@yielded/auth 0.1.0-beta.1

package/dist/sessions/assurance.mjs

@@ -0,0 +1,95 @@
+import { PendingAuthenticationInvalid, SessionConfigurationError, StaleAuthentication } from "./errors.mjs";
+import { AuthenticationAssurance } from "../operations/context.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement, SessionAuthenticationProvenance } from "./models.mjs";
+import { Array, DateTime, Effect, Schema } from "effect";
+//#region src/sessions/assurance.ts
+const evidenceCodec = Schema.toCodecIso(AuthenticationEvidence);
+const snapshotAuthenticationEvidence = Effect.fn("snapshotAuthenticationEvidence")(function* (evidence) {
+	if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return yield* StaleAuthentication.make({});
+	const projected = yield* Schema.encodeEffect(evidenceCodec)(evidence).pipe(Effect.flatMap(Schema.decodeEffect(evidenceCodec)), Effect.mapError(() => StaleAuthentication.make({})));
+	return Object.freeze({
+		...projected,
+		revision: Object.freeze({
+			...projected.revision,
+			credentials: Object.freeze(projected.revision.credentials.map((item) => Object.freeze({ ...item })))
+		}),
+		proofs: Object.freeze(Array.map(projected.proofs, (proof) => {
+			const verifiedAt = DateTime.makeUnsafe(DateTime.toEpochMillis(proof.verifiedAt));
+			Object.freeze(DateTime.toPartsUtc(verifiedAt));
+			Object.freeze(verifiedAt);
+			return Object.freeze({
+				...proof,
+				factors: Object.freeze([...proof.factors]),
+				verifiedAt
+			});
+		}))
+	});
+});
+const snapshotSessionAuthenticationProvenance = Effect.fn("snapshotSessionAuthenticationProvenance")(function* (input) {
+	if (input?.evidence?.proofs?.length > 64 || input?.evidence?.revision?.credentials?.length > 64) return yield* StaleAuthentication.make({});
+	yield* Schema.decodeEffect(Schema.toType(SessionAuthenticationProvenance))(input).pipe(Effect.mapError(() => StaleAuthentication.make({})));
+	const ids = new Set(input.evidence.revision.credentials.map((item) => item.credentialId));
+	if (ids.size !== input.evidence.revision.credentials.length || input.evidence.proofs.some((proof) => !ids.has(proof.credentialId))) return yield* StaleAuthentication.make({});
+	return Object.freeze({ evidence: yield* snapshotAuthenticationEvidence(input.evidence) });
+});
+const assessAuthentication = Effect.fn("assessAuthentication")(function* (input, configured) {
+	if (input.proofs.length > 64 || input.revision.credentials.length > 64) return yield* StaleAuthentication.make({});
+	const evidence = yield* Schema.decodeEffect(Schema.toType(AuthenticationEvidence))(input).pipe(Effect.mapError(() => StaleAuthentication.make({})));
+	const requirement = yield* Schema.decodeEffect(AuthenticationRequirement)(configured).pipe(Effect.mapError(() => SessionConfigurationError.make({ reason: "pending-authentication" })));
+	const revisions = /* @__PURE__ */ new Map();
+	for (const revision of evidence.revision.credentials) {
+		if (revisions.has(revision.credentialId)) return yield* StaleAuthentication.make({});
+		revisions.set(revision.credentialId, revision.revision);
+	}
+	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return yield* StaleAuthentication.make({});
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	for (const proof of evidence.proofs) if (now - DateTime.toEpochMillis(proof.verifiedAt) < 0) return yield* StaleAuthentication.make({});
+	const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < requirement.maximumAgeMillis);
+	if (fresh.length === 0) return yield* StaleAuthentication.make({});
+	const factors = [...new Set(fresh.flatMap((proof) => proof.factors))];
+	const credentials = new Set(fresh.map((proof) => proof.credentialId));
