@voltro/plugin-auth-social 0.86.0 → 0.87.0

package/dist/plugin.js

@@ -4,11 +4,17 @@ import { socialBeginLogin as i } from "./login.js";
 import { socialCompleteLogin as a } from "./callback.js";
 import { completeSocialSignIn as o } from "./signIn.js";
 import { dataStoreSocialIdentityStore as s, socialAuthTables as c } from "./identityStore.js";
-import { Effect as l } from "effect";
-import { definePlugin as u } from "@voltro/protocol";
-import { buildSetCookie as d, readCookie as f } from "@voltro/protocol/session";
+import { completeGuestSocialUpgrade as l } from "./guestUpgrade.js";
+import { decodeGuestUpgradeHandoff as u, encodeGuestUpgradeHandoff as d, guestIdentityOf as f } from "./guestHandoff.js";
+import { isNativeVerifier as p, nativeUpgradeRequestOf as m, openNativeUpgradeCode as h, sealNativeUpgradeCode as g, signNativeUpgradeTicket as ee, verifierMatches as te, verifyNativeUpgradeTicket as ne } from "./nativeGuestUpgrade.js";
+import { verifyPlatformTicket as _ } from "./platform.js";
+import { Effect as v, Result as y } from "effect";
+import { and as b, eq as x } from "@voltro/database";
+import { definePlugin as re } from "@voltro/protocol";
+import { SESSION_HEADER_NAME as S, buildSetCookie as C, readCookie as w } from "@voltro/protocol/session";
+import { CSRF_COOKIE_NAME as T, CSRF_HEADER_NAME as ie, configSessionSecrets as E, dataStoreGuestAuth as ae, dataStoreSessionRegistry as oe, issueCsrfToken as se, parseGuestCredential as D, readSessionFromHeaders as O, signAuthClaims as ce, verifyAuthClaims as k, verifyCsrf as le } from "@voltro/plugin-auth";
 //#region src/plugin.ts
-var p = "/auth/social", m = 600, h = "voltro:oauth", g = {
+var ue = "/auth/social", de = 600, fe = "voltro:oauth", A = {
 	google: [{
 		name: "VOLTRO_GOOGLE_CLIENT_ID",
 		secret: !1,
@@ -48,41 +54,140 @@ var p = "/auth/social", m = 600, h = "voltro:oauth", g = {
 			secret: !0,
 			description: "Contents of the .p8 file (PKCS#8 PEM). Apple signs no static secret — this key mints one per exchange."
 		}
-	]
-}, _ = (e, t) => ({
+	],
+	discord: [{
+		name: "VOLTRO_DISCORD_CLIENT_ID",
+		secret: !1,
+		description: "Discord OAuth application client id."
+	}, {
+		name: "VOLTRO_DISCORD_CLIENT_SECRET",
+		secret: !0,
+		description: "Discord OAuth application client secret."
+	}],
+	twitch: [{
+		name: "VOLTRO_TWITCH_CLIENT_ID",
+		secret: !1,
+		description: "Twitch confidential application client id."
+	}, {
+		name: "VOLTRO_TWITCH_CLIENT_SECRET",
+		secret: !0,
+		description: "Twitch confidential application client secret."
+	}],
+	microsoft: [{
+		name: "VOLTRO_MICROSOFT_CLIENT_ID",
+		secret: !1,
+		description: "Microsoft application client id for personal accounts."
+	}, {
+		name: "VOLTRO_MICROSOFT_CLIENT_SECRET",
+		secret: !0,
+		description: "Microsoft application client secret."
+	}],
+	epic: [{
+		name: "VOLTRO_EPIC_CLIENT_ID",
+		secret: !1,
+		description: "Epic Account Services OAuth client id."
+	}, {
+		name: "VOLTRO_EPIC_CLIENT_SECRET",
+		secret: !0,
+		description: "Epic Account Services OAuth client secret."
