@yielded/auth 0.1.0-beta.1

package/dist/sessions/AuthenticationAuthority.mjs

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+//#region src/sessions/AuthenticationAuthority.ts
+/** Subject status, factor policy, and revision are owned by the consumer's identity authority. */
+var AuthenticationAuthority = class extends Context.Service()("effect-auth/AuthenticationAuthority") {};
+//#endregion
+export { AuthenticationAuthority };
+
+//# sourceMappingURL=AuthenticationAuthority.mjs.map

package/dist/sessions/AuthenticationAuthority.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationAuthority.mjs","names":[],"sources":["../../src/sessions/AuthenticationAuthority.ts"],"sourcesContent":["import { Context, type DateTime, type Effect } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport type { SubjectId } from \"../Schema\";\nimport type { PrepareSessionCommit } from \"./commit\";\nimport type {\n  PendingAuthenticationInvalid,\n  SessionUnavailable,\n  StaleAuthentication,\n} from \"./errors\";\nimport type {\n  AuthenticationEvidence,\n  AuthenticationRequirement,\n  AuthenticationRevision,\n  PendingConsumption,\n} from \"./models\";\n\n/** Subject status, factor policy, and revision are owned by the consumer's identity authority. */\nexport class AuthenticationAuthority extends Context.Service<\n  AuthenticationAuthority,\n  {\n    /** Before verification, read active subject + these independently resolved credential IDs. */\n    readonly capture: (\n      subjectId: SubjectId,\n      credentialIds: ReadonlyArray<string>,\n    ) => Effect.Effect<AuthenticationRevision, StaleAuthentication | SessionUnavailable>;\n    /** Reject unless the captured revision is still current; never refresh old evidence's revision. */\n    readonly requirements: (\n      evidence: AuthenticationEvidence,\n    ) => Effect.Effect<AuthenticationRequirement, StaleAuthentication | SessionUnavailable>;\n    /**\n     * Linearization point for fresh signed-session authentication. Check active\n     * subject, current factor policy/freshness, unexpired issuance, and exactly these revisions, consuming pending state in the same\n     * commit when provided. Re-read the clock at the conditional commit, never rely\n     * solely on the caller's pre-hook timestamp. Stateless verification and renewal never call this.\n     */\n    readonly approve: <A>(\n      input: {\n        readonly evidence: AuthenticationEvidence;\n        readonly now: DateTime.Utc;\n        readonly expiresAt: DateTime.Utc;\n        readonly absoluteExpiresAt: DateTime.Utc;\n        readonly pending?: PendingConsumption;\n      },\n      prepare: PrepareSessionCommit<void, A>,\n    ) => Effect.Effect<\n      PreparedCommit<A>,\n      StaleAuthentication | PendingAuthenticationInvalid | SessionUnavailable\n    >;\n  }\n>()(\"effect-auth/AuthenticationAuthority\") {}\n"],"mappings":";;;AAkBA,IAAa,0BAAb,cAA6C,QAAQ,QAgCnD,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC"}

