@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/AuditLog.js

@@ -1,5 +1,7 @@
-import { Context, Data, Effect, Layer } from "effect";
-import { currentUnixMillis } from "./Internal.js";
+import { Context, Data, Effect, Layer, Option, Ref, Schema } from "effect";
+import { AuditEventIdSchema, ChallengeIdSchema, CredentialIdSchema, EmailHashSchema, IdentityIdSchema, IpHashSchema, OAuthAccountIdSchema, OAuthProviderIdSchema, PermissionIdSchema, PolicyIdSchema, RoleIdSchema, SessionIdSchema, UnixMillisSchema, UserAgentHashSchema, UserIdSchema, } from "./Identifiers.js";
+import { compareUtf8Bytes, currentUnixMillis } from "./Internal.js";
+import { WaitUntil } from "./WaitUntil.js";
 export class AuditLogError extends Data.TaggedError("AuditLogError") {
 }
 export class AuditLogStoreError extends Data.TaggedError("AuditLogStoreError") {
@@ -11,45 +13,485 @@ export const AuditActor = {
         userId: input.userId,
         ...(input.sessionId === undefined ? {} : { sessionId: input.sessionId }),
     }),
+    custom: (input) => ({
+        type: "custom",
+        actorType: input.actorType,
+        ...(input.actorReference === undefined
+            ? {}
+            : { actorReference: input.actorReference }),
+    }),
 };
+export const AuditActorSchema = Schema.Union([
+    Schema.Struct({ type: Schema.Literal("anonymous") }),
+    Schema.Struct({
+        type: Schema.Literal("user"),
+        userId: UserIdSchema,
+        sessionId: Schema.optional(SessionIdSchema),
+    }),
+    Schema.Struct({
+        type: Schema.Literal("custom"),
+        actorType: Schema.String,
+        actorReference: Schema.optional(Schema.String),
+    }),
+]);
 export const AuditSubject = {
     anonymous: () => ({ type: "anonymous" }),
     email: (emailHash) => ({ type: "email", emailHash }),
     user: (userId) => ({ type: "user", userId }),
 };
+export const AuditSubjectSchema = Schema.Union([
+    Schema.Struct({ type: Schema.Literal("anonymous") }),
+    Schema.Struct({ type: Schema.Literal("email"), emailHash: EmailHashSchema }),
+    Schema.Struct({ type: Schema.Literal("user"), userId: UserIdSchema }),
+]);
+export const AuditRequestSchema = Schema.Struct({
+    ipHash: Schema.optional(IpHashSchema),
+    userAgentHash: Schema.optional(UserAgentHashSchema),
+});
+const AuditEventBaseSchema = {
+    id: Schema.optional(AuditEventIdSchema),
+    request: Schema.optional(AuditRequestSchema),
+    occurredAt: UnixMillisSchema,
+};
+const ActorAuditEventBaseSchema = {
+    ...AuditEventBaseSchema,
+    actor: AuditActorSchema,
+};
+const AuthorizationAuditSubjectSchema = Schema.Union([
+    Schema.Struct({ type: Schema.Literal("user"), userId: UserIdSchema }),
+    Schema.Struct({
+        type: Schema.Literal("custom"),
+        subjectType: Schema.String,
+        subjectReference: Schema.optional(Schema.String),
+    }),
+]);
+const AuthorizationAuditScopeSchema = Schema.Struct({
+    type: Schema.String,
+    reference: Schema.optional(Schema.String),
+});
+const IdentityScopeSchema = Schema.Union([
+    Schema.Struct({ type: Schema.Literal("global") }),
+    Schema.Struct({ type: Schema.Literal("tenant"), tenantId: Schema.String }),
+]);
+const ApiKeyIdSchema = Schema.String.pipe(Schema.brand("auth/ApiKeyId"));
+const PasskeyCredentialIdSchema = Schema.String.pipe(Schema.brand("auth/PasskeyCredentialId"));
+const RefreshTokenIdSchema = Schema.String.pipe(Schema.brand("auth/RefreshTokenId"));
+const RefreshTokenFamilyIdSchema = Schema.String.pipe(Schema.brand("auth/RefreshTokenFamilyId"));
+const AssuranceTransitionSchema = {
+    ...ActorAuditEventBaseSchema,
+    type: Schema.Literals([
+        "auth.session.assurance_changed",
+        "auth.session.step_up_completed",
+        "auth.session.primary_reauthenticated",
+        "auth.session.recovery_remediation.entered",
+        "auth.session.recovery_remediation.completed",
+    ]),
+    userId: UserIdSchema,
+    sessionId: SessionIdSchema,
