@voltro/plugin-auth 0.23.0 → 0.25.0

package/dist/{plugin-HgTMFY3m.js → plugin-ZXs8LFn0.js}

@@ -1,6 +1,6 @@
 import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
 import { clearSessionCookie as r, issueSession as i, readSessionKeyed as a, resolveSessionSecret as o, resolveSessionSecrets as s, sessionSecretsOf as c } from "./session.js";
-import { a as l, l as u, o as d, s as f, t as p } from "./strategy-D345j4df.js";
+import { a as l, l as u, o as d, s as f, t as p } from "./strategy-Ce4FlGi4.js";
 import { hashToken as m, mintToken as h } from "./tokens.js";
 import { CSRF_COOKIE_NAME as g, CSRF_HEADER_NAME as _, issueCsrfToken as v, verifyCsrf as ee } from "./csrf.js";
 import { generateChallenge as y, verifyAssertion as b, verifyRegistration as te } from "./webauthn.js";
@@ -32,39 +32,43 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 }, me = (e) => {
 	let t = Buffer.alloc(8);
 	return t.writeBigUInt64BE(BigInt(e), 0), t;
-}, O = (e, t) => {
+}, he = (e, t) => {
 	let n = ne(ue, Buffer.from(e));
 	n.update(me(t));
 	let r = n.digest(), i = r[r.length - 1] & 15, a = (r[i] & 127) << 24 | (r[i + 1] & 255) << 16 | (r[i + 2] & 255) << 8 | r[i + 3] & 255;
 	return String(a % 10 ** T).padStart(T, "0");
-}, k = () => fe(x(le)), A = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
+}, O = () => fe(x(le)), k = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
 	secret: e.secret,
 	issuer: e.issuer,
 	algorithm: "SHA1",
 	digits: String(T),
 	period: String(w)
-}).toString()}`, he = (e, t = Date.now()) => {
+}).toString()}`, ge = (e, t = Date.now()) => {
 	let n = pe(e);
-	return n ? O(n, Math.floor(t / 1e3 / w)) : "000000";
-}, j = (e, t, n = Date.now()) => S.gen(function* () {
+	return n ? he(n, Math.floor(t / 1e3 / w)) : "000000";
+}, A = (e, t, n = Date.now()) => S.gen(function* () {
 	let r = pe(e);
 	if (!r) return yield* S.fail(new E({ reason: "malformedSecret" }));
 	let i = t.replace(/\s+/g, "");
 	if (!/^[0-9]{6}$/.test(i)) return yield* S.fail(new E({ reason: "invalidCode" }));
 	let a = Math.floor(n / 1e3 / w), o = Buffer.from(i);
 	for (let e = -1; e <= de; e++) {
-		let t = O(r, a + e), n = Buffer.from(t);
+		let t = he(r, a + e), n = Buffer.from(t);
 		if (n.length === o.length && re(n, o)) return !0;
 	}
 	return yield* S.fail(new E({ reason: "invalidCode" }));
-}), M = (e = 10) => {
+}), j = (e = 10) => {
 	let t = [];
 	for (let n = 0; n < e; n++) {
 		let e = fe(x(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
 		t.push(e.join("-"));
 	}
 	return t;
-}, N = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), P = (e) => e.secret ?? o(), F = (e, t, n = {}) => ({
+}, _e = 5, ve = 900, ye = 900, M = (e) => ({
+	maxAttempts: e.lockout?.maxAttempts ?? _e,
+	windowMs: (e.lockout?.windowSeconds ?? ve) * 1e3,
+	lockMs: (e.lockout?.lockSeconds ?? ye) * 1e3
+}), N = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), P = (e) => e.secret ?? o(), F = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
@@ -82,6 +86,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		sessionId: t
 	}
 } : e, z = (e, t, n, r = {}) => S.gen(function* () {
+	yield* t.clearLoginFailures(e.email);
 	let a = yield* t.listMemberships(e.id), o = l("sess");
 	yield* t.insertSession({
 		id: o,
@@ -108,16 +113,21 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		error: r.code,
 		message: r.message
 	});
-}), ge = 300, V = (r, i, a) => S.gen(function* () {
+}), be = 300, V = (r, i, a) => S.gen(function* () {
 	if (!r.email || !r.password) return F(400, { error: "email and password required" });
-	let o = yield* i.findByEmail(r.email), s = o?.passwordHash, c = typeof s == "string" && s.length > 0 ? yield* n(r.password, s) : yield* S.gen(function* () {
+	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
+	if (c.locked) return F(429, {
+		error: "account_locked",
+		retryAfterSeconds: c.retryAfterSeconds
+	});
+	let u = o?.passwordHash, d = typeof u == "string" && u.length > 0 ? yield* n(r.password, u) : yield* S.gen(function* () {
