@yielded/auth 0.1.0-beta.1

package/dist/sessions/contract.mjs

@@ -0,0 +1,174 @@
+import { TokenDigest } from "../Schema.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { SessionConfigurationError, SessionError, SessionSignOutUnavailable } from "./errors.mjs";
+import { SessionInvalidationWindow } from "./invalidation.mjs";
+import { AuthenticationEvidence, SessionCapabilities, SessionId, SessionMetadata, SessionSignOut } from "./models.mjs";
+import { SessionStepUpProfileId, StepUpPending } from "./SessionStepUpPersistence.mjs";
+import { Schema } from "effect";
+//#region src/sessions/contract.ts
+/** Canonical session contracts without installing session authority or strategy Layers. */
+const makeSessionContract = (moduleId, claims) => {
+	if (!Schema.is(Schema.NonEmptyString)(moduleId)) throw SessionConfigurationError.make({ reason: "claims" });
+	const ClaimsCodec = claims;
+	const Session = Schema.Struct({
+		...SessionMetadata.fields,
+		claims: ClaimsCodec
+	});
+	const Completed = Schema.TaggedStruct("Authenticated", { session: Session });
+	const Pending = Schema.TaggedStruct("PendingAuthentication", { expiresAt: Schema.DateTimeUtcFromMillis });
+	const CompletionResult = Schema.Union([Completed, Pending]);
+	const SignOutResult = Schema.Union([SessionSignOut, SessionSignOutUnavailable]);
+	const Failure = Schema.Union([SessionError, HookDenied]);
+	const Credential = Schema.RedactedFromValue(Schema.NonEmptyString);
+	const StepUpBegin = makeOperation(`${moduleId}/session/step-up/begin`, {
+		payload: Schema.Struct({
+			sourceCredential: Credential,
+			profileId: SessionStepUpProfileId
+		}),
+		exposure: "public",
+		success: StepUpPending,
+		error: Failure,
+		access: "authenticated",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const StepUpComplete = makeOperation(`${moduleId}/session/step-up/complete`, {
+		payload: Schema.Struct({
+			sourceCredential: Credential,
+			stepUpCredential: Credential,
+			additional: AuthenticationEvidence
+		}),
+		exposure: "internal",
+		success: Session,
+		error: Failure,
+		access: "system",
+		replay: "single-use",
+		credentials: true
+	});
+	const StepUpReject = makeOperation(`${moduleId}/session/step-up/reject`, {
+		payload: Schema.Struct({ stepUpCredential: Credential }),
+		exposure: "internal",
+		success: Schema.TaggedStruct("Rejected", {}),
+		error: Failure,
+		access: "system",
+		replay: "non-idempotent"
+	});
+	const stepUpOperations = Object.freeze({
+		Begin: StepUpBegin,
+		Complete: StepUpComplete,
+		Reject: StepUpReject
+	});
+	const operations = {
+		Complete: makeOperation(`${moduleId}/session/complete`, {
+			payload: Schema.Struct({
+				evidence: AuthenticationEvidence,
+				claims: ClaimsCodec
+			}),
+			success: CompletionResult,
+			error: Failure,
+			access: "system",
+			replay: "non-idempotent",
+			credentials: true
+		}),
+		CompletePending: makeOperation(`${moduleId}/session/complete-pending`, {
+			payload: Schema.Struct({
+				credential: Credential,
+				additional: AuthenticationEvidence
+			}),
+			success: CompletionResult,
+			error: Failure,
+			access: "system",
+			replay: "single-use",
+			credentials: true
+		}),
+		RejectPending: makeOperation(`${moduleId}/session/reject-pending`, {
+			payload: Schema.Struct({
+				credential: Credential,
+				bindingDigest: TokenDigest
+			}),
+			success: Schema.TaggedStruct("Rejected", {}),
+			error: Failure,
+			access: "system",
+			replay: "non-idempotent"
+		}),
+		Capabilities: makeOperation(`${moduleId}/session/capabilities`, {
+			payload: Schema.Void,
+			success: SessionCapabilities,
+			error: Schema.Never,
+			access: "any",
+			exposure: "public",
+			replay: "read-only"
+		}),
+		Verify: makeOperation(`${moduleId}/session/verify`, {
+			payload: Schema.Struct({ credential: Credential }),
+			success: Session,
+			error: Failure,
+			access: "any",
+			replay: "read-only"
+		}),
+		Renew: makeOperation(`${moduleId}/session/renew`, {
+			payload: Schema.Struct({ credential: Credential }),
+			success: Session,
+			error: Failure,
+			access: "any",
+			replay: "non-idempotent",
+			credentials: true
+		}),
+		SignOut: makeOperation(`${moduleId}/session/sign-out`, {
+			payload: Schema.Struct({ credential: Credential }),
+			success: SignOutResult,
+			error: Failure,
+			access: "any",
+			replay: "idempotent",
+			credentials: true
+		}),
+		List: makeOperation(`${moduleId}/session/list`, {
+			payload: Schema.Struct({
+				credential: Credential,
+				cursor: Schema.optionalKey(Schema.String),
+				limit: Schema.Int.check(Schema.isBetween({
+					minimum: 1,
+					maximum: 100
+				}))
+			}),
+			success: Schema.Struct({
+				sessions: Schema.Array(SessionMetadata),
+				nextCursor: Schema.optionalKey(Schema.String)
+			}),
+			error: Failure,
+			access: "authenticated",
+			replay: "read-only"
+		}),
+		Revoke: makeOperation(`${moduleId}/session/revoke`, {
+			payload: Schema.Struct({
+				credential: Credential,
+				sessionId: SessionId
+			}),
+			success: Schema.Void,
+			error: Failure,
+			access: "authenticated",
+			replay: "idempotent"
+		}),
+		RevokeAll: makeOperation(`${moduleId}/session/revoke-all`, {
+			payload: Schema.Struct({ credential: Credential }),
+			success: SessionInvalidationWindow,
+			error: Failure,
+			access: "authenticated",
+			replay: "non-idempotent"
+		})
+	};
+	return Object.freeze({
+		moduleId,
+		Session,
+		CompletionResult,
+		operations,
+		group: operationGroup(...Object.values(operations)),
+		stepUpOperations,
+		stepUpGroup: operationGroup(...Object.values(stepUpOperations))
+	});
+};
+//#endregion
+export { makeSessionContract };
+
+//# sourceMappingURL=contract.mjs.map