+	}]
+}, j = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8"
-}), v = (e, t) => ({
+	contentType: "application/json; charset=utf-8",
+	headers: { "cache-control": "no-store" }
+}), M = (e, t) => e + (e.includes("?") ? "&" : "?") + new URLSearchParams(t).toString(), N = (e, t) => ({
 	status: 302,
 	body: "",
 	contentType: "text/plain; charset=utf-8",
 	headers: {
+		"cache-control": "no-store",
+		"referrer-policy": "no-referrer",
 		location: e,
 		...t === void 0 ? {} : { "set-cookie": t }
 	}
-}), y = (e) => Buffer.from(JSON.stringify(e), "utf8").toString("base64url"), b = (e) => {
+}), pe = (e, t) => ce({ ...e }, t.current.secret, "social-login"), me = (e, t) => {
 	if (!e) return null;
 	try {
-		let t = JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
-		return typeof t.p != "string" || typeof t.s != "string" || typeof t.v != "string" || typeof t.n != "string" ? null : {
-			p: t.p,
-			s: t.s,
-			v: t.v,
-			n: t.n
+		let n = [t.current, t.previous].filter((e) => e !== void 0).map((t) => k(e, t.secret, "social-login")).find((e) => e !== null);
+		if (!n) return null;
+		let r = n;
+		if (typeof r.p != "string" || typeof r.s != "string" || typeof r.v != "string" || typeof r.n != "string" || typeof r.exp != "number" || typeof r.audience != "string" || typeof r.redirectUri != "string") return null;
+		let i = r.guest === void 0 ? void 0 : f(r.guest);
+		if (i === null) return null;
+		let a = r.native, o = a === void 0 ? void 0 : m(a, typeof a?.r == "string" ? [a.r] : []);
+		return o === null || o !== void 0 && i === void 0 ? null : {
+			p: r.p,
+			s: r.s,
+			v: r.v,
+			n: r.n,
+			exp: r.exp,
+			audience: r.audience,
+			redirectUri: r.redirectUri,
+			...i === void 0 ? {} : { guest: i },
+			...o === void 0 ? {} : { native: o }
 		};
 	} catch {
 		return null;
 	}
-}, x = (e) => e.method === "POST" && (e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded") ? new URLSearchParams(Buffer.from(e.rawBody).toString("utf8")) : new URLSearchParams(e.query), S = (S) => {
-	let C = S.prefix ?? p, w = S.stateTtlSeconds ?? m, T = S.stateCookieName ?? h, E = S.linkPolicy ?? "never", D = S.auth.cookieSecure ?? !0, O = Object.keys(S.providers).filter(n);
-	if (O.length === 0) throw new t("socialAuthPlugin: `providers` is empty — enable at least one of google / github / apple");
-	let k = (S.appBaseUrl ?? S.auth.appBaseUrl ?? "").replace(/\/+$/, ""), A = (e) => {
-		let n = S.providers[e] ?? {}, r = process.env, i = n.clientId ?? r[g[e][0].name] ?? "";
-		if (!i) throw new t(`socialAuthPlugin: ${e} has no client id — pass \`providers.${e}.clientId\` or set ${g[e][0].name}`);
-		let a = n.redirectUri ?? `${k}${C}/${e}/callback`;
-		if (!a.startsWith("http")) throw new t(`socialAuthPlugin: ${e} needs an absolute redirect URI — set \`appBaseUrl\` (or \`providers.${e}.redirectUri\`)`);
-		let o = {
+}, he = (e) => e.method === "POST" && (e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded") ? new URLSearchParams(Buffer.from(e.rawBody).toString("utf8")) : new URLSearchParams(e.query), P = (k) => {
+	let P = k.prefix ?? ue, F = k.stateTtlSeconds ?? de, I = k.stateCookieName ?? fe, L = k.linkPolicy ?? "never", R = k.auth.cookieSecure ?? !0, z = k.providers ?? {}, ge = Object.keys(z);
+	if (ge.find((e) => !n(e)) !== void 0) throw new t("socialAuthPlugin: unknown provider configuration");
+	let B = ge.filter(n), V = /* @__PURE__ */ new Map();
+	for (let e of k.platforms ?? []) {
+		if (V.has(e.id)) throw new t(`socialAuthPlugin: platform ${e.id} is configured twice`);
+		V.set(e.id, e);
+	}
+	if (B.length === 0 && V.size === 0) throw new t("socialAuthPlugin: `providers` and `platforms` are empty — enable at least one provider or platform");
+	if (!Number.isSafeInteger(F) || F <= 0 || F > 3600) throw new t("socialAuthPlugin: stateTtlSeconds must be an integer from 1 to 3600");
+	let H = (k.appBaseUrl ?? k.auth.appBaseUrl ?? "").replace(/\/+$/, ""), U = I + ":upgrade", W = k.guestUpgrade, G = JSON.stringify([
+		H,
+		P,
+		k.name ?? "",
+		k.auth.defaultTenantId
+	]);
+	if (W) {
+		if (W.guest.tenantId !== k.auth.defaultTenantId || k.auth.ensureActor !== void 0 && W.configForTransaction === void 0) throw new t("Guest upgrade requires matching server tenants and transaction-bound actor hooks");
