@yielded/auth 0.1.0-beta.1

package/src/sessions/contract.ts

@@ -0,0 +1,203 @@
+import { Schema } from "effect";
+
+import { HookDenied } from "../hooks/models";
+import { makeOperation, operationGroup } from "../operations/operation";
+import { TokenDigest } from "../Schema";
+import { SessionConfigurationError, SessionError, SessionSignOutUnavailable } from "./errors";
+import { SessionInvalidationWindow } from "./invalidation";
+import {
+  AuthenticationEvidence,
+  SessionCapabilities,
+  SessionId,
+  SessionMetadata,
+  SessionSignOut,
+} from "./models";
+import { SessionStepUpProfileId, StepUpPending } from "./SessionStepUpPersistence";
+
+/** Canonical session contracts without installing session authority or strategy Layers. */
+export const makeSessionContract = <
+  const Id extends string,
+  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,
+>(
+  moduleId: Id,
+  claims: Claims,
+) => {
+  if (!Schema.is(Schema.NonEmptyString)(moduleId))
+    throw SessionConfigurationError.make({ reason: "claims" });
+
+  const ClaimsCodec: Schema.Codec<
+    Claims["Type"],
+    Claims["Encoded"],
+    Claims["DecodingServices"],
+    Claims["EncodingServices"]
+  > = claims;
+
+  const Session = Schema.Struct({ ...SessionMetadata.fields, claims: ClaimsCodec });
+
+  const Completed = Schema.TaggedStruct("Authenticated", { session: Session });
+
+  const Pending = Schema.TaggedStruct("PendingAuthentication", {
+    expiresAt: Schema.DateTimeUtcFromMillis,
+  });
+
+  const CompletionResult = Schema.Union([Completed, Pending]);
+
+  const SignOutResult = Schema.Union([SessionSignOut, SessionSignOutUnavailable]);
+
+  const Failure = Schema.Union([SessionError, HookDenied]);
+  const Credential = Schema.RedactedFromValue(Schema.NonEmptyString);
+
+  const StepUpBegin = makeOperation(`${moduleId}/session/step-up/begin`, {
+    payload: Schema.Struct({ sourceCredential: Credential, profileId: SessionStepUpProfileId }),
+    exposure: "public",
+    success: StepUpPending,
+    error: Failure,
+    access: "authenticated",
+    replay: "non-idempotent",
+    credentials: true,
+  });
+
+  const StepUpComplete = makeOperation(`${moduleId}/session/step-up/complete`, {
+    payload: Schema.Struct({
+      sourceCredential: Credential,
+      stepUpCredential: Credential,
+      additional: AuthenticationEvidence,
+    }),
+    exposure: "internal",
+    success: Session,
+    error: Failure,
+    access: "system",
+    replay: "single-use",
+    credentials: true,
+  });
+
+  const StepUpReject = makeOperation(`${moduleId}/session/step-up/reject`, {
+    payload: Schema.Struct({ stepUpCredential: Credential }),
+    exposure: "internal",
+    success: Schema.TaggedStruct("Rejected", {}),
+    error: Failure,
+    access: "system",
+    replay: "non-idempotent",
+  });
+
+  const stepUpOperations = Object.freeze({
+    Begin: StepUpBegin,
+    Complete: StepUpComplete,
+    Reject: StepUpReject,
+  });
+
+  const Complete = makeOperation(`${moduleId}/session/complete`, {
+    payload: Schema.Struct({ evidence: AuthenticationEvidence, claims: ClaimsCodec }),
+    success: CompletionResult,
+    error: Failure,
+    access: "system",
+    replay: "non-idempotent",
+    credentials: true,
+  });
+
+  const CompletePending = makeOperation(`${moduleId}/session/complete-pending`, {
+    payload: Schema.Struct({ credential: Credential, additional: AuthenticationEvidence }),
+    success: CompletionResult,
+    error: Failure,
+    access: "system",
+    replay: "single-use",
+    credentials: true,
+  });
+
+  const RejectPending = makeOperation(`${moduleId}/session/reject-pending`, {
+    payload: Schema.Struct({ credential: Credential, bindingDigest: TokenDigest }),
+    success: Schema.TaggedStruct("Rejected", {}),
+    error: Failure,
+    access: "system",
+    replay: "non-idempotent",
+  });
+
+  const Capabilities = makeOperation(`${moduleId}/session/capabilities`, {
+    payload: Schema.Void,
+    success: SessionCapabilities,
+    error: Schema.Never,
+    access: "any",
+    exposure: "public",
+    replay: "read-only",
+  });
+
+  const Verify = makeOperation(`${moduleId}/session/verify`, {
+    payload: Schema.Struct({ credential: Credential }),
+    success: Session,
+    error: Failure,
+    access: "any",
+    replay: "read-only",
+  });
+
+  const Renew = makeOperation(`${moduleId}/session/renew`, {
+    payload: Schema.Struct({ credential: Credential }),
+    success: Session,
+    error: Failure,
+    access: "any",
+    replay: "non-idempotent",
+    credentials: true,
+  });
+
+  const SignOut = makeOperation(`${moduleId}/session/sign-out`, {
+    payload: Schema.Struct({ credential: Credential }),
+    success: SignOutResult,
+    error: Failure,
+    access: "any",
+    replay: "idempotent",
+    credentials: true,
+  });
+
+  const List = makeOperation(`${moduleId}/session/list`, {
+    payload: Schema.Struct({
+      credential: Credential,
+      cursor: Schema.optionalKey(Schema.String),
+      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 100 })),
+    }),
+    success: Schema.Struct({
+      sessions: Schema.Array(SessionMetadata),
+      nextCursor: Schema.optionalKey(Schema.String),
+    }),
+    error: Failure,
+    access: "authenticated",
+    replay: "read-only",
+  });
+
+  const Revoke = makeOperation(`${moduleId}/session/revoke`, {
+    payload: Schema.Struct({ credential: Credential, sessionId: SessionId }),
+    success: Schema.Void,
+    error: Failure,
+    access: "authenticated",
+    replay: "idempotent",
+  });
+
+  const RevokeAll = makeOperation(`${moduleId}/session/revoke-all`, {
+    payload: Schema.Struct({ credential: Credential }),
+    success: SessionInvalidationWindow,
+    error: Failure,
+    access: "authenticated",
+    replay: "non-idempotent",
+  });
+
+  const operations = {
+    Complete,
+    CompletePending,
+    RejectPending,
+    Capabilities,
+    Verify,
+    Renew,
+    SignOut,
+    List,
+    Revoke,
+    RevokeAll,
+  };
+
+  return Object.freeze({
+    moduleId,
+    Session,
+    CompletionResult,
+    operations,
+    group: operationGroup(...Object.values(operations)),
+    stepUpOperations,
+    stepUpGroup: operationGroup(...Object.values(stepUpOperations)),
+  });
+};

