effect 4.1.0 → 4.1.1

package/src/crypto/Cipher.ts

@@ -35,7 +35,7 @@ import * as CryptoError from "./CryptoError.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const TypeId = "~effect/crypto/Cipher/Key" as const
 
@@ -217,7 +217,7 @@ export const layerWebCrypto: Layer.Layer<Cipher, never, SecureRandom.SecureRando
   Cipher,
   Effect.gen(function*() {
     const random = yield* SecureRandom.SecureRandom
-    const crypto = yield* WebCrypto
+    const crypto = yield* WebCrypto.WebCrypto
     const cryptoKeyFor = KeyModel.makeCache((subtle, bytes, algorithm: Algorithm) =>
       subtle.importKey("raw", bytes as BufferSource, algorithm.mode, false, ["encrypt", "decrypt"])
     )
@@ -299,7 +299,7 @@ export const key = <A extends Algorithm>(
  */
 export const fromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<Key<A>, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("Cipher", "fromCryptoKey", KeyProto, algorithm, cryptoKey, {
     type: "secret",

package/src/crypto/KeyAgreement.ts

@@ -43,7 +43,7 @@ import * as Asymmetric from "./internal/asymmetric.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const PrivateKeyTypeId = "~effect/crypto/KeyAgreement/PrivateKey" as const
 const PublicKeyTypeId = "~effect/crypto/KeyAgreement/PublicKey" as const
@@ -307,7 +307,7 @@ export const layerWebCrypto: Layer.Layer<KeyAgreement, never, SecureRandom.Secur
   KeyAgreement,
   Effect.gen(function*() {
     const random = yield* SecureRandom.SecureRandom
-    const crypto = yield* WebCrypto
+    const crypto = yield* WebCrypto.WebCrypto
     const caches = Asymmetric.makeCaches(family)
     return KeyAgreement.of({
       generateKeyPair: <A extends Algorithm>(algorithm: A) =>
@@ -447,7 +447,7 @@ export const publicKey = <A extends Algorithm>(
  */
 export const privateKeyFromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PrivateKey<A>, CryptoError.CryptoError> =>
   Asymmetric.fromCryptoKey(family, "privateKeyFromCryptoKey", algorithm, "private", cryptoKey)
 
@@ -467,7 +467,7 @@ export const privateKeyFromCryptoKey = <A extends Algorithm>(
  */
 export const publicKeyFromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PublicKey<A>, CryptoError.CryptoError> =>
   Asymmetric.fromCryptoKey(family, "publicKeyFromCryptoKey", algorithm, "public", cryptoKey)
 

package/src/crypto/KeyFormat.ts

@@ -76,6 +76,35 @@ export type Role = "public" | "private" | "secret"
  */
 export type Direction = "decode" | "encode"
 
+/**
+ * A JSON Web Key (RFC 7517) with the native Web Crypto field types and
+ * mutability, usable without DOM declarations.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface JsonWebKey {
+  alg?: string
+  crv?: string
+  d?: string
+  dp?: string
+  dq?: string
+  e?: string
+  ext?: boolean
+  k?: string
+  key_ops?: Array<string>
+  kty?: string
+  n?: string
+  oth?: Array<{ d?: string; r?: string; t?: string }>
+  p?: string
+  q?: string
+  qi?: string
+  use?: string
+  x?: string
+  y?: string
+}
+
 /**
  * A key format, such as {@link spki} or `pem(pkcs8)`.
  *
@@ -83,7 +112,7 @@ export type Direction = "decode" | "encode"
  *
  * `~tags` exists only in the types. It records the roles the format holds,
  * whether it can be read and written, and the type of its data: `Uint8Array`
- * for DER, `string` for PEM, and `JsonWebKey` for JWK.
+ * for DER, `string` for PEM, and {@link JsonWebKey} for JWK.
  *
  * @stability unstable
  * @category models