package/dist/sessions/contract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.mjs","names":[],"sources":["../../src/sessions/contract.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { HookDenied } from \"../hooks/models\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport { TokenDigest } from \"../Schema\";\nimport { SessionConfigurationError, SessionError, SessionSignOutUnavailable } from \"./errors\";\nimport { SessionInvalidationWindow } from \"./invalidation\";\nimport {\n  AuthenticationEvidence,\n  SessionCapabilities,\n  SessionId,\n  SessionMetadata,\n  SessionSignOut,\n} from \"./models\";\nimport { SessionStepUpProfileId, StepUpPending } from \"./SessionStepUpPersistence\";\n\n/** Canonical session contracts without installing session authority or strategy Layers. */\nexport const makeSessionContract = <\n  const Id extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  claims: Claims,\n) => {\n  if (!Schema.is(Schema.NonEmptyString)(moduleId))\n    throw SessionConfigurationError.make({ reason: \"claims\" });\n\n  const ClaimsCodec: Schema.Codec<\n    Claims[\"Type\"],\n    Claims[\"Encoded\"],\n    Claims[\"DecodingServices\"],\n    Claims[\"EncodingServices\"]\n  > = claims;\n\n  const Session = Schema.Struct({ ...SessionMetadata.fields, claims: ClaimsCodec });\n\n  const Completed = Schema.TaggedStruct(\"Authenticated\", { session: Session });\n\n  const Pending = Schema.TaggedStruct(\"PendingAuthentication\", {\n    expiresAt: Schema.DateTimeUtcFromMillis,\n  });\n\n  const CompletionResult = Schema.Union([Completed, Pending]);\n\n  const SignOutResult = Schema.Union([SessionSignOut, SessionSignOutUnavailable]);\n\n  const Failure = Schema.Union([SessionError, HookDenied]);\n  const Credential = Schema.RedactedFromValue(Schema.NonEmptyString);\n\n  const StepUpBegin = makeOperation(`${moduleId}/session/step-up/begin`, {\n    payload: Schema.Struct({ sourceCredential: Credential, profileId: SessionStepUpProfileId }),\n    exposure: \"public\",\n    success: StepUpPending,\n    error: Failure,\n    access: \"authenticated\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const StepUpComplete = makeOperation(`${moduleId}/session/step-up/complete`, {\n    payload: Schema.Struct({\n      sourceCredential: Credential,\n      stepUpCredential: Credential,\n      additional: AuthenticationEvidence,\n    }),\n    exposure: \"internal\",\n    success: Session,\n    error: Failure,\n    access: \"system\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const StepUpReject = makeOperation(`${moduleId}/session/step-up/reject`, {\n    payload: Schema.Struct({ stepUpCredential: Credential }),\n    exposure: \"internal\",\n    success: Schema.TaggedStruct(\"Rejected\", {}),\n    error: Failure,\n    access: \"system\",\n    replay: \"non-idempotent\",\n  });\n\n  const stepUpOperations = Object.freeze({\n    Begin: StepUpBegin,\n    Complete: StepUpComplete,\n    Reject: StepUpReject,\n  });\n\n  const Complete = makeOperation(`${moduleId}/session/complete`, {\n    payload: Schema.Struct({ evidence: AuthenticationEvidence, claims: ClaimsCodec }),\n    success: CompletionResult,\n    error: Failure,\n    access: \"system\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const CompletePending = makeOperation(`${moduleId}/session/complete-pending`, {\n    payload: Schema.Struct({ credential: Credential, additional: AuthenticationEvidence }),\n    success: CompletionResult,\n    error: Failure,\n    access: \"system\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const RejectPending = makeOperation(`${moduleId}/session/reject-pending`, {\n    payload: Schema.Struct({ credential: Credential, bindingDigest: TokenDigest }),\n    success: Schema.TaggedStruct(\"Rejected\", {}),\n    error: Failure,\n    access: \"system\",\n    replay: \"non-idempotent\",\n  });\n\n  const Capabilities = makeOperation(`${moduleId}/session/capabilities`, {\n    payload: Schema.Void,\n    success: SessionCapabilities,\n    error: Schema.Never,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"read-only\",\n  });\n\n  const Verify = makeOperation(`${moduleId}/session/verify`, {\n    payload: Schema.Struct({ credential: Credential }),\n    success: Session,\n    error: Failure,\n    access: \"any\",\n    replay: \"read-only\",\n  });\n\n  const Renew = makeOperation(`${moduleId}/session/renew`, {\n    payload: Schema.Struct({ credential: Credential }),\n    success: Session,\n    error: Failure,\n    access: \"any\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const SignOut = makeOperation(`${moduleId}/session/sign-out`, {\n    payload: Schema.Struct({ credential: Credential }),\n    success: SignOutResult,\n    error: Failure,\n    access: \"any\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const List = makeOperation(`${moduleId}/session/list`, {\n    payload: Schema.Struct({\n      credential: Credential,\n      cursor: Schema.optionalKey(Schema.String),\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100 })),\n    }),\n    success: Schema.Struct({\n      sessions: Schema.Array(SessionMetadata),\n      nextCursor: Schema.optionalKey(Schema.String),\n    }),\n    error: Failure,\n    access: \"authenticated\",\n    replay: \"read-only\",\n  });\n\n  const Revoke = makeOperation(`${moduleId}/session/revoke`, {\n    payload: Schema.Struct({ credential: Credential, sessionId: SessionId }),\n    success: Schema.Void,\n    error: Failure,\n    access: \"authenticated\",\n    replay: \"idempotent\",\n  });\n\n  const RevokeAll = makeOperation(`${moduleId}/session/revoke-all`, {\n    payload: Schema.Struct({ credential: Credential }),\n    success: SessionInvalidationWindow,\n    error: Failure,\n    access: \"authenticated\",\n    replay: \"non-idempotent\",\n  });\n\n  const operations = {\n    Complete,\n    CompletePending,\n    RejectPending,\n    Capabilities,\n    Verify,\n    Renew,\n    SignOut,\n    List,\n    Revoke,\n    RevokeAll,\n  };\n\n  return Object.freeze({\n    moduleId,\n    Session,\n    CompletionResult,\n    operations,\n    group: operationGroup(...Object.values(operations)),\n    stepUpOperations,\n    stepUpGroup: operationGroup(...Object.values(stepUpOperations)),\n  });\n};\n"],"mappings":";;;;;;;;;;AAiBA,MAAa,uBAIX,UACA,WACG;CACH,IAAI,CAAC,OAAO,GAAG,OAAO,cAAc,CAAC,CAAC,QAAQ,GAC5C,MAAM,0BAA0B,KAAK,EAAE,QAAQ,SAAS,CAAC;CAE3D,MAAM,cAKF;CAEJ,MAAM,UAAU,OAAO,OAAO;EAAE,GAAG,gBAAgB;EAAQ,QAAQ;CAAY,CAAC;CAEhF,MAAM,YAAY,OAAO,aAAa,iBAAiB,EAAE,SAAS,QAAQ,CAAC;CAE3E,MAAM,UAAU,OAAO,aAAa,yBAAyB,EAC3D,WAAW,OAAO,sBACpB,CAAC;CAED,MAAM,mBAAmB,OAAO,MAAM,CAAC,WAAW,OAAO,CAAC;CAE1D,MAAM,gBAAgB,OAAO,MAAM,CAAC,gBAAgB,yBAAyB,CAAC;CAE9E,MAAM,UAAU,OAAO,MAAM,CAAC,cAAc,UAAU,CAAC;CACvD,MAAM,aAAa,OAAO,kBAAkB,OAAO,cAAc;CAEjE,MAAM,cAAc,cAAc,GAAG,SAAS,yBAAyB;EACrE,SAAS,OAAO,OAAO;GAAE,kBAAkB;GAAY,WAAW;EAAuB,CAAC;EAC1F,UAAU;EACV,SAAS;EACT,OAAO;EACP,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,iBAAiB,cAAc,GAAG,SAAS,4BAA4B;EAC3E,SAAS,OAAO,OAAO;GACrB,kBAAkB;GAClB,kBAAkB;GAClB,YAAY;EACd,CAAC;EACD,UAAU;EACV,SAAS;EACT,OAAO;EACP,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,eAAe,cAAc,GAAG,SAAS,0BAA0B;EACvE,SAAS,OAAO,OAAO,EAAE,kBAAkB,WAAW,CAAC;EACvD,UAAU;EACV,SAAS,OAAO,aAAa,YAAY,CAAC,CAAC;EAC3C,OAAO;EACP,QAAQ;EACR,QAAQ;CACV,CAAC;CAED,MAAM,mBAAmB,OAAO,OAAO;EACrC,OAAO;EACP,UAAU;EACV,QAAQ;CACV,CAAC;CA8FD,MAAM,aAAa;EACjB,UA7Fe,cAAc,GAAG,SAAS,oBAAoB;GAC7D,SAAS,OAAO,OAAO;IAAE,UAAU;IAAwB,QAAQ;GAAY,CAAC;GAChF,SAAS;GACT,OAAO;GACP,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAsFS;EACP,iBArFsB,cAAc,GAAG,SAAS,4BAA4B;GAC5E,SAAS,OAAO,OAAO;IAAE,YAAY;IAAY,YAAY;GAAuB,CAAC;GACrF,SAAS;GACT,OAAO;GACP,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CA8EgB;EACd,eA7EoB,cAAc,GAAG,SAAS,0BAA0B;GACxE,SAAS,OAAO,OAAO;IAAE,YAAY;IAAY,eAAe;GAAY,CAAC;GAC7E,SAAS,OAAO,aAAa,YAAY,CAAC,CAAC;GAC3C,OAAO;GACP,QAAQ;GACR,QAAQ;EACV,CAuEc;EACZ,cAtEmB,cAAc,GAAG,SAAS,wBAAwB;GACrE,SAAS,OAAO;GAChB,SAAS;GACT,OAAO,OAAO;GACd,QAAQ;GACR,UAAU;GACV,QAAQ;EACV,CA+Da;EACX,QA9Da,cAAc,GAAG,SAAS,kBAAkB;GACzD,SAAS,OAAO,OAAO,EAAE,YAAY,WAAW,CAAC;GACjD,SAAS;GACT,OAAO;GACP,QAAQ;GACR,QAAQ;EACV,CAwDO;EACL,OAvDY,cAAc,GAAG,SAAS,iBAAiB;GACvD,SAAS,OAAO,OAAO,EAAE,YAAY,WAAW,CAAC;GACjD,SAAS;GACT,OAAO;GACP,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAgDM;EACJ,SA/Cc,cAAc,GAAG,SAAS,oBAAoB;GAC5D,SAAS,OAAO,OAAO,EAAE,YAAY,WAAW,CAAC;GACjD,SAAS;GACT,OAAO;GACP,QAAQ;GACR,QAAQ;GACR,aAAa;EACf,CAwCQ;EACN,MAvCW,cAAc,GAAG,SAAS,gBAAgB;GACrD,SAAS,OAAO,OAAO;IACrB,YAAY;IACZ,QAAQ,OAAO,YAAY,OAAO,MAAM;IACxC,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;KAAE,SAAS;KAAG,SAAS;IAAI,CAAC,CAAC;GACxE,CAAC;GACD,SAAS,OAAO,OAAO;IACrB,UAAU,OAAO,MAAM,eAAe;IACtC,YAAY,OAAO,YAAY,OAAO,MAAM;GAC9C,CAAC;GACD,OAAO;GACP,QAAQ;GACR,QAAQ;EACV,CA0BK;EACH,QAzBa,cAAc,GAAG,SAAS,kBAAkB;GACzD,SAAS,OAAO,OAAO;IAAE,YAAY;IAAY,WAAW;GAAU,CAAC;GACvE,SAAS,OAAO;GAChB,OAAO;GACP,QAAQ;GACR,QAAQ;EACV,CAmBO;EACL,WAlBgB,cAAc,GAAG,SAAS,sBAAsB;GAChE,SAAS,OAAO,OAAO,EAAE,YAAY,WAAW,CAAC;GACjD,SAAS;GACT,OAAO;GACP,QAAQ;GACR,QAAQ;EACV,CAYU;CACV;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA,OAAO,eAAe,GAAG,OAAO,OAAO,UAAU,CAAC;EAClD;EACA,aAAa,eAAe,GAAG,OAAO,OAAO,gBAAgB,CAAC;CAChE,CAAC;AACH"}

