@yielded/auth 0.1.0-beta.1

package/dist/sessions/module.mjs

@@ -0,0 +1,943 @@
+import { TokenDigest } from "../Schema.mjs";
+import { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { SessionCapabilityUnsupported, SessionConfigurationError, SessionInvalid, SessionRenewalTooEarly, SessionSignOutUnavailable, SessionStepUpInvalid, SessionUnavailable } from "./errors.mjs";
+import { sessionInvalidationWindow } from "./invalidation.mjs";
+import { AuthenticationAssurance, requireAssurance, requireAuthenticated } from "../operations/context.mjs";
+import { AuthenticationFlowId, AuthenticationRequirement, SessionAuthenticationProvenance, SessionCredentialVersion, SessionId } from "./models.mjs";
+import { SessionStepUpIntent, SessionStepUpProfile, SessionStepUpRequirement } from "./SessionStepUpPersistence.mjs";
+import { makeSessionContract } from "./contract.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { cryptoLayer, hooksLayer } from "../auth/defaults.mjs";
+import { coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { assessAuthentication, combineAuthenticationEvidence, snapshotAuthenticationEvidence, snapshotSessionAuthenticationProvenance } from "./assurance.mjs";
+import { AuthenticationAuthority } from "./AuthenticationAuthority.mjs";
+import { makeSessionSecrets, makeSessionSigningCodec } from "./crypto.mjs";
+import { snapshotPendingAuthenticationContext } from "./PendingAuthentication.mjs";
+import { stateAssistedCapabilities, statefulCapabilities, statelessCapabilities, validateSessionPolicy, validateSessionTimeline } from "./policy.mjs";
+import { Array as Array$1, Cause, Context, Crypto, DateTime, Effect, Encoding, Layer, Option, Redacted, Result, Schema } from "effect";
+//#region src/sessions/module.ts
+const reportSignOutFailure = (effect) => effect.pipe(Effect.tapCause((cause) => reportAuthFailure("session-sign-out", Cause.fromReasons(cause.reasons.filter((reason) => Cause.isFailReason(reason) && reason.error._tag !== "SessionInvalid" && reason.error._tag !== "HookDenied")))));
+const makeSessionModule = (moduleId, claims) => {
+	const { Session, CompletionResult, operations, group, stepUpOperations, stepUpGroup } = makeSessionContract(moduleId, claims);
+	const ClaimsCodec = Session.fields.claims;
+	const SessionStrategy = Context.Service(`effect-auth/sessions/${moduleId}/Strategy`);
+	const StepUpPlanner = Context.Service(`effect-auth/sessions/${moduleId}/StepUpPlanner`);
+	const SessionStepUpPersistence = Context.Service(`effect-auth/sessions/${moduleId}/StepUpPersistence`);
+	const StatefulSessionPersistence = Context.Service(`effect-auth/sessions/${moduleId}/Persistence`);
+	const SessionRepository = Context.Service(`effect-auth/sessions/${moduleId}/Repository`);
+	const SignedSessionValidity = Context.Service(`effect-auth/sessions/${moduleId}/Validity`);
+	const PendingAuthentication = Context.Service(`effect-auth/sessions/${moduleId}/Pending`);
+	const unsupported = (capability) => Effect.fail(SessionCapabilityUnsupported.make({ capability }));
+	const checkNoAmbientCommit = Effect.fn("Session.checkNoAmbientCommit")(function* () {
+		if (yield* hasCommitScope) return yield* SessionCapabilityUnsupported.make({ capability: "public-operation-inside-transaction; use prepared completion" });
+	});
+	const checkRenewalDue = (session, now, policy) => {
+		const retryAt = DateTime.add(session.issuedAt, { milliseconds: policy.renewalIntervalMillis });
+		return DateTime.toEpochMillis(now) < DateTime.toEpochMillis(retryAt) ? Effect.fail(SessionRenewalTooEarly.make({ retryAt })) : Effect.void;
+	};
+	const readCommitted = (receipt) => receipt.read.pipe(Effect.mapError(() => SessionUnavailable.make({})));
+	const prepareHooks = Effect.fn("Session.prepareHooks")(function* (action, session) {
+		const hooks = yield* LifecycleHooks;
+		const secrets = yield* makeSessionSecrets(moduleId);
+		const snapshot = lifecycleSnapshot({
+			action,
+			operation: `${moduleId}/session`,
+			...session === void 0 ? {} : {
+				subjectId: session.subjectId,
+				method: session.assurance.method
+			},
+			identifiers: []
+		});
+		yield* hooks.before(snapshot);
+		const id = yield* secrets.generate();
+		return lifecycleEvent({
+			id: LifecycleEventId.make(Redacted.value(id)),
+			occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+			snapshot
+		});
+	});
+	const publicSessionCodec = Schema.toCodecJson(Schema.toType(Session));
+	const projectSession = (session) => Schema.encodeEffect(publicSessionCodec)(session).pipe(Effect.flatMap(Schema.decodeEffect(publicSessionCodec)), Effect.mapError(() => SessionInvalid.make({})));
+	const issue = (session, credential) => ({
+		value: Schema.decodeSync(publicSessionCodec)(Schema.encodeSync(publicSessionCodec)(session)),
+		credentialCommands: [{
+			_tag: "Issue",
+			slot: "session",
+			credential,
+			expiresAtMillis: DateTime.toEpochMillis(session.expiresAt)
+		}]
+	});
+	const inspectProvenance = Effect.fn("Session.inspectProvenance")(function* (session, input, version) {
+		const provenance = yield* snapshotSessionAuthenticationProvenance(input).pipe(Effect.mapError(() => SessionInvalid.make({})));
+		const credentialVersion = yield* Schema.decodeEffect(SessionCredentialVersion)(version).pipe(Effect.mapError(() => SessionInvalid.make({})));
+		const original = provenance.evidence;
+		const publicProofs = session.assurance.evidence;
+		const ordinals = /* @__PURE__ */ new Map();
+		const revisions = new Set(original.revision.credentials.map((item) => item.credentialId));
+		if (revisions.size !== original.revision.credentials.length || original.proofs.some((proof) => !revisions.has(proof.credentialId))) return yield* SessionInvalid.make({});
+		for (const proof of original.proofs) if (!ordinals.has(proof.credentialId)) ordinals.set(proof.credentialId, ordinals.size);
+		if (session.subjectId !== original.revision.subjectId || session.securityRevision !== original.revision.securityRevision || publicProofs === void 0 || publicProofs.length !== original.proofs.length || original.proofs.some((proof, index) => {
+			const actual = publicProofs[index];
+			return actual.method !== proof.method || actual.credentialOrdinal !== ordinals.get(proof.credentialId) || actual.userVerified !== proof.userVerified || actual.phishingResistant !== proof.phishingResistant || DateTime.toEpochMillis(actual.verifiedAt) !== DateTime.toEpochMillis(proof.verifiedAt) || actual.factors.length !== proof.factors.length || actual.factors.some((factor, i) => factor !== proof.factors[i]);