package/src/crypto/KeyWrap.ts

@@ -44,7 +44,7 @@ import * as internal from "./internal/webCrypto.ts"
 import type * as KeyFormat from "./KeyFormat.ts"
 import * as Mac from "./Mac.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const KeyTypeId = "~effect/crypto/KeyWrap/Key" as const
 const PrivateKeyTypeId = "~effect/crypto/KeyWrap/PrivateKey" as const
@@ -417,7 +417,7 @@ export const layerWebCrypto: Layer.Layer<KeyWrap, never, SecureRandom.SecureRand
   KeyWrap,
   Effect.gen(function*() {
     const random = yield* SecureRandom.SecureRandom
-    const crypto = yield* WebCrypto
+    const crypto = yield* WebCrypto.WebCrypto
     const kwCryptoKey = KeyModel.makeCache((subtle, bytes) =>
       subtle.importKey("raw", bytes as BufferSource, "AES-KW", false, ["wrapKey", "unwrapKey"])
     )
@@ -553,7 +553,7 @@ export const key = <A extends AesKw>(
  */
 export const fromCryptoKey = <A extends AesKw>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<Key<A>, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("KeyWrap", "fromCryptoKey", KeyProto, algorithm, cryptoKey, {
     type: "secret",
@@ -570,7 +570,7 @@ const rsaFromCryptoKey = <K>(
   proto: object,
   algorithm: RsaOaep,
   role: Asymmetric.Role,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<K, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("KeyWrap", method, proto, algorithm, cryptoKey, {
     type: role,
@@ -597,7 +597,7 @@ const rsaFromCryptoKey = <K>(
  */
 export const privateKeyFromCryptoKey = <A extends RsaOaep>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PrivateKey<A>, CryptoError.CryptoError> =>
   rsaFromCryptoKey("privateKeyFromCryptoKey", PrivateKeyProto, algorithm, "private", cryptoKey)
 
@@ -617,7 +617,7 @@ export const privateKeyFromCryptoKey = <A extends RsaOaep>(
  */
 export const publicKeyFromCryptoKey = <A extends RsaOaep>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PublicKey<A>, CryptoError.CryptoError> =>
   rsaFromCryptoKey("publicKeyFromCryptoKey", PublicKeyProto, algorithm, "public", cryptoKey)
 

package/src/crypto/Mac.ts

@@ -23,7 +23,7 @@ import * as Digest from "./Digest.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const TypeId = "~effect/crypto/Mac/Key" as const
 
@@ -215,7 +215,7 @@ export const layerWebCryptoWith = (options: {
     Mac,
     Effect.gen(function*() {
       const random = yield* SecureRandom.SecureRandom
-      const crypto = yield* WebCrypto
+      const crypto = yield* WebCrypto.WebCrypto
       const cryptoKeyFor = KeyModel.makeCache((subtle, bytes, algorithm: Algorithm) =>
         subtle.importKey("raw", bytes as BufferSource, importParams(algorithm), false, ["sign", "verify"])
       )
@@ -321,7 +321,7 @@ export const key = <A extends Algorithm>(
  */
 export const fromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<Key<A>, CryptoError.CryptoError> =>
   KeyModel.fromCryptoKey("Mac", "fromCryptoKey", KeyProto, algorithm, cryptoKey, {
     type: "secret",

package/src/crypto/Signature.ts

@@ -48,7 +48,7 @@ import * as Asymmetric from "./internal/asymmetric.ts"
 import * as KeyModel from "./internal/key.ts"
 import * as internal from "./internal/webCrypto.ts"
 import * as SecureRandom from "./SecureRandom.ts"
-import { WebCrypto } from "./WebCrypto.ts"
+import * as WebCrypto from "./WebCrypto.ts"
 
 const PrivateKeyTypeId = "~effect/crypto/Signature/PrivateKey" as const
 const PublicKeyTypeId = "~effect/crypto/Signature/PublicKey" as const
@@ -513,7 +513,7 @@ export const layerWebCrypto: Layer.Layer<Signature, never, SecureRandom.SecureRa
   Signature,
   Effect.gen(function*() {
     const random = yield* SecureRandom.SecureRandom
-    const crypto = yield* WebCrypto
+    const crypto = yield* WebCrypto.WebCrypto
     const caches = Asymmetric.makeCaches(family)
     return Signature.of({
       generateKeyPair: <A extends Algorithm>(algorithm: A) =>
@@ -630,7 +630,7 @@ export const publicKey = <
  */
 export const privateKeyFromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PrivateKey<A>, CryptoError.CryptoError> =>
   Asymmetric.fromCryptoKey(family, "privateKeyFromCryptoKey", algorithm, "private", cryptoKey)
 