package/dist/sessions/PendingAuthentication.d.mts

@@ -0,0 +1,108 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthenticationEvidence, SecurityRevision } from "./models.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { PrepareSessionCommit } from "./commit.mjs";
+import { PendingAuthenticationInvalid, SessionConflict, SessionUnavailable, StaleAuthentication } from "./errors.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/sessions/PendingAuthentication.d.ts
+interface PendingAuthenticationState {
+  readonly digest: TokenDigest;
+  readonly version: SecurityRevision;
+  readonly evidence: AuthenticationEvidence;
+  readonly expiresAt: DateTime.Utc;
+  readonly attemptLimit: number;
+}
+interface PendingAuthenticationRecord<Claims> extends PendingAuthenticationState {
+  readonly claims: Claims;
+}
+/** Internal correlation for an independently verified additional factor. This is
+ * neither a session nor reusable authorization; final completion rechecks it. */
+declare const PendingAuthenticationContext: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly expiresAtMillis: Schema.Int;
+}>;
+type PendingAuthenticationContext = typeof PendingAuthenticationContext.Type;
+/** Detaches the entire graph and projects away storage/private fields. */
+declare const snapshotPendingAuthenticationContext: (input: {
+  readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly expiresAtMillis: number;
+}) => Effect.Effect<Readonly<{
+  flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  expiresAtMillis: number;
+  revision: Readonly<{
+    subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    credentials: readonly Readonly<{
+      credentialId: string;
+      revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }>[];
+  }>;
+}>, PendingAuthenticationInvalid, never>;
+declare const pendingAuthenticationContext: (record: PendingAuthenticationState) => Effect.Effect<Readonly<{
+  flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  expiresAtMillis: number;
+  revision: Readonly<{
+    subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    credentials: readonly Readonly<{
+      credentialId: string;
+      revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }>[];
+  }>;
+}>, PendingAuthenticationInvalid, never>;
+/** Optional MFA persistence; minimal single-factor sessions do not require this capability. */
+interface PendingAuthentication<Claims> {
+  /** Authoritative non-consuming private-bearer lookup. Reject expired, consumed,
+   * exhausted, stale or inactive subject/credential state. Do not decode Claims.
+   * Locks end at this read; final completion must recheck after factor verification.
+   */
+  readonly context: (input: {
+    readonly digest: TokenDigest;
+    readonly now: DateTime.Utc;
+  }) => Effect.Effect<PendingAuthenticationContext, PendingAuthenticationInvalid | SessionUnavailable>;
+  /** Conditional on active subject and original revisions, unique by initiating flow.
+   * Duplicate flow MUST fail SessionConflict. Interactive owners reject before
+   * prepare. Ordered-batch owners may prepare speculatively during a concurrent
+   * race, but MUST discard the losing receipt and events. Never return an existing
+   * record paired with this attempt's newly generated secret.
+   */
+  readonly create: <A>(input: Omit<PendingAuthenticationRecord<Claims>, "version">, now: DateTime.Utc, prepare: PrepareSessionCommit<PendingAuthenticationRecord<Claims>, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionConflict | SessionUnavailable>;
+  /** Authoritative expiry, binding, revision, consumed status, and budget checks. */
+  readonly read: (input: {
+    readonly digest: TokenDigest;
+    readonly bindingDigest: TokenDigest;
+    readonly now: DateTime.Utc;
+  }) => Effect.Effect<PendingAuthenticationRecord<Claims>, PendingAuthenticationInvalid | SessionUnavailable>;
+  /** Prepare a rejection VALUE; translate it to a public failure only after the root
+   * receipt commits, so outer rollback/error translation cannot erase attempts. */
+  readonly reject: <A>(input: {
+    readonly digest: TokenDigest;
+    readonly bindingDigest: TokenDigest;
+    readonly now: DateTime.Utc;
+  }, prepare: PrepareSessionCommit<{
+    readonly _tag: "Rejected";
+  }, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable>;
+}
+//#endregion
+export { PendingAuthentication, PendingAuthenticationContext, PendingAuthenticationRecord, PendingAuthenticationState, pendingAuthenticationContext, snapshotPendingAuthenticationContext };
+//# sourceMappingURL=PendingAuthentication.d.mts.map

package/dist/sessions/PendingAuthentication.mjs

@@ -0,0 +1,40 @@
+import { TokenDigest } from "../Schema.mjs";
+import { PendingAuthenticationInvalid } from "./errors.mjs";
+import { AuthenticationFlowId, AuthenticationRevision } from "./models.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/sessions/PendingAuthentication.ts
+/** Internal correlation for an independently verified additional factor. This is
+* neither a session nor reusable authorization; final completion rechecks it. */
+const PendingAuthenticationContext = Schema.Struct({
+	flowId: AuthenticationFlowId,
+	bindingDigest: TokenDigest,
+	revision: AuthenticationRevision,
+	expiresAtMillis: Schema.Int
+});
+/** Detaches the entire graph and projects away storage/private fields. */
+const snapshotPendingAuthenticationContext = Effect.fn("snapshotPendingAuthenticationContext")(function* (input) {
+	const value = yield* Schema.decodeEffect(PendingAuthenticationContext)(input).pipe(Effect.mapError(() => PendingAuthenticationInvalid.make({})));
+	return Object.freeze({
+		flowId: value.flowId,
+		bindingDigest: value.bindingDigest,
+		expiresAtMillis: value.expiresAtMillis,
+		revision: Object.freeze({
+			subjectId: value.revision.subjectId,
+			securityRevision: value.revision.securityRevision,
+			credentials: Object.freeze(value.revision.credentials.map((item) => Object.freeze({
+				credentialId: item.credentialId,
+				revision: item.revision
+			})))
+		})
+	});
+});
+const pendingAuthenticationContext = (record) => snapshotPendingAuthenticationContext({
+	flowId: record.evidence.flowId,
+	bindingDigest: record.evidence.bindingDigest,
+	revision: record.evidence.revision,
+	expiresAtMillis: DateTime.toEpochMillis(record.expiresAt)
+});
+//#endregion
+export { PendingAuthenticationContext, pendingAuthenticationContext, snapshotPendingAuthenticationContext };
+
+//# sourceMappingURL=PendingAuthentication.mjs.map