 		let n = yield* e("decoy-not-a-real-password").pipe(S.orElseSucceed(() => ""));
 		return yield* t(r.password, n), { valid: !1 };
 	});
-	if (!o || !c.valid) return F(401, { error: "invalid credentials" });
-	let u = yield* B(o, a);
-	if (u) return u;
-	if (c.rehash && (yield* i.updatePassword(o.id, c.rehash).pipe(S.ignore)), o.mfaEnrolledAt) {
+	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, M(a)), F(401, { error: "invalid credentials" });
+	let f = yield* B(o, a);
+	if (f) return f;
+	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(S.ignore)), o.mfaEnrolledAt) {
 		let e = h("mfa-pending", 300);
 		return yield* i.insertToken({
 			id: l("tok"),
@@ -132,14 +142,14 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			expiresInSeconds: 300
 		});
 	}
-	let { setCookie: d, subject: f } = yield* z(o, i, a, {
+	let { setCookie: p, subject: m } = yield* z(o, i, a, {
 		ipAddress: r.ipAddress ?? null,
 		userAgent: r.userAgent ?? null
 	});
-	return r.redirectAfter ? I(a.successRedirect ?? "/", { setCookie: d }) : F(200, {
+	return r.redirectAfter ? I(a.successRedirect ?? "/", { setCookie: p }) : F(200, {
 		ok: !0,
-		subject: f
-	}, { setCookie: d });
+		subject: m
+	}, { setCookie: p });
 }), H = (e, t, n) => S.gen(function* () {
 	if (!e.pendingToken) return F(400, { error: "pending token required" });
 	if (!e.code && !e.recoveryCode) return F(400, { error: "code or recoveryCode required" });
@@ -147,17 +157,22 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 	if (!r) return F(401, { error: "invalid or expired challenge" });
 	let i = yield* t.findById(r.userId);
 	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return F(401, { error: "mfa not enrolled" });
-	let a = yield* B(i, n);
-	if (a) return a;
-	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, m(e.recoveryCode.trim())) : yield* j(i.mfaSecret, e.code ?? "").pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return F(401, { error: "invalid_code" });
-	let { setCookie: o, subject: s } = yield* z(i, t, n, {
+	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
+	if (o.locked) return F(429, {
+		error: "account_locked",
+		retryAfterSeconds: o.retryAfterSeconds
+	});
+	let s = yield* B(i, n);
+	if (s) return s;
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, m(e.recoveryCode.trim())) : yield* A(i.mfaSecret, e.code ?? "").pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, M(n)), F(401, { error: "invalid_code" });
+	let { setCookie: c, subject: l } = yield* z(i, t, n, {
 		ipAddress: e.ipAddress ?? null,
 		userAgent: e.userAgent ?? null
 	});
-	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: o }) : F(200, {
+	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: c }) : F(200, {
 		ok: !0,
-		subject: s
-	}, { setCookie: o });
+		subject: l
+	}, { setCookie: c });
 }), U = (t, n, r) => S.gen(function* () {
 	if (!t.email || !t.password) return F(400, { error: "email and password required" });
 	if (t.password.length < 8) return F(400, { error: "password must be at least 8 characters" });
@@ -205,11 +220,11 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 }), G = (e, t) => S.gen(function* () {
 	let n = yield* t.findById(e.userId);
 	if (!n) return F(404, { error: "user_not_found" });
-	let r = k();
+	let r = O();
 	return yield* t.setMfaSecret(n.id, r).pipe(S.catchAll(() => S.succeed(n))), F(200, {
 		ok: !0,
 		secret: r,
-		otpauthUrl: A({
+		otpauthUrl: k({
 			issuer: e.issuer,
 			accountName: e.accountName,
 			secret: r
@@ -220,9 +235,9 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 	if (!n) return F(404, { error: "user_not_found" });
 	if (!n.mfaSecret) return F(400, { error: "no_enrollment_in_progress" });
 	if (n.mfaEnrolledAt) return F(409, { error: "already_enrolled" });
-	if (!(yield* j(n.mfaSecret, e.code).pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return F(401, { error: "invalid_code" });
