@voltro/plugin-auth 0.1.0

package/dist/strategy-CQ2YCIcr.js

@@ -0,0 +1,236 @@
+import { sessionSecretsOf as e } from "./session.js";
+import { Data as t, Effect as n } from "effect";
+import { readCookie as r, resolveSessionSecret as i, verifySessionKeyed as a } from "@voltro/protocol/session";
+import { generateId as o } from "@voltro/database";
+//#region src/revocation.ts
+var s = 3e4, c = 1e4, l = (e, t = {}) => {
+	let r = t.ttlMs ?? s, i = t.maxEntries ?? c, a = t.now ?? Date.now, o = /* @__PURE__ */ new Map(), l = () => {
+		if (o.size <= i) return;
+		let e = a();
+		for (let [t, n] of o) n.freshUntil <= e && o.delete(t);
+		for (let e of o.keys()) {
+			if (o.size <= i) break;
+			o.delete(e);
+		}
+	}, u = (e) => e !== null && e.expiresAt.getTime() > a();
+	return {
+		ttlMs: r,
+		invalidate: (e) => {
+			o.delete(e);
+		},
+		isLive: (t) => n.gen(function* () {
+			let n = a();
+			if (r > 0) {
+				let e = o.get(t);
+				if (e && e.freshUntil > n) return e.live;
+			}
+			let i = yield* e.findSession(t), s = u(i);
+			return r > 0 && (o.set(t, {
+				live: s,
+				freshUntil: n + r
+			}), l()), s;
+		})
+	};
+}, u = class extends t.TaggedError("UserAlreadyExistsError") {}, d = class extends t.TaggedError("UserNotFoundError") {}, f = (e) => o({
+	kind: "typeid",
+	prefix: e
+}, e), p = (e = []) => {
+	let t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = [], a = [], o = [], s = [], c = [];
+	for (let n of e) t.set(n.id, n), r.set(n.email.toLowerCase(), n);
+	let l = (e, i) => n.gen(function* () {
+		let a = t.get(e);
+		if (!a) return yield* n.fail(new d({ userId: e }));
+		let o = i(a);
+		return t.set(e, o), r.set(o.email.toLowerCase(), o), o;
+	});
+	return {
+		findByEmail: (e) => n.sync(() => r.get(e.toLowerCase()) ?? null),
+		findById: (e) => n.sync(() => t.get(e) ?? null),
+		insert: (e) => n.gen(function* () {
+			let i = e.email.toLowerCase();
+			if (r.has(i)) return yield* n.fail(new u({ email: i }));
+			let a = {
+				...e,
+				email: i,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return t.set(a.id, a), r.set(i, a), a;
+		}),
+		updatePassword: (e, t) => l(e, (e) => ({
+			...e,
+			passwordHash: t
+		})),
+		setMfaSecret: (e, t) => l(e, (e) => ({
+			...e,
+			mfaSecret: t,
+			mfaEnrolledAt: null
+		})),
+		markMfaEnrolled: (e) => l(e, (e) => ({
+			...e,
+			mfaEnrolledAt: /* @__PURE__ */ new Date()
+		})),
+		clearMfa: (e) => l(e, (e) => ({
+			...e,
+			mfaSecret: null,
+			mfaEnrolledAt: null
+		})),
+		listMemberships: (e) => n.sync(() => i.filter((t) => t.userId === e)),
+		addMembership: (e) => n.sync(() => {
+			let t = i.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
+				...e,
+				joinedAt: /* @__PURE__ */ new Date()
+			};
+			if (t >= 0) {
+				let e = i[t], r = {
+					...n,
+					joinedAt: e.joinedAt
+				};
+				return i[t] = r, r;
+			}
+			return i.push(n), n;
+		}),
+		membershipRole: (e, t) => n.sync(() => i.find((n) => n.userId === e && n.tenantId === t)?.role ?? null),
+		listSessions: (e) => n.sync(() => a.filter((t) => t.userId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+		insertSession: (e) => n.sync(() => {
+			let t = /* @__PURE__ */ new Date(), n = {