package/dist/sessions/PendingAuthentication.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PendingAuthentication.mjs","names":[],"sources":["../../src/sessions/PendingAuthentication.ts"],"sourcesContent":["import { DateTime, Effect, Schema } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport { TokenDigest } from \"../Schema\";\nimport type { PrepareSessionCommit } from \"./commit\";\nimport {\n  PendingAuthenticationInvalid,\n  type SessionConflict,\n  type SessionUnavailable,\n  type StaleAuthentication,\n} from \"./errors\";\nimport {\n  AuthenticationFlowId,\n  AuthenticationRevision,\n  type AuthenticationEvidence,\n  type SecurityRevision,\n} from \"./models\";\n\nexport interface PendingAuthenticationState {\n  readonly digest: TokenDigest;\n  readonly version: SecurityRevision;\n  readonly evidence: AuthenticationEvidence;\n  readonly expiresAt: DateTime.Utc;\n  readonly attemptLimit: number;\n}\n\nexport interface PendingAuthenticationRecord<Claims> extends PendingAuthenticationState {\n  readonly claims: Claims;\n}\n\n/** Internal correlation for an independently verified additional factor. This is\n * neither a session nor reusable authorization; final completion rechecks it. */\nexport const PendingAuthenticationContext = Schema.Struct({\n  flowId: AuthenticationFlowId,\n  bindingDigest: TokenDigest,\n  revision: AuthenticationRevision,\n  expiresAtMillis: Schema.Int,\n});\n\nexport type PendingAuthenticationContext = typeof PendingAuthenticationContext.Type;\n\n/** Detaches the entire graph and projects away storage/private fields. */\nexport const snapshotPendingAuthenticationContext = Effect.fn(\n  \"snapshotPendingAuthenticationContext\",\n)(function* (input: PendingAuthenticationContext) {\n  const value = yield* Schema.decodeEffect(PendingAuthenticationContext)(input).pipe(\n    Effect.mapError(() => PendingAuthenticationInvalid.make({})),\n  );\n\n  return Object.freeze({\n    flowId: value.flowId,\n    bindingDigest: value.bindingDigest,\n    expiresAtMillis: value.expiresAtMillis,\n    revision: Object.freeze({\n      subjectId: value.revision.subjectId,\n      securityRevision: value.revision.securityRevision,\n      credentials: Object.freeze(\n        value.revision.credentials.map((item) =>\n          Object.freeze({\n            credentialId: item.credentialId,\n            revision: item.revision,\n          }),\n        ),\n      ),\n    }),\n  });\n});\n\nexport const pendingAuthenticationContext = (record: PendingAuthenticationState) =>\n  snapshotPendingAuthenticationContext({\n    flowId: record.evidence.flowId,\n    bindingDigest: record.evidence.bindingDigest,\n    revision: record.evidence.revision,\n    expiresAtMillis: DateTime.toEpochMillis(record.expiresAt),\n  });\n\n/** Optional MFA persistence; minimal single-factor sessions do not require this capability. */\nexport interface PendingAuthentication<Claims> {\n  /** Authoritative non-consuming private-bearer lookup. Reject expired, consumed,\n   * exhausted, stale or inactive subject/credential state. Do not decode Claims.\n   * Locks end at this read; final completion must recheck after factor verification.\n   */\n  readonly context: (input: {\n    readonly digest: TokenDigest;\n    readonly now: DateTime.Utc;\n  }) => Effect.Effect<\n    PendingAuthenticationContext,\n    PendingAuthenticationInvalid | SessionUnavailable\n  >;\n\n  /** Conditional on active subject and original revisions, unique by initiating flow.\n   * Duplicate flow MUST fail SessionConflict. Interactive owners reject before\n   * prepare. Ordered-batch owners may prepare speculatively during a concurrent\n   * race, but MUST discard the losing receipt and events. Never return an existing\n   * record paired with this attempt's newly generated secret.\n   */\n  readonly create: <A>(\n    input: Omit<PendingAuthenticationRecord<Claims>, \"version\">,\n    now: DateTime.Utc,\n    prepare: PrepareSessionCommit<PendingAuthenticationRecord<Claims>, A>,\n  ) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionConflict | SessionUnavailable>;\n  /** Authoritative expiry, binding, revision, consumed status, and budget checks. */\n  readonly read: (input: {\n    readonly digest: TokenDigest;\n    readonly bindingDigest: TokenDigest;\n    readonly now: DateTime.Utc;\n  }) => Effect.Effect<\n    PendingAuthenticationRecord<Claims>,\n    PendingAuthenticationInvalid | SessionUnavailable\n  >;\n  /** Prepare a rejection VALUE; translate it to a public failure only after the root\n   * receipt commits, so outer rollback/error translation cannot erase attempts. */\n  readonly reject: <A>(\n    input: {\n      readonly digest: TokenDigest;\n      readonly bindingDigest: TokenDigest;\n      readonly now: DateTime.Utc;\n    },\n    prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n  ) => Effect.Effect<PreparedCommit<A>, SessionUnavailable>;\n}\n"],"mappings":";;;;;;;AAgCA,MAAa,+BAA+B,OAAO,OAAO;CACxD,QAAQ;CACR,eAAe;CACf,UAAU;CACV,iBAAiB,OAAO;AAC1B,CAAC;;AAKD,MAAa,uCAAuC,OAAO,GACzD,sCACF,CAAC,CAAC,WAAW,OAAqC;CAChD,MAAM,QAAQ,OAAO,OAAO,aAAa,4BAA4B,CAAC,CAAC,KAAK,CAAC,CAAC,KAC5E,OAAO,eAAe,6BAA6B,KAAK,CAAC,CAAC,CAAC,CAC7D;CAEA,OAAO,OAAO,OAAO;EACnB,QAAQ,MAAM;EACd,eAAe,MAAM;EACrB,iBAAiB,MAAM;EACvB,UAAU,OAAO,OAAO;GACtB,WAAW,MAAM,SAAS;GAC1B,kBAAkB,MAAM,SAAS;GACjC,aAAa,OAAO,OAClB,MAAM,SAAS,YAAY,KAAK,SAC9B,OAAO,OAAO;IACZ,cAAc,KAAK;IACnB,UAAU,KAAK;GACjB,CAAC,CACH,CACF;EACF,CAAC;CACH,CAAC;AACH,CAAC;AAED,MAAa,gCAAgC,WAC3C,qCAAqC;CACnC,QAAQ,OAAO,SAAS;CACxB,eAAe,OAAO,SAAS;CAC/B,UAAU,OAAO,SAAS;CAC1B,iBAAiB,SAAS,cAAc,OAAO,SAAS;AAC1D,CAAC"}