+	if (!(yield* A(n.mfaSecret, e.code).pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return F(401, { error: "invalid_code" });
 	yield* t.markMfaEnrolled(n.id).pipe(S.catchAll(() => S.succeed(n)));
-	let r = M();
+	let r = j();
 	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => m(e))).pipe(S.ignore), F(200, {
 		ok: !0,
 		enrolled: !0,
@@ -232,18 +247,18 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 	let n = yield* t.findById(e.userId);
 	if (!n) return F(404, { error: "user_not_found" });
 	if (!n.mfaEnrolledAt) return F(400, { error: "mfa_not_enrolled" });
-	let r = M();
+	let r = j();
 	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => m(e))).pipe(S.ignore), F(200, {
 		ok: !0,
 		recoveryCodes: r
 	});
-}), _e = (e, t) => S.gen(function* () {
+}), xe = (e, t) => S.gen(function* () {
 	let n = yield* t.findById(e.userId);
 	return n ? (yield* t.clearMfa(n.id).pipe(S.catchAll(() => S.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(S.ignore), F(200, {
 		ok: !0,
 		enrolled: !1
 	})) : F(404, { error: "user_not_found" });
-}), ve = (e) => {
+}), Se = (e) => {
 	let t = v(P(e)), n = ae(g, t, {
 		httpOnly: !1,
 		sameSite: "lax",
@@ -252,7 +267,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		path: "/"
 	});
 	return F(200, { csrfToken: t }, { setCookie: n });
-}, ye = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, be = (e, t, n) => S.gen(function* () {
+}, Ce = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, we = (e, t, n) => S.gen(function* () {
 	if (!e.email) return F(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
@@ -264,7 +279,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			purpose: "magic-link",
 			expiresAt: i.expiresAt
 		}).pipe(S.ignore);
-		let a = ye(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		let a = Ce(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
 		n.sendEmail && (yield* S.tryPromise(() => n.sendEmail({
 			to: r.email,
 			kind: "magic-link",
@@ -275,7 +290,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		})).pipe(S.ignore));
 	}
 	return F(202, { ok: !0 });
-}), xe = (e, t, n) => S.gen(function* () {
+}), Te = (e, t, n) => S.gen(function* () {
 	if (!e.token) return F(400, { error: "token required" });
 	let r = yield* t.consumeToken(m(e.token), "magic-link");
 	if (!r) return F(401, { error: "invalid or expired token" });
@@ -301,7 +316,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		ok: !0,
 		subject: u
 	}, { setCookie: d.setCookie });
-}), Se = (e, t, n) => S.gen(function* () {
+}), Ee = (e, t, n) => S.gen(function* () {
 	if (!e.email) return F(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
@@ -313,7 +328,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			purpose: "password-reset",
 			expiresAt: i.expiresAt
 		}).pipe(S.ignore);
-		let a = ye(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		let a = Ce(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
 		n.sendEmail && (yield* S.tryPromise(() => n.sendEmail({
 			to: r.email,
 			kind: "password-reset",
@@ -324,14 +339,14 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		})).pipe(S.ignore));
 	}
 	return F(202, { ok: !0 });
-}), Ce = (t, n) => S.gen(function* () {
+}), De = (t, n) => S.gen(function* () {
 	if (!t.token || !t.newPassword) return F(400, { error: "token and newPassword required" });
 	if (t.newPassword.length < 8) return F(400, { error: "password must be at least 8 characters" });
 	let r = yield* n.consumeToken(m(t.token), "password-reset");
 	if (!r) return F(401, { error: "invalid or expired token" });
 	let i = yield* e(t.newPassword).pipe(S.orElseSucceed(() => ""));
 	return i ? (yield* n.updatePassword(r.userId, i).pipe(S.ignore), yield* n.revokeAllOtherSessions(r.userId, "__none__").pipe(S.ignore), F(200, { ok: !0 })) : F(500, { error: "hash_failed" });
-}), we = (e, t) => S.gen(function* () {
+}), Oe = (e, t) => S.gen(function* () {
