@voltro/plugin-auth-social 0.85.0 → 0.87.0

package/dist/providers.js

@@ -0,0 +1,130 @@
+import { SocialConfigError as e } from "./errors.js";
+//#region src/providers.ts
+var t = {
+	id: "google",
+	label: "Google",
+	authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+	tokenUrl: "https://oauth2.googleapis.com/token",
+	jwksUrl: "https://www.googleapis.com/oauth2/v3/certs",
+	issuer: "https://accounts.google.com",
+	apiBase: null,
+	defaultScopes: [
+		"openid",
+		"email",
+		"profile"
+	],
+	kind: "oidc",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !0
+}, n = {
+	id: "github",
+	label: "GitHub",
+	authorizeUrl: "https://github.com/login/oauth/authorize",
+	tokenUrl: "https://github.com/login/oauth/access_token",
+	jwksUrl: null,
+	issuer: null,
+	apiBase: "https://api.github.com",
+	defaultScopes: ["read:user", "user:email"],
+	kind: "oauth2",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !1
+}, r = {
+	id: "apple",
+	label: "Apple",
+	authorizeUrl: "https://appleid.apple.com/auth/authorize",
+	tokenUrl: "https://appleid.apple.com/auth/token",
+	jwksUrl: "https://appleid.apple.com/auth/keys",
+	issuer: "https://appleid.apple.com",
+	apiBase: null,
+	defaultScopes: ["name", "email"],
+	kind: "oidc",
+	responseMode: "form_post",
+	assertsEmailVerification: !0,
+	pkceEnforced: !0
+}, i = {
+	id: "discord",
+	label: "Discord",
+	authorizeUrl: "https://discord.com/oauth2/authorize",
+	tokenUrl: "https://discord.com/api/oauth2/token",
+	jwksUrl: null,
+	issuer: null,
+	apiBase: "https://discord.com/api/v10",
+	defaultScopes: ["identify", "email"],
+	kind: "oauth2",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !1
+}, a = {
+	id: "twitch",
+	label: "Twitch",
+	authorizeUrl: "https://id.twitch.tv/oauth2/authorize",
+	tokenUrl: "https://id.twitch.tv/oauth2/token",
+	jwksUrl: "https://id.twitch.tv/oauth2/keys",
+	issuer: "https://id.twitch.tv/oauth2",
+	apiBase: null,
+	defaultScopes: ["openid", "user:read:email"],
+	kind: "oidc",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !1
+}, o = {
+	id: "microsoft",
+	label: "Microsoft",
+	authorizeUrl: "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize",
+	tokenUrl: "https://login.microsoftonline.com/consumers/oauth2/v2.0/token",
+	jwksUrl: "https://login.microsoftonline.com/consumers/discovery/v2.0/keys",
+	issuer: "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0",
+	apiBase: null,
+	defaultScopes: [
+		"openid",
+		"email",
+		"profile"
+	],
+	kind: "oidc",
+	responseMode: "query",
+	assertsEmailVerification: !1,
+	pkceEnforced: !0
+}, s = {
+	id: "epic",
+	label: "Epic Games",
+	authorizeUrl: "https://www.epicgames.com/id/authorize",
+	tokenUrl: "https://api.epicgames.dev/epic/oauth/v2/token",
+	jwksUrl: null,
+	issuer: null,
+	apiBase: "https://api.epicgames.dev/epic/oauth/v2",
+	defaultScopes: ["basic_profile"],
+	kind: "oauth2",
+	responseMode: "query",
+	assertsEmailVerification: !1,
+	pkceEnforced: !1
+}, c = {
+	google: t,
+	github: n,
+	apple: r,
+	discord: i,
+	twitch: a,
+	microsoft: o,
+	epic: s
+}, l = [
+	t,
+	n,
+	r,
+	i,
+	a,
+	o,
+	s
+], u = l.map((e) => e.id), d = (e) => Object.hasOwn(c, e), f = (t, n = {}) => {
+	if (!d(t)) throw new e(`unknown social provider '${t}' — expected one of ${u.join(", ")}`);
+	return {
+		...c[t],
+		...n.authorizeUrl === void 0 ? {} : { authorizeUrl: n.authorizeUrl },
+		...n.tokenUrl === void 0 ? {} : { tokenUrl: n.tokenUrl },
+		...n.jwksUrl === void 0 ? {} : { jwksUrl: n.jwksUrl },
+		...n.issuer === void 0 ? {} : { issuer: n.issuer },
+		...n.apiBase === void 0 ? {} : { apiBase: n.apiBase }
+	};
+};
+//#endregion
+export { l as SOCIAL_PROVIDERS, u as SOCIAL_PROVIDER_IDS, d as isSocialProviderId, f as socialProvider };

