestClock } from "effect/testing";
+//#region src/testing/conformance/AuthStore.ts
+const decodeChallengeId = Schema.decodeSync(ChallengeId);
+const decodeRegistrationId = Schema.decodeSync(RegistrationId);
+const conformanceKeyId = Schema.decodeSync(KeyId)("conformance-key");
+let uniqueId = 0;
+const makeChallenge = (options) => Effect.map(DateTime.now, (now) => NewChallenge.make({
+	challengeId: decodeChallengeId(uuidOf(++uniqueId)),
+	tokenDigest: tokenDigestOf(options.token),
+	email: options.email,
+	purpose: "sign-in",
+	otpDigest: otpDigestOf(options.otp),
+	otpKeyId: conformanceKeyId,
+	issuedAt: now,
+	expiresAt: DateTime.addDuration(now, options.lifetime ?? Duration.minutes(10)),
+	attemptLimit: options.attemptLimit ?? 5,
+	resendCooldown: options.resendCooldown ?? Duration.seconds(60)
+}));
+const consume = (token, otp) => Effect.flatMap(AuthStore, (store) => store.consumeChallenge(ConsumeChallenge.make({
+	tokenDigest: tokenDigestOf(token),
+	otpDigests: { [conformanceKeyId]: otpDigestOf(otp) }
+})));
+const makeRegistration = (options) => Effect.map(DateTime.now, (now) => NewRegistration.make({
+	registrationId: decodeRegistrationId(uuidOf(++uniqueId)),
+	tokenDigest: tokenDigestOf(options.token),
+	email: options.email,
+	purpose: "registration",
+	issuedAt: now,
+	expiresAt: DateTime.addDuration(now, options.lifetime ?? Duration.minutes(15))
+}));
+const conformanceCase = (name, run) => ({
+	name,
+	run: Effect.orDie(run)
+});
+const authStoreConformanceCases = [
+	conformanceCase("expiry boundaries are deterministic", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const before = emailOf("expiry-before");
+		yield* store.issueChallenge(yield* makeChallenge({
+			email: before,
+			token: "expiry-1",
+			otp: "11111111"
+		}));
+		yield* TestClock.adjust(Duration.subtract(Duration.minutes(10), Duration.millis(1)));
+		yield* consume("expiry-1", "11111111");
+		const at = emailOf("expiry-at");
+		yield* store.issueChallenge(yield* makeChallenge({
+			email: at,
+			token: "expiry-2",
+			otp: "22222222"
+		}));
+		yield* TestClock.adjust(Duration.minutes(10));
+		yield* expectFailure(consume("expiry-2", "22222222"), "EmailOtpRejected", "a challenge must be rejected once its expiry instant is reached");
+	})),
+	conformanceCase("wrong attempts increment and exhaust the configured budget", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const email = emailOf("budget");
+		yield* store.issueChallenge(yield* makeChallenge({
+			email,
+			token: "budget-1",
+			otp: "11111111",
+			attemptLimit: 3
+		}));
+		for (let attempt = 0; attempt < 3; attempt++) yield* expectFailure(consume("budget-1", "99999999"), "EmailOtpRejected", "a wrong code must fail");
+		yield* expectFailure(consume("budget-1", "11111111"), "EmailOtpRejected", "an exhausted challenge must reject even the correct code");
+	})),
+	conformanceCase("resend supersedes prior challenges without resetting the rolling budget", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const email = emailOf("supersede");
+		yield* store.issueChallenge(yield* makeChallenge({
+			email,
+			token: "supersede-1",
+			otp: "11111111",
+			attemptLimit: 3
+		}));
+		yield* expectFailure(consume("supersede-1", "00000000"), "EmailOtpRejected", "wrong");
+		yield* expectFailure(consume("supersede-1", "00000001"), "EmailOtpRejected", "wrong");
+		yield* TestClock.adjust(Duration.seconds(61));
+		yield* store.issueChallenge(yield* makeChallenge({
+			email,
+			token: "supersede-2",
+			otp: "22222222",
+			attemptLimit: 3
+		}));
+		yield* expectFailure(consume("supersede-1", "11111111"), "EmailOtpRejected", "a superseded challenge must reject its own correct code");
+		yield* expectFailure(consume("supersede-2", "00000002"), "EmailOtpRejected", "wrong code on the replacement challenge");
+		yield* expectFailure(consume("supersede-2", "22222222"), "EmailOtpRejected", "the rolling budget must carry across resends and exhaust the replacement");
+	})),
+	conformanceCase("parallel valid verification produces exactly one success", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const email = emailOf("parallel-challenge");
+		yield* store.issueChallenge(yield* makeChallenge({
+			email,
+			token: "parallel-1",
+			otp: "11111111"
+		}));
+		const successes = (yield* Effect.all(Array.from({ length: 8 }, () => Effect.exit(consume("parallel-1", "11111111"))), { concurrency: "unbounded" })).filter((exit) => exit._tag === "Success").length;
+		yield* check(successes === 1, `expected exactly one success, saw ${successes}`);
+	})),
+	conformanceCase("a consumed challenge cannot be replayed", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const email = emailOf("replay-challenge");
+		yield* store.issueChallenge(yield* makeChallenge({
+			email,
+			token: "replay-1",
+			otp: "11111111"
+		}));
+		yield* consume("replay-1", "11111111");
+		yield* expectFailure(consume("replay-1", "11111111"), "EmailOtpRejected", "a consumed challenge must reject replays");
+	})),
+	conformanceCase("issuance enforces the resend cooldown with a typed error", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const email = emailOf("cooldown");
+		yield* store.issueChallenge(yield* makeChallenge({
+			email,
+			token: "cooldown-1",
+			otp: "11111111"
+		}));
+		yield* expectFailure(Effect.flatMap(makeChallenge({
+			email,
+			token: "cooldown-2",
+			otp: "22222222"
+		}), (challenge) => store.issueChallenge(challenge)), "AuthRateLimited", "issuing within the cooldown must be rate limited");
+		yield* TestClock.adjust(Duration.seconds(60));
+		yield* Effect.flatMap(makeChallenge({
+			email,
+			token: "cooldown-3",
+			otp: "33333333"
+		}), (challenge) => store.issueChallenge(challenge));
+	})),
+	conformanceCase("pending registrations are single-use and expire", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const email = emailOf("registration");
+		yield* store.issueRegistration(yield* makeRegistration({
+			email,
+			token: "registration-1"
+		}));
+		const registration = yield* store.inspectRegistration(tokenDigestOf("registration-1"));
+		yield* check(registration.email === email, "inspect must return the registration's email");
+		yield* store.consumeRegistration(ConsumeRegistration.make({ tokenDigest: tokenDigestOf("registration-1") }));
+		yield* expectFailure(store.inspectRegistration(tokenDigestOf("registration-1")), "InvalidRegistration", "a consumed registration must not be inspectable");
+		yield* expectFailure(store.consumeRegistration(ConsumeRegistration.make({ tokenDigest: tokenDigestOf("registration-1") })), "InvalidRegistration", "a consumed registration must not be consumable again");
+		yield* store.issueRegistration(yield* makeRegistration({
+			email,
+			token: "registration-2"
+		}));
+		yield* TestClock.adjust(Duration.minutes(15));
+		yield* expectFailure(store.inspectRegistration(tokenDigestOf("registration-2")), "InvalidRegistration", "an expired registration must be rejected");
+	})),
+	conformanceCase("parallel registration consumption produces exactly one success", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		const email = emailOf("parallel-registration");
+		yield* store.issueRegistration(yield* makeRegistration({
+			email,
+			token: "parallel-registration-1"
+		}));
+		const successes = (yield* Effect.all(Array.from({ length: 8 }, () => Effect.exit(store.consumeRegistration(ConsumeRegistration.make({ tokenDigest: tokenDigestOf("parallel-registration-1") })))), { concurrency: "unbounded" })).filter((exit) => exit._tag === "Success").length;
+		yield* check(successes === 1, `expected exactly one success, saw ${successes}`);
+	})),
+	conformanceCase("unknown tokens fail with typed internal rejections", Effect.gen(function* () {
+		const store = yield* AuthStore;
+		yield* expectFailure(consume("never-issued", "11111111"), "EmailOtpRejected", "an unknown challenge token must map to the internal OTP rejection");
+		yield* expectFailure(store.inspectRegistration(tokenDigestOf("never-issued")), "InvalidRegistration", "an unknown registration token must map to the generic registration error");
+	}))
+];
+//#endregion
+export { authStoreConformanceCases };
+
+//# sourceMappingURL=AuthStore.mjs.map