 	return F(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
 		id: e.id,
 		tenantId: e.tenantId,
@@ -341,17 +356,17 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		lastSeenAt: e.lastSeenAt.toISOString(),
 		expiresAt: e.expiresAt.toISOString()
 	})) });
-}), Te = (e, t) => S.gen(function* () {
+}), ke = (e, t) => S.gen(function* () {
 	return (yield* t.revokeSession(e.userId, e.sessionId)) ? F(200, {
 		ok: !0,
 		revoked: 1
 	}) : F(404, { error: "session_not_found" });
-}), Ee = (e, t) => S.gen(function* () {
+}), Ae = (e, t) => S.gen(function* () {
 	return F(200, {
 		ok: !0,
 		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
 	});
-}), De = (e, t, n, r) => S.gen(function* () {
+}), je = (e, t, n, r) => S.gen(function* () {
 	let a = yield* t.findById(e.userId);
 	if (!a) return F(404, { error: "user_not_found" });
 	let o = yield* t.membershipRole(e.userId, e.targetTenantId);
@@ -373,7 +388,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		role: o,
 		subject: u
 	}, { setCookie: d.setCookie });
-}), Oe = (e, t) => S.gen(function* () {
+}), Me = (e, t) => S.gen(function* () {
 	return F(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
 		tenantId: e.tenantId,
 		role: e.role,
@@ -384,7 +399,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
 	...n
-}), ke = 3600 * 24 * 7, Ae = () => {
+}), Ne = 3600 * 24 * 7, Pe = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		put: (t, n, r) => S.sync(() => {
@@ -398,7 +413,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
 		})
 	};
-}, je = (e) => ({
+}, Fe = (e) => ({
 	put: (t, n, r) => S.gen(function* () {
 		let i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + r * 1e3);
 		(yield* e`
@@ -418,7 +433,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
       `)[0];
 		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
 	}).pipe(S.orElseSucceed(() => null))
-}), Y = 300, Me = (e, t, n, r) => S.gen(function* () {
+}), Y = 300, Ie = (e, t, n, r) => S.gen(function* () {
 	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
 	let i = y();
 	yield* n.put(`${e.userId}:register`, i, Y);
@@ -451,7 +466,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		},
 		timeout: Y * 1e3
 	});
-}), Ne = (e, t, n, r) => S.gen(function* () {
+}), Le = (e, t, n, r) => S.gen(function* () {
 	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
 	let i = yield* n.take(`${e.userId}:register`);
 	if (!i) return J(400, { error: "no_pending_challenge" });
@@ -473,7 +488,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		ok: !0,
 		credentialId: a.result.credentialId
 	})) : J(400, { error: a.error });
-}), Pe = (e, t, n, r) => S.gen(function* () {
+}), Re = (e, t, n, r) => S.gen(function* () {
 	let i = y(), a = e.userId ? `${e.userId}:assert` : "*:assert";
 	yield* n.put(a, i, Y);
 	let o = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
@@ -487,7 +502,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		userVerification: "preferred",
 		timeout: Y * 1e3
 	});
-}), Fe = (e, t, n, r, a) => S.gen(function* () {
+}), ze = (e, t, n, r, a) => S.gen(function* () {
 	let o = yield* t.findPasskey(e.credentialId);
 	if (!o) return J(401, { error: "unknown_credential" });
 	let s = e.userId ? `${e.userId}:assert` : "*:assert", c = yield* n.take(s);
@@ -513,7 +528,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		id: h,
 		userId: d.id,
 		tenantId: d.tenantId,
-		expiresAt: new Date(Date.now() + ke * 1e3),
+		expiresAt: new Date(Date.now() + Ne * 1e3),
 		ipAddress: null,
 		userAgent: null
 	}).pipe(S.ignore);
@@ -524,7 +539,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			sessionId: h
 		}
 	} : g, v = i(_, N(a), {
-		ttlSeconds: ke,
+		ttlSeconds: Ne,
 		...a.cookieDomain ? { domain: a.cookieDomain } : {},
 		secure: a.cookieSecure ?? !0
 	});
@@ -532,10 +547,10 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		ok: !0,
 		subject: _
 	}, { setCookie: v.setCookie });
-}), Ie = (e) => {
