@yielded/auth 0.1.0-beta.1

package/src/passkey/snapshot.ts

@@ -0,0 +1,48 @@
+import { DateTime, Effect, Predicate, Schema } from "effect";
+
+import { PasskeyUnavailable } from "./errors";
+
+export const freezePasskey = (value: unknown): void => {
+  if (!Predicate.isObjectOrArray(value) || Object.isFrozen(value)) return;
+  if (DateTime.isDateTime(value)) Object.freeze(DateTime.toPartsUtc(value));
+  for (const child of Object.values(value)) freezePasskey(child);
+  Object.freeze(value);
+};
+
+export const snapshotPasskeySync = <S extends Schema.Codec<unknown, unknown, never, never>>(
+  schema: S,
+  value: S["Type"],
+): S["Type"] => {
+  try {
+    const codec = Schema.toCodecJson(Schema.toType(schema));
+    const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));
+
+    freezePasskey(result);
+
+    return result;
+  } catch {
+    throw PasskeyUnavailable.make({});
+  }
+};
+
+export const snapshotPasskey = <S extends Schema.Codec<unknown, unknown, never, never>>(
+  schema: S,
+  value: S["Type"],
+) =>
+  Effect.try({
+    try: () => snapshotPasskeySync(schema, value),
+    catch: () => PasskeyUnavailable.make({}),
+  });
+
+export const samePasskey = <S extends Schema.Codec<unknown, unknown, never, never>>(
+  schema: S,
+  left: S["Type"],
+  right: S["Type"],
+) =>
+  Effect.gen(function* () {
+    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+    const a = yield* Schema.encodeEffect(codec)(left);
+    const b = yield* Schema.encodeEffect(codec)(right);
+
+    return a === b;
+  }).pipe(Effect.mapError(() => PasskeyUnavailable.make({})));