package/dist/testing/conformance/AuthStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStore.mjs","names":[],"sources":["../../../src/testing/conformance/AuthStore.ts"],"sourcesContent":["import { DateTime, Duration, Effect, Schema } from \"effect\";\nimport { TestClock } from \"effect/testing\";\n\nimport { AuthStore } from \"../../AuthStore\";\nimport {\n  type Email,\n  ChallengeId,\n  ConsumeChallenge,\n  ConsumeRegistration,\n  KeyId,\n  NewChallenge,\n  NewRegistration,\n  RegistrationId,\n} from \"../../Schema\";\nimport { check, emailOf, expectFailure, otpDigestOf, tokenDigestOf, uuidOf } from \"./support\";\n\n// Pure store-contract checks for `AuthStore` adapters. Run each case with\n// `it.effect` (TestClock required) against the adapter's layer.\n\nexport interface AuthStoreConformanceCase {\n  readonly name: string;\n  readonly run: Effect.Effect<void, never, AuthStore>;\n}\n\nconst decodeChallengeId = Schema.decodeSync(ChallengeId);\nconst decodeRegistrationId = Schema.decodeSync(RegistrationId);\n\nconst conformanceKeyId = Schema.decodeSync(KeyId)(\"conformance-key\");\n\nlet uniqueId = 0;\n\nconst makeChallenge = (options: {\n  readonly email: Email;\n  readonly token: string;\n  readonly otp: string;\n  readonly attemptLimit?: number;\n  readonly lifetime?: Duration.Duration;\n  readonly resendCooldown?: Duration.Duration;\n}): Effect.Effect<NewChallenge> =>\n  Effect.map(DateTime.now, (now) =>\n    NewChallenge.make({\n      challengeId: decodeChallengeId(uuidOf(++uniqueId)),\n      tokenDigest: tokenDigestOf(options.token),\n      email: options.email,\n      purpose: \"sign-in\",\n      otpDigest: otpDigestOf(options.otp),\n      otpKeyId: conformanceKeyId,\n      issuedAt: now,\n      expiresAt: DateTime.addDuration(now, options.lifetime ?? Duration.minutes(10)),\n      attemptLimit: options.attemptLimit ?? 5,\n      resendCooldown: options.resendCooldown ?? Duration.seconds(60),\n    }),\n  );\n\nconst consume = (token: string, otp: string) =>\n  Effect.flatMap(AuthStore, (store) =>\n    store.consumeChallenge(\n      ConsumeChallenge.make({\n        tokenDigest: tokenDigestOf(token),\n        otpDigests: { [conformanceKeyId]: otpDigestOf(otp) },\n      }),\n    ),\n  );\n\nconst makeRegistration = (options: {\n  readonly email: Email;\n  readonly token: string;\n  readonly lifetime?: Duration.Duration;\n}): Effect.Effect<NewRegistration> =>\n  Effect.map(DateTime.now, (now) =>\n    NewRegistration.make({\n      registrationId: decodeRegistrationId(uuidOf(++uniqueId)),\n      tokenDigest: tokenDigestOf(options.token),\n      email: options.email,\n      purpose: \"registration\",\n      issuedAt: now,\n      expiresAt: DateTime.addDuration(now, options.lifetime ?? Duration.minutes(15)),\n    }),\n  );\n\nconst conformanceCase = <CaseError>(\n  name: string,\n  run: Effect.Effect<void, CaseError, AuthStore>,\n): AuthStoreConformanceCase => ({ name, run: Effect.orDie(run) });\n\nexport const authStoreConformanceCases: ReadonlyArray<AuthStoreConformanceCase> = [\n  conformanceCase(\n    \"expiry boundaries are deterministic\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const before = emailOf(\"expiry-before\");\n\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email: before, token: \"expiry-1\", otp: \"11111111\" }),\n      );\n      yield* TestClock.adjust(Duration.subtract(Duration.minutes(10), Duration.millis(1)));\n      yield* consume(\"expiry-1\", \"11111111\");\n\n      const at = emailOf(\"expiry-at\");\n\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email: at, token: \"expiry-2\", otp: \"22222222\" }),\n      );\n      yield* TestClock.adjust(Duration.minutes(10));\n      yield* expectFailure(\n        consume(\"expiry-2\", \"22222222\"),\n        \"EmailOtpRejected\",\n        \"a challenge must be rejected once its expiry instant is reached\",\n      );\n    }),\n  ),\n\n  conformanceCase(\n    \"wrong attempts increment and exhaust the configured budget\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const email = emailOf(\"budget\");\n\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email, token: \"budget-1\", otp: \"11111111\", attemptLimit: 3 }),\n      );\n      for (let attempt = 0; attempt < 3; attempt++) {\n        yield* expectFailure(\n          consume(\"budget-1\", \"99999999\"),\n          \"EmailOtpRejected\",\n          \"a wrong code must fail\",\n        );\n      }\n      yield* expectFailure(\n        consume(\"budget-1\", \"11111111\"),\n        \"EmailOtpRejected\",\n        \"an exhausted challenge must reject even the correct code\",\n      );\n    }),\n  ),\n\n  conformanceCase(\n    \"resend supersedes prior challenges without resetting the rolling budget\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const email = emailOf(\"supersede\");\n\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email, token: \"supersede-1\", otp: \"11111111\", attemptLimit: 3 }),\n      );\n      yield* expectFailure(consume(\"supersede-1\", \"00000000\"), \"EmailOtpRejected\", \"wrong\");\n      yield* expectFailure(consume(\"supersede-1\", \"00000001\"), \"EmailOtpRejected\", \"wrong\");\n      yield* TestClock.adjust(Duration.seconds(61));\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email, token: \"supersede-2\", otp: \"22222222\", attemptLimit: 3 }),\n      );\n      yield* expectFailure(\n        consume(\"supersede-1\", \"11111111\"),\n        \"EmailOtpRejected\",\n        \"a superseded challenge must reject its own correct code\",\n      );\n      yield* expectFailure(\n        consume(\"supersede-2\", \"00000002\"),\n        \"EmailOtpRejected\",\n        \"wrong code on the replacement challenge\",\n      );\n      yield* expectFailure(\n        consume(\"supersede-2\", \"22222222\"),\n        \"EmailOtpRejected\",\n        \"the rolling budget must carry across resends and exhaust the replacement\",\n      );\n    }),\n  ),\n\n  conformanceCase(\n    \"parallel valid verification produces exactly one success\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const email = emailOf(\"parallel-challenge\");\n\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email, token: \"parallel-1\", otp: \"11111111\" }),\n      );\n\n      const exits = yield* Effect.all(\n        Array.from({ length: 8 }, () => Effect.exit(consume(\"parallel-1\", \"11111111\"))),\n        { concurrency: \"unbounded\" },\n      );\n\n      const successes = exits.filter((exit) => exit._tag === \"Success\").length;\n\n      yield* check(successes === 1, `expected exactly one success, saw ${successes}`);\n    }),\n  ),\n\n  conformanceCase(\n    \"a consumed challenge cannot be replayed\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const email = emailOf(\"replay-challenge\");\n\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email, token: \"replay-1\", otp: \"11111111\" }),\n      );\n      yield* consume(\"replay-1\", \"11111111\");\n      yield* expectFailure(\n        consume(\"replay-1\", \"11111111\"),\n        \"EmailOtpRejected\",\n        \"a consumed challenge must reject replays\",\n      );\n    }),\n  ),\n\n  conformanceCase(\n    \"issuance enforces the resend cooldown with a typed error\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const email = emailOf(\"cooldown\");\n\n      yield* store.issueChallenge(\n        yield* makeChallenge({ email, token: \"cooldown-1\", otp: \"11111111\" }),\n      );\n      yield* expectFailure(\n        Effect.flatMap(\n          makeChallenge({ email, token: \"cooldown-2\", otp: \"22222222\" }),\n          (challenge) => store.issueChallenge(challenge),\n        ),\n        \"AuthRateLimited\",\n        \"issuing within the cooldown must be rate limited\",\n      );\n      