package/src/sessions/crypto.ts

@@ -0,0 +1,181 @@
+import { Crypto, Effect, Encoding, Redacted, Result, Schema } from "effect";
+
+import { TokenDigest } from "../Schema";
+import { SubtleCrypto } from "../WebCrypto";
+import { SessionConfigurationError, SessionInvalid, SessionUnavailable } from "./errors";
+
+export interface SessionSigningKeyring {
+  readonly activeKeyId: string;
+  /** At least 32 cryptographically random bytes per key, encoded as base64url. */
+  readonly keys: ReadonlyArray<{
+    readonly id: string;
+    readonly material: Redacted.Redacted<string>;
+  }>;
+}
+
+const opaqueCredential = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
+const keyIdSchema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/));
+
+const Keyring = Schema.Struct({
+  activeKeyId: keyIdSchema,
+  keys: Schema.Array(
+    Schema.Struct({ id: keyIdSchema, material: Schema.Redacted(Schema.String) }),
+  ).check(Schema.isMinLength(1)),
+});
+
+const tokenFormat = Schema.String.check(
+  Schema.isPattern(/^eas1\.[A-Za-z0-9_-]{1,64}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/),
+);
+
+const textEncoder = new TextEncoder();
+
+const digestMessage = Schema.fromJsonString(
+  Schema.Struct({
+    namespace: Schema.Literal("effect-auth/session"),
+    moduleId: Schema.String,
+    purpose: Schema.Literals(["bearer", "pending", "step-up", "step-up-binding"]),
+    secret: Schema.String,
+  }),
+);
+
+export const makeSessionSecrets = Effect.fn("makeSessionSecrets")(function* (moduleId: string) {
+  const crypto = yield* Crypto.Crypto;
+
+  return {
+    generate: Effect.fn("SessionSecrets.generate")(function* () {
+      const bytes = yield* crypto
+        .randomBytes(32)
+        .pipe(Effect.mapError(() => SessionUnavailable.make({})));
+
+      return Redacted.make(Encoding.encodeBase64Url(bytes));
+    }),
+    digest: Effect.fn("SessionSecrets.digest")(function* (
+      token: Redacted.Redacted<string>,
+      purpose: "bearer" | "pending" | "step-up" | "step-up-binding",
+    ) {
+      yield* Schema.decodeEffect(opaqueCredential)(Redacted.value(token)).pipe(
+        Effect.mapError(() => SessionInvalid.make({})),
+      );
+
+      const message = yield* Schema.encodeEffect(digestMessage)({
+        namespace: "effect-auth/session",
+        moduleId,
+        purpose,
+        secret: Redacted.value(token),
+      }).pipe(Effect.orDie);
+
+      const digest = yield* crypto
+        .digest("SHA-256", textEncoder.encode(message))
+        .pipe(Effect.mapError(() => SessionUnavailable.make({})));
+
+      return TokenDigest.make(Encoding.encodeBase64Url(digest));
+    }),
+  };
+});
+
+/** Immutable key snapshot: retirement is effective only after every runtime installs it. */
+export const makeSessionSigningCodec = Effect.fn("makeSessionSigningCodec")(function* <
+  S extends Schema.Top,
+>(schema: S, configuration: SessionSigningKeyring, maximumTokenBytes: number) {
+  const checked = yield* Schema.decodeEffect(Keyring)(configuration).pipe(
+    Effect.mapError(() => SessionConfigurationError.make({ reason: "keyring" })),
+  );
+
+  const subtle = yield* SubtleCrypto;
+  const services = yield* Effect.context<S["DecodingServices"] | S["EncodingServices"]>();
+  const keys = new Map<string, CryptoKey>();
+
+  for (const entry of checked.keys) {
