@voltro/plugin-auth-social 0.85.0 → 0.87.0

package/dist/apple.js

@@ -0,0 +1,64 @@
+import { SocialConfigError as e } from "./errors.js";
+import { createPrivateKey as t, sign as n } from "node:crypto";
+//#region src/apple.ts
+var r = 15777e3, i = 900, a = "https://appleid.apple.com", o = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64url"), s = /* @__PURE__ */ new Map(), c = (n) => {
+	let r = s.get(n);
+	if (r) return r;
+	let i;
+	try {
+		i = t({ key: n });
+	} catch (t) {
+		throw new e(`apple: could not parse the .p8 private key — ${t.message}`);
+	}
+	if (i.asymmetricKeyType !== "ec") throw new e(`apple: the .p8 key must be an EC (P-256) key, got '${String(i.asymmetricKeyType)}'`);
+	let a = i.asymmetricKeyDetails?.namedCurve;
+	if (a !== void 0 && a !== "prime256v1") throw new e(`apple: ES256 requires the P-256 curve (prime256v1), got '${a}'`);
+	return s.set(n, i), i;
+}, l = /* @__PURE__ */ new Map(), u = () => {
+	s.clear(), l.clear();
+}, d = (t, i, s = Date.now) => {
+	if (!t) throw new e("apple: `clientId` (Services ID) is required");
+	if (!i.teamId) throw new e("apple: `teamId` is required");
+	if (!i.keyId) throw new e("apple: `keyId` is required");
+	if (!i.privateKey) throw new e("apple: `privateKey` (.p8 contents) is required");
+	let u = i.ttlSeconds ?? 900;
+	if (!Number.isFinite(u) || u <= 0) throw new e("apple: `ttlSeconds` must be a positive number");
+	if (u > 15777e3) throw new e(`apple: \`ttlSeconds\` may not exceed ${r} (six months, Apple's cap) — got ${u}`);
+	let d = s(), f = `${i.teamId}\u0000${i.keyId}\u0000${t}\u0000${u}`, p = l.get(f);
+	if (p && p.expiresAtMs - d > 6e4) return p.secret;
+	let m = Math.floor(d / 1e3), h = m + u, g = `${o(JSON.stringify({
+		alg: "ES256",
+		kid: i.keyId,
+		typ: "JWT"
+	}))}.${o(JSON.stringify({
+		iss: i.teamId,
+		iat: m,
+		exp: h,
+		aud: a,
+		sub: t
+	}))}`, _ = `${g}.${n("sha256", Buffer.from(g, "ascii"), {
+		key: c(i.privateKey),
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
+	return l.set(f, {
+		secret: _,
+		expiresAtMs: h * 1e3
+	}), _;
+}, f = (e) => {
+	if (!e) return null;
+	let t;
+	try {
+		t = JSON.parse(e);
+	} catch {
+		return null;
+	}
+	if (typeof t != "object" || !t) return null;
+	let n = t, r = typeof n.name == "object" && n.name !== null ? n.name : {}, i = (e) => typeof e == "string" && e.length > 0 ? e : null, a = {
+		firstName: i(r.firstName),
+		lastName: i(r.lastName),
+		email: i(n.email)
+	};
+	return a.firstName === null && a.lastName === null && a.email === null ? null : a;
+}, p = (e) => e !== null && e.toLowerCase().endsWith("@privaterelay.appleid.com");
+//#endregion
+export { i as APPLE_CLIENT_SECRET_DEFAULT_TTL_S, r as APPLE_CLIENT_SECRET_MAX_TTL_S, u as _resetAppleSecretCache, d as appleClientSecret, p as isApplePrivateRelayEmail, f as parseAppleUserPayload };