yield* TestClock.adjust(Duration.seconds(60));\n      yield* Effect.flatMap(\n        makeChallenge({ email, token: \"cooldown-3\", otp: \"33333333\" }),\n        (challenge) => store.issueChallenge(challenge),\n      );\n    }),\n  ),\n\n  conformanceCase(\n    \"pending registrations are single-use and expire\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const email = emailOf(\"registration\");\n\n      yield* store.issueRegistration(yield* makeRegistration({ email, token: \"registration-1\" }));\n      const registration = yield* store.inspectRegistration(tokenDigestOf(\"registration-1\"));\n\n      yield* check(registration.email === email, \"inspect must return the registration's email\");\n      yield* store.consumeRegistration(\n        ConsumeRegistration.make({ tokenDigest: tokenDigestOf(\"registration-1\") }),\n      );\n      yield* expectFailure(\n        store.inspectRegistration(tokenDigestOf(\"registration-1\")),\n        \"InvalidRegistration\",\n        \"a consumed registration must not be inspectable\",\n      );\n      yield* expectFailure(\n        store.consumeRegistration(\n          ConsumeRegistration.make({ tokenDigest: tokenDigestOf(\"registration-1\") }),\n        ),\n        \"InvalidRegistration\",\n        \"a consumed registration must not be consumable again\",\n      );\n\n      yield* store.issueRegistration(yield* makeRegistration({ email, token: \"registration-2\" }));\n      yield* TestClock.adjust(Duration.minutes(15));\n      yield* expectFailure(\n        store.inspectRegistration(tokenDigestOf(\"registration-2\")),\n        \"InvalidRegistration\",\n        \"an expired registration must be rejected\",\n      );\n    }),\n  ),\n\n  conformanceCase(\n    \"parallel registration consumption produces exactly one success\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n      const email = emailOf(\"parallel-registration\");\n\n      yield* store.issueRegistration(\n        yield* makeRegistration({ email, token: \"parallel-registration-1\" }),\n      );\n\n      const exits = yield* Effect.all(\n        Array.from({ length: 8 }, () =>\n          Effect.exit(\n            store.consumeRegistration(\n              ConsumeRegistration.make({ tokenDigest: tokenDigestOf(\"parallel-registration-1\") }),\n            ),\n          ),\n        ),\n        { concurrency: \"unbounded\" },\n      );\n\n      const successes = exits.filter((exit) => exit._tag === \"Success\").length;\n\n      yield* check(successes === 1, `expected exactly one success, saw ${successes}`);\n    }),\n  ),\n\n  conformanceCase(\n    \"unknown tokens fail with typed internal rejections\",\n    Effect.gen(function* () {\n      const store = yield* AuthStore;\n\n      yield* expectFailure(\n        consume(\"never-issued\", \"11111111\"),\n        \"EmailOtpRejected\",\n        \"an unknown challenge token must map to the internal OTP rejection\",\n      );\n      yield* expectFailure(\n        store.inspectRegistration(tokenDigestOf(\"never-issued\")),\n        \"InvalidRegistration\",\n        \"an unknown registration token must map to the generic registration error\",\n      );\n    }),\n  ),\n];\n"],"mappings":";;;;;;AAwBA,MAAM,oBAAoB,OAAO,WAAW,WAAW;AACvD,MAAM,uBAAuB,OAAO,WAAW,cAAc;AAE7D,MAAM,mBAAmB,OAAO,WAAW,KAAK,CAAC,CAAC,iBAAiB;AAEnE,IAAI,WAAW;AAEf,MAAM,iBAAiB,YAQrB,OAAO,IAAI,SAAS,MAAM,QACxB,aAAa,KAAK;CAChB,aAAa,kBAAkB,OAAO,EAAE,QAAQ,CAAC;CACjD,aAAa,cAAc,QAAQ,KAAK;CACxC,OAAO,QAAQ;CACf,SAAS;CACT,WAAW,YAAY,QAAQ,GAAG;CAClC,UAAU;CACV,UAAU;CACV,WAAW,SAAS,YAAY,KAAK,QAAQ,YAAY,SAAS,QAAQ,EAAE,CAAC;CAC7E,cAAc,QAAQ,gBAAgB;CACtC,gBAAgB,QAAQ,kBAAkB,SAAS,QAAQ,EAAE;AAC/D,CAAC,CACH;AAEF,MAAM,WAAW,OAAe,QAC9B,OAAO,QAAQ,YAAY,UACzB,MAAM,iBACJ,iBAAiB,KAAK;CACpB,aAAa,cAAc,KAAK;CAChC,YAAY,GAAG,mBAAmB,YAAY,GAAG,EAAE;AACrD,CAAC,CACH,CACF;AAEF,MAAM,oBAAoB,YAKxB,OAAO,IAAI,SAAS,MAAM,QACxB,gBAAgB,KAAK;CACnB,gBAAgB,qBAAqB,OAAO,EAAE,QAAQ,CAAC;CACvD,aAAa,cAAc,QAAQ,KAAK;CACxC,OAAO,QAAQ;CACf,SAAS;CACT,UAAU;CACV,WAAW,SAAS,YAAY,KAAK,QAAQ,YAAY,SAAS,QAAQ,EAAE,CAAC;AAC/E,CAAC,CACH;AAEF,MAAM,mBACJ,MACA,SAC8B;CAAE;CAAM,KAAK,OAAO,MAAM,GAAG;AAAE;AAE/D,MAAa,4BAAqE;CAChF,gBACE,uCACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,QAAQ,eAAe;EAEtC,OAAO,MAAM,eACX,OAAO,cAAc;GAAE,OAAO;GAAQ,OAAO;GAAY,KAAK;EAAW,CAAC,CAC5E;EACA,OAAO,UAAU,OAAO,SAAS,SAAS,SAAS,QAAQ,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC,CAAC;EACnF,OAAO,QAAQ,YAAY,UAAU;EAErC,MAAM,KAAK,QAAQ,WAAW;EAE9B,OAAO,MAAM,eACX,OAAO,cAAc;GAAE,OAAO;GAAI,OAAO;GAAY,KAAK;EAAW,CAAC,CACxE;EACA,OAAO,UAAU,OAAO,SAAS,QAAQ,EAAE,CAAC;EAC5C,OAAO,cACL,QAAQ,YAAY,UAAU,GAC9B,oBACA,iEACF;CACF,CAAC,CACH;CAEA,gBACE,8DACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,QAAQ;EAE9B,OAAO,MAAM,eACX,OAAO,cAAc;GAAE;GAAO,OAAO;GAAY,KAAK;GAAY,cAAc;EAAE,CAAC,CACrF;EACA,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WACjC,OAAO,cACL,QAAQ,YAAY,UAAU,GAC9B,oBACA,wBACF;EAEF,OAAO,cACL,QAAQ,YAAY,UAAU,GAC9B,oBACA,0DACF;CACF,CAAC,CACH;CAEA,gBACE,2EACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,WAAW;EAEjC,OAAO,MAAM,eACX,OAAO,cAAc;GAAE;GAAO,OAAO;GAAe,KAAK;GAAY,cAAc;EAAE,CAAC,CACxF;EACA,OAAO,cAAc,QAAQ,eAAe,UAAU,GAAG,oBAAoB,OAAO;EACpF,OAAO,cAAc,QAAQ,eAAe,UAAU,GAAG,oBAAoB,OAAO;EACpF,OAAO,UAAU,OAAO,SAAS,QAAQ,EAAE,CAAC;EAC5C,OAAO,MAAM,eACX,OAAO,cAAc;GAAE;GAAO,OAAO;GAAe,KAAK;GAAY,cAAc;EAAE,CAAC,CACxF;EACA,OAAO,cACL,QAAQ,eAAe,UAAU,GACjC,oBACA,yDACF;EACA,OAAO,cACL,QAAQ,eAAe,UAAU,GACjC,oBACA,yCACF;EACA,OAAO,cACL,QAAQ,eAAe,UAAU,GACjC,oBACA,0EACF;CACF,CAAC,CACH;CAEA,gBACE,4DACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,oBAAoB;EAE1C,OAAO,MAAM,eACX,OAAO,cAAc;GAAE;GAAO,OAAO;GAAc,KAAK;EAAW,CAAC,CACtE;EAOA,MAAM,aAAY,OALG,OAAO,IAC1B,MAAM,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,KAAK,QAAQ,cAAc,UAAU,CAAC,CAAC,GAC9E,EAAE,aAAa,YAAY,CAC7B,EAAA,CAEwB,QAAQ,SAAS,KAAK,SAAS,SAAS,CAAC,CAAC;EAElE,OAAO,MAAM,cAAc,GAAG,qCAAqC,WAAW;CAChF,CAAC,CACH;CAEA,gBACE,2CACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,kBAAkB;EAExC,OAAO,MAAM,eACX,OAAO,cAAc;GAAE;GAAO,OAAO;GAAY,KAAK;EAAW,CAAC,CACpE;EACA,OAAO,QAAQ,YAAY,UAAU;EACrC,OAAO,cACL,QAAQ,YAAY,UAAU,GAC9B,oBACA,0CACF;CACF,CAAC,CACH;CAEA,gBACE,4DACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,UAAU;EAEhC,OAAO,MAAM,eACX,OAAO,cAAc;GAAE;GAAO,OAAO;GAAc,KAAK;EAAW,CAAC,CACtE;EACA,OAAO,cACL,OAAO,QACL,cAAc;GAAE;GAAO,OAAO;GAAc,KAAK;EAAW,CAAC,IAC5D,cAAc,MAAM,eAAe,SAAS,CAC/C,GACA,mBACA,kDACF;EACA,OAAO,UAAU,OAAO,SAAS,QAAQ,EAAE,CAAC;EAC5C,OAAO,OAAO,QACZ,cAAc;GAAE;GAAO,OAAO;GAAc,KAAK;EAAW,CAAC,IAC5D,cAAc,MAAM,eAAe,SAAS,CAC/C;CACF,CAAC,CACH;CAEA,gBACE,mDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,cAAc;EAEpC,OAAO,MAAM,kBAAkB,OAAO,iBAAiB;GAAE;GAAO,OAAO;EAAiB,CAAC,CAAC;EAC1F,MAAM,eAAe,OAAO,MAAM,oBAAoB,cAAc,gBAAgB,CAAC;EAErF,OAAO,MAAM,aAAa,UAAU,OAAO,8CAA8C;EACzF,OAAO,MAAM,oBACX,oBAAoB,KAAK,EAAE,aAAa,cAAc,gBAAgB,EAAE,CAAC,CAC3E;EACA,OAAO,cACL,MAAM,oBAAoB,cAAc,gBAAgB,CAAC,GACzD,uBACA,iDACF;EACA,OAAO,cACL,MAAM,oBACJ,oBAAoB,KAAK,EAAE,aAAa,cAAc,gBAAgB,EAAE,CAAC,CAC3E,GACA,uBACA,sDACF;EAEA,OAAO,MAAM,kBAAkB,OAAO,iBAAiB;GAAE;GAAO,OAAO;EAAiB,CAAC,CAAC;EAC1F,OAAO,UAAU,OAAO,SAAS,QAAQ,EAAE,CAAC;EAC5C,OAAO,cACL,MAAM,oBAAoB,cAAc,gBAAgB,CAAC,GACzD,uBACA,0CACF;CACF,CAAC,CACH;CAEA,gBACE,kEACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,uBAAuB;EAE7C,OAAO,MAAM,kBACX,OAAO,iBAAiB;GAAE;GAAO,OAAO;EAA0B,CAAC,CACrE;EAaA,MAAM,aAAY,OAXG,OAAO,IAC1B,MAAM,KAAK,EAAE,QAAQ,EAAE,SACrB,OAAO,KACL,MAAM,oBACJ,oBAAoB,KAAK,EAAE,aAAa,cAAc,yBAAyB,EAAE,CAAC,CACpF,CACF,CACF,GACA,EAAE,aAAa,YAAY,CAC7B,EAAA,CAEwB,QAAQ,SAAS,KAAK,SAAS,SAAS,CAAC,CAAC;EAElE,OAAO,MAAM,cAAc,GAAG,qCAAqC,WAAW;CAChF,CAAC,CACH;CAEA,gBACE,sDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,OAAO,cACL,QAAQ,gBAAgB,UAAU,GAClC,oBACA,mEACF;EACA,OAAO,cACL,MAAM,oBAAoB,cAAc,cAAc,CAAC,GACvD,uBACA,0EACF;CACF,CAAC,CACH;AACF"}