+    yield* Schema.decodeEffect(keyIdSchema)(entry.id).pipe(
+      Effect.mapError(() => SessionConfigurationError.make({ reason: "keyring" })),
+    );
+
+    const material = Result.getOrUndefined(
+      Encoding.decodeBase64Url(Redacted.value(entry.material)),
+    );
+
+    if (keys.has(entry.id) || material === undefined || material.length < 32) {
+      return yield* SessionConfigurationError.make({ reason: "keyring" });
+    }
+
+    const key = yield* Effect.tryPromise({
+      try: () =>
+        subtle.importKey(
+          "raw",
+          material as BufferSource,
+          { name: "HMAC", hash: "SHA-256" },
+          false,
+          ["sign", "verify"],
+        ),
+      catch: () => SessionConfigurationError.make({ reason: "keyring" }),
+    });
+
+    keys.set(entry.id, key);
+  }
+  const activeKeyId = checked.activeKeyId;
+  const activeKey = keys.get(activeKeyId);
+
+  if (activeKey === undefined) return yield* SessionConfigurationError.make({ reason: "keyring" });
+  const codec = Schema.fromJsonString(Schema.toCodecJson(schema));
+  const encode = Schema.encodeEffect(codec);
+  const decode = Schema.decodeEffect(codec);
+
+  return {
+    encode: Effect.fn("SessionSigningCodec.encode")(function* (claims: S["Type"]) {
+      const json = yield* encode(claims).pipe(
+        Effect.provide(services),
+        Effect.mapError(() => SessionUnavailable.make({})),
+      );
+
+      const message = `eas1.${activeKeyId}.${Encoding.encodeBase64Url(json)}`;
+
+      const signature = yield* Effect.tryPromise({
+        try: () => subtle.sign("HMAC", activeKey, textEncoder.encode(message)),
+        catch: () => SessionUnavailable.make({}),
+      });
+
+      const token = `${message}.${Encoding.encodeBase64Url(new Uint8Array(signature))}`;
+
+      if (token.length > maximumTokenBytes) return yield* SessionUnavailable.make({});
+
+      return Redacted.make(token);
+    }),
+    decode: Effect.fn("SessionSigningCodec.decode")(function* (
+      credential: Redacted.Redacted<string>,
+    ) {
+      const token = Redacted.value(credential);
+
+      if (token.length > maximumTokenBytes) return yield* SessionInvalid.make({});
+      yield* Schema.decodeEffect(tokenFormat)(token).pipe(
+        Effect.mapError(() => SessionInvalid.make({})),
+      );
+      const [version, keyId, payload, signatureText] = token.split(".");
+      const key = keys.get(keyId);
+      const signature = Result.getOrUndefined(Encoding.decodeBase64Url(signatureText));
+
+      if (key === undefined || signature === undefined || signature.length !== 32)
+        return yield* SessionInvalid.make({});
+
+      const valid = yield* Effect.tryPromise({
+        try: () =>
+          subtle.verify(
+            "HMAC",
+            key,
+            signature as BufferSource,
+            textEncoder.encode(`${version}.${keyId}.${payload}`),
+          ),
+        catch: () => SessionUnavailable.make({}),
+      });
+
+      if (!valid) return yield* SessionInvalid.make({});
+      const json = Result.getOrUndefined(Encoding.decodeBase64UrlString(payload));
+
+      if (json === undefined) return yield* SessionInvalid.make({});
+
+      return yield* decode(json).pipe(
+        Effect.provide(services),
+        Effect.mapError(() => SessionInvalid.make({})),
+      );
+    }),
+  };
+});