+	const satisfied = requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.includes(factor)) && credentials.size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
+	const first = fresh[0];
+	const authenticatedAt = fresh.reduce((oldest, proof) => DateTime.toEpochMillis(proof.verifiedAt) < DateTime.toEpochMillis(oldest) ? proof.verifiedAt : oldest, first.verifiedAt);
+	const ordinals = /* @__PURE__ */ new Map();
+	for (const proof of evidence.proofs) if (!ordinals.has(proof.credentialId)) ordinals.set(proof.credentialId, ordinals.size);
+	if (ordinals.size > 64) return yield* StaleAuthentication.make({});
+	return {
+		satisfied,
+		assurance: AuthenticationAssurance.make({
+			method: first.method,
+			factors,
+			authenticatedAt,
+			evidence: Array.map(evidence.proofs, ({ method, credentialId, factors, userVerified, phishingResistant, verifiedAt }) => ({
+				method,
+				credentialOrdinal: ordinals.get(credentialId),
+				factors,
+				userVerified,
+				phishingResistant,
+				verifiedAt
+			}))
+		})
+	};
+});
+/** Never refresh original proof timestamps or the revision captured before primary verification. */
+const combineAuthenticationEvidence = (original, additional) => {
+	if (original.flowId !== additional.flowId || original.bindingDigest !== additional.bindingDigest || original.revision.subjectId !== additional.revision.subjectId || original.revision.securityRevision !== additional.revision.securityRevision) return Effect.fail(PendingAuthenticationInvalid.make({}));
+	const revisions = new Map(original.revision.credentials.map((credential) => [credential.credentialId, credential]));
+	for (const credential of additional.revision.credentials) {
+		const previous = revisions.get(credential.credentialId);
+		if (previous !== void 0 && previous.revision !== credential.revision) return Effect.fail(PendingAuthenticationInvalid.make({}));
+		revisions.set(credential.credentialId, credential);
+	}
+	return Effect.succeed({
+		...original,
+		revision: {
+			...original.revision,
+			credentials: [...revisions.values()]
+		},
+		proofs: [...original.proofs, ...additional.proofs]
+	});
+};
+//#endregion
+export { assessAuthentication, combineAuthenticationEvidence, snapshotAuthenticationEvidence, snapshotSessionAuthenticationProvenance };
+
+//# sourceMappingURL=assurance.mjs.map

package/dist/sessions/assurance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance.mjs","names":[],"sources":["../../src/sessions/assurance.ts"],"sourcesContent":["import { Array, DateTime, Effect, Schema } from \"effect\";\n\nimport { AuthenticationAssurance } from \"../operations/context\";\nimport {\n  PendingAuthenticationInvalid,\n  SessionConfigurationError,\n  StaleAuthentication,\n} from \"./errors\";\nimport {\n  AuthenticationEvidence,\n  AuthenticationRequirement,\n  SessionAuthenticationProvenance,\n} from \"./models\";\n\nconst evidenceCodec = Schema.toCodecIso(AuthenticationEvidence);\n\nexport const snapshotAuthenticationEvidence = Effect.fn(\"snapshotAuthenticationEvidence\")(\n  function* (evidence: AuthenticationEvidence) {\n    // Bound Type input before schema projection allocates a detached proof graph.\n    if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64)\n      return yield* StaleAuthentication.make({});\n\n    const projected = yield* Schema.encodeEffect(evidenceCodec)(evidence).pipe(\n      Effect.flatMap(Schema.decodeEffect(evidenceCodec)),\n      Effect.mapError(() => StaleAuthentication.make({})),\n    );\n\n    return Object.freeze({\n      ...projected,\n      revision: Object.freeze({\n        ...projected.revision,\n        credentials: Object.freeze(\n          projected.revision.credentials.map((item) => Object.freeze({ ...item })),\n        ),\n      }),\n      proofs: Object.freeze(\n        Array.map(projected.proofs, (proof) => {\n          const verifiedAt = DateTime.makeUnsafe(DateTime.toEpochMillis(proof.verifiedAt));\n\n          // DateTime.Utc caches parts lazily; populate before freezing the detached instant.