package/src/passkey/stepUp.ts

@@ -0,0 +1,212 @@
+import { Context, Effect, Layer, Schema, type Types } from "effect";
+
+import type { AuthInvocation } from "../operations/context";
+import type { AuthOperationResult } from "../operations/credentials";
+import { makeOperation, operationGroup } from "../operations/operation";
+import type { AuthenticationAuthority } from "../sessions/AuthenticationAuthority";
+import type { makeSessionModule } from "../sessions/module";
+import {
+  passkeyUnexpected,
+  makePasskeyCeremony,
+  passkeyNoAmbient,
+  readPasskeyCommit,
+} from "./actions";
+import type { PasskeyConfigurationError } from "./errors";
+import {
+  PasskeyFailure,
+  PasskeyMethodUnsupported,
+  PasskeyRejected,
+  PasskeyUnavailable,
+} from "./errors";
+import {
+  PasskeyAuthenticationStarted,
+  PasskeyBegin,
+  PasskeyComplete,
+  PasskeyTarget,
+} from "./models";
+import type { PasskeyCredentials } from "./PasskeyCredentials";
+import type { PasskeyEnrollmentContext } from "./PasskeyEnrollmentContext";
+import type { PasskeyMethodPolicy } from "./policy";
+import { snapshotPasskey } from "./snapshot";
+const credential = Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(16384)));
+
+export const makePasskeyStepUp = <
+  const Id extends string,
+  const SessionId extends string,
+  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,
+>(
+  moduleId: Id,
+  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,
+  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,
+) => {
+  const ceremony = makePasskeyCeremony(moduleId, source, "step-up");
+  const BeginInput = Schema.Struct({ ...PasskeyBegin.fields, stepUpCredential: credential });
+
+  const CompleteInput = Schema.Struct({
+    ...PasskeyComplete.fields,
+    stepUpCredential: credential,
+    sourceCredential: credential,
+  });
+
+  const StepUp = Context.Service<
+    {
+      readonly moduleId: Id;
+      readonly kind: "passkey-step-up";
+      readonly claims: Types.Invariant<Claims["Type"]>;
+    },
+    {
+      readonly begin: (
+        invocation: AuthInvocation,
+        input: typeof BeginInput.Type,
+      ) => Effect.Effect<AuthOperationResult<PasskeyAuthenticationStarted>, PasskeyFailure>;
+      readonly complete: (
+        invocation: AuthInvocation,
+        input: typeof CompleteInput.Type,
+      ) => Effect.Effect<AuthOperationResult<typeof sessions.Session.Type>, PasskeyFailure>;
+    }
+  >(`effect-auth/PasskeyStepUp/${moduleId.length}:${moduleId}`);
+
+  const layer = Layer.effect(
+    StepUp,
+    Effect.gen(function* () {
+      const runtime = yield* ceremony.make,
+        stepUp = yield* sessions.SessionStepUp;
+
+      const services = yield* Effect.context<
+        PasskeyCredentials | PasskeyEnrollmentContext | AuthenticationAuthority
+      >();
+
+      const target = Effect.fn("PasskeyStepUp.target")(function* (
+        invocation: AuthInvocation,
+        token: typeof credential.Type,
+      ) {
+        if (invocation._tag !== "Authenticated") return yield* PasskeyRejected.make({});
+
+        const context = yield* stepUp
+          .context(token)
+          .pipe(
+            Effect.mapError((error) =>
+              error._tag === "HookDenied"
+                ? error
+                : error._tag === "SessionUnavailable"
+                  ? PasskeyUnavailable.make({})
+                  : error._tag === "SessionCapabilityUnsupported"
+                    ? PasskeyMethodUnsupported.make({})
+                    : PasskeyRejected.make({}),
+            ),
+          );
+
+        if (context.revision.subjectId !== invocation.subjectId)
+          return yield* PasskeyRejected.make({});
+
+        return yield* snapshotPasskey(PasskeyTarget, {
+          ...context,
+          moduleId: sessions.moduleId,