+    oldAal: Schema.Literals(["aal1", "aal2", "aal3"]),
+    newAal: Schema.Literals(["aal1", "aal2", "aal3"]),
+    amr: Schema.Array(Schema.String),
+    method: Schema.String,
+    rotatedAt: UnixMillisSchema,
+    requirementsEntered: Schema.Array(Schema.String),
+    requirementsCleared: Schema.Array(Schema.String),
+};
+const LoginRiskAssessmentSchema = Schema.Struct({
+    userId: UserIdSchema,
+    method: Schema.String,
+    amr: Schema.Array(Schema.String),
+    aal: Schema.Literals(["aal1", "aal2", "aal3"]),
+    device: Schema.Struct({
+        status: Schema.Literals(["known", "new", "unknown"]),
+    }),
+    risk: Schema.Struct({
+        level: Schema.Literals(["unknown", "low", "medium", "high", "critical"]),
+        signals: Schema.Array(Schema.Struct({
+            type: Schema.String,
+            level: Schema.optional(Schema.Literals(["unknown", "low", "medium", "high", "critical"])),
+        })),
+    }),
+    metadata: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+});
+const IncidentActionResultSchema = Schema.Struct({
+    userId: UserIdSchema,
+    reason: Schema.optional(Schema.String),
+    sessions: Schema.optional(Schema.Struct({
+        revokedAll: Schema.Literal(true),
+        activeBefore: Schema.Number,
+        sessionIds: Schema.Array(SessionIdSchema),
+    })),
+    trustedDevices: Schema.optional(Schema.Struct({
+        revoked: Schema.Number,
+        deviceIds: Schema.Array(Schema.String),
+    })),
+    apiKeys: Schema.optional(Schema.Struct({
+        revoked: Schema.Number,
+        keyIds: Schema.Array(ApiKeyIdSchema),
+    })),
+    refreshTokens: Schema.optional(Schema.Struct({
+        revokedFamilies: Schema.Number,
+        activeBefore: Schema.Number,
+        tokenIds: Schema.Array(RefreshTokenIdSchema),
+        familyIds: Schema.Array(RefreshTokenFamilyIdSchema),
+    })),
+});
+export const AuthAuditEventSchema = Schema.Union([
+    Schema.Struct(AssuranceTransitionSchema),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.permission_definition.created"),
+        permissionId: PermissionIdSchema,
+        scopeType: Schema.optional(Schema.String),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.permission_definition.updated"),
+        permissionId: PermissionIdSchema,
+        scopeType: Schema.optional(Schema.String),
+        changedFields: Schema.Array(Schema.Literals(["description", "scopeType"])),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals([
+            "auth.permission_definition.disabled",
+            "auth.permission_definition.enabled",
+            "auth.permission_definition.deleted",
+        ]),
+        permissionId: PermissionIdSchema,
+        scopeType: Schema.optional(Schema.String),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.role_definition.created"),
+        roleId: RoleIdSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.role_definition.updated"),
+        roleId: RoleIdSchema,
+        changedFields: Schema.Array(Schema.Literal("description")),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals([
+            "auth.role_definition.disabled",
+            "auth.role_definition.enabled",
+            "auth.role_definition.deleted",
+        ]),
+        roleId: RoleIdSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.permission.granted"),
+        subject: AuthorizationAuditSubjectSchema,
+        permissionId: PermissionIdSchema,
+        scope: Schema.optional(AuthorizationAuditScopeSchema),
+        expiresAt: Schema.optional(UnixMillisSchema),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.permission.revoked"),
+        subject: AuthorizationAuditSubjectSchema,
+        permissionId: PermissionIdSchema,
+        scope: Schema.optional(AuthorizationAuditScopeSchema),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.role.granted"),
+        subject: AuthorizationAuditSubjectSchema,
+        roleId: RoleIdSchema,
+        scope: Schema.optional(AuthorizationAuditScopeSchema),