package/dist/testing/conformance/OAuthConnectionStore.d.mts

@@ -0,0 +1,11 @@
+import { OAuthConnectionStore } from "../../oauth/OAuthConnectionStore.mjs";
+import { Effect } from "effect";
+//#region src/testing/conformance/OAuthConnectionStore.d.ts
+interface OAuthConnectionStoreConformanceCase {
+  readonly name: string;
+  readonly run: Effect.Effect<void, never, OAuthConnectionStore>;
+}
+declare const oauthConnectionStoreConformanceCases: ReadonlyArray<OAuthConnectionStoreConformanceCase>;
+//#endregion
+export { OAuthConnectionStoreConformanceCase, oauthConnectionStoreConformanceCases };
+//# sourceMappingURL=OAuthConnectionStore.d.mts.map

package/dist/testing/conformance/OAuthConnectionStore.mjs

@@ -0,0 +1,102 @@
+import { OAuthConnection, OAuthIdentity, OAuthProviderKey, OAuthTokens } from "../../oauth/schema.mjs";
+import { OAuthConnectionStore } from "../../oauth/OAuthConnectionStore.mjs";
+import { check, decodeSubjectId } from "./support.mjs";
+import { DateTime, Duration, Effect, Option, Redacted, Schema } from "effect";
+//#region src/testing/conformance/OAuthConnectionStore.ts
+const decodeOAuthProviderKey = Schema.decodeSync(OAuthProviderKey);
+const conformanceProvider = decodeOAuthProviderKey("conformance");
+const otherConformanceProvider = decodeOAuthProviderKey("conformance-other");
+const makeOAuthConnection = (options) => Effect.map(DateTime.now, (now) => {
+	const provider = options.provider ?? conformanceProvider;
+	return OAuthConnection.make({
+		provider,
+		subjectId: decodeSubjectId(options.subject),
+		identity: OAuthIdentity.make({
+			provider,
+			providerAccountId: `account:${options.subject}`,
+			handle: Option.some(options.subject)
+		}),
+		tokens: OAuthTokens.make({
+			accessToken: Redacted.make(options.accessToken),
+			tokenType: "bearer",
+			accessTokenExpiresAt: Option.some(DateTime.addDuration(now, Duration.hours(8))),
+			refreshToken: options.refreshToken === void 0 ? Option.none() : Option.some(Redacted.make(options.refreshToken)),
+			refreshTokenExpiresAt: Option.none(),
+			scope: Option.none()
+		}),
+		connectedAt: now,
+		updatedAt: now
+	});
+});
+const oauthConnectionCase = (name, run) => ({
+	name,
+	run: Effect.orDie(run)
+});
+const oauthConnectionStoreConformanceCases = [
+	oauthConnectionCase("put and get round-trip the connection including token values", Effect.gen(function* () {
+		const store = yield* OAuthConnectionStore;
+		const connection = yield* makeOAuthConnection({
+			subject: "roundtrip",
+			accessToken: "access-roundtrip",
+			refreshToken: "refresh-roundtrip"
+		});
+		yield* store.put(connection);
+		const loaded = yield* store.get(conformanceProvider, connection.subjectId);
+		yield* check(Option.isSome(loaded), "get must return the stored connection");
+		if (Option.isSome(loaded)) {
+			yield* check(Redacted.value(loaded.value.tokens.accessToken) === "access-roundtrip" && Option.isSome(loaded.value.tokens.refreshToken) && Redacted.value(loaded.value.tokens.refreshToken.value) === "refresh-roundtrip", "token values must survive the round-trip exactly");
+			yield* check(loaded.value.identity.providerAccountId === "account:roundtrip", "the identity must survive the round-trip");
+		}
+	})),
+	oauthConnectionCase("put replaces the existing connection for the same key", Effect.gen(function* () {
+		const store = yield* OAuthConnectionStore;
+		yield* store.put(yield* makeOAuthConnection({
+			subject: "replace",
+			accessToken: "access-before"
+		}));
+		yield* store.put(yield* makeOAuthConnection({
+			subject: "replace",
+			accessToken: "access-after"
+		}));
+		const loaded = yield* store.get(conformanceProvider, decodeSubjectId("replace"));
+		yield* check(Option.isSome(loaded) && Redacted.value(loaded.value.tokens.accessToken) === "access-after", "put must replace the previous connection");
+	})),
+	oauthConnectionCase("remove deletes the connection and is idempotent", Effect.gen(function* () {
+		const store = yield* OAuthConnectionStore;
+		const subjectId = decodeSubjectId("remove");
+		yield* store.put(yield* makeOAuthConnection({
+			subject: "remove",
+			accessToken: "access-remove"
+		}));
+		yield* store.remove(conformanceProvider, subjectId);
+		const loaded = yield* store.get(conformanceProvider, subjectId);
+		yield* check(Option.isNone(loaded), "a removed connection must not be readable");
+		yield* store.remove(conformanceProvider, subjectId);
+	})),
+	oauthConnectionCase("connections are isolated by subject and by provider", Effect.gen(function* () {
+		const store = yield* OAuthConnectionStore;
+		yield* store.put(yield* makeOAuthConnection({
+			subject: "isolation-a",
+			accessToken: "access-a"
+		}));
+		yield* store.put(yield* makeOAuthConnection({
+			subject: "isolation-b",
+			accessToken: "access-b"
+		}));
+		yield* store.put(yield* makeOAuthConnection({
+			provider: otherConformanceProvider,
+			subject: "isolation-a",
+			accessToken: "access-a-other"
+		}));
+		const first = yield* store.get(conformanceProvider, decodeSubjectId("isolation-a"));
+		const second = yield* store.get(conformanceProvider, decodeSubjectId("isolation-b"));
+		const other = yield* store.get(otherConformanceProvider, decodeSubjectId("isolation-a"));
+		yield* check(Option.isSome(first) && Redacted.value(first.value.tokens.accessToken) === "access-a", "subject A must read its own connection");
+		yield* check(Option.isSome(second) && Redacted.value(second.value.tokens.accessToken) === "access-b", "subject B must read its own connection");
+		yield* check(Option.isSome(other) && Redacted.value(other.value.tokens.accessToken) === "access-a-other", "the same subject on another provider must read that provider's connection");
+	}))
+];
+//#endregion
+export { oauthConnectionStoreConformanceCases };
+
+//# sourceMappingURL=OAuthConnectionStore.mjs.map

package/dist/testing/conformance/OAuthConnectionStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectionStore.mjs","names":[],"sources":["../../../src/testing/conformance/OAuthConnectionStore.ts"],"sourcesContent":["import { DateTime, Duration, Effect, Option, Redacted, Schema } from \"effect\";\n\nimport { OAuthConnectionStore } from \"../../oauth/OAuthConnectionStore\";\nimport { OAuthConnection, OAuthIdentity, OAuthProviderKey, OAuthTokens } from \"../../oauth/schema\";\nimport { check, decodeSubjectId } from \"./support\";\n\n// Contract checks a downstream (typically encrypting) `OAuthConnectionStore`\n// adapter must pass: keyed round-trips that preserve the redacted token\n// values, replacement on put, removal, and isolation across subjects and\n// providers. Run each case with `it.effect`.\n\nexport interface OAuthConnectionStoreConformanceCase {\n  readonly name: string;\n  readonly run: Effect.Effect<void, never, OAuthConnectionStore>;\n}\n\nconst decodeOAuthProviderKey = Schema.decodeSync(OAuthProviderKey);\n\nconst conformanceProvider = decodeOAuthProviderKey(\"conformance\");\nconst otherConformanceProvider = decodeOAuthProviderKey(\"conformance-other\");\n\nconst makeOAuthConnection = (options: {\n  readonly provider?: OAuthProviderKey;\n  readonly subject: string;\n  readonly accessToken: string;\n  readonly refreshToken?: string;\n}): Effect.Effect<OAuthConnection> =>\n  Effect.map(DateTime.now, (now) => {\n    const provider = options.provider ?? conformanceProvider;\n\n    return OAuthConnection.make({\n      provider,\n      subjectId: decodeSubjectId(options.subject),\n      identity: OAuthIdentity.make({\n        provider,\n        providerAccountId: `account:${options.subject}`,\n        handle: Option.some(options.subject),\n      }),\n      tokens: OAuthTokens.make({\n        accessToken: Redacted.make(options.accessToken),\n        tokenType: \"bearer\",\n        accessTokenExpiresAt: Option.some(DateTime.addDuration(now, Duration.hours(8))),\n        refreshToken:\n          options.refreshToken === undefined\n            ? Option.none()\n            : Option.some(Redacted.make(options.refreshToken)),\n        refreshTokenExpiresAt: Option.none(),\n        scope: Option.none(),\n      }),\n      connectedAt: now,\n      updatedAt: now,\n    });\n  });\n\nconst oauthConnectionCase = <CaseError>(\n  name: string,\n  run: Effect.Effect<void, CaseError, OAuthConnectionStore>,\n): OAuthConnectionStoreConformanceCase => ({ name, run: Effect.orDie(run) });\n\nexport const oauthConnectionStoreConformanceCases: ReadonlyArray<OAuthConnectionStoreConformanceCase> =\n  [\n    oauthConnectionCase(\n      \"put and get round-trip the connection including token values\",\n      Effect.gen(function* () {\n        const store = yield* OAuthConnectionStore;\n\n        const connection = yield* makeOAuthConnection({\n          subject: \"roundtrip\",\n          accessToken: \"access-roundtrip\",\n          refreshToken: \"refresh-roundtrip\",\n        });\n\n        yield* store.put(connection);\n        const loaded = yield* store.get(conformanceProvider, connection.subjectId);\n\n        yield* check(Option.isSome(loaded), \"get must return the stored connection\");\n        if (Option.isSome(loaded)) {\n          yield* check(\n            Redacted.value(loaded.value.tokens.accessToken) === \"access-roundtrip\" &&\n              Option.isSome(loaded.value.tokens.refreshToken) &&\n              Redacted.value(loaded.value.tokens.refreshToken.value) === \"refresh-roundtrip\",\n            \"token values must survive the round-trip exactly\",\n          );\n          yield* check(\n            loaded.value.identity.providerAccountId === \"account:roundtrip\",\n            \"the identity must survive the round-trip\",\n          );\n        }\n      }),\n    ),\n\n    oauthConnectionCase(\n      \"put replaces the existing connection for the same key\",\n      Effect.gen(function* () {\n        const store = yield* OAuthConnectionStore;\n\n        yield* store.put(\n          yield* makeOAuthConnection({ subject: \"replace\", accessToken: \"access-before\" }),\n        );\n        yield* store.put(\n          yield* makeOAuthConnection({ subject: \"replace\", accessToken: \"access-after\" }),\n        );\n        const loaded = yield* store.get(conformanceProvider, decodeSubjectId(\"replace\"));\n\n        yield* check(\n          Option.isSome(loaded) &&\n            Redacted.value(loaded.value.tokens.accessToken) === \"access-after\",\n          \"put must replace the previous connection\",\n        );\n      }),\n    ),\n\n    oauthConnectionCase(\n      \"remove deletes the connection and is idempotent\",\n      Effect.gen(function* () {\n        const store = yield* OAuthConnectionStore;\n        const subjectId = decodeSubjectId(\"remove\");\n\n        yield* store.put(\n          yield* makeOAuthConnection({ subject: \"remove\", accessToken: \"access-remove\" }),\n        );\n        yield* store.remove(conformanceProvider, subjectId);\n        const loaded = yield* store.get(conformanceProvider, subjectId);\n\n        yield* check(Option.isNone(loaded), \"a removed connection must not be readable\");\n        yield* store.remove(conformanceProvider, subjectId);\n      }),\n    ),\n\n    oauthConnectionCase(\n      \"connections are isolated by subject and by provider\",\n      Effect.gen(function* () {\n        const store = yield* OAuthConnectionStore;\n\n        yield* store.put(\n          yield* makeOAuthConnection({ subject: \"isolation-a\", accessToken: \"access-a\" }),\n        );\n        yield* store.put(\n          yield* makeOAuthConnection({ subject: \"isolation-b\", accessToken: \"access-b\" }),\n        );\n        yield* store.put(\n          yield* makeOAuthConnection({\n            provider: otherConformanceProvider,\n            subject: \"isolation-a\",\n            accessToken: \"access-a-other\",\n          }),\n        );\n        const first = yield* store.get(conformanceProvider, decodeSubjectId(\"isolation-a\"));\n        const second = yield* store.get(conformanceProvider, decodeSubjectId(\"isolation-b\"));\n        const other = yield* store.get(otherConformanceProvider, decodeSubjectId(\"isolation-a\"));\n\n        yield* check(\n          Option.isSome(first) && Redacted.value(first.value.tokens.accessToken) === \"access-a\",\n          \"subject A must read its own connection\",\n        );\n        yield* check(\n          Option.isSome(second) && Redacted.value(second.value.tokens.accessToken) === \"access-b\",\n          \"subject B must read its own connection\",\n        );\n        yield* check(\n          Option.isSome(other) &&\n            Redacted.value(other.value.tokens.accessToken) === \"access-a-other\",\n          \"the same subject on another provider must read that provider's connection\",\n        );\n      }),\n    ),\n  ];\n"],"mappings":";;;;;AAgBA,MAAM,yBAAyB,OAAO,WAAW,gBAAgB;AAEjE,MAAM,sBAAsB,uBAAuB,aAAa;AAChE,MAAM,2BAA2B,uBAAuB,mBAAmB;AAE3E,MAAM,uBAAuB,YAM3B,OAAO,IAAI,SAAS,MAAM,QAAQ;CAChC,MAAM,WAAW,QAAQ,YAAY;CAErC,OAAO,gBAAgB,KAAK;EAC1B;EACA,WAAW,gBAAgB,QAAQ,OAAO;EAC1C,UAAU,cAAc,KAAK;GAC3B;GACA,mBAAmB,WAAW,QAAQ;GACtC,QAAQ,OAAO,KAAK,QAAQ,OAAO;EACrC,CAAC;EACD,QAAQ,YAAY,KAAK;GACvB,aAAa,SAAS,KAAK,QAAQ,WAAW;GAC9C,WAAW;GACX,sBAAsB,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,MAAM,CAAC,CAAC,CAAC;GAC9E,cACE,QAAQ,iBAAiB,KAAA,IACrB,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,KAAK,QAAQ,YAAY,CAAC;GACrD,uBAAuB,OAAO,KAAK;GACnC,OAAO,OAAO,KAAK;EACrB,CAAC;EACD,aAAa;EACb,WAAW;CACb,CAAC;AACH,CAAC;AAEH,MAAM,uBACJ,MACA,SACyC;CAAE;CAAM,KAAK,OAAO,MAAM,GAAG;AAAE;AAE1E,MAAa,uCACX;CACE,oBACE,gEACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,MAAM,aAAa,OAAO,oBAAoB;GAC5C,SAAS;GACT,aAAa;GACb,cAAc;EAChB,CAAC;EAED,OAAO,MAAM,IAAI,UAAU;EAC3B,MAAM,SAAS,OAAO,MAAM,IAAI,qBAAqB,WAAW,SAAS;EAEzE,OAAO,MAAM,OAAO,OAAO,MAAM,GAAG,uCAAuC;EAC3E,IAAI,OAAO,OAAO,MAAM,GAAG;GACzB,OAAO,MACL,SAAS,MAAM,OAAO,MAAM,OAAO,WAAW,MAAM,sBAClD,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAC9C,SAAS,MAAM,OAAO,MAAM,OAAO,aAAa,KAAK,MAAM,qBAC7D,kDACF;GACA,OAAO,MACL,OAAO,MAAM,SAAS,sBAAsB,qBAC5C,0CACF;EACF;CACF,CAAC,CACH;CAEA,oBACE,yDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,OAAO,MAAM,IACX,OAAO,oBAAoB;GAAE,SAAS;GAAW,aAAa;EAAgB,CAAC,CACjF;EACA,OAAO,MAAM,IACX,OAAO,oBAAoB;GAAE,SAAS;GAAW,aAAa;EAAe,CAAC,CAChF;EACA,MAAM,SAAS,OAAO,MAAM,IAAI,qBAAqB,gBAAgB,SAAS,CAAC;EAE/E,OAAO,MACL,OAAO,OAAO,MAAM,KAClB,SAAS,MAAM,OAAO,MAAM,OAAO,WAAW,MAAM,gBACtD,0CACF;CACF,CAAC,CACH;CAEA,oBACE,mDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,YAAY,gBAAgB,QAAQ;EAE1C,OAAO,MAAM,IACX,OAAO,oBAAoB;GAAE,SAAS;GAAU,aAAa;EAAgB,CAAC,CAChF;EACA,OAAO,MAAM,OAAO,qBAAqB,SAAS;EAClD,MAAM,SAAS,OAAO,MAAM,IAAI,qBAAqB,SAAS;EAE9D,OAAO,MAAM,OAAO,OAAO,MAAM,GAAG,2CAA2C;EAC/E,OAAO,MAAM,OAAO,qBAAqB,SAAS;CACpD,CAAC,CACH;CAEA,oBACE,uDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,OAAO,MAAM,IACX,OAAO,oBAAoB;GAAE,SAAS;GAAe,aAAa;EAAW,CAAC,CAChF;EACA,OAAO,MAAM,IACX,OAAO,oBAAoB;GAAE,SAAS;GAAe,aAAa;EAAW,CAAC,CAChF;EACA,OAAO,MAAM,IACX,OAAO,oBAAoB;GACzB,UAAU;GACV,SAAS;GACT,aAAa;EACf,CAAC,CACH;EACA,MAAM,QAAQ,OAAO,MAAM,IAAI,qBAAqB,gBAAgB,aAAa,CAAC;EAClF,MAAM,SAAS,OAAO,MAAM,IAAI,qBAAqB,gBAAgB,aAAa,CAAC;EACnF,MAAM,QAAQ,OAAO,MAAM,IAAI,0BAA0B,gBAAgB,aAAa,CAAC;EAEvF,OAAO,MACL,OAAO,OAAO,KAAK,KAAK,SAAS,MAAM,MAAM,MAAM,OAAO,WAAW,MAAM,YAC3E,wCACF;EACA,OAAO,MACL,OAAO,OAAO,MAAM,KAAK,SAAS,MAAM,OAAO,MAAM,OAAO,WAAW,MAAM,YAC7E,wCACF;EACA,OAAO,MACL,OAAO,OAAO,KAAK,KACjB,SAAS,MAAM,MAAM,MAAM,OAAO,WAAW,MAAM,kBACrD,2EACF;CACF,CAAC,CACH;AACF"}