package/dist/sessions/SessionStepUpPersistence.d.mts

@@ -0,0 +1,152 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision, SessionId, SessionInspection } from "./models.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { PrepareSessionCommit } from "./commit.mjs";
+import { SessionConflict, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication } from "./errors.mjs";
+import { PendingAuthenticationContext } from "./PendingAuthentication.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/sessions/SessionStepUpPersistence.d.ts
+declare const SessionStepUpProfileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+type SessionStepUpProfileId = typeof SessionStepUpProfileId.Type;
+declare const SessionStepUpRequirement: Schema.Struct<{
+  readonly maximumAgeMillis: Schema.Int;
+  readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+    readonly userVerified: Schema.Boolean;
+    readonly phishingResistant: Schema.Boolean;
+    readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    readonly minimumCredentials: Schema.Int;
+  }>>;
+}>;
+declare const SessionStepUpProfile: Schema.Struct<{
+  readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+  readonly generation: Schema.Int;
+  readonly requirement: Schema.Struct<{
+    readonly maximumAgeMillis: Schema.Int;
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+  }>;
+  readonly lifetimeMillis: Schema.Int;
+  readonly attemptLimit: Schema.Int;
+}>;
+type SessionStepUpProfile = typeof SessionStepUpProfile.Type;
+declare const StepUpPending: Schema.TaggedStruct<"StepUpPending", {
+  readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>;
+type StepUpPending = typeof StepUpPending.Type;
+declare const SessionStepUpIntent: Schema.TaggedStruct<"SessionStepUpIntent", {
+  readonly digest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly version: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly sourceKind: Schema.Literals<readonly ["Stateful", "StateAssistedSigned", "StatelessSigned"]>;
+  readonly sourceSessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+  readonly sourceCredentialVersion: Schema.brand<Schema.String, "effect-auth/SessionCredentialVersion">;
+  readonly sourceAuthenticatedAt: Schema.DateTimeUtcFromMillis;
+  readonly sourceExpiresAt: Schema.DateTimeUtcFromMillis;
+  readonly sourceAbsoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+  readonly profileId: Schema.brand<Schema.String, "effect-auth/SessionStepUpProfileId">;
+  readonly profileGeneration: Schema.Int;
+  readonly profileDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requirement: Schema.Struct<{
+    readonly maximumAgeMillis: Schema.Int;
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+  }>;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  readonly attemptLimit: Schema.Int;
+}>;
+type SessionStepUpIntent = typeof SessionStepUpIntent.Type;
+/** Private guard from the SAME authoritative read as inspection. */
+interface SessionStepUpSource<Claims> {
+  readonly inspection: SessionInspection<Claims>;
+  readonly guard: {
+    readonly _tag: "Stateful";
+    readonly digest: TokenDigest;
+    readonly rowVersion: SecurityRevision;
+  } | {
+    readonly _tag: "StateAssistedSigned";
+  } | {
+    readonly _tag: "StatelessSigned";
+  };
+}
+type SessionStepUpReplacement<Claims> = {
+  readonly _tag: "Stateful";
+  readonly inspection: SessionInspection<Claims>;
+  readonly expectedDigest: TokenDigest;
+  readonly expectedRowVersion: SecurityRevision;
+  readonly nextDigest: TokenDigest;
+} | {
+  readonly _tag: "StateAssistedSigned";
+  readonly inspection: SessionInspection<Claims>;
+  readonly tombstoneSessionId: SessionId;
+  readonly tombstoneUntil: DateTime.Utc;
+} | {
+  readonly _tag: "StatelessSigned";
+  readonly inspection: SessionInspection<Claims>;
+};
+/** No bearer, callback or crypto work. All fields are preplanned under the core's
+ * trusted snapshots. Native owners must preserve the exact replacement metadata. */
+interface SessionStepUpCompletionPlan<Claims> {
+  readonly intent: SessionStepUpIntent;
+  readonly source: SessionStepUpSource<Claims>;
+  readonly evidence: AuthenticationEvidence;
+  readonly baseRequirement: AuthenticationRequirement;
+  readonly profileRequirement: AuthenticationRequirement;
+  readonly now: DateTime.Utc;
+  readonly replacement: SessionStepUpReplacement<Claims>;
+}
+/** Optional, distinct from login pending. No implementation may compose standalone
+ * rotate/revoke/pending commits to approximate the one-owner complete transition. */
+interface SessionStepUpPersistence<Claims> {
+  /** Check active exact revisions and all source/time bounds; unique flow/digest.
+   * Prepare BEFORE the actual commit. Ambient owners must join or reject before writes. */
+  readonly create: <A>(input: Omit<SessionStepUpIntent, "version">, now: DateTime.Utc, prepare: PrepareSessionCommit<SessionStepUpIntent, A>) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionConflict | SessionUnavailable>;
+  /** Claims-free authoritative kind/source/revision/expiry/consumed/budget checks. */
+  readonly context: (input: {
+    readonly digest: TokenDigest;
+    readonly now: DateTime.Utc;
+  }) => Effect.Effect<PendingAuthenticationContext, SessionStepUpInvalid | SessionUnavailable>;
+  readonly read: (input: {
+    readonly digest: TokenDigest;
+    readonly bindingDigest: TokenDigest;
+    readonly now: DateTime.Utc;
+  }) => Effect.Effect<SessionStepUpIntent, SessionStepUpInvalid | SessionUnavailable>;
+  /** Authenticate binding internally, atomically cap/increment attempts, return a
+   * decision VALUE. Unknown commits are unavailable, never automatically retried. */
+  readonly reject: <A>(input: {
+    readonly digest: TokenDigest;
+    readonly now: DateTime.Utc;
+  }, prepare: PrepareSessionCommit<{
+    readonly _tag: "Rejected";
+  }, A>) => Effect.Effect<PreparedCommit<A>, SessionUnavailable>;
+  /** Recheck intent version/status/budget, exact source/profile/revisions and BOTH
+   * requirements at the actual commit clock. Stateful: guard source digest/row and
+   * credential versions, update in place + consume. Stored sourceKind must match
+   * both the inspected guard and replacement tag, including after deployment changes. Assisted: insert absent source
+   * lineage tombstone + consume. Pure signed: consume only; old source remains live.
+   * Preserve source authenticatedAt/absolute expiry and exact prepared metadata.
+   * A guard loss discards prepared bearer/events, including under an outer owner.
+   * The callback is synchronous and must run before physical commit, including D1.
+   */
+  readonly complete: <A>(plan: SessionStepUpCompletionPlan<Claims>, prepare: PrepareSessionCommit<SessionInspection<Claims>, A>) => Effect.Effect<PreparedCommit<A>, SessionStepUpInvalid | StaleAuthentication | SessionConflict | SessionUnavailable>;
+}
+//#endregion
+export { SessionStepUpCompletionPlan, SessionStepUpIntent, SessionStepUpPersistence, SessionStepUpProfile, SessionStepUpProfileId, SessionStepUpReplacement, SessionStepUpRequirement, SessionStepUpSource, StepUpPending };
+//# sourceMappingURL=SessionStepUpPersistence.d.mts.map