+          kind: "session-step-up",
+          commandId: context.flowId,
+        });
+      }, passkeyUnexpected);
+
+      return StepUp.of({
+        begin: Effect.fn("PasskeyStepUp.begin")(function* (invocation, input) {
+          input = yield* snapshotPasskey(Schema.toType(BeginInput), input);
+          yield* passkeyNoAmbient();
+
+          const fixed = yield* target(invocation, input.stepUpCredential),
+            captured = yield* runtime
+              .exclusions(input.profileId, fixed.revision.subjectId)
+              .pipe(Effect.provide(services));
+
+          return yield* runtime.beginAuthentication(
+            input,
+            { _tag: "StepUp", target: fixed },
+            captured.credentials,
+          );
+        }, passkeyUnexpected),
+        complete: Effect.fn("PasskeyStepUp.complete")(function* (invocation, input) {
+          input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);
+          yield* passkeyNoAmbient();
+          const fixed = yield* target(invocation, input.stepUpCredential);
+
+          const verified = yield* runtime
+            .authentication(input, { _tag: "StepUp", target: fixed })
+            .pipe(
+              Effect.provide(services),
+              Effect.catchTag("PasskeyRejected", () =>
+                Effect.gen(function* () {
+                  yield* readPasskeyCommit(
+                    yield* stepUp
+                      .rejectCredential(input.stepUpCredential)
+                      .pipe(Effect.mapError(() => PasskeyUnavailable.make({}))),
+                  );
+
+                  return yield* PasskeyRejected.make({});
+                }),
+              ),
+            );
+
+          const result = yield* readPasskeyCommit(
+            yield* stepUp
+              .prepareComplete({
+                sourceCredential: input.sourceCredential,
+                stepUpCredential: input.stepUpCredential,
+                additional: verified.evidence,
+              })
+              .pipe(
+                Effect.mapError((error) =>
+                  error._tag === "HookDenied"
+                    ? error
+                    : error._tag === "SessionUnavailable"
+                      ? PasskeyUnavailable.make({})
+                      : error._tag === "SessionCapabilityUnsupported"
+                        ? PasskeyMethodUnsupported.make({})
+                        : PasskeyRejected.make({}),
+                ),
+              ),
+          );
+
+          return {
+            value: result.value,
+            credentialCommands: [...verified.credentialCommands, ...result.credentialCommands],
+          };
+        }, passkeyUnexpected),
+      });
+    }),
+  );
+
+  const Begin = makeOperation(`${moduleId}/passkey/step-up/begin`, {
+    payload: BeginInput,
+    success: PasskeyAuthenticationStarted,
+    error: PasskeyFailure,
+    exposure: "public",
+    access: "authenticated",
+    replay: "single-use",
+    credentials: true,
+  });
+
+  const Complete = makeOperation(`${moduleId}/passkey/step-up/complete`, {
+    payload: CompleteInput,
+    success: sessions.Session,
+    error: PasskeyFailure,
+    exposure: "public",
+    access: "authenticated",
+    replay: "single-use",
+    credentials: true,
+  });
+
+  return Object.freeze({
+    StepUp,
+    binding: ceremony.binding,
+    layer,
+    operations: Object.freeze({ Begin, Complete }),
+    group: operationGroup(Begin, Complete),
+    handlersLayer: Layer.mergeAll(
+      Begin.credentialHandlerLayer((input, invocation) =>
+        Effect.flatMap(StepUp, (service) => service.begin(invocation, input)),
+      ),
+      Complete.credentialHandlerLayer((input, invocation) =>
+        Effect.flatMap(StepUp, (service) => service.complete(invocation, input)),
+      ),
+    ),
+  });
+};