package/dist/signIn.js

@@ -0,0 +1,84 @@
+import { SocialAccountLinkError as e } from "./errors.js";
+import { decideSocialLink as t } from "./linking.js";
+import { Effect as n } from "effect";
+import { issueUserSession as r, newAuthId as i, runSubjectGuards as a } from "@voltro/plugin-auth";
+//#region src/signIn.ts
+var o = (e) => ({
+	kind: "refused",
+	status: e.status,
+	code: e.code,
+	message: e.message
+}), s = (s) => n.gen(function* () {
+	let { profile: c, identities: l, users: u, config: d } = s, f = s.policy ?? "never", p = yield* l.findByProviderAccount(c.provider, c.providerAccountId), m = c.email === null ? null : yield* u.findByEmail(c.email), h = t({
+		profile: c,
+		linkedUserId: p?.userId ?? null,
+		existingUserIdByEmail: m?.id ?? null,
+		policy: f
+	});
+	if (h.kind === "refuse") return o(h.error);
+	let g = null, _ = !1, v = !1;
+	if (h.kind === "create-user") {
+		let t = c.email, r = yield* u.insert({
+			id: i("user"),
+			email: t,
+			passwordHash: null,
+			tenantId: d.defaultTenantId
+		}).pipe(n.catchTag("UserAlreadyExistsError", (t) => n.succeed(new e("account_exists_unlinked", `An account already exists for ${t.email}. Sign in with your existing method, then connect ${c.provider} from your account settings.`))));
+		if (r instanceof e) return o(r);
+		g = r, _ = !0;
+	} else {
+		if (v = h.kind === "link", g = yield* u.findById(h.userId), !g) return o(new e("account_exists_unlinked", "The account this login is linked to no longer exists.", 409));
+		let t = d.subjectGuards ?? [];
+		if (t.length > 0) {
+			let e = yield* a(t, g);
+			if (!e.ok) return {
+				kind: "refused",
+				status: 403,
+				code: e.code,
+				message: e.message
+			};
+		}
+	}
+	if (p === null) {
+		if (!(yield* l.insert({
+			userId: g.id,
+			provider: c.provider,
+			providerAccountId: c.providerAccountId,
+			email: c.email,
+			emailVerified: c.emailVerified
+		}).pipe(n.as(!0), n.catchTag("SocialIdentityConflict", () => n.succeed(!1))))) {
+			let t = yield* l.findByProviderAccount(c.provider, c.providerAccountId), n = t === null ? null : yield* u.findById(t.userId);
+			if (n === null) return o(new e("account_exists_unlinked", "The account this login is linked to no longer exists.", 409));
+			let r = yield* a(d.subjectGuards ?? [], n);
+			if (!r.ok) return {
+				kind: "refused",
+				status: 403,
+				code: r.code,
+				message: r.message
+			};
+			g = n, _ = !1, v = !1;
+		}
+	} else yield* l.touch(p.id, /* @__PURE__ */ new Date());
+	let y = yield* r(g, u, d, {
+		ipAddress: s.ipAddress ?? null,
+		userAgent: s.userAgent ?? null
+	});
+	return {
+		kind: "ok",
+		userId: g.id,
+		subject: y.subject,
+		setCookie: y.setCookie,
+		session: {
+			value: y.value,
+			expiresAt: y.expiresAt
+		},
+		created: _,
+		linked: v,
+		oneTimeName: c.nameIsFirstAuthorizationOnly ? {
+			firstName: c.firstName,
+			lastName: c.lastName
+		} : null
+	};
+});
+//#endregion
+export { s as completeSocialSignIn };