package/dist/sessions/SessionStepUpPersistence.mjs

@@ -0,0 +1,63 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AssuranceAlternative, AuthenticationFlowId, AuthenticationRequirement, AuthenticationRevision, SecurityRevision, SessionCredentialVersion, SessionId } from "./models.mjs";
+import { Schema } from "effect";
+//#region src/sessions/SessionStepUpPersistence.ts
+const SessionStepUpProfileId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,128}$/)).pipe(Schema.brand("effect-auth/SessionStepUpProfileId"));
+const SessionStepUpRequirement = Schema.Struct({
+	...AuthenticationRequirement.fields,
+	alternatives: Schema.NonEmptyArray(Schema.Struct({
+		...AssuranceAlternative.fields,
+		factors: AssuranceAlternative.fields.factors.check(Schema.isMaxLength(3)),
+		minimumCredentials: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 64
+		}))
+	})).check(Schema.isMaxLength(16))
+});
+const SessionStepUpProfile = Schema.Struct({
+	profileId: SessionStepUpProfileId,
+	generation: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: Number.MAX_SAFE_INTEGER
+	})),
+	requirement: SessionStepUpRequirement,
+	lifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 9e5
+	})),
+	attemptLimit: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 100
+	}))
+});
+const StepUpPending = Schema.TaggedStruct("StepUpPending", {
+	profileId: SessionStepUpProfileId,
+	expiresAt: Schema.DateTimeUtcFromMillis
+});
+const SessionStepUpIntent = Schema.TaggedStruct("SessionStepUpIntent", {
+	digest: TokenDigest,
+	version: SecurityRevision,
+	flowId: AuthenticationFlowId,
+	bindingDigest: TokenDigest,
+	revision: AuthenticationRevision,
+	sourceKind: Schema.Literals([
+		"Stateful",
+		"StateAssistedSigned",
+		"StatelessSigned"
+	]),
+	sourceSessionId: SessionId,
+	sourceCredentialVersion: SessionCredentialVersion,
+	sourceAuthenticatedAt: Schema.DateTimeUtcFromMillis,
+	sourceExpiresAt: Schema.DateTimeUtcFromMillis,
+	sourceAbsoluteExpiresAt: Schema.DateTimeUtcFromMillis,
+	profileId: SessionStepUpProfileId,
+	profileGeneration: SessionStepUpProfile.fields.generation,
+	profileDigest: TokenDigest,
+	requirement: SessionStepUpProfile.fields.requirement,
+	expiresAt: Schema.DateTimeUtcFromMillis,
+	attemptLimit: SessionStepUpProfile.fields.attemptLimit
+});
+//#endregion
+export { SessionStepUpIntent, SessionStepUpProfile, SessionStepUpProfileId, SessionStepUpRequirement, StepUpPending };
+
+//# sourceMappingURL=SessionStepUpPersistence.mjs.map