+				...e,
+				createdAt: t,
+				lastSeenAt: t
+			};
+			return a.push(n), n;
+		}),
+		findSession: (e) => n.sync(() => a.find((t) => t.id === e) ?? null),
+		touchSession: (e, t) => n.sync(() => {
+			let n = a.findIndex((t) => t.id === e);
+			n >= 0 && (a[n] = {
+				...a[n],
+				expiresAt: t,
+				lastSeenAt: /* @__PURE__ */ new Date()
+			});
+		}),
+		revokeSession: (e, t) => n.sync(() => {
+			let n = a.findIndex((n) => n.id === t && n.userId === e);
+			return n < 0 ? !1 : (a.splice(n, 1), !0);
+		}),
+		revokeAllOtherSessions: (e, t) => n.sync(() => {
+			let n = 0;
+			for (let r = a.length - 1; r >= 0; r--) {
+				let i = a[r];
+				i.userId === e && i.id !== t && (a.splice(r, 1), n++);
+			}
+			return n;
+		}),
+		insertToken: (e) => n.sync(() => {
+			let t = {
+				...e,
+				consumedAt: null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return o.push(t), t;
+		}),
+		consumeToken: (e, t) => n.sync(() => {
+			let n = Date.now(), r = o.find((r) => r.tokenHash === e && r.purpose === t && r.consumedAt === null && r.expiresAt.getTime() > n);
+			if (!r) return null;
+			let i = {
+				...r,
+				consumedAt: /* @__PURE__ */ new Date()
+			}, a = o.indexOf(r);
+			return o[a] = i, i;
+		}),
+		replaceRecoveryCodes: (e, t) => n.sync(() => {
+			for (let t = c.length - 1; t >= 0; t--) c[t].userId === e && c.splice(t, 1);
+			let n = /* @__PURE__ */ new Date();
+			for (let r of t) c.push({
+				id: f("rc"),
+				userId: e,
+				codeHash: r,
+				consumedAt: null,
+				createdAt: n
+			});
+		}),
+		consumeRecoveryCode: (e, t) => n.sync(() => {
+			let n = c.findIndex((n) => n.userId === e && n.codeHash === t && n.consumedAt === null);
+			return n < 0 ? !1 : (c[n] = {
+				...c[n],
+				consumedAt: /* @__PURE__ */ new Date()
+			}, !0);
+		}),
+		countRecoveryCodes: (e) => n.sync(() => c.filter((t) => t.userId === e && t.consumedAt === null).length),
+		listPasskeys: (e) => n.sync(() => s.filter((t) => t.userId === e)),
+		findPasskey: (e) => n.sync(() => s.find((t) => t.credentialId === e) ?? null),
+		insertPasskey: (e) => n.sync(() => {
+			let t = /* @__PURE__ */ new Date(), n = {
+				...e,
+				createdAt: t,
+				lastUsedAt: null
+			};
+			return s.push(n), n;
+		}),
+		advancePasskeyCounter: (e, t) => n.sync(() => {
+			let n = s.findIndex((t) => t.credentialId === e);
+			return n < 0 || t <= s[n].counter ? !1 : (s[n] = {
+				...s[n],
+				counter: t,
+				lastUsedAt: /* @__PURE__ */ new Date()
+			}, !0);
+		})
+	};
+}, m = (e, t = {}) => ({
+	type: "user",
+	id: e.id,
+	tenantId: t.tenantId ?? e.tenantId,
+	...t.memberships ? { metadata: { memberships: t.memberships.map((e) => ({
+		tenantId: e.tenantId,
+		role: e.role
+	})) } } : {}
+}), h = (e) => {
+	if (e.type !== "user") return null;
+	let t = e.metadata?.sessionId;
+	return typeof t == "string" && t.length > 0 ? t : null;
+}, g = (e) => {
+	if (e.type !== "user") return [];
+	let t = e.metadata?.memberships;
+	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
+}, _ = (e) => typeof e.isLive == "function", v = (e) => e.revocation && _(e.revocation) ? e.revocation : e.store ? l(e.store, e.revocation ?? {}) : null, y = (t = {}) => {