package/src/sessions/definition.ts

@@ -0,0 +1,25 @@
+import type { Schema } from "effect";
+
+import { makeSessionModule } from "./module";
+
+/** Standalone session contracts. Auth definitions bind these automatically. */
+export function make<Claims extends Schema.Codec<unknown, unknown, unknown, unknown>>(
+  claims: Claims,
+): ReturnType<typeof makeSessionModule<"effect-auth/sessions", Claims>>;
+
+export function make<
+  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,
+  const Id extends string,
+>(
+  claims: Claims,
+  options: { readonly namespace: Id },
+): ReturnType<typeof makeSessionModule<Id, Claims>>;
+
+export function make<
+  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,
+  const Id extends string,
+>(claims: Claims, options?: { readonly namespace: Id }) {
+  if (options === undefined) return makeSessionModule("effect-auth/sessions", claims);
+
+  return makeSessionModule(options.namespace, claims);
+}

package/src/sessions/errors.ts

@@ -0,0 +1,68 @@
+import { Schema } from "effect";
+
+export class SessionInvalid extends Schema.TaggedError<SessionInvalid>()("SessionInvalid", {}) {}
+
+export class SessionUnavailable extends Schema.TaggedError<SessionUnavailable>()(
+  "SessionUnavailable",
+  {},
+) {}
+
+export class StaleAuthentication extends Schema.TaggedError<StaleAuthentication>()(
+  "StaleAuthentication",
+  {},
+) {}
+
+export class SessionRenewalTooEarly extends Schema.TaggedError<SessionRenewalTooEarly>()(
+  "SessionRenewalTooEarly",
+  { retryAt: Schema.DateTimeUtcFromMillis },
+) {}
+
+export class SessionConflict extends Schema.TaggedError<SessionConflict>()("SessionConflict", {}) {}
+
+export class SessionCapabilityUnsupported extends Schema.TaggedError<SessionCapabilityUnsupported>()(
+  "SessionCapabilityUnsupported",
+  { capability: Schema.NonEmptyString },
+) {}
+
+export class SessionConfigurationError extends Schema.TaggedError<SessionConfigurationError>()(
+  "SessionConfigurationError",
+  {
+    reason: Schema.Literals([
+      "policy",
+      "keyring",
+      "claims",
+      "capability",
+      "pending-authentication",
+      "step-up",
+    ]),
+  },
+) {}
+
+export class PendingAuthenticationInvalid extends Schema.TaggedError<PendingAuthenticationInvalid>()(
+  "PendingAuthenticationInvalid",
+  {},
+) {}
+
+export class SessionStepUpInvalid extends Schema.TaggedError<SessionStepUpInvalid>()(
+  "SessionStepUpInvalid",
+  {},
+) {}
+
+export class SessionSignOutUnavailable extends Schema.TaggedError<SessionSignOutUnavailable>()(
+  "SessionSignOutUnavailable",
+  { clearCredential: Schema.Literal(true) },
+) {}
+
+export const SessionError = Schema.Union([
+  SessionInvalid,
+  SessionUnavailable,
+  StaleAuthentication,
+  SessionConflict,
+  SessionRenewalTooEarly,
+  SessionCapabilityUnsupported,
+  PendingAuthenticationInvalid,
+  SessionStepUpInvalid,
+  SessionSignOutUnavailable,
+]);
+
+export type SessionError = typeof SessionError.Type;