+		})) return yield* SessionInvalid.make({});
+		return Object.freeze({
+			session,
+			provenance,
+			credentialVersion
+		});
+	});
+	const replacementSession = Effect.fn("Session.replacementSession")(function* (source, evidence, assurance, policy, sessionId) {
+		const now = yield* DateTime.now;
+		const session = yield* projectSession({
+			...source,
+			sessionId,
+			subjectId: evidence.revision.subjectId,
+			securityRevision: evidence.revision.securityRevision,
+			assurance: AuthenticationAssurance.make({
+				...assurance,
+				authenticatedAt: source.assurance.authenticatedAt
+			}),
+			issuedAt: now,
+			expiresAt: DateTime.makeUnsafe(Math.min(DateTime.toEpochMillis(source.absoluteExpiresAt), DateTime.toEpochMillis(now) + policy.idleLifetimeMillis))
+		});
+		yield* validateSessionTimeline(source, policy);
+		yield* validateSessionTimeline(session, policy);
+		return session;
+	});
+	const statefulLayer = (configured) => Layer.effectContext(Effect.gen(function* () {
+		const policy = yield* validateSessionPolicy(configured, statefulCapabilities);
+		const store = yield* StatefulSessionPersistence;
+		const repository = yield* SessionRepository;
+		const secrets = yield* makeSessionSecrets(moduleId);
+		const services = yield* Effect.context();
+		const validate = (session) => projectSession(session).pipe(Effect.provide(services), Effect.flatMap((value) => validateSessionTimeline(value, policy).pipe(Effect.as(value))));
+		const inspectForStepUp = Effect.fn("StatefulSession.inspectForStepUp")(function* (credential) {
+			const digest = yield* secrets.digest(credential, "bearer");
+			const record = yield* store.verify({
+				digest,
+				now: yield* DateTime.now
+			});
+			const inspection = yield* inspectProvenance(yield* validate(record), record.provenance, record.credentialVersion);
+			return Object.freeze({
+				inspection,
+				guard: Object.freeze({
+					_tag: "Stateful",
+					digest,
+					rowVersion: record.version
+				})
+			});
+		});
+		const inspect = Effect.fn("StatefulSession.inspect")((credential) => inspectForStepUp(credential).pipe(Effect.map((source) => source.inspection)));
+		const verify = Effect.fn("StatefulSession.verify")((credential) => inspect(credential).pipe(Effect.map((value) => value.session)));
+		const strategy = SessionStrategy.of({
+			policy,
+			capabilities: statefulCapabilities,
+			inspectForStepUp,
+			inspect,
+			verify,
+			prepareEstablish: Effect.fn("StatefulSession.prepareEstablish")(function* (input) {
+				input = {
+					...input,
+					evidence: yield* snapshotAuthenticationEvidence(input.evidence)
+				};
+				const requirement = yield* (yield* AuthenticationAuthority).requirements(input.evidence);
+				const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(Effect.mapError(() => SessionInvalid.make({})));
+				if (!assessed.satisfied) return yield* SessionInvalid.make({});
+				const now = yield* DateTime.now;
+				const absoluteExpiresAt = DateTime.add(assessed.assurance.authenticatedAt, { milliseconds: policy.absoluteLifetimeMillis });
+				const expiresAt = DateTime.makeUnsafe(Math.min(DateTime.toEpochMillis(absoluteExpiresAt), DateTime.toEpochMillis(now) + policy.idleLifetimeMillis));
+				const credential = yield* secrets.generate();
+				const digest = yield* secrets.digest(credential, "bearer");
+				const base = {
+					subjectId: input.evidence.revision.subjectId,
+					securityRevision: input.evidence.revision.securityRevision,
+					assurance: assessed.assurance,
+					issuedAt: now,
+					expiresAt,
+					absoluteExpiresAt,
+					claims: input.claims,
+					digest,
+					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
+					credentialVersion: SessionCredentialVersion.make(Redacted.value(yield* secrets.generate()))
+				};
+				yield* validateSessionTimeline(base, policy);
+				const event = yield* prepareHooks("sign-in", base).pipe(Effect.provide(services));
+				const creation = yield* prepareHooks("session-creation", base).pipe(Effect.provide(services));
+				yield* validateSessionTimeline(base, policy);
+				const commitNow = yield* DateTime.now;
+				return yield* store.establish({
+					session: base,
+					evidence: input.evidence,
+					pending: input.pending,
+					now: commitNow
+				}, (record, journal) => {
+					journal.stage(event);
+					journal.stage(creation);
+					return journal.prepare(issue(record, credential));
+				});
+			}),
+			prepareRenew: Effect.fn("StatefulSession.prepareRenew")(function* (credential) {
+				const digest = yield* secrets.digest(credential, "bearer");
+				const now = yield* DateTime.now;
+				const record = yield* store.verify({
+					digest,
+					now
+				});
+				const session = (yield* inspectProvenance(yield* validate(record), record.provenance, record.credentialVersion)).session;
+				yield* checkRenewalDue(session, now, policy);
+				const next = yield* secrets.generate();
+				const nextDigest = yield* secrets.digest(next, "bearer");
+				const nextCredentialVersion = SessionCredentialVersion.make(Redacted.value(yield* secrets.generate()));
+				const event = yield* prepareHooks("session-creation", session).pipe(Effect.provide(services));
+				yield* validateSessionTimeline(session, policy);
+				const commitNow = yield* DateTime.now;
+				const nextExpiresAt = DateTime.makeUnsafe(Math.min(DateTime.toEpochMillis(session.absoluteExpiresAt), DateTime.toEpochMillis(now) + policy.idleLifetimeMillis));
+				return yield* store.rotate({
+					sessionId: session.sessionId,
+					expectedDigest: digest,
+					expectedVersion: record.version,
+					expectedSecurityRevision: session.securityRevision,
+					nextDigest,
+					nextCredentialVersion,
+					nextExpiresAt,
+					now: commitNow
+				}, (rotated, journal) => {
+					journal.stage(event);
+					return journal.prepare(issue(rotated, next));
+				});
+			}),
+			signOut: Effect.fn("StatefulSession.signOut")(function* (credential) {
+				const result = yield* Effect.gen(function* () {
+					const digest = yield* secrets.digest(credential, "bearer");
+					const event = yield* prepareHooks("sign-out").pipe(Effect.provide(services));
+					const receipt = yield* store.revokeDigest(digest, (revoked, journal) => {