+	let o = t.cookieName ?? "voltro:session", s = v(t);
+	return {
+		id: "voltro-password",
+		resolve: (c) => {
+			let l = r(c.headers.cookie, o);
+			if (!l) return { kind: "skip" };
+			let u = a(l, e(t.secret ?? i()));
+			if (!u) return {
+				kind: "failed",
+				reason: "voltro session cookie failed verification"
+			};
+			let d = b(u.subject, "voltro-password");
+			if (!s) return {
+				kind: "matched",
+				subject: d
+			};
+			let f = h(d);
+			return f ? n.runPromise(s.isLive(f)).then((e) => e ? {
+				kind: "matched",
+				subject: d
+			} : {
+				kind: "failed",
+				reason: "voltro session revoked"
+			}) : {
+				kind: "matched",
+				subject: d
+			};
+		}
+	};
+}, b = (e, t) => {
+	if (e.type === "anonymous") return e;
+	let n = e.metadata ?? {};
+	return {
+		...e,
+		metadata: {
+			...n,
+			provider: t
+		}
+	};
+};
+//#endregion
+export { f as a, g as c, p as i, l, u as n, h as o, d as r, m as s, y as t };

package/dist/strategy.d.ts

@@ -0,0 +1,233 @@
+import { AuthStrategy } from '@voltro/protocol';
+import { Effect } from 'effect';
+import { SessionSecrets } from '@voltro/protocol/session';
+import { VoidIfEmpty } from 'effect/Types';
+import { YieldableError } from 'effect/Cause';
+
+/** One tenant a user belongs to. The active tenant lives on the Subject;
+ *  the full set drives the switch-tenant menu + the switch-tenant guard. */
+declare interface MembershipRecord {
+    readonly userId: string;
+    readonly tenantId: string;
+    readonly role: string;
+    readonly joinedAt: Date;
+}
+
+/** A registered WebAuthn credential. */
+declare interface PasskeyRecord {
+    readonly id: string;
+    readonly credentialId: string;
+    readonly userId: string;
+    readonly publicKey: string;
+    readonly counter: number;
+    readonly transports?: string | null;
+    readonly createdAt: Date;
+    readonly lastUsedAt: Date | null;
+}
+
+/** A server-side session row — enumerated so apps can list active
+ *  devices + revoke them. Written on sign-in; deleted on revoke. */
+declare interface SessionRecord {
+    readonly id: string;
+    readonly userId: string;
+    readonly tenantId: string;
+    readonly expiresAt: Date;
+    readonly ipAddress?: string | null;
+    readonly userAgent?: string | null;
+    readonly createdAt: Date;
+    readonly lastSeenAt: Date;
+}
+
+declare interface SessionRevocationChecker {
+    /** Is this session still live? `false` means the row was revoked (or
+     *  is past its `expiresAt`) — the caller rejects the cookie. Verdicts
+     *  are cached for `ttlMs`. */
+    readonly isLive: (sessionId: string) => Effect.Effect<boolean>;
+    /** Drop the cached verdict for one session — called inline by
+     *  sign-out / revoke handlers so the kill is immediate on THIS
+     *  process (other replicas converge within `ttlMs`). */
+    readonly invalidate: (sessionId: string) => void;
+    /** The effective cache window in milliseconds. */
+    readonly ttlMs: number;
+}
+
+declare interface SessionRevocationOptions {
+    /** Cache window in milliseconds. A revocation performed elsewhere
+     *  takes effect on this process within this window. Default 30s.