package/dist/sessions/SessionStepUpPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionStepUpPersistence.mjs","names":[],"sources":["../../src/sessions/SessionStepUpPersistence.ts"],"sourcesContent":["import { type DateTime, type Effect, Schema } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport { TokenDigest } from \"../Schema\";\nimport type { PrepareSessionCommit } from \"./commit\";\nimport type {\n  SessionConflict,\n  SessionStepUpInvalid,\n  SessionUnavailable,\n  StaleAuthentication,\n} from \"./errors\";\nimport {\n  AuthenticationFlowId,\n  AuthenticationRequirement,\n  AuthenticationRevision,\n  AssuranceAlternative,\n  SecurityRevision,\n  SessionCredentialVersion,\n  SessionId,\n  type AuthenticationEvidence,\n  type SessionInspection,\n} from \"./models\";\nimport type { PendingAuthenticationContext } from \"./PendingAuthentication\";\n\nexport const SessionStepUpProfileId = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9._-]{1,128}$/),\n).pipe(Schema.brand(\"effect-auth/SessionStepUpProfileId\"));\n\nexport type SessionStepUpProfileId = typeof SessionStepUpProfileId.Type;\n\nexport const SessionStepUpRequirement = Schema.Struct({\n  ...AuthenticationRequirement.fields,\n  alternatives: Schema.NonEmptyArray(\n    Schema.Struct({\n      ...AssuranceAlternative.fields,\n      factors: AssuranceAlternative.fields.factors.check(Schema.isMaxLength(3)),\n      minimumCredentials: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n    }),\n  ).check(Schema.isMaxLength(16)),\n});\n\nexport const SessionStepUpProfile = Schema.Struct({\n  profileId: SessionStepUpProfileId,\n  generation: Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER })),\n  requirement: SessionStepUpRequirement,\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 900000 })),\n  attemptLimit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100 })),\n});\n\nexport type SessionStepUpProfile = typeof SessionStepUpProfile.Type;\n\nexport const StepUpPending = Schema.TaggedStruct(\"StepUpPending\", {\n  profileId: SessionStepUpProfileId,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n});\n\nexport type StepUpPending = typeof StepUpPending.Type;\n\nexport const SessionStepUpIntent = Schema.TaggedStruct(\"SessionStepUpIntent\", {\n  digest: TokenDigest,\n  version: SecurityRevision,\n  flowId: AuthenticationFlowId,\n  bindingDigest: TokenDigest,\n  revision: AuthenticationRevision,\n  sourceKind: Schema.Literals([\"Stateful\", \"StateAssistedSigned\", \"StatelessSigned\"]),\n  sourceSessionId: SessionId,\n  sourceCredentialVersion: SessionCredentialVersion,\n  sourceAuthenticatedAt: Schema.DateTimeUtcFromMillis,\n  sourceExpiresAt: Schema.DateTimeUtcFromMillis,\n  sourceAbsoluteExpiresAt: Schema.DateTimeUtcFromMillis,\n  profileId: SessionStepUpProfileId,\n  profileGeneration: SessionStepUpProfile.fields.generation,\n  profileDigest: TokenDigest,\n  requirement: SessionStepUpProfile.fields.requirement,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n  attemptLimit: SessionStepUpProfile.fields.attemptLimit,\n});\n\nexport type SessionStepUpIntent = typeof SessionStepUpIntent.Type;\n\n/** Private guard from the SAME authoritative read as inspection. */\nexport interface SessionStepUpSource<Claims> {\n  readonly inspection: SessionInspection<Claims>;\n  readonly guard:\n    | {\n        readonly _tag: \"Stateful\";\n        readonly digest: TokenDigest;\n        readonly rowVersion: SecurityRevision;\n      }\n    | { readonly _tag: \"StateAssistedSigned\" }\n    | { readonly _tag: \"StatelessSigned\" };\n}\n\nexport type SessionStepUpReplacement<Claims> =\n  | {\n      readonly _tag: \"Stateful\";\n      readonly inspection: SessionInspection<Claims>;\n      readonly expectedDigest: TokenDigest;\n      readonly expectedRowVersion: SecurityRevision;\n      readonly nextDigest: TokenDigest;\n    }\n  | {\n      readonly _tag: \"StateAssistedSigned\";\n      readonly inspection: SessionInspection<Claims>;\n      readonly tombstoneSessionId: SessionId;\n      readonly tombstoneUntil: DateTime.Utc;\n    }\n  | { readonly _tag: \"StatelessSigned\"; readonly inspection: SessionInspection<Claims> };\n\n/** No bearer, callback or crypto work. All