\n          Object.freeze(DateTime.toPartsUtc(verifiedAt));\n          Object.freeze(verifiedAt);\n\n          return Object.freeze({\n            ...proof,\n            factors: Object.freeze([...proof.factors]),\n            verifiedAt,\n          });\n        }),\n      ),\n    });\n  },\n);\n\nexport const snapshotSessionAuthenticationProvenance = Effect.fn(\n  \"snapshotSessionAuthenticationProvenance\",\n)(function* (input: SessionAuthenticationProvenance) {\n  if (input?.evidence?.proofs?.length > 64 || input?.evidence?.revision?.credentials?.length > 64)\n    return yield* StaleAuthentication.make({});\n  yield* Schema.decodeEffect(Schema.toType(SessionAuthenticationProvenance))(input).pipe(\n    Effect.mapError(() => StaleAuthentication.make({})),\n  );\n  const ids = new Set(input.evidence.revision.credentials.map((item) => item.credentialId));\n\n  if (\n    ids.size !== input.evidence.revision.credentials.length ||\n    input.evidence.proofs.some((proof) => !ids.has(proof.credentialId))\n  )\n    return yield* StaleAuthentication.make({});\n\n  return Object.freeze({ evidence: yield* snapshotAuthenticationEvidence(input.evidence) });\n});\n\nexport const assessAuthentication = Effect.fn(\"assessAuthentication\")(function* (\n  input: AuthenticationEvidence,\n  configured: AuthenticationRequirement,\n) {\n  if (input.proofs.length > 64 || input.revision.credentials.length > 64)\n    return yield* StaleAuthentication.make({});\n\n  const evidence = yield* Schema.decodeEffect(Schema.toType(AuthenticationEvidence))(input).pipe(\n    Effect.mapError(() => StaleAuthentication.make({})),\n  );\n\n  const requirement = yield* Schema.decodeEffect(AuthenticationRequirement)(configured).pipe(\n    Effect.mapError(() => SessionConfigurationError.make({ reason: \"pending-authentication\" })),\n  );\n\n  const revisions = new Map<string, string>();\n\n  for (const revision of evidence.revision.credentials) {\n    if (revisions.has(revision.credentialId)) return yield* StaleAuthentication.make({});\n    revisions.set(revision.credentialId, revision.revision);\n  }\n  if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId)))\n    return yield* StaleAuthentication.make({});\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  for (const proof of evidence.proofs) {\n    const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n    if (age < 0) return yield* StaleAuthentication.make({});\n  }\n\n  const fresh = evidence.proofs.filter(\n    (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < requirement.maximumAgeMillis,\n  );\n\n  if (fresh.length === 0) return yield* StaleAuthentication.make({});\n  const factors = [...new Set(fresh.flatMap((proof) => proof.factors))];\n  const credentials = new Set(fresh.map((proof) => proof.credentialId));\n\n  const satisfied = requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.includes(factor)) &&\n      credentials.size >= alternative.minimumCredentials &&\n      fresh.