+     *  `0` disables caching (every verify hits the store). */
+    readonly ttlMs?: number;
+    /** Upper bound on cached session ids. When exceeded, expired entries
+     *  are swept; if still over, the oldest entries are dropped. Default
+     *  10 000. */
+    readonly maxEntries?: number;
+    /** Clock override (epoch milliseconds). Defaults to `Date.now`. A
+     *  testing seam — lets suites cross the cache window without
+     *  wall-clock sleeps. */
+    readonly now?: () => number;
+}
+
+/** Every session helper takes either a bare secret string (single-key)
+ *  or the keyed `{ current, previous? }` rotation set. */
+declare type SessionSecretInput = string | SessionSecrets;
+
+declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending';
+
+/** A single-use, hashed, expiring token (magic-link / password-reset). */
+declare interface TokenRecord {
+    readonly id: string;
+    readonly tokenHash: string;
+    readonly userId: string;
+    readonly purpose: TokenPurpose;
+    readonly expiresAt: Date;
+    readonly consumedAt: Date | null;
+    readonly createdAt: Date;
+}
+
+declare class UserAlreadyExistsError extends UserAlreadyExistsError_base<{
+    readonly email: string;
+}> {
+}
+
+declare const UserAlreadyExistsError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "UserAlreadyExistsError";
+} & Readonly<A>;
+
+declare class UserNotFoundError extends UserNotFoundError_base<{
+    readonly userId: string;
+}> {
+}
+
+declare const UserNotFoundError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "UserNotFoundError";
+} & Readonly<A>;
+
+declare interface UserRecord {
+    readonly id: string;
+    readonly email: string;
+    readonly passwordHash: string;
+    readonly tenantId: string;
+    readonly createdAt: Date;
+    /** Base32-encoded TOTP secret. `null` = MFA not enrolled. Set by
+     *  `setMfaSecret()` from the enrolment handler. Stored as plaintext. */
+    readonly mfaSecret?: string | null;
+    /** Timestamp the user completed TOTP enrolment (first successful
+     *  verify). Distinct from the secret being set — a half-completed
+     *  enrolment leaves `mfaSecret` populated but this null. */
+    readonly mfaEnrolledAt?: Date | null;
+    /** Optional lifecycle flag read by post-authentication subject guards.
+     *  Set (a `Date`) means the account is DEACTIVATED — `@voltro/plugin-
+     *  deactivation`'s `deactivationGuard()` vetoes login when it's non-null.
+     *  `null` / absent means active. A store populates it from the app's
+     *  `deactivatedAt` column (added by the `deactivation()` mixin) when that
+     *  column exists; stores without the column simply leave it undefined and
+     *  the guard treats the account as active. */
+    readonly deactivatedAt?: Date | null;
+}
+
+declare interface UserStore {
+    readonly findByEmail: (email: string) => Effect.Effect<UserRecord | null>;
+    readonly findById: (id: string) => Effect.Effect<UserRecord | null>;
+    readonly insert: (user: Omit<UserRecord, 'createdAt'>) => Effect.Effect<UserRecord, UserAlreadyExistsError>;
+    /** Replace a user's stored password hash. Used by password-reset AND
+     *  by rehash-on-verify (silently upgrading an under-cost hash on a
+     *  successful sign-in). */
+    readonly updatePassword: (userId: string, newHash: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /** Stash a freshly-generated TOTP secret on the user. Called by