package/dist/sessions/crypto.d.mts

@@ -0,0 +1,24 @@
+import { SessionConfigurationError, SessionInvalid, SessionUnavailable } from "./errors.mjs";
+import { SubtleCrypto } from "../WebCrypto.mjs";
+import { Crypto, Effect, Redacted, Schema } from "effect";
+//#region src/sessions/crypto.d.ts
+interface SessionSigningKeyring {
+  readonly activeKeyId: string;
+  /** At least 32 cryptographically random bytes per key, encoded as base64url. */
+  readonly keys: ReadonlyArray<{
+    readonly id: string;
+    readonly material: Redacted.Redacted<string>;
+  }>;
+}
+declare const makeSessionSecrets: (moduleId: string) => Effect.Effect<{
+  generate: () => Effect.Effect<Redacted.Redacted<string>, SessionUnavailable, never>;
+  digest: (token: Redacted.Redacted<string>, purpose: "bearer" | "pending" | "step-up" | "step-up-binding") => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/TokenDigest">, SessionInvalid | SessionUnavailable, never>;
+}, never, Crypto.Crypto>;
+/** Immutable key snapshot: retirement is effective only after every runtime installs it. */
+declare const makeSessionSigningCodec: <S extends Schema.Top>(schema: S, configuration: SessionSigningKeyring, maximumTokenBytes: number) => Effect.Effect<{
+  encode: (claims: S["Type"]) => Effect.Effect<Redacted.Redacted<string>, SessionUnavailable, Exclude<S["EncodingServices"], S["DecodingServices"] | S["EncodingServices"]>>;
+  decode: (credential: Redacted.Redacted<string>) => Effect.Effect<S["Type"], SessionInvalid | SessionUnavailable, Exclude<S["DecodingServices"], S["DecodingServices"] | S["EncodingServices"]>>;
+}, SessionConfigurationError, SubtleCrypto | S["DecodingServices"] | S["EncodingServices"]>;
+//#endregion
+export { SessionSigningKeyring, makeSessionSecrets, makeSessionSigningCodec };
+//# sourceMappingURL=crypto.d.mts.map