+		if (k.identities !== void 0) throw new t("Guest upgrade requires transaction-bound SQL social identities");
+		let e = !1;
+		try {
+			let t = new URL(H), n = new URL(W.confirmationRedirect, t);
+			e = /^https?:$/.test(t.protocol) && n.origin === t.origin && !n.username && !n.password && !W.confirmationRedirect.startsWith("//") && !W.confirmationRedirect.includes("\\");
+		} catch {}
+		if (!e) throw new t("Guest upgrade confirmation must be a same-origin application page");
+		for (let e of W.native?.redirectUris ?? ["acme://valid"]) {
+			let n = null;
+			try {
+				n = new URL(e);
+			} catch {}
+			if (!n || e.includes("*") || n.hash || n.username || n.password || /^(javascript|data|file):$/.test(n.protocol) || n.protocol === "http:" && ![
+				"127.0.0.1",
+				"[::1]",
+				"localhost"
+			].includes(n.hostname)) throw new t("Native guest upgrade redirect URIs must be exact app URIs (custom scheme, https or loopback http)");
+		}
+		if (W.native && W.native.redirectUris.length === 0) throw new t("Native guest upgrade needs at least one redirect URI");
+	}
+	let K = (e) => {
+		if (!W) throw new t("Guest upgrade is not configured");
+		return W.service?.(e) ?? ae(e, W.guest);
+	}, q = (e) => C(e, "", {
+		maxAgeSeconds: 0,
+		path: P,
+		secure: R,
+		httpOnly: !0,
+		sameSite: "lax",
+		...k.auth.cookieDomain ? { domain: k.auth.cookieDomain } : {}
+	}), J = (e) => {
+		let n = z[e] ?? {}, r = process.env, i = n.clientId ?? r[A[e][0].name] ?? "";
+		if (!i) throw new t(`socialAuthPlugin: ${e} has no client id — pass \`providers.${e}.clientId\` or set ${A[e][0].name}`);
+		let a = n.redirectUri ?? `${H}${P}/${e}/callback`, o = !1;
+		try {
+			let e = new URL(a);
+			o = (e.protocol === "https:" || e.protocol === "http:") && e.username === "" && e.password === "" && e.hash === "";
+		} catch {}
+		if (!o) throw new t(`socialAuthPlugin: ${e} needs an absolute redirect URI — set \`appBaseUrl\` (or \`providers.${e}.redirectUri\`)`);
+		let s = {
 			id: e,
 			clientId: i,
 			redirectUri: a,
@@ -97,148 +202,540 @@ var p = "/auth/social", m = 600, h = "voltro:oauth", g = {
 			} : void 0);
 			if (!e) throw new t("socialAuthPlugin: apple needs `appleKey` (teamId + keyId + .p8) or VOLTRO_APPLE_TEAM_ID / VOLTRO_APPLE_KEY_ID / VOLTRO_APPLE_PRIVATE_KEY");
 			return {
-				...o,
+				...s,
 				appleKey: e
 			};
 		}
-		let s = n.clientSecret ?? r[g[e][1].name] ?? "";
-		if (!s) throw new t(`socialAuthPlugin: ${e} has no client secret — pass \`providers.${e}.clientSecret\` or set ${g[e][1].name}`);
+		let c = n.clientSecret ?? r[A[e][1].name] ?? "";
+		if (!c) throw new t(`socialAuthPlugin: ${e} has no client secret — pass \`providers.${e}.clientSecret\` or set ${A[e][1].name}`);
 		return {
-			...o,
-			clientSecret: s
+			...s,
+			clientSecret: c
 		};
-	}, j = S.identities ?? null, M = (e) => {
-		if (j) return j;
+	}, Y = k.identities ?? null, _e = (e) => {
+		if (Y) return Y;
 		let n = e.store;
 		if (!n) throw new t("socialAuthPlugin: no identity store — pass `identities`, or run on an app with a DataStore");
-		return j = s(n), j;
-	}, N = (e) => {
-		if (!e.startsWith(`${C}/`)) return null;
-		let [t, ...r] = e.slice(C.length + 1).split("/");
-		return !t || !n(t) || !O.includes(t) ? null : r.length === 0 ? {
+		return Y = s(n), Y;
+	}, ve = (e) => {
+		if (!e.startsWith(`${P}/`)) return null;
+		let [t, ...r] = e.slice(P.length + 1).split("/");
+		return !t || !n(t) || !B.includes(t) ? null : r.length === 0 ? {
 			id: t,
 			isCallback: !1
 		} : r.length === 1 && r[0] === "callback" ? {
 			id: t,
 			isCallback: !0
 		} : null;
-	}, P = (e, t, n) => {
-		if (!S.failureRedirect) return _(e, {
-			error: t,
-			message: n
-		});
-		let r = S.failureRedirect.includes("?") ? "&" : "?";
-		return v(`${S.failureRedirect}${r}social_error=${encodeURIComponent(t)}`, d(T, "", {
-			maxAgeSeconds: 0,
-			path: C,
-			secure: D
-		}));
-	}, F = (e, t) => {
-		let n = A(t), a = r(t, n.endpoints), o = i({
+	}, X = (e, t, n) => {
+		let r = [q(I), ...W ? [q(U)] : []];
+		if (!k.failureRedirect) return {
+			...j(e, {
+				error: t,
+				message: n
+			}),
+			headers: {
+				"cache-control": "no-store",
+				"set-cookie": r
+			}
+		};