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n\n  const first = fresh[0];\n\n  const authenticatedAt = fresh.reduce(\n    (oldest, proof) =>\n      DateTime.toEpochMillis(proof.verifiedAt) < DateTime.toEpochMillis(oldest)\n        ? proof.verifiedAt\n        : oldest,\n    first.verifiedAt,\n  );\n\n  const ordinals = new Map<string, number>();\n\n  for (const proof of evidence.proofs) {\n    if (!ordinals.has(proof.credentialId)) ordinals.set(proof.credentialId, ordinals.size);\n  }\n  if (ordinals.size > 64) return yield* StaleAuthentication.make({});\n\n  return {\n    satisfied,\n    assurance: AuthenticationAssurance.make({\n      method: first.method,\n      factors,\n      authenticatedAt,\n      evidence: Array.map(\n        evidence.proofs,\n        ({ method, credentialId, factors, userVerified, phishingResistant, verifiedAt }) => ({\n          method,\n          credentialOrdinal: ordinals.get(credentialId)!,\n          factors,\n          userVerified,\n          phishingResistant,\n          verifiedAt,\n        }),\n      ),\n    }),\n  };\n});\n\n/** Never refresh original proof timestamps or the revision captured before primary verification. */\nexport const combineAuthenticationEvidence = (\n  original: AuthenticationEvidence,\n  additional: AuthenticationEvidence,\n): Effect.Effect<AuthenticationEvidence, PendingAuthenticationInvalid> => {\n  if (\n    original.flowId !== additional.flowId ||\n    original.bindingDigest !== additional.bindingDigest ||\n    original.revision.subjectId !== additional.revision.subjectId ||\n    original.revision.securityRevision !== additional.revision.securityRevision\n  )\n    return Effect.fail(PendingAuthenticationInvalid.make({}));\n\n  const revisions = new Map(\n    original.revision.credentials.map((credential) => [credential.credentialId, credential]),\n  );\n\n  for (const credential of additional.revision.credentials) {\n    const previous = revisions.get(credential.credentialId);\n\n    if (previous !== undefined && previous.revision !== credential.revision)\n      return Effect.fail(PendingAuthenticationInvalid.make({}));\n    revisions.set(credential.credentialId, credential);\n  }\n\n  return Effect.succeed({\n    ...original,\n    revision: { ...original.revision, credentials: [...revisions.values()] },\n    proofs: [...original.proofs, ...additional.proofs],\n  });\n};\n"],"mappings":";;;;;AAcA,MAAM,gBAAgB,OAAO,WAAW,sBAAsB;AAE9D,MAAa,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CACvF,WAAW,UAAkC;CAE3C,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IACxE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,YAAY,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KACpE,OAAO,QAAQ,OAAO,aAAa,aAAa,CAAC,GACjD,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,UAAU,OAAO,OAAO;GACtB,GAAG,UAAU;GACb,aAAa,OAAO,OAClB,UAAU,SAAS,YAAY,KAAK,SAAS,OAAO,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CACzE;EACF,CAAC;EACD,QAAQ,OAAO,OACb,MAAM,IAAI,UAAU,SAAS,UAAU;GACrC,MAAM,aAAa,SAAS,WAAW,SAAS,cAAc,MAAM,UAAU,CAAC;GAG/E,OAAO,OAAO,SAAS,WAAW,UAAU,CAAC;GAC7C,OAAO,OAAO,UAAU;GAExB,OAAO,OAAO,OAAO;IACnB,GAAG;IACH,SAAS,OAAO,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC;IACzC;GACF,CAAC;EACH,CAAC,CACH;CACF,CAAC;AACH,CACF;AAEA,MAAa,0CAA0C,OAAO,GAC5D,yCACF,CAAC,CAAC,WAAW,OAAwC;CACnD,IAAI,OAAO,UAAU,QAAQ,SAAS,MAAM,OAAO,UAAU,UAAU,aAAa,SAAS,IAC3F,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAC3C,OAAO,OAAO,aAAa,OAAO,OAAO,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAChF,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CACA,MAAM,MAAM,IAAI,IAAI,MAAM,SAAS,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC;CAExF,IACE,IAAI,SAAS,MAAM,SAAS,SAAS,YAAY,UACjD,MAAM,SAAS,OAAO,MAAM,UAAU,CAAC,IAAI,IAAI,MAAM,YAAY,CAAC,GAElE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,OAAO,OAAO,OAAO,EAAE,UAAU,OAAO,+BAA+B,MAAM,QAAQ,EAAE,CAAC;AAC1F,CAAC;AAED,MAAa,uBAAuB,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACpE,OACA,YACA;CACA,IAAI,MAAM,OAAO,SAAS,MAAM,MAAM,SAAS,YAAY,SAAS,IAClE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,WAAW,OAAO,OAAO,aAAa,OAAO,OAAO,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACxF,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAEA,MAAM,cAAc,OAAO,OAAO,aAAa,yBAAyB,CAAC,CAAC,UAAU,CAAC,CAAC,KACpF,OAAO,eAAe,0BAA0B,KAAK,EAAE,QAAQ,yBAAyB,CAAC,CAAC,CAC5F;CAEA,MAAM,4BAAY,IAAI,IAAoB;CAE1C,KAAK,MAAM,YAAY,SAAS,SAAS,aAAa;EACpD,IAAI,UAAU,IAAI,SAAS,YAAY,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EACnF,UAAU,IAAI,SAAS,cAAc,SAAS,QAAQ;CACxD;CACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GACpE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAC3C,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,KAAK,MAAM,SAAS,SAAS,QAG3B,IAFY,MAAM,SAAS,cAAc,MAAM,UAAU,IAE/C,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAGxD,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,YAAY,gBAC1E;CAEA,IAAI,MAAM,WAAW,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CACjE,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC,CAAC;CACpE,MAAM,cAAc,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC;CAEpE,MAAM,YAAY,YAAY,aAAa,MACxC,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,SAAS,MAAM,CAAC,KAC9D,YAAY,QAAQ,YAAY,sBAChC,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CAEA,MAAM,QAAQ,MAAM;CAEpB,MAAM,kBAAkB,MAAM,QAC3B,QAAQ,UACP,SAAS,cAAc,MAAM,UAAU,IAAI,SAAS,cAAc,MAAM,IACpE,MAAM,aACN,QACN,MAAM,UACR;CAEA,MAAM,2BAAW,IAAI,IAAoB;CAEzC,KAAK,MAAM,SAAS,SAAS,QAC3B,IAAI,CAAC,SAAS,IAAI,MAAM,YAAY,GAAG,SAAS,IAAI,MAAM,cAAc,SAAS,IAAI;CAEvF,IAAI,SAAS,OAAO,IAAI,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAEjE,OAAO;EACL;EACA,WAAW,wBAAwB,KAAK;GACtC,QAAQ,MAAM;GACd;GACA;GACA,UAAU,MAAM,IACd,SAAS,SACR,EAAE,QAAQ,cAAc,SAAS,cAAc,mBAAmB,kBAAkB;IACnF;IACA,mBAAmB,SAAS,IAAI,YAAY;IAC5C;IACA;IACA;IACA;GACF,EACF;EACF,CAAC;CACH;AACF,CAAC;;AAGD,MAAa,iCACX,UACA,eACwE;CACxE,IACE,SAAS,WAAW,WAAW,UAC/B,SAAS,kBAAkB,WAAW,iBACtC,SAAS,SAAS,cAAc,WAAW,SAAS,aACpD,SAAS,SAAS,qBAAqB,WAAW,SAAS,kBAE3D,OAAO,OAAO,KAAK,6BAA6B,KAAK,CAAC,CAAC,CAAC;CAE1D,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,eAAe,CAAC,WAAW,cAAc,UAAU,CAAC,CACzF;CAEA,KAAK,MAAM,cAAc,WAAW,SAAS,aAAa;EACxD,MAAM,WAAW,UAAU,IAAI,WAAW,YAAY;EAEtD,IAAI,aAAa,KAAA,KAAa,SAAS,aAAa,WAAW,UAC7D,OAAO,OAAO,KAAK,6BAA6B,KAAK,CAAC,CAAC,CAAC;EAC1D,UAAU,IAAI,WAAW,cAAc,UAAU;CACnD;CAEA,OAAO,OAAO,QAAQ;EACpB,GAAG;EACH,UAAU;GAAE,GAAG,SAAS;GAAU,aAAa,CAAC,GAAG,UAAU,OAAO,CAAC;EAAE;EACvE,QAAQ,CAAC,GAAG,SAAS,QAAQ,GAAG,WAAW,MAAM;CACnD,CAAC;AACH"}

package/dist/sessions/commit.d.mts

@@ -0,0 +1,13 @@
+import { CommitJournal, PreparedCommit } from "../hooks/commit.mjs";
+//#region src/sessions/commit.d.ts
+/**
+ * Runs inside the persistence adapter's actual commit journal. It can only prepare
+ * an immutable result/event; all cryptography and before hooks run beforehand.
+ * Interactive/savepoint owners reuse the outer journal, synchronous owners never
+ * suspend, and batch owners allocate final IDs/versions and prepare BEFORE executing the batch.
+ * No adapter may invoke this after its physical root commit has returned.
+ */
+type PrepareSessionCommit<Record, A> = (record: Record, journal: CommitJournal) => PreparedCommit<A>;
+//#endregion
+export { PrepareSessionCommit };
+//# sourceMappingURL=commit.d.mts.map

package/dist/sessions/configuration.d.mts

@@ -0,0 +1,46 @@
+import "./errors.mjs";
+import { SessionSigningKeyring } from "./crypto.mjs";
+import { SessionPolicy } from "./policy.mjs";
+import { ModuleService } from "./module.mjs";
+import { Duration, Layer, Schema, Scope } from "effect";
+//#region src/sessions/configuration.d.ts
+interface SessionOptions {
+  readonly idleTimeout?: Duration.Input;
+  readonly maxAge?: Duration.Input;