package/dist/sessions/crypto.mjs

@@ -0,0 +1,106 @@
+import { TokenDigest } from "../Schema.mjs";
+import { SessionConfigurationError, SessionInvalid, SessionUnavailable } from "./errors.mjs";
+import { SubtleCrypto } from "../WebCrypto.mjs";
+import { Crypto, Effect, Encoding, Redacted, Result, Schema } from "effect";
+//#region src/sessions/crypto.ts
+const opaqueCredential = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
+const keyIdSchema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/));
+const Keyring = Schema.Struct({
+	activeKeyId: keyIdSchema,
+	keys: Schema.Array(Schema.Struct({
+		id: keyIdSchema,
+		material: Schema.Redacted(Schema.String)
+	})).check(Schema.isMinLength(1))
+});
+const tokenFormat = Schema.String.check(Schema.isPattern(/^eas1\.[A-Za-z0-9_-]{1,64}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/));
+const textEncoder = new TextEncoder();
+const digestMessage = Schema.fromJsonString(Schema.Struct({
+	namespace: Schema.Literal("effect-auth/session"),
+	moduleId: Schema.String,
+	purpose: Schema.Literals([
+		"bearer",
+		"pending",
+		"step-up",
+		"step-up-binding"
+	]),
+	secret: Schema.String
+}));
+const makeSessionSecrets = Effect.fn("makeSessionSecrets")(function* (moduleId) {
+	const crypto = yield* Crypto.Crypto;
+	return {
+		generate: Effect.fn("SessionSecrets.generate")(function* () {
+			const bytes = yield* crypto.randomBytes(32).pipe(Effect.mapError(() => SessionUnavailable.make({})));
+			return Redacted.make(Encoding.encodeBase64Url(bytes));
+		}),
+		digest: Effect.fn("SessionSecrets.digest")(function* (token, purpose) {
+			yield* Schema.decodeEffect(opaqueCredential)(Redacted.value(token)).pipe(Effect.mapError(() => SessionInvalid.make({})));
+			const message = yield* Schema.encodeEffect(digestMessage)({
+				namespace: "effect-auth/session",
+				moduleId,
+				purpose,
+				secret: Redacted.value(token)
+			}).pipe(Effect.orDie);
+			const digest = yield* crypto.digest("SHA-256", textEncoder.encode(message)).pipe(Effect.mapError(() => SessionUnavailable.make({})));
+			return TokenDigest.make(Encoding.encodeBase64Url(digest));
+		})
+	};
+});
+/** Immutable key snapshot: retirement is effective only after every runtime installs it. */
+const makeSessionSigningCodec = Effect.fn("makeSessionSigningCodec")(function* (schema, configuration, maximumTokenBytes) {
+	const checked = yield* Schema.decodeEffect(Keyring)(configuration).pipe(Effect.mapError(() => SessionConfigurationError.make({ reason: "keyring" })));
+	const subtle = yield* SubtleCrypto;
+	const services = yield* Effect.context();
+	const keys = /* @__PURE__ */ new Map();
+	for (const entry of checked.keys) {
+		yield* Schema.decodeEffect(keyIdSchema)(entry.id).pipe(Effect.mapError(() => SessionConfigurationError.make({ reason: "keyring" })));
+		const material = Result.getOrUndefined(Encoding.decodeBase64Url(Redacted.value(entry.material)));
+		if (keys.has(entry.id) || material === void 0 || material.length < 32) return yield* SessionConfigurationError.make({ reason: "keyring" });
+		const key = yield* Effect.tryPromise({
+			try: () => subtle.importKey("raw", material, {
+				name: "HMAC",
+				hash: "SHA-256"
+			}, false, ["sign", "verify"]),
+			catch: () => SessionConfigurationError.make({ reason: "keyring" })
+		});
+		keys.set(entry.id, key);
+	}
+	const activeKeyId = checked.activeKeyId;
+	const activeKey = keys.get(activeKeyId);
+	if (activeKey === void 0) return yield* SessionConfigurationError.make({ reason: "keyring" });
+	const codec = Schema.fromJsonString(Schema.toCodecJson(schema));
+	const encode = Schema.encodeEffect(codec);
+	const decode = Schema.decodeEffect(codec);
+	return {
+		encode: Effect.fn("SessionSigningCodec.encode")(function* (claims) {
+			const json = yield* encode(claims).pipe(Effect.provide(services), Effect.mapError(() => SessionUnavailable.make({})));
+			const message = `eas1.${activeKeyId}.${Encoding.encodeBase64Url(json)}`;
+			const signature = yield* Effect.tryPromise({
+				try: () => subtle.sign("HMAC", activeKey, textEncoder.encode(message)),
+				catch: () => SessionUnavailable.make({})
+			});
+			const token = `${message}.${Encoding.encodeBase64Url(new Uint8Array(signature))}`;
+			if (token.length > maximumTokenBytes) return yield* SessionUnavailable.make({});
+			return Redacted.make(token);
+		}),
+		decode: Effect.fn("SessionSigningCodec.decode")(function* (credential) {
+			const token = Redacted.value(credential);
+			if (token.length > maximumTokenBytes) return yield* SessionInvalid.make({});
+			yield* Schema.decodeEffect(tokenFormat)(token).pipe(Effect.mapError(() => SessionInvalid.make({})));
+			const [version, keyId, payload, signatureText] = token.split(".");
+			const key = keys.get(keyId);
+			const signature = Result.getOrUndefined(Encoding.decodeBase64Url(signatureText));
+			if (key === void 0 || signature === void 0 || signature.length !== 32) return yield* SessionInvalid.make({});
+			if (!(yield* Effect.tryPromise({
+				try: () => subtle.verify("HMAC", key, signature, textEncoder.encode(`${version}.${keyId}.${payload}`)),
+				catch: () => SessionUnavailable.make({})
+			}))) return yield* SessionInvalid.make({});
+			const json = Result.getOrUndefined(Encoding.decodeBase64UrlString(payload));
+			if (json === void 0) return yield* SessionInvalid.make({});
+			return yield* decode(json).pipe(Effect.provide(services), Effect.mapError(() => SessionInvalid.make({})));
+		})
+	};
+});
+//#endregion
+export { makeSessionSecrets, makeSessionSigningCodec };
+
+//# sourceMappingURL=crypto.mjs.map

