@yielded/auth 0.1.0-beta.1

package/dist/PasskeyPassword.mjs

@@ -0,0 +1,174 @@
+import { HookDenied } from "./hooks/models.mjs";
+import { makeOperation, operationGroup } from "./operations/operation.mjs";
+import { SessionInvalidationWindow } from "./sessions/invalidation.mjs";
+import { AuthenticationFlowId } from "./sessions/models.mjs";
+import { NewPasswordRejected, PasswordCheckUnavailable } from "./password/errors.mjs";
+import { PasswordActionRequired, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./password/methods/errors.mjs";
+import { PasswordPreparedCredential } from "./password/methods/preparedModels.mjs";
+import { PasskeyFailure } from "./passkey/errors.mjs";
+import { PasskeyAuthenticationStarted, PasskeyBegin, PasskeyComplete, PasskeyTarget } from "./passkey/models.mjs";
+import { snapshotPasskey } from "./passkey/snapshot.mjs";
+import { passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit } from "./passkey/actions.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/PasskeyPassword.ts
+const PasswordFailure = Schema.Union([
+	PasswordRejected,
+	PasswordUnavailable,
+	PasswordActionRequired,
+	PasswordMethodUnsupported,
+	NewPasswordRejected,
+	PasswordCheckUnavailable,
+	HookDenied
+]);
+const Failure = Schema.Union([PasskeyFailure, PasswordFailure]);
+/** Separate assertion payloads; no change to ordinary password actionProof. Each
+* target capability is authenticated before factor claim; final target plans keep
+* their original proof/CAS/policy owner. Factor consumption is never refunded. */
+const makePasskeyPasswordActions = (moduleId, options) => {
+	const BeginInput = Schema.Struct({
+		...PasskeyBegin.fields,
+		intentCredential: PasswordPreparedCredential
+	});
+	const CompleteInput = Schema.Struct({
+		...PasskeyComplete.fields,
+		intentCredential: PasswordPreparedCredential
+	});
+	const continuation = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096)));
+	const ResetBeginInput = Schema.Struct({
+		...BeginInput.fields,
+		continuationCredential: continuation
+	});
+	const ResetCompleteInput = Schema.Struct({
+		...CompleteInput.fields,
+		continuationCredential: continuation
+	});
+	const Result = Schema.Struct({ invalidation: SessionInvalidationWindow });
+	const target = (context) => snapshotPasskey(PasskeyTarget, {
+		moduleId: context.challenge.moduleId,
+		kind: `password/${context.action}`,
+		commandId: context.challenge.commandId,
+		flowId: AuthenticationFlowId.make(context.challenge.commandId),
+		bindingDigest: context.challenge.bindingDigest,
+		revision: context.challenge.revision,
+		requirement: context.capturedRequirement,
+		expiresAtMillis: context.expiresAtMillis
+	});
+	const PasswordActions = Context.Service(`effect-auth/PasskeyPasswordActions/${moduleId.length}:${moduleId}`);
+	const ResetPasswordActions = Context.Service(`effect-auth/PasskeyResetPasswordActions/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(PasswordActions, Effect.gen(function* () {
+		const actions = yield* options.passkeys.PasskeyActionAssertions, prepared = yield* options.prepared.PasswordPrepared;
+		return PasswordActions.of({
+			begin: Effect.fn("PasskeyPasswordActions.begin")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(BeginInput), input);
+				yield* passkeyNoAmbient();
+				const context = yield* prepared.context(invocation, input.intentCredential);
+				if (context.action === "reset-password") return yield* PasswordRejected.make({});
+				return yield* actions.begin(input, yield* target(context));
+			}, passkeyUnexpected),
+			complete: Effect.fn("PasskeyPasswordActions.complete")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);
+				yield* passkeyNoAmbient();
+				const context = yield* prepared.context(invocation, input.intentCredential);
+				if (context.action === "reset-password") return yield* PasswordRejected.make({});
+				const factor = yield* actions.complete(input, yield* target(context));
+				const plan = yield* prepared.planCompleteAuthorized(invocation, { intentCredential: input.intentCredential }, {
+					evidence: factor.evidence,
+					requirement: context.capturedRequirement
+				});
+				const result = yield* readPasskeyCommit(yield* plan.commit);
+				if ("_tag" in result.value) return yield* PasswordRejected.make({});
+				return {
+					value: result.value,
+					credentialCommands: [...factor.credentialCommands, ...result.credentialCommands]
+				};
+			}, passkeyUnexpected)
+		});
+	}));
+	const resetLayer = Layer.effect(ResetPasswordActions, Effect.gen(function* () {
+		const actions = yield* options.passkeys.PasskeyActionAssertions, prepared = yield* options.prepared.PasswordPrepared, services = yield* Effect.context();
+		return ResetPasswordActions.of({
+			begin: Effect.fn("PasskeyResetPasswordActions.begin")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(ResetBeginInput), input);
+				yield* passkeyNoAmbient();
+				const context = yield* prepared.resetContext(invocation, input).pipe(Effect.provide(services));
+				return yield* actions.begin(input, yield* target(context));
+			}, passkeyUnexpected),
+			complete: Effect.fn("PasskeyResetPasswordActions.complete")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(ResetCompleteInput), input);
+				yield* passkeyNoAmbient();
+				const context = yield* prepared.resetContext(invocation, input).pipe(Effect.provide(services));
+				const factor = yield* actions.complete(input, yield* target(context));
+				const plan = yield* prepared.planResetCompleteAuthorized(invocation, input, {
+					evidence: factor.evidence,
+					requirement: context.capturedRequirement
+				}).pipe(Effect.provide(services));
+				const result = yield* readPasskeyCommit(yield* plan.commit);
+				if ("_tag" in result.value) return yield* PasswordRejected.make({});
+				return {
+					value: result.value,
+					credentialCommands: [...factor.credentialCommands, ...result.credentialCommands]
+				};
+			}, passkeyUnexpected)
+		});
+	}));
+	const Begin = makeOperation(`${moduleId}/passkey/password/begin`, {
+		payload: BeginInput,
+		success: PasskeyAuthenticationStarted,
+		error: Failure,
+		exposure: "public",
+		access: "authenticated",
+		replay: "single-use",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/passkey/password/complete`, {
+		payload: CompleteInput,
+		success: Result,
+		error: Failure,
+		exposure: "public",
+		access: "authenticated",
+		replay: "single-use",
+		credentials: true
+	});
+	const ResetBegin = makeOperation(`${moduleId}/passkey/password/reset/begin`, {
+		payload: ResetBeginInput,
+		success: PasskeyAuthenticationStarted,
+		error: Failure,
+		exposure: "public",
+		access: "any",
+		replay: "single-use",
+		credentials: true
+	});
+	const ResetComplete = makeOperation(`${moduleId}/passkey/password/reset/complete`, {
+		payload: ResetCompleteInput,
+		success: Result,
+		error: Failure,
+		exposure: "public",
+		access: "any",
+		replay: "single-use",
+		credentials: true
+	});
+	return Object.freeze({
+		PasswordActions,
+		layer,
+		operations: Object.freeze({
+			Begin,
+			Complete
+		}),
+		group: operationGroup(Begin, Complete),
+		handlersLayer: Layer.mergeAll(Begin.credentialHandlerLayer((input, invocation) => Effect.flatMap(PasswordActions, (service) => service.begin(invocation, input))), Complete.credentialHandlerLayer((input, invocation) => Effect.flatMap(PasswordActions, (service) => service.complete(invocation, input)))),
+		reset: Object.freeze({
+			PasswordActions: ResetPasswordActions,
+			layer: resetLayer,
+			operations: Object.freeze({
+				Begin: ResetBegin,
+				Complete: ResetComplete
+			}),
+			group: operationGroup(ResetBegin, ResetComplete),
+			handlersLayer: Layer.mergeAll(ResetBegin.credentialHandlerLayer((input, invocation) => Effect.flatMap(ResetPasswordActions, (service) => service.begin(invocation, input))), ResetComplete.credentialHandlerLayer((input, invocation) => Effect.flatMap(ResetPasswordActions, (service) => service.complete(invocation, input))))
+		})
+	});
+};
+//#endregion
+export { makePasskeyPasswordActions };
+
+//# sourceMappingURL=PasskeyPassword.mjs.map