package/dist/steam.js

@@ -0,0 +1,152 @@
+import { randomToken as e } from "./pkce.js";
+import { PlatformTicketError as t, SocialAuthError as n, SocialConfigError as r, SocialExchangeError as i, SocialStateMismatchError as a } from "./errors.js";
+import { Effect as o } from "effect";
+import { timingSafeStringEqual as s } from "@voltro/protocol/session";
+import { createHash as c } from "node:crypto";
+//#region src/steam.ts
+var l = "http://specs.openid.net/auth/2.0", u = "https://steamcommunity.com/openid/", d = `${l}/identifier_select`, f = (e) => typeof e == "string" && /^[0-9]{17,20}$/.test(e) && BigInt(e) > 0n && BigInt(e) <= 18446744073709551615n, p = 65536, m = 5e3, h = async (e) => {
+	let t = e.body?.getReader();
+	if (!t) return "";
+	let n = [], r = 0;
+	for (;;) {
+		let { done: e, value: i } = await t.read();
+		if (e) break;
+		if (r += i.byteLength, r > p) return await t.cancel().catch(() => void 0), null;
+		n.push(i);
+	}
+	return new TextDecoder().decode(Buffer.concat(n));
+}, g = (e) => ({
+	provider: "steam",
+	providerAccountId: e,
+	email: null,
+	emailVerified: !1,
+	emailIsPrivateRelay: !1,
+	name: null,
+	firstName: null,
+	lastName: null,
+	avatarUrl: null,
+	nameIsFirstAuthorizationOnly: !1,
+	raw: { steamId: e }
+}), _ = (e) => {
+	let t;
+	try {
+		t = new URL(e);
+	} catch {
+		throw new r("steam: invalid absolute callback URL");
+	}
+	if (!["https:", "http:"].includes(t.protocol) || t.username || t.password || t.hash) throw new r("steam: callback URL requires HTTP(S), without credentials or fragments");
+	return t;
+}, v = (t) => {
+	let n = _(t.returnTo);
+	if (n.searchParams.has("state")) throw new r("steam: state must be server minted");
+	let i = _(t.realm ?? `${n.origin}/`);
+	if (i.search || i.origin !== n.origin || !(n.pathname === i.pathname || n.pathname.startsWith(i.pathname.endsWith("/") ? i.pathname : `${i.pathname}/`))) throw new r("steam: callback is outside the configured realm");
+	let a = e();
+	return n.searchParams.set("state", a), {
+		url: `${u}?${new URLSearchParams({
+			"openid.ns": l,
+			"openid.mode": "checkid_setup",
+			"openid.return_to": n.href,
+			"openid.realm": i.href,
+			"openid.identity": d,
+			"openid.claimed_id": d
+		})}`,
+		state: a,
+		returnTo: n.href,
+		realm: i.href
+	};
+}, y = (e) => o.gen(function* () {
+	let t = yield* o.tryPromise({
+		try: async () => {
+			let t = e.maxNonceAgeMs ?? 3e5, n = e.clockSkewMs ?? 3e4;
+			if (!e.namespace || !Number.isSafeInteger(t) || t < 1 || t > 36e5 || !Number.isSafeInteger(n) || n < 0 || n > 3e5 || e.multiNode === !0 && !e.hotStore.capabilities.crossNode) throw new r("steam: invalid replay owner, lifetime or multi-node hot store");
+			if (e.callbackUrl.length > 16384) throw new a("steam: callback exceeds the admission budget");
+			let o = _(e.callbackUrl), c = _(e.expectedReturnTo), d = o.searchParams, p = /* @__PURE__ */ new Set();
+			for (let e of d.keys()) {
+				if (p.has(e)) throw new a("steam: duplicate callback parameter");
+				p.add(e);
+			}
+			if (!e.expectedState || d.get("state") === null || !s(d.get("state"), e.expectedState) || c.searchParams.get("state") !== e.expectedState || o.origin !== c.origin || o.pathname !== c.pathname) throw new a("steam: state or callback location mismatch");
+			for (let [e, t] of c.searchParams) if (d.get(e) !== t) throw new a("steam: callback query binding mismatch");
+			if (d.get("openid.ns") !== l || d.get("openid.mode") !== "id_res" || d.get("openid.op_endpoint") !== u || d.get("openid.return_to") !== e.expectedReturnTo) throw new a("steam: invalid OpenID provider or return binding");
+			let g = d.get("openid.claimed_id") ?? "", v = /^https?:\/\/steamcommunity\.com\/openid\/id\/([0-9]{17,20})$/.exec(g);
+			if (!v || !f(v[1]) || d.get("openid.identity") !== g) throw new a("steam: invalid Steam claimed identity");
+			let y = new Set((d.get("openid.signed") ?? "").split(","));
+			if ([
+				"op_endpoint",
+				"return_to",
+				"response_nonce",
+				"assoc_handle",
+				"claimed_id",
+				"identity"
+			].some((e) => !y.has(e)) || !d.get("openid.assoc_handle") || !d.get("openid.sig")) throw new a("steam: assertion is missing required signed fields");