fields are preplanned under the core's\n * trusted snapshots. Native owners must preserve the exact replacement metadata. */\nexport interface SessionStepUpCompletionPlan<Claims> {\n  readonly intent: SessionStepUpIntent;\n  readonly source: SessionStepUpSource<Claims>;\n  readonly evidence: AuthenticationEvidence;\n  readonly baseRequirement: AuthenticationRequirement;\n  readonly profileRequirement: AuthenticationRequirement;\n  readonly now: DateTime.Utc;\n  readonly replacement: SessionStepUpReplacement<Claims>;\n}\n\n/** Optional, distinct from login pending. No implementation may compose standalone\n * rotate/revoke/pending commits to approximate the one-owner complete transition. */\nexport interface SessionStepUpPersistence<Claims> {\n  /** Check active exact revisions and all source/time bounds; unique flow/digest.\n   * Prepare BEFORE the actual commit. Ambient owners must join or reject before writes. */\n  readonly create: <A>(\n    input: Omit<SessionStepUpIntent, \"version\">,\n    now: DateTime.Utc,\n    prepare: PrepareSessionCommit<SessionStepUpIntent, A>,\n  ) => Effect.Effect<PreparedCommit<A>, StaleAuthentication | SessionConflict | SessionUnavailable>;\n  /** Claims-free authoritative kind/source/revision/expiry/consumed/budget checks. */\n  readonly context: (input: {\n    readonly digest: TokenDigest;\n    readonly now: DateTime.Utc;\n  }) => Effect.Effect<PendingAuthenticationContext, SessionStepUpInvalid | SessionUnavailable>;\n  readonly read: (input: {\n    readonly digest: TokenDigest;\n    readonly bindingDigest: TokenDigest;\n    readonly now: DateTime.Utc;\n  }) => Effect.Effect<SessionStepUpIntent, SessionStepUpInvalid | SessionUnavailable>;\n  /** Authenticate binding internally, atomically cap/increment attempts, return a\n   * decision VALUE. Unknown commits are unavailable, never automatically retried. */\n  readonly reject: <A>(\n    input: { readonly digest: TokenDigest; readonly now: DateTime.Utc },\n    prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n  ) => Effect.Effect<PreparedCommit<A>, SessionUnavailable>;\n  /** Recheck intent version/status/budget, exact source/profile/revisions and BOTH\n   * requirements at the actual commit clock. Stateful: guard source digest/row and\n   * credential versions, update in place + consume. Stored sourceKind must match\n   * both the inspected guard and replacement tag, including after deployment changes. Assisted: insert absent source\n   * lineage tombstone + consume. Pure signed: consume only; old source remains live.\n   * Preserve source authenticatedAt/absolute expiry and exact prepared metadata.\n   * A guard loss discards prepared bearer/events, including under an outer owner.\n   * The callback is synchronous and must run before physical commit, including D1.\n   */\n  readonly complete: <A>(\n    plan: SessionStepUpCompletionPlan<Claims>,\n    prepare: PrepareSessionCommit<SessionInspection<Claims>, A>,\n  ) => Effect.Effect<\n    PreparedCommit<A>,\n    SessionStepUpInvalid | StaleAuthentication | SessionConflict | SessionUnavailable\n  >;\n}\n"],"mappings":";;;;AAwBA,MAAa,yBAAyB,OAAO,OAAO,MAClD,OAAO,UAAU,yBAAyB,CAC5C,CAAC,CAAC,KAAK,OAAO,MAAM,oCAAoC,CAAC;AAIzD,MAAa,2BAA2B,OAAO,OAAO;CACpD,GAAG,0BAA0B;CAC7B,cAAc,OAAO,cACnB,OAAO,OAAO;EACZ,GAAG,qBAAqB;EACxB,SAAS,qBAAqB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;EACxE,oBAAoB,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAG,CAAC,CAAC;CACpF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAChC,CAAC;AAED,MAAa,uBAAuB,OAAO,OAAO;CAChD,WAAW;CACX,YAAY,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CAC/F,aAAa;CACb,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAO,CAAC,CAAC;CAClF,cAAc,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAI,CAAC,CAAC;AAC/E,CAAC;AAID,MAAa,gBAAgB,OAAO,aAAa,iBAAiB;CAChE,WAAW;CACX,WAAW,OAAO;AACpB,CAAC;AAID,MAAa,sBAAsB,OAAO,aAAa,uBAAuB;CAC5E,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,eAAe;CACf,UAAU;CACV,YAAY,OAAO,SAAS;EAAC;EAAY;EAAuB;CAAiB,CAAC;CAClF,iBAAiB;CACjB,yBAAyB;CACzB,uBAAuB,OAAO;CAC9B,iBAAiB,OAAO;CACxB,yBAAyB,OAAO;CAChC,WAAW;CACX,mBAAmB,qBAAqB,OAAO;CAC/C,eAAe;CACf,aAAa,qBAAqB,OAAO;CACzC,WAAW,OAAO;CAClB,cAAc,qBAAqB,OAAO;AAC5C,CAAC"}