@@ -650,7 +650,7 @@ export const privateKeyFromCryptoKey = <A extends Algorithm>(
  */
 export const publicKeyFromCryptoKey = <A extends Algorithm>(
   algorithm: A,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<PublicKey<A>, CryptoError.CryptoError> =>
   Asymmetric.fromCryptoKey(family, "publicKeyFromCryptoKey", algorithm, "public", cryptoKey)
 

package/src/crypto/WebCrypto.ts

@@ -20,6 +20,10 @@
 import * as Context from "../Context.ts"
 import * as Layer from "../Layer.ts"
 
+// The type of `globalThis.crypto`, which, unlike the global `Crypto` type,
+// every `@types/node` version declares.
+type Crypto = typeof globalThis.crypto
+
 /**
  * Reference to the WebCrypto `Crypto` object, defaulting to
  * `globalThis.crypto`.
@@ -62,3 +66,19 @@ export const WebCrypto: Context.Reference<Crypto> = Context.Reference<Crypto>("e
  * @since 4.0.0
  */
 export const layer = (crypto: Crypto): Layer.Layer<never> => Layer.succeed(WebCrypto, crypto)
+
+/**
+ * A WebCrypto `CryptoKey`, declared structurally so the `effect` declarations
+ * type-check without the DOM library and with any `@types/node` version.
+ * Keys from `crypto.subtle` and Node's `webcrypto` are assignable to it.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface CryptoKey {
+  readonly algorithm: { readonly name: string }
+  readonly extractable: boolean
+  readonly type: "private" | "public" | "secret"
+  readonly usages: ReadonlyArray<string>
+}

package/src/crypto/internal/asymmetric.ts

@@ -2,6 +2,7 @@ import * as Effect from "../../Effect.ts"
 import * as Predicate from "../../Predicate.ts"
 import * as CryptoError from "../CryptoError.ts"
 import type * as SecureRandom from "../SecureRandom.ts"
+import type * as WebCrypto from "../WebCrypto.ts"
 import * as KeyModel from "./key.ts"
 import * as internal from "./webCrypto.ts"
 
@@ -121,7 +122,7 @@ export const fromCryptoKey = <K>(
   method: string,
   algorithm: unknown,
   role: Role,
-  cryptoKey: CryptoKey
+  cryptoKey: WebCrypto.CryptoKey
 ): Effect.Effect<K, CryptoError.CryptoError> => {
   const spec = family.specOf(algorithm)
   return KeyModel.fromCryptoKey(

package/src/crypto/internal/key.ts

@@ -4,6 +4,7 @@ import { format } from "../../Formatter.ts"
 import { NodeInspectSymbol } from "../../Inspectable.ts"
 import * as Predicate from "../../Predicate.ts"
 import type * as CryptoError from "../CryptoError.ts"
+import type * as WebCrypto from "../WebCrypto.ts"
 import * as internal from "./webCrypto.ts"
 
 /**
@@ -131,7 +132,7 @@ export const checkAesLength = (name: string, keyLength: number) => (algorithm: K
   return length === keyLength * 8 ? undefined : `Expected a ${keyLength * 8}-bit ${name} key, not ${length} bits`
 }
 
-const checkCryptoKey = (cryptoKey: CryptoKey, expected: ExpectedCryptoKey): string | undefined => {
+const checkCryptoKey = (cryptoKey: WebCrypto.CryptoKey, expected: ExpectedCryptoKey): string | undefined => {
   if (
     !Predicate.hasProperty(cryptoKey, "type") || !Predicate.hasProperty(cryptoKey, "algorithm") ||
     !Predicate.hasProperty(cryptoKey, "usages") || !Array.isArray(cryptoKey.usages)
@@ -162,7 +163,7 @@ const checkCryptoKey = (cryptoKey: CryptoKey, expected: ExpectedCryptoKey): stri
  *
  * @internal
  */
-export const importedAlgorithm = (algorithm: unknown, cryptoKey: CryptoKey): unknown => {
+export const importedAlgorithm = (algorithm: unknown, cryptoKey: WebCrypto.CryptoKey): unknown => {
   const modulusLength = (cryptoKey.algorithm as Partial<RsaKeyAlgorithm>).modulusLength
   return Predicate.hasProperty(algorithm, "modulusLength") && modulusLength !== undefined &&
       algorithm.modulusLength !== modulusLength
@@ -171,7 +172,8 @@ export const importedAlgorithm = (algorithm: unknown, cryptoKey: CryptoKey): unk
 }
 