package/dist/PasskeyPassword.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasskeyPassword.mjs","names":[],"sources":["../src/PasskeyPassword.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema, type Redacted } from \"effect\";\n\nimport { HookDenied } from \"./hooks/models\";\nimport type { AuthInvocation } from \"./operations/context\";\nimport type { AuthOperationResult } from \"./operations/credentials\";\nimport { makeOperation, operationGroup } from \"./operations/operation\";\nimport type { makePasskeyActions } from \"./passkey/actions\";\nimport { passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit } from \"./passkey/actions\";\nimport { PasskeyFailure } from \"./passkey/errors\";\nimport {\n  PasskeyAuthenticationStarted,\n  PasskeyBegin,\n  PasskeyComplete,\n  PasskeyTarget,\n} from \"./passkey/models\";\nimport { snapshotPasskey } from \"./passkey/snapshot\";\nimport { NewPasswordRejected, PasswordCheckUnavailable } from \"./password/errors\";\nimport {\n  PasswordActionRequired,\n  PasswordMethodUnsupported,\n  PasswordRejected,\n  PasswordUnavailable,\n} from \"./password/methods/errors\";\nimport type {\n  PasswordPreparedAuthorization,\n  PasswordPreparedCompletionPlan,\n} from \"./password/methods/prepared\";\nimport {\n  PasswordPreparedCredential,\n  type PasswordPreparedContext,\n} from \"./password/methods/preparedModels\";\nimport { SessionInvalidationWindow } from \"./sessions/invalidation\";\nimport { AuthenticationFlowId } from \"./sessions/models\";\n\nconst PasswordFailure = Schema.Union([\n  PasswordRejected,\n  PasswordUnavailable,\n  PasswordActionRequired,\n  PasswordMethodUnsupported,\n  NewPasswordRejected,\n  PasswordCheckUnavailable,\n  HookDenied,\n]);\n\ntype PasswordFailure = typeof PasswordFailure.Type;\nconst Failure = Schema.Union([PasskeyFailure, PasswordFailure]);\n\ntype Failure = typeof Failure.Type;\ninterface Prepared<ResetId, CommitId> {\n  readonly context: (\n    invocation: AuthInvocation,\n    credential: Redacted.Redacted<string>,\n  ) => Effect.Effect<PasswordPreparedContext, PasswordFailure>;\n  readonly resetContext: (\n    invocation: AuthInvocation,\n    input: {\n      readonly intentCredential: Redacted.Redacted<string>;\n      readonly continuationCredential: Redacted.Redacted<string>;\n    },\n  ) => Effect.Effect<PasswordPreparedContext, PasswordFailure, ResetId>;\n  readonly planCompleteAuthorized: (\n    invocation: AuthInvocation,\n    input: { readonly intentCredential: Redacted.Redacted<string> },\n    authorization: PasswordPreparedAuthorization,\n  ) => Effect.Effect<PasswordPreparedCompletionPlan<CommitId>, PasswordFailure>;\n  readonly planResetCompleteAuthorized: (\n    invocation: AuthInvocation,\n    input: {\n      readonly intentCredential: Redacted.Redacted<string>;\n      readonly continuationCredential: Redacted.Redacted<string>;\n    },\n    authorization: PasswordPreparedAuthorization,\n  ) => Effect.Effect<PasswordPreparedCompletionPlan<CommitId>, PasswordFailure, ResetId>;\n}\n\n/** Separate assertion payloads; no change to ordinary password actionProof. Each\n * target capability is authenticated before factor claim; final target plans keep\n * their original proof/CAS/policy owner. Factor consumption is never refunded. */\nexport const makePasskeyPasswordActions = <\n  const Id extends string,\n  const PasskeyId extends string,\n  PreparedId,\n  ResetId,\n  CommitId,\n>(\n  moduleId: Id,\n  options: {\n    readonly passkeys: ReturnType<typeof makePasskeyActions<PasskeyId>>;\n    readonly prepared: {\n      readonly PasswordPrepared: Context.Key<PreparedId, Prepared<ResetId, CommitId>>;\n    };\n  },\n) => {\n  const BeginInput = Schema.Struct({\n    ...PasskeyBegin.fields,\n    intentCredential: PasswordPreparedCredential,\n  });\n\n  const CompleteInput = Schema.Struct({\n    ...PasskeyComplete.fields,\n    intentCredential: PasswordPreparedCredential,\n  });\n\n  const continuation = Schema.RedactedFromValue(\n    Schema.NonEmptyString.check(Schema.isMaxLength(4096)),\n  );\n\n  const ResetBeginInput = Schema.Struct({\n    ...BeginInput.fields,\n    continuationCredential: continuation,\n  });\n\n  const ResetCompleteInput = Schema.Struct({\n    ...CompleteInput.fields,\n    continuationCredential: continuation,\n  });\n\n  const Result = Schema.Struct({ invalidation: SessionInvalidationWindow });\n\n  const target = (context: PasswordPreparedContext) =>\n    snapshotPasskey(PasskeyTarget, {\n      moduleId: context.challenge.moduleId,\n      kind: `password/${context.action}`,\n      commandId: context.challenge.commandId,\n      flowId: AuthenticationFlowId.make(context.challenge.commandId),\n      bindingDigest: context.challenge.bindingDigest,\n      revision: context.challenge.revision,\n      requirement: context.capturedRequirement,\n      expiresAtMillis: context.expiresAtMillis,\n    });\n\n  const PasswordActions = Context.Service<\n    { readonly moduleId: Id; readonly kind: \"passkey-password-actions\" },\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof BeginInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof PasskeyAuthenticationStarted.Type>, Failure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: typeof CompleteInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof Result.Type>, Failure, CommitId>;\n    }\n  >(`effect-auth/PasskeyPasswordActions/${moduleId.length}:${moduleId}`);\n\n  const ResetPasswordActions = Context.Service<\n    { readonly moduleId: Id; readonly kind: \"passkey-reset-password-actions\" },\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof ResetBeginInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof PasskeyAuthenticationStarted.Type>, Failure>;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: typeof ResetCompleteInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof Result.Type>, Failure, CommitId>;\n    }\n  >(`effect-auth/PasskeyResetPasswordActions/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(\n    PasswordActions,\n    Effect.gen(function* () {\n      const actions = yield* options.passkeys.PasskeyActionAssertions,\n        prepared = yield* options.prepared.PasswordPrepared;\n\n      return PasswordActions.of({\n        begin: Effect.fn(\"PasskeyPasswordActions.begin\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(BeginInput), input);\n          yield* passkeyNoAmbient();\n          const context = yield* prepared.context(invocation, input.intentCredential);\n\n          if (context.action === \"reset-password\") return yield* PasswordRejected.make({});\n\n          return yield* actions.begin(input, yield* target(context));\n        }, passkeyUnexpected),\n        complete: Effect.fn(\"PasskeyPasswordActions.complete\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);\n          yield* passkeyNoAmbient();\n          const context = yield* prepared.context(invocation, input.intentCredential);\n\n          if (context.action === \"reset-password\") return yield* PasswordRejected.make({});\n          const factor = yield* actions.complete(input, yield* target(context));\n\n          const plan = yield* prepared.planCompleteAuthorized(\n            invocation,\n            { intentCredential: input.intentCredential },\n            { evidence: factor.evidence, requirement: context.capturedRequirement },\n          );\n\n          const result = yield* readPasskeyCommit(yield* plan.commit);\n\n          if (\"_tag\" in result.value) return yield* PasswordRejected.make({});\n\n          return {\n            value: result.value,\n            credentialCommands: [...factor.credentialCommands, ...result.credentialCommands],\n          };\n        }, passkeyUnexpected),\n      });\n    }),\n  );\n\n  const resetLayer = Layer.effect(\n    ResetPasswordActions,\n    Effect.gen(function* () {\n      const actions = yield* options.passkeys.PasskeyActionAssertions,\n        prepared = yield* options.prepared.PasswordPrepared,\n        services = yield* Effect.context<ResetId>();\n\n      return ResetPasswordActions.of({\n        begin: Effect.fn(\"PasskeyResetPasswordActions.begin\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(ResetBeginInput), input);\n          yield* passkeyNoAmbient();\n\n          const context = yield* prepared\n            .resetContext(invocation, input)\n            .pipe(Effect.provide(services));\n\n          return yield* actions.begin(input, yield* target(context));\n        }, passkeyUnexpected),\n        complete: Effect.fn(\"PasskeyResetPasswordActions.complete\")(function* (invocation, input) {\n          input = yield* snapshotPasskey(Schema.toType(ResetCompleteInput), input);\n          yield* passkeyNoAmbient();\n\n          const context = yield* prepared\n            .resetContext(invocation, input)\n            .pipe(Effect.provide(services));\n\n          const factor = yield* actions.complete(input, yield* target(context));\n\n          const plan = yield* prepared\n            .planResetCompleteAuthorized(invocation, input, {\n              evidence: factor.evidence,\n              requirement: context.capturedRequirement,\n            })\n            .pipe(Effect.provide(services));\n\n          const result = yield* readPasskeyCommit(yield* plan.commit);\n\n          if (\"_tag\" in result.value) return yield* PasswordRejected.make({});\n\n          return {\n            value: result.value,\n            credentialCommands: [...factor.credentialCommands, ...result.credentialCommands],\n          };\n        }, passkeyUnexpected),\n      });\n    }),\n  );\n\n  const Begin = makeOperation(`${moduleId}/passkey/password/begin`, {\n    payload: BeginInput,\n    success: PasskeyAuthenticationStarted,\n    error: Failure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/passkey/password/complete`, {\n    payload: CompleteInput,\n    success: Result,\n    error: Failure,\n    exposure: \"public\",\n    access: \"authenticated\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const ResetBegin = makeOperation(`${moduleId}/passkey/password/reset/begin`, {\n    payload: ResetBeginInput,\n    success: PasskeyAuthenticationStarted,\n    error: Failure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const ResetComplete = makeOperation(`${moduleId}/passkey/password/reset/complete`, {\n    payload: ResetCompleteInput,\n    success: Result,\n    error: Failure,\n    exposure: \"public\",\n    access: \"any\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  return Object.freeze({\n    PasswordActions,\n    layer,\n    operations: Object.freeze({ Begin, Complete }),\n    group: operationGroup(Begin, Complete),\n    handlersLayer: Layer.mergeAll(\n      Begin.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(PasswordActions, (service) => service.begin(invocation, input)),\n      ),\n      Complete.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(PasswordActions, (service) => service.complete(invocation, input)),\n      ),\n    ),\n    reset: Object.freeze({\n      PasswordActions: ResetPasswordActions,\n      layer: resetLayer,\n      operations: Object.freeze({ Begin: ResetBegin, Complete: ResetComplete }),\n      group: operationGroup(ResetBegin, ResetComplete),\n      handlersLayer: Layer.mergeAll(\n        ResetBegin.credentialHandlerLayer((input, invocation) =>\n          Effect.flatMap(ResetPasswordActions, (service) => service.begin(invocation, input)),\n        ),\n        ResetComplete.credentialHandlerLayer((input, invocation) =>\n          Effect.flatMap(ResetPasswordActions, (service) => service.complete(invocation, input)),\n        ),\n      ),\n    }),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;AAkCA,MAAM,kBAAkB,OAAO,MAAM;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAM,UAAU,OAAO,MAAM,CAAC,gBAAgB,eAAe,CAAC;;;;AAiC9D,MAAa,8BAOX,UACA,YAMG;CACH,MAAM,aAAa,OAAO,OAAO;EAC/B,GAAG,aAAa;EAChB,kBAAkB;CACpB,CAAC;CAED,MAAM,gBAAgB,OAAO,OAAO;EAClC,GAAG,gBAAgB;EACnB,kBAAkB;CACpB,CAAC;CAED,MAAM,eAAe,OAAO,kBAC1B,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CACtD;CAEA,MAAM,kBAAkB,OAAO,OAAO;EACpC,GAAG,WAAW;EACd,wBAAwB;CAC1B,CAAC;CAED,MAAM,qBAAqB,OAAO,OAAO;EACvC,GAAG,cAAc;EACjB,wBAAwB;CAC1B,CAAC;CAED,MAAM,SAAS,OAAO,OAAO,EAAE,cAAc,0BAA0B,CAAC;CAExE,MAAM,UAAU,YACd,gBAAgB,eAAe;EAC7B,UAAU,QAAQ,UAAU;EAC5B,MAAM,YAAY,QAAQ;EAC1B,WAAW,QAAQ,UAAU;EAC7B,QAAQ,qBAAqB,KAAK,QAAQ,UAAU,SAAS;EAC7D,eAAe,QAAQ,UAAU;EACjC,UAAU,QAAQ,UAAU;EAC5B,aAAa,QAAQ;EACrB,iBAAiB,QAAQ;CAC3B,CAAC;CAEH,MAAM,kBAAkB,QAAQ,QAY9B,sCAAsC,SAAS,OAAO,GAAG,UAAU;CAErE,MAAM,uBAAuB,QAAQ,QAYnC,2CAA2C,SAAS,OAAO,GAAG,UAAU;CAE1E,MAAM,QAAQ,MAAM,OAClB,iBACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,yBACtC,WAAW,OAAO,QAAQ,SAAS;EAErC,OAAO,gBAAgB,GAAG;GACxB,OAAO,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAAW,YAAY,OAAO;IAC7E,QAAQ,OAAO,gBAAgB,OAAO,OAAO,UAAU,GAAG,KAAK;IAC/D,OAAO,iBAAiB;IACxB,MAAM,UAAU,OAAO,SAAS,QAAQ,YAAY,MAAM,gBAAgB;IAE1E,IAAI,QAAQ,WAAW,kBAAkB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAE/E,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC;GAC3D,GAAG,iBAAiB;GACpB,UAAU,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAAW,YAAY,OAAO;IACnF,QAAQ,OAAO,gBAAgB,OAAO,OAAO,aAAa,GAAG,KAAK;IAClE,OAAO,iBAAiB;IACxB,MAAM,UAAU,OAAO,SAAS,QAAQ,YAAY,MAAM,gBAAgB;IAE1E,IAAI,QAAQ,WAAW,kBAAkB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC/E,MAAM,SAAS,OAAO,QAAQ,SAAS,OAAO,OAAO,OAAO,OAAO,CAAC;IAEpE,MAAM,OAAO,OAAO,SAAS,uBAC3B,YACA,EAAE,kBAAkB,MAAM,iBAAiB,GAC3C;KAAE,UAAU,OAAO;KAAU,aAAa,QAAQ;IAAoB,CACxE;IAEA,MAAM,SAAS,OAAO,kBAAkB,OAAO,KAAK,MAAM;IAE1D,IAAI,UAAU,OAAO,OAAO,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAElE,OAAO;KACL,OAAO,OAAO;KACd,oBAAoB,CAAC,GAAG,OAAO,oBAAoB,GAAG,OAAO,kBAAkB;IACjF;GACF,GAAG,iBAAiB;EACtB,CAAC;CACH,CAAC,CACH;CAEA,MAAM,aAAa,MAAM,OACvB,sBACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,QAAQ,SAAS,yBACtC,WAAW,OAAO,QAAQ,SAAS,kBACnC,WAAW,OAAO,OAAO,QAAiB;EAE5C,OAAO,qBAAqB,GAAG;GAC7B,OAAO,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,YAAY,OAAO;IAClF,QAAQ,OAAO,gBAAgB,OAAO,OAAO,eAAe,GAAG,KAAK;IACpE,OAAO,iBAAiB;IAExB,MAAM,UAAU,OAAO,SACpB,aAAa,YAAY,KAAK,CAAC,CAC/B,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAEhC,OAAO,OAAO,QAAQ,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC;GAC3D,GAAG,iBAAiB;GACpB,UAAU,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAAW,YAAY,OAAO;IACxF,QAAQ,OAAO,gBAAgB,OAAO,OAAO,kBAAkB,GAAG,KAAK;IACvE,OAAO,iBAAiB;IAExB,MAAM,UAAU,OAAO,SACpB,aAAa,YAAY,KAAK,CAAC,CAC/B,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAEhC,MAAM,SAAS,OAAO,QAAQ,SAAS,OAAO,OAAO,OAAO,OAAO,CAAC;IAEpE,MAAM,OAAO,OAAO,SACjB,4BAA4B,YAAY,OAAO;KAC9C,UAAU,OAAO;KACjB,aAAa,QAAQ;IACvB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,QAAQ,CAAC;IAEhC,MAAM,SAAS,OAAO,kBAAkB,OAAO,KAAK,MAAM;IAE1D,IAAI,UAAU,OAAO,OAAO,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAElE,OAAO;KACL,OAAO,OAAO;KACd,oBAAoB,CAAC,GAAG,OAAO,oBAAoB,GAAG,OAAO,kBAAkB;IACjF;GACF,GAAG,iBAAiB;EACtB,CAAC;CACH,CAAC,CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,0BAA0B;EAChE,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,6BAA6B;EACtE,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,aAAa,cAAc,GAAG,SAAS,gCAAgC;EAC3E,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,cAAc,GAAG,SAAS,mCAAmC;EACjF,SAAS;EACT,SAAS;EACT,OAAO;EACP,UAAU;EACV,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,OAAO,OAAO,OAAO;EACnB;EACA;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;EAAS,CAAC;EAC7C,OAAO,eAAe,OAAO,QAAQ;EACrC,eAAe,MAAM,SACnB,MAAM,wBAAwB,OAAO,eACnC,OAAO,QAAQ,kBAAkB,YAAY,QAAQ,MAAM,YAAY,KAAK,CAAC,CAC/E,GACA,SAAS,wBAAwB,OAAO,eACtC,OAAO,QAAQ,kBAAkB,YAAY,QAAQ,SAAS,YAAY,KAAK,CAAC,CAClF,CACF;EACA,OAAO,OAAO,OAAO;GACnB,iBAAiB;GACjB,OAAO;GACP,YAAY,OAAO,OAAO;IAAE,OAAO;IAAY,UAAU;GAAc,CAAC;GACxE,OAAO,eAAe,YAAY,aAAa;GAC/C,eAAe,MAAM,SACnB,WAAW,wBAAwB,OAAO,eACxC,OAAO,QAAQ,uBAAuB,YAAY,QAAQ,MAAM,YAAY,KAAK,CAAC,CACpF,GACA,cAAc,wBAAwB,OAAO,eAC3C,OAAO,QAAQ,uBAAuB,YAAY,QAAQ,SAAS,YAAY,KAAK,CAAC,CACvF,CACF;EACF,CAAC;CACH,CAAC;AACH"}