+     *  the MFA enrolment handler before the user verifies the first
+     *  code. */
+    readonly setMfaSecret: (userId: string, secret: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /** Mark MFA as fully enrolled (called after the first successful
+     *  TOTP verify completes the enrolment ceremony). */
+    readonly markMfaEnrolled: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /** Wipe the secret + enrolledAt. Used by /account/security's
+     *  "remove MFA" action. */
+    readonly clearMfa: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /** Every tenant the user belongs to. */
+    readonly listMemberships: (userId: string) => Effect.Effect<ReadonlyArray<MembershipRecord>>;
+    /** Idempotent grant: inserts the [userId, tenantId] membership or
+     *  updates its role if it already exists. The DB-level composite
+     *  UNIQUE on `[userId, tenantId]` (see `membershipsTable`) is the
+     *  source of truth; this upsert converges to it. */
+    readonly addMembership: (membership: Omit<MembershipRecord, 'joinedAt'>) => Effect.Effect<MembershipRecord>;
+    /** Resolve the role for a [userId, tenantId] pair, or null when the
+     *  user is NOT a member. The switch-tenant handler calls this to
+     *  validate the requested tenant before rebinding the connection. */
+    readonly membershipRole: (userId: string, tenantId: string) => Effect.Effect<string | null>;
+    /** Active sessions for a user (most recent first). */
+    readonly listSessions: (userId: string) => Effect.Effect<ReadonlyArray<SessionRecord>>;
+    /** Record a session on sign-in. */
+    readonly insertSession: (session: Omit<SessionRecord, 'createdAt' | 'lastSeenAt'>) => Effect.Effect<SessionRecord>;
+    /** Look up one session row by id. The request-time revocation check
+     *  (`makeSessionRevocationChecker`) calls this — a missing row means
+     *  the session was revoked. */
+    readonly findSession: (sessionId: string) => Effect.Effect<SessionRecord | null>;
+    /** Slide a session row forward: bump `expiresAt` + `lastSeenAt`. Called
+     *  when the sliding-window renewal re-issues the cookie, so the row
+     *  outlives the renewed cookie and the revocation check keeps passing. */
+    readonly touchSession: (sessionId: string, expiresAt: Date) => Effect.Effect<void>;
+    /** Revoke a single session — only if it belongs to `userId` (so a
+     *  caller can't revoke another user's session by id-guessing). Returns
+     *  whether a row was removed. */
+    readonly revokeSession: (userId: string, sessionId: string) => Effect.Effect<boolean>;
+    /** Revoke every session for the user EXCEPT `keepSessionId` — the
+     *  "sign out other devices" action. Returns the count removed. */
+    readonly revokeAllOtherSessions: (userId: string, keepSessionId: string) => Effect.Effect<number>;
+    /** Persist a single-use token (already hashed). */
+    readonly insertToken: (token: Omit<TokenRecord, 'consumedAt' | 'createdAt'>) => Effect.Effect<TokenRecord>;
+    /** Atomically redeem a token by its hash + purpose: returns the row
+     *  only when it exists, matches the purpose, is unexpired, and was not
+     *  already consumed — and marks it consumed in the same step. Returns
+     *  null otherwise (single-use guard). */
+    readonly consumeToken: (tokenHash: string, purpose: TokenPurpose) => Effect.Effect<TokenRecord | null>;
+    /** Replace the user's recovery codes with a fresh (already hashed) set.