+		let i = k.failureRedirect.includes("?") ? "&" : "?", a = N(`${k.failureRedirect}${i}social_error=${encodeURIComponent(t)}`);
+		return {
+			...a,
+			headers: {
+				...a.headers,
+				"set-cookie": r
+			}
+		};
+	}, Z = (e, t, n, a) => {
+		let o = J(t), s = r(t, o.endpoints), c = i({
 			provider: t,
-			clientId: n.clientId,
-			redirectUri: n.redirectUri,
-			...n.scopes === void 0 ? {} : { scopes: n.scopes },
-			endpoints: n.endpoints,
+			clientId: o.clientId,
+			redirectUri: o.redirectUri,
+			...o.scopes === void 0 ? {} : { scopes: o.scopes },
+			endpoints: o.endpoints,
 			...new URLSearchParams(e.query).get("login_hint") ? { loginHint: new URLSearchParams(e.query).get("login_hint") } : {}
-		}), s = d(T, y({
+		}), l = C(I, pe({
 			p: t,
-			s: o.state,
-			v: o.codeVerifier,
-			n: o.nonce
-		}), {
-			maxAgeSeconds: w,
+			s: c.state,
+			v: c.codeVerifier,
+			n: c.nonce,
+			exp: Math.floor(Date.now() / 1e3) + F,
+			audience: G,
+			redirectUri: o.redirectUri,
+			...n === void 0 ? {} : { guest: n },
+			...n !== void 0 && a !== void 0 ? { native: a } : {}
+		}, E(k.auth)), {
+			maxAgeSeconds: F,
 			httpOnly: !0,
-			sameSite: a.responseMode === "form_post" ? "none" : "lax",
-			secure: a.responseMode === "form_post" || D,
-			...S.auth.cookieDomain ? { domain: S.auth.cookieDomain } : {},
-			path: C
-		});
-		return v(o.url, s);
-	}, I = async (e, t) => {
-		let n = x(e), r = n.get("error");
-		if (r) return P(400, "exchange_failed", `${t} refused the authorization: ${r}`);
-		let i = b(f(e.headers.cookie, T)), s = i && i.p === t ? i : null, c = A(t), u = await a({
+			sameSite: s.responseMode === "form_post" ? "none" : "lax",
+			secure: s.responseMode === "form_post" || R,
+			...k.auth.cookieDomain ? { domain: k.auth.cookieDomain } : {},
+			path: P
+		}), u = N(c.url, l);
+		return W ? {
+			...u,
+			headers: {
+				...u.headers,
+				"set-cookie": [l, q(U)]
+			}
+		} : u;
+	}, ye = async (e, t) => {
+		let n = he(e), r = me(w(e.headers.cookie, I), E(k.auth)), i = J(t), s = r && r.p === t && r.audience === G && r.redirectUri === i.redirectUri ? r : null, c = W?.native && s?.guest && s.native ? s.native : null, l = (e) => {
+			let t = N(e);
+			return {
+				...t,
+				headers: {
+					...t.headers,
+					"set-cookie": [q(I)]
+				}
+			};
+		}, u = (e, t, n) => c ? l(M(c.r, {
+			error: t,
+			state: c.ns
+		})) : X(e, t, n);
+		if (n.get("error")) return u(400, "exchange_failed", `${t} refused the authorization`);
+		if (s?.guest) {
+			if (!W || !e.store || s.guest.tenantId !== W.guest.tenantId) return u(403, "credential_rejected", "Guest upgrade was refused.");
+			let t = await v.runPromise(v.result(K(e.store).isLive(s.guest)));
+			if (y.isFailure(t)) return u(503, "store_unavailable", "Guest upgrade storage is unavailable.");
+			if (!t.success) return u(403, "credential_rejected", "Guest upgrade was refused.");
+		}
+		let f = await a({
 			provider: t,
-			clientId: c.clientId,
-			...c.clientSecret === void 0 ? {} : { clientSecret: c.clientSecret },
-			...c.appleKey === void 0 ? {} : { appleKey: c.appleKey },
-			redirectUri: c.redirectUri,
+			clientId: i.clientId,
+			...i.clientSecret === void 0 ? {} : { clientSecret: i.clientSecret },
+			...i.appleKey === void 0 ? {} : { appleKey: i.appleKey },
+			redirectUri: i.redirectUri,
 			code: n.get("code") ?? "",
 			state: n.get("state") ?? "",
 			expectedState: s?.s ?? "",
 			codeVerifier: s?.v ?? "",
 			expectedNonce: s?.n ?? "",
 			...n.get("user") ? { appleUserPayload: n.get("user") } : {},
-			endpoints: c.endpoints
-		}), p = await l.runPromise(o({
-			profile: u,
-			identities: M(e),
-			users: S.users,
-			config: S.auth,
-			policy: E,
+			endpoints: i.endpoints
+		});
+		if (s?.guest && W) {
+			let e = Math.min(s.exp, Math.floor(Date.now() / 1e3) + F), t = d({
+				guest: s.guest,
+				profile: f,
+				exp: e,
+				audience: G
+			}, E(k.auth));
+			if (c) {
+				let n = g({
+					handoff: t,
+					ch: c.ch,
+					guestId: s.guest.id,
+					exp: Math.min(e, Math.floor(Date.now() / 1e3) + 120)
+				}, E(k.auth), G);
+				return l(M(c.r, {
+					code: n,
+					state: c.ns
+				}));
+			}
+			let n = N(W.confirmationRedirect);
+			return {
+				...n,
+				headers: {
+					...n.headers,
+					"set-cookie": [q(I), C(U, t, {