package/dist/testing/conformance/OAuthStateStore.d.mts

@@ -0,0 +1,11 @@
+import { OAuthStateStore } from "../../oauth/OAuthStateStore.mjs";
+import { Effect } from "effect";
+//#region src/testing/conformance/OAuthStateStore.d.ts
+interface OAuthStateStoreConformanceCase {
+  readonly name: string;
+  readonly run: Effect.Effect<void, never, OAuthStateStore>;
+}
+declare const oauthStateStoreConformanceCases: ReadonlyArray<OAuthStateStoreConformanceCase>;
+//#endregion
+export { OAuthStateStoreConformanceCase, oauthStateStoreConformanceCases };
+//# sourceMappingURL=OAuthStateStore.d.mts.map

package/dist/testing/conformance/OAuthStateStore.mjs

@@ -0,0 +1,45 @@
+import { OAuthProviderKey, OAuthState } from "../../oauth/schema.mjs";
+import { OAuthStateStore } from "../../oauth/OAuthStateStore.mjs";
+import { check, decodeSubjectId, expectFailure, tokenDigestOf } from "./support.mjs";
+import { DateTime, Duration, Effect, Schema } from "effect";
+import { TestClock } from "effect/testing";
+//#region src/testing/conformance/OAuthStateStore.ts
+const conformanceProvider = Schema.decodeSync(OAuthProviderKey)("conformance");
+const makeOAuthState = (options) => Effect.map(DateTime.now, (now) => OAuthState.make({
+	stateDigest: tokenDigestOf(options.token),
+	provider: conformanceProvider,
+	subjectId: decodeSubjectId(options.subject ?? "conformance-subject"),
+	redirectUri: "https://app.conformance.test/oauth/callback",
+	issuedAt: now,
+	expiresAt: DateTime.addDuration(now, options.lifetime ?? Duration.minutes(10))
+}));
+const oauthStateCase = (name, run) => ({
+	name,
+	run: Effect.orDie(run)
+});
+const oauthStateStoreConformanceCases = [
+	oauthStateCase("consume returns the issued state exactly once", Effect.gen(function* () {
+		const store = yield* OAuthStateStore;
+		yield* store.issue(yield* makeOAuthState({ token: "oauth-once" }));
+		const state = yield* store.consume(tokenDigestOf("oauth-once"));
+		yield* check(state.redirectUri === "https://app.conformance.test/oauth/callback", "consume must return the stored state");
+		yield* expectFailure(store.consume(tokenDigestOf("oauth-once")), "InvalidOAuthState", "a consumed state must reject replays");
+	})),
+	oauthStateCase("parallel consumption produces exactly one success", Effect.gen(function* () {
+		const store = yield* OAuthStateStore;
+		yield* store.issue(yield* makeOAuthState({ token: "oauth-parallel" }));
+		const successes = (yield* Effect.all(Array.from({ length: 8 }, () => Effect.exit(store.consume(tokenDigestOf("oauth-parallel")))), { concurrency: "unbounded" })).filter((exit) => exit._tag === "Success").length;
+		yield* check(successes === 1, `expected exactly one success, saw ${successes}`);
+	})),
+	oauthStateCase("an expired state is rejected at its expiry instant", Effect.gen(function* () {
+		const store = yield* OAuthStateStore;
+		yield* store.issue(yield* makeOAuthState({ token: "oauth-expiry" }));
+		yield* TestClock.adjust(Duration.minutes(10));
+		yield* expectFailure(store.consume(tokenDigestOf("oauth-expiry")), "InvalidOAuthState", "a state must be rejected once its expiry instant is reached");
+	})),
+	oauthStateCase("unknown digests fail with the generic typed error", expectFailure(Effect.flatMap(OAuthStateStore, (store) => store.consume(tokenDigestOf("oauth-unknown"))), "InvalidOAuthState", "an unknown state digest must map to the generic state error"))
+];
+//#endregion
+export { oauthStateStoreConformanceCases };
+
+//# sourceMappingURL=OAuthStateStore.mjs.map

