@comity/auth

Authentication and session domain core for the Comity platform.

Purpose

@comity/auth provides the domain and application logic for authentication, session lifecycle management, and assurance evaluation.

It is designed as a pure, framework-independent module that can be integrated with different transport mechanisms (HTTP, tokens, RPC).

Scope

This package:

• ✅ defines the authentication domain (sessions, assurance, refresh, step-up)
• ✅ provides use cases for session lifecycle management
• ✅ exposes a unified AuthFacade
• ✅ emits domain events for observability and integration

This package does NOT:

• ❌ parse or validate HTTP requests
• ❌ issue or verify tokens directly
• ❌ manage persistence details
• ❌ depend on any transport or framework

Public API

• Authentication facade — AuthFacade for session lifecycle operations
• Session contracts — session, assurance, refresh, and revocation types
• Policy contracts — assurance, refresh, and revocation policy interfaces
• Domain events — session lifecycle event interfaces
• Errors — authorization error types (@comity/auth/errors)
• Observers — passive event subscribers (@comity/auth/observers)
• Policies — canonical policy implementations (@comity/auth/policies)
• Setup — kernel module metadata and wiring (@comity/auth/setup)
• Use cases — session lifecycle operations (@comity/auth/use-cases)

No exhaustive reference; see docs for constraints.

Documentation

• docs/overview.md
• docs/conventions.md
• docs/architecture.md
• docs/events.md
• docs/decisions.md

Related Packages

• @comity/auth-jose
• @comity/http
• @comity/kernel

Status

Stable

Review Completed: 2026-07-25 Reviewer: Hobiri MAGI (DeepSeek v4 Pro) Compliance Score: 99.5% (Green)