+						maxAgeSeconds: Math.max(0, e - Math.floor(Date.now() / 1e3)),
+						path: P,
+						httpOnly: !0,
+						sameSite: "lax",
+						secure: R,
+						...k.auth.cookieDomain ? { domain: k.auth.cookieDomain } : {}
+					})]
+				}
+			};
+		}
+		let p = await v.runPromise(o({
+			profile: f,
+			identities: _e(e),
+			users: k.users,
+			config: k.auth,
+			policy: L,
 			ipAddress: e.remoteAddr ?? null,
 			userAgent: e.headers["user-agent"] ?? null
 		}));
-		if (p.kind === "refused") return P(p.status, p.code, p.message);
-		let m = d(T, "", {
+		if (p.kind === "refused") return X(p.status, p.code, p.message);
+		let m = C(I, "", {
 			maxAgeSeconds: 0,
-			path: C,
-			secure: D
+			path: P,
+			secure: R
 		});
 		return {
 			status: 302,
 			body: "",
 			contentType: "text/plain; charset=utf-8",
 			headers: {
-				location: S.successRedirect ?? S.auth.successRedirect ?? "/",
+				"cache-control": "no-store",
+				"referrer-policy": "no-referrer",
+				location: k.successRedirect ?? k.auth.successRedirect ?? "/",
 				"set-cookie": [m, p.setCookie]
 			}
 		};
-	}, L = {
+	}, Q = (e, t) => ({
+		...j(e, t),
+		headers: { "cache-control": "no-store" }
+	}), be = async (e, t, r) => {
+		let i = W?.native;
+		if (!W || !i) return j(404, { error: "not_found" });
+		let a = async (t) => {
+			if (!e.store) return Q(503, { error: "store_unavailable" });
+			let n = await v.runPromise(v.result(K(e.store).isLive(t)));
+			return y.isFailure(n) ? Q(503, { error: "store_unavailable" }) : n.success ? null : Q(403, { error: "credential_rejected" });
+		};
+		if (t === "begin") {
+			if (e.method !== "GET") return j(405, { error: "method_not_allowed" });
+			let t = ne(new URLSearchParams(e.query).get("t"), r, G, i.redirectUris);
+			return !t || !n(t.provider) || !B.includes(t.provider) || t.guest.tenantId !== W.guest.tenantId ? Q(403, { error: "upgrade_ticket_rejected" }) : await a(t.guest) ?? Z(e, t.provider, t.guest, t.native);
+		}
+		if (e.method !== "POST") return j(405, { error: "method_not_allowed" });
+		if ((e.headers["content-type"] ?? "").split(";")[0]?.trim() !== "application/json") return j(415, { error: "json_required" });
+		if (e.rawBody.byteLength > 8192) return j(413, { error: "body_too_large" });
+		let o;
+		try {
+			o = JSON.parse(new TextDecoder().decode(e.rawBody));
+		} catch {
+			return Q(400, { error: "invalid_input" });
+		}
+		if (!o || typeof o != "object" || Array.isArray(o)) return Q(400, { error: "invalid_input" });
+		let s = o;
+		if (t.startsWith("start/")) {
+			let o = t.slice(6);
+			if (!n(o) || !B.includes(o)) return j(404, { error: "not_found" });
+			let c = e.headers[S], l = typeof W.guest.secret == "function" ? W.guest.secret() : W.guest.secret, u = typeof c == "string" && c ? f(O({ [S]: c }, l)?.subject) : null;
+			if (!u || u.tenantId !== W.guest.tenantId) return Q(403, { error: "credential_rejected" });
+			let d = m({
+				ch: s.codeChallenge,
+				r: s.redirectUri,
+				ns: s.state
+			}, i.redirectUris);
+			if (!d || Object.keys(s).some((e) => e !== "codeChallenge" && e !== "redirectUri" && e !== "state")) return Q(400, { error: "invalid_input" });
+			let p = await a(u);
+			if (p) return p;
+			let h = ee({
+				guest: u,
+				provider: o,
+				native: d,
+				exp: Math.floor(Date.now() / 1e3) + F,
+				audience: G
+			}, r), g = new URL(P + "/upgrade/native/begin", J(o).redirectUri);
+			return g.search = new URLSearchParams({ t: h }).toString(), Q(200, { authorizationUrl: g.toString() });
+		}
+		if (t !== "complete") return j(404, { error: "not_found" });
+		if (Object.keys(s).some((e) => e !== "code" && e !== "codeVerifier" && e !== "credential" && e !== "confirmed") || s.confirmed !== !0 || typeof s.credential != "string" || !p(s.codeVerifier)) return Q(400, { error: "invalid_input" });
+		let c = h(s.code, r, G);
+		if (!c || !te(s.codeVerifier, c.ch)) return Q(400, { error: "invalid_code" });
+		let d = u(c.handoff, r, G), g = D(s.credential);
+		if (!d || d.guest.id !== c.guestId || d.guest.tenantId !== W.guest.tenantId || !g || g.guestId !== d.guest.id || g.deviceId !== d.guest.metadata?.guestDeviceId) return Q(403, { error: "upgrade_handoff_rejected" });
+		let _ = await a(d.guest);
+		if (_) return _;
+		let b = await v.runPromise(l({