 /**
- * Synchronously validates and wraps a `CryptoKey`.
+ * Synchronously validates and wraps a `CryptoKey`. The structural key only
+ * becomes the native `CryptoKey` once it passes the check.
  *
  * @internal
  */
@@ -180,13 +182,18 @@ export const fromCryptoKey = <K>(
   method: string,
   proto: object,
   algorithm: unknown,
-  cryptoKey: CryptoKey,
+  cryptoKey: WebCrypto.CryptoKey,
   expected: ExpectedCryptoKey
 ): Effect.Effect<K, CryptoError.CryptoError> =>
   Effect.suspend(() => {
     const problem = checkCryptoKey(cryptoKey, expected)
     return problem === undefined
-      ? Effect.succeed(make<K>(proto, importedAlgorithm(algorithm, cryptoKey), { _tag: "CryptoKey", cryptoKey }))
+      ? Effect.succeed(
+        make<K>(proto, importedAlgorithm(algorithm, cryptoKey), {
+          _tag: "CryptoKey",
+          cryptoKey: cryptoKey as CryptoKey
+        })
+      )
       : internal.invalidKey(module, method, problem)
   })
 

package/src/encoding/Base64Url.ts

@@ -115,6 +115,7 @@ export const decode = (str: string): Result.Result<Uint8Array, EncodingError> =>
       })
     )
   }
+  // Validating up front keeps failures as cheap as the scan, without allocating the output.
   if (!/^[-_A-Z0-9]*?={0,2}$/i.test(stripped)) {
     return Result.fail(
       new EncodingError({
@@ -125,11 +126,34 @@ export const decode = (str: string): Result.Result<Uint8Array, EncodingError> =>
       })
     )
   }
-  let sanitized = length % 4 === 2 ? `${stripped}==` : length % 4 === 3 ? `${stripped}=` : stripped
-  sanitized = sanitized.replace(/-/g, "+").replace(/_/g, "/")
-  return Base64.decode(sanitized)
+  const end = !padded ? length : stripped.charCodeAt(length - 2) === 61 ? length - 2 : length - 1
+  const fullEnd = end & ~3
+  // Not `(end * 3) >> 2`: engines that allow strings over 2^31 / 3 characters would overflow int32.
+  const result = new Uint8Array(Math.floor(end * 3 / 4))
+  let j = 0
+  for (let i = 0; i < fullEnd; i += 4) {
+    const a = codes[stripped.charCodeAt(i)]
+    const b = codes[stripped.charCodeAt(i + 1)]
+    const c = codes[stripped.charCodeAt(i + 2)]
+    const d = codes[stripped.charCodeAt(i + 3)]
+    result[j++] = (a << 2) | (b >> 4)
+    result[j++] = (b << 4) | (c >> 2)
+    result[j++] = (c << 6) | d
+  }
+  // Non-zero trailing bits in the final character are ignored.
+  if (end > fullEnd) {
+    const a = codes[stripped.charCodeAt(fullEnd)]
+    const b = codes[stripped.charCodeAt(fullEnd + 1)]
+    result[j++] = (a << 2) | (b >> 4)
+    if (end - fullEnd === 3) result[j] = (b << 4) | (codes[stripped.charCodeAt(fullEnd + 2)] >> 2)
+  }
+  return Result.succeed(result)
 }
 
+const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+const codes = new Uint8Array(128)
+for (let i = 0; i < alphabet.length; i++) codes[alphabet.charCodeAt(i)] = i
+
 /**
  * Decodes a padded or unpadded URL-safe Base64 string into UTF-8 text safely.
  *