package/dist/callback.js

@@ -0,0 +1,129 @@
+import { SocialAuthError as e, SocialConfigError as t, SocialExchangeError as n, SocialIdTokenError as r, SocialStateMismatchError as i } from "./errors.js";
+import { socialProvider as a } from "./providers.js";
+import { appleClientSecret as o, isApplePrivateRelayEmail as s, parseAppleUserPayload as c } from "./apple.js";
+import { fetchGithubIdentity as l } from "./github.js";
+import { fetchDiscordIdentity as u } from "./discord.js";
+import { fetchEpicIdentity as d } from "./epic.js";
+import { timingSafeStringEqual as f } from "@voltro/protocol/session";
+import { JwtVerifyError as p, verifyJwt as m } from "@voltro/protocol/jwt";
+//#region src/callback.ts
+var h = (e) => e === !0 || e === "true", g = (e) => typeof e == "string" && e.length > 0 ? e : null, _ = async (_) => {
+	let v = a(_.provider, _.endpoints ?? {});
+	if (!_.code) throw new e(400, "missing_code", "socialCompleteLogin: missing `code`");
+	if (!_.expectedState) throw new i("socialCompleteLogin: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
+	if (!_.state || !f(_.state, _.expectedState)) throw new i("socialCompleteLogin: `state` does not match the value minted for this browser (possible login CSRF).");
+	if (!_.codeVerifier) throw new e(400, "missing_verifier", "socialCompleteLogin: missing `codeVerifier` (PKCE)");
+	if (v.kind === "oidc" && !_.expectedNonce) throw new t(`socialCompleteLogin: ${v.id} returns an ID token, so \`expectedNonce\` is required — without it a token captured from another login replays here.`);
+	let y = v.id === "apple" ? o(_.clientId, _.appleKey ?? (() => {
+		throw new t("apple: `appleKey` (teamId + keyId + .p8) is required");
+	})(), _.now ?? Date.now) : _.clientSecret ?? (() => {
+		throw new t(`${v.id}: \`clientSecret\` is required`);
+	})(), b = _.fetchImpl ?? fetch, x = new URLSearchParams({
+		grant_type: "authorization_code",
+		client_id: _.clientId,
+		client_secret: y,
+		code: _.code,
+		redirect_uri: _.redirectUri,
+		code_verifier: _.codeVerifier
+	});
+	v.id === "epic" && (x.delete("client_id"), x.delete("client_secret"));
+	let S;
+	try {
+		S = await b(v.tokenUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				accept: "application/json",
+				...v.id === "epic" ? { authorization: `Basic ${Buffer.from(`${encodeURIComponent(_.clientId)}:${encodeURIComponent(y)}`, "utf8").toString("base64")}` } : {}
+			},
+			body: x.toString(),
+			redirect: "error"
+		});
+	} catch {
+		throw new n("exchange_failed", `${v.id}: token exchange request failed`);
+	}
+	if (!S.ok) throw new n("exchange_failed", `${v.id}: token exchange failed (${S.status})`);
+	let C;
+	try {
+		let e = await S.json();
+		if (typeof e != "object" || !e || Array.isArray(e)) throw Error();
+		C = e;
+	} catch {
+		throw new n("malformed_token_response", `${v.id}: token endpoint returned a body that is not JSON`);