+			let b = d.get("openid.response_nonce") ?? "";
+			if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z.+$/.test(b) || b.length > 255) throw new a("steam: malformed response nonce");
+			let x = Date.parse(b.slice(0, 20)), S = (e.now ?? Date.now)();
+			if (!Number.isFinite(S) || !Number.isFinite(x) || new Date(x).toISOString().replace(".000Z", "Z") !== b.slice(0, 20) || x > S + n || x < S - t) throw new a("steam: response nonce outside the admission lifetime");
+			let C = new URLSearchParams();
+			for (let [e, t] of d) e.startsWith("openid.") && C.set(e, t);
+			C.set("openid.mode", "check_authentication");
+			let w;
+			try {
+				w = await (e.fetchImpl ?? fetch)(e.verificationUrl ?? u, {
+					method: "POST",
+					headers: { "content-type": "application/x-www-form-urlencoded" },
+					body: C.toString(),
+					redirect: "error",
+					signal: AbortSignal.timeout(e.timeoutMs ?? m)
+				});
+			} catch {
+				throw new i("exchange_failed", "steam: OpenID verification request failed");
+			}
+			if (!w.ok) throw new i("exchange_failed", "steam: OpenID verification refused");
+			let T = await h(w).catch(() => null);
+			if (T === null || T.length > 8192) throw new i("exchange_failed", "steam: malformed OpenID verification response");
+			let E = /* @__PURE__ */ new Map();
+			for (let e of T.split("\n")) {
+				if (!e) continue;
+				let t = e.indexOf(":"), n = e.slice(0, t);
+				if (t < 1 || E.has(n)) throw new i("exchange_failed", "steam: malformed OpenID verification response");
+				E.set(n, e.slice(t + 1).replace(/\r$/, ""));
+			}
+			if (E.get("ns") !== l || E.get("is_valid") !== "true") throw new i("exchange_failed", "steam: OpenID assertion was not verified");
+			return {
+				value: b,
+				accountId: v[1],
+				ttlMs: t + n
+			};
+		},
+		catch: (e) => e instanceof n ? e : new i("exchange_failed", "steam: OpenID verification failed")
+	}), d = `${e.namespace}:steam:nonce:${c("sha256").update(JSON.stringify([u, t.value])).digest("hex")}`;
+	return (yield* e.hotStore.setNx(d, "consumed", t.ttlMs).pipe(o.catch(() => o.fail(new i("exchange_failed", "steam: replay admission unavailable"))), o.catchDefect(() => o.fail(new i("exchange_failed", "steam: replay admission unavailable"))))) ? g(t.accountId) : yield* o.fail(new a("steam: assertion already consumed"));
+}), b = async (e) => {
+	if (!Number.isSafeInteger(e.appId) || e.appId < 1 || e.appId > 4294967295 || !e.identity || e.identity.length > 255 || !e.publisherKey) throw new r("steam: appId, ticket identity and publisher key are required");
+	if (!/^(?:[a-fA-F0-9]{2})+$/.test(e.ticket) || e.ticket.length > 16384) throw new t("steam: malformed Web API ticket");
+	let a = new URL(e.verificationUrl ?? "https://partner.steam-api.com/ISteamUserAuth/AuthenticateUserTicket/v1/");
+	a.searchParams.set("key", e.publisherKey), a.searchParams.set("appid", String(e.appId)), a.searchParams.set("ticket", e.ticket), a.searchParams.set("identity", e.identity);
+	let o;
+	try {
+		o = await (e.fetchImpl ?? fetch)(a.href, {
+			redirect: "error",
+			headers: { accept: "application/json" },
+			signal: AbortSignal.timeout(e.timeoutMs ?? m)
+		});
+	} catch {
+		throw new i("exchange_failed", "steam: ticket verification request failed");
+	}
+	if (!o.ok) throw new i("exchange_failed", "steam: ticket verification refused");
+	let s;
+	try {
+		let e = await h(o);
+		if (e === null) throw Error("oversized");
+		s = JSON.parse(e);
+	} catch {
+		throw new i("malformed_token_response", "steam: malformed ticket verification response");
+	}
+	let c = typeof s == "object" && s ? s : {}, l = typeof c.response == "object" && c.response !== null ? c.response : {}, u = typeof l.params == "object" && l.params !== null ? l.params : {};
+	if (u.result !== "OK" || !f(u.steamid)) throw new t("steam: invalid Web API ticket");
+	if (u.publisherbanned === !0 && e.allowPublisherBanned !== !0) throw new n(403, "guard_rejected", "steam: the publisher banned this account");
+	return g(u.steamid);
+};
+//#endregion
+export { v as steamBeginOpenId, y as steamCompleteOpenId, b as verifySteamWebApiTicket };