+						journal.stage(event);
+						return journal.prepare({
+							clearCredential: true,
+							invalidation: revoked ? "revoked" : "already-invalid"
+						});
+					});
+					return yield* readCommitted(receipt);
+				}).pipe(reportSignOutFailure, Effect.result);
+				return {
+					value: result._tag === "Failure" ? result.failure._tag === "SessionInvalid" ? {
+						clearCredential: true,
+						invalidation: "already-invalid"
+					} : SessionSignOutUnavailable.make({ clearCredential: true }) : result.success,
+					credentialCommands: [{
+						_tag: "Clear",
+						slot: "session"
+					}]
+				};
+			}),
+			list: repository.list,
+			revoke: Effect.fn("StatefulSession.revoke")(function* (session, sessionId) {
+				const event = yield* prepareHooks("sign-out", session).pipe(Effect.provide(services));
+				return yield* readCommitted(yield* store.revoke({
+					subjectId: session.subjectId,
+					sessionId,
+					expectedSecurityRevision: session.securityRevision
+				}, (_, journal) => {
+					journal.stage(event);
+					return journal.prepare(void 0);
+				}));
+			}),
+			revokeAll: Effect.fn("StatefulSession.revokeAll")(function* (session) {
+				const event = yield* prepareHooks("sign-out", session).pipe(Effect.provide(services));
+				return yield* readCommitted(yield* store.revokeAll({
+					subjectId: session.subjectId,
+					expectedSecurityRevision: session.securityRevision
+				}, (_, journal) => {
+					journal.stage(event);
+					return journal.prepare(void 0);
+				}));
+			})
+		});
+		const plan = Effect.fn("StatefulSession.planStepUpReplacement")(function* (source, evidence, assurance) {
+			if (source.guard._tag !== "Stateful") return yield* SessionStepUpInvalid.make({});
+			const credential = yield* secrets.generate();
+			const nextDigest = yield* secrets.digest(credential, "bearer");
+			const session = yield* replacementSession(source.inspection.session, evidence, assurance, policy, source.inspection.session.sessionId);
+			const inspection = yield* inspectProvenance(session, { evidence }, SessionCredentialVersion.make(Redacted.value(yield* secrets.generate())));
+			return {
+				credential,
+				replacement: Object.freeze({
+					_tag: "Stateful",
+					inspection,
+					expectedDigest: source.guard.digest,
+					expectedRowVersion: source.guard.rowVersion,
+					nextDigest
+				})
+			};
+		});
+		return Context.make(SessionStrategy, strategy).pipe(Context.add(StepUpPlanner, { plan }));
+	}));
+	const signedLayer = (configured, keyring, mode) => {
+		return Layer.effectContext(Effect.gen(function* () {
+			const validity = mode === "state-assisted" ? Option.some(yield* SignedSessionValidity) : Option.none();
+			const capabilities = Option.isSome(validity) ? stateAssistedCapabilities : statelessCapabilities;
+			const policy = yield* validateSessionPolicy(configured, capabilities);
+			const hooks = yield* LifecycleHooks;
+			const secrets = yield* makeSessionSecrets(moduleId);
+			const services = yield* Effect.context();
+			const Envelope = Schema.Struct({
+				version: Schema.Literal(2),
+				moduleId: Schema.Literal(moduleId),
+				issuer: Schema.String,
+				audience: Schema.String,
+				generation: Schema.Natural,
+				session: Session,
+				provenance: SessionAuthenticationProvenance,
+				credentialVersion: SessionCredentialVersion
+			});
+			const signing = yield* makeSessionSigningCodec(Envelope, keyring, policy.maximumTokenBytes);
+			const encode = (inspection) => signing.encode({
+				version: 2,
+				moduleId,
+				issuer: policy.issuer,
+				audience: policy.audience,
+				generation: policy.generation,
+				...inspection
+			});
+			const inspect = Effect.fn("SignedSession.inspect")(function* (credential) {
+				const envelope = yield* signing.decode(credential);
+				if (envelope.issuer !== policy.issuer || envelope.audience !== policy.audience || envelope.generation !== policy.generation) return yield* SessionInvalid.make({});
+				yield* validateSessionTimeline(envelope.session, policy);
+				if (Option.isSome(validity)) yield* validity.value.verify(envelope.session, yield* DateTime.now);
+				return yield* inspectProvenance(yield* projectSession(envelope.session), envelope.provenance, envelope.credentialVersion);
+			});
+			const inspectForStepUp = Effect.fn("SignedSession.inspectForStepUp")(function* (credential) {
+				return Object.freeze({
+					inspection: yield* inspect(credential),
+					guard: Object.freeze(Option.isSome(validity) ? { _tag: "StateAssistedSigned" } : { _tag: "StatelessSigned" })
+				});
+			});
+			const verify = Effect.fn("SignedSession.verify")((credential) => inspect(credential).pipe(Effect.map((value) => value.session)));
+			const strategy = SessionStrategy.of({
+				policy,
+				capabilities,
+				inspectForStepUp,
+				inspect,
+				verify,
+				prepareEstablish: Effect.fn("SignedSession.prepareEstablish")(function* (input) {
+					input = {
+						...input,
+						evidence: yield* snapshotAuthenticationEvidence(input.evidence)
+					};
+					const authority = yield* AuthenticationAuthority;
+					const requirement = yield* authority.requirements(input.evidence);
+					const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(Effect.mapError(() => SessionInvalid.make({})));
+					if (!assessed.satisfied) return yield* SessionInvalid.make({});
+					const now = yield* DateTime.now;
+					const absoluteExpiresAt = DateTime.add(assessed.assurance.authenticatedAt, { milliseconds: policy.absoluteLifetimeMillis });
+					const session = {
+						sessionId: SessionId.make(Redacted.value(yield* secrets.generate())),
+						subjectId: input.evidence.revision.subjectId,
+						securityRevision: input.evidence.revision.securityRevision,
+						assurance: assessed.assurance,
+						issuedAt: now,
+						expiresAt: DateTime.makeUnsafe(Math.min(DateTime.toEpochMillis(absoluteExpiresAt), DateTime.toEpochMillis(now) + policy.idleLifetimeMillis)),
+						absoluteExpiresAt,
+						claims: input.claims
+					};
+					yield* validateSessionTimeline(session, policy);
+					const provenance = yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence });
+					const credentialVersion = SessionCredentialVersion.make(Redacted.value(yield* secrets.generate()));
+					const credential = yield* encode({
+						session,
+						provenance,