+        expiresAt: Schema.optional(UnixMillisSchema),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.role.revoked"),
+        subject: AuthorizationAuditSubjectSchema,
+        roleId: RoleIdSchema,
+        scope: Schema.optional(AuthorizationAuditScopeSchema),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals([
+            "auth.role_permission.assigned",
+            "auth.role_permission.removed",
+        ]),
+        roleId: RoleIdSchema,
+        permissionId: PermissionIdSchema,
+        scopeType: Schema.optional(Schema.String),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals([
+            "auth.identity.added",
+            "auth.identity.primary_changed",
+        ]),
+        userId: UserIdSchema,
+        identityId: IdentityIdSchema,
+        kind: Schema.String,
+        scope: IdentityScopeSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.identity.replaced"),
+        userId: UserIdSchema,
+        identityId: IdentityIdSchema,
+        replacementIdentityId: IdentityIdSchema,
+        kind: Schema.String,
+        scope: IdentityScopeSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.identity.revoked"),
+        userId: UserIdSchema,
+        identityId: IdentityIdSchema,
+        kind: Schema.String,
+        scope: IdentityScopeSchema,
+        reason: Schema.optional(Schema.String),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.login.succeeded"),
+        method: Schema.String,
+    }),
+    Schema.Struct({
+        ...AuditEventBaseSchema,
+        type: Schema.Literal("auth.login.failed"),
+        subject: AuditSubjectSchema,
+        method: Schema.String,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.session.revoked"),
+        sessionId: SessionIdSchema,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.risk.assessed"),
+        assessment: LoginRiskAssessmentSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.policy.denied"),
+        policyId: PolicyIdSchema,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals([
+            "auth.oauth.account.linked",
+            "auth.oauth.account.unlinked",
+        ]),
+        userId: UserIdSchema,
+        accountId: OAuthAccountIdSchema,
+        providerId: OAuthProviderIdSchema,
+        providerAccountId: Schema.String,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals([
+            "auth.oauth.link_confirmation.started",
+            "auth.oauth.link_confirmation.confirmed",
+        ]),
+        userId: UserIdSchema,
+        challengeId: ChallengeIdSchema,
+        providerId: OAuthProviderIdSchema,
+        providerAccountId: Schema.String,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.oauth.provider_token.refreshed"),
+        userId: UserIdSchema,
+        accountId: OAuthAccountIdSchema,
+        providerId: OAuthProviderIdSchema,
+        providerAccountId: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.oauth.provider_token.revoked"),
+        userId: UserIdSchema,
+        accountId: OAuthAccountIdSchema,
+        providerId: OAuthProviderIdSchema,
+        providerAccountId: Schema.String,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.passkey.credential.revoked"),
+        userId: UserIdSchema,
+        credentialId: PasskeyCredentialIdSchema,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals([
+            "auth.totp.enrollment.started",
+            "auth.totp.factor.confirmed",
+            "auth.totp.factor.verified",
+        ]),
+        userId: UserIdSchema,
+        factorId: CredentialIdSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.totp.factor.revoked"),
+        userId: UserIdSchema,
+        factorId: CredentialIdSchema,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.recovery_code.generated"),
+        userId: UserIdSchema,
+        count: Schema.Number,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.recovery_code.verified"),
+        userId: UserIdSchema,