package/dist/testing/conformance/OAuthStateStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthStateStore.mjs","names":[],"sources":["../../../src/testing/conformance/OAuthStateStore.ts"],"sourcesContent":["import { DateTime, Duration, Effect, Schema } from \"effect\";\nimport { TestClock } from \"effect/testing\";\n\nimport { OAuthStateStore } from \"../../oauth/OAuthStateStore\";\nimport { OAuthProviderKey, OAuthState } from \"../../oauth/schema\";\nimport { check, decodeSubjectId, expectFailure, tokenDigestOf } from \"./support\";\n\n// Pure store-contract checks for `OAuthStateStore` adapters: state digests\n// are opaque strings to the store, so the suite fabricates them directly.\n// Run each case with `it.effect` (TestClock required) against the adapter's\n// layer.\n\nexport interface OAuthStateStoreConformanceCase {\n  readonly name: string;\n  readonly run: Effect.Effect<void, never, OAuthStateStore>;\n}\n\nconst conformanceProvider = Schema.decodeSync(OAuthProviderKey)(\"conformance\");\n\nconst makeOAuthState = (options: {\n  readonly token: string;\n  readonly subject?: string;\n  readonly lifetime?: Duration.Duration;\n}): Effect.Effect<OAuthState> =>\n  Effect.map(DateTime.now, (now) =>\n    OAuthState.make({\n      stateDigest: tokenDigestOf(options.token),\n      provider: conformanceProvider,\n      subjectId: decodeSubjectId(options.subject ?? \"conformance-subject\"),\n      redirectUri: \"https://app.conformance.test/oauth/callback\",\n      issuedAt: now,\n      expiresAt: DateTime.addDuration(now, options.lifetime ?? Duration.minutes(10)),\n    }),\n  );\n\nconst oauthStateCase = <CaseError>(\n  name: string,\n  run: Effect.Effect<void, CaseError, OAuthStateStore>,\n): OAuthStateStoreConformanceCase => ({ name, run: Effect.orDie(run) });\n\nexport const oauthStateStoreConformanceCases: ReadonlyArray<OAuthStateStoreConformanceCase> = [\n  oauthStateCase(\n    \"consume returns the issued state exactly once\",\n    Effect.gen(function* () {\n      const store = yield* OAuthStateStore;\n\n      yield* store.issue(yield* makeOAuthState({ token: \"oauth-once\" }));\n      const state = yield* store.consume(tokenDigestOf(\"oauth-once\"));\n\n      yield* check(\n        state.redirectUri === \"https://app.conformance.test/oauth/callback\",\n        \"consume must return the stored state\",\n      );\n      yield* expectFailure(\n        store.consume(tokenDigestOf(\"oauth-once\")),\n        \"InvalidOAuthState\",\n        \"a consumed state must reject replays\",\n      );\n    }),\n  ),\n\n  oauthStateCase(\n    \"parallel consumption produces exactly one success\",\n    Effect.gen(function* () {\n      const store = yield* OAuthStateStore;\n\n      yield* store.issue(yield* makeOAuthState({ token: \"oauth-parallel\" }));\n\n      const exits = yield* Effect.all(\n        Array.from({ length: 8 }, () =>\n          Effect.exit(store.consume(tokenDigestOf(\"oauth-parallel\"))),\n        ),\n        { concurrency: \"unbounded\" },\n      );\n\n      const successes = exits.filter((exit) => exit._tag === \"Success\").length;\n\n      yield* check(successes === 1, `expected exactly one success, saw ${successes}`);\n    }),\n  ),\n\n  oauthStateCase(\n    \"an expired state is rejected at its expiry instant\",\n    Effect.gen(function* () {\n      const store = yield* OAuthStateStore;\n\n      yield* store.issue(yield* makeOAuthState({ token: \"oauth-expiry\" }));\n      yield* TestClock.adjust(Duration.minutes(10));\n      yield* expectFailure(\n        store.consume(tokenDigestOf(\"oauth-expiry\")),\n        \"InvalidOAuthState\",\n        \"a state must be rejected once its expiry instant is reached\",\n      );\n    }),\n  ),\n\n  oauthStateCase(\n    \"unknown digests fail with the generic typed error\",\n    expectFailure(\n      Effect.flatMap(OAuthStateStore, (store) => store.consume(tokenDigestOf(\"oauth-unknown\"))),\n      \"InvalidOAuthState\",\n      \"an unknown state digest must map to the generic state error\",\n    ),\n  ),\n];\n"],"mappings":";;;;;;AAiBA,MAAM,sBAAsB,OAAO,WAAW,gBAAgB,CAAC,CAAC,aAAa;AAE7E,MAAM,kBAAkB,YAKtB,OAAO,IAAI,SAAS,MAAM,QACxB,WAAW,KAAK;CACd,aAAa,cAAc,QAAQ,KAAK;CACxC,UAAU;CACV,WAAW,gBAAgB,QAAQ,WAAW,qBAAqB;CACnE,aAAa;CACb,UAAU;CACV,WAAW,SAAS,YAAY,KAAK,QAAQ,YAAY,SAAS,QAAQ,EAAE,CAAC;AAC/E,CAAC,CACH;AAEF,MAAM,kBACJ,MACA,SACoC;CAAE;CAAM,KAAK,OAAO,MAAM,GAAG;AAAE;AAErE,MAAa,kCAAiF;CAC5F,eACE,iDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,OAAO,MAAM,MAAM,OAAO,eAAe,EAAE,OAAO,aAAa,CAAC,CAAC;EACjE,MAAM,QAAQ,OAAO,MAAM,QAAQ,cAAc,YAAY,CAAC;EAE9D,OAAO,MACL,MAAM,gBAAgB,+CACtB,sCACF;EACA,OAAO,cACL,MAAM,QAAQ,cAAc,YAAY,CAAC,GACzC,qBACA,sCACF;CACF,CAAC,CACH;CAEA,eACE,qDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,OAAO,MAAM,MAAM,OAAO,eAAe,EAAE,OAAO,iBAAiB,CAAC,CAAC;EASrE,MAAM,aAAY,OAPG,OAAO,IAC1B,MAAM,KAAK,EAAE,QAAQ,EAAE,SACrB,OAAO,KAAK,MAAM,QAAQ,cAAc,gBAAgB,CAAC,CAAC,CAC5D,GACA,EAAE,aAAa,YAAY,CAC7B,EAAA,CAEwB,QAAQ,SAAS,KAAK,SAAS,SAAS,CAAC,CAAC;EAElE,OAAO,MAAM,cAAc,GAAG,qCAAqC,WAAW;CAChF,CAAC,CACH;CAEA,eACE,sDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,OAAO,MAAM,MAAM,OAAO,eAAe,EAAE,OAAO,eAAe,CAAC,CAAC;EACnE,OAAO,UAAU,OAAO,SAAS,QAAQ,EAAE,CAAC;EAC5C,OAAO,cACL,MAAM,QAAQ,cAAc,cAAc,CAAC,GAC3C,qBACA,6DACF;CACF,CAAC,CACH;CAEA,eACE,qDACA,cACE,OAAO,QAAQ,kBAAkB,UAAU,MAAM,QAAQ,cAAc,eAAe,CAAC,CAAC,GACxF,qBACA,6DACF,CACF;AACF"}

package/dist/testing/conformance/PasswordCredentialStore.d.mts

@@ -0,0 +1,20 @@
+import { Email, SubjectId } from "../../Schema.mjs";
+import { IdentityResolver } from "../../IdentityResolver.mjs";
+import { PasswordCredentialStore } from "../../PasswordCredentialStore.mjs";
+import { Effect, Layer } from "effect";
+//#region src/testing/conformance/PasswordCredentialStore.d.ts
+interface PasswordCredentialStoreConformanceCase {
+  readonly name: string;
+  readonly run: Effect.Effect<void, never, PasswordCredentialStore>;
+}
+/** Subject id the adapter under test must map a conformance email to. */
+declare const credentialConformanceSubject: (email: Email) => SubjectId;
+/**
+ * `IdentityResolver` implementing the credential-conformance email mapping,
+ * for adapters that resolve emails through the resolver.
+ */
+declare const layerCredentialConformanceResolver: Layer.Layer<IdentityResolver>;
+declare const passwordCredentialStoreConformanceCases: ReadonlyArray<PasswordCredentialStoreConformanceCase>;
+//#endregion
+export { PasswordCredentialStoreConformanceCase, credentialConformanceSubject, layerCredentialConformanceResolver, passwordCredentialStoreConformanceCases };
+//# sourceMappingURL=PasswordCredentialStore.d.mts.map

package/dist/testing/conformance/PasswordCredentialStore.mjs

@@ -0,0 +1,103 @@
+import { PasswordHash } from "../../Schema.mjs";
+import { IdentityResolver } from "../../IdentityResolver.mjs";
+import { PasswordCredentialStore } from "../../PasswordCredentialStore.mjs";
+import { check, decodeSubjectId, emailOf } from "./support.mjs";
+import { DateTime, Duration, Effect, Layer, Option, Schema } from "effect";
+import { TestClock } from "effect/testing";
+//#region src/testing/conformance/PasswordCredentialStore.ts
+const decodePasswordHash = Schema.decodeSync(PasswordHash);
+/** Subject id the adapter under test must map a conformance email to. */
+const credentialConformanceSubject = (email) => decodeSubjectId(`subject:${email}`);
+/**
+* `IdentityResolver` implementing the credential-conformance email mapping,
+* for adapters that resolve emails through the resolver.
+*/
+const layerCredentialConformanceResolver = Layer.succeed(IdentityResolver)({ findByVerifiedEmail: (email) => Effect.succeed(Option.some(credentialConformanceSubject(email))) });
+const passwordHashOf = (name) => decodePasswordHash(`password-hash:${name}`);
+const credentialLockOptions = {
+	attemptLimit: 3,
+	lockDuration: Duration.minutes(15)
+};
+const credentialCase = (name, run) => ({
+	name,
+	run: Effect.orDie(run)
+});
+const passwordCredentialStoreConformanceCases = [
+	credentialCase("upsert and find round-trip through subject and email", Effect.gen(function* () {
+		const store = yield* PasswordCredentialStore;
+		const email = emailOf("credential-roundtrip");
+		const subjectId = credentialConformanceSubject(email);
+		yield* store.upsert(subjectId, passwordHashOf("roundtrip"));
+		const bySubject = yield* store.findBySubject(subjectId);
+		yield* check(Option.isSome(bySubject) && bySubject.value.hash === passwordHashOf("roundtrip"), "findBySubject must return the upserted hash");
+		const byEmail = yield* store.findByEmail(email);
+		yield* check(Option.isSome(byEmail) && byEmail.value.subjectId === subjectId, "findByEmail must resolve to the same credential");
+		yield* check(Option.isSome(byEmail) && byEmail.value.failedAttempts === 0 && Option.isNone(byEmail.value.lockedUntil), "a fresh credential must be unlocked with zero failures");
+	})),
+	credentialCase("failures count up and lock at the configured threshold", Effect.gen(function* () {
+		const store = yield* PasswordCredentialStore;
+		const email = emailOf("credential-lock");
+		const subjectId = credentialConformanceSubject(email);
+		yield* store.upsert(subjectId, passwordHashOf("lock"));
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		const beforeLock = yield* store.findByEmail(email);
+		yield* check(Option.isSome(beforeLock) && beforeLock.value.failedAttempts === 2 && Option.isNone(beforeLock.value.lockedUntil), "failures below the limit must count without locking");
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		const locked = yield* store.findByEmail(email);
+		const now = yield* DateTime.now;
+		yield* check(Option.isSome(locked) && locked.value.failedAttempts === 3 && Option.isSome(locked.value.lockedUntil) && DateTime.toEpochMillis(locked.value.lockedUntil.value) > DateTime.toEpochMillis(now), "reaching the limit must set a lock in the future");
+	})),
+	credentialCase("success clears failures and the lock without touching the hash", Effect.gen(function* () {
+		const store = yield* PasswordCredentialStore;
+		const email = emailOf("credential-success");
+		const subjectId = credentialConformanceSubject(email);
+		yield* store.upsert(subjectId, passwordHashOf("success"));
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordSuccess(subjectId);
+		const credential = yield* store.findByEmail(email);
+		yield* check(Option.isSome(credential) && credential.value.failedAttempts === 0 && Option.isNone(credential.value.lockedUntil) && credential.value.hash === passwordHashOf("success"), "recordSuccess must reset failures and the lock and keep the hash");
+	})),
+	credentialCase("upsert replaces the hash and clears failures and the lock", Effect.gen(function* () {
+		const store = yield* PasswordCredentialStore;
+		const email = emailOf("credential-upsert-reset");
+		const subjectId = credentialConformanceSubject(email);
+		yield* store.upsert(subjectId, passwordHashOf("before"));
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.upsert(subjectId, passwordHashOf("after"));
+		const credential = yield* store.findByEmail(email);
+		yield* check(Option.isSome(credential) && credential.value.hash === passwordHashOf("after") && credential.value.failedAttempts === 0 && Option.isNone(credential.value.lockedUntil), "upsert must replace the hash and reset failures and the lock");
+	})),
+	credentialCase("an expired lock starts a fresh failure window", Effect.gen(function* () {
+		const store = yield* PasswordCredentialStore;
+		const email = emailOf("credential-lock-expiry");
+		const subjectId = credentialConformanceSubject(email);
+		yield* store.upsert(subjectId, passwordHashOf("lock-expiry"));
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		const locked = yield* store.findByEmail(email);
+		yield* check(Option.isSome(locked) && Option.isSome(locked.value.lockedUntil), "reaching the limit must lock the credential");
+		yield* TestClock.adjust(credentialLockOptions.lockDuration);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		const afterExpiry = yield* store.findByEmail(email);
+		yield* check(Option.isSome(afterExpiry) && afterExpiry.value.failedAttempts === 1 && Option.isNone(afterExpiry.value.lockedUntil), "a failure after the lock expires must reset the count to one and not immediately re-lock");
+	})),
+	credentialCase("unknown subjects are no-ops", Effect.gen(function* () {
+		const store = yield* PasswordCredentialStore;
+		const email = emailOf("credential-unknown");
+		const subjectId = credentialConformanceSubject(email);
+		yield* store.recordFailure(subjectId, credentialLockOptions);
+		yield* store.recordSuccess(subjectId);
+		const credential = yield* store.findByEmail(email);
+		yield* check(Option.isNone(credential), "failure and success accounting must ignore subjects without a credential");
+	}))
+];
+//#endregion
+export { credentialConformanceSubject, layerCredentialConformanceResolver, passwordCredentialStoreConformanceCases };
+
+//# sourceMappingURL=PasswordCredentialStore.mjs.map