+						credentialVersion
+					});
+					const event = yield* prepareHooks("sign-in", session).pipe(Effect.provide(services));
+					const creation = yield* prepareHooks("session-creation", session).pipe(Effect.provide(services));
+					yield* validateSessionTimeline(session, policy);
+					return yield* authority.approve({
+						evidence: input.evidence,
+						pending: input.pending,
+						now: yield* DateTime.now,
+						expiresAt: session.expiresAt,
+						absoluteExpiresAt: session.absoluteExpiresAt
+					}, (_, journal) => {
+						journal.stage(event);
+						journal.stage(creation);
+						return journal.prepare(issue(session, credential));
+					});
+				}),
+				prepareRenew: Effect.fn("SignedSession.prepareRenew")(function* (credential) {
+					const source = yield* inspect(credential);
+					const session = source.session;
+					const now = yield* DateTime.now;
+					yield* checkRenewalDue(session, now, policy);
+					const renewed = {
+						...session,
+						issuedAt: now,
+						expiresAt: DateTime.makeUnsafe(Math.min(DateTime.toEpochMillis(session.absoluteExpiresAt), DateTime.toEpochMillis(now) + policy.idleLifetimeMillis))
+					};
+					const next = yield* encode({
+						session: renewed,
+						provenance: source.provenance,
+						credentialVersion: SessionCredentialVersion.make(Redacted.value(yield* secrets.generate()))
+					});
+					const event = yield* prepareHooks("session-creation", renewed).pipe(Effect.provide(services));
+					yield* validateSessionTimeline(session, policy);
+					yield* validateSessionTimeline(renewed, policy);
+					if (Option.isSome(validity)) yield* validity.value.verify(session, yield* DateTime.now);
+					return (yield* coordinateCommit((journal) => Effect.sync(() => {
+						journal.stage(event);
+						return journal.prepare(issue(renewed, next));
+					}), { mode: "interactive" }).pipe(Effect.provideService(LifecycleHooks, hooks), Effect.mapError(() => SessionUnavailable.make({})))).value;
+				}),
+				signOut: Effect.fn("SignedSession.signOut")(function* (credential) {
+					const outcome = yield* Effect.gen(function* () {
+						const event = yield* prepareHooks("sign-out").pipe(Effect.provide(services));
+						if (Option.isSome(validity)) {
+							const session = yield* verify(credential);
+							const receipt = yield* validity.value.revoke({
+								subjectId: session.subjectId,
+								sessionId: session.sessionId,
+								absoluteExpiresAt: session.absoluteExpiresAt,
+								expectedSecurityRevision: session.securityRevision
+							}, (_, journal) => {
+								journal.stage(event);
+								return journal.prepare({
+									clearCredential: true,
+									invalidation: "revoked"
+								});
+							});
+							return yield* readCommitted(receipt);
+						}
+						const result = yield* coordinateCommit((journal) => Effect.sync(() => {
+							journal.stage(event);
+							return journal.prepare({
+								clearCredential: true,
+								invalidation: "client-only"
+							});
+						}), { mode: "interactive" }).pipe(Effect.provideService(LifecycleHooks, hooks), Effect.mapError(() => SessionUnavailable.make({})));
+						return yield* readCommitted(result.value);
+					}).pipe(reportSignOutFailure, Effect.result);
+					return {
+						value: outcome._tag === "Failure" ? outcome.failure._tag === "SessionInvalid" ? {
+							clearCredential: true,
+							invalidation: "already-invalid"
+						} : SessionSignOutUnavailable.make({ clearCredential: true }) : outcome.success,
+						credentialCommands: [{
+							_tag: "Clear",
+							slot: "session"
+						}]
+					};
+				}),
+				list: () => unsupported("session-listing"),
+				revoke: Effect.fn("SignedSession.revoke")(function* (session, sessionId) {
+					if (Option.isNone(validity)) return yield* unsupported("per-session-revocation");
+					const event = yield* prepareHooks("sign-out", session).pipe(Effect.provide(services));
+					return yield* readCommitted(yield* validity.value.revoke({
+						subjectId: session.subjectId,
+						sessionId,
+						absoluteExpiresAt: DateTime.add(yield* DateTime.now, { milliseconds: policy.maximumIssuedAbsoluteLifetimeMillis }),
+						expectedSecurityRevision: session.securityRevision
+					}, (_, journal) => {
+						journal.stage(event);
+						return journal.prepare(void 0);
+					}));
+				}),
+				revokeAll: Effect.fn("SignedSession.revokeAll")(function* (session) {
+					if (Option.isNone(validity)) return yield* unsupported("subject-invalidation");
+					const event = yield* prepareHooks("sign-out", session).pipe(Effect.provide(services));
+					return yield* readCommitted(yield* validity.value.revokeAll({
+						subjectId: session.subjectId,
+						expectedSecurityRevision: session.securityRevision
+					}, (_, journal) => {
+						journal.stage(event);
+						return journal.prepare(void 0);
+					}));
+				})
+			});
+			const plan = Effect.fn("SignedSession.planStepUpReplacement")(function* (source, evidence, assurance) {
+				const expectedTag = Option.isSome(validity) ? "StateAssistedSigned" : "StatelessSigned";
+				if (source.guard._tag !== expectedTag) return yield* SessionStepUpInvalid.make({});
+				const session = yield* replacementSession(source.inspection.session, evidence, assurance, policy, SessionId.make(Redacted.value(yield* secrets.generate())));
+				const inspection = yield* inspectProvenance(session, { evidence }, SessionCredentialVersion.make(Redacted.value(yield* secrets.generate())));
+				return {
+					credential: yield* encode(inspection),
+					replacement: Option.isSome(validity) ? Object.freeze({
+						_tag: "StateAssistedSigned",
+						inspection,
+						tombstoneSessionId: source.inspection.session.sessionId,
+						tombstoneUntil: source.inspection.session.absoluteExpiresAt
+					}) : Object.freeze({
+						_tag: "StatelessSigned",
+						inspection
+					})
+				};
+			});
+			return Context.make(SessionStrategy, strategy).pipe(Context.add(StepUpPlanner, { plan }));
+		}));
+	};
+	const statelessLayer = (policy, keyring) => signedLayer(policy, keyring, "stateless");
+	const stateAssistedLayer = (policy, keyring) => signedLayer(policy, keyring, "state-assisted");
+	const AuthenticationCompletion = Context.Service(`effect-auth/sessions/${moduleId}/Completion`);
+	const makeCompletionLayer = (inputConfiguration, pending) => Layer.effect(AuthenticationCompletion, Effect.gen(function* () {