package/dist/sessions/crypto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.mjs","names":[],"sources":["../../src/sessions/crypto.ts"],"sourcesContent":["import { Crypto, Effect, Encoding, Redacted, Result, Schema } from \"effect\";\n\nimport { TokenDigest } from \"../Schema\";\nimport { SubtleCrypto } from \"../WebCrypto\";\nimport { SessionConfigurationError, SessionInvalid, SessionUnavailable } from \"./errors\";\n\nexport interface SessionSigningKeyring {\n  readonly activeKeyId: string;\n  /** At least 32 cryptographically random bytes per key, encoded as base64url. */\n  readonly keys: ReadonlyArray<{\n    readonly id: string;\n    readonly material: Redacted.Redacted<string>;\n  }>;\n}\n\nconst opaqueCredential = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));\nconst keyIdSchema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/));\n\nconst Keyring = Schema.Struct({\n  activeKeyId: keyIdSchema,\n  keys: Schema.Array(\n    Schema.Struct({ id: keyIdSchema, material: Schema.Redacted(Schema.String) }),\n  ).check(Schema.isMinLength(1)),\n});\n\nconst tokenFormat = Schema.String.check(\n  Schema.isPattern(/^eas1\\.[A-Za-z0-9_-]{1,64}\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/),\n);\n\nconst textEncoder = new TextEncoder();\n\nconst digestMessage = Schema.fromJsonString(\n  Schema.Struct({\n    namespace: Schema.Literal(\"effect-auth/session\"),\n    moduleId: Schema.String,\n    purpose: Schema.Literals([\"bearer\", \"pending\", \"step-up\", \"step-up-binding\"]),\n    secret: Schema.String,\n  }),\n);\n\nexport const makeSessionSecrets = Effect.fn(\"makeSessionSecrets\")(function* (moduleId: string) {\n  const crypto = yield* Crypto.Crypto;\n\n  return {\n    generate: Effect.fn(\"SessionSecrets.generate\")(function* () {\n      const bytes = yield* crypto\n        .randomBytes(32)\n        .pipe(Effect.mapError(() => SessionUnavailable.make({})));\n\n      return Redacted.make(Encoding.encodeBase64Url(bytes));\n    }),\n    digest: Effect.fn(\"SessionSecrets.digest\")(function* (\n      token: Redacted.Redacted<string>,\n      purpose: \"bearer\" | \"pending\" | \"step-up\" | \"step-up-binding\",\n    ) {\n      yield* Schema.decodeEffect(opaqueCredential)(Redacted.value(token)).pipe(\n        Effect.mapError(() => SessionInvalid.make({})),\n      );\n\n      const message = yield* Schema.encodeEffect(digestMessage)({\n        namespace: \"effect-auth/session\",\n        moduleId,\n        purpose,\n        secret: Redacted.value(token),\n      }).pipe(Effect.orDie);\n\n      const digest = yield* crypto\n        .digest(\"SHA-256\", textEncoder.encode(message))\n        .pipe(Effect.mapError(() => SessionUnavailable.make({})));\n\n      return TokenDigest.make(Encoding.encodeBase64Url(digest));\n    }),\n  };\n});\n\n/** Immutable key snapshot: retirement is effective only after every runtime installs it. */\nexport const makeSessionSigningCodec = Effect.fn(\"makeSessionSigningCodec\")(function* <\n  S extends Schema.Top,\n>(schema: S, configuration: SessionSigningKeyring, maximumTokenBytes: number) {\n  const checked = yield* Schema.decodeEffect(Keyring)(configuration).pipe(\n    Effect.mapError(() => SessionConfigurationError.make({ reason: \"keyring\" })),\n  );\n\n  const subtle = yield* SubtleCrypto;\n  const services = yield* Effect.context<S[\"DecodingServices\"] | S[\"EncodingServices\"]>();\n  const keys = new Map<string, CryptoKey>();\n\n  for (const entry of checked.keys) {\n    yield* Schema.decodeEffect(keyIdSchema)(entry.id).pipe(\n      Effect.mapError(() => SessionConfigurationError.make({ reason: \"keyring\" })),\n    );\n\n    const material = Result.getOrUndefined(\n      Encoding.decodeBase64Url(Redacted.value(entry.material)),\n    );\n\n    if (keys.has(entry.id) || material === undefined || material.length < 32) {\n      return yield* SessionConfigurationError.make({ reason: \"keyring\" });\n    }\n\n    const key = yield* Effect.tryPromise({\n      try: () =>\n        subtle.importKey(\n          \"raw\",\n          material as BufferSource,\n          { name: \"HMAC\", hash: \"SHA-256\" },\n          false,\n          [\"sign\", \"verify\"],\n        ),\n      catch: () => SessionConfigurationError.make({ reason: \"keyring\" }),\n    });\n\n    keys.set(entry.id, key);\n  }\n  const activeKeyId = checked.activeKeyId;\n  const activeKey = keys.get(activeKeyId);\n\n  if (activeKey === undefined) return yield* SessionConfigurationError.make({ reason: \"keyring\" });\n  const codec = Schema.fromJsonString(Schema.toCodecJson(schema));\n  const encode = Schema.encodeEffect(codec);\n  const decode = Schema.decodeEffect(codec);\n\n  return {\n    encode: Effect.fn(\"SessionSigningCodec.encode\")(function* (claims: S[\"Type\"]) {\n      const json = yield* encode(claims).pipe(\n        Effect.provide(services),\n        Effect.mapError(() => SessionUnavailable.make({})),\n      );\n\n      const message = `eas1.${activeKeyId}.${Encoding.encodeBase64Url(json)}`;\n\n      const signature = yield* Effect.tryPromise({\n        try: () => subtle.sign(\"HMAC\", activeKey, textEncoder.encode(message)),\n        catch: () => SessionUnavailable.make({}),\n      });\n\n      const token = `${message}.${Encoding.encodeBase64Url(new Uint8Array(signature))}`;\n\n      if (token.length > maximumTokenBytes) return yield* SessionUnavailable.make({});\n\n      return Redacted.make(token);\n    }),\n    decode: Effect.fn(\"SessionSigningCodec.decode\")(function* (\n      credential: Redacted.Redacted<string>,\n    ) {\n      const token = Redacted.value(credential);\n\n      if (token.length > maximumTokenBytes) return yield* SessionInvalid.make({});\n      yield* Schema.decodeEffect(tokenFormat)(token).pipe(\n        Effect.mapError(() => SessionInvalid.make({})),\n      );\n      const [version, keyId, payload, signatureText] = token.split(\".\");\n      const key = keys.get(keyId);\n      const signature = Result.getOrUndefined(Encoding.decodeBase64Url(signatureText));\n\n      if (key === undefined || signature === undefined || signature.length !== 32)\n        return yield* SessionInvalid.make({});\n\n      const valid = yield* Effect.tryPromise({\n        try: () =>\n          subtle.verify(\n            \"HMAC\",\n            key,\n            signature as BufferSource,\n            textEncoder.encode(`${version}.${keyId}.${payload}`),\n          ),\n        catch: () => SessionUnavailable.make({}),\n      });\n\n      if (!valid) return yield* SessionInvalid.make({});\n      const json = Result.getOrUndefined(Encoding.decodeBase64UrlString(payload));\n\n      if (json === undefined) return yield* SessionInvalid.make({});\n\n      return yield* decode(json).pipe(\n        Effect.provide(services),\n        Effect.mapError(() => SessionInvalid.make({})),\n      );\n    }),\n  };\n});\n"],"mappings":";;;;;AAeA,MAAM,mBAAmB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AACpF,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU,uBAAuB,CAAC;AAEjF,MAAM,UAAU,OAAO,OAAO;CAC5B,aAAa;CACb,MAAM,OAAO,MACX,OAAO,OAAO;EAAE,IAAI;EAAa,UAAU,OAAO,SAAS,OAAO,MAAM;CAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,cAAc,OAAO,OAAO,MAChC,OAAO,UAAU,6DAA6D,CAChF;AAEA,MAAM,cAAc,IAAI,YAAY;AAEpC,MAAM,gBAAgB,OAAO,eAC3B,OAAO,OAAO;CACZ,WAAW,OAAO,QAAQ,qBAAqB;CAC/C,UAAU,OAAO;CACjB,SAAS,OAAO,SAAS;EAAC;EAAU;EAAW;EAAW;CAAiB,CAAC;CAC5E,QAAQ,OAAO;AACjB,CAAC,CACH;AAEA,MAAa,qBAAqB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,UAAkB;CAC7F,MAAM,SAAS,OAAO,OAAO;CAE7B,OAAO;EACL,UAAU,OAAO,GAAG,yBAAyB,CAAC,CAAC,aAAa;GAC1D,MAAM,QAAQ,OAAO,OAClB,YAAY,EAAE,CAAC,CACf,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE1D,OAAO,SAAS,KAAK,SAAS,gBAAgB,KAAK,CAAC;EACtD,CAAC;EACD,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACzC,OACA,SACA;GACA,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,KAClE,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;GAEA,MAAM,UAAU,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC;IACxD,WAAW;IACX;IACA;IACA,QAAQ,SAAS,MAAM,KAAK;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK;GAEpB,MAAM,SAAS,OAAO,OACnB,OAAO,WAAW,YAAY,OAAO,OAAO,CAAC,CAAC,CAC9C,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;GAE1D,OAAO,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;EAC1D,CAAC;CACH;AACF,CAAC;;AAGD,MAAa,0BAA0B,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAE1E,QAAW,eAAsC,mBAA2B;CAC5E,MAAM,UAAU,OAAO,OAAO,aAAa,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,KACjE,OAAO,eAAe,0BAA0B,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC,CAC7E;CAEA,MAAM,SAAS,OAAO;CACtB,MAAM,WAAW,OAAO,OAAO,QAAuD;CACtF,MAAM,uBAAO,IAAI,IAAuB;CAExC,KAAK,MAAM,SAAS,QAAQ,MAAM;EAChC,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAChD,OAAO,eAAe,0BAA0B,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC,CAC7E;EAEA,MAAM,WAAW,OAAO,eACtB,SAAS,gBAAgB,SAAS,MAAM,MAAM,QAAQ,CAAC,CACzD;EAEA,IAAI,KAAK,IAAI,MAAM,EAAE,KAAK,aAAa,KAAA,KAAa,SAAS,SAAS,IACpE,OAAO,OAAO,0BAA0B,KAAK,EAAE,QAAQ,UAAU,CAAC;EAGpE,MAAM,MAAM,OAAO,OAAO,WAAW;GACnC,WACE,OAAO,UACL,OACA,UACA;IAAE,MAAM;IAAQ,MAAM;GAAU,GAChC,OACA,CAAC,QAAQ,QAAQ,CACnB;GACF,aAAa,0BAA0B,KAAK,EAAE,QAAQ,UAAU,CAAC;EACnE,CAAC;EAED,KAAK,IAAI,MAAM,IAAI,GAAG;CACxB;CACA,MAAM,cAAc,QAAQ;CAC5B,MAAM,YAAY,KAAK,IAAI,WAAW;CAEtC,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,0BAA0B,KAAK,EAAE,QAAQ,UAAU,CAAC;CAC/F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,MAAM,CAAC;CAC9D,MAAM,SAAS,OAAO,aAAa,KAAK;CACxC,MAAM,SAAS,OAAO,aAAa,KAAK;CAExC,OAAO;EACL,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,QAAmB;GAC5E,MAAM,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,KACjC,OAAO,QAAQ,QAAQ,GACvB,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;GAEA,MAAM,UAAU,QAAQ,YAAY,GAAG,SAAS,gBAAgB,IAAI;GAEpE,MAAM,YAAY,OAAO,OAAO,WAAW;IACzC,WAAW,OAAO,KAAK,QAAQ,WAAW,YAAY,OAAO,OAAO,CAAC;IACrE,aAAa,mBAAmB,KAAK,CAAC,CAAC;GACzC,CAAC;GAED,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,gBAAgB,IAAI,WAAW,SAAS,CAAC;GAE9E,IAAI,MAAM,SAAS,mBAAmB,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;GAE9E,OAAO,SAAS,KAAK,KAAK;EAC5B,CAAC;EACD,QAAQ,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC9C,YACA;GACA,MAAM,QAAQ,SAAS,MAAM,UAAU;GAEvC,IAAI,MAAM,SAAS,mBAAmB,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;GAC1E,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAC7C,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;GACA,MAAM,CAAC,SAAS,OAAO,SAAS,iBAAiB,MAAM,MAAM,GAAG;GAChE,MAAM,MAAM,KAAK,IAAI,KAAK;GAC1B,MAAM,YAAY,OAAO,eAAe,SAAS,gBAAgB,aAAa,CAAC;GAE/E,IAAI,QAAQ,KAAA,KAAa,cAAc,KAAA,KAAa,UAAU,WAAW,IACvE,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;GAatC,IAAI,EAAC,OAXgB,OAAO,WAAW;IACrC,WACE,OAAO,OACL,QACA,KACA,WACA,YAAY,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CACrD;IACF,aAAa,mBAAmB,KAAK,CAAC,CAAC;GACzC,CAAC,IAEW,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;GAChD,MAAM,OAAO,OAAO,eAAe,SAAS,sBAAsB,OAAO,CAAC;GAE1E,IAAI,SAAS,KAAA,GAAW,OAAO,OAAO,eAAe,KAAK,CAAC,CAAC;GAE5D,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,KACzB,OAAO,QAAQ,QAAQ,GACvB,OAAO,eAAe,eAAe,KAAK,CAAC,CAAC,CAAC,CAC/C;EACF,CAAC;CACH;AACF,CAAC"}

