@getstrata/core 2.2.33 → 2.2.34

package/dist/entries/auth/basicAuthGuard.js

@@ -1082,6 +1082,19 @@ function readBasicCredentials(request) {
 // ../../src/core/auth/basicAuthGuard.ts
 init_databaseTenantContext();
 
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+
 // ../../src/core/auth/password.ts
 async function hashPassword(password) {
   return await Bun.password.hash(password, {
@@ -1574,6 +1587,8 @@ function parseRecoveryHashes(raw) {
   }
 }
 function completePasswordLogin(user, options = {}) {
+  if (!isAccountActive(user))
+    return { ok: false, error: "account_inactive" };
   if (!user.mfa_enabled) {
     return { ok: true };
   }
@@ -1637,6 +1652,8 @@ class BasicAuthGuard {
       return null;
     }
     const record = typeof directory.findByEmail === "function" ? await directory.findByEmail(credentials.username) : null;
+    if (record && !isAccountActive(record))
+      return null;
     if (record?.password) {
       if (!await verifyPassword(credentials.password, record.password)) {
         return null;
@@ -1654,12 +1671,13 @@ class BasicAuthGuard {
       return {
         id: record.id,
         role: record.role,
+        ...record.auth_version !== undefined ? { authVersion: record.auth_version } : {},
         emailVerifiedAt: record.email_verified_at ?? null
       };
     }
     if (typeof directory.verifyCredentials === "function") {
       const user = await directory.verifyCredentials(credentials.username, credentials.password);
-      if (!user) {
+      if (!user || !isAuthUserActive(user)) {
         return null;
       }
       let record = typeof directory.findByEmail === "function" ? await directory.findByEmail(credentials.username) : null;

package/dist/entries/auth/jwtGuard.js

@@ -167,6 +167,19 @@ function readBasicCredentials(request) {
   }
 }
 
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+
 // ../../src/core/auth/jwt.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
@@ -333,6 +346,40 @@ function verifyJwt(token, secret) {
 
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
+// ../../src/core/auth/sessionCookie.ts
 var SESSION_COOKIE = appCookieName("session");
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
 var SESSION_REMEMBER_TTL_SECONDS = 60 * 60 * 24 * 30;
@@ -352,25 +399,12 @@ function sessionRememberTtlSeconds() {
 function resolveSessionSecret() {
   return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
 }
-function signSession(userId, issuedAt, ttlSeconds) {
-  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
+function signSession(userId, issuedAt, ttlSeconds, authVersion) {
+  const payload = authVersion !== undefined ? `v2.${userId}.${issuedAt}.${ttlSeconds}.${authVersion}` : ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
   const signature = createHmac2("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
-function readCookieValue(request, cookieName) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === cookieName) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember, authVersion) {
   const userId = Number.parseInt(userIdRaw, 10);
   const issuedAt = Number.parseInt(issuedAtRaw, 10);
   if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
@@ -382,7 +416,7 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (Date.now() - issuedAt > ttlSeconds * 1000) {
     return null;
   }
-  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
+  const expectedSignature = (authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, authVersion) : remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return null;
   }
@@ -394,14 +428,20 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return { userId, issuedAt };
+  return { userId, issuedAt, ...authVersion !== undefined ? { authVersion } : {} };
 }
 function readSession(request) {
-  const cookieValue = readCookieValue(request, sessionCookieName());
+  const cookieValue = readRequestCookie(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
   const parts = cookieValue.split(".");
+  if (parts.length === 6 && parts[0] === "v2") {
+    const fields = parts.slice(1, 5);
+    if (fields.some((value) => !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value))))
+      return null;
+    return readSignedSession(String(parts[1]), String(parts[2]), parts[5], Number(parts[3]), true, Number(parts[4]));
+  }
   if (parts.length === 4) {
     const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
     return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
@@ -426,15 +466,18 @@ function isSessionInvalidated(issuedAt, validAfter) {
   return issuedAt < timestamp;
 }
 function createSessionCookieDetails(userId, options = {}) {
+  if (options.authVersion !== undefined && (!Number.isSafeInteger(options.authVersion) || options.authVersion < 0))
+    throw new RangeError("authVersion must be a non-negative safe integer.");
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
-  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
+  const value = options.authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, options.authVersion) : options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = isProductionEnv() ? "; Secure" : "";
   return {
     header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
     userId,
     issuedAt,
-    ttlSeconds
+    ttlSeconds,
+    ...options.authVersion !== undefined ? { authVersion: options.authVersion } : {}
   };
 }
 function createSessionCookie(userId, options = {}) {
@@ -496,10 +539,15 @@ class JwtGuard {
     } catch {
       return null;
     }
-    if (isSessionInvalidated(payload.iat * 1000, record.session_valid_after)) {
+    if (!isAccountActive(record) || !matchesAuthVersion(payload.authVersion, record.auth_version))
+      return null;
+    if (record.auth_version === undefined && isSessionInvalidated(payload.iat * 1000, record.session_valid_after)) {
       return null;
     }
-    return authUserFromJwt(payload);
+    return {
+      ...authUserFromJwt(payload),
+      ...record.auth_version !== undefined ? { authVersion: record.auth_version } : {}
+    };
   }
 }
 export {