package/dist/PasskeySimpleWebAuthn.d.mts

@@ -0,0 +1,3 @@
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./passkey/simplewebauthn/models.mjs";
+import { layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol } from "./passkey/simplewebauthn/protocol.mjs";
+export { SimpleWebAuthnPasskeyProtocolOptions, layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol };

package/dist/PasskeySimpleWebAuthn.mjs

@@ -0,0 +1,3 @@
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./passkey/simplewebauthn/models.mjs";
+import { layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol } from "./passkey/simplewebauthn/protocol.mjs";
+export { SimpleWebAuthnPasskeyProtocolOptions, layerSimpleWebAuthnPasskeyProtocol, makeSimpleWebAuthnPasskeyProtocol };

package/dist/Password.d.mts

@@ -0,0 +1,19 @@
+import { NewPasswordRejected, PasswordCheckUnavailable, PasswordConfigurationError, PasswordHashingUnavailable, PasswordInputInvalid, PasswordKdfBusy, PasswordVerifierInvalid } from "./password/errors.mjs";
+import { PasswordActionRequired, PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./password/methods/errors.mjs";
+import { PasswordAction, PasswordActionAuthorization, PasswordActionChallenge, PasswordAttemptAdmission, PasswordAttemptDecision, PasswordAttemptId, PasswordCommandId, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordReplacement } from "./password/methods/models.mjs";
+import { CompromisedPasswords, PasswordScreening, PasswordScreeningContext } from "./password/CompromisedPasswords.mjs";
+import { PasswordNormalization, PasswordPolicy, defaultPasswordPolicy, validatePasswordPolicy } from "./password/policy.mjs";
+import { CheckedNewPassword, NewPasswordCheck } from "./password/NewPasswordCheck.mjs";
+import { PasswordHashingConfig, defaultPasswordHashingConfig, validatePasswordHashingConfig } from "./password/configuration.mjs";
+import { EncodedPasswordHash, PasswordVerification } from "./password/models.mjs";
+import { PasswordKdfAdmission } from "./password/PasswordKdfAdmission.mjs";
+import { PasswordHashing } from "./password/PasswordHashing.mjs";
+import { PasswordActionEvidence } from "./password/methods/PasswordActionEvidence.mjs";
+import { PasswordAttemptPolicy, PasswordMethodPolicy, defaultPasswordMethodPolicy, validatePasswordMethodPolicy } from "./password/methods/policy.mjs";
+import { PasswordMutationInput, PasswordPersistence, PreparePasswordCommit } from "./password/methods/PasswordPersistence.mjs";
+import { PasswordPreparedConfiguration, PasswordPreparedContext, PasswordPreparedCredential, PasswordPreparedIntentId, PasswordPreparedReady, PasswordPreparedReadyJson, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordPreparedResult, PasswordPreparedVersion, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation, validatePasswordPreparedConfiguration } from "./password/methods/preparedModels.mjs";
+import { PasswordPreparedMutation, PasswordPreparedPersistence, PasswordPreparedReserveDecision } from "./password/methods/PasswordPreparedPersistence.mjs";
+import { PasswordPreparedAuthorization, PasswordPreparedCompletionPlan } from "./password/methods/prepared.mjs";
+import { PasswordRegistrationDecision, makePasswordMethod } from "./password/methods/module.mjs";
+import { PasswordManagementOptions, PasswordOptions, make } from "./password/methods/definition.mjs";
+export { type CheckedNewPassword, CompromisedPasswords, EncodedPasswordHash, NewPasswordCheck, NewPasswordRejected, PasswordAction, type PasswordActionAuthorization, PasswordActionChallenge, PasswordActionEvidence, PasswordActionRequired, type PasswordAttemptAdmission, type PasswordAttemptDecision, PasswordAttemptId, PasswordAttemptPolicy, PasswordCheckUnavailable, PasswordCommandId, PasswordConfigurationError, PasswordCredentialSnapshot, PasswordHashing, PasswordHashingConfig, PasswordHashingUnavailable, PasswordInputInvalid, PasswordKdfAdmission, PasswordKdfBusy, type PasswordManagementOptions, PasswordMethodConfigurationError, PasswordMethodPolicy, PasswordMethodUnsupported, type PasswordMutationDecision, type PasswordMutationInput, PasswordNormalization, type PasswordOptions, PasswordPersistence, PasswordPolicy, type PasswordPreparedAuthorization, type PasswordPreparedCompletionPlan, PasswordPreparedConfiguration, type PasswordPreparedContext, PasswordPreparedCredential, PasswordPreparedIntentId, type PasswordPreparedMutation, type PasswordPreparedPersistence, PasswordPreparedReady, PasswordPreparedReadyJson, PasswordPreparedRequirement, PasswordPreparedReservation, type PasswordPreparedReserveDecision, PasswordPreparedReset, PasswordPreparedResult, PasswordPreparedVersion, type PasswordRegistrationDecision, PasswordRejected, PasswordReplacement, PasswordScreening, PasswordScreeningContext, PasswordUnavailable, PasswordVerification, PasswordVerifierInvalid, type PreparePasswordCommit, decodePasswordPreparedReady, defaultPasswordHashingConfig, defaultPasswordMethodPolicy, defaultPasswordPolicy, encodePasswordPreparedReady, make, makePasswordMethod as makeModule, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation, validatePasswordHashingConfig, validatePasswordMethodPolicy, validatePasswordPolicy, validatePasswordPreparedConfiguration };

package/dist/Password.mjs

@@ -0,0 +1,17 @@
+import { NewPasswordRejected, PasswordCheckUnavailable, PasswordConfigurationError, PasswordHashingUnavailable, PasswordInputInvalid, PasswordKdfBusy, PasswordVerifierInvalid } from "./password/errors.mjs";
+import { PasswordActionRequired, PasswordMethodConfigurationError, PasswordMethodUnsupported, PasswordRejected, PasswordUnavailable } from "./password/methods/errors.mjs";
+import { PasswordPersistence } from "./password/methods/PasswordPersistence.mjs";
+import { EncodedPasswordHash, PasswordVerification } from "./password/models.mjs";
+import { PasswordNormalization, PasswordPolicy, defaultPasswordPolicy, validatePasswordPolicy } from "./password/policy.mjs";
+import { PasswordAction, PasswordActionChallenge, PasswordAttemptId, PasswordCommandId, PasswordCredentialSnapshot, PasswordReplacement } from "./password/methods/models.mjs";
+import { PasswordAttemptPolicy, PasswordMethodPolicy, defaultPasswordMethodPolicy, validatePasswordMethodPolicy } from "./password/methods/policy.mjs";
+import { PasswordPreparedConfiguration, PasswordPreparedCredential, PasswordPreparedIntentId, PasswordPreparedReady, PasswordPreparedReadyJson, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordPreparedResult, PasswordPreparedVersion, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation, validatePasswordPreparedConfiguration } from "./password/methods/preparedModels.mjs";
+import { CompromisedPasswords, PasswordScreening, PasswordScreeningContext } from "./password/CompromisedPasswords.mjs";
+import { NewPasswordCheck } from "./password/NewPasswordCheck.mjs";
+import { PasswordActionEvidence } from "./password/methods/PasswordActionEvidence.mjs";
+import { PasswordHashingConfig, defaultPasswordHashingConfig, validatePasswordHashingConfig } from "./password/configuration.mjs";
+import { PasswordKdfAdmission } from "./password/PasswordKdfAdmission.mjs";
+import { PasswordHashing } from "./password/PasswordHashing.mjs";
+import { makePasswordMethod } from "./password/methods/module.mjs";
+import { make } from "./password/methods/definition.mjs";
+export { CompromisedPasswords, EncodedPasswordHash, NewPasswordCheck, NewPasswordRejected, PasswordAction, PasswordActionChallenge, PasswordActionEvidence, PasswordActionRequired, PasswordAttemptId, PasswordAttemptPolicy, PasswordCheckUnavailable, PasswordCommandId, PasswordConfigurationError, PasswordCredentialSnapshot, PasswordHashing, PasswordHashingConfig, PasswordHashingUnavailable, PasswordInputInvalid, PasswordKdfAdmission, PasswordKdfBusy, PasswordMethodConfigurationError, PasswordMethodPolicy, PasswordMethodUnsupported, PasswordNormalization, PasswordPersistence, PasswordPolicy, PasswordPreparedConfiguration, PasswordPreparedCredential, PasswordPreparedIntentId, PasswordPreparedReady, PasswordPreparedReadyJson, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordPreparedResult, PasswordPreparedVersion, PasswordRejected, PasswordReplacement, PasswordScreening, PasswordScreeningContext, PasswordUnavailable, PasswordVerification, PasswordVerifierInvalid, decodePasswordPreparedReady, defaultPasswordHashingConfig, defaultPasswordMethodPolicy, defaultPasswordPolicy, encodePasswordPreparedReady, make, makePasswordMethod as makeModule, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation, validatePasswordHashingConfig, validatePasswordMethodPolicy, validatePasswordPolicy, validatePasswordPreparedConfiguration };