+	}
+	if (C.error) throw new n("exchange_failed", `${v.id}: token exchange refused`);
+	if (v.kind === "oauth2") {
+		if (typeof C.access_token != "string" || !C.access_token) throw new n("malformed_token_response", `${v.id}: token response carries no access_token`);
+		if (!v.apiBase) throw new t(`${v.id}: no apiBase configured`);
+		let e = {
+			apiBase: v.apiBase,
+			..._.fetchImpl === void 0 ? {} : { fetchImpl: _.fetchImpl }
+		}, r = v.id === "github" ? await l(C.access_token, e) : v.id === "discord" ? await u(C.access_token, e) : v.id === "epic" ? await d(C.access_token, {
+			...e,
+			clientId: _.clientId,
+			..._.now ? { now: _.now } : {}
+		}) : (() => {
+			throw new t(`${v.id}: no OAuth identity adapter`);
+		})();
+		return {
+			provider: v.id,
+			providerAccountId: r.accountId,
+			email: r.email,
+			emailVerified: r.emailVerified,
+			emailIsPrivateRelay: !1,
+			name: r.name ?? r.login,
+			firstName: null,
+			lastName: null,
+			avatarUrl: r.avatarUrl,
+			nameIsFirstAuthorizationOnly: !1,
+			raw: { ...r }
+		};
+	}
+	if (typeof C.id_token != "string" || !C.id_token) throw new n("malformed_token_response", `${v.id}: token response carries no id_token`);
+	if (!v.jwksUrl || !v.issuer) throw new t(`${v.id}: no JWKS/issuer configured`);
+	let w;
+	try {
+		w = await m(C.id_token, v.jwksUrl, {
+			issuer: v.issuer,
+			audience: _.clientId
+		});
+	} catch (e) {
+		throw e instanceof p ? new r("id_token_invalid", `${v.id}: id_token verification refused (${e.code})`) : new r("id_token_invalid", `${v.id}: id_token verification failed`);
+	}
+	let T = g(w.nonce);
+	if (!T || !f(T, _.expectedNonce ?? "")) throw new r("nonce_mismatch", `${v.id}: id_token nonce does not match the value minted for this login (possible replay).`);
+	let E = g(w.sub);
+	if (!E) throw new r("id_token_invalid", `${v.id}: id_token has no sub claim`);
+	let D = g(w.email), O = D !== null && v.assertsEmailVerification && h(w.email_verified);
+	if (v.id === "apple") {
+		let e = c(_.appleUserPayload), t = h(w.is_private_email) || s(D), n = e?.firstName ?? null, r = e?.lastName ?? null, i = [n, r].filter((e) => e !== null).join(" ");
+		return {
+			provider: "apple",
+			providerAccountId: E,
+			email: D ?? e?.email ?? null,
+			emailVerified: O,
+			emailIsPrivateRelay: t,
+			name: i.length > 0 ? i : null,
+			firstName: n,
+			lastName: r,
+			avatarUrl: null,
+			nameIsFirstAuthorizationOnly: e !== null,
+			raw: w
+		};
+	}
+	return {
+		provider: v.id,
+		providerAccountId: E,
+		email: D,
+		emailVerified: O,
+		emailIsPrivateRelay: !1,
+		name: g(w.name) ?? (v.id === "twitch" ? g(w.preferred_username) : null),
+		firstName: g(w.given_name),
+		lastName: g(w.family_name),
+		avatarUrl: g(w.picture),
+		nameIsFirstAuthorizationOnly: !1,
+		raw: w
+	};
+};
+//#endregion
+export { _ as socialCompleteLogin };