+        codeId: CredentialIdSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.recovery_code.revoked"),
+        userId: UserIdSchema,
+        codeId: CredentialIdSchema,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literals(["auth.api_key.created", "auth.api_key.verified"]),
+        userId: UserIdSchema,
+        keyId: ApiKeyIdSchema,
+        scopes: Schema.Array(Schema.String),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.api_key.revoked"),
+        userId: UserIdSchema,
+        keyId: ApiKeyIdSchema,
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.api_key.verification_failed"),
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.refresh_token.issued"),
+        userId: UserIdSchema,
+        tokenId: RefreshTokenIdSchema,
+        familyId: RefreshTokenFamilyIdSchema,
+        expiresAt: UnixMillisSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.refresh_token.rotated"),
+        userId: UserIdSchema,
+        previousTokenId: RefreshTokenIdSchema,
+        tokenId: RefreshTokenIdSchema,
+        familyId: RefreshTokenFamilyIdSchema,
+        expiresAt: UnixMillisSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.refresh_token.reuse_detected"),
+        userId: UserIdSchema,
+        tokenId: RefreshTokenIdSchema,
+        familyId: RefreshTokenFamilyIdSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.refresh_token.revoked"),
+        userId: UserIdSchema,
+        familyId: RefreshTokenFamilyIdSchema,
+        tokenId: Schema.optional(RefreshTokenIdSchema),
+        reason: Schema.String,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.incident_action.executed"),
+        userId: UserIdSchema,
+        result: IncidentActionResultSchema,
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.jwt.introspected"),
+        active: Schema.Boolean,
+        jwtId: Schema.optional(Schema.String),
+        expiresAt: Schema.optional(UnixMillisSchema),
+        reason: Schema.optional(Schema.String),
+    }),
+    Schema.Struct({
+        ...ActorAuditEventBaseSchema,
+        type: Schema.Literal("auth.jwt.revoked"),
+        jwtId: Schema.String,
+        expiresAt: Schema.optional(UnixMillisSchema),
+        reason: Schema.String,
+    }),
+]);
+const CustomAuditEventFields = {
+    type: Schema.TemplateLiteral(["app.", Schema.String]),
+    version: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
+    id: Schema.optional(AuditEventIdSchema),
+    actor: AuditActorSchema,
+    subject: Schema.optional(AuditSubjectSchema),
+    request: Schema.optional(AuditRequestSchema),
+    payload: Schema.Record(Schema.String, Schema.Unknown),
+    occurredAt: UnixMillisSchema,
+};
+export class CustomAuditEvent extends Schema.Class("CustomAuditEvent")(CustomAuditEventFields) {
+}
+export const CustomAuditEventSchema = Schema.Struct(CustomAuditEventFields);
+export const isCustomAuditEvent = Schema.is(CustomAuditEventSchema);
+export const AuditEventSchema = Schema.Union([
+    AuthAuditEventSchema,
+    CustomAuditEventSchema,
+]);
+const decodeAuditEventUnknown = Schema.decodeUnknownSync(AuditEventSchema);
+export const decodeAuditEvent = (input) => decodeAuditEventUnknown(input);
+export const isAuthAuditEvent = (event) => event.type.startsWith("auth.");
 export class AuditLog extends Context.Service()("auth/AuditLog") {
 }
-(function (AuditLog) {
-    AuditLog.make = (service) => AuditLog.of(service);
-})(AuditLog || (AuditLog = {}));
 export class AuditLogStore extends Context.Service()("auth/AuditLogStore") {
 }
-(function (AuditLogStore) {
-    AuditLogStore.make = (service) => AuditLogStore.of(service);
-})(AuditLogStore || (AuditLogStore = {}));
 const occurredAt = (value) => value === undefined ? currentUnixMillis : Effect.succeed(value);
 const clone = (value) => structuredClone(value);
 export const auditEventUserId = (event) => {
-    if ("userId" in event) {
+    if (isAuthAuditEvent(event) && "userId" in event) {
         return event.userId;
     }
-    if (event.type === "auth.risk.assessed") {