package/dist/web/guestUpgradeClient.js

@@ -0,0 +1,109 @@
+import { isSocialProviderId as e } from "../providers.js";
+import { parseGuestCredential as t } from "@voltro/plugin-auth/guest";
+//#region src/web/guestUpgradeClient.ts
+var n = class extends Error {
+	code;
+	status;
+	constructor(e, t) {
+		super("Guest upgrade: " + e), this.code = e, this.status = t, this.name = "GuestUpgradeClientError";
+	}
+}, r = (e) => typeof e == "object" && e && !Array.isArray(e) ? e : null, i = (i) => {
+	let a = new URL(i.apiBaseUrl), o = i.prefix ?? "/auth/social";
+	if (!/^https?:$/.test(a.protocol) || a.username || a.password || a.search || a.hash || !/^\/[A-Za-z0-9/_-]+$/.test(o) || o.endsWith("/")) throw new n("invalid_response");
+	let s = i.apiBaseUrl.replace(/\/+$/, "") + o + "/upgrade", c = i.fetch ?? globalThis.fetch, l = async (e, t) => {
+		try {
+			let i = {};
+			if (t !== void 0) {
+				let e = await c(s + "/csrf", {
+					credentials: "include",
+					cache: "no-store",
+					redirect: "error"
+				});
+				if (!e.ok) throw new n("transport_failed", e.status);
+				let t = r(await e.json());
+				if (typeof t?.token != "string" || !t.token) throw new n("invalid_response");
+				i["x-csrf-token"] = t.token, i["content-type"] = "application/json";
+			}
+			let a = await c(s + e, {
+				credentials: "include",
+				cache: "no-store",
+				redirect: "error",
+				...t === void 0 ? {} : {
+					method: "POST",
+					headers: i,
+					body: JSON.stringify(t)
+				}
+			}), o = r(await a.json());
+			if (!a.ok) {
+				let e = o?.error;
+				throw new n(e === "account_merge_required" || e === "credential_rejected" || e === "upgrade_handoff_rejected" ? e : "transport_failed", a.status);
+			}
+			if (!o) throw new n("invalid_response");
+			return o;
+		} catch (e) {
+			throw e instanceof n ? e : new n("transport_failed");
+		}
+	}, u = async (e) => {
+		try {
+			return await e();
+		} catch (e) {
+			throw e instanceof n ? e : new n("storage_unavailable");
+		}
+	}, d = async () => {
+		let e = await u(() => i.storage.read());
+		if (e === null || !t(e)) throw new n("credential_rejected");
+		return e;
+	}, f = (e, t) => {
+		let i = r(e.subject);
+		if (e.upgraded !== !0 || i?.type !== "user" || i.kind === "guest" || i.id !== t || typeof i.tenantId != "string" || !i.tenantId.trim()) throw new n("invalid_response");
+		return {
+			upgraded: !0,
+			subject: {
+				type: "user",
+				id: t,
+				tenantId: i.tenantId
+			}
+		};
+	};
+	return {
+		begin: (t) => u(() => i.storage.exclusive(async () => {
+			if (!e(t)) throw new n("invalid_response");
+			await d();
+			let r = await l("/" + t, {});
+			if (typeof r.authorizationUrl != "string") throw new n("invalid_response");
+			let i;
+			try {
+				i = new URL(r.authorizationUrl);
+			} catch {
+				throw new n("invalid_response");
+			}
+			if (!/^https?:$/.test(i.protocol) || i.username || i.password || i.hash) throw new n("invalid_response");
+			return i.toString();
+		})),
+		pending: async () => {
+			let t = await l("/pending");
+			if (typeof t.guestId != "string" || !/^guest_[A-Za-z0-9_-]+$/.test(t.guestId) || typeof t.provider != "string" || !e(t.provider) || t.email !== null && typeof t.email != "string" || typeof t.emailVerified != "boolean" || typeof t.expiresAt != "number" || !Number.isSafeInteger(t.expiresAt) || t.expiresAt <= Date.now()) throw new n("invalid_response");
+			return {
+				guestId: t.guestId,
+				provider: t.provider,
+				email: t.email,
+				emailVerified: t.emailVerified,
+				expiresAt: t.expiresAt
+			};
+		},
+		confirm: (e) => u(() => i.storage.exclusive(async () => {
+			if (e.confirmed !== !0) throw new n("credential_rejected");
+			let r = await d(), a = t(r), o = await l("/complete", {
+				credential: r,
+				confirmed: !0
+			}), s = f(o, a.guestId);
+			return await u(() => i.storage.remove()), s;
+		})),
+		recover: () => u(() => i.storage.exclusive(async () => {
+			let e = await d(), n = f(await l("/receipt"), t(e).guestId);
+			return await u(() => i.storage.remove()), n;
+		}))
+	};
+};
+//#endregion
+export { n as GuestUpgradeClientError, i as createGuestUpgradeClient };