+  readonly renewAfter?: Duration.Input;
+  readonly issuer?: string;
+  readonly audience?: string;
+  readonly generation?: number;
+  /** Retain the greatest maxAge of still-usable issued tokens after reducing policy. */
+  readonly maximumIssuedAge?: Duration.Input;
+  readonly maximumTokenBytes?: number;
+}
+interface StatefulConfiguration {
+  readonly mode: "stateful";
+  readonly policy: (namespace: string) => SessionPolicy;
+}
+interface StatelessConfiguration {
+  readonly mode: "stateless";
+  readonly policy: (namespace: string) => SessionPolicy;
+  readonly keys: SessionSigningKeyring;
+}
+interface StateAssistedConfiguration {
+  readonly mode: "state-assisted";
+  readonly policy: (namespace: string) => SessionPolicy;
+  readonly keys: SessionSigningKeyring;
+}
+type SessionConfiguration = StatefulConfiguration | StatelessConfiguration | StateAssistedConfiguration;
+/** Authoritative sessions with immediate revocation; supply the bound persistence services. */
+declare const stateful: (options?: SessionOptions) => StatefulConfiguration;
+/** Database-free verification. Sign-out clears this client's credential only. */
+declare const stateless: (options: SessionOptions & {
+  readonly keys: SessionSigningKeyring;
+}) => StatelessConfiguration;
+/** Signed credentials checked against application-owned validity state. */
+declare const stateAssisted: (options: SessionOptions & {
+  readonly keys: SessionSigningKeyring;
+}) => StateAssistedConfiguration;
+type SessionRequirements<C, Id extends string, Claims extends Schema.Top> = Exclude<Claims["DecodingServices"] | Claims["EncodingServices"], Scope.Scope> | (C extends StatefulConfiguration ? ModuleService<Id, "persistence", Claims["Type"]> | ModuleService<Id, "repository", Claims["Type"]> : C extends StateAssistedConfiguration ? ModuleService<Id, "validity", Claims["Type"]> : never);
+//#endregion
+export { SessionConfiguration, SessionOptions, SessionRequirements, StateAssistedConfiguration, StatefulConfiguration, StatelessConfiguration, stateAssisted, stateful, stateless };
+//# sourceMappingURL=configuration.d.mts.map

package/dist/sessions/configuration.mjs

@@ -0,0 +1,55 @@
+import { SessionConfigurationError } from "./errors.mjs";
+import { cryptoLayer, hooksLayer } from "../auth/defaults.mjs";
+import { Duration, Layer } from "effect";
+//#region src/sessions/configuration.ts
+const policy = (options, immediate) => {
+	let values;
+	try {
+		const maxAge = Duration.toMillis(options.maxAge ?? "30 days");
+		const idle = Duration.toMillis(options.idleTimeout ?? Math.min(maxAge, Duration.toMillis("7 days")));
+		values = Object.freeze({
+			generation: options.generation ?? 1,
+			idleLifetimeMillis: idle,
+			absoluteLifetimeMillis: maxAge,
+			renewalIntervalMillis: Duration.toMillis(options.renewAfter ?? Math.min(Math.floor(idle / 2), Duration.toMillis("1 day"))),
+			maximumIssuedAbsoluteLifetimeMillis: Duration.toMillis(options.maximumIssuedAge ?? maxAge),
+			maximumTokenBytes: options.maximumTokenBytes ?? 4096,
+			requireImmediateInvalidation: immediate
+		});
+	} catch {
+		throw SessionConfigurationError.make({ reason: "policy" });
+	}
+	const issuer = options.issuer;
+	const audience = options.audience;
+	return (namespace) => ({
+		...values,
+		issuer: issuer ?? namespace,
+		audience: audience ?? namespace
+	});
+};
+/** Authoritative sessions with immediate revocation; supply the bound persistence services. */
+const stateful = (options = {}) => Object.freeze({
+	mode: "stateful",
+	policy: policy(options, true)
+});
+/** Database-free verification. Sign-out clears this client's credential only. */
+const stateless = (options) => Object.freeze({