+		const configuration = inputConfiguration === void 0 ? void 0 : Object.freeze(yield* Schema.decodeEffect(Schema.Struct({
+			pendingLifetimeMillis: Schema.Int.check(Schema.isBetween({
+				minimum: 1,
+				maximum: 9e5
+			})),
+			attemptLimit: Schema.Int.check(Schema.isBetween({
+				minimum: 1,
+				maximum: 100
+			}))
+		}))(inputConfiguration).pipe(Effect.mapError(() => SessionConfigurationError.make({ reason: "pending-authentication" }))));
+		const pendingPort = yield* pending;
+		const strategy = yield* SessionStrategy;
+		const authority = yield* AuthenticationAuthority;
+		const secrets = yield* makeSessionSecrets(moduleId);
+		const claimServices = yield* Effect.context();
+		const codec = Schema.toCodecIso(ClaimsCodec);
+		const projectClaims = (value) => Schema.encodeEffect(codec)(value).pipe(Effect.flatMap(Schema.decodeEffect(codec)), Effect.provide(claimServices), Effect.mapError(() => SessionInvalid.make({})));
+		const completed = (receipt) => ({
+			_tag: "PreparedCommit",
+			read: receipt.read.pipe(Effect.map(({ value, credentialCommands }) => ({
+				value: {
+					_tag: "Authenticated",
+					session: value
+				},
+				credentialCommands
+			})))
+		});
+		const prepare = Effect.fn("AuthenticationCompletion.prepare")(function* (input) {
+			input = {
+				...input,
+				evidence: yield* snapshotAuthenticationEvidence(input.evidence)
+			};
+			const checkedClaims = yield* projectClaims(input.claims);
+			const requirement = yield* authority.requirements(input.evidence);
+			const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(Effect.mapError(() => SessionInvalid.make({})));
+			if (assessed.satisfied) return completed(yield* strategy.prepareEstablish({
+				...input,
+				claims: checkedClaims
+			}).pipe(Effect.provideService(AuthenticationAuthority, authority)));
+			if (input.pending !== void 0 || configuration === void 0 || Option.isNone(pendingPort)) return yield* SessionCapabilityUnsupported.make({ capability: "required-additional-authentication" });
+			const now = yield* DateTime.now;
+			const expiresAt = DateTime.makeUnsafe(Math.min(DateTime.toEpochMillis(now) + configuration.pendingLifetimeMillis, DateTime.toEpochMillis(assessed.assurance.authenticatedAt) + requirement.maximumAgeMillis));
+			const credential = yield* secrets.generate();
+			const digest = yield* secrets.digest(credential, "pending");
+			return yield* pendingPort.value.create({
+				digest,
+				evidence: input.evidence,
+				claims: checkedClaims,
+				expiresAt,
+				attemptLimit: configuration.attemptLimit
+			}, now, (record, journal) => journal.prepare({
+				value: {
+					_tag: "PendingAuthentication",
+					expiresAt: record.expiresAt
+				},
+				credentialCommands: [{
+					_tag: "Issue",
+					slot: "pending-proof",
+					credential,
+					expiresAtMillis: DateTime.toEpochMillis(record.expiresAt)
+				}]
+			}));
+		});
+		const pendingContext = Effect.fn("AuthenticationCompletion.pendingContext")(function* (credential) {
+			if (Option.isNone(pendingPort)) return yield* SessionCapabilityUnsupported.make({ capability: "pending-authentication" });
+			const digest = yield* secrets.digest(credential, "pending");
+			return yield* snapshotPendingAuthenticationContext(yield* pendingPort.value.context({
+				digest,
+				now: yield* DateTime.now
+			}));
+		});
+		return AuthenticationCompletion.of({
+			prepare,
+			pendingContext,
+			rejectPendingCredential: Effect.fn("AuthenticationCompletion.rejectPendingCredential")(function* (credential) {
+				if (Option.isNone(pendingPort)) return yield* SessionCapabilityUnsupported.make({ capability: "pending-authentication" });
+				const digest = yield* secrets.digest(credential, "pending");
+				const context = yield* snapshotPendingAuthenticationContext(yield* pendingPort.value.context({
+					digest,
+					now: yield* DateTime.now
+				}));
+				return yield* pendingPort.value.reject({
+					digest,
+					bindingDigest: context.bindingDigest,
+					now: yield* DateTime.now
+				}, (decision, journal) => journal.prepare(decision));
+			}),
+			preparePending: Effect.fn("AuthenticationCompletion.preparePending")(function* (input) {
+				if (Option.isNone(pendingPort)) return yield* SessionCapabilityUnsupported.make({ capability: "pending-authentication" });
+				const digest = yield* secrets.digest(input.credential, "pending");
+				const record = yield* pendingPort.value.read({
+					digest,
+					bindingDigest: input.additional.bindingDigest,
+					now: yield* DateTime.now
+				});
+				const evidence = yield* combineAuthenticationEvidence(record.evidence, input.additional);
+				return {
+					_tag: "PreparedCommit",
+					read: (yield* prepare({
+						evidence,
+						claims: record.claims,
+						pending: {
+							digest,
+							bindingDigest: evidence.bindingDigest,
+							flowId: evidence.flowId,
+							version: record.version
+						}
+					})).read.pipe(Effect.map((result) => ({
+						value: result.value,
+						credentialCommands: [...result.credentialCommands, {
+							_tag: "Clear",
+							slot: "pending-proof"
+						}]
+					})))
+				};
+			}),
+			rejectPending: Effect.fn("AuthenticationCompletion.rejectPending")(function* (input) {
+				if (Option.isNone(pendingPort)) return yield* SessionCapabilityUnsupported.make({ capability: "pending-authentication" });
+				return yield* pendingPort.value.reject({
+					digest: yield* secrets.digest(input.credential, "pending"),
+					bindingDigest: input.bindingDigest,
+					now: yield* DateTime.now
+				}, (decision, journal) => journal.prepare(decision));
+			})
+		});
+	}));
+	function completionLayer(configuration) {
+		const captured = configuration === void 0 ? void 0 : Object.freeze({ ...configuration });
+		return makeCompletionLayer(captured, captured === void 0 ? Effect.serviceOption(PendingAuthentication) : Effect.map(PendingAuthentication, Option.some));
+	}
+	const SessionStepUp = Context.Service(`effect-auth/sessions/${moduleId}/StepUp`);
+	const freezeInstant = (input) => {
+		const copy = DateTime.makeUnsafe(DateTime.toEpochMillis(input));
+		Object.freeze(DateTime.toPartsUtc(copy));
+		return Object.freeze(copy);
+	};
+	const snapshotRequirement = (input) => Object.freeze({
+		...input,
+		alternatives: Object.freeze(Array$1.map(input.alternatives, (alternative) => Object.freeze({