package/dist/sessions/assurance.d.mts

@@ -0,0 +1,163 @@
+import { AuthenticationAssurance } from "../operations/context.mjs";
+import { AuthenticationEvidence } from "./models.mjs";
+import { PendingAuthenticationInvalid, SessionConfigurationError, StaleAuthentication } from "./errors.mjs";
+import { DateTime, Effect } from "effect";
+//#region src/sessions/assurance.d.ts
+declare const snapshotAuthenticationEvidence: (evidence: {
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly proofs: readonly [{
+    readonly method: string;
+    readonly credentialId: string;
+    readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    readonly userVerified: boolean;
+    readonly phishingResistant: boolean;
+    readonly verifiedAt: DateTime.Utc;
+  }, ...{
+    readonly method: string;
+    readonly credentialId: string;
+    readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    readonly userVerified: boolean;
+    readonly phishingResistant: boolean;
+    readonly verifiedAt: DateTime.Utc;
+  }[]];
+}) => Effect.Effect<Readonly<{
+  flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  revision: Readonly<{
+    subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    credentials: readonly Readonly<{
+      credentialId: string;
+      revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }>[];
+  }>;
+  proofs: readonly [Readonly<{
+    method: string;
+    credentialId: string;
+    userVerified: boolean;
+    phishingResistant: boolean;
+    factors: readonly ("inherence" | "knowledge" | "possession")[];
+    verifiedAt: DateTime.Utc;
+  }>, ...Readonly<{
+    method: string;
+    credentialId: string;
+    userVerified: boolean;
+    phishingResistant: boolean;
+    factors: readonly ("inherence" | "knowledge" | "possession")[];
+    verifiedAt: DateTime.Utc;
+  }>[]];
+}>, StaleAuthentication, never>;
+declare const snapshotSessionAuthenticationProvenance: (input: {
+  readonly evidence: {
+    readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    readonly revision: {
+      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      readonly credentials: readonly {
+        readonly credentialId: string;
+        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }[];
+    };
+    readonly proofs: readonly [{
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+    }, ...{
+      readonly method: string;
+      readonly credentialId: string;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly verifiedAt: DateTime.Utc;
+    }[]];
+  };
+}) => Effect.Effect<Readonly<{
+  evidence: Readonly<{
+    flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+    bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+    revision: Readonly<{
+      subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+      securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      credentials: readonly Readonly<{
+        credentialId: string;
+        revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      }>[];
+    }>;
+    proofs: readonly [Readonly<{
+      method: string;
+      credentialId: string;
+      userVerified: boolean;
+      phishingResistant: boolean;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+      verifiedAt: DateTime.Utc;
+    }>, ...Readonly<{
+      method: string;
+      credentialId: string;
+      userVerified: boolean;
+      phishingResistant: boolean;
+      factors: readonly ("inherence" | "knowledge" | "possession")[];
+      verifiedAt: DateTime.Utc;
+    }>[]];
+  }>;
+}>, StaleAuthentication, never>;
+declare const assessAuthentication: (input: {
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly proofs: readonly [{
+    readonly method: string;
+    readonly credentialId: string;
+    readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    readonly userVerified: boolean;
+    readonly phishingResistant: boolean;
+    readonly verifiedAt: DateTime.Utc;
+  }, ...{
+    readonly method: string;
+    readonly credentialId: string;
+    readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    readonly userVerified: boolean;
+    readonly phishingResistant: boolean;
+    readonly verifiedAt: DateTime.Utc;
+  }[]];
+}, configured: {
+  readonly alternatives: readonly [{
+    readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    readonly userVerified: boolean;
+    readonly phishingResistant: boolean;
+    readonly minimumCredentials: number;
+  }, ...{
+    readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+    readonly userVerified: boolean;
+    readonly phishingResistant: boolean;
+    readonly minimumCredentials: number;
+  }[]];
+  readonly maximumAgeMillis: number;
+}) => Effect.Effect<{
+  satisfied: boolean;
+  assurance: AuthenticationAssurance;
+}, SessionConfigurationError | StaleAuthentication, never>;
+/** Never refresh original proof timestamps or the revision captured before primary verification. */
+declare const combineAuthenticationEvidence: (original: AuthenticationEvidence, additional: AuthenticationEvidence) => Effect.Effect<AuthenticationEvidence, PendingAuthenticationInvalid>;
+//#endregion
+export { assessAuthentication, combineAuthenticationEvidence, snapshotAuthenticationEvidence, snapshotSessionAuthenticationProvenance };
+//# sourceMappingURL=assurance.d.mts.map