+	mode: "stateless",
+	policy: policy(options, false),
+	keys: options.keys
+});
+/** Signed credentials checked against application-owned validity state. */
+const stateAssisted = (options) => Object.freeze({
+	mode: "state-assisted",
+	policy: policy(options, true),
+	keys: options.keys
+});
+const configuredLayer = (sessions, configuration) => {
+	const configured = configuration.policy(sessions.moduleId);
+	const defaults = (layer) => layer.pipe(Layer.provide([cryptoLayer, hooksLayer]));
+	return configuration.mode === "stateful" ? defaults(sessions.statefulLayer(configured)) : configuration.mode === "stateless" ? defaults(sessions.statelessLayer(configured, configuration.keys)) : defaults(sessions.stateAssistedLayer(configured, configuration.keys));
+};
+//#endregion
+export { configuredLayer, stateAssisted, stateful, stateless };
+
+//# sourceMappingURL=configuration.mjs.map

package/dist/sessions/configuration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/sessions/configuration.ts"],"sourcesContent":["import { Duration, Layer, type Schema, type Scope } from \"effect\";\n\nimport { cryptoLayer, hooksLayer } from \"../auth/defaults\";\nimport type { SessionSigningKeyring } from \"./crypto\";\nimport { SessionConfigurationError } from \"./errors\";\nimport type { makeSessionModule, ModuleService } from \"./module\";\nimport type { SessionPolicy } from \"./policy\";\n\nexport interface SessionOptions {\n  readonly idleTimeout?: Duration.Input;\n  readonly maxAge?: Duration.Input;\n  readonly renewAfter?: Duration.Input;\n  readonly issuer?: string;\n  readonly audience?: string;\n  readonly generation?: number;\n  /** Retain the greatest maxAge of still-usable issued tokens after reducing policy. */\n  readonly maximumIssuedAge?: Duration.Input;\n  readonly maximumTokenBytes?: number;\n}\n\nexport interface StatefulConfiguration {\n  readonly mode: \"stateful\";\n  readonly policy: (namespace: string) => SessionPolicy;\n}\n\nexport interface StatelessConfiguration {\n  readonly mode: \"stateless\";\n  readonly policy: (namespace: string) => SessionPolicy;\n  readonly keys: SessionSigningKeyring;\n}\n\nexport interface StateAssistedConfiguration {\n  readonly mode: \"state-assisted\";\n  readonly policy: (namespace: string) => SessionPolicy;\n  readonly keys: SessionSigningKeyring;\n}\n\nexport type SessionConfiguration =\n  | StatefulConfiguration\n  | StatelessConfiguration\n  | StateAssistedConfiguration;\n\nconst policy = (options: SessionOptions, immediate: boolean) => {\n  let values: Omit<SessionPolicy, \"issuer\" | \"audience\">;\n\n  try {\n    const maxAge = Duration.toMillis(options.maxAge ?? \"30 days\");\n\n    const idle = Duration.toMillis(\n      options.idleTimeout ?? Math.min(maxAge, Duration.toMillis(\"7 days\")),\n    );\n\n    values = Object.freeze({\n      generation: options.generation ?? 1,\n      idleLifetimeMillis: idle,\n      absoluteLifetimeMillis: maxAge,\n      renewalIntervalMillis: Duration.toMillis(\n        options.renewAfter ?? Math.min(Math.floor(idle / 2), Duration.toMillis(\"1 day\")),\n      ),\n      maximumIssuedAbsoluteLifetimeMillis: Duration.toMillis(options.maximumIssuedAge ?? maxAge),\n      maximumTokenBytes: options.maximumTokenBytes ?? 