package/dist/entries/auth/oneTimeToken.js

@@ -341,6 +341,8 @@ function hashOneTimeToken(plain) {
   return hashApiToken(plain.trim());
 }
 function isMissingRelation(error) {
+  if (error && typeof error === "object" && "code" in error && error.code === "ER_NO_SUCH_TABLE")
+    return true;
   const message = error instanceof Error ? error.message : String(error);
   return /no such table|does not exist|unknown table|er_no_such_table/i.test(message);
 }
@@ -374,23 +376,25 @@ async function consumeOneTimeToken(sql, purpose, plain, now = new Date) {
 }
 async function revokeUserSessions(sql, userId, options = {}) {
   const dialect = currentSqlDialect();
-  await sql.unsafe(`UPDATE users SET session_valid_after = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)}`, [new Date().toISOString(), userId]);
-  try {
-    await sql.unsafe(`DELETE FROM sessions WHERE user_id = ${dialect.placeholder(1)}`, [userId]);
-  } catch (error) {
-    if (!isMissingRelation(error)) {
-      throw error;
-    }
+  const versionUpdate = options.incrementAuthVersion ? ", auth_version = auth_version + 1" : "";
+  await sql.unsafe(`UPDATE users SET session_valid_after = ${dialect.placeholder(1)}${versionUpdate} WHERE id = ${dialect.placeholder(2)}`, [new Date().toISOString(), userId]);
+  await deleteOptionalCredentials(sql, "sessions", userId);
+  if (options.revokeApiTokens !== false) {
+    await deleteOptionalCredentials(sql, "api_tokens", userId);
   }
-  if (options.revokeApiTokens === false) {
-    return;
+}
+async function deleteOptionalCredentials(sql, table, userId) {
+  const dialect = currentSqlDialect();
+  if (dialect.driver === "pgsql") {
+    const [row] = await sql.unsafe(`SELECT to_regclass(${dialect.placeholder(1)}) AS relation`, [table]);
+    if (row?.relation == null)
+      return;
   }
   try {
-    await sql.unsafe(`DELETE FROM api_tokens WHERE user_id = ${dialect.placeholder(1)}`, [userId]);
+    await sql.unsafe(`DELETE FROM ${table} WHERE user_id = ${dialect.placeholder(1)}`, [userId]);
   } catch (error) {
-    if (!isMissingRelation(error)) {
+    if (dialect.driver === "pgsql" || !isMissingRelation(error))
       throw error;
-    }
   }
 }
 export {

package/dist/entries/auth/passwordConfirmCookie.js

@@ -2,6 +2,38 @@
 // ../../src/core/auth/passwordConfirmCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -88,6 +120,19 @@ function sdkClientClassName() {
   return fromName ? `${fromName}Client` : "AppClient";
 }
 