package/dist/discord.js

@@ -0,0 +1,38 @@
+import { SocialExchangeError as e } from "./errors.js";
+//#region src/discord.ts
+var t = async (t, n) => {
+	if (!t) throw new e("malformed_token_response", "discord: missing access token");
+	let r;
+	try {
+		r = await (n.fetchImpl ?? fetch)(`${n.apiBase}/users/@me`, {
+			headers: {
+				authorization: `Bearer ${t}`,
+				accept: "application/json"
+			},
+			redirect: "error"
+		});
+	} catch {
+		throw new e("exchange_failed", "discord: identity request failed");
+	}
+	if (!r.ok) throw new e("exchange_failed", `discord: identity request refused (${r.status})`);
+	let i;
+	try {
+		i = await r.json();
+	} catch {
+		throw new e("malformed_token_response", "discord: identity response is not JSON");
+	}
+	if (typeof i != "object" || !i || Array.isArray(i)) throw new e("malformed_token_response", "discord: malformed identity response");
+	let a = i;
+	if (typeof a.id != "string" || !/^[0-9]{1,20}$/.test(a.id) || typeof a.username != "string" || a.username.length === 0) throw new e("malformed_token_response", "discord: identity response has no stable id/username");
+	let o = typeof a.email == "string" && a.email.length > 0 ? a.email : null;
+	return {
+		accountId: a.id,
+		login: a.username,
+		name: typeof a.global_name == "string" && a.global_name.length > 0 ? a.global_name : null,
+		avatarUrl: null,
+		email: o,
+		emailVerified: o !== null && a.verified === !0
+	};
+};
+//#endregion
+export { t as fetchDiscordIdentity };