+     *  Called at enrolment / regeneration — wipes any prior codes so the
+     *  displayed set is the only valid one. */
+    readonly replaceRecoveryCodes: (userId: string, codeHashes: ReadonlyArray<string>) => Effect.Effect<void>;
+    /** Atomically redeem one recovery code by its hash: returns true only
+     *  when an unconsumed row for `userId` matched — and marks it consumed
+     *  in the same step (single-use). false otherwise. */
+    readonly consumeRecoveryCode: (userId: string, codeHash: string) => Effect.Effect<boolean>;
+    /** Count the user's remaining (unconsumed) recovery codes — surfaced so
+     *  the UI can warn when the user is running low. */
+    readonly countRecoveryCodes: (userId: string) => Effect.Effect<number>;
+    readonly listPasskeys: (userId: string) => Effect.Effect<ReadonlyArray<PasskeyRecord>>;
+    readonly findPasskey: (credentialId: string) => Effect.Effect<PasskeyRecord | null>;
+    readonly insertPasskey: (passkey: Omit<PasskeyRecord, 'createdAt' | 'lastUsedAt'>) => Effect.Effect<PasskeyRecord>;
+    /** Atomically bump the stored signature counter, guarding against a
+     *  cloned authenticator (WebAuthn §6.1.1): the update only applies when
+     *  `newCounter` strictly exceeds the stored counter. Returns whether a
+     *  row was advanced. `false` with an unchanged stored counter is the
+     *  clone/replay signal the assertion handler rejects on — the check and
+     *  the write are ONE atomic statement at the store, so two replicas
+     *  racing the same counter can't both succeed. */
+    readonly advancePasskeyCounter: (credentialId: string, newCounter: number) => Effect.Effect<boolean>;
+}
+
+export declare const voltroPasswordStrategy: (options?: VoltroPasswordStrategyOptions) => AuthStrategy;
+
+export declare interface VoltroPasswordStrategyOptions {
+    /** Secret(s) used to verify the cookie: a bare string OR a keyed
+     *  `SessionSecrets` set. Defaults to `resolveSessionSecret()` which
+     *  reads `VOLTRO_SESSION_SECRET` env with a dev fallback — same
+     *  resolver used by the mint side, so there's no drift between
+     *  issuing and verifying. A bare string is widened with the
+     *  `VOLTRO_SESSION_SECRET_PREVIOUS` env var (`sessionSecretsOf`),
+     *  so env-var rotation applies either way. */
+    readonly secret?: SessionSecretInput;
+    /** Cookie name. Defaults to `voltro:session`. Override when running
+     *  the strategy alongside another tenant on the same domain. */
+    readonly cookieName?: string;
+    /** The user store whose `sessions` rows back the request-time
+     *  revocation check. When absent, verification stays purely
+     *  stateless — a revoked session's cookie keeps working until it
+     *  expires. */
+    readonly store?: UserStore;
+    /** Tuning for the revocation check: options for the built-in TTL
+     *  cache (default window 30s), or a pre-built checker — pass the
+     *  auth plugin's own checker to share one cache between the HTTP
+     *  routes and the rpc auth chain. Ignored without a `store`
+     *  (unless a checker is passed directly). */
+    readonly revocation?: SessionRevocationOptions | SessionRevocationChecker;
+}
+
+export { }

package/dist/strategy.js

@@ -0,0 +1,3 @@
+import "./session.js";
+import { t as e } from "./strategy-CQ2YCIcr.js";
+export { e as voltroPasswordStrategy };

package/dist/tokens.d.ts

@@ -0,0 +1,31 @@
+/** Hash a plaintext token for storage / lookup. SHA-256 is sufficient —
+ *  the token is high-entropy (32 random bytes), so there's no
+ *  brute-force surface that would need a slow KDF. */
+export declare const hashToken: (plaintext: string) => string;
+
+/** Default magic-link lifetime — short, since it's an inbox round-trip. */
+export declare const MAGIC_LINK_TTL_S: number;
+
+export declare interface MintedToken {
+    /** The plaintext — put this in the emailed link. Never stored. */
+    readonly token: string;
+    /** SHA-256 of the plaintext — store this. */
+    readonly tokenHash: string;
+    /** Unix-ms expiry. */
+    readonly expiresAt: Date;
+    readonly purpose: TokenPurpose;
+}
+
+/**
+ * Mint a fresh single-use token. The caller persists `{ tokenHash,
+ * userId, purpose, expiresAt }` via `UserStore.insertToken` and emails
+ * the plaintext `token` in a link.