+			profile: d.profile,
+			credential: s.credential,
+			store: e.store,
+			guest: W.guest,
+			service: K(e.store),
+			users: k.users,
+			config: k.auth,
+			...W.configForTransaction ? { configForTransaction: W.configForTransaction } : {},
+			ipAddress: e.remoteAddr ?? null,
+			userAgent: e.headers["user-agent"] ?? null
+		}));
+		return b.kind === "refused" ? Q(b.status, {
+			error: b.code,
+			message: b.message
+		}) : Q(200, {
+			ok: !0,
+			upgraded: !0,
+			subject: b.subject,
+			session: b.session.value,
+			expiresAt: b.session.expiresAt
+		});
+	}, $ = /* @__PURE__ */ new Map(), xe = async (e, t) => {
+		let n = ($.get(e) ?? Promise.resolve()).then(t, t), r = n.then(() => void 0, () => void 0);
+		$.set(e, r);
+		try {
+			return await n;
+		} finally {
+			$.get(e) === r && $.delete(e);
+		}
+	}, Se = async (t) => {
+		let [n, r, ...i] = t.path.slice((P + "/platform/").length).split("/"), a = n === void 0 ? void 0 : V.get(n);
+		if (!a || i.length !== 0 || r !== "sign-in" && r !== "link" || r === "link" && !W) return j(404, { error: "not_found" });
+		if (t.method !== "POST") return j(405, { error: "method_not_allowed" });
+		if ((t.headers["content-type"] ?? "").split(";")[0]?.trim() !== "application/json") return j(415, { error: "json_required" });
+		if (t.rawBody.byteLength > 16384) return j(413, { error: "body_too_large" });
+		let s;
+		try {
+			s = JSON.parse(new TextDecoder().decode(t.rawBody));
+		} catch {
+			return Q(400, { error: "invalid_input" });
+		}
+		if (!s || typeof s != "object" || Array.isArray(s)) return Q(400, { error: "invalid_input" });
+		let c = s, u = r === "link" ? ["ticket", "credential"] : ["ticket"];
+		if (Object.keys(c).some((e) => !u.includes(e)) || typeof c.ticket != "string" || c.ticket.length === 0 || r === "link" && (typeof c.credential != "string" || !D(c.credential))) return Q(400, { error: "invalid_input" });
+		if (!t.store && (r === "link" || !k.identities)) return Q(503, { error: "store_unavailable" });
+		let d;
+		try {
+			d = await _(a, c.ticket);
+		} catch (t) {
+			if (t instanceof e) return Q(t.status, {
+				error: t.code,
+				message: t.message
+			});
+			throw t;
+		}
+		let f = {
+			provider: a.id,
+			providerAccountId: d.accountId,
+			email: null,
+			emailVerified: !1,
+			emailIsPrivateRelay: !1,
+			name: null,
+			firstName: null,
+			lastName: null,
+			avatarUrl: null,
+			nameIsFirstAuthorizationOnly: !1,
+			raw: {}
+		}, p = {
+			ipAddress: t.remoteAddr ?? null,
+			userAgent: t.headers["user-agent"] ?? null
+		}, m = await xe(a.id + "\0" + d.accountId, () => r === "sign-in" ? v.runPromise(o({
+			profile: f,
+			identities: _e(t),
+			users: k.users,
+			config: k.auth,
+			policy: L,
+			...p
+		})) : v.runPromise(l({
+			profile: f,
+			credential: c.credential,
+			store: t.store,
+			guest: W.guest,
+			service: K(t.store),
+			users: k.users,
+			config: k.auth,
+			...W.configForTransaction ? { configForTransaction: W.configForTransaction } : {},
+			...p
+		})));
+		return m.kind === "refused" ? Q(m.status, {
+			error: m.code,
+			message: m.message
+		}) : Q(200, {
+			ok: !0,
+			subject: m.subject,
+			session: m.session.value,
+			expiresAt: m.session.expiresAt,
+			created: m.created
+		});
+	}, Ce = async (e) => {
+		if (!W) return j(404, { error: "not_found" });
+		let t = e.path.slice((P + "/upgrade/").length), r = E(k.auth);
+		if (t.startsWith("native/")) return be(e, t.slice(7), r);
+		if (t === "csrf") {
+			if (e.method !== "GET") return j(405, { error: "method_not_allowed" });
+			let t = se(r.current.secret);
+			return {
+				...j(200, { token: t }),
+				headers: {
+					"cache-control": "no-store",
+					"set-cookie": C(T, t, {
+						path: "/",
+						httpOnly: !1,
+						secure: R,
+						sameSite: "lax",
+						maxAgeSeconds: F,
+						...k.auth.cookieDomain ? { domain: k.auth.cookieDomain } : {}
+					})
+				}
+			};
+		}
+		let i = () => u(w(e.headers.cookie, U), r, G);
+		if (t === "receipt") {
+			if (e.method !== "GET") return j(405, { error: "method_not_allowed" });
+			let t = O(e.headers, r)?.subject;
+			if (!e.store || t?.type !== "user" || t.kind === "guest" || !/^guest_[A-Za-z0-9_-]+$/.test(t.id) || t.tenantId !== W.guest.tenantId || typeof t.metadata?.sessionId != "string") return j(403, { error: "credential_rejected" });