package/dist/epic.js

@@ -0,0 +1,39 @@
+import { SocialExchangeError as e } from "./errors.js";
+//#region src/epic.ts
+var t = async (t, n) => {
+	if (!t || !n.clientId) throw new e("malformed_token_response", "epic: missing token/client binding");
+	let r;
+	try {
+		r = await (n.fetchImpl ?? fetch)(`${n.apiBase}/tokenInfo`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				accept: "application/json"
+			},
+			body: new URLSearchParams({ token: t }).toString(),
+			redirect: "error"
+		});
+	} catch {
+		throw new e("exchange_failed", "epic: token verification request failed");
+	}
+	if (!r.ok) throw new e("exchange_failed", `epic: token verification refused (${r.status})`);
+	let i;
+	try {
+		i = await r.json();
+	} catch {
+		throw new e("malformed_token_response", "epic: token verification response is not JSON");
+	}
+	if (typeof i != "object" || !i || Array.isArray(i)) throw new e("malformed_token_response", "epic: malformed token verification response");
+	let a = i, o = (n.now ?? Date.now)(), s = typeof a.expires_at == "string" ? Date.parse(a.expires_at) : NaN;
+	if (a.active !== !0 || a.client_id !== n.clientId || typeof a.account_id != "string" || !/^[a-f0-9]{32}$/.test(a.account_id) || typeof a.token_type != "string" || a.token_type.toLowerCase() !== "bearer" || !Number.isFinite(o) || !Number.isFinite(s) || s <= o) throw new e("exchange_failed", "epic: inactive, expired or unbound account token");
+	return {
+		accountId: a.account_id,
+		login: a.account_id,
+		name: null,
+		avatarUrl: null,
+		email: null,
+		emailVerified: !1
+	};
+};
+//#endregion
+export { t as fetchEpicIdentity };

package/dist/errors.js

@@ -0,0 +1,34 @@
+//#region src/errors.ts
+var e = class extends Error {
+	status;
+	code;
+	constructor(e, t, n) {
+		super(n), this.status = e, this.code = t, this.name = "SocialAuthError";
+	}
+}, t = class extends e {
+	constructor(e) {
+		super(400, "state_mismatch", e), this.name = "SocialStateMismatchError";
+	}
+}, n = class extends e {
+	constructor(e, t, n = 502) {
+		super(n, e, t), this.name = "SocialExchangeError";
+	}
+}, r = class extends e {
+	constructor(e, t) {
+		super(401, e, t), this.name = "SocialIdTokenError";
+	}
+}, i = class extends e {
+	constructor(e) {
+		super(401, "ticket_rejected", e), this.name = "PlatformTicketError";
+	}
+}, a = class extends e {
+	constructor(e) {
+		super(500, "config", e), this.name = "SocialConfigError";
+	}
+}, o = class extends e {
+	constructor(e, t, n = 409) {
+		super(n, e, t), this.name = "SocialAccountLinkError";
+	}
+};
+//#endregion
+export { i as PlatformTicketError, o as SocialAccountLinkError, e as SocialAuthError, a as SocialConfigError, n as SocialExchangeError, r as SocialIdTokenError, t as SocialStateMismatchError };