package/src/encoding/Ndjson.ts

@@ -236,7 +236,7 @@ const parseLine = (
   ignoreEmptyLines: boolean,
   unterminated: boolean
 ): NdjsonError | undefined => {
-  if (ignoreEmptyLines && line.length === 0) return
+  if (ignoreEmptyLines && /^[ \t]*$/.test(line)) return
   try {
     out.push(JSON.parse(line))
   } catch (cause) {
@@ -262,8 +262,9 @@ const flushNothing = () => undefined
  *
  * **Gotchas**
  *
- * Set `ignoreEmptyLines` to skip blank lines before calling `JSON.parse`;
- * otherwise blank lines are parsed and fail as invalid JSON.
+ * Set `ignoreEmptyLines` to skip empty lines and lines containing only spaces
+ * or tabs before calling `JSON.parse`; otherwise these lines fail as invalid
+ * JSON.
  *
  * @stability unstable
  * @category constructors
@@ -314,8 +315,8 @@ const emptyBytes = new Uint8Array(0)
  * **Details**
  *
  * Lines may span input chunks. `\n`, `\r\n` and a bare `\r` end a line, and a
- * leading UTF-8 BOM is skipped. `ignoreEmptyLines` controls whether blank lines
- * are skipped before JSON parsing.
+ * leading UTF-8 BOM is skipped. `ignoreEmptyLines` skips empty lines and lines
+ * containing only spaces or tabs before JSON parsing.
  *
  * The first bad line fails the channel after the lines before it have been
  * emitted. A line that is not valid UTF-8 fails with `reason: "InvalidUtf8"`

package/src/encoding/Sse.ts

@@ -667,7 +667,9 @@ export type AnyEvent = Event | Retry
  * **Details**
  *
  * It renders `Event` values as `id`, `event`, and `data` lines and renders
- * `Retry` values as `retry:` directives.
+ * `Retry` values as `retry:` directives. CR and LF are removed from `id` and
+ * `event`, and NUL is removed from `id`, so those values cannot inject fields
+ * or events.
  *
  * @stability unstable
  * @category encoding
@@ -679,10 +681,10 @@ export const encoder: Encoder = {
       case "Event": {
         let data = ""
         if (event.id !== undefined) {
-          data += `id: ${event.id}\n`
+          data += `id: ${event.id.replace(/[\r\n\0]/g, "")}\n`
         }
         if (event.event !== "message") {
-          data += `event: ${event.event}\n`
+          data += `event: ${event.event.replace(/[\r\n]/g, "")}\n`
         }
         data += `data: ${event.data.replace(/\r\n|\r|\n/g, "\ndata: ")}\n`
         return data + "\n"

package/src/eventlog/EventLog.ts

@@ -303,6 +303,13 @@ export const layerRegistry = Layer.effect(
  * The identity is used by remote replication for authentication and by the
  * encryption service to derive signing and encryption keys.
  *
+ * **Gotchas**
+ *
+ * `publicKey` identifies the identity but is not a secret, and nothing ties it
+ * to the signing key derived from `privateKey`. A server binds the first
+ * signing key that authenticates for a `publicKey`, unless its authorization
+ * checks the presented signing key.
+ *
  * @stability unstable
  * @category services
  * @since 4.0.0