package/src/sessions/invalidation.ts

@@ -0,0 +1,46 @@
+import { Schema } from "effect";
+
+import type { SessionCapabilities } from "./models";
+import type { SessionPolicy } from "./policy";
+
+export const SessionInvalidationTrigger = Schema.Literals([
+  "password-reset",
+  "factor-reset",
+  "credential-change",
+  "subject-disable",
+  "subject-delete",
+  "identifier-change",
+  "all-session-revocation",
+]);
+
+export type SessionInvalidationTrigger = typeof SessionInvalidationTrigger.Type;
+
+export const SessionInvalidationWindow = Schema.Struct({
+  trigger: SessionInvalidationTrigger,
+  existingSessions: Schema.Literals(["immediate", "original-absolute-expiry"]),
+  maximumExposureMillis: Schema.Natural,
+  oldAuthenticationEvidence: Schema.Literal("rejected"),
+});
+
+export type SessionInvalidationWindow = typeof SessionInvalidationWindow.Type;
+
+/**
+ * Report only AFTER the consumer commits the mutation and security-revision bump
+ * in the same authority. Disable/delete also prevent fresh issuance; a reset
+ * permits fresh verification using the replacement credential. Pure stateless
+ * renewal preserves each old token's absolute bound and may replay until then.
+ */
+export const sessionInvalidationWindow = (
+  trigger: SessionInvalidationTrigger,
+  capabilities: SessionCapabilities,
+  policy: SessionPolicy,
+): SessionInvalidationWindow => ({
+  trigger,
+  existingSessions:
+    capabilities.subjectInvalidation === "immediate" ? "immediate" : "original-absolute-expiry",
+  maximumExposureMillis:
+    capabilities.subjectInvalidation === "immediate"
+      ? 0
+      : policy.maximumIssuedAbsoluteLifetimeMillis,
+  oldAuthenticationEvidence: "rejected",
+});