package/dist/testing/conformance/PasswordCredentialStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordCredentialStore.mjs","names":[],"sources":["../../../src/testing/conformance/PasswordCredentialStore.ts"],"sourcesContent":["import { DateTime, Duration, Effect, Layer, Option, Schema } from \"effect\";\nimport { TestClock } from \"effect/testing\";\n\nimport { IdentityResolver } from \"../../IdentityResolver\";\nimport { PasswordCredentialStore } from \"../../PasswordCredentialStore\";\nimport { type Email, type SubjectId, PasswordHash } from \"../../Schema\";\nimport { check, decodeSubjectId, emailOf } from \"./support\";\n\n// Pure store-contract checks for `PasswordCredentialStore` adapters: hashes\n// are opaque strings to the store, so the suite fabricates them directly and\n// never needs a hasher. The adapter under test must resolve each conformance\n// email to `credentialConformanceSubject` of that email; adapters that\n// delegate email lookup to `IdentityResolver` (like\n// `PasswordCredentialStore.layerMemory`) can use\n// `layerCredentialConformanceResolver`. Run each case with `it.effect`.\n\nexport interface PasswordCredentialStoreConformanceCase {\n  readonly name: string;\n  readonly run: Effect.Effect<void, never, PasswordCredentialStore>;\n}\n\nconst decodePasswordHash = Schema.decodeSync(PasswordHash);\n\n/** Subject id the adapter under test must map a conformance email to. */\nexport const credentialConformanceSubject = (email: Email): SubjectId =>\n  decodeSubjectId(`subject:${email}`);\n\n/**\n * `IdentityResolver` implementing the credential-conformance email mapping,\n * for adapters that resolve emails through the resolver.\n */\nexport const layerCredentialConformanceResolver: Layer.Layer<IdentityResolver> = Layer.succeed(\n  IdentityResolver,\n)({\n  findByVerifiedEmail: (email) => Effect.succeed(Option.some(credentialConformanceSubject(email))),\n});\n\nconst passwordHashOf = (name: string) => decodePasswordHash(`password-hash:${name}`);\n\nconst credentialLockOptions = { attemptLimit: 3, lockDuration: Duration.minutes(15) };\n\nconst credentialCase = <CaseError>(\n  name: string,\n  run: Effect.Effect<void, CaseError, PasswordCredentialStore>,\n): PasswordCredentialStoreConformanceCase => ({ name, run: Effect.orDie(run) });\n\nexport const passwordCredentialStoreConformanceCases: ReadonlyArray<PasswordCredentialStoreConformanceCase> =\n  [\n    credentialCase(\n      \"upsert and find round-trip through subject and email\",\n      Effect.gen(function* () {\n        const store = yield* PasswordCredentialStore;\n        const email = emailOf(\"credential-roundtrip\");\n        const subjectId = credentialConformanceSubject(email);\n\n        yield* store.upsert(subjectId, passwordHashOf(\"roundtrip\"));\n        const bySubject = yield* store.findBySubject(subjectId);\n\n        yield* check(\n          Option.isSome(bySubject) && bySubject.value.hash === passwordHashOf(\"roundtrip\"),\n          \"findBySubject must return the upserted hash\",\n        );\n        const byEmail = yield* store.findByEmail(email);\n\n        yield* check(\n          Option.isSome(byEmail) && byEmail.value.subjectId === subjectId,\n          \"findByEmail must resolve to the same credential\",\n        );\n        yield* check(\n          Option.isSome(byEmail) &&\n            byEmail.value.failedAttempts === 0 &&\n            Option.isNone(byEmail.value.lockedUntil),\n          \"a fresh credential must be unlocked with zero failures\",\n        );\n      }),\n    ),\n\n    credentialCase(\n      \"failures count up and lock at the configured threshold\",\n      Effect.gen(function* () {\n        const store = yield* PasswordCredentialStore;\n        const email = emailOf(\"credential-lock\");\n        const subjectId = credentialConformanceSubject(email);\n\n        yield* store.upsert(subjectId, passwordHashOf(\"lock\"));\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        const beforeLock = yield* store.findByEmail(email);\n\n        yield* check(\n          Option.isSome(beforeLock) &&\n            beforeLock.value.failedAttempts === 2 &&\n            Option.isNone(beforeLock.value.lockedUntil),\n          \"failures below the limit must count without locking\",\n        );\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        const locked = yield* store.findByEmail(email);\n        const now = yield* DateTime.now;\n\n        yield* check(\n          Option.isSome(locked) &&\n            locked.value.failedAttempts === 3 &&\n            Option.isSome(locked.value.lockedUntil) &&\n            DateTime.toEpochMillis(locked.value.lockedUntil.value) > DateTime.toEpochMillis(now),\n          \"reaching the limit must set a lock in the future\",\n        );\n      }),\n    ),\n\n    credentialCase(\n      \"success clears failures and the lock without touching the hash\",\n      Effect.gen(function* () {\n        const store = yield* PasswordCredentialStore;\n        const email = emailOf(\"credential-success\");\n        const subjectId = credentialConformanceSubject(email);\n\n        yield* store.upsert(subjectId, passwordHashOf(\"success\"));\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordSuccess(subjectId);\n        const credential = yield* store.findByEmail(email);\n\n        yield* check(\n          Option.isSome(credential) &&\n            credential.value.failedAttempts === 0 &&\n            Option.isNone(credential.value.lockedUntil) &&\n            credential.value.hash === passwordHashOf(\"success\"),\n          \"recordSuccess must reset failures and the lock and keep the hash\",\n        );\n      }),\n    ),\n\n    credentialCase(\n      \"upsert replaces the hash and clears failures and the lock\",\n      Effect.gen(function* () {\n        const store = yield* PasswordCredentialStore;\n        const email = emailOf(\"credential-upsert-reset\");\n        const subjectId = credentialConformanceSubject(email);\n\n        yield* store.upsert(subjectId, passwordHashOf(\"before\"));\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.upsert(subjectId, passwordHashOf(\"after\"));\n        const credential = yield* store.findByEmail(email);\n\n        yield* check(\n          Option.isSome(credential) &&\n            credential.value.hash === passwordHashOf(\"after\") &&\n            credential.value.failedAttempts === 0 &&\n            Option.isNone(credential.value.lockedUntil),\n          \"upsert must replace the hash and reset failures and the lock\",\n        );\n      }),\n    ),\n\n    credentialCase(\n      \"an expired lock starts a fresh failure window\",\n      Effect.gen(function* () {\n        const store = yield* PasswordCredentialStore;\n        const email = emailOf(\"credential-lock-expiry\");\n        const subjectId = credentialConformanceSubject(email);\n\n        yield* store.upsert(subjectId, passwordHashOf(\"lock-expiry\"));\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        const locked = yield* store.findByEmail(email);\n\n        yield* check(\n          Option.isSome(locked) && Option.isSome(locked.value.lockedUntil),\n          \"reaching the limit must lock the credential\",\n        );\n        yield* TestClock.adjust(credentialLockOptions.lockDuration);\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        const afterExpiry = yield* store.findByEmail(email);\n\n        yield* check(\n          Option.isSome(afterExpiry) &&\n            afterExpiry.value.failedAttempts === 1 &&\n            Option.isNone(afterExpiry.value.lockedUntil),\n          \"a failure after the lock expires must reset the count to one and not immediately re-lock\",\n        );\n      }),\n    ),\n\n    credentialCase(\n      \"unknown subjects are no-ops\",\n      Effect.gen(function* () {\n        const store = yield* PasswordCredentialStore;\n        const email = emailOf(\"credential-unknown\");\n        const subjectId = credentialConformanceSubject(email);\n\n        yield* store.recordFailure(subjectId, credentialLockOptions);\n        yield* store.recordSuccess(subjectId);\n        const credential = yield* store.findByEmail(email);\n\n        yield* check(\n          Option.isNone(credential),\n          \"failure and success accounting must ignore subjects without a credential\",\n        );\n      }),\n    ),\n  ];\n"],"mappings":";;;;;;;AAqBA,MAAM,qBAAqB,OAAO,WAAW,YAAY;;AAGzD,MAAa,gCAAgC,UAC3C,gBAAgB,WAAW,OAAO;;;;;AAMpC,MAAa,qCAAoE,MAAM,QACrF,gBACF,CAAC,CAAC,EACA,sBAAsB,UAAU,OAAO,QAAQ,OAAO,KAAK,6BAA6B,KAAK,CAAC,CAAC,EACjG,CAAC;AAED,MAAM,kBAAkB,SAAiB,mBAAmB,iBAAiB,MAAM;AAEnF,MAAM,wBAAwB;CAAE,cAAc;CAAG,cAAc,SAAS,QAAQ,EAAE;AAAE;AAEpF,MAAM,kBACJ,MACA,SAC4C;CAAE;CAAM,KAAK,OAAO,MAAM,GAAG;AAAE;AAE7E,MAAa,0CACX;CACE,eACE,wDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,sBAAsB;EAC5C,MAAM,YAAY,6BAA6B,KAAK;EAEpD,OAAO,MAAM,OAAO,WAAW,eAAe,WAAW,CAAC;EAC1D,MAAM,YAAY,OAAO,MAAM,cAAc,SAAS;EAEtD,OAAO,MACL,OAAO,OAAO,SAAS,KAAK,UAAU,MAAM,SAAS,eAAe,WAAW,GAC/E,6CACF;EACA,MAAM,UAAU,OAAO,MAAM,YAAY,KAAK;EAE9C,OAAO,MACL,OAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,cAAc,WACtD,iDACF;EACA,OAAO,MACL,OAAO,OAAO,OAAO,KACnB,QAAQ,MAAM,mBAAmB,KACjC,OAAO,OAAO,QAAQ,MAAM,WAAW,GACzC,wDACF;CACF,CAAC,CACH;CAEA,eACE,0DACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,iBAAiB;EACvC,MAAM,YAAY,6BAA6B,KAAK;EAEpD,OAAO,MAAM,OAAO,WAAW,eAAe,MAAM,CAAC;EACrD,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,MAAM,aAAa,OAAO,MAAM,YAAY,KAAK;EAEjD,OAAO,MACL,OAAO,OAAO,UAAU,KACtB,WAAW,MAAM,mBAAmB,KACpC,OAAO,OAAO,WAAW,MAAM,WAAW,GAC5C,qDACF;EACA,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,MAAM,SAAS,OAAO,MAAM,YAAY,KAAK;EAC7C,MAAM,MAAM,OAAO,SAAS;EAE5B,OAAO,MACL,OAAO,OAAO,MAAM,KAClB,OAAO,MAAM,mBAAmB,KAChC,OAAO,OAAO,OAAO,MAAM,WAAW,KACtC,SAAS,cAAc,OAAO,MAAM,YAAY,KAAK,IAAI,SAAS,cAAc,GAAG,GACrF,kDACF;CACF,CAAC,CACH;CAEA,eACE,kEACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,oBAAoB;EAC1C,MAAM,YAAY,6BAA6B,KAAK;EAEpD,OAAO,MAAM,OAAO,WAAW,eAAe,SAAS,CAAC;EACxD,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,SAAS;EACpC,MAAM,aAAa,OAAO,MAAM,YAAY,KAAK;EAEjD,OAAO,MACL,OAAO,OAAO,UAAU,KACtB,WAAW,MAAM,mBAAmB,KACpC,OAAO,OAAO,WAAW,MAAM,WAAW,KAC1C,WAAW,MAAM,SAAS,eAAe,SAAS,GACpD,kEACF;CACF,CAAC,CACH;CAEA,eACE,6DACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,yBAAyB;EAC/C,MAAM,YAAY,6BAA6B,KAAK;EAEpD,OAAO,MAAM,OAAO,WAAW,eAAe,QAAQ,CAAC;EACvD,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,OAAO,WAAW,eAAe,OAAO,CAAC;EACtD,MAAM,aAAa,OAAO,MAAM,YAAY,KAAK;EAEjD,OAAO,MACL,OAAO,OAAO,UAAU,KACtB,WAAW,MAAM,SAAS,eAAe,OAAO,KAChD,WAAW,MAAM,mBAAmB,KACpC,OAAO,OAAO,WAAW,MAAM,WAAW,GAC5C,8DACF;CACF,CAAC,CACH;CAEA,eACE,iDACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,wBAAwB;EAC9C,MAAM,YAAY,6BAA6B,KAAK;EAEpD,OAAO,MAAM,OAAO,WAAW,eAAe,aAAa,CAAC;EAC5D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,MAAM,SAAS,OAAO,MAAM,YAAY,KAAK;EAE7C,OAAO,MACL,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,MAAM,WAAW,GAC/D,6CACF;EACA,OAAO,UAAU,OAAO,sBAAsB,YAAY;EAC1D,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,MAAM,cAAc,OAAO,MAAM,YAAY,KAAK;EAElD,OAAO,MACL,OAAO,OAAO,WAAW,KACvB,YAAY,MAAM,mBAAmB,KACrC,OAAO,OAAO,YAAY,MAAM,WAAW,GAC7C,0FACF;CACF,CAAC,CACH;CAEA,eACE,+BACA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,oBAAoB;EAC1C,MAAM,YAAY,6BAA6B,KAAK;EAEpD,OAAO,MAAM,cAAc,WAAW,qBAAqB;EAC3D,OAAO,MAAM,cAAc,SAAS;EACpC,MAAM,aAAa,OAAO,MAAM,YAAY,KAAK;EAEjD,OAAO,MACL,OAAO,OAAO,UAAU,GACxB,0EACF;CACF,CAAC,CACH;AACF"}