+ */
+export declare const mintToken: (purpose: TokenPurpose, ttlSeconds?: number) => MintedToken;
+
+/** Default password-reset lifetime — a bit longer. */
+export declare const PASSWORD_RESET_TTL_S: number;
+
+declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending';
+
+export { }

package/dist/tokens.js

@@ -0,0 +1,13 @@
+import { createHash as e, randomBytes as t } from "node:crypto";
+//#region src/tokens.ts
+var n = 900, r = 3600, i = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), a = (t) => e("sha256").update(t).digest("hex"), o = (e, n) => {
+	let r = i(t(32)), o = n ?? (e === "magic-link" ? 900 : 3600);
+	return {
+		token: r,
+		tokenHash: a(r),
+		expiresAt: new Date(Date.now() + o * 1e3),
+		purpose: e
+	};
+};
+//#endregion
+export { n as MAGIC_LINK_TTL_S, r as PASSWORD_RESET_TTL_S, a as hashToken, o as mintToken };

package/dist/web.d.ts

@@ -0,0 +1,69 @@
+import { ReactNode } from 'react';
+import { Subject } from '@voltro/protocol';
+
+/** True when this browser can do WebAuthn at all. */
+export declare const isPasskeySupported: () => boolean;
+
+export declare interface PasskeyClientOptions {
+    /** Base path the auth routes are mounted under. Default `/auth`. */
+    readonly basePath?: string;
+    /** Pass the CSRF token (from the `voltro:csrf` cookie / `GET /auth/csrf`)
+     *  so registration (an authenticated, state-changing flow) passes the
+     *  double-submit check. */
+    readonly csrfToken?: string;
+    /** `fetch` override (tests / custom credentials mode). Defaults to the
+     *  global `fetch` with `credentials: 'include'`. */
+    readonly fetchImpl?: typeof fetch;
+}
+
+declare interface ProviderProps {
+    /** Subject decoded from the session cookie, or null when unsigned. */
+    readonly subject: Subject | null;
+    readonly children: ReactNode;
+}
+
+/**
+ * Register a passkey for the (signed-in) user. Runs both ceremony steps:
+ * fetch creation options, call `navigator.credentials.create`, post the
+ * result for verification. Resolves to the new credential id.
+ */
+export declare const registerPasskey: (input: {
+    userId: string;
+    userName: string;
+}, options?: PasskeyClientOptions) => Promise<{
+    credentialId: string;
+}>;
+
+export declare const RequireAuth: ({ children, fallback }: RequireAuthProps) => ReactNode;
+
+declare interface RequireAuthProps {
+    readonly children: ReactNode | ((subject: Subject) => ReactNode);
+    /** Rendered when no Subject is present. Typically <LoginCard />. */
+    readonly fallback: ReactNode;
+}
+
+/**
+ * Sign in with a passkey. Fetches assertion options, calls
+ * `navigator.credentials.get`, posts the assertion for verification.
+ * Resolves to the resolved subject on success.
+ */
+export declare const signInWithPasskey: (input?: {
+    userId?: string;
+}, options?: PasskeyClientOptions) => Promise<{
+    subject: unknown;
+}>;
+
+export declare const SubjectProvider: ({ subject, children }: ProviderProps) => ReactNode;
+
+/** Read the Subject; returns null when no session is present. */
+export declare const useOptionalSubject: () => Subject | null;
+
+/**
+ * Read the resolved Subject. THROWS when not signed in — pair with
+ * `<RequireAuth>` or with a route-level guard so the throw can't
+ * surface to end users. Use `useOptionalSubject()` when both states
+ * are valid in the same component.