+			try {
+				let n = await v.runPromise(oe(e.store).findSession(t.metadata.sessionId));
+				if (!n || n.userId !== t.id || n.tenantId !== t.tenantId || !(n.expiresAt.getTime() > Date.now())) return j(403, { error: "credential_rejected" });
+				let r = {
+					predicate: b(x("id", t.id), x("tenantId", t.tenantId)),
+					order: [],
+					take: void 0,
+					skip: void 0,
+					projection: void 0
+				}, i = (await e.store.query({
+					table: "users",
+					...r
+				}))[0], a = (await e.store.query({
+					table: "authGuests",
+					...r
+				}))[0];
+				return !i || i.id !== t.id || i.tenantId !== t.tenantId || a || i.deactivatedAt !== null && i.deactivatedAt !== void 0 ? j(403, { error: "credential_rejected" }) : j(200, {
+					upgraded: !0,
+					subject: {
+						type: "user",
+						id: t.id,
+						tenantId: t.tenantId
+					}
+				});
+			} catch {
+				return j(503, { error: "store_unavailable" });
+			}
+		}
+		if (t === "pending") {
+			if (e.method !== "GET") return j(405, { error: "method_not_allowed" });
+			let t = i();
+			if (!t || t.guest.tenantId !== W.guest.tenantId || !e.store) return j(403, { error: "upgrade_handoff_rejected" });
+			let n = await v.runPromise(v.result(K(e.store).isLive(t.guest)));
+			return y.isFailure(n) ? j(503, { error: "store_unavailable" }) : n.success ? j(200, {
+				guestId: t.guest.id,
+				provider: t.profile.provider,
+				email: t.profile.email,
+				emailVerified: t.profile.emailVerified,
+				expiresAt: t.exp * 1e3
+			}) : j(403, { error: "credential_rejected" });
+		}
+		let a = n(t) && B.includes(t);
+		if (!a && t !== "complete") return j(404, { error: "not_found" });
+		if (e.method !== "POST") return j(405, { error: "method_not_allowed" });
+		if ((e.headers["content-type"] ?? "").split(";")[0]?.trim() !== "application/json") return j(415, { error: "json_required" });
+		if (e.rawBody.byteLength > 1024) return j(413, { error: "body_too_large" });
+		if (![r.current, r.previous].filter((e) => e !== void 0).some((t) => le(e.headers[ie], w(e.headers.cookie, T), t.secret))) return j(403, { error: "csrf_rejected" });
+		let o;
+		try {
+			o = JSON.parse(new TextDecoder().decode(e.rawBody));
+		} catch {
+			return j(400, { error: "invalid_input" });
+		}
+		if (!o || typeof o != "object" || Array.isArray(o)) return j(400, { error: "invalid_input" });
+		let s = o;
+		if (!e.store) return j(503, { error: "store_unavailable" });
+		let c = K(e.store);
+		if (a && n(t)) {
+			if (Object.keys(s).length !== 0) return j(400, { error: "invalid_input" });
+			let n = typeof W.guest.secret == "function" ? W.guest.secret() : W.guest.secret, r = f(O(e.headers, n)?.subject);
+			if (!r || r.tenantId !== W.guest.tenantId) return j(403, { error: "credential_rejected" });
+			let i = await v.runPromise(v.result(c.isLive(r)));
+			if (y.isFailure(i)) return j(503, { error: "store_unavailable" });
+			if (!i.success) return j(403, { error: "credential_rejected" });
+			let a = Z(e, t, r);
+			return {
+				...j(200, { authorizationUrl: a.headers?.location }),
+				headers: {
+					"cache-control": "no-store",
+					"set-cookie": a.headers?.["set-cookie"] ?? []
+				}
+			};
+		}
+		if (Object.keys(s).some((e) => e !== "credential" && e !== "confirmed") || typeof s.credential != "string" || s.confirmed !== !0) return j(400, { error: "invalid_input" });
+		let d = i(), p = D(s.credential);
+		if (!d || !p || d.guest.tenantId !== W.guest.tenantId || p.guestId !== d.guest.id || p.deviceId !== d.guest.metadata?.guestDeviceId) return j(403, { error: "upgrade_handoff_rejected" });
+		let m = await v.runPromise(v.result(c.isLive(d.guest)));
+		if (y.isFailure(m)) return j(503, { error: "store_unavailable" });
+		if (!m.success) return j(403, { error: "credential_rejected" });
+		let h = await v.runPromise(l({
+			profile: d.profile,
+			credential: s.credential,
+			store: e.store,
+			guest: W.guest,
+			service: c,
+			users: k.users,
+			config: k.auth,
+			...W.configForTransaction ? { configForTransaction: W.configForTransaction } : {},
+			ipAddress: e.remoteAddr ?? null,
+			userAgent: e.headers["user-agent"] ?? null
+		}));
+		return h.kind === "refused" ? j(h.status, {
+			error: h.code,