package/dist/sessions/definition.d.mts

@@ -0,0 +1,11 @@
+import { makeSessionModule } from "./module.mjs";
+import { Schema } from "effect";
+//#region src/sessions/definition.d.ts
+/** Standalone session contracts. Auth definitions bind these automatically. */
+declare function make<Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(claims: Claims): ReturnType<typeof makeSessionModule<"effect-auth/sessions", Claims>>;
+declare function make<Claims extends Schema.Codec<unknown, unknown, unknown, unknown>, const Id extends string>(claims: Claims, options: {
+  readonly namespace: Id;
+}): ReturnType<typeof makeSessionModule<Id, Claims>>;
+//#endregion
+export { make };
+//# sourceMappingURL=definition.d.mts.map

package/dist/sessions/definition.mjs

@@ -0,0 +1,10 @@
+import { makeSessionModule } from "./module.mjs";
+//#region src/sessions/definition.ts
+function make(claims, options) {
+	if (options === void 0) return makeSessionModule("effect-auth/sessions", claims);
+	return makeSessionModule(options.namespace, claims);
+}
+//#endregion
+export { make };
+
+//# sourceMappingURL=definition.mjs.map

package/dist/sessions/definition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.mjs","names":[],"sources":["../../src/sessions/definition.ts"],"sourcesContent":["import type { Schema } from \"effect\";\n\nimport { makeSessionModule } from \"./module\";\n\n/** Standalone session contracts. Auth definitions bind these automatically. */\nexport function make<Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(\n  claims: Claims,\n): ReturnType<typeof makeSessionModule<\"effect-auth/sessions\", Claims>>;\n\nexport function make<\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  const Id extends string,\n>(\n  claims: Claims,\n  options: { readonly namespace: Id },\n): ReturnType<typeof makeSessionModule<Id, Claims>>;\n\nexport function make<\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  const Id extends string,\n>(claims: Claims, options?: { readonly namespace: Id }) {\n  if (options === undefined) return makeSessionModule(\"effect-auth/sessions\", claims);\n\n  return makeSessionModule(options.namespace, claims);\n}\n"],"mappings":";;AAiBA,SAAgB,KAGd,QAAgB,SAAsC;CACtD,IAAI,YAAY,KAAA,GAAW,OAAO,kBAAkB,wBAAwB,MAAM;CAElF,OAAO,kBAAkB,QAAQ,WAAW,MAAM;AACpD"}