package/src/sessions/models.ts

@@ -0,0 +1,138 @@
+import { Schema } from "effect";
+
+import { AuthenticationAssurance, AuthenticationFactor } from "../operations/context";
+import { SubjectId, TokenDigest } from "../Schema";
+
+export const SessionId = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/SessionId"));
+export type SessionId = typeof SessionId.Type;
+
+export const SecurityRevision = Schema.NonEmptyString.pipe(
+  Schema.brand("effect-auth/SecurityRevision"),
+);
+
+export type SecurityRevision = typeof SecurityRevision.Type;
+
+export const AuthenticationFlowId = Schema.NonEmptyString.pipe(
+  Schema.brand("effect-auth/AuthenticationFlowId"),
+);
+
+export type AuthenticationFlowId = typeof AuthenticationFlowId.Type;
+
+export const CredentialRevision = Schema.Struct({
+  credentialId: Schema.NonEmptyString,
+  revision: SecurityRevision,
+});
+
+export type CredentialRevision = typeof CredentialRevision.Type;
+
+/** Captured by the method's authority before cryptographic credential verification begins. */
+export const AuthenticationRevision = Schema.Struct({
+  subjectId: SubjectId,
+  securityRevision: SecurityRevision,
+  credentials: Schema.Array(CredentialRevision).check(Schema.isMaxLength(64)),
+});
+
+export type AuthenticationRevision = typeof AuthenticationRevision.Type;
+
+export const AuthenticationProof = Schema.Struct({
+  method: Schema.NonEmptyString,
+  /** Distinguishes independently verified credentials without exposing credential material. */
+  credentialId: Schema.NonEmptyString,
+  factors: Schema.Array(AuthenticationFactor),
+  userVerified: Schema.Boolean,
+  phishingResistant: Schema.Boolean,
+  verifiedAt: Schema.DateTimeUtcFromMillis,
+});
+
+export type AuthenticationProof = typeof AuthenticationProof.Type;
+
+/** Trusted method evidence. No public endpoint accepts subject/factor assertions as proof. */
+export const AuthenticationEvidence = Schema.Struct({
+  revision: AuthenticationRevision,
+  flowId: AuthenticationFlowId,
+  bindingDigest: TokenDigest,
+  proofs: Schema.NonEmptyArray(AuthenticationProof).check(Schema.isMaxLength(64)),
+});
+
+export type AuthenticationEvidence = typeof AuthenticationEvidence.Type;
+
+/** Private authenticated source evidence. Never derive this from public metadata. */
+export const SessionAuthenticationProvenance = Schema.Struct({
+  evidence: Schema.Struct({
+    ...AuthenticationEvidence.fields,
+    revision: Schema.Struct({
+      ...AuthenticationRevision.fields,
+      credentials: Schema.Array(CredentialRevision).check(Schema.isMaxLength(64)),
+    }),
+    proofs: Schema.NonEmptyArray(AuthenticationProof).check(Schema.isMaxLength(64)),
+  }),
+});
+
+export type SessionAuthenticationProvenance = typeof SessionAuthenticationProvenance.Type;
+
+/** Identifies the exact issued credential, independently of storage CAS versions. */
+export const SessionCredentialVersion = Schema.String.check(
+  Schema.isPattern(/^[A-Za-z0-9_-]{43}$/),
+).pipe(Schema.brand("effect-auth/SessionCredentialVersion"));
+
+export type SessionCredentialVersion = typeof SessionCredentialVersion.Type;
+
+export const AssuranceAlternative = Schema.Struct({
+  factors: Schema.Array(AuthenticationFactor),
+  userVerified: Schema.Boolean,
+  phishingResistant: Schema.Boolean,
+  minimumCredentials: Schema.Int.check(Schema.isGreaterThan(0)),
+});
+
+export const AuthenticationRequirement = Schema.Struct({
+  alternatives: Schema.NonEmptyArray(AssuranceAlternative),
+  maximumAgeMillis: Schema.Int.check(Schema.isGreaterThan(0)),
+});
+
+export type AuthenticationRequirement = typeof AuthenticationRequirement.Type;
+
+export const SessionMetadata = Schema.Struct({
+  sessionId: SessionId,
+  subjectId: SubjectId,
+  securityRevision: SecurityRevision,
+  assurance: AuthenticationAssurance,
+  issuedAt: Schema.DateTimeUtcFromMillis,
+  expiresAt: Schema.DateTimeUtcFromMillis,
+  absoluteExpiresAt: Schema.DateTimeUtcFromMillis,
+});
+
+export type SessionMetadata = typeof SessionMetadata.Type;
+
+export interface SessionInspection<Claims> {
+  readonly session: SessionMetadata & { readonly claims: Claims };
+  readonly provenance: SessionAuthenticationProvenance;
+  readonly credentialVersion: SessionCredentialVersion;
+}
+
+export const PendingConsumption = Schema.Struct({
+  flowId: AuthenticationFlowId,
+  digest: TokenDigest,
+  bindingDigest: TokenDigest,
+  version: SecurityRevision,
+});
+
+export type PendingConsumption = typeof PendingConsumption.Type;
+
+export const SessionSignOut = Schema.Struct({
+  clearCredential: Schema.Literal(true),
+  invalidation: Schema.Literals(["revoked", "already-invalid", "client-only"]),
+});
+
+export type SessionSignOut = typeof SessionSignOut.Type;
+
+export const SessionCapabilities = Schema.Struct({
+  mode: Schema.Literals(["stateful", "stateless", "state-assisted"]),
+  listing: Schema.Boolean,
+  perSessionRevocation: Schema.Boolean,
+  subjectInvalidation: Schema.Literals(["immediate", "absolute-expiry"]),
+  renewal: Schema.Literals(["single-winner", "replayable"]),
+  /** Default authoritative checks never reuse positive authorization caches. */
+  positiveCacheMillis: Schema.Literal(0),
+});
+
+export type SessionCapabilities = typeof SessionCapabilities.Type;