-	for (let t of e) if (Le(t)) return t.auth.sessionStrategy;
+}), Be = (e) => {
+	for (let t of e) if (Ve(t)) return t.auth.sessionStrategy;
 	return null;
-}, Le = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", Re = "/auth", ze = (e) => {
+}, Ve = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", He = "/auth", Ue = (e) => {
 	let t = Buffer.from(e.rawBody).toString("utf8");
 	if (!t) return {};
 	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
@@ -561,8 +576,8 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8"
-}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, Be = (e) => {
-	let t = e.prefix ?? Re, n = e.store, r = e.challengeStore ?? Ae(), o = {
+}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, We = (e) => {
+	let t = e.prefix ?? He, n = e.store, r = e.challengeStore ?? Pe(), o = {
 		...e.secret === void 0 ? {} : { secret: e.secret },
 		...e.secrets === void 0 ? {} : { secrets: e.secrets },
 		defaultTenantId: e.defaultTenantId,
@@ -571,7 +586,9 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		...e.successRedirect === void 0 ? {} : { successRedirect: e.successRedirect },
 		...e.sendEmail === void 0 ? {} : { sendEmail: e.sendEmail },
 		...e.appBaseUrl === void 0 ? {} : { appBaseUrl: e.appBaseUrl },
-		...e.subjectGuards === void 0 ? {} : { subjectGuards: e.subjectGuards }
+		...e.subjectGuards === void 0 ? {} : { subjectGuards: e.subjectGuards },
+		...e.lockout === void 0 ? {} : { lockout: e.lockout },
+		...e.now === void 0 ? {} : { now: e.now }
 	}, s = u(n, e.sessionRevocation ?? {}), c = async (e) => {
 		let t = N(o), r = a(e.headers.cookie, t);
 		if (!r) return null;
@@ -610,8 +627,8 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		method: "*",
 		path: t,
 		handle: async (i) => {
-			let a = i.method === "GET" ? {} : ze(i);
-			if (i.method === "GET" && m(i, "/csrf")) return X(ve(o));
+			let a = i.method === "GET" ? {} : Ue(i);
+			if (i.method === "GET" && m(i, "/csrf")) return X(Se(o));
 			if (i.method === "POST" && m(i, "/sign-in")) return h(V({
 				email: Q(a.email) ?? "",
 				password: Q(a.password) ?? "",
@@ -629,19 +646,19 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 				let e = await c(i);
 				return e && e.subject.type === "user" && e.sessionId && (await S.runPromise(n.revokeSession(e.subject.id, e.sessionId)), s.invalidate(e.sessionId)), X(W(o));
 			}
-			if (i.method === "POST" && m(i, "/magic-link")) return h(be({
+			if (i.method === "POST" && m(i, "/magic-link")) return h(we({
 				email: Q(a.email) ?? "",
 				...$("callbackPath", a.callbackPath)
 			}, n, o));
-			if (i.method === "POST" && m(i, "/magic-link/callback")) return h(xe({
+			if (i.method === "POST" && m(i, "/magic-link/callback")) return h(Te({
 				token: Q(a.token) ?? "",
 				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
 			}, n, o));
-			if (i.method === "POST" && m(i, "/password-reset")) return h(Se({
+			if (i.method === "POST" && m(i, "/password-reset")) return h(Ee({
 				email: Q(a.email) ?? "",
 				...$("callbackPath", a.callbackPath)
 			}, n, o));
-			if (i.method === "POST" && m(i, "/password-reset/confirm")) return h(Ce({
+			if (i.method === "POST" && m(i, "/password-reset/confirm")) return h(De({
 				token: Q(a.token) ?? "",
 				newPassword: Q(a.newPassword) ?? ""
 			}, n));
@@ -653,8 +670,8 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 				...i.headers["x-forwarded-for"] ? { ipAddress: i.headers["x-forwarded-for"] } : {},
 				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
 			}, n, o));
-			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/options")) return h(Pe({ ...$("userId", a.userId) }, n, r, e.passkey));
-			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/verify")) return h(Fe({
+			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/options")) return h(Re({ ...$("userId", a.userId) }, n, r, e.passkey));
+			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/verify")) return h(ze({