package/src/eventlog/EventLogServer.ts

@@ -13,6 +13,7 @@ import type { NonEmptyReadonlyArray } from "../Array.ts"
 import * as Arr from "../Array.ts"
 import * as Cache from "../Cache.ts"
 import * as Context from "../Context.ts"
+import * as Mac from "../crypto/Mac.ts"
 import * as Data from "../Data.ts"
 import * as Duration from "../Duration.ts"
 import * as Effect from "../Effect.ts"
@@ -76,6 +77,12 @@ export const layerAuthMiddleware: Layer.Layer<
  * chunked writes, delegates write and change handling to the supplied callbacks,
  * and frames large change payloads into chunks.
  *
+ * `Authenticate` calls `authorizeIdentity` with the claimed public key and the
+ * presented signing public key, then verifies the signature against the
+ * presented key. Only a verified key is passed to
+ * `getOrCreateSessionAuthBinding`, and a key that differs from the identity's
+ * existing binding is rejected.
+ *
  * Use the connection's `ConnectionWrites.track` in `onWrite` and
  * `ConnectionWrites.filter` in `changes` to suppress its own write echoes.
  * `compaction` sets `HelloResponse.compaction`, advertising that the server
@@ -89,7 +96,10 @@ export const layerRpcHandlers = (options: {
   readonly remoteId: RemoteId
   readonly firstSequence?: number | undefined
   readonly compaction?: boolean | undefined
-  readonly authorizeIdentity?: (publicKey: string) => Effect.Effect<void, EventLogProtocolError>
+  readonly authorizeIdentity?: (
+    publicKey: string,
+    signingPublicKey: Uint8Array<ArrayBuffer>
+  ) => Effect.Effect<void, EventLogProtocolError>
   readonly getOrCreateSessionAuthBinding: (
     publicKey: string,
     signingPublicKey: Uint8Array<ArrayBuffer>
@@ -158,33 +168,40 @@ export const layerRpcHandlers = (options: {
         }
         yield* Cache.invalidate(clientChallenges, client.id)
         if (options.authorizeIdentity) {
-          yield* options.authorizeIdentity(request.publicKey)
+          yield* options.authorizeIdentity(request.publicKey, request.signingPublicKey)
         }
-        const signingPublicKey = yield* Cache.get(
-          persistedSigningPublicKeys,
-          new SessionAuthCacheKey({
-            publicKey: request.publicKey,
-            signingPublicKey: request.signingPublicKey
-          })
-        )
         const verified = yield* EventLogSessionAuth.verifySessionAuthenticateRequest({
           remoteId: options.remoteId,
           challenge,
           publicKey: request.publicKey,
-          signingPublicKey,
+          signingPublicKey: request.signingPublicKey,
           signature: request.signature,
           algorithm: request.algorithm
         }).pipe(
           Effect.catch(() => Effect.succeed(false))
         )
 
-        if (!verified) {
-          return yield* new EventLogProtocolError({
+        const verificationFailed = () =>
+          new EventLogProtocolError({
             requestTag: "Authenticate",
             publicKey: request.publicKey,
             code: "Forbidden",
             message: "Session auth signature verification failed"
           })
+        if (!verified) {
+          return yield* verificationFailed()
+        }
+        // Only a verified key reaches the binding. A key other than the
+        // identity's bound key is rejected like a bad signature.
+        const boundSigningPublicKey = yield* Cache.get(
+          persistedSigningPublicKeys,
+          new SessionAuthCacheKey({
+            publicKey: request.publicKey,
+            signingPublicKey: request.signingPublicKey
+          })
+        )
+        if (!Mac.timingSafeEqual(boundSigningPublicKey, request.signingPublicKey)) {
+          return yield* verificationFailed()
         }
 
         const authenticatedIdentities = new Set(
@@ -411,6 +428,8 @@ export class AuthenticatedIdentities extends Context.Service<AuthenticatedIdenti
   "effect/eventlog/EventLogServer/AuthenticatedIdentities"
 ) {}
 
+// Keyed by `publicKey` alone: the cache holds each identity's bound signing
+// key, and `Authenticate` rejects any presented key that differs from it.
 class SessionAuthCacheKey extends Data.Class<{
   readonly publicKey: string
   readonly signingPublicKey: Uint8Array<ArrayBuffer>

package/src/eventlog/EventLogServerEncrypted.ts

@@ -503,6 +503,11 @@ export class Storage extends Context.Service<Storage, {
    * Lowest assigned sequence (default 0). Overestimating skips entries.
    */
   readonly firstSequence?: number | undefined
+  /**
+   * Returns the signing key bound to `publicKey`, binding `signingPublicKey`
+   * when none is bound yet. The server only passes keys whose signature it
+   * has verified, and rejects a key that differs from the returned binding.
+   */
   readonly getOrCreateSessionAuthBinding: (
     publicKey: string,
     signingPublicKey: Uint8Array<ArrayBuffer>