package/dist/testing/conformance/support.mjs

@@ -0,0 +1,17 @@
+import { Email, OtpDigest, SubjectId, TokenDigest } from "../../Schema.mjs";
+import { Effect, Schema } from "effect";
+//#region src/testing/conformance/support.ts
+const decodeEmail = Schema.decodeSync(Email);
+const decodeTokenDigest = Schema.decodeSync(TokenDigest);
+const decodeOtpDigest = Schema.decodeSync(OtpDigest);
+const decodeSubjectId = Schema.decodeSync(SubjectId);
+const emailOf = (name) => decodeEmail(`${name}@conformance.test`);
+const tokenDigestOf = (token) => decodeTokenDigest(`token-digest:${token}`);
+const otpDigestOf = (otp) => decodeOtpDigest(`otp-digest:${otp}`);
+const uuidOf = (index) => `00000000-0000-4000-8000-${String(index).padStart(12, "0")}`;
+const check = (condition, message) => condition ? Effect.void : Effect.die(/* @__PURE__ */ new Error(`Store conformance violation: ${message}`));
+const expectFailure = (effect, tag, message) => Effect.exit(effect).pipe(Effect.flatMap((exit) => check(exit._tag === "Failure" && exit.cause.reasons.some((reason) => reason._tag === "Fail" && reason.error._tag === tag), message)));
+//#endregion
+export { check, decodeSubjectId, emailOf, expectFailure, otpDigestOf, tokenDigestOf, uuidOf };
+
+//# sourceMappingURL=support.mjs.map

package/dist/testing/conformance/support.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.mjs","names":[],"sources":["../../../src/testing/conformance/support.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport { Email, OtpDigest, SubjectId, TokenDigest } from \"../../Schema\";\n\n// Shared fabrication and assertion helpers for the store conformance suites.\n// Digests and identifiers are opaque strings to every store, so the suites\n// fabricate them directly and never need a codec.\n\nconst decodeEmail = Schema.decodeSync(Email);\nconst decodeTokenDigest = Schema.decodeSync(TokenDigest);\nconst decodeOtpDigest = Schema.decodeSync(OtpDigest);\n\nexport const decodeSubjectId = Schema.decodeSync(SubjectId);\n\nexport const emailOf = (name: string) => decodeEmail(`${name}@conformance.test`);\nexport const tokenDigestOf = (token: string) => decodeTokenDigest(`token-digest:${token}`);\nexport const otpDigestOf = (otp: string) => decodeOtpDigest(`otp-digest:${otp}`);\n\nexport const uuidOf = (index: number) =>\n  `00000000-0000-4000-8000-${String(index).padStart(12, \"0\")}`;\n\nexport const check = (condition: boolean, message: string): Effect.Effect<void> =>\n  condition ? Effect.void : Effect.die(new Error(`Store conformance violation: ${message}`));\n\nexport const expectFailure = <A, E extends { readonly _tag: string }, R>(\n  effect: Effect.Effect<A, E, R>,\n  tag: E[\"_tag\"],\n  message: string,\n): Effect.Effect<void, never, R> =>\n  Effect.exit(effect).pipe(\n    Effect.flatMap((exit) =>\n      check(\n        exit._tag === \"Failure\" &&\n          exit.cause.reasons.some((reason) => reason._tag === \"Fail\" && reason.error._tag === tag),\n        message,\n      ),\n    ),\n  );\n"],"mappings":";;;AAQA,MAAM,cAAc,OAAO,WAAW,KAAK;AAC3C,MAAM,oBAAoB,OAAO,WAAW,WAAW;AACvD,MAAM,kBAAkB,OAAO,WAAW,SAAS;AAEnD,MAAa,kBAAkB,OAAO,WAAW,SAAS;AAE1D,MAAa,WAAW,SAAiB,YAAY,GAAG,KAAK,kBAAkB;AAC/E,MAAa,iBAAiB,UAAkB,kBAAkB,gBAAgB,OAAO;AACzF,MAAa,eAAe,QAAgB,gBAAgB,cAAc,KAAK;AAE/E,MAAa,UAAU,UACrB,2BAA2B,OAAO,KAAK,CAAC,CAAC,SAAS,IAAI,GAAG;AAE3D,MAAa,SAAS,WAAoB,YACxC,YAAY,OAAO,OAAO,OAAO,oBAAI,IAAI,MAAM,gCAAgC,SAAS,CAAC;AAE3F,MAAa,iBACX,QACA,KACA,YAEA,OAAO,KAAK,MAAM,CAAC,CAAC,KAClB,OAAO,SAAS,SACd,MACE,KAAK,SAAS,aACZ,KAAK,MAAM,QAAQ,MAAM,WAAW,OAAO,SAAS,UAAU,OAAO,MAAM,SAAS,GAAG,GACzF,OACF,CACF,CACF"}

package/dist/testing/crypto.d.mts

@@ -0,0 +1,11 @@
+import { Crypto, Layer } from "effect";
+//#region src/testing/crypto.d.ts
+/**
+ * Seeded, reproducible `Crypto.Crypto` for tests. The digest is deterministic
+ * and collision-poor but NOT cryptographic; never use this layer outside
+ * tests.
+ */
+declare const layerCryptoDeterministic: (seed?: number) => Layer.Layer<Crypto.Crypto>;
+//#endregion
+export { layerCryptoDeterministic };
+//# sourceMappingURL=crypto.d.mts.map