 				credentialId: Q(a.credentialId) ?? "",
 				clientDataJSON: Q(a.clientDataJSON) ?? "",
 				authenticatorData: Q(a.authenticatorData) ?? "",
@@ -672,11 +689,11 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			}
 			if (i.method === "GET" && m(i, "/sessions")) {
 				let e = p();
-				return "status" in e ? e : _(we({ userId: e.userId }, n));
+				return "status" in e ? e : _(Oe({ userId: e.userId }, n));
 			}
 			if (i.method === "GET" && m(i, "/memberships")) {
 				let e = p();
-				return "status" in e ? e : _(Oe({ userId: e.userId }, n));
+				return "status" in e ? e : _(Me({ userId: e.userId }, n));
 			}
 			if (i.method === "POST" && m(i, "/sessions/revoke")) {
 				let e = p();
@@ -684,21 +701,21 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 				let t = g();
 				if (t) return t;
 				let r = Q(a.sessionId) ?? "";
-				return _(Te({
+				return _(ke({
 					userId: e.userId,
 					sessionId: r
 				}, n)).then((e) => (r && s.invalidate(r), e));
 			}
 			if (i.method === "POST" && m(i, "/sessions/revoke-others")) {
 				let e = p();
-				return "status" in e ? e : g() || _(Ee({
+				return "status" in e ? e : g() || _(Ae({
 					userId: e.userId,
 					keepSessionId: u?.sessionId ?? "__none__"
 				}, n));
 			}
 			if (i.method === "POST" && m(i, "/switch-tenant")) {
 				let t = p();
-				return "status" in t ? t : g() || h(De({
+				return "status" in t ? t : g() || h(je({
 					userId: t.userId,
 					targetTenantId: Q(a.targetTenantId) ?? "",
 					...typeof a.clientId == "number" ? { clientId: a.clientId } : {},
@@ -727,7 +744,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			}
 			if (e.mfa && i.method === "POST" && m(i, "/mfa/unenroll")) {
 				let e = p();
-				return "status" in e ? e : g() || _(_e({ userId: e.userId }, n));
+				return "status" in e ? e : g() || _(xe({ userId: e.userId }, n));
 			}
 			if (e.mfa && i.method === "POST" && m(i, "/mfa/recovery-codes/regenerate")) {
 				let e = p();
@@ -735,14 +752,14 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			}
 			if (e.passkey && i.method === "POST" && m(i, "/passkey/register/options")) {
 				let t = p();
-				return "status" in t ? t : g() || _(Me({
+				return "status" in t ? t : g() || _(Ie({
 					userId: t.userId,
 					userName: Q(a.userName) ?? t.userId
 				}, n, r, e.passkey));
 			}
 			if (e.passkey && i.method === "POST" && m(i, "/passkey/register/verify")) {
 				let t = p();
-				return "status" in t ? t : g() || _(Ne({
+				return "status" in t ? t : g() || _(Le({
 					userId: t.userId,
 					credentialId: Q(a.credentialId) ?? "",
 					clientDataJSON: Q(a.clientDataJSON) ?? "",
@@ -756,7 +773,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 		name: e.name ? `@voltro/plugin-auth#${e.name}` : "@voltro/plugin-auth",
 		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
 		permissions: [],
-		declaredEnv: Ve,
+		declaredEnv: Ge,
 		httpRoutes: [v],
 		onActivate: (n) => S.sync(() => {
 			n.logger.info("auth routes active", {
@@ -776,7 +793,7 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 			revocation: s
 		}) }
 	};
-}, Ve = [
+}, Ge = [
 	{
 		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
 		required: !1,
@@ -800,4 +817,4 @@ var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
 	}
 ];
 //#endregion
-export { z as A, Se as C, W as D, V as E, A as F, j as I, C as L, M, he as N, U as O, k as P, Ce as S, Te as T, G as _, Fe as a, _e as b, Ae as c, B as d, ve as f, be as g, xe as h, Pe as i, E as j, De as k, ge as l, we as m, Ie as n, Me as o, Oe as p, je as r, Ne as s, Be as t, N as u, K as v, Ee as w, H as x, q as y };
+export { z as A, Ee as C, W as D, V as E, k as F, A as I, C as L, j as M, ge as N, U as O, O as P, De as S, ke as T, G as _, ze as a, xe as b, Pe as c, B as d, Se as f, we as g, Te as h, Re as i, E as j, je as k, be as l, Oe as m, Be as n, Ie as o, Me as p, Fe as r, Le as s, We as t, N as u, K as v, Ae as w, H as x, q as y };