package/dist/sessions/errors.d.mts

@@ -0,0 +1,35 @@
+import { Schema } from "effect";
+//#region src/sessions/errors.d.ts
+declare const SessionInvalid_base: Schema.Class<SessionInvalid, Schema.TaggedStruct<"SessionInvalid", {}>, import("effect/Cause").YieldableError>;
+declare class SessionInvalid extends SessionInvalid_base {}
+declare const SessionUnavailable_base: Schema.Class<SessionUnavailable, Schema.TaggedStruct<"SessionUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class SessionUnavailable extends SessionUnavailable_base {}
+declare const StaleAuthentication_base: Schema.Class<StaleAuthentication, Schema.TaggedStruct<"StaleAuthentication", {}>, import("effect/Cause").YieldableError>;
+declare class StaleAuthentication extends StaleAuthentication_base {}
+declare const SessionRenewalTooEarly_base: Schema.Class<SessionRenewalTooEarly, Schema.TaggedStruct<"SessionRenewalTooEarly", {
+  readonly retryAt: Schema.DateTimeUtcFromMillis;
+}>, import("effect/Cause").YieldableError>;
+declare class SessionRenewalTooEarly extends SessionRenewalTooEarly_base {}
+declare const SessionConflict_base: Schema.Class<SessionConflict, Schema.TaggedStruct<"SessionConflict", {}>, import("effect/Cause").YieldableError>;
+declare class SessionConflict extends SessionConflict_base {}
+declare const SessionCapabilityUnsupported_base: Schema.Class<SessionCapabilityUnsupported, Schema.TaggedStruct<"SessionCapabilityUnsupported", {
+  readonly capability: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+declare class SessionCapabilityUnsupported extends SessionCapabilityUnsupported_base {}
+declare const SessionConfigurationError_base: Schema.Class<SessionConfigurationError, Schema.TaggedStruct<"SessionConfigurationError", {
+  readonly reason: Schema.Literals<readonly ["policy", "keyring", "claims", "capability", "pending-authentication", "step-up"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class SessionConfigurationError extends SessionConfigurationError_base {}
+declare const PendingAuthenticationInvalid_base: Schema.Class<PendingAuthenticationInvalid, Schema.TaggedStruct<"PendingAuthenticationInvalid", {}>, import("effect/Cause").YieldableError>;
+declare class PendingAuthenticationInvalid extends PendingAuthenticationInvalid_base {}
+declare const SessionStepUpInvalid_base: Schema.Class<SessionStepUpInvalid, Schema.TaggedStruct<"SessionStepUpInvalid", {}>, import("effect/Cause").YieldableError>;
+declare class SessionStepUpInvalid extends SessionStepUpInvalid_base {}
+declare const SessionSignOutUnavailable_base: Schema.Class<SessionSignOutUnavailable, Schema.TaggedStruct<"SessionSignOutUnavailable", {
+  readonly clearCredential: Schema.Literal<true>;
+}>, import("effect/Cause").YieldableError>;
+declare class SessionSignOutUnavailable extends SessionSignOutUnavailable_base {}
+declare const SessionError: Schema.Union<readonly [typeof SessionInvalid, typeof SessionUnavailable, typeof StaleAuthentication, typeof SessionConflict, typeof SessionRenewalTooEarly, typeof SessionCapabilityUnsupported, typeof PendingAuthenticationInvalid, typeof SessionStepUpInvalid, typeof SessionSignOutUnavailable]>;
+type SessionError = typeof SessionError.Type;
+//#endregion
+export { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConfigurationError, SessionConflict, SessionError, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication };
+//# sourceMappingURL=errors.d.mts.map

package/dist/sessions/errors.mjs

@@ -0,0 +1,34 @@
+import { Schema } from "effect";
+//#region src/sessions/errors.ts
+var SessionInvalid = class extends Schema.TaggedError()("SessionInvalid", {}) {};
+var SessionUnavailable = class extends Schema.TaggedError()("SessionUnavailable", {}) {};
+var StaleAuthentication = class extends Schema.TaggedError()("StaleAuthentication", {}) {};
+var SessionRenewalTooEarly = class extends Schema.TaggedError()("SessionRenewalTooEarly", { retryAt: Schema.DateTimeUtcFromMillis }) {};
+var SessionConflict = class extends Schema.TaggedError()("SessionConflict", {}) {};
+var SessionCapabilityUnsupported = class extends Schema.TaggedError()("SessionCapabilityUnsupported", { capability: Schema.NonEmptyString }) {};
+var SessionConfigurationError = class extends Schema.TaggedError()("SessionConfigurationError", { reason: Schema.Literals([
+	"policy",
+	"keyring",
+	"claims",
+	"capability",
+	"pending-authentication",
+	"step-up"
+]) }) {};
+var PendingAuthenticationInvalid = class extends Schema.TaggedError()("PendingAuthenticationInvalid", {}) {};
+var SessionStepUpInvalid = class extends Schema.TaggedError()("SessionStepUpInvalid", {}) {};
+var SessionSignOutUnavailable = class extends Schema.TaggedError()("SessionSignOutUnavailable", { clearCredential: Schema.Literal(true) }) {};
+const SessionError = Schema.Union([
+	SessionInvalid,
+	SessionUnavailable,
+	StaleAuthentication,
+	SessionConflict,
+	SessionRenewalTooEarly,
+	SessionCapabilityUnsupported,
+	PendingAuthenticationInvalid,
+	SessionStepUpInvalid,
+	SessionSignOutUnavailable
+]);
+//#endregion
+export { PendingAuthenticationInvalid, SessionCapabilityUnsupported, SessionConfigurationError, SessionConflict, SessionError, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/sessions/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../src/sessions/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport class SessionInvalid extends Schema.TaggedError<SessionInvalid>()(\"SessionInvalid\", {}) {}\n\nexport class SessionUnavailable extends Schema.TaggedError<SessionUnavailable>()(\n  \"SessionUnavailable\",\n  {},\n) {}\n\nexport class StaleAuthentication extends Schema.TaggedError<StaleAuthentication>()(\n  \"StaleAuthentication\",\n  {},\n) {}\n\nexport class SessionRenewalTooEarly extends Schema.TaggedError<SessionRenewalTooEarly>()(\n  \"SessionRenewalTooEarly\",\n  { retryAt: Schema.DateTimeUtcFromMillis },\n) {}\n\nexport class SessionConflict extends Schema.TaggedError<SessionConflict>()(\"SessionConflict\", {}) {}\n\nexport class SessionCapabilityUnsupported extends Schema.TaggedError<SessionCapabilityUnsupported>()(\n  \"SessionCapabilityUnsupported\",\n  { capability: Schema.NonEmptyString },\n) {}\n\nexport class SessionConfigurationError extends Schema.TaggedError<SessionConfigurationError>()(\n  \"SessionConfigurationError\",\n  {\n    reason: Schema.Literals([\n      \"policy\",\n      \"keyring\",\n      \"claims\",\n      \"capability\",\n      \"pending-authentication\",\n      \"step-up\",\n    ]),\n  },\n) {}\n\nexport class PendingAuthenticationInvalid extends Schema.TaggedError<PendingAuthenticationInvalid>()(\n  \"PendingAuthenticationInvalid\",\n  {},\n) {}\n\nexport class SessionStepUpInvalid extends Schema.TaggedError<SessionStepUpInvalid>()(\n  \"SessionStepUpInvalid\",\n  {},\n) {}\n\nexport class SessionSignOutUnavailable extends Schema.TaggedError<SessionSignOutUnavailable>()(\n  \"SessionSignOutUnavailable\",\n  { clearCredential: Schema.Literal(true) },\n) {}\n\nexport const SessionError = Schema.Union([\n  SessionInvalid,\n  SessionUnavailable,\n  StaleAuthentication,\n  SessionConflict,\n  SessionRenewalTooEarly,\n  SessionCapabilityUnsupported,\n  PendingAuthenticationInvalid,\n  SessionStepUpInvalid,\n  SessionSignOutUnavailable,\n]);\n\nexport type SessionError = typeof SessionError.Type;\n"],"mappings":";;AAEA,IAAa,iBAAb,cAAoC,OAAO,YAA4B,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,EAAE,SAAS,OAAO,sBAAsB,CAC1C,CAAC,CAAC,CAAC;AAEH,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnG,IAAa,+BAAb,cAAkD,OAAO,YAA0C,CAAC,CAClG,gCACA,EAAE,YAAY,OAAO,eAAe,CACtC,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,+BAAb,cAAkD,OAAO,YAA0C,CAAC,CAClG,gCACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,EAAE,iBAAiB,OAAO,QAAQ,IAAI,EAAE,CAC1C,CAAC,CAAC,CAAC;AAEH,MAAa,eAAe,OAAO,MAAM;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/sessions/invalidation.d.mts