+			...alternative,
+			factors: Object.freeze([...alternative.factors])
+		})))
+	});
+	const boundedRequirement = (input) => Array.isArray(input?.alternatives) && input.alternatives.length > 0 && input.alternatives.length <= 16 && input.alternatives.every((alternative) => Array.isArray(alternative?.factors) && alternative.factors.length <= 3);
+	const readRequirement = (input) => boundedRequirement(input) ? Schema.decodeEffect(SessionStepUpRequirement)(input).pipe(Effect.map(snapshotRequirement), Effect.mapError(() => SessionUnavailable.make({}))) : Effect.fail(SessionUnavailable.make({}));
+	const intentCodec = Schema.toCodecJson(Schema.toType(SessionStepUpIntent));
+	const snapshotIntent = Effect.fn("SessionStepUp.snapshotIntent")(function* (input) {
+		if (!Array.isArray(input?.revision?.credentials) || input.revision.credentials.length > 64 || !boundedRequirement(input?.requirement)) return yield* SessionStepUpInvalid.make({});
+		const value = yield* Schema.encodeEffect(intentCodec)(input).pipe(Effect.flatMap(Schema.decodeEffect(intentCodec)), Effect.mapError(() => SessionStepUpInvalid.make({})));
+		return Object.freeze({
+			...value,
+			revision: Object.freeze({
+				...value.revision,
+				credentials: Object.freeze(value.revision.credentials.map((item) => Object.freeze({ ...item })))
+			}),
+			requirement: snapshotRequirement(value.requirement),
+			sourceAuthenticatedAt: freezeInstant(value.sourceAuthenticatedAt),
+			sourceExpiresAt: freezeInstant(value.sourceExpiresAt),
+			sourceAbsoluteExpiresAt: freezeInstant(value.sourceAbsoluteExpiresAt),
+			expiresAt: freezeInstant(value.expiresAt)
+		});
+	});
+	const inspectionCodec = Schema.toCodecJson(Schema.toType(Schema.Struct({
+		session: Session,
+		provenance: SessionAuthenticationProvenance,
+		credentialVersion: SessionCredentialVersion
+	})));
+	const freezeGraph = (value) => {
+		if (value !== null && typeof value === "object") {
+			if (DateTime.isDateTime(value) && DateTime.isUtc(value)) {
+				Object.freeze(DateTime.toPartsUtc(value));
+				Object.freeze(value);
+			} else if (Array.isArray(value) || Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null || Schema.is(AuthenticationAssurance)(value)) {
+				for (const child of Object.values(value)) freezeGraph(child);
+				Object.freeze(value);
+			}
+		}
+		return value;
+	};
+	const snapshotInspection = (input) => Schema.encodeEffect(inspectionCodec)(input).pipe(Effect.flatMap(Schema.decodeEffect(inspectionCodec)), Effect.map(freezeGraph), Effect.mapError(() => SessionStepUpInvalid.make({})));
+	const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationRequirement));
+	const profileEncoding = Schema.encodeSync(Schema.fromJsonString(Schema.Tuple([
+		Schema.Literal("effect-auth/session-step-up/profile/v1"),
+		Schema.String,
+		SessionStepUpProfile
+	])));
+	/** Configuration is decoded and detached before asynchronous hashing or Layer building. */
+	const stepUpLayer = (configured) => {
+		const decoded = Schema.decodeResult(Schema.Array(SessionStepUpProfile).check(Schema.isMinLength(1), Schema.isMaxLength(64)))(Array.isArray(configured) && configured.length <= 64 && configured.every((profile) => boundedRequirement(profile?.requirement)) ? configured : []);
+		const profiles = Result.isSuccess(decoded) ? Object.freeze(decoded.success.map((profile) => Object.freeze({
+			...profile,
+			requirement: snapshotRequirement(profile.requirement)
+		}))) : void 0;
+		return Layer.effect(SessionStepUp, Effect.gen(function* () {
+			if (profiles === void 0 || new Set(profiles.map((profile) => profile.profileId)).size !== profiles.length) return yield* SessionConfigurationError.make({ reason: "step-up" });
+			const store = yield* SessionStepUpPersistence;
+			const strategy = yield* SessionStrategy;
+			const planner = yield* StepUpPlanner;
+			const authority = yield* AuthenticationAuthority;
+			const crypto = yield* Crypto.Crypto;
+			const secrets = yield* makeSessionSecrets(moduleId);
+			const hooks = yield* Effect.context();
+			const registry = /* @__PURE__ */ new Map();
+			for (const profile of profiles) {
+				const bytes = new TextEncoder().encode(profileEncoding([
+					"effect-auth/session-step-up/profile/v1",
+					moduleId,
+					profile
+				]));
+				const digest = yield* crypto.digest("SHA-256", bytes).pipe(Effect.mapError(() => SessionUnavailable.make({})));
+				registry.set(profile.profileId, Object.freeze({
+					profile,
+					digest: TokenDigest.make(Encoding.encodeBase64Url(digest))
+				}));
+			}
+			const assess = (evidence, requirement) => assessAuthentication(evidence, requirement).pipe(Effect.catchTag("SessionConfigurationError", () => Effect.fail(SessionUnavailable.make({}))));
+			const digestCredential = (credential) => secrets.digest(credential, "step-up").pipe(Effect.catchTag("SessionInvalid", () => Effect.fail(SessionStepUpInvalid.make({}))));
+			const inspectSource = (credential) => strategy.inspectForStepUp(credential).pipe(Effect.flatMap((source) => snapshotInspection(source.inspection).pipe(Effect.map((inspection) => Object.freeze({
+				inspection,
+				guard: Object.freeze({ ...source.guard })
+			})))), Effect.catchTag("SessionInvalid", () => Effect.fail(SessionStepUpInvalid.make({}))));
+			const readIntent = Effect.fn("SessionStepUp.readIntent")(function* (digest, bindingDigest) {
+				const intent = yield* snapshotIntent(yield* store.read({
+					digest,
+					bindingDigest,
+					now: yield* DateTime.now
+				}));
+				const configured = registry.get(intent.profileId);
+				const now = DateTime.toEpochMillis(yield* DateTime.now);
+				if (intent.digest !== digest || intent.bindingDigest !== bindingDigest || configured === void 0 || intent.profileGeneration !== configured.profile.generation || intent.profileDigest !== configured.digest || requirementEncoding(intent.requirement) !== requirementEncoding(configured.profile.requirement) || intent.attemptLimit !== configured.profile.attemptLimit || now >= DateTime.toEpochMillis(intent.expiresAt) || DateTime.toEpochMillis(intent.expiresAt) > DateTime.toEpochMillis(intent.sourceExpiresAt) || DateTime.toEpochMillis(intent.sourceExpiresAt) > DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)) return yield* SessionStepUpInvalid.make({});
+				return intent;
+			});