package/dist/plugin.d.ts

@@ -49,6 +49,20 @@ declare interface AuthConfig {
      *  but any concern (unverified email, suspended tenant, …) can hook here.
      *  Absent / empty ⇒ every authenticated user proceeds unchanged. */
     readonly subjectGuards?: ReadonlyArray<SubjectGuard>;
+    /** Brute-force lockout. After `maxAttempts` failed credential attempts
+     *  (wrong password OR wrong MFA code) within `windowSeconds`, the account —
+     *  keyed by EMAIL, so an unknown address locks exactly like a real one and
+     *  the lock can't be used as an existence oracle — is refused with a 429 for
+     *  `lockSeconds`; a completed login clears the counter. ON by default (a
+     *  security default, not opt-in); raise `maxAttempts` very high to disable. */
+    readonly lockout?: {
+        readonly maxAttempts?: number;
+        readonly windowSeconds?: number;
+        readonly lockSeconds?: number;
+    };
+    /** Injectable clock (epoch-ms) for the lockout counter. Default `Date.now`;
+     *  tests pass a controllable one to exercise window/lock expiry. */
+    readonly now?: () => number;
 }
 
 /**
@@ -108,6 +122,26 @@ declare interface ChallengeStore {
  */
 export declare const getAuthSessionStrategy: (plugins: ReadonlyArray<VoltroPlugin>) => AuthStrategy | null;
 