package/dist/PasswordAuth.d.mts

@@ -0,0 +1,45 @@
+import { Email, SubjectId } from "./Schema.mjs";
+import { AuthRateLimited, AuthStoreError, AuthTokenError, InvalidAuthRequest, InvalidCredentials } from "./Errors.mjs";
+import { PasswordCredentialStore } from "./PasswordCredentialStore.mjs";
+import { PasswordHasher } from "./PasswordHasher.mjs";
+import { Context, Effect, Layer, Option, Redacted } from "effect";
+//#region src/PasswordAuth.d.ts
+interface SetPasswordInput {
+  /** Required whenever the subject already has a password credential. */
+  readonly currentPassword: Option.Option<Redacted.Redacted<string>>;
+  readonly newPassword: Redacted.Redacted<string>;
+}
+declare const PasswordAuth_base: Context.ServiceClass<PasswordAuth, "effect-auth/PasswordAuth", {
+  /**
+   * Verifies an email and password pair and resolves the subject. Unknown
+   * email, missing credential, and wrong password all collapse into
+   * `InvalidCredentials`; a locked credential is `AuthRateLimited`.
+   */
+  readonly signIn: (email: Email, password: Redacted.Redacted<string>) => Effect.Effect<SubjectId, InvalidCredentials | AuthRateLimited | AuthStoreError | AuthTokenError>;
+  /**
+   * Sets or changes the subject's password. Changing an existing password
+   * requires the current one; a missing or wrong current password is
+   * `InvalidCredentials`, and a new password outside the policy bounds is
+   * `InvalidAuthRequest`. Wrong current passwords share the sign-in failure
+   * accounting, so a locked credential is `AuthRateLimited` here too —
+   * otherwise this endpoint would be an unthrottled password oracle.
+   */
+  readonly setPassword: (subjectId: SubjectId, input: SetPasswordInput) => Effect.Effect<void, InvalidCredentials | InvalidAuthRequest | AuthRateLimited | AuthStoreError | AuthTokenError>;
+  /** Reports whether the subject has set a password. */
+  readonly hasPassword: (subjectId: SubjectId) => Effect.Effect<boolean, AuthStoreError>;
+}>;
+/**
+ * Password strategy workflow, a sibling of `EmailOtp`. A password is a second
+ * sign-in method an existing subject opts into; account creation stays with
+ * the email OTP strategy, so a verified email always precedes a credential.
+ * Session issuance stays in `AuthSession`; the HTTP layer composes the two.
+ *
+ * Sessions are stateless, so changing a password does not revoke sessions
+ * issued before the change.
+ */
+declare class PasswordAuth extends PasswordAuth_base {
+  static readonly layer: Layer.Layer<PasswordAuth, never, PasswordCredentialStore | PasswordHasher>;
+}
+//#endregion
+export { PasswordAuth, SetPasswordInput };
+//# sourceMappingURL=PasswordAuth.d.mts.map

package/dist/PasswordAuth.mjs

@@ -0,0 +1,79 @@
+import { AuthRateLimited, InvalidAuthRequest, InvalidCredentials } from "./Errors.mjs";
+import { AuthPolicy } from "./Policy.mjs";
+import { PasswordCredentialStore } from "./PasswordCredentialStore.mjs";
+import { PasswordHasher } from "./PasswordHasher.mjs";
+import { Context, DateTime, Effect, Layer, Option, Redacted } from "effect";
+//#region src/PasswordAuth.ts
+/**
+* Password strategy workflow, a sibling of `EmailOtp`. A password is a second
+* sign-in method an existing subject opts into; account creation stays with
+* the email OTP strategy, so a verified email always precedes a credential.
+* Session issuance stays in `AuthSession`; the HTTP layer composes the two.
+*
+* Sessions are stateless, so changing a password does not revoke sessions
+* issued before the change.
+*/
+var PasswordAuth = class PasswordAuth extends Context.Service()("effect-auth/PasswordAuth") {
+	static layer = Layer.effect(PasswordAuth)(Effect.gen(function* () {
+		const policy = yield* AuthPolicy;
+		const store = yield* PasswordCredentialStore;
+		const hasher = yield* PasswordHasher;
+		const dummyHash = yield* Effect.cached(hasher.hash(Redacted.make("effect-auth/anti-enumeration-dummy")));
+		const failureOptions = {
+			attemptLimit: policy.passwordAttemptLimit,
+			lockDuration: policy.passwordLockDuration
+		};
+		return PasswordAuth.of({
+			signIn: Effect.fn("PasswordAuth.signIn")(function* (email, password) {
+				if (Redacted.value(password).length > policy.passwordMaxLength) return yield* InvalidCredentials.make();
+				const credential = yield* store.findByEmail(email);
+				if (Option.isSome(credential) && Option.isSome(credential.value.lockedUntil)) {
+					const now = yield* DateTime.now;
+					const lockedUntil = credential.value.lockedUntil.value;
+					const remainingMillis = DateTime.toEpochMillis(lockedUntil) - DateTime.toEpochMillis(now);
+					if (remainingMillis > 0) return yield* AuthRateLimited.make({ retryAfterSeconds: Math.ceil(remainingMillis / 1e3) });
+				}
+				if (Option.isNone(credential)) {
+					yield* hasher.verify(password, yield* dummyHash);
+					return yield* InvalidCredentials.make();
+				}
+				if (!(yield* hasher.verify(password, credential.value.hash))) {
+					yield* store.recordFailure(credential.value.subjectId, failureOptions);
+					return yield* InvalidCredentials.make();
+				}
+				yield* store.recordSuccess(credential.value.subjectId);
+				return credential.value.subjectId;
+			}),
+			setPassword: Effect.fn("PasswordAuth.setPassword")(function* (subjectId, input) {
+				const newPasswordLength = Redacted.value(input.newPassword).length;
+				if (newPasswordLength < policy.passwordMinLength) return yield* InvalidAuthRequest.make({ message: `Passwords must be at least ${policy.passwordMinLength} characters` });
+				if (newPasswordLength > policy.passwordMaxLength) return yield* InvalidAuthRequest.make({ message: `Passwords must be at most ${policy.passwordMaxLength} characters` });
+				const existing = yield* store.findBySubject(subjectId);
+				if (Option.isSome(existing)) {
+					if (Option.isSome(existing.value.lockedUntil)) {
+						const now = yield* DateTime.now;
+						const remainingMillis = DateTime.toEpochMillis(existing.value.lockedUntil.value) - DateTime.toEpochMillis(now);
+						if (remainingMillis > 0) return yield* AuthRateLimited.make({ retryAfterSeconds: Math.ceil(remainingMillis / 1e3) });
+					}
+					if (Option.isNone(input.currentPassword)) return yield* InvalidCredentials.make();
+					const currentPassword = input.currentPassword.value;
+					if (Redacted.value(currentPassword).length > policy.passwordMaxLength) return yield* InvalidCredentials.make();
+					if (!(yield* hasher.verify(currentPassword, existing.value.hash))) {
+						yield* store.recordFailure(subjectId, failureOptions);
+						return yield* InvalidCredentials.make();
+					}
+					yield* store.recordSuccess(subjectId);
+				}
+				const hash = yield* hasher.hash(input.newPassword);
+				yield* store.upsert(subjectId, hash);
+			}),
+			hasPassword: Effect.fn("PasswordAuth.hasPassword")(function* (subjectId) {
+				return Option.isSome(yield* store.findBySubject(subjectId));
+			})
+		});
+	}));
+};
+//#endregion
+export { PasswordAuth };
+
+//# sourceMappingURL=PasswordAuth.mjs.map