package/dist/github.js

@@ -0,0 +1,37 @@
+import { SocialExchangeError as e } from "./errors.js";
+//#region src/github.ts
+var t = (e) => ({
+	authorization: `Bearer ${e}`,
+	accept: "application/vnd.github+json",
+	"x-github-api-version": "2022-11-28",
+	"user-agent": "voltro-plugin-auth-social"
+}), n = async (n, r) => {
+	let i = r.fetchImpl ?? fetch, a = await i(`${r.apiBase}/user`, {
+		headers: t(n),
+		redirect: "error"
+	});
+	if (!a.ok) throw new e("exchange_failed", `github: GET /user failed (${a.status})`);
+	let o = await a.json();
+	if (o.id === void 0 || o.id === null || !o.login) throw new e("malformed_token_response", "github: GET /user response is missing id/login");
+	let s = null, c = !1, l = await i(`${r.apiBase}/user/emails`, {
+		headers: t(n),
+		redirect: "error"
+	});
+	if (l.ok) {
+		let e = await l.json();
+		if (Array.isArray(e)) {
+			let t = e.find((e) => e.primary === !0 && typeof e.email == "string");
+			t?.email && (s = t.email, c = t.verified === !0);
+		}
+	}
+	return {
+		accountId: String(o.id),
+		login: o.login,
+		name: typeof o.name == "string" && o.name.length > 0 ? o.name : null,
+		avatarUrl: typeof o.avatar_url == "string" && o.avatar_url.length > 0 ? o.avatar_url : null,
+		email: s,
+		emailVerified: c
+	};
+};
+//#endregion
+export { n as fetchGithubIdentity };

package/dist/guestHandoff.js

@@ -0,0 +1,61 @@
+import { SocialConfigError as e } from "./errors.js";
+import { isSocialProviderId as t } from "./providers.js";
+import { signAuthClaims as n, verifyAuthClaims as r } from "@voltro/plugin-auth";
+//#region src/guestHandoff.ts
+var i = (t, r) => {
+	let i = t.profile, a = n({
+		exp: t.exp,
+		audience: t.audience,
+		guest: t.guest,
+		profile: {
+			provider: i.provider,
+			providerAccountId: i.providerAccountId,
+			email: i.email,
+			emailVerified: i.emailVerified,
+			emailIsPrivateRelay: i.emailIsPrivateRelay,
+			firstName: i.firstName,
+			lastName: i.lastName,
+			nameIsFirstAuthorizationOnly: i.nameIsFirstAuthorizationOnly
+		}
+	}, r.current.secret, "social-upgrade");
+	if (a.length > 3400) throw new e("Guest upgrade handoff exceeds its cookie budget");
+	return a;
+}, a = (e) => typeof e == "object" && e && !Array.isArray(e) ? e : null, o = (e) => {
+	let t = a(e), n = a(t?.metadata);
+	return t?.type !== "user" || t.kind !== "guest" || typeof t.id != "string" || !/^guest_[A-Za-z0-9_-]+$/.test(t.id) || typeof t.tenantId != "string" || !t.tenantId.trim() || typeof n?.sessionId != "string" || !n.sessionId || typeof n.guestDeviceId != "string" || !/^gdev_[A-Za-z0-9_-]+$/.test(n.guestDeviceId) || typeof n.guestDeviceGeneration != "number" || !Number.isSafeInteger(n.guestDeviceGeneration) || n.guestDeviceGeneration < 0 ? null : {
+		type: "user",
+		kind: "guest",
+		id: t.id,
+		tenantId: t.tenantId,
+		metadata: {
+			sessionId: n.sessionId,
+			guestDeviceId: n.guestDeviceId,
+			guestDeviceGeneration: n.guestDeviceGeneration
+		}
+	};
+}, s = (e, n, i) => {
+	if (!e || e.length > 3400) return null;
+	let s = [n.current, n.previous].filter((e) => e !== void 0).map((t) => r(e, t.secret, "social-upgrade")).find((e) => e !== null);
+	if (!s || s.audience !== i || typeof s.exp != "number") return null;
+	let c = o(s.guest), l = a(s.profile), u = (e) => e === null || typeof e == "string";
+	return !c || !l || typeof l.provider != "string" || !t(l.provider) || typeof l.providerAccountId != "string" || !l.providerAccountId || !u(l.email) || !u(l.firstName) || !u(l.lastName) || typeof l.emailVerified != "boolean" || typeof l.emailIsPrivateRelay != "boolean" || typeof l.nameIsFirstAuthorizationOnly != "boolean" ? null : {
+		guest: c,
+		exp: s.exp,
+		audience: i,
+		profile: {
+			provider: l.provider,
+			providerAccountId: l.providerAccountId,
+			email: l.email,
+			emailVerified: l.emailVerified,
+			emailIsPrivateRelay: l.emailIsPrivateRelay,
+			firstName: l.firstName,
+			lastName: l.lastName,
+			nameIsFirstAuthorizationOnly: l.nameIsFirstAuthorizationOnly,
+			name: null,
+			avatarUrl: null,
+			raw: {}
+		}
+	};
+};
+//#endregion
+export { s as decodeGuestUpgradeHandoff, i as encodeGuestUpgradeHandoff, o as guestIdentityOf };