package/src/eventlog/EventLogServerUnencrypted.ts

@@ -165,8 +165,8 @@ export const layerRpcHandlers: Layer.Layer<
   return EventLogServer.layerRpcHandlers({
     remoteId,
     firstSequence: storage.firstSequence,
-    authorizeIdentity: (publicKey) =>
-      auth.authorizeIdentity({ publicKey }).pipe(
+    authorizeIdentity: (publicKey, signingPublicKey) =>
+      auth.authorizeIdentity({ publicKey, signingPublicKey }).pipe(
         Effect.mapError((error) =>
           new EventLogProtocolError({
             requestTag: "Authenticate",
@@ -318,6 +318,17 @@ export class EventLogServerAuthError extends Data.TaggedError("EventLogServerAut
  * Use to provide authorization checks for plaintext event-log writes, reads,
  * and identity authentication.
  *
+ * **Gotchas**
+ *
+ * An identity's `publicKey` is an identifier, not a secret. The server binds
+ * the first signing key that authenticates for an identity and rejects any
+ * other key afterwards. `authorizeIdentity` also receives the presented
+ * `signingPublicKey`, so a deployment that records each identity's signing key
+ * at provisioning time, with `EventLogSessionAuth.deriveSigningPublicKey`, can
+ * reject every other key, including on first use. The server always supplies
+ * `signingPublicKey`; it is optional only so that existing callers keep
+ * compiling, and a policy that checks it should reject when it is missing.
+ *
  * @stability unstable
  * @category services
  * @since 4.0.0
@@ -334,6 +345,7 @@ export class EventLogServerAuthorization extends Context.Service<EventLogServerA
   }) => Effect.Effect<void, EventLogServerAuthError>
   readonly authorizeIdentity: (options: {
     readonly publicKey: string
+    readonly signingPublicKey?: Uint8Array<ArrayBuffer> | undefined
   }) => Effect.Effect<void, EventLogServerAuthError>
 }>()("effect/eventlog/EventLogServerUnencrypted/EventLogServerAuthorization") {}
 
@@ -422,6 +434,11 @@ export class Storage extends Context.Service<Storage, {
    * Lowest assigned sequence (default 0). Overestimating skips entries.
    */
   readonly firstSequence?: number | undefined
+  /**
+   * Returns the signing key bound to `publicKey`, binding `signingPublicKey`
+   * when none is bound yet. The server only passes keys whose signature it
+   * has verified, and rejects a key that differs from the returned binding.
+   */
   readonly getOrCreateSessionAuthBinding: (
     publicKey: string,
     signingPublicKey: Uint8Array<ArrayBuffer>

package/src/eventlog/EventLogSessionAuth.ts

@@ -16,6 +16,8 @@ import { WebCrypto } from "../crypto/WebCrypto.ts"
 import * as Data from "../Data.ts"
 import * as Effect from "../Effect.ts"
 import * as Layer from "../Layer.ts"
+import type { Identity } from "./EventLog.ts"
+import { makeGetIdentityRootSecretMaterial } from "./internal/identityRootSecretDerivation.ts"
 
 const textEncoder = new TextEncoder()
 const textDecoder = new TextDecoder("utf-8", { fatal: true })
@@ -524,3 +526,27 @@ export const verifySessionAuthenticateRequest = Effect.fnUntraced(function*(opti
     signature: options.signature
   })
 })
+
+const getIdentityRootSecretMaterial = makeGetIdentityRootSecretMaterial()
+
+/**
+ * Derives the Ed25519 signing public key an identity presents during session
+ * authentication.
+ *
+ * **When to use**
+ *
+ * Use when provisioning an identity to record its signing key, so that server
+ * authorization can reject any other key presented for the identity's
+ * `publicKey`.
+ *
+ * **Details**
+ *
+ * The key is derived from the identity's private key on the `WebCrypto`
+ * reference.
+ *
+ * @stability unstable
+ * @category signing
+ * @since 4.1.1
+ */
+export const deriveSigningPublicKey = (identity: Identity["Service"]): Effect.Effect<Uint8Array<ArrayBuffer>> =>
+  Effect.map(getIdentityRootSecretMaterial(identity), (material) => material.signingPublicKey)

package/src/graphql/GraphQLClient.ts

@@ -70,7 +70,9 @@ type ArgsWithOptions<Variables, Options> = {} extends Variables ? [variables: Va
  * `partial: false`, it returns the decoded result and fails with a
  * `ResponseError` on any `errors`. With `partial: true` it returns
  * `{ data, errors }`. `partial` must be a literal `true` or `false`, not
- * an arbitrary `boolean`.
+ * an arbitrary `boolean`. A non-2xx HTTP response never succeeds, even with
+ * `partial: true`: it fails with a `ResponseError` when it has `errors`, and
+ * with a `TransportError` otherwise.
  *
  * An operation without variables is called as `client.Viewer()` or, with
  * options, `client.Viewer(undefined, { headers })`.