+ */
+export declare const useSubject: () => Subject;
+
+export { }

package/dist/web.js

@@ -0,0 +1,90 @@
+import { createContext as e, useContext as t } from "react";
+import { Fragment as n, jsx as r } from "react/jsx-runtime";
+//#region src/web/subjectContext.tsx
+var i = e(null), a = ({ subject: e, children: t }) => /* @__PURE__ */ r(i.Provider, {
+	value: e,
+	children: t
+}), o = () => {
+	let e = t(i);
+	if (!e) throw Error("useSubject() called without a signed-in user. Use useOptionalSubject() or wrap the consumer in <RequireAuth>.");
+	return e;
+}, s = () => t(i), c = ({ children: e, fallback: t }) => {
+	let i = s();
+	return i ? typeof e == "function" ? /* @__PURE__ */ r(n, { children: e(i) }) : /* @__PURE__ */ r(n, { children: e }) : /* @__PURE__ */ r(n, { children: t });
+}, l = (e) => {
+	let t = new Uint8Array(e), n = "";
+	for (let e of t) n += String.fromCharCode(e);
+	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}, u = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4), n = atob(t), r = new Uint8Array(n.length);
+	for (let e = 0; e < n.length; e++) r[e] = n.charCodeAt(e);
+	return r.buffer;
+}, d = () => typeof window < "u" && window.PublicKeyCredential !== void 0 && typeof navigator < "u" && !!navigator.credentials, f = async (e, t, n) => await (await (n.fetchImpl ?? fetch)(e, {
+	method: "POST",
+	credentials: "include",
+	headers: {
+		"content-type": "application/json",
+		...n.csrfToken ? { "x-csrf-token": n.csrfToken } : {}
+	},
+	body: JSON.stringify(t)
+})).json(), p = async (e, t = {}) => {
+	if (!d()) throw Error("passkeys not supported in this browser");
+	let n = t.basePath ?? "/auth", r = await f(`${n}/passkey/register/options`, e, t), i = r.challenge, a = r.rp, o = r.user, s = r.excludeCredentials ?? [], c = await navigator.credentials.create({ publicKey: {
+		challenge: u(i),
+		rp: a,
+		user: {
+			id: new TextEncoder().encode(o.id),
+			name: o.name,
+			displayName: o.displayName
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		excludeCredentials: s.map((e) => ({
+			type: "public-key",
+			id: u(e.id)
+		})),
+		authenticatorSelection: {
+			userVerification: "preferred",
+			residentKey: "preferred"
+		},
+		timeout: 300 * 1e3
+	} });
+	if (!c) throw Error("credential creation was cancelled");
+	let p = c.response, m = typeof p.getAuthenticatorData == "function" ? p.getAuthenticatorData() : /* @__PURE__ */ new ArrayBuffer(0), h = await f(`${n}/passkey/register/verify`, {
+		userId: e.userId,
+		credentialId: l(c.rawId),
+		clientDataJSON: l(p.clientDataJSON),
+		authenticatorData: l(m)
+	}, t);
+	if (!h.ok) throw Error(`passkey registration failed: ${String(h.error)}`);
+	return { credentialId: h.credentialId };
+}, m = async (e = {}, t = {}) => {
+	if (!d()) throw Error("passkeys not supported in this browser");
+	let n = t.basePath ?? "/auth", r = await f(`${n}/passkey/assert/options`, e.userId ? { userId: e.userId } : {}, t), i = r.challenge, a = r.rpId, o = r.allowCredentials ?? [], s = await navigator.credentials.get({ publicKey: {
+		challenge: u(i),
+		rpId: a,
+		allowCredentials: o.map((e) => ({
+			type: "public-key",
+			id: u(e.id)
+		})),
+		userVerification: "preferred",
+		timeout: 300 * 1e3
+	} });
+	if (!s) throw Error("assertion was cancelled");
+	let c = s.response, p = await f(`${n}/passkey/assert/verify`, {
+		credentialId: l(s.rawId),
+		clientDataJSON: l(c.clientDataJSON),
+		authenticatorData: l(c.authenticatorData),
+		signature: l(c.signature),
+		...e.userId ? { userId: e.userId } : {}
+	}, t);
+	if (!p.ok) throw Error(`passkey sign-in failed: ${String(p.error)}`);
+	return { subject: p.subject };
+};
+//#endregion
+export { c as RequireAuth, a as SubjectProvider, d as isPasskeySupported, p as registerPasskey, m as signInWithPasskey, s as useOptionalSubject, o as useSubject };