package/dist/guestUpgrade.js

@@ -0,0 +1,97 @@
+import { SOCIAL_IDENTITY_TABLE as e, dataStoreSocialIdentityStore as t } from "./identityStore.js";
+import { Effect as n } from "effect";
+import { and as r, eq as i } from "@voltro/database";
+import { GuestAuthError as a, dataStoreGuestAuth as o, dataStoreSessionRegistry as s, issueUserSession as c, runSubjectGuards as l } from "@voltro/plugin-auth";
+//#region src/guestUpgrade.ts
+var u = (e, t, n) => ({
+	table: e,
+	predicate: i(t, n),
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), d = (d) => {
+	if (d.config.defaultTenantId !== d.guest.tenantId || d.config.ensureActor !== void 0 && d.configForTransaction === void 0) return n.succeed({
+		kind: "refused",
+		status: 500,
+		code: "config",
+		message: "Guest upgrade requires a matching tenant and transaction-bound actor hooks."
+	});
+	let f = d.profile, p = f.email === null || f.email.length === 0 ? null : f.email;
+	return (d.service ?? o(d.store, d.guest)).upgrade(d.credential, async (o) => {
+		let m = o.store, h = t(m);
+		if (await n.runPromise(h.findByProviderAccount(f.provider, f.providerAccountId)) !== null || p !== null && (await m.query(u("users", "email", p))).length !== 0) throw new a({ code: "upgrade_conflict" });
+		let g = {
+			id: o.subjectId,
+			tenantId: o.tenantId,
+			email: p,
+			passwordHash: null,
+			createdAt: o.createdAt,
+			mfaSecret: null,
+			mfaEnrolledAt: null,
+			emailVerifiedAt: p !== null && f.emailVerified ? /* @__PURE__ */ new Date() : null
+		}, _ = d.configForTransaction?.(m) ?? d.config;
+		if (_.defaultTenantId !== o.tenantId || !(await n.runPromise(l(_.subjectGuards ?? [], g))).ok) throw new a({ code: "credential_rejected" });
+		if (await m.insert("users", {
+			...g,
+			updatedAt: /* @__PURE__ */ new Date()
+		}), !await n.runPromise(h.insert({
+			userId: g.id,
+			provider: f.provider,
+			providerAccountId: f.providerAccountId,
+			email: p,
+			emailVerified: p !== null && f.emailVerified
+		}).pipe(n.as(!0), n.catchTag("SocialIdentityConflict", () => n.succeed(!1))))) throw new a({ code: "upgrade_conflict" });
+		let v = {
+			...d.users,
+			...s(m),
+			listMemberships: (e) => n.promise(async () => (await m.query({
+				...u("memberships", "userId", e),
+				predicate: r(i("userId", e), i("tenantId", o.tenantId))
+			})).map((t) => {
+				if (t.userId !== e || t.tenantId !== o.tenantId || typeof t.role != "string") throw new a({ code: "store_unavailable" });
+				let n = t.joinedAt instanceof Date ? t.joinedAt : new Date(String(t.joinedAt));
+				if (!Number.isFinite(n.getTime())) throw new a({ code: "store_unavailable" });
+				return {
+					userId: e,
+					tenantId: o.tenantId,
+					role: t.role,
+					joinedAt: n
+				};
+			}))
+		}, y = await n.runPromise(c(g, v, _, {
+			clearLoginFailures: !1,
+			ipAddress: d.ipAddress ?? null,
+			userAgent: d.userAgent ?? null
+		})), b = y.subject.type === "user" ? y.subject.metadata?.sessionId : null;
+		if (typeof b != "string" || (await m.query(u("sessions", "id", b))).length !== 1) throw new a({ code: "store_unavailable" });
+		let x = (await m.query({
+			...u(e, "provider", f.provider),
+			predicate: r(i("provider", f.provider), i("providerAccountId", f.providerAccountId))
+		}))[0];
+		if (!x || x.provider !== f.provider || x.providerAccountId !== f.providerAccountId || x.userId !== g.id) throw new a({ code: "upgrade_conflict" });
+		return {
+			kind: "ok",
+			userId: g.id,
+			subject: y.subject,
+			setCookie: y.setCookie,
+			session: {
+				value: y.value,
+				expiresAt: y.expiresAt
+			},
+			created: !0,
+			linked: !0,
+			oneTimeName: f.nameIsFirstAuthorizationOnly ? {
+				firstName: f.firstName,
+				lastName: f.lastName
+			} : null
+		};
+	}).pipe(n.catch((e) => n.succeed({
+		kind: "refused",
+		status: e.code === "upgrade_conflict" ? 409 : e.code === "credential_rejected" ? 403 : 503,
+		code: e.code === "upgrade_conflict" ? "account_merge_required" : e.code,
+		message: e.code === "upgrade_conflict" ? "The provider or email belongs to an existing account. Confirm both accounts before merging." : e.code === "credential_rejected" ? "Guest upgrade was refused." : "Guest upgrade storage is unavailable."
+	})));
+};
+//#endregion
+export { d as completeGuestSocialUpgrade };