package/src/password/CompromisedPasswords.ts

@@ -0,0 +1,36 @@
+import { Context, type Effect, Schema, type Redacted } from "effect";
+
+import type { PasswordCheckUnavailable } from "./errors";
+
+/** Request-specific local screening hints. Never log these or implicitly send
+ * them to a remote breached-password service. Context is not authorization.
+ */
+export const PasswordScreeningContext = Schema.Struct({
+  accountName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+  serviceName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+});
+
+export type PasswordScreeningContext = typeof PasswordScreeningContext.Type;
+
+export const PasswordScreening = Schema.Union([
+  Schema.TaggedStruct("Allowed", {}),
+  Schema.TaggedStruct("Rejected", {
+    reason: Schema.Literals(["compromised", "common", "contextual"]),
+  }),
+]);
+
+export type PasswordScreening = typeof PasswordScreening.Type;
+
+/** Required consumer capability for new passwords. No implicit network call or
+ * permissive default. Remote adapters must explicitly document any disclosure.
+ * A common/compromised corpus and contextual rules belong to this capability.
+ */
+export class CompromisedPasswords extends Context.Service<
+  CompromisedPasswords,
+  {
+    readonly check: (
+      password: Redacted.Redacted<string>,
+      context: PasswordScreeningContext,
+    ) => Effect.Effect<PasswordScreening, PasswordCheckUnavailable>;
+  }
+>()("effect-auth/CompromisedPasswords") {}

package/src/password/NewPasswordCheck.ts

@@ -0,0 +1,89 @@
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+
+import { reportAuthFailure } from "../internal/diagnostics";
+import {
+  CompromisedPasswords,
+  PasswordScreening,
+  PasswordScreeningContext,
+} from "./CompromisedPasswords";
+import { NewPasswordRejected, PasswordCheckUnavailable } from "./errors";
+import {
+  defaultPasswordPolicy,
+  validatePasswordPolicy,
+  type PasswordNormalization,
+  type PasswordPolicy,
+} from "./policy";
+
+export interface CheckedNewPassword {
+  readonly password: Redacted.Redacted<string>;
+  readonly normalization: PasswordNormalization;
+}
+
+/** Apply only to new credentials. Persist normalization beside the verifier;
+ * login uses that stored mode, while legacy verification/rehash retains none.
+ */
+export class NewPasswordCheck extends Context.Service<
+  NewPasswordCheck,
+  {
+    readonly check: (
+      password: Redacted.Redacted<string>,
+      context?: PasswordScreeningContext,
+    ) => Effect.Effect<CheckedNewPassword, NewPasswordRejected | PasswordCheckUnavailable>;
+  }
+>()("effect-auth/NewPasswordCheck") {
+  static readonly layer = (input: PasswordPolicy = defaultPasswordPolicy) => {
+    const snapshot = { ...input };
+
+    return Layer.effect(
+      this,
+      Effect.gen(function* () {
+        const policy = yield* validatePasswordPolicy(snapshot);
+        const screening = (yield* CompromisedPasswords).check;
+
+        return NewPasswordCheck.of({
+          check: Effect.fn("NewPasswordCheck.check")(function* (password, context = {}) {
+            const checkedContext = Object.freeze(
+              yield* Schema.decodeEffect(PasswordScreeningContext)(context).pipe(
+                Effect.mapError(() => PasswordCheckUnavailable.make({})),
+              ),
+            );
+
+            const raw = Redacted.value(password);
+
+            yield* Schema.decodeEffect(
+              Schema.String.check(Schema.isMaxLength(policy.maximumBytes)),
+            )(raw).pipe(Effect.mapError(() => NewPasswordRejected.make({ reason: "too-long" })));
+            yield* Schema.decodeEffect(
+              Schema.String.check(Schema.isPattern(/^[^\uD800-\uDFFF]*$/u)),
+            )(raw).pipe(Effect.mapError(() => NewPasswordRejected.make({ reason: "ill-formed" })));
+            const value = policy.normalization === "NFC" ? raw.normalize("NFC") : raw;
+            const length = [...value].length;
+
+            if (length < (policy.assurance === "single-factor" ? 15 : 8))
+              return yield* NewPasswordRejected.make({ reason: "too-short" });
+            if (
+              length > policy.maximumCodePoints ||
+              new TextEncoder().encode(value).byteLength > policy.maximumBytes
+            )
+              return yield* NewPasswordRejected.make({ reason: "too-long" });
+            const normalized = Redacted.make(value);
+
+            const result = yield* Effect.suspend(() => screening(normalized, checkedContext)).pipe(
+              Effect.flatMap(Schema.decodeEffect(PasswordScreening)),
+              Effect.catchCause((cause) =>
+                reportAuthFailure("password-screening", cause).pipe(
+                  Effect.andThen(Effect.fail(PasswordCheckUnavailable.make({}))),
+                ),
+              ),
+            );
+
+            if (result._tag === "Rejected")
+              return yield* NewPasswordRejected.make({ reason: result.reason });
+
+            return Object.freeze({ password: normalized, normalization: policy.normalization });
+          }),
+        });
+      }),
+    );
+  };
+}