package/dist/PasswordAuth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordAuth.mjs","names":[],"sources":["../src/PasswordAuth.ts"],"sourcesContent":["import { Context, DateTime, Effect, Layer, Option, Redacted } from \"effect\";\n\nimport {\n  type AuthStoreError,\n  type AuthTokenError,\n  AuthRateLimited,\n  InvalidAuthRequest,\n  InvalidCredentials,\n} from \"./Errors\";\nimport { PasswordCredentialStore } from \"./PasswordCredentialStore\";\nimport { PasswordHasher } from \"./PasswordHasher\";\nimport { AuthPolicy } from \"./Policy\";\nimport type { Email, SubjectId } from \"./Schema\";\n\nexport interface SetPasswordInput {\n  /** Required whenever the subject already has a password credential. */\n  readonly currentPassword: Option.Option<Redacted.Redacted<string>>;\n  readonly newPassword: Redacted.Redacted<string>;\n}\n\n/**\n * Password strategy workflow, a sibling of `EmailOtp`. A password is a second\n * sign-in method an existing subject opts into; account creation stays with\n * the email OTP strategy, so a verified email always precedes a credential.\n * Session issuance stays in `AuthSession`; the HTTP layer composes the two.\n *\n * Sessions are stateless, so changing a password does not revoke sessions\n * issued before the change.\n */\nexport class PasswordAuth extends Context.Service<\n  PasswordAuth,\n  {\n    /**\n     * Verifies an email and password pair and resolves the subject. Unknown\n     * email, missing credential, and wrong password all collapse into\n     * `InvalidCredentials`; a locked credential is `AuthRateLimited`.\n     */\n    readonly signIn: (\n      email: Email,\n      password: Redacted.Redacted<string>,\n    ) => Effect.Effect<\n      SubjectId,\n      InvalidCredentials | AuthRateLimited | AuthStoreError | AuthTokenError\n    >;\n    /**\n     * Sets or changes the subject's password. Changing an existing password\n     * requires the current one; a missing or wrong current password is\n     * `InvalidCredentials`, and a new password outside the policy bounds is\n     * `InvalidAuthRequest`. Wrong current passwords share the sign-in failure\n     * accounting, so a locked credential is `AuthRateLimited` here too —\n     * otherwise this endpoint would be an unthrottled password oracle.\n     */\n    readonly setPassword: (\n      subjectId: SubjectId,\n      input: SetPasswordInput,\n    ) => Effect.Effect<\n      void,\n      InvalidCredentials | InvalidAuthRequest | AuthRateLimited | AuthStoreError | AuthTokenError\n    >;\n    /** Reports whether the subject has set a password. */\n    readonly hasPassword: (subjectId: SubjectId) => Effect.Effect<boolean, AuthStoreError>;\n  }\n>()(\"effect-auth/PasswordAuth\") {\n  static readonly layer: Layer.Layer<\n    PasswordAuth,\n    never,\n    PasswordCredentialStore | PasswordHasher\n  > = Layer.effect(PasswordAuth)(\n    Effect.gen(function* () {\n      const policy = yield* AuthPolicy;\n      const store = yield* PasswordCredentialStore;\n      const hasher = yield* PasswordHasher;\n\n      // Verified when no credential exists so the missing-credential path\n      // costs one key derivation, the same as a wrong password. Hashed here\n      // rather than hard-coded so its iteration count tracks the policy.\n      // Lazily memoized rather than derived at layer build: consumers may\n      // rebuild the layer graph per request, and only the unknown-email\n      // sign-in path should ever pay the full key derivation.\n      const dummyHash = yield* Effect.cached(\n        hasher.hash(Redacted.make(\"effect-auth/anti-enumeration-dummy\")),\n      );\n\n      const failureOptions = {\n        attemptLimit: policy.passwordAttemptLimit,\n        lockDuration: policy.passwordLockDuration,\n      };\n\n      return PasswordAuth.of({\n        signIn: Effect.fn(\"PasswordAuth.signIn\")(function* (email, password) {\n          // An over-long password can never verify (`setPassword` enforces the\n          // cap), so refuse it before any derivation. The response does not\n          // depend on the email, so nothing leaks.\n          if (Redacted.value(password).length > policy.passwordMaxLength) {\n            return yield* InvalidCredentials.make();\n          }\n          const credential = yield* store.findByEmail(email);\n\n          if (Option.isSome(credential) && Option.isSome(credential.value.lockedUntil)) {\n            const now = yield* DateTime.now;\n            const lockedUntil = credential.value.lockedUntil.value;\n\n            const remainingMillis =\n              DateTime.toEpochMillis(lockedUntil) - DateTime.toEpochMillis(now);\n\n            if (remainingMillis > 0) {\n              // Deliberate tradeoff: answering 429 here reveals that a\n              // password credential exists for the email (an attacker can\n              // probe by burning attemptLimit guesses). We accept that —\n              // legitimate locked-out users need the retry guidance, and\n              // collapsing to InvalidCredentials would hide the lockout.\n              return yield* AuthRateLimited.make({\n                retryAfterSeconds: Math.ceil(remainingMillis / 1000),\n              });\n            }\n          }\n          if (Option.isNone(credential)) {\n            // Burn the same key derivation a real verification would, so\n            // response timing cannot separate unknown emails from wrong\n            // passwords.\n            yield* hasher.verify(password, yield* dummyHash);\n\n            return yield* InvalidCredentials.make();\n          }\n          const matches = yield* hasher.verify(password, credential.value.hash);\n\n          if (!matches) {\n            yield* store.recordFailure(credential.value.subjectId, failureOptions);\n\n            return yield* InvalidCredentials.make();\n          }\n          yield* store.recordSuccess(credential.value.subjectId);\n\n          return credential.value.subjectId;\n        }),\n\n        setPassword: Effect.fn(\"PasswordAuth.setPassword\")(function* (subjectId, input) {\n          const newPasswordLength = Redacted.value(input.newPassword).length;\n\n          if (newPasswordLength < policy.passwordMinLength) {\n            return yield* InvalidAuthRequest.make({\n              message: `Passwords must be at least ${policy.passwordMinLength} characters`,\n            });\n          }\n          if (newPasswordLength > policy.passwordMaxLength) {\n            return yield* InvalidAuthRequest.make({\n              message: `Passwords must be at most ${policy.passwordMaxLength} characters`,\n            });\n          }\n          const existing = yield* store.findBySubject(subjectId);\n\n          if (Option.isSome(existing)) {\n            // Current-password guesses share the sign-in failure accounting,\n            // so a locked credential is rejected before any verification.\n            if (Option.isSome(existing.value.lockedUntil)) {\n              const now = yield* DateTime.now;\n\n              const remainingMillis =\n                DateTime.toEpochMillis(existing.value.lockedUntil.value) -\n                DateTime.toEpochMillis(now);\n\n              if (remainingMillis > 0) {\n                return yield* AuthRateLimited.make({\n                  retryAfterSeconds: Math.ceil(remainingMillis / 1000),\n                });\n              }\n            }\n            if (Option.isNone(input.currentPassword)) {\n              return yield* InvalidCredentials.make();\n            }\n            const currentPassword = input.currentPassword.value;\n\n            // Same DoS guard as sign-in: never derive from an over-long input.\n            if (Redacted.value(currentPassword).length > policy.passwordMaxLength) {\n              return yield* InvalidCredentials.make();\n            }\n            const matches = yield* hasher.verify(currentPassword, existing.value.hash);\n\n            if (!matches) {\n              yield* store.recordFailure(subjectId, failureOptions);\n\n              return yield* InvalidCredentials.make();\n            }\n            yield* store.recordSuccess(subjectId);\n          }\n          const hash = yield* hasher.hash(input.newPassword);\n\n          yield* store.upsert(subjectId, hash);\n        }),\n\n        hasPassword: Effect.fn(\"PasswordAuth.hasPassword\")(function* (subjectId) {\n          return Option.isSome(yield* store.findBySubject(subjectId));\n        }),\n      });\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,IAAa,eAAb,MAAa,qBAAqB,QAAQ,QAiCxC,CAAC,CAAC,0BAA0B,CAAC,CAAC;CAC9B,OAAgB,QAIZ,MAAM,OAAO,YAAY,CAAC,CAC5B,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO;EAQtB,MAAM,YAAY,OAAO,OAAO,OAC9B,OAAO,KAAK,SAAS,KAAK,oCAAoC,CAAC,CACjE;EAEA,MAAM,iBAAiB;GACrB,cAAc,OAAO;GACrB,cAAc,OAAO;EACvB;EAEA,OAAO,aAAa,GAAG;GACrB,QAAQ,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAAW,OAAO,UAAU;IAInE,IAAI,SAAS,MAAM,QAAQ,CAAC,CAAC,SAAS,OAAO,mBAC3C,OAAO,OAAO,mBAAmB,KAAK;IAExC,MAAM,aAAa,OAAO,MAAM,YAAY,KAAK;IAEjD,IAAI,OAAO,OAAO,UAAU,KAAK,OAAO,OAAO,WAAW,MAAM,WAAW,GAAG;KAC5E,MAAM,MAAM,OAAO,SAAS;KAC5B,MAAM,cAAc,WAAW,MAAM,YAAY;KAEjD,MAAM,kBACJ,SAAS,cAAc,WAAW,IAAI,SAAS,cAAc,GAAG;KAElE,IAAI,kBAAkB,GAMpB,OAAO,OAAO,gBAAgB,KAAK,EACjC,mBAAmB,KAAK,KAAK,kBAAkB,GAAI,EACrD,CAAC;IAEL;IACA,IAAI,OAAO,OAAO,UAAU,GAAG;KAI7B,OAAO,OAAO,OAAO,UAAU,OAAO,SAAS;KAE/C,OAAO,OAAO,mBAAmB,KAAK;IACxC;IAGA,IAAI,EAAC,OAFkB,OAAO,OAAO,UAAU,WAAW,MAAM,IAAI,IAEtD;KACZ,OAAO,MAAM,cAAc,WAAW,MAAM,WAAW,cAAc;KAErE,OAAO,OAAO,mBAAmB,KAAK;IACxC;IACA,OAAO,MAAM,cAAc,WAAW,MAAM,SAAS;IAErD,OAAO,WAAW,MAAM;GAC1B,CAAC;GAED,aAAa,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,WAAW,OAAO;IAC9E,MAAM,oBAAoB,SAAS,MAAM,MAAM,WAAW,CAAC,CAAC;IAE5D,IAAI,oBAAoB,OAAO,mBAC7B,OAAO,OAAO,mBAAmB,KAAK,EACpC,SAAS,8BAA8B,OAAO,kBAAkB,aAClE,CAAC;IAEH,IAAI,oBAAoB,OAAO,mBAC7B,OAAO,OAAO,mBAAmB,KAAK,EACpC,SAAS,6BAA6B,OAAO,kBAAkB,aACjE,CAAC;IAEH,MAAM,WAAW,OAAO,MAAM,cAAc,SAAS;IAErD,IAAI,OAAO,OAAO,QAAQ,GAAG;KAG3B,IAAI,OAAO,OAAO,SAAS,MAAM,WAAW,GAAG;MAC7C,MAAM,MAAM,OAAO,SAAS;MAE5B,MAAM,kBACJ,SAAS,cAAc,SAAS,MAAM,YAAY,KAAK,IACvD,SAAS,cAAc,GAAG;MAE5B,IAAI,kBAAkB,GACpB,OAAO,OAAO,gBAAgB,KAAK,EACjC,mBAAmB,KAAK,KAAK,kBAAkB,GAAI,EACrD,CAAC;KAEL;KACA,IAAI,OAAO,OAAO,MAAM,eAAe,GACrC,OAAO,OAAO,mBAAmB,KAAK;KAExC,MAAM,kBAAkB,MAAM,gBAAgB;KAG9C,IAAI,SAAS,MAAM,eAAe,CAAC,CAAC,SAAS,OAAO,mBAClD,OAAO,OAAO,mBAAmB,KAAK;KAIxC,IAAI,EAAC,OAFkB,OAAO,OAAO,iBAAiB,SAAS,MAAM,IAAI,IAE3D;MACZ,OAAO,MAAM,cAAc,WAAW,cAAc;MAEpD,OAAO,OAAO,mBAAmB,KAAK;KACxC;KACA,OAAO,MAAM,cAAc,SAAS;IACtC;IACA,MAAM,OAAO,OAAO,OAAO,KAAK,MAAM,WAAW;IAEjD,OAAO,MAAM,OAAO,WAAW,IAAI;GACrC,CAAC;GAED,aAAa,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,WAAW;IACvE,OAAO,OAAO,OAAO,OAAO,MAAM,cAAc,SAAS,CAAC;GAC5D,CAAC;EACH,CAAC;CACH,CAAC,CACH;AACF"}