package/dist/identityStore.js

@@ -0,0 +1,124 @@
+import { Data as e, Effect as t } from "effect";
+import { and as n, boolean as r, classifyConstraintViolation as i, eq as a, extractDbCause as o, generateId as s, id as c, table as l, text as u, timestamp as d } from "@voltro/database";
+//#region src/identityStore.ts
+var f = "_voltro_oauth_identities", p = l(f, {
+	id: c({ prefix: "oauthid" }),
+	userId: u(),
+	provider: u(),
+	providerAccountId: u(),
+	email: u().nullable(),
+	emailVerified: r().default(!1),
+	createdAt: d().default("now"),
+	lastLoginAt: d().nullable()
+}).unique("byOauthProviderAccount", ["provider", "providerAccountId"]).index(["userId"]), m = [p], h = class extends e.TaggedError("SocialIdentityConflict") {}, g = (e) => typeof e == "object" && !!e && e._tag === "ConstraintViolation" && e.kind === "unique" || i(o(e), "insert")?.kind === "unique", _ = () => s({
+	kind: "typeid",
+	prefix: "oauthid"
+}, "oauthid"), v = (e = []) => {
+	let n = [...e];
+	return {
+		findByProviderAccount: (e, r) => t.sync(() => n.find((t) => t.provider === e && t.providerAccountId === r) ?? null),
+		listForUser: (e) => t.sync(() => n.filter((t) => t.userId === e)),
+		insert: (e) => n.some((t) => t.provider === e.provider && t.providerAccountId === e.providerAccountId) ? t.fail(new h({ provider: e.provider })) : t.sync(() => {
+			let t = {
+				...e,
+				id: _(),
+				createdAt: /* @__PURE__ */ new Date(),
+				lastLoginAt: null
+			};
+			return n.push(t), t;
+		}),
+		touch: (e, r) => t.sync(() => {
+			let t = n.findIndex((t) => t.id === e);
+			t >= 0 && (n[t] = {
+				...n[t],
+				lastLoginAt: r
+			});
+		}),
+		remove: (e, r) => t.sync(() => {
+			let t = n.findIndex((t) => t.userId === e && t.provider === r);
+			return t < 0 ? !1 : (n.splice(t, 1), !0);
+		})
+	};
+}, y = (e) => {
+	if (e instanceof Date) return e;
+	if (typeof e == "string" || typeof e == "number") {
+		let t = new Date(e);
+		return Number.isNaN(t.getTime()) ? null : t;
+	}
+	return null;
+}, b = (e) => ({
+	id: String(e.id ?? ""),
+	userId: String(e.userId ?? ""),
+	provider: String(e.provider ?? ""),
+	providerAccountId: String(e.providerAccountId ?? ""),
+	email: typeof e.email == "string" && e.email.length > 0 ? e.email : null,
+	emailVerified: e.emailVerified === !0 || e.emailVerified === 1,
+	createdAt: y(e.createdAt) ?? /* @__PURE__ */ new Date(0),
+	lastLoginAt: y(e.lastLoginAt)
+}), x = (e) => ({
+	findByProviderAccount: (r, i) => t.promise(async () => {
+		let t = (await e.query({
+			table: f,
+			predicate: n(a("provider", r), a("providerAccountId", i)),
+			limit: 1,
+			take: 1,
+			skip: void 0,
+			projection: void 0,
+			order: []
+		}))[0];
+		return t ? b(t) : null;
+	}),
+	listForUser: (n) => t.promise(async () => (await e.query({
+		table: f,
+		predicate: a("userId", n),
+		order: [{
+			column: "createdAt",
+			direction: "asc"
+		}],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	})).map(b)),
+	insert: (n) => t.tryPromise({
+		try: async () => {
+			let t = {
+				id: _(),
+				userId: n.userId,
+				provider: n.provider,
+				providerAccountId: n.providerAccountId,
+				email: n.email,
+				emailVerified: n.emailVerified,
+				createdAt: /* @__PURE__ */ new Date(),
+				lastLoginAt: null
+			};
+			if (!("insertIgnoreWithOutcome" in e) || e.insertIgnoreWithOutcome === void 0) return b(await e.insert(f, t));
+			let r = await e.insertIgnoreWithOutcome(f, t, { conflictColumns: ["provider", "providerAccountId"] });
+			if (r.outcome === "ignored") throw new h({ provider: n.provider });
+			return b(r.row);
+		},
+		catch: (e) => e
+	}).pipe(t.catch((e) => e instanceof h || g(e) ? t.fail(new h({ provider: n.provider })) : t.die(e))),
+	touch: (n, r) => t.promise(async () => {
+		await e.update(f, n, { lastLoginAt: r });
+	}),
+	remove: (r, i) => t.promise(async () => {
+		let t = (await e.query({
+			table: f,
+			predicate: n(a("userId", r), a("provider", i)),
+			limit: 1,
+			take: 1,
+			skip: void 0,
+			projection: void 0,
+			order: []
+		}))[0];
+		return t ? e.delete(f, String(t.id ?? "")) : !1;
+	})
+}), S = (e, n, r) => t.gen(function* () {
+	let i = yield* e.findByProviderAccount(r.provider, r.providerAccountId);
+	return i ? i.userId === n ? i : yield* t.fail(/* @__PURE__ */ Error(`linkSocialIdentity: this ${r.provider} account is already linked to another user`)) : yield* e.insert({
+		...r,
+		userId: n
+	});
+});
+//#endregion
+export { f as SOCIAL_IDENTITY_TABLE, h as SocialIdentityConflict, x as dataStoreSocialIdentityStore, S as linkSocialIdentity, v as memorySocialIdentityStore, m as socialAuthTables, p as socialIdentitiesTable };