package/src/password/PasswordHashing.ts

@@ -0,0 +1,209 @@
+/* eslint-disable import/extensions -- Noble exposes these package subpaths only with the .js suffix. */
+import { equalBytes } from "@noble/ciphers/utils.js";
+import { argon2idAsync } from "@noble/hashes/argon2.js";
+import { pbkdf2Async } from "@noble/hashes/pbkdf2.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { Context, Crypto, Effect, Layer, Redacted, Schema } from "effect";
+
+import {
+  defaultPasswordHashingConfig,
+  validatePasswordHashingConfig,
+  type PasswordHashingConfig,
+} from "./configuration";
+import { parsePasswordHash, phcBase64 } from "./encoding";
+import {
+  PasswordHashingUnavailable,
+  PasswordInputInvalid,
+  type PasswordKdfBusy,
+  type PasswordVerifierInvalid,
+} from "./errors";
+import { EncodedPasswordHash, type PasswordVerification } from "./models";
+import { PasswordKdfAdmission } from "./PasswordKdfAdmission";
+
+const encoder = new TextEncoder();
+
+type HashFailure = PasswordHashingUnavailable | PasswordInputInvalid | PasswordKdfBusy;
+
+/** Byte-preserving KDF capability. Text normalization belongs to trusted credential
+ * provenance, never the algorithm identifier. Rehash legacy passwords with mode none.
+ * Replacements must retain admission until actual work completion, including native
+ * callbacks. Portable async KDFs yield microtasks; they are not off-thread workers.
+ */
+export class PasswordHashing extends Context.Service<
+  PasswordHashing,
+  {
+    readonly hash: (
+      password: Redacted.Redacted<string>,
+    ) => Effect.Effect<Redacted.Redacted<EncodedPasswordHash>, HashFailure>;
+    readonly verify: (
+      password: Redacted.Redacted<string>,
+      verifier: Redacted.Redacted<EncodedPasswordHash>,
+    ) => Effect.Effect<PasswordVerification, HashFailure | PasswordVerifierInvalid>;
+    /** One current-cost derivation, including on the first unknown-identifier attempt. */
+    readonly dummy: (password: Redacted.Redacted<string>) => Effect.Effect<void, HashFailure>;
+  }
+>()("effect-auth/PasswordHashing") {
+  static readonly portableLayer = (input: PasswordHashingConfig = defaultPasswordHashingConfig) => {
+    const snapshot = { ...input };
+
+    return Layer.effect(
+      this,
+      Effect.gen(function* () {
+        const config = yield* validatePasswordHashingConfig(snapshot);
+        const admission = yield* PasswordKdfAdmission;
+        const crypto = yield* Crypto.Crypto;
+
+        const passwordBytes = Effect.fn("PasswordHashing.passwordBytes")(function* (
+          password: Redacted.Redacted<string>,
+        ) {
+          const value = Redacted.value(password);
+
+          yield* Schema.decodeEffect(
+            Schema.String.check(Schema.isMaxLength(config.maximumPasswordBytes)),
+          )(value).pipe(Effect.mapError(() => PasswordInputInvalid.make({ reason: "too-long" })));
+          const buffer = new Uint8Array(config.maximumPasswordBytes);
+          const encoded = encoder.encodeInto(value, buffer);
+
+          if (encoded.read !== value.length) {
+            buffer.fill(0);
+
+            return yield* PasswordInputInvalid.make({ reason: "too-long" });
+          }
+
+          return buffer.subarray(0, encoded.written);
+        });
+
+        const derive = (
+          password: Uint8Array,
+          salt: Uint8Array,
+          memoryKiB: number,
+          passes: number,
+          parallelism: number,
+          length: number,
+        ) =>
+          Effect.tryPromise({
+            try: () =>
+              argon2idAsync(password, salt, {
+                m: memoryKiB,
+                t: passes,
+                p: parallelism,
+                version: 19,
+                dkLen: length,
+                maxmem: config.maximumMemoryKiB * 1024,
+                asyncTick: 10,
+              }),
+            catch: () => PasswordHashingUnavailable.make({}),
+          });
+
+        const withPassword = <A, E, P, E2>(
+          password: Redacted.Redacted<string>,
+          prepare: Effect.Effect<P, E2>,
+          body: (bytes: Uint8Array, prepared: P) => Effect.Effect<A, E>,
+        ) =>
+          admission.run(
+            Effect.gen(function* () {
+              const prepared = yield* prepare;
+              const bytes = yield* passwordBytes(password);
+
+              return yield* body(bytes, prepared).pipe(
+                Effect.ensuring(Effect.sync(() => bytes.fill(0))),
+              );
+            }),
+          );
+
+        return PasswordHashing.of({
+          hash: (password) =>
+            withPassword(password, Effect.void, (bytes) =>
+              Effect.gen(function* () {
+                const salt = yield* crypto
+                  .randomBytes(16)
+                  .pipe(Effect.mapError(() => PasswordHashingUnavailable.make({})));
+
+                const output = yield* derive(
+                  bytes,
+                  salt,
+                  config.memoryKiB,
+                  config.passes,
+                  config.parallelism,
+                  32,
+                );
+
+                try {
+                  return Redacted.make(
+                    EncodedPasswordHash.make(
+                      `$argon2id$v=19$m=${config.memoryKiB},t=${config.passes},p=${config.parallelism}$${phcBase64(salt)}$${phcBase64(output)}`,
+                    ),
+                  );
+                } finally {
+                  output.fill(0);
+                  salt.fill(0);
+                }
+              }),
+            ),
+          verify: (password, verifier) =>
+            withPassword(
+              password,
+              parsePasswordHash(Redacted.value(verifier), config),
+              (bytes, parsed) =>
+                Effect.gen(function* () {
+                  const output = yield* parsed._tag === "Argon2id"
+                    ? derive(
+                        bytes,
+                        parsed.salt,
+                        parsed.memoryKiB,
+                        parsed.passes,
+                        parsed.parallelism,
+                        parsed.expected.length,
+                      )
+                    : Effect.tryPromise({
+                        try: () =>
+                          pbkdf2Async(sha256, bytes, parsed.salt, {
+                            c: parsed.iterations,
+                            dkLen: 32,
+                            asyncTick: 10,
+                          }),
+                        catch: () => PasswordHashingUnavailable.make({}),
+                      });
+
+                  try {
+                    // Maintained fixed-length byte comparison; JavaScript/JIT gives no hard timing guarantee.
+                    const matches = equalBytes(output, parsed.expected);
+
+                    // Parallelism is a scheduling profile, not compensation for weak memory/passes.
+                    const upgrade =
+                      parsed._tag === "LegacyPbkdf2" ||
+                      parsed.memoryKiB < config.memoryKiB ||
+                      parsed.passes < config.passes ||
+                      parsed.salt.length < 16 ||
+                      parsed.expected.length < 32;
+
+                    return { matches, needsRehash: matches && upgrade };
+                  } finally {
+                    output.fill(0);
+                    parsed.expected.fill(0);
+                    parsed.salt.fill(0);
+                  }
+                }),
+            ),
+          dummy: (password) =>
+            withPassword(password, Effect.void, (bytes) =>
+              derive(
+                bytes,
+                new Uint8Array(16),
+                config.memoryKiB,
+                config.passes,
+                config.parallelism,
+                32,
+              ).pipe(
+                Effect.flatMap((output) =>
+                  Effect.sync(() => {
+                    output.fill(0);
+                  }),
+                ),
+              ),
+            ),
+        });
+      }),
+    );
+  };
+}