package/dist/PasswordCredentialStore.d.mts

@@ -0,0 +1,46 @@
+import { Email, PasswordCredential, PasswordHash, SubjectId } from "./Schema.mjs";
+import { AuthStoreError } from "./Errors.mjs";
+import { IdentityResolver } from "./IdentityResolver.mjs";
+import { Context, Duration, Effect, Layer, Option } from "effect";
+//#region src/PasswordCredentialStore.d.ts
+/** Failure-accounting knobs, passed per call so the store stays policy-free. */
+interface RecordFailureOptions {
+  /** Consecutive failures at which the credential locks. */
+  readonly attemptLimit: number;
+  /** How long the credential stays locked once the limit is reached. */
+  readonly lockDuration: Duration.Duration;
+}
+declare const PasswordCredentialStore_base: Context.ServiceClass<PasswordCredentialStore, "effect-auth/PasswordCredentialStore", {
+  readonly findByEmail: (email: Email) => Effect.Effect<Option.Option<PasswordCredential>, AuthStoreError>;
+  readonly findBySubject: (subjectId: SubjectId) => Effect.Effect<Option.Option<PasswordCredential>, AuthStoreError>;
+  /** Creates or replaces the subject's credential, clearing failures and any lock. */
+  readonly upsert: (subjectId: SubjectId, hash: PasswordHash) => Effect.Effect<void, AuthStoreError>;
+  /**
+   * Increments the failure count and sets `lockedUntil` once the limit is
+   * reached. A failure arriving after an existing lock has expired starts a
+   * fresh window: the count resets to one and the stale lock is cleared, so
+   * a single wrong attempt per window can never re-lock forever. A no-op
+   * when the subject has no credential.
+   */
+  readonly recordFailure: (subjectId: SubjectId, options: RecordFailureOptions) => Effect.Effect<void, AuthStoreError>;
+  /** Clears the failure count and any lock. A no-op when the subject has no credential. */
+  readonly recordSuccess: (subjectId: SubjectId) => Effect.Effect<void, AuthStoreError>;
+}>;
+/**
+ * Consumer-implemented persistence for long-lived password credentials, keyed
+ * by subject with lookup through the subject's verified email. Deliberately
+ * not part of `AuthStore`: that store is transient-only, while credentials
+ * live as long as the account. Like `IdentityResolver`, the application owns
+ * the implementation; `PasswordAuth` owns the policy decisions around it.
+ */
+declare class PasswordCredentialStore extends PasswordCredentialStore_base {
+  /**
+   * In-memory adapter for tests and local development; never durable. Email
+   * lookup delegates to `IdentityResolver`, mirroring how a production adapter
+   * joins its email mapping.
+   */
+  static readonly layerMemory: Layer.Layer<PasswordCredentialStore, never, IdentityResolver>;
+}
+//#endregion
+export { PasswordCredentialStore, RecordFailureOptions };
+//# sourceMappingURL=PasswordCredentialStore.d.mts.map

package/dist/PasswordCredentialStore.mjs

@@ -0,0 +1,62 @@
+import { PasswordCredential } from "./Schema.mjs";
+import { AuthStoreError } from "./Errors.mjs";
+import { IdentityResolver } from "./IdentityResolver.mjs";
+import { Context, DateTime, Effect, Layer, Option } from "effect";
+//#region src/PasswordCredentialStore.ts
+/**
+* Consumer-implemented persistence for long-lived password credentials, keyed
+* by subject with lookup through the subject's verified email. Deliberately
+* not part of `AuthStore`: that store is transient-only, while credentials
+* live as long as the account. Like `IdentityResolver`, the application owns
+* the implementation; `PasswordAuth` owns the policy decisions around it.
+*/
+var PasswordCredentialStore = class PasswordCredentialStore extends Context.Service()("effect-auth/PasswordCredentialStore") {
+	/**
+	* In-memory adapter for tests and local development; never durable. Email
+	* lookup delegates to `IdentityResolver`, mirroring how a production adapter
+	* joins its email mapping.
+	*/
+	static layerMemory = Layer.effect(PasswordCredentialStore)(Effect.gen(function* () {
+		const resolver = yield* IdentityResolver;
+		const credentials = /* @__PURE__ */ new Map();
+		const byEmail = (email) => resolver.findByVerifiedEmail(email).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Identity resolution failed" })), Effect.map(Option.flatMap((subjectId) => Option.fromNullishOr(credentials.get(subjectId)))));
+		return PasswordCredentialStore.of({
+			findByEmail: byEmail,
+			findBySubject: (subjectId) => Effect.sync(() => Option.fromNullishOr(credentials.get(subjectId))),
+			upsert: (subjectId, hash) => Effect.sync(() => {
+				credentials.set(subjectId, PasswordCredential.make({
+					subjectId,
+					hash,
+					failedAttempts: 0,
+					lockedUntil: Option.none()
+				}));
+			}),
+			recordFailure: Effect.fn("PasswordCredentialStore.recordFailure")(function* (subjectId, options) {
+				const credential = credentials.get(subjectId);
+				if (credential === void 0) return;
+				const now = yield* DateTime.now;
+				const lockExpired = Option.isSome(credential.lockedUntil) && DateTime.toEpochMillis(credential.lockedUntil.value) <= DateTime.toEpochMillis(now);
+				const failedAttempts = lockExpired ? 1 : credential.failedAttempts + 1;
+				const lockedUntil = failedAttempts >= options.attemptLimit ? Option.some(DateTime.addDuration(now, options.lockDuration)) : lockExpired ? Option.none() : credential.lockedUntil;
+				credentials.set(subjectId, PasswordCredential.make({
+					...credential,
+					failedAttempts,
+					lockedUntil
+				}));
+			}),
+			recordSuccess: (subjectId) => Effect.sync(() => {
+				const credential = credentials.get(subjectId);
+				if (credential === void 0) return;
+				credentials.set(subjectId, PasswordCredential.make({
+					...credential,
+					failedAttempts: 0,
+					lockedUntil: Option.none()
+				}));
+			})
+		});
+	}));
+};
+//#endregion
+export { PasswordCredentialStore };
+
+//# sourceMappingURL=PasswordCredentialStore.mjs.map