+/**
+ * Brute-force lockout policy, resolved from `AuthConfig.lockout` and passed
+ * INTO the store on each failure so the store itself stays policy-free.
+ * Times in milliseconds; `now` everywhere is epoch-ms so tests can inject a
+ * clock. Kept keyed by EMAIL (not user id) on purpose — a locked account must
+ * not read differently from an unknown one, or the lock becomes an existence
+ * oracle. See `loginAttemptsTable`.
+ */
+declare interface LockoutPolicy {
+    readonly maxAttempts: number;
+    readonly windowMs: number;
+    readonly lockMs: number;
+}
+
+declare interface LockoutState {
+    readonly locked: boolean;
+    /** Seconds until the lock lifts; 0 when not locked. */
+    readonly retryAfterSeconds: number;
+}
+
 /** One tenant a user belongs to. The active tenant lives on the Subject;
  *  the full set drives the switch-tenant menu + the switch-tenant guard. */
 declare interface MembershipRecord {
@@ -396,6 +430,16 @@ declare interface UserStore {
      *  the write are ONE atomic statement at the store, so two replicas
      *  racing the same counter can't both succeed. */
     readonly advancePasskeyCounter: (credentialId: string, newCounter: number) => Effect.Effect<boolean>;
+    /** Is this email currently locked out? Reads only — never mutates. Returns
+     *  the remaining cooldown so the handler can surface a retry-after. */
+    readonly isLockedOut: (email: string, now: number) => Effect.Effect<LockoutState>;
+    /** Record one failed credential attempt for `email`. Opens a fresh window
+     *  when the previous one (or a prior lock) has expired, otherwise increments;
+     *  sets the lock once `failedCount` reaches `policy.maxAttempts`. Called only
+     *  for a NOT-currently-locked email (the handler checks `isLockedOut` first). */
+    readonly recordLoginFailure: (email: string, now: number, policy: LockoutPolicy) => Effect.Effect<void>;
+    /** Clear the counter for `email` on a completed login. */
+    readonly clearLoginFailures: (email: string) => Effect.Effect<void>;
 }
 
 export { }

package/dist/plugin.js

@@ -1,4 +1,4 @@
 import "./session.js";
-import { n as e, t } from "./plugin-HgTMFY3m.js";
+import { n as e, t } from "./plugin-ZXs8LFn0.js";
 import "./csrf.js";
 export { t as authRoutesPlugin, e as getAuthSessionStrategy };

package/dist/schema.d.ts

@@ -1,7 +1,7 @@
 import { TableLike } from '@voltro/database';
 
 /** Tables the plugin contributes, as an array. */
-export declare const authTables: readonly [TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike];
+export declare const authTables: readonly [TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike];
 
 /**
  * Auth-token table. Single-use, hashed, expiring tokens for the
@@ -12,6 +12,16 @@ export declare const authTables: readonly [TableLike, TableLike, TableLike, Tabl
  */
 export declare const authTokensTable: TableLike;
 
+/**
+ * Login-attempt counters for brute-force lockout, keyed by normalized
+ * email — NOT by user id. Tracking the EMAIL (whether or not a user row
+ * exists) is what keeps a locked account from leaking its existence: an
+ * unknown email that has been hammered locks exactly like a real one, so
+ * the refusal is uniform. `handleSignIn` records a failure on every wrong
+ * credential and clears the row on a completed login.
+ */
+export declare const loginAttemptsTable: TableLike;
+
 /**
  * Memberships table. A user belongs to MANY tenants; each row is one
  * membership with a `role`. The active tenant lives on the Subject, but

package/dist/schema.js

@@ -53,14 +53,23 @@ var a = n("users", {
 	challenge: r(),
 	expiresAt: i(),
 	createdAt: i().default("now")
-}), f = [
+}), f = n("loginAttempts", {
+	id: e(),
+	email: r().unique(),
+	failedCount: t().default(0),
+	windowStartedAt: i().nullable(),
+	lockedUntil: i().nullable(),
+	createdAt: i().default("now"),
+	updatedAt: i().default("now").onUpdate("now")
+}), p = [
 	a,
 	o,
 	s,
 	c,
 	l,
 	u,
-	d
+	d,
+	f
 ];
 //#endregion
-export { f as authTables, c as authTokensTable, s as membershipsTable, d as passkeyChallengesTable, l as passkeysTable, u as recoveryCodesTable, o as sessionsTable, a as usersTable };
+export { p as authTables, c as authTokensTable, f as loginAttemptsTable, s as membershipsTable, d as passkeyChallengesTable, l as passkeysTable, u as recoveryCodesTable, o as sessionsTable, a as usersTable };