package/src/password/PasswordKdfAdmission.ts

@@ -0,0 +1,44 @@
+import { Context, Effect, Layer, Option, Schema, Semaphore } from "effect";
+
+import { PasswordConfigurationError, PasswordKdfBusy } from "./errors";
+
+/** Share ONE Layer instance across hashers in a runtime. This bounds actual
+ * nonabortable work, not distributed guesses. Callbacks must finish only after
+ * their underlying computation finishes: an already-detached Promise is unsafe.
+ * Work includes allocation, derive, comparison and cleanup. No waiting queue.
+ */
+export class PasswordKdfAdmission extends Context.Service<
+  PasswordKdfAdmission,
+  {
+    readonly run: <A, E, R>(
+      work: Effect.Effect<A, E, R>,
+    ) => Effect.Effect<A, E | PasswordKdfBusy, R>;
+  }
+>()("effect-auth/PasswordKdfAdmission") {
+  static readonly layer = (options: { readonly concurrency: number } = { concurrency: 1 }) => {
+    const concurrency = options.concurrency;
+
+    return Layer.effect(
+      this,
+      Effect.gen(function* () {
+        yield* Schema.decodeEffect(Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 32 })))(
+          concurrency,
+        ).pipe(Effect.mapError(() => PasswordConfigurationError.make({ component: "admission" })));
+        const semaphore = yield* Semaphore.make(concurrency);
+
+        return PasswordKdfAdmission.of({
+          run: <A, E, R>(work: Effect.Effect<A, E, R>) =>
+            semaphore
+              .withPermitsIfAvailable(1)(Effect.uninterruptible(work))
+              .pipe(
+                Effect.flatMap((result) =>
+                  Option.isSome(result)
+                    ? Effect.succeed(result.value)
+                    : Effect.fail(PasswordKdfBusy.make({})),
+                ),
+              ),
+        });
+      }),
+    );
+  };
+}

package/src/password/configuration.ts

@@ -0,0 +1,52 @@
+import { Effect, Schema } from "effect";
+
+import { PasswordConfigurationError } from "./errors";
+
+export const PasswordHashingConfig = Schema.Struct({
+  memoryKiB: Schema.Int.check(Schema.isBetween({ minimum: 19456, maximum: 65536 })),
+  passes: Schema.Int.check(Schema.isBetween({ minimum: 2, maximum: 6 })),
+  parallelism: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 4 })),
+  maximumMemoryKiB: Schema.Int.check(Schema.isBetween({ minimum: 19456, maximum: 65536 })),
+  maximumPasses: Schema.Int.check(Schema.isBetween({ minimum: 2, maximum: 6 })),
+  maximumParallelism: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 4 })),
+  maximumMemoryPasses: Schema.Int.check(Schema.isBetween({ minimum: 38912, maximum: 393216 })),
+  maximumLegacyIterations: Schema.Int.check(
+    Schema.isBetween({ minimum: 600000, maximum: 2000000 }),
+  ),
+  maximumPasswordBytes: Schema.Int.check(Schema.isBetween({ minimum: 256, maximum: 65536 })),
+});
+
+export type PasswordHashingConfig = typeof PasswordHashingConfig.Type;
+
+/** OWASP Argon2id minimum profile. Host CPU/memory allowances must fit this cost;
+ * runtime failures never cause an automatic downgrade. Limits are per permit.
+ */
+export const defaultPasswordHashingConfig: PasswordHashingConfig = Object.freeze({
+  memoryKiB: 19456,
+  passes: 2,
+  parallelism: 1,
+  maximumMemoryKiB: 65536,
+  maximumPasses: 6,
+  maximumParallelism: 4,
+  maximumMemoryPasses: 131072,
+  maximumLegacyIterations: 1000000,
+  maximumPasswordBytes: 16384,
+});
+
+export const validatePasswordHashingConfig = Effect.fn("validatePasswordHashingConfig")(function* (
+  input: PasswordHashingConfig,
+) {
+  const config = yield* Schema.decodeEffect(PasswordHashingConfig)(input).pipe(
+    Effect.mapError(() => PasswordConfigurationError.make({ component: "hashing" })),
+  );
+
+  if (
+    config.memoryKiB > config.maximumMemoryKiB ||
+    config.passes > config.maximumPasses ||
+    config.parallelism > config.maximumParallelism ||
+    config.memoryKiB * config.passes > config.maximumMemoryPasses
+  )
+    return yield* PasswordConfigurationError.make({ component: "hashing" });
+
+  return Object.freeze(config);
+});