package/dist/web.d.ts

@@ -0,0 +1,54 @@
+import { GuestCredentialStore } from '@voltro/plugin-auth/guest';
+
+/** Browser cookie presentation only. Device proofs stay in durable storage and
+ * in the confirmed JSON POST, never navigation URLs or login-state cookies. */
+export declare const createGuestUpgradeClient: (options: GuestUpgradeClientOptions) => {
+    /** Call after an authenticated guest session exists, then navigate to the
+     * returned authorization URL in this browser. Does not send device proof. */
+    begin: (provider: SocialProviderId) => Promise<string>;
+    pending: () => Promise<GuestUpgradePending>;
+    /** Call only after explicit confirmation. Storage remains untouched on an
+     * uncertain/refused response; no replacement guest identity is created. */
+    confirm: (confirmation: {
+        readonly confirmed: true;
+    }) => Promise<GuestUpgradeCompletion>;
+    /** After uncertain delivery, prove a live registered session for the exact
+     * stored guest ID. If its cookie was lost too, sign in with the linked
+     * provider first. Refusal never erases storage or creates another guest. */
+    recover: () => Promise<GuestUpgradeCompletion>;
+};
+
+export declare class GuestUpgradeClientError extends Error {
+    readonly code: 'storage_unavailable' | 'credential_rejected' | 'account_merge_required' | 'transport_failed' | 'invalid_response' | 'upgrade_handoff_rejected';
+    readonly status?: number | undefined;
+    constructor(code: 'storage_unavailable' | 'credential_rejected' | 'account_merge_required' | 'transport_failed' | 'invalid_response' | 'upgrade_handoff_rejected', status?: number | undefined);
+}
+
+export declare interface GuestUpgradeClientOptions {
+    readonly apiBaseUrl: string;
+    readonly storage: GuestCredentialStore;
+    readonly prefix?: string;
+    readonly fetch?: typeof globalThis.fetch;
+}
+
+export declare interface GuestUpgradeCompletion {
+    readonly upgraded: true;
+    readonly subject: {
+        readonly type: 'user';
+        readonly id: string;
+        readonly tenantId: string;
+    };
+}
+
+export declare interface GuestUpgradePending {
+    readonly guestId: string;
+    readonly provider: SocialProviderId;
+    readonly email: string | null;
+    readonly emailVerified: boolean;
+    readonly expiresAt: number;
+}
+
+/** The providers this package ships. */
+declare type SocialProviderId = 'google' | 'github' | 'apple' | 'discord' | 'twitch' | 'microsoft' | 'epic';
+
+export { }

package/dist/web.js

@@ -0,0 +1 @@
+export { GuestUpgradeClientError, createGuestUpgradeClient } from "./web/guestUpgradeClient.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@voltro/plugin-auth-social",
-  "version": "0.85.0",
-  "description": "First-party social login for the Voltro framework — Sign in with Google, GitHub and Apple. Mandatory PKCE (S256) + state, JWKS-verified ID tokens, a deliberate account-linking policy, and sessions issued through @voltro/plugin-auth. No identity vendor required.",
+  "version": "0.87.0",
+  "description": "First-party social login with state, S256, provider identity verification, explicit account linking and shared Auth sessions.",
   "keywords": [
     "voltro",
     "typescript",
@@ -23,6 +23,11 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./web": {
+      "types": "./dist/web.d.ts",
+      "import": "./dist/web.js",
+      "default": "./dist/web.js"
+    },
     "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
@@ -33,9 +38,10 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.85.0",
-    "@voltro/plugin-auth": "0.85.0",
-    "@voltro/protocol": "0.85.0"
+    "@voltro/database": "0.87.0",
+    "@voltro/plugin-auth": "0.87.0",
+    "@voltro/protocol": "0.87.0",
+    "@voltro/kv": "0.87.0"
   },
   "peerDependencies": {
     "effect": "4.0.1"