@@ -0,0 +1,23 @@
+import { SessionCapabilities } from "./models.mjs";
+import { SessionPolicy } from "./policy.mjs";
+import { Schema } from "effect";
+//#region src/sessions/invalidation.d.ts
+declare const SessionInvalidationTrigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+type SessionInvalidationTrigger = typeof SessionInvalidationTrigger.Type;
+declare const SessionInvalidationWindow: Schema.Struct<{
+  readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+  readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+  readonly maximumExposureMillis: Schema.Natural;
+  readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+}>;
+type SessionInvalidationWindow = typeof SessionInvalidationWindow.Type;
+/**
+ * Report only AFTER the consumer commits the mutation and security-revision bump
+ * in the same authority. Disable/delete also prevent fresh issuance; a reset
+ * permits fresh verification using the replacement credential. Pure stateless
+ * renewal preserves each old token's absolute bound and may replay until then.
+ */
+declare const sessionInvalidationWindow: (trigger: SessionInvalidationTrigger, capabilities: SessionCapabilities, policy: SessionPolicy) => SessionInvalidationWindow;
+//#endregion
+export { SessionInvalidationTrigger, SessionInvalidationWindow, sessionInvalidationWindow };
+//# sourceMappingURL=invalidation.d.mts.map

package/dist/sessions/invalidation.mjs

@@ -0,0 +1,33 @@
+import { Schema } from "effect";
+//#region src/sessions/invalidation.ts
+const SessionInvalidationTrigger = Schema.Literals([
+	"password-reset",
+	"factor-reset",
+	"credential-change",
+	"subject-disable",
+	"subject-delete",
+	"identifier-change",
+	"all-session-revocation"
+]);
+const SessionInvalidationWindow = Schema.Struct({
+	trigger: SessionInvalidationTrigger,
+	existingSessions: Schema.Literals(["immediate", "original-absolute-expiry"]),
+	maximumExposureMillis: Schema.Natural,
+	oldAuthenticationEvidence: Schema.Literal("rejected")
+});
+/**
+* Report only AFTER the consumer commits the mutation and security-revision bump
+* in the same authority. Disable/delete also prevent fresh issuance; a reset
+* permits fresh verification using the replacement credential. Pure stateless
+* renewal preserves each old token's absolute bound and may replay until then.
+*/
+const sessionInvalidationWindow = (trigger, capabilities, policy) => ({
+	trigger,
+	existingSessions: capabilities.subjectInvalidation === "immediate" ? "immediate" : "original-absolute-expiry",
+	maximumExposureMillis: capabilities.subjectInvalidation === "immediate" ? 0 : policy.maximumIssuedAbsoluteLifetimeMillis,
+	oldAuthenticationEvidence: "rejected"
+});
+//#endregion
+export { SessionInvalidationTrigger, SessionInvalidationWindow, sessionInvalidationWindow };
+
+//# sourceMappingURL=invalidation.mjs.map

package/dist/sessions/invalidation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalidation.mjs","names":[],"sources":["../../src/sessions/invalidation.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport type { SessionCapabilities } from \"./models\";\nimport type { SessionPolicy } from \"./policy\";\n\nexport const SessionInvalidationTrigger = Schema.Literals([\n  \"password-reset\",\n  \"factor-reset\",\n  \"credential-change\",\n  \"subject-disable\",\n  \"subject-delete\",\n  \"identifier-change\",\n  \"all-session-revocation\",\n]);\n\nexport type SessionInvalidationTrigger = typeof SessionInvalidationTrigger.Type;\n\nexport const SessionInvalidationWindow = Schema.Struct({\n  trigger: SessionInvalidationTrigger,\n  existingSessions: Schema.Literals([\"immediate\", \"original-absolute-expiry\"]),\n  maximumExposureMillis: Schema.Natural,\n  oldAuthenticationEvidence: Schema.Literal(\"rejected\"),\n});\n\nexport type SessionInvalidationWindow = typeof SessionInvalidationWindow.Type;\n\n/**\n * Report only AFTER the consumer commits the mutation and security-revision bump\n * in the same authority. Disable/delete also prevent fresh issuance; a reset\n * permits fresh verification using the replacement credential. Pure stateless\n * renewal preserves each old token's absolute bound and may replay until then.\n */\nexport const sessionInvalidationWindow = (\n  trigger: SessionInvalidationTrigger,\n  capabilities: SessionCapabilities,\n  policy: SessionPolicy,\n): SessionInvalidationWindow => ({\n  trigger,\n  existingSessions:\n    capabilities.subjectInvalidation === \"immediate\" ? \"immediate\" : \"original-absolute-expiry\",\n  maximumExposureMillis:\n    capabilities.subjectInvalidation === \"immediate\"\n      ? 0\n      : policy.maximumIssuedAbsoluteLifetimeMillis,\n  oldAuthenticationEvidence: \"rejected\",\n});\n"],"mappings":";;AAKA,MAAa,6BAA6B,OAAO,SAAS;CACxD;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,MAAa,4BAA4B,OAAO,OAAO;CACrD,SAAS;CACT,kBAAkB,OAAO,SAAS,CAAC,aAAa,0BAA0B,CAAC;CAC3E,uBAAuB,OAAO;CAC9B,2BAA2B,OAAO,QAAQ,UAAU;AACtD,CAAC;;;;;;;AAUD,MAAa,6BACX,SACA,cACA,YAC+B;CAC/B;CACA,kBACE,aAAa,wBAAwB,cAAc,cAAc;CACnE,uBACE,aAAa,wBAAwB,cACjC,IACA,OAAO;CACb,2BAA2B;AAC7B"}