4096,\n      requireImmediateInvalidation: immediate,\n    });\n  } catch {\n    throw SessionConfigurationError.make({ reason: \"policy\" });\n  }\n  const issuer = options.issuer;\n  const audience = options.audience;\n\n  return (namespace: string): SessionPolicy => ({\n    ...values,\n    issuer: issuer ?? namespace,\n    audience: audience ?? namespace,\n  });\n};\n\n/** Authoritative sessions with immediate revocation; supply the bound persistence services. */\nexport const stateful = (options: SessionOptions = {}): StatefulConfiguration =>\n  Object.freeze({ mode: \"stateful\", policy: policy(options, true) });\n\n/** Database-free verification. Sign-out clears this client's credential only. */\nexport const stateless = (\n  options: SessionOptions & { readonly keys: SessionSigningKeyring },\n): StatelessConfiguration =>\n  Object.freeze({ mode: \"stateless\", policy: policy(options, false), keys: options.keys });\n\n/** Signed credentials checked against application-owned validity state. */\nexport const stateAssisted = (\n  options: SessionOptions & { readonly keys: SessionSigningKeyring },\n): StateAssistedConfiguration =>\n  Object.freeze({ mode: \"state-assisted\", policy: policy(options, true), keys: options.keys });\n\nexport type SessionRequirements<C, Id extends string, Claims extends Schema.Top> =\n  | Exclude<Claims[\"DecodingServices\"] | Claims[\"EncodingServices\"], Scope.Scope>\n  | (C extends StatefulConfiguration\n      ?\n          | ModuleService<Id, \"persistence\", Claims[\"Type\"]>\n          | ModuleService<Id, \"repository\", Claims[\"Type\"]>\n      : C extends StateAssistedConfiguration\n        ? ModuleService<Id, \"validity\", Claims[\"Type\"]>\n        : never);\n\nexport const configuredLayer = <\n  const Id extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  C extends SessionConfiguration,\n>(\n  sessions: ReturnType<typeof makeSessionModule<Id, Claims>>,\n  configuration: C,\n): Layer.Layer<\n  ModuleService<Id, \"strategy\", Claims[\"Type\"]>,\n  SessionConfigurationError,\n  SessionRequirements<C, Id, Claims>\n> => {\n  const configured = configuration.policy(sessions.moduleId);\n\n  const defaults = <A, E, R>(layer: Layer.Layer<A, E, R>) =>\n    layer.pipe(Layer.provide([cryptoLayer, hooksLayer]));\n\n  const layer =\n    configuration.mode === \"stateful\"\n      ? defaults(sessions.statefulLayer(configured))\n      : configuration.mode === \"stateless\"\n        ? defaults(sessions.statelessLayer(configured, configuration.keys))\n        : defaults(sessions.stateAssistedLayer(configured, configuration.keys));\n\n  // The selected mode determines exactly which persistence port the layer acquires.\n  return layer as Layer.Layer<\n    ModuleService<Id, \"strategy\", Claims[\"Type\"]>,\n    SessionConfigurationError,\n    SessionRequirements<C, Id, Claims>\n  >;\n};\n"],"mappings":";;;;AA0CA,MAAM,UAAU,SAAyB,cAAuB;CAC9D,IAAI;CAEJ,IAAI;EACF,MAAM,SAAS,SAAS,SAAS,QAAQ,UAAU,SAAS;EAE5D,MAAM,OAAO,SAAS,SACpB,QAAQ,eAAe,KAAK,IAAI,QAAQ,SAAS,SAAS,QAAQ,CAAC,CACrE;EAEA,SAAS,OAAO,OAAO;GACrB,YAAY,QAAQ,cAAc;GAClC,oBAAoB;GACpB,wBAAwB;GACxB,uBAAuB,SAAS,SAC9B,QAAQ,cAAc,KAAK,IAAI,KAAK,MAAM,OAAO,CAAC,GAAG,SAAS,SAAS,OAAO,CAAC,CACjF;GACA,qCAAqC,SAAS,SAAS,QAAQ,oBAAoB,MAAM;GACzF,mBAAmB,QAAQ,qBAAqB;GAChD,8BAA8B;EAChC,CAAC;CACH,QAAQ;EACN,MAAM,0BAA0B,KAAK,EAAE,QAAQ,SAAS,CAAC;CAC3D;CACA,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW,QAAQ;CAEzB,QAAQ,eAAsC;EAC5C,GAAG;EACH,QAAQ,UAAU;EAClB,UAAU,YAAY;CACxB;AACF;;AAGA,MAAa,YAAY,UAA0B,CAAC,MAClD,OAAO,OAAO;CAAE,MAAM;CAAY,QAAQ,OAAO,SAAS,IAAI;AAAE,CAAC;;AAGnE,MAAa,aACX,YAEA,OAAO,OAAO;CAAE,MAAM;CAAa,QAAQ,OAAO,SAAS,KAAK;CAAG,MAAM,QAAQ;AAAK,CAAC;;AAGzF,MAAa,iBACX,YAEA,OAAO,OAAO;CAAE,MAAM;CAAkB,QAAQ,OAAO,SAAS,IAAI;CAAG,MAAM,QAAQ;AAAK,CAAC;AAY7F,MAAa,mBAKX,UACA,kBAKG;CACH,MAAM,aAAa,cAAc,OAAO,SAAS,QAAQ;CAEzD,MAAM,YAAqB,UACzB,MAAM,KAAK,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CAAC;CAUrD,OAPE,cAAc,SAAS,aACnB,SAAS,SAAS,cAAc,UAAU,CAAC,IAC3C,cAAc,SAAS,cACrB,SAAS,SAAS,eAAe,YAAY,cAAc,IAAI,CAAC,IAChE,SAAS,SAAS,mBAAmB,YAAY,cAAc,IAAI,CAAC;AAQ9E"}