+			const matchSource = (intent, source) => {
+				const { session, credentialVersion, provenance } = source.inspection;
+				const revision = provenance.evidence.revision;
+				const sameRevisions = revision.credentials.length === intent.revision.credentials.length && revision.credentials.every((item) => intent.revision.credentials.some((expected) => expected.credentialId === item.credentialId && expected.revision === item.revision));
+				return intent.sourceKind === source.guard._tag && intent.sourceSessionId === session.sessionId && intent.sourceCredentialVersion === credentialVersion && intent.revision.subjectId === revision.subjectId && intent.revision.securityRevision === revision.securityRevision && sameRevisions && DateTime.toEpochMillis(intent.sourceAuthenticatedAt) === DateTime.toEpochMillis(session.assurance.authenticatedAt) && DateTime.toEpochMillis(intent.sourceExpiresAt) === DateTime.toEpochMillis(session.expiresAt) && DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) === DateTime.toEpochMillis(session.absoluteExpiresAt);
+			};
+			return SessionStepUp.of({
+				prepareBegin: Effect.fn("SessionStepUp.prepareBegin")(function* (input) {
+					const configured = registry.get(input.profileId);
+					if (configured === void 0) return yield* SessionStepUpInvalid.make({});
+					const source = yield* inspectSource(input.sourceCredential);
+					const evidence = source.inspection.provenance.evidence;
+					yield* readRequirement(yield* authority.requirements(evidence));
+					const credential = yield* secrets.generate();
+					const digest = yield* digestCredential(credential);
+					const bindingDigest = yield* secrets.digest(yield* secrets.generate(), "step-up-binding");
+					const flowId = AuthenticationFlowId.make(Redacted.value(yield* secrets.generate()));
+					const now = yield* DateTime.now;
+					const session = source.inspection.session;
+					yield* validateSessionTimeline(session, strategy.policy);
+					const expiresAt = freezeInstant(DateTime.makeUnsafe(Math.min(DateTime.toEpochMillis(now) + configured.profile.lifetimeMillis, DateTime.toEpochMillis(session.expiresAt), DateTime.toEpochMillis(session.absoluteExpiresAt))));
+					const intent = Object.freeze({
+						_tag: "SessionStepUpIntent",
+						digest,
+						flowId,
+						bindingDigest,
+						revision: evidence.revision,
+						sourceKind: source.guard._tag,
+						sourceSessionId: session.sessionId,
+						sourceCredentialVersion: source.inspection.credentialVersion,
+						sourceAuthenticatedAt: freezeInstant(session.assurance.authenticatedAt),
+						sourceExpiresAt: freezeInstant(session.expiresAt),
+						sourceAbsoluteExpiresAt: freezeInstant(session.absoluteExpiresAt),
+						profileId: configured.profile.profileId,
+						profileGeneration: configured.profile.generation,
+						profileDigest: configured.digest,
+						requirement: configured.profile.requirement,
+						expiresAt,
+						attemptLimit: configured.profile.attemptLimit
+					});
+					return yield* store.create(intent, now, (_, journal) => journal.prepare({
+						value: {
+							_tag: "StepUpPending",
+							profileId: intent.profileId,
+							expiresAt
+						},
+						credentialCommands: [{
+							_tag: "Issue",
+							slot: "session-step-up",
+							credential,
+							expiresAtMillis: DateTime.toEpochMillis(expiresAt)
+						}]
+					}));
+				}),
+				context: Effect.fn("SessionStepUp.context")(function* (credential) {
+					const digest = yield* digestCredential(credential);
+					return yield* snapshotPendingAuthenticationContext(yield* store.context({
+						digest,
+						now: yield* DateTime.now
+					})).pipe(Effect.catchTag("PendingAuthenticationInvalid", () => Effect.fail(SessionStepUpInvalid.make({}))));
+				}),
+				rejectCredential: Effect.fn("SessionStepUp.rejectCredential")(function* (credential) {
+					const digest = yield* digestCredential(credential);
+					return yield* store.reject({
+						digest,
+						now: yield* DateTime.now
+					}, (decision, journal) => journal.prepare(decision));
+				}),
+				prepareComplete: Effect.fn("SessionStepUp.prepareComplete")(function* (input) {
+					const additional = yield* snapshotAuthenticationEvidence(input.additional);
+					const digest = yield* digestCredential(input.stepUpCredential);
+					const intent = yield* readIntent(digest, additional.bindingDigest);
+					const source = yield* inspectSource(input.sourceCredential);
+					if (!matchSource(intent, source)) return yield* SessionStepUpInvalid.make({});
+					const original = source.inspection.provenance.evidence;
+					const evidence = yield* snapshotAuthenticationEvidence(yield* combineAuthenticationEvidence({
+						...original,
+						flowId: intent.flowId,
+						bindingDigest: intent.bindingDigest
+					}, additional).pipe(Effect.catchTag("PendingAuthenticationInvalid", () => Effect.fail(SessionStepUpInvalid.make({})))));
+					const requirement = yield* readRequirement(yield* authority.requirements(evidence));
+					const base = yield* assess(evidence, requirement);
+					const profile = yield* assess(evidence, intent.requirement);
+					if (!base.satisfied || !profile.satisfied) return yield* SessionStepUpInvalid.make({});
+					const generated = yield* planner.plan(source, evidence, base.assurance);
+					const replacement = Object.freeze({
+						...generated.replacement,
+						inspection: yield* snapshotInspection(generated.replacement.inspection)
+					});
+					const output = yield* snapshotInspection(generated.replacement.inspection);
+					const planned = {
+						credential: generated.credential,
+						replacement
+					};
+					if (planned.replacement._tag !== intent.sourceKind) return yield* SessionStepUpInvalid.make({});
+					const event = yield* prepareHooks("session-creation", planned.replacement.inspection.session).pipe(Effect.provide(hooks));
+					const current = yield* inspectSource(input.sourceCredential);
+					if (!matchSource(intent, current) || source.guard._tag === "Stateful" && (current.guard._tag !== "Stateful" || source.guard.digest !== current.guard.digest || source.guard.rowVersion !== current.guard.rowVersion)) return yield* SessionStepUpInvalid.make({});
+					const currentRequirement = yield* readRequirement(yield* authority.requirements(evidence));