+    if (isAuthAuditEvent(event) && event.type === "auth.risk.assessed") {
         return event.assessment.userId;
     }
-    if ("subject" in event && event.subject.type === "user") {
-        return event.subject.userId;
+    if ("subject" in event && event.subject !== undefined) {
+        const { subject } = event;
+        if (subject.type === "user") {
+            return subject.userId;
+        }
     }
     if ("actor" in event && event.actor.type === "user") {
         return event.actor.userId;
     }
     return undefined;
 };
-export const auditEventActorUserId = (event) => "actor" in event && event.actor.type === "user" ? event.actor.userId : undefined;
+export const auditEventActorUserId = (event) => "actor" in event && event.actor.type === "user"
+    ? event.actor.userId
+    : undefined;
 const compareAuditEvents = (left, right) => {
     const occurredAtDifference = Number(right.occurredAt) - Number(left.occurredAt);
-    return occurredAtDifference === 0
-        ? String(right.id ?? "").localeCompare(String(left.id ?? ""))
-        : occurredAtDifference;
+    const leftId = String(left.id ?? "");
+    const rightId = String(right.id ?? "");
+    if (occurredAtDifference !== 0 || leftId === rightId) {
+        return occurredAtDifference;
+    }
+    return -compareUtf8Bytes(leftId, rightId);
 };
 const insertSortedAuditEvent = (events, event) => {
     const index = events.findIndex((existing) => compareAuditEvents(event, existing) < 0);
@@ -69,23 +511,25 @@ export const filterAuditLogEvents = (events, input = {}) => {
     const beforeOccurredAt = input.beforeOccurredAt === undefined
         ? undefined
         : Number(input.beforeOccurredAt);
-    const limit = input.limit === undefined ? undefined : Math.max(0, Math.floor(input.limit));
+    const limit = input.limit === undefined
+        ? undefined
+        : Math.max(0, Math.floor(input.limit));
     const filtered = [...events]
         .filter((event) => input.userId === undefined || auditEventUserId(event) === input.userId)
-        .filter((event) => beforeOccurredAt === undefined || Number(event.occurredAt) < beforeOccurredAt)
+        .filter((event) => beforeOccurredAt === undefined ||
+        Number(event.occurredAt) < beforeOccurredAt)
         .filter((event) => types === undefined || types.has(event.type));
     const sorted = sortAuditEvents(filtered).map(clone);
     return limit === undefined ? sorted : sorted.slice(0, limit);
 };
-const auditLogStoreErrorToAuditLogError = (cause) => new AuditLogError({
-    message: "Audit log store insert failed",
-    cause,
-});
-export const makeAuditLogFromStore = (store) => AuditLog.make({
-    emit: (event) => store.insert(event).pipe(Effect.mapError(auditLogStoreErrorToAuditLogError)),
-});
-export const emit = (event) => AuditLog.use((auditLog) => auditLog.emit(event));
-export const insertAuditLogEvent = (event) => AuditLogStore.use((store) => store.insert(event));
+export const emit = (event) => Effect.serviceOption(AuditLog).pipe(Effect.flatMap(Option.match({
+    onNone: () => Effect.void,
+    onSome: (auditLog) => auditLog
+        .emit(event)
+        .pipe(Effect.catchTag("AuditLogError", (error) => Effect.logError("Audit log emit failed", error))),
+})));
+export const emitRequired = (event) => AuditLog.use((auditLog) => auditLog.emit(event));
+export const insertAuditLogEvents = (events) => AuditLogStore.use((store) => store.insertMany(events));
 export const listAuditLogEvents = (input = {}) => AuditLogStore.use((store) => store.list(input));
 export const deleteAuditLogEventsBefore = (input) => AuditLogStore.use((store) => store.deleteBefore(input));
 export const loginSucceeded = (input) => Effect.gen(function* () {
@@ -95,6 +539,17 @@ export const loginSucceeded = (input) => Effect.gen(function* () {
         occurredAt: yield* occurredAt(input.occurredAt),
     });
 });