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+
 // ../../src/core/auth/passwordConfirmCookie.ts
 var PASSWORD_CONFIRM_COOKIE = appCookieName("password_confirmed");
 var DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS = 3 * 60 * 60;
@@ -101,33 +146,27 @@ function passwordConfirmTtlSeconds() {
 function resolvePasswordConfirmSecret() {
   return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET"], "session-secret");
 }
-function signPasswordConfirm(userId, confirmedAt) {
-  const payload = `${userId}.${confirmedAt}`;
+function signPasswordConfirm(userId, confirmedAt, authVersion) {
+  const payload = authVersion === undefined ? `${userId}.${confirmedAt}` : `v2.${userId}.${confirmedAt}.${authVersion}`;
   const signature = createHmac("sha256", resolvePasswordConfirmSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
-function readCookieValue(request, cookieName) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === cookieName) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function hasFreshPasswordConfirmation(request, userId) {
-  const cookieValue = readCookieValue(request, passwordConfirmCookieName());
+function hasFreshPasswordConfirmation(request, userId, authVersion) {
+  const cookieValue = readRequestCookie(request, passwordConfirmCookieName());
   if (!cookieValue) {
     return false;
   }
   const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
-    return false;
+  let proofVersion;
+  if (parts.length === 5 && parts[0] === "v2") {
+    if (parts.slice(1, 4).some((value) => !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value))))
+      return false;
+    proofVersion = Number(parts[3]);
+    parts.splice(3, 1);
+    parts.shift();
   }
+  if (parts.length !== 3 || !matchesAuthVersion(proofVersion, authVersion))
+    return false;
   const [userIdRaw, confirmedAtRaw, cookieSignature] = parts;
   const cookieUserId = Number.parseInt(String(userIdRaw), 10);
   const confirmedAt = Number.parseInt(String(confirmedAtRaw), 10);
@@ -137,7 +176,7 @@ function hasFreshPasswordConfirmation(request, userId) {
   if (Date.now() - confirmedAt > passwordConfirmTtlSeconds() * 1000) {
     return false;
   }
-  const expectedSignature = signPasswordConfirm(cookieUserId, confirmedAt).split(".").pop();
+  const expectedSignature = signPasswordConfirm(cookieUserId, confirmedAt, proofVersion).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return false;
   }
@@ -148,9 +187,11 @@ function hasFreshPasswordConfirmation(request, userId) {
   }
   return timingSafeEqual(expectedBuffer, actualBuffer);
 }
-function createPasswordConfirmCookie(userId) {
+function createPasswordConfirmCookie(userId, authVersion) {
+  if (authVersion !== undefined && (!Number.isSafeInteger(authVersion) || authVersion < 0))
+    throw new Error("Invalid authentication version.");
   const confirmedAt = Date.now();
-  const value = signPasswordConfirm(userId, confirmedAt);
+  const value = signPasswordConfirm(userId, confirmedAt, authVersion);
   const secure = isProductionEnv() ? "; Secure" : "";
   return `${passwordConfirmCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${passwordConfirmTtlSeconds()}${secure}`;
 }

package/dist/entries/auth/passwordLogin.js

@@ -712,6 +712,19 @@ function verifyTotp(secret, token, window = 1) {
   return matched;
 }
 
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+
 // ../../src/core/auth/passwordLogin.ts
 function parseRecoveryHashes(raw) {
   if (!raw?.trim()) {
@@ -725,6 +738,8 @@ function parseRecoveryHashes(raw) {
   }
 }
 function completePasswordLogin(user, options = {}) {
+  if (!isAccountActive(user))
+    return { ok: false, error: "account_inactive" };
   if (!user.mfa_enabled) {
     return { ok: true };
   }