+			message: h.message
+		}) : {
+			...j(200, {
+				upgraded: !0,
+				subject: h.subject
+			}),
+			headers: {
+				"cache-control": "no-store",
+				"set-cookie": [q(U), h.setCookie]
+			}
+		};
+	}, we = {
 		method: "*",
-		path: C,
+		path: P,
 		handle: async (t) => {
-			let n = N(t.path);
-			if (!n) return _(404, { error: "not_found" });
+			if (t.path.startsWith(P + "/platform/")) return Se(t);
+			if (t.path.startsWith(P + "/upgrade/")) try {
+				return await Ce(t);
+			} catch (t) {
+				if (t instanceof e) return X(t.status, t.code, t.message);
+				throw t;
+			}
+			let n = ve(t.path);
+			if (!n) return j(404, { error: "not_found" });
 			try {
-				return n.isCallback ? t.method !== "GET" && t.method !== "POST" ? _(405, { error: "method_not_allowed" }) : await I(t, n.id) : t.method === "GET" ? F(t, n.id) : _(405, { error: "method_not_allowed" });
+				return n.isCallback ? t.method !== "GET" && t.method !== "POST" ? j(405, { error: "method_not_allowed" }) : await ye(t, n.id) : t.method === "GET" ? Z(t, n.id) : j(405, { error: "method_not_allowed" });
 			} catch (t) {
-				if (t instanceof e) return P(t.status, t.code, t.message);
+				if (t instanceof e) return X(t.status, t.code, t.message);
 				throw t;
 			}
 		}
-	}, R = [
+	}, Te = [
 		"store:write",
 		"network:outbound:oauth2.googleapis.com",
 		"network:outbound:www.googleapis.com",
 		"network:outbound:github.com",
 		"network:outbound:api.github.com",
-		"network:outbound:appleid.apple.com"
-	], z = O.flatMap((e) => g[e].map((t) => ({
+		"network:outbound:appleid.apple.com",
+		"network:outbound:discord.com",
+		"network:outbound:id.twitch.tv",
+		"network:outbound:login.microsoftonline.com",
+		"network:outbound:api.epicgames.dev",
+		...[...V.values()].flatMap((e) => e.permissions)
+	], Ee = (e, t) => {
+		let n = z[e];
+		return t === 0 ? n?.clientId !== void 0 : e === "apple" ? t === 1 ? n?.appleKey?.teamId !== void 0 : t === 2 ? n?.appleKey?.keyId !== void 0 : n?.appleKey?.privateKey !== void 0 : n?.clientSecret !== void 0;
+	}, De = B.flatMap((e) => A[e].map((t, n) => ({
 		name: t.name,
-		required: S.providers[e]?.clientId === void 0,
+		required: !Ee(e, n),
 		secret: t.secret,
 		description: t.description
-	})));
-	return u({
-		name: S.name ? `@voltro/plugin-auth-social#${S.name}` : "@voltro/plugin-auth-social",
-		description: "Social login — Sign in with Google / GitHub / Apple. Mandatory PKCE (S256) + state, JWKS-verified ID tokens, a deliberate account-linking policy, and sessions issued through @voltro/plugin-auth.",
-		permissions: R,
-		declaredEnv: z,
+	}))), Oe = k.auth.secret === void 0 && k.auth.secrets === void 0 ? [{
+		name: "VOLTRO_SESSION_SECRET",
+		required: !0,
+		secret: !0,
+		generate: "base64url",
+		description: "Project key for signed login handoffs and ordinary sessions."
+	}] : [];
+	return re({
+		name: k.name ? `@voltro/plugin-auth-social#${k.name}` : "@voltro/plugin-auth-social",
+		description: "Social login — Google / GitHub / Apple / Discord / Twitch / Microsoft / Epic, and game sign-in with Steam / EOS / console tickets. Mandatory S256 + state, JWKS-verified ID tokens, a deliberate account-linking policy, and sessions issued through @voltro/plugin-auth.",
+		permissions: Te,
+		declaredEnv: [
+			...De,
+			...[...V.values()].flatMap((e) => e.declaredEnv),
+			...Oe
+		],
 		extendSchema: { tables: c },
-		httpRoutes: [L],
-		onActivate: (e) => l.sync(() => {
-			for (let e of O) A(e);
+		httpRoutes: [we],
+		onActivate: (e) => v.sync(() => {
+			for (let e of B) J(e);
+			for (let e of V.values()) e.check();
+			let n = E(k.auth);
+			if (ce({ exp: Math.floor(Date.now() / 1e3) + F }, n.current.secret, "social-login"), n.previous && n.previous.secret.length < 32) throw new t("socialAuthPlugin: previous project signing key is too short");
 			e.logger.info("social auth active", {
-				prefix: C,
-				providers: O.join(","),
-				linkPolicy: E,
-				stateTtlSeconds: w
+				prefix: P,
+				providers: B.join(","),
+				platforms: [...V.keys()].join(","),
+				linkPolicy: L,
+				stateTtlSeconds: F
 			});
 		}),
-		onDeactivate: () => l.void
+		onDeactivate: () => v.void
 	});
 };
 //#endregion
-export { S as socialAuthPlugin };
+export { P as socialAuthPlugin };