+const identityEvent = (type, input) => occurredAt(input.occurredAt).pipe(Effect.flatMap((at) => emit({ ...input, type, occurredAt: at })));
+export const identityAdded = (input) => identityEvent("auth.identity.added", input);
+export const identityReplaced = (input) => identityEvent("auth.identity.replaced", input);
+export const identityRevoked = (input) => identityEvent("auth.identity.revoked", input);
+export const identityPrimaryChanged = (input) => identityEvent("auth.identity.primary_changed", input);
+const assuranceEvent = (type, input) => occurredAt(input.occurredAt).pipe(Effect.flatMap((at) => emit({ ...input, type, occurredAt: at })));
+export const sessionAssuranceChanged = (input) => assuranceEvent("auth.session.assurance_changed", input);
+export const sessionStepUpCompleted = (input) => assuranceEvent("auth.session.step_up_completed", input);
+export const sessionPrimaryReauthenticated = (input) => assuranceEvent("auth.session.primary_reauthenticated", input);
+export const recoveryRemediationEntered = (input) => assuranceEvent("auth.session.recovery_remediation.entered", input);
+export const recoveryRemediationCompleted = (input) => assuranceEvent("auth.session.recovery_remediation.completed", input);
 export const loginFailed = (input) => Effect.gen(function* () {
     return yield* emit({
         ...input,
@@ -300,9 +755,9 @@ export const jwtRevoked = (input) => Effect.gen(function* () {
 });
 export const makeAuditLogStoreMemory = () => {
     const events = [];
-    return AuditLogStore.make({
-        insert: (event) => Effect.sync(() => {
-            events.push(clone(event));
+    return AuditLogStore.of({
+        insertMany: (batch) => Effect.sync(() => {
+            events.push(...batch.map(clone));
         }),
         list: (input = {}) => Effect.sync(() => filterAuditLogEvents(events, input)),
         deleteBefore: (input) => Effect.sync(() => {
@@ -310,7 +765,8 @@ export const makeAuditLogStoreMemory = () => {
             let deleted = 0;
             for (const event of events) {
                 if (Number(event.occurredAt) < Number(input.beforeOccurredAt) &&
-                    (input.userId === undefined || auditEventUserId(event) === input.userId)) {
+                    (input.userId === undefined ||
+                        auditEventUserId(event) === input.userId)) {
                     deleted += 1;
                     continue;
                 }
@@ -322,8 +778,30 @@ export const makeAuditLogStoreMemory = () => {
     });
 };
 export const AuditLogStoreMemoryLive = Layer.sync(AuditLogStore, makeAuditLogStoreMemory);
-export const AuditLogFromStoreLive = Layer.effect(AuditLog)(AuditLogStore.use((store) => Effect.succeed(makeAuditLogFromStore(store))));
-export const AuditLogNoopLive = Layer.succeed(AuditLog)(AuditLog.make({
+export const AuditLogLive = Layer.effect(AuditLog)(Effect.gen(function* () {
+    const store = yield* AuditLogStore;
+    const waitUntil = yield* Effect.serviceOption(WaitUntil);
+    const events = yield* Ref.make([]);
+    yield* Effect.addFinalizer(() => Ref.getAndSet(events, []).pipe(Effect.flatMap((batch) => {
+        if (batch.length === 0) {
+            return Effect.void;
+        }
+        const flush = store.insertMany(batch);
+        return Option.isSome(waitUntil)
+            ? waitUntil.value.waitUntil(flush).pipe(Effect.mapError((cause) => new AuditLogError({
+                message: "Audit log batch scheduling failed",
+                cause,
+            })))
+            : flush.pipe(Effect.mapError((cause) => new AuditLogError({
+                message: "Audit log batch flush failed",
+                cause,
+            })));
+    }), Effect.catch(() => Effect.logError("Audit log batch flush failed"))));
+    return AuditLog.of({
+        emit: (event) => Ref.update(events, (batch) => [...batch, clone(event)]),
+    });
+}));
+export const AuditLogNoopLive = Layer.succeed(AuditLog)(AuditLog.of({
     emit: () => Effect.void,
 }));
 //# sourceMappingURL=AuditLog.js.map