+					if (!(yield* assess(evidence, currentRequirement)).satisfied || !(yield* assess(evidence, intent.requirement)).satisfied) return yield* SessionStepUpInvalid.make({});
+					yield* validateSessionTimeline(planned.replacement.inspection.session, strategy.policy);
+					const now = yield* DateTime.now;
+					if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(intent.expiresAt)) return yield* SessionStepUpInvalid.make({});
+					const plan = Object.freeze({
+						intent,
+						source: current,
+						evidence,
+						baseRequirement: currentRequirement,
+						profileRequirement: intent.requirement,
+						now: freezeInstant(now),
+						replacement: planned.replacement
+					});
+					return yield* store.complete(plan, (_, journal) => {
+						const result = issue(output.session, planned.credential);
+						journal.stage(event);
+						return journal.prepare({
+							...result,
+							credentialCommands: [...result.credentialCommands, {
+								_tag: "Clear",
+								slot: "session-step-up"
+							}]
+						});
+					});
+				})
+			});
+		}));
+	};
+	const { Begin: StepUpBegin, Complete: StepUpComplete, Reject: StepUpReject } = stepUpOperations;
+	const stepUpHandlersLayer = Layer.mergeAll(StepUpBegin.credentialHandlerLayer(Effect.fn("SessionStepUp.Begin")(function* (input, context) {
+		yield* checkNoAmbientCommit();
+		const caller = yield* requireAuthenticated(context);
+		const source = yield* (yield* SessionStrategy).inspectForStepUp(input.sourceCredential);
+		if (caller.subjectId !== source.inspection.session.subjectId || caller.sessionId !== source.inspection.session.sessionId) return yield* SessionStepUpInvalid.make({});
+		return yield* readCommitted(yield* (yield* SessionStepUp).prepareBegin(input));
+	})), StepUpComplete.credentialHandlerLayer(Effect.fn("SessionStepUp.Complete")(function* (input) {
+		yield* checkNoAmbientCommit();
+		return yield* readCommitted(yield* (yield* SessionStepUp).prepareComplete(input));
+	})), StepUpReject.handlerLayer(Effect.fn("SessionStepUp.Reject")(function* (input) {
+		yield* checkNoAmbientCommit();
+		return yield* readCommitted(yield* (yield* SessionStepUp).rejectCredential(input.stepUpCredential));
+	})));
+	const { Complete, CompletePending, RejectPending, Capabilities, Verify, Renew, SignOut, List, Revoke, RevokeAll } = operations;
+	const capabilitiesHandlerLayer = Capabilities.handlerLayer(Effect.fn("Session.Capabilities")(function* () {
+		return (yield* SessionStrategy).capabilities;
+	}));
+	/** Verification, renewal and sign-out need no authentication-completion authority. */
+	const sessionHandlersLayer = Layer.mergeAll(Verify.handlerLayer(Effect.fn("Session.Verify")(function* (input) {
+		return yield* (yield* SessionStrategy).verify(input.credential);
+	})), Renew.credentialHandlerLayer(Effect.fn("Session.Renew")(function* (input) {
+		yield* checkNoAmbientCommit();
+		return yield* readCommitted(yield* (yield* SessionStrategy).prepareRenew(input.credential));
+	})), SignOut.credentialHandlerLayer(Effect.fn("Session.SignOut")(function* (input) {
+		yield* checkNoAmbientCommit();
+		return yield* (yield* SessionStrategy).signOut(input.credential);
+	})));
+	const handlersLayer = (management) => {
+		management = Object.freeze({
+			...management,
+			factors: management.factors === void 0 ? void 0 : Object.freeze([...management.factors])
+		});
+		return Layer.mergeAll(capabilitiesHandlerLayer, Complete.credentialHandlerLayer(Effect.fn("Session.Complete")(function* (input) {
+			yield* checkNoAmbientCommit();
+			return yield* readCommitted(yield* (yield* AuthenticationCompletion).prepare(input));
+		})), CompletePending.credentialHandlerLayer(Effect.fn("Session.CompletePending")(function* (input) {
+			yield* checkNoAmbientCommit();
+			return yield* readCommitted(yield* (yield* AuthenticationCompletion).preparePending(input));
+		})), RejectPending.handlerLayer(Effect.fn("Session.RejectPending")(function* (input) {
+			yield* checkNoAmbientCommit();
+			return yield* readCommitted(yield* (yield* AuthenticationCompletion).rejectPending(input));
+		})), sessionHandlersLayer, List.handlerLayer(Effect.fn("Session.List")(function* (input, context) {
+			const caller = yield* requireAuthenticated(context);
+			const strategy = yield* SessionStrategy;
+			const session = yield* strategy.verify(input.credential);
+			if (session.subjectId !== caller.subjectId) return yield* SessionInvalid.make({});
+			return yield* strategy.list({
+				cursor: input.cursor,
+				limit: input.limit,
+				subjectId: session.subjectId,
+				now: yield* DateTime.now
+			});
+		})), Revoke.handlerLayer(Effect.fn("Session.Revoke")(function* (input, context) {
+			yield* checkNoAmbientCommit();
+			const caller = yield* requireAssurance(context, management);
+			const strategy = yield* SessionStrategy;
+			const session = yield* strategy.verify(input.credential);
+			if (session.subjectId !== caller.subjectId) return yield* SessionInvalid.make({});
+			return yield* strategy.revoke(session, input.sessionId);
+		})), RevokeAll.handlerLayer(Effect.fn("Session.RevokeAll")(function* (input, context) {
+			yield* checkNoAmbientCommit();
+			const caller = yield* requireAssurance(context, management);
+			const strategy = yield* SessionStrategy;
+			const session = yield* strategy.verify(input.credential);
+			if (session.subjectId !== caller.subjectId) return yield* SessionInvalid.make({});
+			yield* strategy.revokeAll(session);
+			return sessionInvalidationWindow("all-session-revocation", strategy.capabilities, strategy.policy);
+		})));
+	};
+	return Object.freeze({
+		moduleId,
+		claims,
+		/** Stateful sessions and authentication completion with portable defaults. */
+		layer: (policy) => completionLayer().pipe(Layer.provideMerge(statefulLayer(policy)), Layer.provide([cryptoLayer, hooksLayer])),
+		Session,
+		CompletionResult,
+		SessionStrategy,
+		SessionStepUp,
+		SessionStepUpPersistence,
+		stepUpLayer,
+		stepUpHandlersLayer,
+		stepUpOperations,
+		stepUpGroup,
+		AuthenticationCompletion,
+		StatefulSessionPersistence,
+		SessionRepository,
+		SignedSessionValidity,
+		PendingAuthentication,
+		statefulLayer,
+		statelessLayer,
+		stateAssistedLayer,
+		completionLayer,
+		capabilitiesHandlerLayer,
+		sessionHandlersLayer,
+		handlersLayer,
+		operations,
+		group
+	});
+};
+//#endregion
+export { makeSessionModule };
+
+//# sourceMappingURL=module.mjs.map