package/dist/PasswordCredentialStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordCredentialStore.mjs","names":[],"sources":["../src/PasswordCredentialStore.ts"],"sourcesContent":["import { Context, DateTime, type Duration, Effect, Layer, Option } from \"effect\";\n\nimport { AuthStoreError } from \"./Errors\";\nimport { IdentityResolver } from \"./IdentityResolver\";\nimport { type Email, type PasswordHash, type SubjectId, PasswordCredential } from \"./Schema\";\n\n/** Failure-accounting knobs, passed per call so the store stays policy-free. */\nexport interface RecordFailureOptions {\n  /** Consecutive failures at which the credential locks. */\n  readonly attemptLimit: number;\n  /** How long the credential stays locked once the limit is reached. */\n  readonly lockDuration: Duration.Duration;\n}\n\n/**\n * Consumer-implemented persistence for long-lived password credentials, keyed\n * by subject with lookup through the subject's verified email. Deliberately\n * not part of `AuthStore`: that store is transient-only, while credentials\n * live as long as the account. Like `IdentityResolver`, the application owns\n * the implementation; `PasswordAuth` owns the policy decisions around it.\n */\nexport class PasswordCredentialStore extends Context.Service<\n  PasswordCredentialStore,\n  {\n    readonly findByEmail: (\n      email: Email,\n    ) => Effect.Effect<Option.Option<PasswordCredential>, AuthStoreError>;\n    readonly findBySubject: (\n      subjectId: SubjectId,\n    ) => Effect.Effect<Option.Option<PasswordCredential>, AuthStoreError>;\n    /** Creates or replaces the subject's credential, clearing failures and any lock. */\n    readonly upsert: (\n      subjectId: SubjectId,\n      hash: PasswordHash,\n    ) => Effect.Effect<void, AuthStoreError>;\n    /**\n     * Increments the failure count and sets `lockedUntil` once the limit is\n     * reached. A failure arriving after an existing lock has expired starts a\n     * fresh window: the count resets to one and the stale lock is cleared, so\n     * a single wrong attempt per window can never re-lock forever. A no-op\n     * when the subject has no credential.\n     */\n    readonly recordFailure: (\n      subjectId: SubjectId,\n      options: RecordFailureOptions,\n    ) => Effect.Effect<void, AuthStoreError>;\n    /** Clears the failure count and any lock. A no-op when the subject has no credential. */\n    readonly recordSuccess: (subjectId: SubjectId) => Effect.Effect<void, AuthStoreError>;\n  }\n>()(\"effect-auth/PasswordCredentialStore\") {\n  /**\n   * In-memory adapter for tests and local development; never durable. Email\n   * lookup delegates to `IdentityResolver`, mirroring how a production adapter\n   * joins its email mapping.\n   */\n  static readonly layerMemory: Layer.Layer<PasswordCredentialStore, never, IdentityResolver> =\n    Layer.effect(PasswordCredentialStore)(\n      Effect.gen(function* () {\n        const resolver = yield* IdentityResolver;\n        const credentials = new Map<SubjectId, PasswordCredential>();\n\n        const byEmail = (email: Email) =>\n          resolver.findByVerifiedEmail(email).pipe(\n            Effect.mapError(() => AuthStoreError.make({ message: \"Identity resolution failed\" })),\n            Effect.map(\n              Option.flatMap((subjectId) => Option.fromNullishOr(credentials.get(subjectId))),\n            ),\n          );\n\n        return PasswordCredentialStore.of({\n          findByEmail: byEmail,\n\n          findBySubject: (subjectId) =>\n            Effect.sync(() => Option.fromNullishOr(credentials.get(subjectId))),\n\n          upsert: (subjectId, hash) =>\n            Effect.sync(() => {\n              credentials.set(\n                subjectId,\n                PasswordCredential.make({\n                  subjectId,\n                  hash,\n                  failedAttempts: 0,\n                  lockedUntil: Option.none(),\n                }),\n              );\n            }),\n\n          recordFailure: Effect.fn(\"PasswordCredentialStore.recordFailure\")(\n            function* (subjectId, options) {\n              const credential = credentials.get(subjectId);\n\n              if (credential === undefined) {\n                return;\n              }\n              const now = yield* DateTime.now;\n\n              // An expired lock means the previous window is over: this\n              // failure starts a fresh count instead of stacking on the old\n              // one, so one wrong attempt per window cannot re-lock forever.\n              const lockExpired =\n                Option.isSome(credential.lockedUntil) &&\n                DateTime.toEpochMillis(credential.lockedUntil.value) <= DateTime.toEpochMillis(now);\n\n              const failedAttempts = lockExpired ? 1 : credential.failedAttempts + 1;\n\n              const lockedUntil =\n                failedAttempts >= options.attemptLimit\n                  ? Option.some(DateTime.addDuration(now, options.lockDuration))\n                  : lockExpired\n                    ? Option.none<DateTime.Utc>()\n                    : credential.lockedUntil;\n\n              credentials.set(\n                subjectId,\n                PasswordCredential.make({ ...credential, failedAttempts, lockedUntil }),\n              );\n            },\n          ),\n\n          recordSuccess: (subjectId) =>\n            Effect.sync(() => {\n              const credential = credentials.get(subjectId);\n\n              if (credential === undefined) {\n                return;\n              }\n              credentials.set(\n                subjectId,\n                PasswordCredential.make({\n                  ...credential,\n                  failedAttempts: 0,\n                  lockedUntil: Option.none(),\n                }),\n              );\n            }),\n        });\n      }),\n    );\n}\n"],"mappings":";;;;;;;;;;;;AAqBA,IAAa,0BAAb,MAAa,gCAAgC,QAAQ,QA4BnD,CAAC,CAAC,qCAAqC,CAAC,CAAC;;;;;;CAMzC,OAAgB,cACd,MAAM,OAAO,uBAAuB,CAAC,CACnC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,8BAAc,IAAI,IAAmC;EAE3D,MAAM,WAAW,UACf,SAAS,oBAAoB,KAAK,CAAC,CAAC,KAClC,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,6BAA6B,CAAC,CAAC,GACpF,OAAO,IACL,OAAO,SAAS,cAAc,OAAO,cAAc,YAAY,IAAI,SAAS,CAAC,CAAC,CAChF,CACF;EAEF,OAAO,wBAAwB,GAAG;GAChC,aAAa;GAEb,gBAAgB,cACd,OAAO,WAAW,OAAO,cAAc,YAAY,IAAI,SAAS,CAAC,CAAC;GAEpE,SAAS,WAAW,SAClB,OAAO,WAAW;IAChB,YAAY,IACV,WACA,mBAAmB,KAAK;KACtB;KACA;KACA,gBAAgB;KAChB,aAAa,OAAO,KAAK;IAC3B,CAAC,CACH;GACF,CAAC;GAEH,eAAe,OAAO,GAAG,uCAAuC,CAAC,CAC/D,WAAW,WAAW,SAAS;IAC7B,MAAM,aAAa,YAAY,IAAI,SAAS;IAE5C,IAAI,eAAe,KAAA,GACjB;IAEF,MAAM,MAAM,OAAO,SAAS;IAK5B,MAAM,cACJ,OAAO,OAAO,WAAW,WAAW,KACpC,SAAS,cAAc,WAAW,YAAY,KAAK,KAAK,SAAS,cAAc,GAAG;IAEpF,MAAM,iBAAiB,cAAc,IAAI,WAAW,iBAAiB;IAErE,MAAM,cACJ,kBAAkB,QAAQ,eACtB,OAAO,KAAK,SAAS,YAAY,KAAK,QAAQ,YAAY,CAAC,IAC3D,cACE,OAAO,KAAmB,IAC1B,WAAW;IAEnB,YAAY,IACV,WACA,mBAAmB,KAAK;KAAE,GAAG;KAAY;KAAgB;IAAY,CAAC,CACxE;GACF,CACF;GAEA,gBAAgB,cACd,OAAO,WAAW;IAChB,MAAM,aAAa,YAAY,IAAI,SAAS;IAE5C,IAAI,eAAe,KAAA,GACjB;IAEF,YAAY,IACV,WACA,mBAAmB,KAAK;KACtB,GAAG;KACH,gBAAgB;KAChB,aAAa,OAAO,KAAK;IAC3B,CAAC,CACH;GACF,CAAC;EACL,CAAC;CACH,CAAC,CACH;AACJ"}

package/dist/PasswordHasher.d.mts

@@ -0,0 +1,31 @@
+import { PasswordHash } from "./Schema.mjs";
+import { SubtleCrypto } from "./WebCrypto.mjs";
+import { AuthTokenError } from "./Errors.mjs";
+import { Context, Crypto, Effect, Layer, Redacted } from "effect";
+//#region src/PasswordHasher.d.ts
+declare const PasswordHasher_base: Context.ServiceClass<PasswordHasher, "effect-auth/PasswordHasher", {
+  /** Derives a fresh salted hash for the password at the configured cost. */
+  readonly hash: (password: Redacted.Redacted<string>) => Effect.Effect<PasswordHash, AuthTokenError>;
+  /**
+   * Verifies the password against a stored hash using the parameters
+   * recorded on the hash, comparing digests in constant time. A malformed
+   * hash yields `false`, never a distinguishable failure.
+   */
+  readonly verify: (password: Redacted.Redacted<string>, hash: PasswordHash) => Effect.Effect<boolean, AuthTokenError>;
+}>;
+/**
+ * One-way password hashing and verification. The PHC-style `PasswordHash`
+ * format is this service's private concern; stores persist it opaquely.
+ */
+declare class PasswordHasher extends PasswordHasher_base {
+  /**
+   * Default PBKDF2 implementation backed by WebCrypto. The consumer may
+   * replace it with its own hasher service, or satisfy `SubtleCrypto` with
+   * `SubtleCrypto.layerWeb`.
+   */
+  static readonly layerWebCrypto: Layer.Layer<PasswordHasher, never, Crypto.Crypto | SubtleCrypto>;
+  static readonly layer: Layer.Layer<PasswordHasher, never, Crypto.Crypto | SubtleCrypto>;
+}
+//#endregion
+export { PasswordHasher };
+//# sourceMappingURL=PasswordHasher.d.mts.map