package/dist/entries/auth/pendingMfaCookie.js

@@ -0,0 +1,100 @@
+// @bun
+// ../../src/core/auth/pendingMfaCookie.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
+// ../../src/core/auth/pendingMfaCookie.ts
+var COOKIE = "strata_mfa_pending";
+var TTL = 600;
+function signature(payload, secret) {
+  if (!secret.trim())
+    throw new Error("A pending MFA secret is required.");
+  return createHmac("sha256", secret).update(`pending-mfa:${payload}`).digest("hex");
+}
+function header(value, ttl) {
+  return `${COOKIE}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttl}${isProductionEnv() ? "; Secure" : ""}`;
+}
+function createPendingMfaCookie(userId, authVersion, secret) {
+  if (!Number.isSafeInteger(userId) || userId <= 0 || !Number.isSafeInteger(authVersion) || authVersion < 0)
+    throw new Error("Invalid pending MFA account identity or version.");
+  const payload = `v1.${userId}.${authVersion}.${Date.now()}`;
+  return header(`${payload}.${signature(payload, secret)}`, TTL);
+}
+function readPendingMfaCookie(request, secret) {
+  const value = readRequestCookie(request, COOKIE);
+  if (!value)
+    return null;
+  const parts = value.split(".");
+  if (parts.length !== 5 || parts[0] !== "v1")
+    return null;
+  const fields = parts.slice(1, 4);
+  if (fields.some((part) => !/^(0|[1-9][0-9]*)$/.test(part) || !Number.isSafeInteger(Number(part))))
+    return null;
+  const userId = Number(parts[1]), authVersion = Number(parts[2]), issuedAt = Number(parts[3]);
+  if (userId <= 0 || issuedAt > Date.now() || Date.now() - issuedAt > TTL * 1000)
+    return null;
+  const expected = Buffer.from(signature(parts.slice(0, 4).join("."), secret));
+  const actual = Buffer.from(parts[4] ?? "");
+  if (expected.length !== actual.length || !timingSafeEqual(expected, actual))
+    return null;
+  return { userId, authVersion };
+}
+function clearPendingMfaCookie() {
+  return header("", 0);
+}
+export {
+  clearPendingMfaCookie,
+  createPendingMfaCookie,
+  readPendingMfaCookie
+};

package/dist/entries/auth/sessionCookie.js

@@ -2,6 +2,38 @@
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -108,25 +140,12 @@ function sessionRememberTtlSeconds() {
 function resolveSessionSecret() {
   return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
 }
-function signSession(userId, issuedAt, ttlSeconds) {
-  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
+function signSession(userId, issuedAt, ttlSeconds, authVersion) {
+  const payload = authVersion !== undefined ? `v2.${userId}.${issuedAt}.${ttlSeconds}.${authVersion}` : ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
   const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
-function readCookieValue(request, cookieName) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === cookieName) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember, authVersion) {
   const userId = Number.parseInt(userIdRaw, 10);
   const issuedAt = Number.parseInt(issuedAtRaw, 10);
   if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
@@ -138,7 +157,7 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (Date.now() - issuedAt > ttlSeconds * 1000) {
     return null;
   }
-  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
+  const expectedSignature = (authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, authVersion) : remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return null;
   }
@@ -150,14 +169,20 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return { userId, issuedAt };
+  return { userId, issuedAt, ...authVersion !== undefined ? { authVersion } : {} };
 }
 function readSession(request) {
-  const cookieValue = readCookieValue(request, sessionCookieName());
+  const cookieValue = readRequestCookie(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
   const parts = cookieValue.split(".");
+  if (parts.length === 6 && parts[0] === "v2") {
+    const fields = parts.slice(1, 5);
+    if (fields.some((value) => !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value))))
+      return null;
+    return readSignedSession(String(parts[1]), String(parts[2]), parts[5], Number(parts[3]), true, Number(parts[4]));
+  }
   if (parts.length === 4) {
     const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
     return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
@@ -182,15 +207,18 @@ function isSessionInvalidated(issuedAt, validAfter) {
   return issuedAt < timestamp;
 }
 function createSessionCookieDetails(userId, options = {}) {
+  if (options.authVersion !== undefined && (!Number.isSafeInteger(options.authVersion) || options.authVersion < 0))
+    throw new RangeError("authVersion must be a non-negative safe integer.");
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
-  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
+  const value = options.authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, options.authVersion) : options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = isProductionEnv() ? "; Secure" : "";
   return {
     header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
     userId,
     issuedAt,
-    ttlSeconds
+    ttlSeconds,
+    ...options.authVersion !== undefined ? { authVersion: options.authVersion } : {}
   };
 }
 function createSessionCookie(userId, options = {}) {